Edit tour

Windows Analysis Report
https://booking.search-13125.com/6513881796

Overview

General Information

Sample URL:	https://booking.search-13125.com/6513881796
Analysis ID:	1389406
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Creates files inside the system directory

Found iframes

HTML body contains password input but no form action

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6428 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5524 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1980,i,14640437719870964142,12986360728299235327,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6432 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://booking.search-13125.com/6513881796 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://booking.search-13125.com/6513881796	Avira URL Cloud: detection malicious, Label: phishing
Source: https://booking.search-13125.com/6513881796	SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

Source: https://account.booking.com/sign-in?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA	HTTP Parser: Iframe src: https://www.booking.com/cookiebanner.html
Source: https://account.booking.com/sign-in?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA	HTTP Parser: Iframe src: https://www.booking.com/cookiebanner.html

Source: https://account.booking.com/sign-in?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA

HTTP Parser: <input type="password" .../> found but no <form action="...

HTTP Parser: Title: Booking.com does not match URL

HTTP Parser: <input type="password" .../> found

Source: https://td.doubleclick.net/td/rul/1060768846?random=1707417344498&cv=11&fst=1707417344498&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nh4qqVoyv2KiIad5kPNddW86jrjYgKSk8&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bb...	HTTP Parser: No favicon
Source: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html	HTTP Parser: No favicon
Source: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/aframe	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/aframe	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/aframe	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&cb=pehgtvg39f6l	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&cb=8mbox63omknd	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&cb=8mbox63omknd	HTTP Parser: No favicon
Source: https://8ef290e4a40aabf645d441eeb66eb6e1.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&cb=k6nv978x042h	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&cb=k6nv978x042h	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&cb=c94raoawdzt3	HTTP Parser: No favicon

Source: https://account.booking.com/sign-in?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA	HTTP Parser: No <meta name="author".. found
Source: https://account.booking.com/sign-in?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA	HTTP Parser: No <meta name="author".. found

Source: https://account.booking.com/sign-in?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA	HTTP Parser: No <meta name="copyright".. found
Source: https://account.booking.com/sign-in?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.5:49717 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /6513881796 HTTP/1.1Host: booking.search-13125.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: booking.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.booking.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /static/css/gprof_icons_cloudfront_sd.iq_ltr/f2fce41920df3c9225af5c680c3a8127d2caaceb.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/incentives_cloudfront_sd.iq_ltr/f1558a6e9832a4eb8cfe1d3d14db176bd3564335.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/index_cloudfront_sd.iq_ltr/903b49ae71c75322442d1bc9a0dc298bb8a6e32e.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/main_cloudfront_sd.iq_ltr/e6474733abba1cd6bc8a66bea1aa8643d7435c30.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/core-deps-inlinedet_cloudfront_sd/789c67928e597e7a413f9e99763adab71edbbfa8.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/main_exps_cloudfront_sd.iq_ltr/586b07455f7783cafa801bdea38881f1f98ad36d.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/jquery_cloudfront_sd/e1e8c0e862309cb4caf3c0d5fbea48bfb8eaad42.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/main_cloudfront_sd/22b1462412c8a51090dedf2fbe6ad45b3d8e8cf4.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/index_cloudfront_sd/803ec559148a8e5c7a9eb8c3720e492f09588177.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/landingpage_cloudfront_sd/4417f0cf113c3ec51a8190be88e7c373a6d9295d.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/searchbox_cloudfront_sd/2ef4e9ae9240f4bd123bc5c51eed3c306e710ecb.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/xp-index-sb_cloudfront_sd.iq_ltr/5b5ab8ab66a5ce3092875d0725122439c4f2dfdd.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/dc32f6b7.745c5004.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/error_catcher_bec_cloudfront_sd/0acd2ada6c74d5dec978a04ea837952bdf050cd2.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/720x217/308526620.jpeg?k=0663a1420ea98a013af0eda32bb4d11258521a39c5b8a5a4e2777ee5661dee55&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/18cad957.d04abce3.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/client.38ffee15.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/7bcb015e.5b709f3d.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/eb60141d.cad86b29.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/c6a78acb.bffda4a9.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/f50a2dfc.837540b6.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/a6a21c13.8939445f.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/f5d0e2e7.a54d85eb.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/720x217/308526620.jpeg?k=0663a1420ea98a013af0eda32bb4d11258521a39c5b8a5a4e2777ee5661dee55&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/43e47265.9fb0fb7a.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/d2a738da.079c3b4c.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/1baf5a63.539e3a8f.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/4e596c2c.3a2fb681.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/21928fd5.c540d700.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/8207c303.9807c216.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/3d066b0d.a994f040.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/445be7a9.b944bd98.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/53a8d0d3.b1818b84.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/cfbdd235.7a595d50.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /libs/privacy-consent/releases/2.1.49/customer/cookie-banner.min.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/genius_vip_cloudfront_sd/aae975495cc56436f4f59463b9ea4e594bdb102a.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/sp-on-maps_cloudfront_sd/d30eef4dc5202875d4c3301b8a0e8ff09f9a0e28.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/raf_cloudfront_sd/92b3daaabd4371c78818992ce9342e212f673b31.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/crossorigin_check_cloudfront_sd/2454015045ef79168d452ff4e7f30bdadff0aa81.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/tfl/group_logos/logo_booking/27c8d1832de6a3123b6ee45b59ae2f81b0d9d0d0.png HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/lazy_load_images_cloudfront_sd/77204d4da4aa41b08b1a4062c8e66e4629550994.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/otSDKStub.js HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/tfl/group_logos/logo_priceline/f80e129541f2a952d470df2447373390f3dd4e44.png HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/tfl/group_logos/logo_kayak/83ef7122074473a6566094e957ff834badb58ce6.png HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js_tracking?ver=2&stype=1&ref_action=index&lang=en-us&pid=e4de82b919b800e4&aid=304142&sid=5171fc655664ddf74ab763a094523fb7&ete=&etg=&etcg=cCHObKdPHMfFdHMEKdbfZRLRMLFSZaTaTaET\|1&ets=cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6X-Booking-CSRF: M1fFZQAAAAA=ow_iJm02C23yTbeZTjDwFw3ODjezY3bK5FHdo-YoJdT7GCkrsQ32GPbbWguo4KloItJB_vA0z9Y_xRO57ct8Amr5W_XGX_7GZSpQGGcZ9tRZ2sLvFoX1OvJhoh8lHbncqueaPtPA9hz8Y_-xROuXkd4r2dhb8qRB-XM9-fcVbZ1TIOfkTWMBhv8vt5DNEpcahji4EEgpTuAdyxqGsec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: e4de82b919b800e4X-Booking-Info: X-Booking-SiteType-Id: 1X-Requested-With: XMLHttpRequestX-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhDMSfLvcMG2VHcbU0a02MOY%2FoE3Pj42bdhHH9WLLA1HPYkJysgulFoMrtOulTRBzpAAVSg2Ic64ufepnGAfylJXnqeKJvDEAHVmYnj3dbGB7ygVV2JkX124%2BEixWTdIqcGu5Kd0Dv6tKmcPbpsN1xr5; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone
Source: global traffic	HTTP traffic detected: GET /static/img/tfl/group_logos/logo_agoda/1c9191b6a3651bf030e41e99a153b64f449845ed.png HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/tfl/group_logos/logo_rentalcars/6bc5ec89d870111592a378bbe7a2086f0b01abc4.png HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/remoteEntry.4935f89c.client.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/tfl/group_logos/logo_opentable/a4b50503eda6c15773d6e61c238230eb42fb050d.png HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /design-assets/assets/v3.81.0/fonts-brand/BookingRegular.woff HTTP/1.1Host: t-cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cf.bstatic.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /design-assets/assets/v3.81.0/fonts-brand/BookingExtraBold.woff HTTP/1.1Host: t-cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cf.bstatic.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /design-assets/assets/v3.81.0/fonts-brand/BookingMedium.woff HTTP/1.1Host: t-cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cf.bstatic.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /design-assets/assets/v3.81.0/fonts-brand/BookingBold.woff HTTP/1.1Host: t-cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cf.bstatic.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/500x500/184698944.png?k=6bb1bf3c13db4a7ba3c22a2d1f1051f793c525a78104703b4dec3eb12101f545&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/714x300/293799350.jpeg?k=8a6f4e24c37096fbdcd3c3d30c9f3dcea15ce35751448466decf791918012a64&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/fonts/booking-iconset-original/29bca18dce5a8e111855e31314a9b1d750ea9beb.woff2 HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cf.bstatic.com/static/css/gprof_icons_cloudfront_sd.iq_ltr/f2fce41920df3c9225af5c680c3a8127d2caaceb.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/3ea94870-d4b1-483a-b1d2-faf1d982bb31.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/tfl/group_logos/logo_booking/27c8d1832de6a3123b6ee45b59ae2f81b0d9d0d0.png HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js_tracking?ver=2&stype=1&ref_action=index&lang=en-us&pid=e4de82b919b800e4&aid=304142&sid=5171fc655664ddf74ab763a094523fb7&ete=&etg=&etcg=&ets=cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3X-Booking-CSRF: M1fFZQAAAAA=ow_iJm02C23yTbeZTjDwFw3ODjezY3bK5FHdo-YoJdT7GCkrsQ32GPbbWguo4KloItJB_vA0z9Y_xRO57ct8Amr5W_XGX_7GZSpQGGcZ9tRZ2sLvFoX1OvJhoh8lHbncqueaPtPA9hz8Y_-xROuXkd4r2dhb8qRB-XM9-fcVbZ1TIOfkTWMBhv8vt5DNEpcahji4EEgpTuAdyxqGsec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: e4de82b919b800e4X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,1912460\|1,1856870\|1,1912460\|7,1912460\|6,1908890\|1X-Booking-SiteType-Id: 1X-Requested-With: XMLHttpRequestX-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhDMSfLvcMG2VHcbU0a02MOY%2FoE3Pj42bdhHH9WLLA1HPYkJysgulFoMrtOulTRBzpAAVSg2Ic64ufepnGAfylJXnqeKJvDEAHVmYnj3dbGB7ygVV2JkX124%2BEixWTdIqcGu5Kd0Dv6tKmcPbpsN1xr5; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1
Source: global traffic	HTTP traffic detected: GET /gsi/client HTTP/1.1Host: accounts.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /static/img/tfl/group_logos/logo_opentable/a4b50503eda6c15773d6e61c238230eb42fb050d.png HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/dc32f6b7.30f8c5b3.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/remoteEntry.f0866eea.client.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/remoteEntry.aaaa260d.client.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/fonticons_clean/base64/woff/5d61b8a7156073e5e3e9741f65dda44ae3eef7d2.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/tfl/group_logos/logo_agoda/1c9191b6a3651bf030e41e99a153b64f449845ed.png HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/tfl/group_logos/logo_kayak/83ef7122074473a6566094e957ff834badb58ce6.png HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/18cad957.fe671709.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/tfl/group_logos/logo_rentalcars/6bc5ec89d870111592a378bbe7a2086f0b01abc4.png HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/714x300/293799350.jpeg?k=8a6f4e24c37096fbdcd3c3d30c9f3dcea15ce35751448466decf791918012a64&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/tfl/group_logos/logo_priceline/f80e129541f2a952d470df2447373390f3dd4e44.png HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/500x500/184698944.png?k=6bb1bf3c13db4a7ba3c22a2d1f1051f793c525a78104703b4dec3eb12101f545&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logo?ver=1&sid=5171fc655664ddf74ab763a094523fb7&t=17074173311 HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhDMSfLvcMG2VHcbU0a02MOY%2FoE3Pj42bdhHH9WLLA1HPYkJysgulFoMrtOulTRBzpAAVSg2Ic64ufepnGAfylJXnqeKJvDEAHVmYnj3dbGB7ygVV2JkX124%2BEixWTdIqcGu5Kd0Dv6tKmcPbpsN1xr5; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1
Source: global traffic	HTTP traffic detected: GET /js_tracking?ver=2&stype=1&ref_action=index&lang=en-us&pid=e4de82b919b800e4&aid=304142&sid=5171fc655664ddf74ab763a094523fb7&ete=&etg=&etcg=cCHObKdPHMfFdHMEKdbfZRLRMLFSZaTaTaET\|1&ets=cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhDMSfLvcMG2VHcbU0a02MOY%2FoE3Pj42bdhHH9WLLA1HPYkJysgulFoMrtOulTRBzpAAVSg2Ic64ufepnGAfylJXnqeKJvDEAHVmYnj3dbGB7ygVV2JkX124%2BEixWTdIqcGu5Kd0Dv6tKmcPbpsN1xr5; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/remoteEntry.b27ba5a8.client.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/client.1b521280.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/4a89d2db.6c0ec4b3.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/3ea94870-d4b1-483a-b1d2-faf1d982bb31.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLalZib7103qG%2BF6jNX4nY1OEBjrxAz9Ob8DEQBWTSqeRvOh6i7KV3uDpo7lfSd6A33jZhjYHawln8E0aqfSwxomTxD7gRkwilYph1WF73PdYDrYV%2FBds8KeGhbWuYLP5WRjHVQWXCaBnPp2c6UP9oiZIrDu36czsM%3D
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/0a098284.df965884.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js_tracking?ver=2&stype=1&ref_action=index&lang=en-us&pid=e4de82b919b800e4&aid=304142&sid=5171fc655664ddf74ab763a094523fb7&ete=&etg=&etcg=&ets=cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLalZib7103qG%2BF6jNX4nY1OEBjrxAz9Ob8DEQBWTSqeRvOh6i7KV3uDpo7lfSd6A33jZhjYHawln8E0aqfSwxomTxD7gRkwilYph1WF73PdYDrYV%2FBds8KeGhbWuYLP5WRjHVQWXCaBnPp2c6UP9oiZIrDu36czsM%3D
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/7bcb015e.cf9d45ea.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/eb60141d.05ae682b.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logo?ver=1&sid=5171fc655664ddf74ab763a094523fb7&t=17074173311 HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLalZib7103qG%2BF6jNX4nY1OEBjrxAz9Ob8DEQBWTSqeRvOh6i7KV3uDpo7lfSd6A33jZhjYHawln8E0aqfSwxomTxD7gRkwilYph1WF73PdYDrYV%2FBds8KeGhbWuYLP5WRjHVQWXCaBnPp2c6UP9oiZIrDu36czsM%3D; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/c6a78acb.9b7b7bd0.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/f50a2dfc.854e46ce.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/202310.2.0/otBannerSdk.js HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/a6a21c13.ad9f14d9.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/f5d0e2e7.5cd38fd6.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /privacy-consents/implicit HTTP/1.1Host: account.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLalZib7103qG%2BF6jNX4nY1OEBjrxAz9Ob8DEQBWTSqeRvOh6i7KV3uDpo7lfSd6A33jZhjYHawln8E0aqfSwxomTxD7gRkwilYph1WF73PdYDrYV%2FBds8KeGhbWuYLP5WRjHVQWXCaBnPp2c6UP9oiZIrDu36czsM%3D; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; lastSeen=0; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJlNTJkY2Q1MS02OTliLTQ1ZTgtODA3MC03Y2M5MWE1NzM1NmIiLCJzZXNzaW9ucyI6W119fQ; bkng_sso_ses=e30; bkng_sso_session=e30
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/43e47265.79cb7ba8.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/d2a738da.35cba7bb.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/1baf5a63.d24b4ba9.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/4e596c2c.d3513b52.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/21928fd5.cc39b346.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/8207c303.4d6b40b0.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-116109-18&cid=421694156.1707417338&jid=1238114313&_u=aGBAgAIJAAAAAGgMIAC~&z=2006954226 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf/en-us.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js_tracking?ver=2&stype=1&ref_action=index&lang=en-us&pid=e4de82b919b800e4&aid=304142&sid=5171fc655664ddf74ab763a094523fb7&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|1&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3X-Booking-CSRF: M1fFZQAAAAA=ow_iJm02C23yTbeZTjDwFw3ODjezY3bK5FHdo-YoJdT7GCkrsQ32GPbbWguo4KloItJB_vA0z9Y_xRO57ct8Amr5W_XGX_7GZSpQGGcZ9tRZ2sLvFoX1OvJhoh8lHbncqueaPtPA9hz8Y_-xROuXkd4r2dhb8qRB-XM9-fcVbZ1TIOfkTWMBhv8vt5DNEpcahji4EEgpTuAdyxqGsec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: e4de82b919b800e4X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,1912460\|1,1856870\|1,1912460\|7,1912460\|6,1908890\|1X-Booking-SiteType-Id: 1X-Requested-With: XMLHttpRequestX-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLalZib7103qG%2BF6jNX4nY1OEBjrxAz9Ob8DEQBWTSqeRvOh6i7KV3uDpo7lfSd6A33jZhjYHawln8E0aqfSwxomTxD7gRkwilYph1WF73PdYDrYV%2FBds8KeGhbWuYLP5WRjHVQWXCaBnPp2c6UP9oiZIrDu36czsM%3D; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; lastSeen=0; bkng_sso_ses=e30; bkng_sso_session=e30; OptanonConsent=impl
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/3d066b0d.6a5d1f73.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/445be7a9.e9bb815f.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/53a8d0d3.8742f23d.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-116109-18&cid=421694156.1707417338&jid=1238114313&_u=aGBAgAIJAAAAAGgMIAC~&z=2006954226 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/cfbdd235.02b9cad2.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf/en-us.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/202310.2.0/assets/otCommonStyles.css HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/540x270/977409.jpg?k=82c14f9e6cea94829ee0528a3aa4324111d3482e9f095194500746fa7ca2769e&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js_tracking?ver=2&stype=1&ref_action=index&lang=en-us&pid=e4de82b919b800e4&aid=304142&sid=5171fc655664ddf74ab763a094523fb7&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|1&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLalZib7103qG%2BF6jNX4nY1OEBjrxAz9Ob8DEQBWTSqeRvOh6i7KV3uDpo7lfSd6A33jZhjYHawln8E0aqfSwxomTxD7gRkwilYph1WF73PdYDrYV%2FBds8KeGhbWuYLP5WRjHVQWXCaBnPp2c6UP9oiZIrDu36czsM%3D; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; lastSeen=0; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A39+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/540x270/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/354x266/977416.jpg?k=ea06e0b572ff052f4fe4fcf35ac3616e8d1b7300f0402756c460a4e9c19e54ed&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/354x266/619763.jpg?k=3bfc62a779df5b92694287e9fc0b82d795f93700ddf8887d66f3191ee745dcc5&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/354x266/977346.jpg?k=0afb2125e3ce4648cf017d8dc1c2c73ce97eea5d441e17b3cc2106b2c5816029&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/b9a82cb8.c62928a4.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/7bcb015e.5b709f3d.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "8b761ecf11f6b807d0d765ee8cd5851e"If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/eb60141d.cad86b29.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "2980ea90c3f4c27d77bffbd1527870a7"If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/c6a78acb.bffda4a9.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "6f3e8bb7938a05e927b3ca4454f98fa8"If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/f50a2dfc.837540b6.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "fdb620d16ddcb3d874c0d96880365b4d"If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/a6a21c13.8939445f.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "e262f92e286a4c74280bd4b3fdee8cbb"If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/540x270/977409.jpg?k=82c14f9e6cea94829ee0528a3aa4324111d3482e9f095194500746fa7ca2769e&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/540x270/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/354x266/977346.jpg?k=0afb2125e3ce4648cf017d8dc1c2c73ce97eea5d441e17b3cc2106b2c5816029&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/354x266/619763.jpg?k=3bfc62a779df5b92694287e9fc0b82d795f93700ddf8887d66f3191ee745dcc5&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/354x266/977416.jpg?k=ea06e0b572ff052f4fe4fcf35ac3616e8d1b7300f0402756c460a4e9c19e54ed&o= HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/202310.2.0/assets/otCommonStyles.css HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /web-vitals/send-vitals HTTP/1.1Host: web-vitals.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLalZib7103qG%2BF6jNX4nY1OEBjrxAz9Ob8DEQBWTSqeRvOh6i7KV3uDpo7lfSd6A33jZhjYHawln8E0aqfSwxomTxD7gRkwilYph1WF73PdYDrYV%2FBds8KeGhbWuYLP5WRjHVQWXCaBnPp2c6UP9oiZIrDu36czsM%3D; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; lastSeen=0; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/f5d0e2e7.a54d85eb.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "88d8b9631fe60984baabd22260a86e6e"If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/43e47265.9fb0fb7a.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "f1d67c93f1232808b430d12e5d784b19"If-Modified-Since: Wed, 07 Feb 2024 14:34:00 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/d2a738da.079c3b4c.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "1a7c523a95596c5b0b122ad8d8e3b553"If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/1baf5a63.539e3a8f.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "e66324ef6e0246820fb69426fdb7b8ad"If-Modified-Since: Wed, 07 Feb 2024 14:34:00 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/21928fd5.c540d700.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "c4aa6cc0b7d7b70cd0b7409f2336e955"If-Modified-Since: Wed, 07 Feb 2024 14:34:00 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/3d066b0d.a994f040.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "054c06419579fbe2660760d03e545650"If-Modified-Since: Wed, 07 Feb 2024 14:34:00 GMT
Source: global traffic	HTTP traffic detected: GET /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=BXAbRIVE HTTP/1.1Host: accommodations.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/jsonx-booking-et-serialized-state: EFB4182z3JoJxbpLmYz6l9XMO8uwQw5vy57VA6rLJax-JW2gEd2Ycalwc-8XMLrKvsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.booking.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLalZib7103qG%2BF6jNX4nY1OEBjrxAz9Ob8DEQBWTSqeRvOh6i7KV3uDpo7lfSd6A33jZhjYHawln8E0aqfSwxomTxD7gRkwilYph1WF73PdYDrYV%2FBds8KeGhbWuYLP5WRjHVQWXCaBnPp2c6UP9oiZIrDu36czsM%3D; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; lastSeen=0; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/445be7a9.b944bd98.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "9f91bb862449cb9e9205f6f0a89b9eca"If-Modified-Since: Wed, 07 Feb 2024 14:34:00 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/53a8d0d3.b1818b84.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "f820477c322829e348f318a453e432a5"If-Modified-Since: Thu, 08 Feb 2024 11:37:52 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/cfbdd235.7a595d50.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "f22efe190d4cdfd20e43049d1c12a165"If-Modified-Since: Wed, 07 Feb 2024 14:34:00 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/dc32f6b7.745c5004.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "65c942cfa2287ad1959f9b9eca30ff42"If-Modified-Since: Tue, 06 Feb 2024 05:14:55 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/b9a82cb8.5aa6563f.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/4e596c2c.3a2fb681.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "51be0c43cc481b13fe70d3ba27e2ffd9"If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=1707417341870; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBnYyLv%2F3rWI%2F2bePxxk2XFhPOKX7DXTroWPOGIe%2FZow1mdV9fpLjCZpCnqq4p6iMnpP9EpkYDRBvZ8y1Nr09ooyfDWYFtO1TDow0eLqIfN3R57GuM%2FiEXeNLeHGI5xRs50EKrz4llVsAb7PkITjdjzTUb%2FnrB03fY%3D
Source: global traffic	HTTP traffic detected: GET /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=BXAbRIVE HTTP/1.1Host: accommodations.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; lastSeen=1707417341870; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBnYyLv%2F3rWI%2F2bePxxk2XFhPOKX7DXTroWPOGIe%2FZow1mdV9fpLjCZpCnqq4p6iMnpP9EpkYDRBvZ8y1Nr09ooyfDWYFtO1TDow0eLqIfN3R57GuM%2FiEXeNLeHGI5xRs50EKrz4llVsAb7PkITjdjzTUb%2FnrB03fY%3D
Source: global traffic	HTTP traffic detected: GET /sendlayoutevents HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=1707417341870; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhAD4WLlocJITBMa3rDvM%2FTul1zrgyV20Oep4%2ByzvFe9TEP4%2FCO7SWdV4nDvU%2BPb6T8tysYngKSx198oV9JBFKQ14%2FRJ75raZDQGoIW6X8k3KrgZ8J43VSKpt36%2FaOYflD1Q6oFd0cBFlEO2ZPIWEaSdI7bMOXiUsqw%3D
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js?render=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&onload=onLoadRecaptchaV3Callback&_=1707417334976 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /static/css/print/0cc4ce4b7108d42a9f293fc9b654f749d84ba4eb.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/searchresults_cloudfront_sd.iq_ltr/a80f32e7f9693f304c247b0f22b0f109a5fd7dd6.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/searchresults_cloudfront_sd/cede9dd040e94f8940ffa9b1176616cd398b0973.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gsi/fedcm.json HTTP/1.1Host: accounts.google.comConnection: keep-aliveAccept: application/jsonSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: webidentityUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gsi/style HTTP/1.1Host: accounts.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /static/js/atlas_cloudfront_sd/7aaea4329a86dd9e6dc4d51a92fef5573f6f9c09.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /.well-known/web-identity HTTP/1.1Host: google.comConnection: keep-aliveAccept: application/jsonSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: webidentityUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/atlas_cst_cloudfront_sd/138d388521c0fb45e14005cb8098ebebb7158dce.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/calendar2_cloudfront_sd/06071dd1c4e89fbe99e5ad6e21584a6bf9585e84.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/2880x868/308526620.jpeg?k=0663a1420ea98a013af0eda32bb4d11258521a39c5b8a5a4e2777ee5661dee55&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /.well-known/web-identity HTTP/1.1Host: www.google.comConnection: keep-aliveAccept: application/jsonSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: webidentityUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sendlayoutevents HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=1707417341870; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhAD4WLlocJITBMa3rDvM%2FTul1zrgyV20Oep4%2ByzvFe9TEP4%2FCO7SWdV4nDvU%2BPb6T8tysYngKSx198oV9JBFKQ14%2FRJ75raZDQGoIW6X8k3KrgZ8J43VSKpt36%2FaOYflD1Q6oFd0cBFlEO2ZPIWEaSdI7bMOXiUsqw%3D
Source: global traffic	HTTP traffic detected: GET /design-assets/assets/v3.109.0/images-flags/Us@3x.png HTTP/1.1Host: t-cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/favicon/9ca83ba2a5a3293ff07452cb24949a5843af4592.svg HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=e4de82b919b800e4&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|4,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|2,cCHObKdBdUHINPSXeHDALOLOLMO\|5,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv= HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-ET-Serialized-State: EFB4182z3JoJxbpLmYz6l9XMO8uwQw5vy57VA6rLJax-JW2gEd2Ycalwc-8XMLrKvX-Booking-Language-Code: en-usX-Booking-Client-Info: sec-ch-ua-mobile: ?0X-Booking-AID: 304142User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: e4de82b919b800e4X-Booking-Info: X-Booking-SiteType-Id: 1X-Booking-Session-Id: db6e5bbb32eac0e80cfcae9b22f5390dsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48
Source: global traffic	HTTP traffic detected: GET /safeframe/1-0-40/html/container.html HTTP/1.1Host: 6187c7943c8809a450d5ea0d812d35d9.safeframe.googlesyndication.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/challenge.js HTTP/1.1Host: d8c14d4960ca.edge.sdk.awswaf.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/searchresults_slick_cloudfront_sd/528359eb9f21194adf8c26f81e07c6eb21a2cc89.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ct/core.js HTTP/1.1Host: s.pinimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /td/fls/rul/activityi;fledge=1;src=4228414;type=views;cat=views;ord=4995395844978;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=2105455417;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /scevent.min.js HTTP/1.1Host: sc-static.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gsi/fedcm/listaccounts HTTP/1.1Host: accounts.google.comConnection: keep-aliveAccept: application/jsonSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: webidentityUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /td/rul/988382855?random=1707417344353&cv=11&fst=1707417344353&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=ZgWTCPidsIkYEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /td/rul/988382855?random=1707417344393&cv=11&fst=1707417344393&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /td/rul/1060768846?random=1707417344498&cv=11&fst=1707417344498&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nh4qqVoyv2KiIad5kPNddW86jrjYgKSk8&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /td/rul/973712236?random=1707417344535&cv=11&fst=1707417344535&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /td/rul/973712236?random=1707417344582&cv=11&fst=1707417344582&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /sendlayoutevents HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=1707417341870; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhAD4WLlocJITBMa3rDvM%2FTul1zrgyV20Oep4%2ByzvFe9TEP4%2FCO7SWdV4nDvU%2BPb6T8tysYngKSx198oV9JBFKQ14%2FRJ75raZDQGoIW6X8k3KrgZ8J43VSKpt36%2FaOYflD1Q6oFd0cBFlEO2ZPIWEaSdI7bMOXiUsqw%3D
Source: global traffic	HTTP traffic detected: GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=e4de82b919b800e4&ete=&etg=&etcg=cCHObEfEITNPfbeQMIaWYUQJFFQccCcCcCC\|5&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,cCHObKdBdUHINPSXeHDALOLOLMO\|3&etgwv= HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-ET-Serialized-State: EFB4182z3JoJxbpLmYz6l9XMO8uwQw5vy57VA6rLJax-JW2gEd2Ycalwc-8XMLrKvX-Booking-Language-Code: en-usX-Booking-Client-Info: sec-ch-ua-mobile: ?0X-Booking-AID: 304142User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: e4de82b919b800e4X-Booking-Info: X-Booking-SiteType-Id: 1X-Booking-Session-Id: db6e5bbb32eac0e80cfcae9b22f5390dsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2BI6h0LLlJfr4uEPODOppbFCV6Th8ROLIHCxxR34ODjqh9FeK%2B5WwxxW%2BXBiWehITLmwPt4eyEFq2SVOwaC2%2FReJiu846DJCGilmlNtxv2P43hLAQDIRlCu6XIGNC%2Bh1Nc15nZTRtXlXUNra0gS515qF2snrbxj%2BGg%3D; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/challenge.js HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /td/rul/975716499?random=1707417344619&cv=11&fst=1707417344619&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /td/rul/975716499?random=1707417344655&cv=11&fst=1707417344655&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: test_cookie=CheckForPermission
Source: global traffic	HTTP traffic detected: GET /activity;src=4228414;type=views;cat=views;ord=4995395844978;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=2105455417;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUlAWu6rXBfYjTV_Uj7dXhX3h_q_6YxHN2kY_h3QN3MMpusGnzAEA8nM1wi4
Source: global traffic	HTTP traffic detected: GET /images/listing/tool/cv/ytag.js HTTP/1.1Host: s.yimg.jpConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /activity;register_conversion=1;src=4228414;type=views;cat=views;ord=4995395844978;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=2105455417;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: trigger, event-source=navigation-sourceReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUnbs1U97w3kjt_Ux_SYNB3RTvhWcFlsDnRTOjaaiOIzJkWJfhsSJjnfBxZx8Ok
Source: global traffic	HTTP traffic detected: GET /cm/i?pid=54f04dd9-4d34-47ee-87a6-989713215c80&u_scsid=15e0a621-1144-485d-901b-09bb638d2936&u_sclid=75022d4d-ae50-4a02-8ab1-d3d7e0695f9e HTTP/1.1Host: tr.snapchat.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /td/ga/rul?tid=G-FPD6YLJCJ7&gacid=421694156.1707417338&gtm=45je4250v888381215z879615461za200&dma=0&gcs=G1--&gcd=13l3l3l3l5&npa=0&pscdl=noapi&aip=1&fledge=1&z=1288257743 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkwA06e2LmJDlVDtE3nlV6zyMr1NHCmYbFzpS9jAPeELWgMasnX2ocNY86m
Source: global traffic	HTTP traffic detected: GET /js_errors?pid=e4de82b919b800e4&url=https%3A%2F%2Fwww.booking.com%2F&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2F&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSObZWJFfVDSMePCFYZWFXO&cors=1 HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-type: application/x-www-form-urlencodedAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWznlSlRZNNCt3uSEWppJCYH588b8iYKXXOnIOKpcULYw5G8qmBlVrUKP4MYa8JC7f9xeViVK4AXz6g8ApKkIokAyiVjrl%2Be7Ypbx0JpGBkh%2BkvyOLCcCjVgj1VWVNbgbfGITiSF2OndEnOsUedtFNaHBwC6U5fUDzek%3D; _uetvid=df1947f0c6b011eeb9850f920174ad42
Source: global traffic	HTTP traffic detected: GET /js_tracking?ver=2&stype=1&ref_action=index&lang=en-us&pid=e4de82b919b800e4&aid=304142&sid=5171fc655664ddf74ab763a094523fb7&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|5\|1&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3X-Booking-CSRF: M1fFZQAAAAA=ow_iJm02C23yTbeZTjDwFw3ODjezY3bK5FHdo-YoJdT7GCkrsQ32GPbbWguo4KloItJB_vA0z9Y_xRO57ct8Amr5W_XGX_7GZSpQGGcZ9tRZ2sLvFoX1OvJhoh8lHbncqueaPtPA9hz8Y_-xROuXkd4r2dhb8qRB-XM9-fcVbZ1TIOfkTWMBhv8vt5DNEpcahji4EEgpTuAdyxqGsec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: e4de82b919b800e4X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,1912460\|1,1856870\|1,1912460\|7,1912460\|6,1908890\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|4,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|2,cCHObKdBdUHINPSXeHDALOLOLMO\|5,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObV
Source: global traffic	HTTP traffic detected: GET /g/collect?v=2&tid=G-A12345&gtm=45je4250z879615461za200&_p=1707417343003&gcs=G1--&gcd=13l3l3l3l5&npa=0&dma=0&cid=421694156.1707417338&ul=en-us&sr=1280x1024&_fplc=0&ur=US-FL&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pscdl=noapi&sst.uc=US&sst.rnd=2080525821.1707417344&sst.gcd=13l3l3l3l5&sst.tft=1707417343003&_s=1&sid=1707417345&sct=1&seg=0&dl=https%3A%2F%2Fwww.booking.com%2F&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&_fv=1&_ss=1&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=17859&richsstsse HTTP/1.1Host: gtm-mktg.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.booking.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWznlSlRZNNCt3uSEWppJCYH588b8iYKXXOnIOKpcULYw5G8qmBlVrUKP4MYa8JC7f9xeViVK4AXz6g8ApKkIokAyiVjrl%2Be7Ypbx0JpGBkh%2BkvyOLCcCjVgj1VWVNbgbfGITiSF2OndEnOsUedtFNaHBwC6U5fUDzek%3D; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0
Source: global traffic	HTTP traffic detected: GET /activity;dc_pre=COTEnqOxnIQDFZE5RAgd3v0I0A;src=4228414;type=views;cat=views;ord=4995395844978;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=2105455417;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pr_ue?action=index&dest_ufi=-1&user_location=us&ttv_uc=undefined&date_in=-1&date_out=-1&rooms=-1&nights=-1&hr=-1&rid=undefined&p1=undefined&adults=-1&children=-1&city_name=-1&country_name=-1&dest_name=-1&region_name=-1&dest_cc=-1&dest_id=-1&dest_type=-1&lang=en-us&ai=304142&preferred_neighborhoods=undefined&preferred_star_ratings=undefined&seed=Pqit_vbiva0hUfw7CE5adQ&site=bookings2&sid=5171fc655664ddf74ab763a094523fb7&channel_id=3&exp_andy=undefined&stid=304142&exp_rmkt_test=global_on&famem=-1&famfn=-1&fampn=-1&logged_in=0&genis=&gwcur=-1&gwcuc=-1&bem=0&bip=0&book_window=&travel_type=unknown&currency=USD&em_sent=undefined&fn_sent=undefined&pn_sent=undefined&cv=-1&sage=0&atnm=&atnm_en=&pt_en=&cul=-1&mnns=-1&zz_val_eur=EUR&zz_look_action2id=undefined&zz_generic_id=undefined&zz_generic_id2=undefined&cip=81.181.57.74&cua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F117.0.0.0%20Safari%2F537.36&tms=gtm&sid_dyna=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000&rmk_var=-1&euuid=b570a48b-d87a-42cd-a665-c49a286c4522&gcem=-1&gcpn=-1&pguai=undefined&ttv=undefined&iamlt=&fbc=undefined&fbp=-1&msclid=undefined&pcid=3&bizp=&istnb=0&genisb=0&as=0&genaspb=1&p=https%3A%2F%2Fwww.booking.com%2F&r=&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&rbda=-1&tcl=undefined&cto_pld=undefined&cgumid=undefined&gtmcb=2059838197 HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/977409.jpg?k=82c14f9e6cea94829ee0528a3aa4324111d3482e9f095194500746fa7ca2769e&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_MIRu885KDHLnHDVd1L_zOfvbAE7ka3IfdUmXyEJ6dX9lBxna&random=1657552313 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/977416.jpg?k=ea06e0b572ff052f4fe4fcf35ac3616e8d1b7300f0402756c460a4e9c19e54ed&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pr_ue?action=visitation&dest_ufi=-1&user_location=us&ttv_uc=undefined&date_in=-1&date_out=-1&rooms=-1&nights=-1&hr=-1&rid=undefined&p1=undefined&adults=-1&children=-1&city_name=-1&country_name=-1&dest_name=-1&region_name=-1&dest_cc=-1&dest_id=-1&dest_type=-1&lang=en-us&ai=304142&preferred_neighborhoods=undefined&preferred_star_ratings=undefined&seed=Pqit_vbiva0hUfw7CE5adQ&site=bookings2&sid=5171fc655664ddf74ab763a094523fb7&channel_id=3&exp_andy=undefined&stid=304142&exp_rmkt_test=global_on&famem=-1&famfn=-1&fampn=-1&logged_in=0&genis=&gwcur=-1&gwcuc=-1&bem=0&bip=0&book_window=&travel_type=unknown&currency=USD&em_sent=undefined&fn_sent=undefined&pn_sent=undefined&cv=-1&sage=0&atnm=&atnm_en=&pt_en=&cul=-1&mnns=-1&zz_val_eur=EUR&zz_look_action2id=undefined&zz_generic_id=undefined&zz_generic_id2=undefined&cip=81.181.57.74&cua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F117.0.0.0%20Safari%2F537.36&tms=gtm&sid_dyna=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000&rmk_var=-1&euuid=b570a48b-d87a-42cd-a665-c49a286c4522&gcem=-1&gcpn=-1&pguai=undefined&ttv=undefined&iamlt=&fbc=undefined&fbp=-1&msclid=undefined&pcid=3&bizp=&istnb=0&genisb=0&as=0&genaspb=1&p=https%3A%2F%2Fwww.booking.com%2F&r=&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&rbda=-1&tcl=undefined&cto_pld=undefined&gtmcb=2120349371 HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2C
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&cb=pehgtvg39f6l HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/977388.jpg?k=4c9c54255e9d2e2d8084959527abea6b6b8a4b8a538a921f1df9e4bea2503ff6&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/263x210/57584488.jpeg?k=d8d4706fc72ee789d870eb6b05c0e546fd4ad85d72a3af3e30fb80ca72f0ba57&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/976877.jpg?k=2aab28217f0fb039e0f35ea2b2c3976141b5860b074f74220edf998115935cda&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/977381.jpg?k=ab236c5e99ba40341684e2d3bfcd8256d36f5e63883350af9faa988cd4d49939&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/hotel/263x210/119467716.jpeg?k=f3c2c6271ab71513e044e48dfde378fcd6bb80cb893e39b9b78b33a60c0131c9&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/hotel/263x210/100235855.jpeg?k=5b6e6cff16cfd290e953768d63ee15f633b56348238a705c45759aa3a81ba82b&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/263x210/45450084.jpeg?k=f8c2954e867a1dd4b479909c49528531dcfb676d8fbc0d60f51d7b51bb32d1d9&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ddm/fls/z/dc_pre=COTEnqOxnIQDFZE5RAgd3v0I0A;src=4228414;type=views;cat=views;ord=4995395844978;npa=0;auiddc=;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=2105455417;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2 HTTP/1.1Host: adservice.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /ct/lib/main.6461a31a.js HTTP/1.1Host: s.pinimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/aframe HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /static/img/favicon/9ca83ba2a5a3293ff07452cb24949a5843af4592.svg HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/2880x868/308526620.jpeg?k=0663a1420ea98a013af0eda32bb4d11258521a39c5b8a5a4e2777ee5661dee55&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=e4de82b919b800e4&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|4,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|2,cCHObKdBdUHINPSXeHDALOLOLMO\|5,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv= HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd89
Source: global traffic	HTTP traffic detected: GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=e4de82b919b800e4&ete=&etg=&etcg=cCHObEfEITNPfbeQMIaWYUQJFFQccCcCcCC\|5&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,cCHObKdBdUHINPSXeHDALOLOLMO\|3&etgwv= HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
Source: global traffic	HTTP traffic detected: GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e&u_sclid=75022d4d-ae50-4a02-8ab1-d3d7e0695f9e&u_scsid=15e0a621-1144-485d-901b-09bb638d2936&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&huah=true&m_dcl=8009&m_fcps=7323&m_pi=7989&m_pl=15337&m_pv=2&m_rd=17424&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F&trackId=c9cbee82-e00d-415b-9153-72ae9e8eb698&ts=1707417345114&v=3.9.1-2402072137 HTTP/1.1Host: tr.snapchat.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_MIRu885KDHLnHDVd1L_zOfvbAE7ka3IfdUmXyEJ6dX9lBxna&random=1657552313 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /web-vitals/send-vitals HTTP/1.1Host: web-vitals.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/977409.jpg?k=82c14f9e6cea94829ee0528a3aa4324111d3482e9f095194500746fa7ca2769e&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/977416.jpg?k=ea06e0b572ff052f4fe4fcf35ac3616e8d1b7300f0402756c460a4e9c19e54ed&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=CUSTOM_EVENT_2&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e&u_sclid=75022d4d-ae50-4a02-8ab1-d3d7e0695f9e&u_scsid=15e0a621-1144-485d-901b-09bb638d2936&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&huah=true&m_dcl=8009&m_fcps=7323&m_pi=7989&m_pl=15337&m_pv=2&m_rd=17436&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F&trackId=559cb617-2573-4523-9e5d-f09d91c1516c&ts=1707417345126&v=3.9.1-2402072137 HTTP/1.1Host: tr.snapchat.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js_tracking?ver=2&stype=1&ref_action=index&lang=en-us&pid=e4de82b919b800e4&aid=304142&sid=5171fc655664ddf74ab763a094523fb7&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|5\|1&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
Source: global traffic	HTTP traffic detected: GET /config/com/54f04dd9-4d34-47ee-87a6-989713215c80.js?v=3.9.1-2402072137 HTTP/1.1Host: tr.snapchat.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js_errors?pid=e4de82b919b800e4&url=https%3A%2F%2Fwww.booking.com%2F&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2F&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSObZWJFfVDSMePCFYZWFXO&cors=1 HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2H
Source: global traffic	HTTP traffic detected: GET /about/enterprise/ HTTP/1.1Host: marketingplatform.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/988382855/?random=1707417344393&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_gWvym3Dpd03oexxdK-7GraOGOHdCrnDIP6cnm_QV7Lz1kW9a&random=1612479673&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/977388.jpg?k=4c9c54255e9d2e2d8084959527abea6b6b8a4b8a538a921f1df9e4bea2503ff6&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /design-assets/assets/v3.109.0/images-flags/Us@3x.png HTTP/1.1Host: t-cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /g/collect?v=2&tid=G-A12345&gtm=45je4250z879615461za200&_p=1707417343003&gcs=G1--&gcd=13l3l3l3l5&npa=0&dma=0&cid=421694156.1707417338&ul=en-us&sr=1280x1024&_fplc=0&ur=US-FL&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pscdl=noapi&sst.uc=US&sst.rnd=2080525821.1707417344&sst.gcd=13l3l3l3l5&sst.tft=1707417343003&_s=1&sid=1707417345&sct=1&seg=0&dl=https%3A%2F%2Fwww.booking.com%2F&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&_fv=1&_ss=1&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=17859&richsstsse HTTP/1.1Host: gtm-mktg.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
Source: global traffic	HTTP traffic detected: GET /activity;register_conversion=1;src=4228414;type=views;cat=views;ord=4995395844978;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=2105455417;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: ad.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
Source: global traffic	HTTP traffic detected: GET /user/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%7D&cb=1707417346995&dep=2%2CPAGE_LOAD HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/263x210/57584488.jpeg?k=d8d4706fc72ee789d870eb6b05c0e546fd4ad85d72a3af3e30fb80ca72f0ba57&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/976877.jpg?k=2aab28217f0fb039e0f35ea2b2c3976141b5860b074f74220edf998115935cda&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/hotel/263x210/100235855.jpeg?k=5b6e6cff16cfd290e953768d63ee15f633b56348238a705c45759aa3a81ba82b&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /user/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1707417346997&dep=5%2CEVENT_TAGS_ABSENT HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/977381.jpg?k=ab236c5e99ba40341684e2d3bfcd8256d36f5e63883350af9faa988cd4d49939&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/verify HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ddm/fls/z/dc_pre=COTEnqOxnIQDFZE5RAgd3v0I0A;src=4228414;type=views;cat=views;ord=4995395844978;npa=0;auiddc=;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=2105455417;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2 HTTP/1.1Host: adservice.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /*X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-conversion/988382855/?random=71414136&cv=11&fst=1707417344353&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=ZgWTCPidsIkYEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&value=0&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&fmt=3&ct_cookie_present=false&sscte=1&crd=CIK9sQII7LuxAiIBAUABSid0cmlnZ2VyLCBldmVudC1zb3VyY2U9bmF2aWdhdGlvbi1zb3VyY2ViBAoCAgM&pscrd=CJL-lL3ht4-vyAESTkNoQUlnSlNTcmdZUTRQWHg3c3lZMlA4WkVpWUFtUzFSNi15TEtiTDJjTXdtWmVCbnhGT0VENVRiZjU0MTZpV2RyRUJoMFh6MnNhdHZqdxpaQ2hFSWdKU1NyZ1lRc3I2NWlwYVprN0diQVJJdUFFRzJzTzFsd0J1c0VxelpYa0VxMXF1c2ZsQ0FCMGhtMlZUY05ENG40cnd1blR3c1FEY2dPclZNMERGakdBIhMIpr_8orGchAMVpZTLAR2HqA4eMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAg&is_vtc=1&ocp_id=AR_FZea6KKWprr4Ph9G68AE&cid=CAQSKQAvHhf_Gt7QoUpXdus5QEyG1eIxuz3AHR2Emh1ZeXw0s6O0dji9wyhm&eitems=ChAIgJSSrgYQzemNw6uqy5stEh0ArMYPzZOA1xjXSQD69MmJkKwXUUq0zbPsrxxgqQ&random=1769082692 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
Source: global traffic	HTTP traffic detected: GET /xdata/images/hotel/263x210/119467716.jpeg?k=f3c2c6271ab71513e044e48dfde378fcd6bb80cb893e39b9b78b33a60c0131c9&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/263x210/45450084.jpeg?k=f8c2954e867a1dd4b479909c49528531dcfb676d8fbc0d60f51d7b51bb32d1d9&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e&u_sclid=75022d4d-ae50-4a02-8ab1-d3d7e0695f9e&u_scsid=15e0a621-1144-485d-901b-09bb638d2936&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&huah=true&m_dcl=8009&m_fcps=7323&m_pi=7989&m_pl=15337&m_pv=2&m_rd=17424&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F&trackId=c9cbee82-e00d-415b-9153-72ae9e8eb698&ts=1707417345114&v=3.9.1-2402072137 HTTP/1.1Host: tr.snapchat.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBgQ0AIAgDsItIQBcH54CGKzje1tLaqVde8Qh0QypPy7oZga7g8xmjEsYNjn6TFIVqMgAAAA==
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1060768846/?random=1707417344498&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nh4qqVoyv2KiIad5kPNddW86jrjYgKSk8&npa=0&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_coWeJkuj5Q3yNq70idh4WJdx3zfM6vO8uiPSFkYUXc53APfl&random=2710065598&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
Source: global traffic	HTTP traffic detected: GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=CUSTOM_EVENT_2&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e&u_sclid=75022d4d-ae50-4a02-8ab1-d3d7e0695f9e&u_scsid=15e0a621-1144-485d-901b-09bb638d2936&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&huah=true&m_dcl=8009&m_fcps=7323&m_pi=7989&m_pl=15337&m_pv=2&m_rd=17436&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F&trackId=559cb617-2573-4523-9e5d-f09d91c1516c&ts=1707417345126&v=3.9.1-2402072137 HTTP/1.1Host: tr.snapchat.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/973712236/?random=1707417344535&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_y-kMF1ofi7FwUZE1wjFhsX8V103pkvRQFAPg8V_tgv1nWHYT&random=766671962&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/975716499/?random=1707417344655&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_niQM3PtsxhJz-etk4SiuaPuc1uxP5cjUkkc_zlGDgt3gu_xP&random=1844959785&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/975716499/?random=1707417344619&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_Z60qOBRC0pooYPssvY44WDhxPvAjD20AS2HYNebi_Po98qJK&random=3590766466&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/973712236/?random=1707417344582&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_rndnWdCAQi6iVyq6cjrgu1EiG1Y8Myw6XFmXv6PP16V-EZAM&random=593389060&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/988382855/?random=1707417344393&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_gWvym3Dpd03oexxdK-7GraOGOHdCrnDIP6cnm_QV7Lz1kW9a&random=1612479673&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /v3/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%226461a31a%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1707417346998 HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v3/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1707417347660&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22aem_eligible_list%22%3A%5B%22fn%22%5D%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%226461a31a%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-conversion/988382855/?random=71414136&cv=11&fst=1707417344353&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=ZgWTCPidsIkYEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&value=0&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&fmt=3&ct_cookie_present=false&sscte=1&crd=CIK9sQII7LuxAiIBAUABSid0cmlnZ2VyLCBldmVudC1zb3VyY2U9bmF2aWdhdGlvbi1zb3VyY2ViBAoCAgM&pscrd=CJL-lL3ht4-vyAESTkNoQUlnSlNTcmdZUTRQWHg3c3lZMlA4WkVpWUFtUzFSNi15TEtiTDJjTXdtWmVCbnhGT0VENVRiZjU0MTZpV2RyRUJoMFh6MnNhdHZqdxpaQ2hFSWdKU1NyZ1lRc3I2NWlwYVprN0diQVJJdUFFRzJzTzFsd0J1c0VxelpYa0VxMXF1c2ZsQ0FCMGhtMlZUY05ENG40cnd1blR3c1FEY2dPclZNMERGakdBIhMIpr_8orGchAMVpZTLAR2HqA4eMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAg&is_vtc=1&ocp_id=AR_FZea6KKWprr4Ph9G68AE&cid=CAQSKQAvHhf_Gt7QoUpXdus5QEyG1eIxuz3AHR2Emh1ZeXw0s6O0dji9wyhm&eitems=ChAIgJSSrgYQzemNw6uqy5stEh0ArMYPzZOA1xjXSQD69MmJkKwXUUq0zbPsrxxgqQ&random=1769082692 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /user/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1707417346997&dep=5%2CEVENT_TAGS_ABSENT HTTP/1.1Host: ct.pinterest.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1060768846/?random=1707417344498&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nh4qqVoyv2KiIad5kPNddW86jrjYgKSk8&npa=0&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_coWeJkuj5Q3yNq70idh4WJdx3zfM6vO8uiPSFkYUXc53APfl&random=2710065598&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/973712236/?random=1707417344535&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_y-kMF1ofi7FwUZE1wjFhsX8V103pkvRQFAPg8V_tgv1nWHYT&random=766671962&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /static/ct/token_create.js HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/975716499/?random=1707417344655&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_niQM3PtsxhJz-etk4SiuaPuc1uxP5cjUkkc_zlGDgt3gu_xP&random=1844959785&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
Source: global traffic	HTTP traffic detected: GET /user/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%7D&cb=1707417346995&dep=2%2CPAGE_LOAD HTTP/1.1Host: ct.pinterest.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ct.html HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&cb=pehgtvg39f6lAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /js/bg/KkWFeSURekXGycdprVC-UY6ED-ZF5ll2JCMiHhJE2Rk.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&cb=pehgtvg39f6lAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/975716499/?random=1707417344619&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_Z60qOBRC0pooYPssvY44WDhxPvAjD20AS2HYNebi_Po98qJK&random=3590766466&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/973712236/?random=1707417344582&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_rndnWdCAQi6iVyq6cjrgu1EiG1Y8Myw6XFmXv6PP16V-EZAM&random=593389060&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAfk6BVG4iAAAA:jn4jiHj1KGR2WepQULdDAPNh27aR8s64smOS+jOJFcu0/gDr1k+BiJmO4IJNM1rlB05AjWs71c8Rp45ik2gXz+kZlvRXZCMulpVEraiGplcNt5Bep6RU78H9p6MS75291fezaMLr0gNr+bA4nQPS3DfjMTBFqiMIU7DbEsu3Km+jSl1Nj3Ezi
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
Source: global traffic	HTTP traffic detected: GET /v3/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%226461a31a%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1707417346998 HTTP/1.1Host: ct.pinterest.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSYyQmdMeTJ2eFJzSk91TERJcUVCQjRKc0lCd3J4VHVoTFJiMkNEWUc0ZVZ4eHkyb1Y1Z2I1ejVSRXdmc05CYW5QU0R6Ukg1STFmTzFjd3dsdXg4YmI4bUM0UURpZ2FNNU42VFpKQmd0QUVRRT0melAzQmdRVXdsM0VlN0llbzVzRnpOdnFPL1BvPQ=="
Source: global traffic	HTTP traffic detected: GET /v3/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1707417347660&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22aem_eligible_list%22%3A%5B%22fn%22%5D%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%226461a31a%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D HTTP/1.1Host: ct.pinterest.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSYyQmdMeTJ2eFJzSk91TERJcUVCQjRKc0lCd3J4VHVoTFJiMkNEWUc0ZVZ4eHkyb1Y1Z2I1ejVSRXdmc05CYW5QU0R6Ukg1STFmTzFjd3dsdXg4YmI4bUM0UURpZ2FNNU42VFpKQmd0QUVRRT0melAzQmdRVXdsM0VlN0llbzVzRnpOdnFPL1BvPQ=="
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
Source: global traffic	HTTP traffic detected: GET /js_tracking?ver=2&stype=1&ref_action=index&lang=en-us&pid=e4de82b919b800e4&aid=304142&sid=5171fc655664ddf74ab763a094523fb7&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|17142&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3X-Booking-CSRF: M1fFZQAAAAA=ow_iJm02C23yTbeZTjDwFw3ODjezY3bK5FHdo-YoJdT7GCkrsQ32GPbbWguo4KloItJB_vA0z9Y_xRO57ct8Amr5W_XGX_7GZSpQGGcZ9tRZ2sLvFoX1OvJhoh8lHbncqueaPtPA9hz8Y_-xROuXkd4r2dhb8qRB-XM9-fcVbZ1TIOfkTWMBhv8vt5DNEpcahji4EEgpTuAdyxqGsec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: e4de82b919b800e4X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,1912460\|1,1856870\|1,1912460\|7,1912460\|6,1908890\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|4,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|2,cCHObKdBdUHINPSXeHDALOLOLMO\|5,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCM
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js_tracking?ver=2&stype=1&ref_action=index&lang=en-us&pid=e4de82b919b800e4&aid=304142&sid=5171fc655664ddf74ab763a094523fb7&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|17142&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8kqA80E7Dah055EUUCXJybztZSKxkA5aCnIJFLwuEv5PRBH%2FuOIr093hmKmylOzKy1om%2BA6S9CXSpp3YXWEQ5uMtGzdXyxL7fd6KnVt8wEbVbuHrbuxq5uAQY%2BNxC%2Fj%2BSMmkfmWa3MeC%2FkjdjYc5vu2uXFBZYHleA%3D; aws-waf-token=cd5c45c3-
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/client.38ffee15.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "c9009dc966b4c139ffffe886598ac0c0"If-Modified-Since: Thu, 08 Feb 2024 12:34:07 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/7bcb015e.5b709f3d.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "8b761ecf11f6b807d0d765ee8cd5851e"If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/eb60141d.cad86b29.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "2980ea90c3f4c27d77bffbd1527870a7"If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/c6a78acb.bffda4a9.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "6f3e8bb7938a05e927b3ca4454f98fa8"If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/720x217/308526620.jpeg?k=0663a1420ea98a013af0eda32bb4d11258521a39c5b8a5a4e2777ee5661dee55&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/f50a2dfc.837540b6.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "fdb620d16ddcb3d874c0d96880365b4d"If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/a6a21c13.8939445f.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "e262f92e286a4c74280bd4b3fdee8cbb"If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/f5d0e2e7.a54d85eb.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "88d8b9631fe60984baabd22260a86e6e"If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/d2a738da.079c3b4c.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "1a7c523a95596c5b0b122ad8d8e3b553"If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/4e596c2c.3a2fb681.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "51be0c43cc481b13fe70d3ba27e2ffd9"If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/53a8d0d3.b1818b84.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "f820477c322829e348f318a453e432a5"If-Modified-Since: Thu, 08 Feb 2024 11:37:52 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/remoteEntry.4935f89c.client.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "a687e666ee59c8527c21313adba1bf8f"If-Modified-Since: Sun, 04 Feb 2024 06:12:25 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/4a89d2db.6c0ec4b3.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "71d148d7e362a60e9a0c56222e4c1c42"If-Modified-Since: Wed, 07 Feb 2024 05:15:19 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/0a098284.df965884.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "47bb1a597dd42cabf5425fe918f725b5"If-Modified-Since: Thu, 08 Feb 2024 06:30:47 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/7bcb015e.cf9d45ea.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "762dbdde80c9b4faddafa20df78215de"If-Modified-Since: Thu, 08 Feb 2024 14:53:52 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/eb60141d.05ae682b.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "8bd695624a0284c0c75e95e6cf849e19"If-Modified-Since: Mon, 05 Feb 2024 10:15:49 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/f50a2dfc.854e46ce.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "16cef59d8ed8d631e974161b3405d558"If-Modified-Since: Thu, 08 Feb 2024 10:31:47 GMT
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/500x500/184698944.png?k=6bb1bf3c13db4a7ba3c22a2d1f1051f793c525a78104703b4dec3eb12101f545&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/a6a21c13.ad9f14d9.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "16323cfbc6f714b70bb4777cc3449e90"If-Modified-Since: Thu, 08 Feb 2024 11:37:54 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/f5d0e2e7.5cd38fd6.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "2a4be84facf3e21bb4a9ebb12a10a92e"If-Modified-Since: Wed, 07 Feb 2024 09:32:56 GMT
Source: global traffic	HTTP traffic detected: GET /logo?ver=1&sid=5171fc655664ddf74ab763a094523fb7&t=17074173491 HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8kqA80E7Dah055EUUCXJybztZSKxkA5aCnIJFLwuEv5PRBH%2FuOIr093hmKmylOzKy1om%2BA6S9CXSpp3YXWEQ5uMtGzdXyxL7fd6KnVt8wEbVbuHrbuxq5uAQY%2BNxC%2Fj%2BSMmkfmWa3MeC%2FkjdjYc5vu2uXFBZYHleA%3D; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3JoFJ/d3+jTRbAw8j2g3DznWiIRblwWjQRtj/04PDlBt/o55ocKzBIQxZ/e0Rt7iMiaISeSKOQt; lastSeen=1707417350227; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A51+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/d2a738da.35cba7bb.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "1aa264da71f354aad6dce94f5a3374d9"If-Modified-Since: Tue, 06 Feb 2024 10:33:56 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/4e596c2c.d3513b52.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "cbed6c40f80b88278fe92b7987f24d10"If-Modified-Since: Thu, 08 Feb 2024 14:16:47 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/21928fd5.cc39b346.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "32f6cb6519036a5cb6d7245e1f3f4a10"If-Modified-Since: Mon, 05 Feb 2024 10:15:48 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/3d066b0d.6a5d1f73.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "b9431959d1fba61458d500bc4cba3939"If-Modified-Since: Tue, 06 Feb 2024 05:16:14 GMT
Source: global traffic	HTTP traffic detected: GET /web-vitals/send-vitals HTTP/1.1Host: web-vitals.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8kqA80E7Dah055EUUCXJybztZSKxkA5aCnIJFLwuEv5PRBH%2FuOIr093hmKmylOzKy1om%2BA6S9CXSpp3YXWEQ5uMtGzdXyxL7fd6KnVt8wEbVbuHrbuxq5uAQY%2BNxC%2Fj%2BSMmkfmWa3MeC%2FkjdjYc5vu2uXFBZYHleA%3D; lastSeen=1707417350227
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/0a098284.df965884.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "47bb1a597dd42cabf5425fe918f725b5"If-Modified-Since: Thu, 08 Feb 2024 06:30:47 GMT
Source: global traffic	HTTP traffic detected: GET /js_tracking?aid=304142&pid=2c8482c2544201f4&ver=2&sid=5171fc655664ddf74ab763a094523fb7&ref_action=index&lang=en-us&stype=1&ete=&etg=&etcg=cCHObKdPHMfFdHMEKdbfZRLRMLFSZaTaTaET\|1&ets=cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YYo1mfebd19Q2WIimWOyIN1gUe4_-JQdNOBTMuHuYCJPue7ik10LWViyRYmmf149m9vSAg2JJTyfAEk9RiEQZejXjro5rDJvxnq57UaGsDKd0iBXLkMuV2sFYEHSFmXZW5zvkIdbv7-B87Oi9zo36Fnq7AU8K4Y8Y-SdtsN1A2dfLiciDUxBuNe45QSxoxZcHhPcdr6v26QamVEbge_7LQ_MDhbvlSKq9Lwf9P11FwHzxPymBNBmu_dZFb8tK9Z3wY0RAyYm7D0hfdu-LCtv4j3isKKp1L_CiYhwCnyC42X_OqimTrSjKXCbKfd3YnkJbQ HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6X-Booking-CSRF: RVfFZQAAAAA=qVueflVyIcgKOJdfCMKcmiDGjvY9UqM_W79drieypCCd1wLxtNOjZPcMNKEslcD0Tiyh8b7rdIv86FT89bynmubUkLo31LJ5cM248yQm3ulKZFWN-WKHCjXqy964TaJvn5A_S7b4oaNG1jhNZ7aGF2JNPgwXGQBCPiOREYDFBwUwhotUpEosEVmLfdyz_vXpYSXlaaCHZibCaVWmsec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAKFvpSuBsACAdICJDdhNmRhMmNiLThiNjMtNDQ1OS04MGUwLTI1OGM3NjBkNWQzMdgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: 2c8482c2544201f4X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,1912460\|1,1856870\|1,1912460\|7,1908890\|1,1912460\|6,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6X-Booking-SiteType-Id: 1X-Requested-With: XMLHttpRequestX-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/reload?k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AJmcDEmmSVjhXu6iSND5nUlaG4u8jg9r3gIsM8fricsYrppd_RXehS30W8rvMgVb0KtN3BzkTFd51AiDyh7KnUA; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/7bcb015e.5b709f3d.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "8b761ecf11f6b807d0d765ee8cd5851e"If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/eb60141d.cad86b29.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "2980ea90c3f4c27d77bffbd1527870a7"If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/c6a78acb.bffda4a9.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "6f3e8bb7938a05e927b3ca4454f98fa8"If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/f50a2dfc.837540b6.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "fdb620d16ddcb3d874c0d96880365b4d"If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/a6a21c13.8939445f.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "e262f92e286a4c74280bd4b3fdee8cbb"If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/f5d0e2e7.a54d85eb.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "88d8b9631fe60984baabd22260a86e6e"If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/720x217/308526620.jpeg?k=0663a1420ea98a013af0eda32bb4d11258521a39c5b8a5a4e2777ee5661dee55&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js_tracking?aid=304142&pid=2c8482c2544201f4&ver=2&sid=5171fc655664ddf74ab763a094523fb7&ref_action=index&lang=en-us&stype=1&ete=&etg=&etcg=&ets=cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3&etgwv=js_web_vitals_cls_per_mille\|1&m=UmFuZG9tSVYkc2RlIyh9YYo1mfebd19Q2WIimWOyIN1gUe4_-JQdNOBTMuHuYCJPue7ik10LWViyRYmmf149m9vSAg2JJTyfAEk9RiEQZejXjro5rDJvxnq57UaGsDKd0iBXLkMuV2sFYEHSFmXZW5zvkIdbv7-B87Oi9zo36Fnq7AU8K4Y8Y-SdtsN1A2dfLiciDUxBuNe45QSxoxZcHhPcdr6v26QamVEbge_7LQ_MDhbvlSKq9Lwf9P11FwHzxPymBNBmu_dZFb8tK9Z3wY0RAyYm7D0hfdu-LCtv4j3isKKp1L_CiYhwCnyC42X_OqimTrSjKXCbKfd3YnkJbQ HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3X-Booking-CSRF: RVfFZQAAAAA=qVueflVyIcgKOJdfCMKcmiDGjvY9UqM_W79drieypCCd1wLxtNOjZPcMNKEslcD0Tiyh8b7rdIv86FT89bynmubUkLo31LJ5cM248yQm3ulKZFWN-WKHCjXqy964TaJvn5A_S7b4oaNG1jhNZ7aGF2JNPgwXGQBCPiOREYDFBwUwhotUpEosEVmLfdyz_vXpYSXlaaCHZibCaVWmsec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAKFvpSuBsACAdICJDdhNmRhMmNiLThiNjMtNDQ1OS04MGUwLTI1OGM3NjBkNWQzMdgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: 2c8482c2544201f4X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,1912460\|1,1856870\|1,1912460\|7,1908890\|1,1912460\|6,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3X-Booking-SiteType-Id: 1X-Requested-With: XMLHttpRequestX-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=I
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/500x500/184698944.png?k=6bb1bf3c13db4a7ba3c22a2d1f1051f793c525a78104703b4dec3eb12101f545&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/fonticons_clean/base64/woff/5d61b8a7156073e5e3e9741f65dda44ae3eef7d2.css HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /logo?ver=1&sid=5171fc655664ddf74ab763a094523fb7&t=17074173491 HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3JoFJ/d3+jTRbAw8j2g3DznWiIRblwWjQRtj/04PDlBt/o55ocKzBIQxZ/e0Rt7iMiaISeSKOQt; lastSeen=1707417350227; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.421694156.1707417338; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPefz11GFz2XDsuxniWysDhYDakkGwaWp4sTAC4tqHnZ0k3PWpIdXDVooPaztJkJl31v3F8fHw9lMHBdd8c1REz5cDYfcMeR0%2FAqDBnUQFnqTjIrUPxmDWl2d9rLaM5SH6Q0wauuC31ecfmXBHEfMHkwnjEl7hHRC7c4%3D
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3JoFJ/d3+jTRbAw8j2g3DznWiIRblwWjQRtj/04PDlBt/o55ocKzBIQxZ/e0Rt7iMiaISeSKOQt; lastSeen=1707417350227; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.421694156.1707417338; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPefz11GFz2XDsuxniWysDhYDakkGwaWp4sTAC4tqHnZ0k3PWpIdXDVooPaztJkJl31v3F8fHw9lMHBdd8c1REz5cDYfcMeR0%2FAqDBnUQFnqTjIrUPxmDWl2d9rLaM5SH6Q0wauuC31ecfmXBHEfMHkwnjEl7hHRC7c4%3D
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/d2a738da.079c3b4c.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "1a7c523a95596c5b0b122ad8d8e3b553"If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/53a8d0d3.b1818b84.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "f820477c322829e348f318a453e432a5"If-Modified-Since: Thu, 08 Feb 2024 11:37:52 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/b9a82cb8.c62928a4.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "d4cb397172a601054d15e416b713f8b5"If-Modified-Since: Tue, 06 Feb 2024 05:14:54 GMT
Source: global traffic	HTTP traffic detected: GET /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=BXAbRIVE HTTP/1.1Host: accommodations.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/jsonx-booking-et-serialized-state: Ef98IG0fjgY56Y63N0XdXtUDZNdmFwr2XgKIh92Hu06LJvnE66CkRQe8kZKZ05qgzsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.booking.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; _ga=GA1.2.421694156.1707417338; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPefz11GFz2XDsuxniWysDhYDakkGwaWp4sTAC4tqHnZ0k3PWpIdXDVooPaztJkJl31v3F8fHw9lMHBdd8c1REz5cDYfcMeR0%2FAqDBnUQFnqTjIrUPxmDWl2d9rLaM5SH6Q0wauuC31ecfmXBHEfMHkwnjEl7hHRC7c4%3D; lastSeen=0
Source: global traffic	HTTP traffic detected: GET /js_tracking?aid=304142&pid=2c8482c2544201f4&ver=2&sid=5171fc655664ddf74ab763a094523fb7&ref_action=index&lang=en-us&stype=1&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|3239&m=UmFuZG9tSVYkc2RlIyh9YYo1mfebd19Q2WIimWOyIN1gUe4_-JQdNOBTMuHuYCJPue7ik10LWViyRYmmf149m9vSAg2JJTyfAEk9RiEQZejXjro5rDJvxnq57UaGsDKd0iBXLkMuV2sFYEHSFmXZW5zvkIdbv7-B87Oi9zo36Fnq7AU8K4Y8Y-SdtsN1A2dfLiciDUxBuNe45QSxoxZcHhPcdr6v26QamVEbge_7LQ_MDhbvlSKq9Lwf9P11FwHzxPymBNBmu_dZFb8tK9Z3wY0RAyYm7D0hfdu-LCtv4j3isKKp1L_CiYhwCnyC42X_OqimTrSjKXCbKfd3YnkJbQ HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3X-Booking-CSRF: RVfFZQAAAAA=qVueflVyIcgKOJdfCMKcmiDGjvY9UqM_W79drieypCCd1wLxtNOjZPcMNKEslcD0Tiyh8b7rdIv86FT89bynmubUkLo31LJ5cM248yQm3ulKZFWN-WKHCjXqy964TaJvn5A_S7b4oaNG1jhNZ7aGF2JNPgwXGQBCPiOREYDFBwUwhotUpEosEVmLfdyz_vXpYSXlaaCHZibCaVWmsec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAKFvpSuBsACAdICJDdhNmRhMmNiLThiNjMtNDQ1OS04MGUwLTI1OGM3NjBkNWQzMdgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: 2c8482c2544201f4X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,1912460\|1,1856870\|1,1912460\|7,1908890\|1,1912460\|6,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3X-Booking-SiteType-Id: 1X-Requested-With: XMLHttpRequestX-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=170741
Source: global traffic	HTTP traffic detected: GET /web-vitals/send-vitals HTTP/1.1Host: web-vitals.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; _ga=GA1.2.421694156.1707417338; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKAimfo93c2GrBDhhKwo6bWKuVj3PL8CFrhr0%2BqmCv4c3d%2B3eXrKgkJqKu4CkWInIJPix%2FdzGgLa83gGD4gcCULKAMcixtmqDHZCsf6fcT6zs4kfQG%2FWoSybhGedPUjj4dJwcO6Qa13VaaHS%2FcpWxeTdhj%2FM0ATu%2Bc%3D; lastSeen=0
Source: global traffic	HTTP traffic detected: GET /js_tracking?aid=304142&pid=2c8482c2544201f4&ver=2&sid=5171fc655664ddf74ab763a094523fb7&ref_action=index&lang=en-us&stype=1&ete=&etg=&etcg=cCHObKdPHMfFdHMEKdbfZRLRMLFSZaTaTaET\|1&ets=cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YYo1mfebd19Q2WIimWOyIN1gUe4_-JQdNOBTMuHuYCJPue7ik10LWViyRYmmf149m9vSAg2JJTyfAEk9RiEQZejXjro5rDJvxnq57UaGsDKd0iBXLkMuV2sFYEHSFmXZW5zvkIdbv7-B87Oi9zo36Fnq7AU8K4Y8Y-SdtsN1A2dfLiciDUxBuNe45QSxoxZcHhPcdr6v26QamVEbge_7LQ_MDhbvlSKq9Lwf9P11FwHzxPymBNBmu_dZFb8tK9Z3wY0RAyYm7D0hfdu-LCtv4j3isKKp1L_CiYhwCnyC42X_OqimTrSjKXCbKfd3YnkJbQ HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3JoFJ/d3+jTRbAw8j2g3DznWiIRblwWjQRtj/04PDlBt/o55ocKzBIQxZ/e0Rt7iMiaISeSKOQt; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGl
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js?render=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&onload=onLoadRecaptchaV3Callback&_=1707417351908 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AJmcDEmmSVjhXu6iSND5nUlaG4u8jg9r3gIsM8fricsYrppd_RXehS30W8rvMgVb0KtN3BzkTFd51AiDyh7KnUA; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /gsi/fedcm.json HTTP/1.1Host: accounts.google.comConnection: keep-aliveAccept: application/jsonSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: webidentityUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/4e596c2c.3a2fb681.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "51be0c43cc481b13fe70d3ba27e2ffd9"If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
Source: global traffic	HTTP traffic detected: GET /static/opensearch/en-us/e19e3ca297c466eb18e0b783736192a638f6a66e.xml HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/challenge.js HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-Modified-Since: Thu, 8 Feb 2024 18:35:46 +0000
Source: global traffic	HTTP traffic detected: GET /td/fls/rul/activityi;fledge=1;src=4228414;type=views;cat=views;ord=4050429631327;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=1884632172;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
Source: global traffic	HTTP traffic detected: GET /td/rul/988382855?random=1707417356533&cv=11&fst=1707417356533&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
Source: global traffic	HTTP traffic detected: GET /activity;src=4228414;type=views;cat=views;ord=4050429631327;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=1884632172;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
Source: global traffic	HTTP traffic detected: GET /activity;register_conversion=1;src=4228414;type=views;cat=views;ord=4050429631327;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=1884632172;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: trigger, event-source;navigation-sourceReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
Source: global traffic	HTTP traffic detected: GET /td/rul/1060768846?random=1707417356687&cv=11&fst=1707417356687&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nh4qqVoyv2KiIad5kPNddW86jrjYgKSk8&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=page_type%3Dhome%3Bcheckindate%3D-1%3Bcheckoutdate%3D-1%3Bhotelid%3D0%3Bbook_window%3D%3Bweekday%3D-1%3Bdest_cc%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bnights%3D-1%3Brooms%3D-1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Bguestcount%3D-1%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdest_ufi%3D-1%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
Source: global traffic	HTTP traffic detected: GET /.well-known/web-identity HTTP/1.1Host: www.google.comConnection: keep-aliveAccept: application/jsonSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: webidentityUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /td/rul/973712236?random=1707417356716&cv=11&fst=1707417356716&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
Source: global traffic	HTTP traffic detected: GET /td/rul/973712236?random=1707417356745&cv=11&fst=1707417356745&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
Source: global traffic	HTTP traffic detected: GET /pr_ue?action=index&dest_ufi=-1&user_location=us&ttv_uc=undefined&date_in=-1&date_out=-1&rooms=-1&nights=-1&hr=-1&rid=undefined&p1=undefined&adults=-1&children=-1&city_name=-1&country_name=-1&dest_name=-1&region_name=-1&dest_cc=-1&dest_id=-1&dest_type=-1&lang=en-us&ai=304142&preferred_neighborhoods=undefined&preferred_star_ratings=undefined&seed=Pqit_vbiva0hUfw7CE5adQ&site=bookings2&sid=5171fc655664ddf74ab763a094523fb7&channel_id=3&exp_andy=undefined&stid=304142&exp_rmkt_test=global_on&famem=-1&famfn=-1&fampn=-1&logged_in=0&genis=&gwcur=-1&gwcuc=-1&bem=0&bip=0&book_window=&travel_type=unknown&currency=USD&em_sent=undefined&fn_sent=undefined&pn_sent=undefined&cv=-1&sage=18&atnm=&atnm_en=&pt_en=&cul=-1&mnns=-1&zz_val_eur=EUR&zz_look_action2id=undefined&zz_generic_id=undefined&zz_generic_id2=undefined&cip=81.181.57.74&cua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F117.0.0.0%20Safari%2F537.36&tms=gtm&sid_dyna=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000&rmk_var=-1&euuid=6271f1cf-d4aa-43a2-8f7e-6faa7f4000b0&gcem=-1&gcpn=-1&pguai=undefined&ttv=undefined&iamlt=&fbc=undefined&fbp=-1&msclid=undefined&pcid=3&bizp=&istnb=0&genisb=0&as=0&genaspb=1&p=https%3A%2F%2Fwww.booking.com%2F&r=&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAKFvpSuBsACAdICJDdhNmRhMmNiLThiNjMtNDQ1OS04MGUwLTI1OGM3NjBkNWQzMdgCBeACAQ&rbda=-1&tcl=undefined&cto_pld=undefined&cgumid=undefined&gtmcb=895809361 HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec
Source: global traffic	HTTP traffic detected: GET /td/rul/975716499?random=1707417356784&cv=11&fst=1707417356784&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
Source: global traffic	HTTP traffic detected: GET /g/collect?v=2&tid=G-A12345&gtm=45je4250z879615461za200&_p=1707417355756&gcs=G1--&gcd=13l3l3l3l5&npa=0&dma=0&cid=421694156.1707417338&ul=en-us&sr=1280x1024&ur=US-FL&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pscdl=noapi&sst.uc=US&sst.rnd=858995681.1707417357&sst.gcd=13l3l3l3l5&sst.tft=1707417355756&_s=1&sid=1707417345&sct=1&seg=1&dl=https%3A%2F%2Fwww.booking.com%2F&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=8579&richsstsse HTTP/1.1Host: gtm-mktg.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.booking.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKAimfo93c2GrBDhhKwo6bWKuVj3PL8CFrhr0%2BqmCv4c3d%2B3eXrKgkJqKu4CkWInIJPix%2FdzGgLa83gGD4gcCULKAMcixtmqDHZCsf6fcT6zs4kfQG%2FWoSybhGedPUjj4dJwcO6Qa13VaaHS%2FcpWxeTdhj%2FM0ATu%2Bc%3D; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.170741
Source: global traffic	HTTP traffic detected: GET /td/rul/975716499?random=1707417356815&cv=11&fst=1707417356815&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
Source: global traffic	HTTP traffic detected: GET /cm/i?pid=54f04dd9-4d34-47ee-87a6-989713215c80&u_scsid=224e9da2-3ebe-4de0-94ba-0d5d22c95b7f&u_sclid=75022d4d-ae50-4a02-8ab1-d3d7e0695f9e HTTP/1.1Host: tr.snapchat.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
Source: global traffic	HTTP traffic detected: GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e&u_sclid=75022d4d-ae50-4a02-8ab1-d3d7e0695f9e&u_scsid=224e9da2-3ebe-4de0-94ba-0d5d22c95b7f&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&df=true&huah=true&m_dcl=4806&m_fcps=3239&m_pi=4770&m_pl=7436&m_pv=2&m_rd=8600&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&trackId=42b0a81f-b07d-418a-b96a-d1b9785bfcee&ts=1707417357018&v=3.9.1-2402072137 HTTP/1.1Host: tr.snapchat.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
Source: global traffic	HTTP traffic detected: GET /config/com/54f04dd9-4d34-47ee-87a6-989713215c80.js?v=3.9.1-2402072137 HTTP/1.1Host: tr.snapchat.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/2880x868/308526620.jpeg?k=0663a1420ea98a013af0eda32bb4d11258521a39c5b8a5a4e2777ee5661dee55&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /activity;dc_pre=CIu156ixnIQDFXji_QUdFZIKVQ;src=4228414;type=views;cat=views;ord=4050429631327;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=1884632172;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
Source: global traffic	HTTP traffic detected: GET /gsi/fedcm/listaccounts HTTP/1.1Host: accounts.google.comConnection: keep-aliveAccept: application/jsonSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: webidentityUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /js_errors?pid=2c8482c2544201f4&url=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&m=UmFuZG9tSVYkc2RlIyh9YYo1mfebd19Q2WIimWOyIN1gUe4_-JQdNOBTMuHuYCJPue7ik10LWViyRYmmf149m9vSAg2JJTyfAEk9RiEQZejXjro5rDJvxnq57UaGsDKd0iBXLkMuV2sFYEHSFmXZW5zvkIdbv7-B87Oi9zo36Fnq7AU8K4Y8Y-SdtsN1A2dfLiciDUxBuNe45QSxoxZcHhPcdr6v26QamVEbge_7LQ_MDhbvlSKq9Lwf9P11FwHzxPymBNBmu_dZFb8tK9Z3wY0RAyYm7D0hfdu-LCtv4j3isKKp1L_CiYhwCnyC42X_OqimTrSjKXCbKfd3YnkJbQ&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSObZWJFfVDSMePCFYZWFXO&cors=1 HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-type: application/x-www-form-urlencodedAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3JoFJ/d3+jTRbAw8j2g3DznWiIRblwWjQRtj/04PDlBt/o55ocKzBIQxZ/e0Rt7iMiaISeSKOQt; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&versi
Source: global traffic	HTTP traffic detected: GET /safeframe/1-0-40/html/container.html HTTP/1.1Host: 0f492a439f0f79bcbc4fe15f41ea6011.safeframe.googlesyndication.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_bKnn4gJpxh610xABibZH5I811MGr-I-n9wGDzZ9KOO-e4-mB&random=635174606 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=2c8482c2544201f4&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|4,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|2,cCHObKdBdUHINPSXeHDALOLOLMO\|5,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv= HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-ET-Serialized-State: Ef98IG0fjgY56Y63N0XdXtUDZNdmFwr2XgKIh92Hu06LJvnE66CkRQe8kZKZ05qgzX-Booking-Language-Code: en-usX-Booking-Client-Info: sec-ch-ua-mobile: ?0X-Booking-AID: 304142User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: 2c8482c2544201f4X-Booking-Info: X-Booking-SiteType-Id: 1X-Booking-Session-Id: db6e5bbb32eac0e80cfcae9b22f5390dsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA
Source: global traffic	HTTP traffic detected: GET /user/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA%22%7D&cb=1707417357969&dep=2%2CPAGE_LOAD HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSY4dDVmd0o2ZzF4RVN2ZHlPL090aCt3NnpTWkZQdlF2bFR0OHJrNFBlM3NYbW9ucGRrMGIrL0lES2pGVnRRNzVaWitlbjRUZDhYVzc2U2E3ZFFrSzhES2RCUlpvb2tIT1pnU2JNS1FUWTd3bz0mclU4SWk0WVFTSXEwdmVJSEttb3prYlpuZzBjPQ=="
Source: global traffic	HTTP traffic detected: GET /user/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1707417357971&dep=5%2CEVENT_TAGS_ABSENT HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSY4dDVmd0o2ZzF4RVN2ZHlPL090aCt3NnpTWkZQdlF2bFR0OHJrNFBlM3NYbW9ucGRrMGIrL0lES2pGVnRRNzVaWitlbjRUZDhYVzc2U2E3ZFFrSzhES2RCUlpvb2tIT1pnU2JNS1FUWTd3bz0mclU4SWk0WVFTSXEwdmVJSEttb3prYlpuZzBjPQ=="
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&cb=8mbox63omknd HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AJmcDEmmSVjhXu6iSND5nUlaG4u8jg9r3gIsM8fricsYrppd_RXehS30W8rvMgVb0KtN3BzkTFd51AiDyh7KnUA; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /ddm/fls/z/dc_pre=CIu156ixnIQDFXji_QUdFZIKVQ;src=4228414;type=views;cat=views;ord=4050429631327;npa=0;auiddc=;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=1884632172;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2 HTTP/1.1Host: adservice.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/988382855/?random=1707417356533&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_gdaH382UdbAT3pTI4QArto9DJ6zfY4NMXdbth7hSGs09MH9-&random=4243601863&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1060768846/?random=1707417356687&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nh4qqVoyv2KiIad5kPNddW86jrjYgKSk8&npa=0&data=page_type%3Dhome%3Bcheckindate%3D-1%3Bcheckoutdate%3D-1%3Bhotelid%3D0%3Bbook_window%3D%3Bweekday%3D-1%3Bdest_cc%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bnights%3D-1%3Brooms%3D-1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Bguestcount%3D-1%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdest_ufi%3D-1%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_PSJZTlF3xHNBsCQJNXjp8P52oWLmj9dYKvL6ae3o34g5Uiz2&random=954397539&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/973712236/?random=1707417356716&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_VC_dWnF5zlO-sJxDecgZQ7JbED0pEd9zFsh_javD5gIRkRhk&random=689319094&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/973712236/?random=1707417356745&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_c43MYL9RI3Thfd_9DdM04RURnZRUImtlZ5ONbr2LQojys0VJ&random=4009849583&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/975716499/?random=1707417356815&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_HJeVreViYDXLcWf6R_L2LSf4gUv3DarQGY-WFjASXo1WtBY_&random=2474861554&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/975716499/?random=1707417356784&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_42ioI1Ek00qaYvOFdRw6k6FN1HsC1z-x2AZ4jVpIftSxh6GR&random=3815724033&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /v3/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%23indexsearch%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%226461a31a%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1707417357983 HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSY4dDVmd0o2ZzF4RVN2ZHlPL090aCt3NnpTWkZQdlF2bFR0OHJrNFBlM3NYbW9ucGRrMGIrL0lES2pGVnRRNzVaWitlbjRUZDhYVzc2U2E3ZFFrSzhES2RCUlpvb2tIT1pnU2JNS1FUWTd3bz0mclU4SWk0WVFTSXEwdmVJSEttb3prYlpuZzBjPQ=="
Source: global traffic	HTTP traffic detected: GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=2c8482c2544201f4&ete=&etg=&etcg=cCHObEfEITNPfbeQMIaWYUQJFFQccCcCcCC\|5&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,cCHObKdBdUHINPSXeHDALOLOLMO\|3&etgwv= HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-ET-Serialized-State: Ef98IG0fjgY56Y63N0XdXtUDZNdmFwr2XgKIh92Hu06LJvnE66CkRQe8kZKZ05qgzX-Booking-Language-Code: en-usX-Booking-Client-Info: sec-ch-ua-mobile: ?0X-Booking-AID: 304142User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: 2c8482c2544201f4X-Booking-Info: X-Booking-SiteType-Id: 1X-Booking-Session-Id: db6e5bbb32eac0e80cfcae9b22f5390dsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3UgB
Source: global traffic	HTTP traffic detected: GET /js_tracking?aid=304142&pid=2c8482c2544201f4&ver=2&sid=5171fc655664ddf74ab763a094523fb7&ref_action=index&lang=en-us&stype=1&ete=&etg=&etcg=&ets=cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3&etgwv=js_web_vitals_cls_per_mille\|1&m=UmFuZG9tSVYkc2RlIyh9YYo1mfebd19Q2WIimWOyIN1gUe4_-JQdNOBTMuHuYCJPue7ik10LWViyRYmmf149m9vSAg2JJTyfAEk9RiEQZejXjro5rDJvxnq57UaGsDKd0iBXLkMuV2sFYEHSFmXZW5zvkIdbv7-B87Oi9zo36Fnq7AU8K4Y8Y-SdtsN1A2dfLiciDUxBuNe45QSxoxZcHhPcdr6v26QamVEbge_7LQ_MDhbvlSKq9Lwf9P11FwHzxPymBNBmu_dZFb8tK9Z3wY0RAyYm7D0hfdu-LCtv4j3isKKp1L_CiYhwCnyC42X_OqimTrSjKXCbKfd3YnkJbQ HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAauuCoe4CAAAA:K1lQMnvwbhrjeE1+SbVHxPPPgukpXhVavnjRqfHXvwEu4MNdPWo9jM8H76Xa918LHxuFz21c6V1bBB/7xxXoFkJW4C6eFKGgPfkNW5GndqZvmvmrJUPY0Nv/imAQxU
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAauuCoe4CAAAA:K1lQMnvwbhrjeE1+SbVHxPPPgukpXhVavnjRqfHXvwEu4MNdPWo9jM8H76Xa918LHxuFz21c6V1bBB/7xxXoFkJW4C6eFKGgPfkNW5GndqZvmvmrJUPY0Nv/imAQxU67dBDE4n7Px3axy3ehQYZ4QIBr76DkS4+4ITvc5Vl0gKXaWhFKFagDreMEbKGYVZrOj3CsSxNLAVj5g9OeNBuwyagHwqstdV4T1qmZUDdXclLvnAdAHFF2Cf3beEHUmkl/Lh/c8Rxh; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhMkPrb7BMdgkeBlz9oHfYQuoYGiM4pBYZsR%2FHlaqFOXgTZUhpPTElQGaxRiPA1iwdBpvuySMc986R8T0pwU%2BGYv2d6r9dFCh8SPiGQb1F993nZXnhDTp%2BFtyEtuJp0WMukPWkwubQ56I6hY%2B%2BQ%2FLAU%3D
Source: global traffic	HTTP traffic detected: GET /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=BXAbRIVE HTTP/1.1Host: accommodations.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhMkPrb7BMdgkeBlz9oHfYQuoYGiM4pBYZsR%2FHlaqFOXgTZUhpPTElQGaxRiPA1iwdBpvuySMc986R8T0pwU%2BGYv2d6r9dFCh8SPiGQb1F993nZXnhDTp%2BFtyEtuJp0WMukPWkwubQ56I6hY%2B%2BQ%2FLAU%3D
Source: global traffic	HTTP traffic detected: GET /xdata/images/hotel/263x210/100235855.jpeg?k=5b6e6cff16cfd290e953768d63ee15f633b56348238a705c45759aa3a81ba82b&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/263x210/57584488.jpeg?k=d8d4706fc72ee789d870eb6b05c0e546fd4ad85d72a3af3e30fb80ca72f0ba57&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/977409.jpg?k=82c14f9e6cea94829ee0528a3aa4324111d3482e9f095194500746fa7ca2769e&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/976877.jpg?k=2aab28217f0fb039e0f35ea2b2c3976141b5860b074f74220edf998115935cda&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v3/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1707417358880&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA%22%2C%22aem_eligible_list%22%3A%5B%22fn%22%5D%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%23indexsearch%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%226461a31a%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSY4dDVmd0o2ZzF4RVN2ZHlPL090aCt3NnpTWkZQdlF2bFR0OHJrNFBlM3NYbW9ucGRrMGIrL0lES2pGVnRRNzVaWitlbjRUZDhYVzc2U2E3ZFFrSzhES2RCUlpvb2tIT1pnU2JNS1FUWTd3bz0mclU4SWk0WVFTSXEwdmVJSEttb3prYlpuZzBjPQ=="
Source: global traffic	HTTP traffic detected: GET /web-vitals/send-vitals HTTP/1.1Host: web-vitals.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBtrc9jcR8FHAZMgVsPDpO7k61zYzfvcAjZN%2BRki3c7UB3918wAejvzi8Uw9wj94zjKlskVeTbjCxUVFcfkqNKas8HUPlorLCqhSg%2BuX8%2BK09RWBvmliG5DU9pml%2FAvTAo8b0NT01eyZ7LmqOV9j%2FXUt583TZ0KwvdQ%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA
Source: global traffic	HTTP traffic detected: GET /activity;register_conversion=1;src=4228414;type=views;cat=views;ord=4050429631327;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=1884632172;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: ad.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js_tracking?aid=304142&pid=2c8482c2544201f4&ver=2&sid=5171fc655664ddf74ab763a094523fb7&ref_action=index&lang=en-us&stype=1&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|3239&m=UmFuZG9tSVYkc2RlIyh9YYo1mfebd19Q2WIimWOyIN1gUe4_-JQdNOBTMuHuYCJPue7ik10LWViyRYmmf149m9vSAg2JJTyfAEk9RiEQZejXjro5rDJvxnq57UaGsDKd0iBXLkMuV2sFYEHSFmXZW5zvkIdbv7-B87Oi9zo36Fnq7AU8K4Y8Y-SdtsN1A2dfLiciDUxBuNe45QSxoxZcHhPcdr6v26QamVEbge_7LQ_MDhbvlSKq9Lwf9P11FwHzxPymBNBmu_dZFb8tK9Z3wY0RAyYm7D0hfdu-LCtv4j3isKKp1L_CiYhwCnyC42X_OqimTrSjKXCbKfd3YnkJbQ HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBtrc9jcR8FHAZMgVsPDpO7k61zYzfvcAjZN%2BRki3c7UB3918wAejvzi8Uw9wj94zjKlskVeTbjCxUVFcfkqNKas8HUPlorLCqhSg%2BuX8%2BK09RWBvmliG5DU9pml%2FAvTAo8b0NT01eyZ7LmqOV9j%2FXUt583TZ0KwvdQ%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-
Source: global traffic	HTTP traffic detected: GET /g/collect?v=2&tid=G-A12345&gtm=45je4250z879615461za200&_p=1707417355756&gcs=G1--&gcd=13l3l3l3l5&npa=0&dma=0&cid=421694156.1707417338&ul=en-us&sr=1280x1024&ur=US-FL&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pscdl=noapi&sst.uc=US&sst.rnd=858995681.1707417357&sst.gcd=13l3l3l3l5&sst.tft=1707417355756&_s=1&sid=1707417345&sct=1&seg=1&dl=https%3A%2F%2Fwww.booking.com%2F&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=8579&richsstsse HTTP/1.1Host: gtm-mktg.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBtrc9jcR8FHAZMgVsPDpO7k61zYzfvcAjZN%2BRki3c7UB3918wAejvzi8Uw9wj94zjKlskVeTbjCxUVFcfkqNKas8HUPlorLCqhSg%2BuX8%2BK09RWBvmliG5DU9pml%2FAvTAo8b0NT01eyZ7LmqOV9j%2FXUt583TZ0KwvdQ%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA
Source: global traffic	HTTP traffic detected: GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e&u_sclid=75022d4d-ae50-4a02-8ab1-d3d7e0695f9e&u_scsid=224e9da2-3ebe-4de0-94ba-0d5d22c95b7f&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&df=true&huah=true&m_dcl=4806&m_fcps=3239&m_pi=4770&m_pl=7436&m_pv=2&m_rd=8600&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&trackId=42b0a81f-b07d-418a-b96a-d1b9785bfcee&ts=1707417357018&v=3.9.1-2402072137 HTTP/1.1Host: tr.snapchat.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_bKnn4gJpxh610xABibZH5I811MGr-I-n9wGDzZ9KOO-e4-mB&random=635174606 HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/2880x868/308526620.jpeg?k=0663a1420ea98a013af0eda32bb4d11258521a39c5b8a5a4e2777ee5661dee55&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js_errors?pid=2c8482c2544201f4&url=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&m=UmFuZG9tSVYkc2RlIyh9YYo1mfebd19Q2WIimWOyIN1gUe4_-JQdNOBTMuHuYCJPue7ik10LWViyRYmmf149m9vSAg2JJTyfAEk9RiEQZejXjro5rDJvxnq57UaGsDKd0iBXLkMuV2sFYEHSFmXZW5zvkIdbv7-B87Oi9zo36Fnq7AU8K4Y8Y-SdtsN1A2dfLiciDUxBuNe45QSxoxZcHhPcdr6v26QamVEbge_7LQ_MDhbvlSKq9Lwf9P11FwHzxPymBNBmu_dZFb8tK9Z3wY0RAyYm7D0hfdu-LCtv4j3isKKp1L_CiYhwCnyC42X_OqimTrSjKXCbKfd3YnkJbQ&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSObZWJFfVDSMePCFYZWFXO&cors=1 HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqT
Source: global traffic	HTTP traffic detected: GET /ddm/fls/z/dc_pre=CIu156ixnIQDFXji_QUdFZIKVQ;src=4228414;type=views;cat=views;ord=4050429631327;npa=0;auiddc=;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=1884632172;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2 HTTP/1.1Host: adservice.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /*X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1060768846/?random=1707417356687&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nh4qqVoyv2KiIad5kPNddW86jrjYgKSk8&npa=0&data=page_type%3Dhome%3Bcheckindate%3D-1%3Bcheckoutdate%3D-1%3Bhotelid%3D0%3Bbook_window%3D%3Bweekday%3D-1%3Bdest_cc%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bnights%3D-1%3Brooms%3D-1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Bguestcount%3D-1%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdest_ufi%3D-1%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_PSJZTlF3xHNBsCQJNXjp8P52oWLmj9dYKvL6ae3o34g5Uiz2&random=954397539&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /user/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1707417357971&dep=5%2CEVENT_TAGS_ABSENT HTTP/1.1Host: ct.pinterest.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZTaWxiNnRDMy9JV0h1aGhEb1ZWT0pJR2N4OVhNTUFySysyd0MyYlJJZURDYVA0NEJsWkRmdjVWNFB5OEtwc1VNSVpJVmM3UVBnNlh4TXB6RExNN2lDdHIxSk5zQ0RjdlZiSHh0ZGFPbThlRT0mTFJRTHkyRnB4cUZkQmZ6YUIwR1l2Y2NzbDNRPQ=="
Source: global traffic	HTTP traffic detected: GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=2c8482c2544201f4&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|4,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|2,cCHObKdBdUHINPSXeHDALOLOLMO\|5,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv= HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGp
Source: global traffic	HTTP traffic detected: GET /user/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA%22%7D&cb=1707417357969&dep=2%2CPAGE_LOAD HTTP/1.1Host: ct.pinterest.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZTaWxiNnRDMy9JV0h1aGhEb1ZWT0pJR2N4OVhNTUFySysyd0MyYlJJZURDYVA0NEJsWkRmdjVWNFB5OEtwc1VNSVpJVmM3UVBnNlh4TXB6RExNN2lDdHIxSk5zQ0RjdlZiSHh0ZGFPbThlRT0mTFJRTHkyRnB4cUZkQmZ6YUIwR1l2Y2NzbDNRPQ=="
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/988382855/?random=1707417356533&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_gdaH382UdbAT3pTI4QArto9DJ6zfY4NMXdbth7hSGs09MH9-&random=4243601863&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/973712236/?random=1707417356716&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_VC_dWnF5zlO-sJxDecgZQ7JbED0pEd9zFsh_javD5gIRkRhk&random=689319094&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/973712236/?random=1707417356745&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_c43MYL9RI3Thfd_9DdM04RURnZRUImtlZ5ONbr2LQojys0VJ&random=4009849583&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqTECAAAA:KZH0LXn1LmtLax44cr3ulN7ZWKDKmkwD0f1NvxkTb/jMqN1qVF8/PPzxZ3FfGbac4KlwMzVqtHBLtnz3TlfY3lZFLuRxBo/G3GoxVpl40Pm79RmXzC5FffFVzmtAhflKkKku7qPdEaN9tz27eDhEX7WXyEmmwnE8ltFV9YWYokbWUXLMQfpGhpTzQoDT/hiUfT0mUysYnL1xui4+/zI3a36phZVLKnVp39vcKq/HJmo0nWX97fMIcKfWJBuirBA//m3YGM3S; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/975716499/?random=1707417356815&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_HJeVreViYDXLcWf6R_L2LSf4gUv3DarQGY-WFjASXo1WtBY_&random=2474861554&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqTECAAAA:KZH0LXn1LmtLax44cr3ulN7ZWKDKmkwD0f1NvxkTb/jMqN1qVF8/PPzxZ3FfGbac4KlwMzVqtHBLtnz3TlfY3lZFLuRxBo/G3GoxVpl40Pm79RmXzC5FffFVzmtAhflKkKku7qPdEaN9tz27eDhEX7WXyEmmwnE8ltFV9YWYokbWUXLMQfpGhpTzQoDT/hiUfT0mUysYnL1xui4+/zI3a36phZVLKnVp39vcKq/HJmo0nWX97fMIcKfWJBuirBA//m3YGM3S; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D
Source: global traffic	HTTP traffic detected: GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=2c8482c2544201f4&ete=&etg=&etcg=cCHObEfEITNPfbeQMIaWYUQJFFQccCcCcCC\|5&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,cCHObKdBdUHINPSXeHDALOLOLMO\|3&etgwv= HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqTECAAAA:KZH0LXn1LmtLax44cr3ulN7ZWKDKmkwD0f1NvxkTb/jMqN1qVF8/PPzxZ3FfGbac4KlwMzVqtHBLtnz3TlfY3lZFLuRxBo/G3GoxVpl40Pm79RmXzC5FffFVzmtAhflKkKku7qPdEaN9tz27eDhEX7WXyEmmwnE8ltFV9YWYokbWUXLMQfpGhpTzQoDT/hiUfT0mUysYnL1xui4+/zI3a36phZVLKnVp39vcKq/HJmo0nWX97fMIcKfWJBuirBA//m3YGM3S; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNull
Source: global traffic	HTTP traffic detected: GET /xdata/images/hotel/263x210/100235855.jpeg?k=5b6e6cff16cfd290e953768d63ee15f633b56348238a705c45759aa3a81ba82b&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sendlayoutevents HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqTECAAAA:KZH0LXn1LmtLax44cr3ulN7ZWKDKmkwD0f1NvxkTb/jMqN1qVF8/PPzxZ3FfGbac4KlwMzVqtHBLtnz3TlfY3lZFLuRxBo/G3GoxVpl40Pm79RmXzC5FffFVzmtAhflKkKku7qPdEaN9tz27eDhEX7WXyEmmwnE8ltFV9YWYokbWUXLMQfpGhpTzQoDT/hiUfT0mUysYnL1xui4+/zI3a36phZVLKnVp39vcKq/HJmo0nWX97fMIcKfWJBuirBA//m3YGM3S; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D
Source: global traffic	HTTP traffic detected: GET /xdata/images/xphoto/263x210/57584488.jpeg?k=d8d4706fc72ee789d870eb6b05c0e546fd4ad85d72a3af3e30fb80ca72f0ba57&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v3/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%23indexsearch%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%226461a31a%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1707417357983 HTTP/1.1Host: ct.pinterest.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZTaWxiNnRDMy9JV0h1aGhEb1ZWT0pJR2N4OVhNTUFySysyd0MyYlJJZURDYVA0NEJsWkRmdjVWNFB5OEtwc1VNSVpJVmM3UVBnNlh4TXB6RExNN2lDdHIxSk5zQ0RjdlZiSHh0ZGFPbThlRT0mTFJRTHkyRnB4cUZkQmZ6YUIwR1l2Y2NzbDNRPQ=="
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/977409.jpg?k=82c14f9e6cea94829ee0528a3aa4324111d3482e9f095194500746fa7ca2769e&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v3/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1707417358880&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA%22%2C%22aem_eligible_list%22%3A%5B%22fn%22%5D%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%23indexsearch%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%226461a31a%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D HTTP/1.1Host: ct.pinterest.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZTaWxiNnRDMy9JV0h1aGhEb1ZWT0pJR2N4OVhNTUFySysyd0MyYlJJZURDYVA0NEJsWkRmdjVWNFB5OEtwc1VNSVpJVmM3UVBnNlh4TXB6RExNN2lDdHIxSk5zQ0RjdlZiSHh0ZGFPbThlRT0mTFJRTHkyRnB4cUZkQmZ6YUIwR1l2Y2NzbDNRPQ=="
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/976877.jpg?k=2aab28217f0fb039e0f35ea2b2c3976141b5860b074f74220edf998115935cda&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o= HTTP/1.1Host: r-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/975716499/?random=1707417356784&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_42ioI1Ek00qaYvOFdRw6k6FN1HsC1z-x2AZ4jVpIftSxh6GR&random=3815724033&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqTECAAAA:KZH0LXn1LmtLax44cr3ulN7ZWKDKmkwD0f1NvxkTb/jMqN1qVF8/PPzxZ3FfGbac4KlwMzVqtHBLtnz3TlfY3lZFLuRxBo/G3GoxVpl40Pm79RmXzC5FffFVzmtAhflKkKku7qPdEaN9tz27eDhEX7WXyEmmwnE8ltFV9YWYokbWUXLMQfpGhpTzQoDT/hiUfT0mUysYnL1xui4+/zI3a36phZVLKnVp39vcKq/HJmo0nWX97fMIcKfWJBuirBA//m3YGM3S; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqTECAAAA:KZH0LXn1LmtLax44cr3ulN7ZWKDKmkwD0f1NvxkTb/jMqN1qVF8/PPzxZ3FfGbac4KlwMzVqtHBLtnz3TlfY3lZFLuRxBo/G3GoxVpl40Pm79RmXzC5FffFVzmtAhflKkKku7qPdEaN9tz27eDhEX7WXyEmmwnE8ltFV9YWYokbWUXLMQfpGhpTzQoDT/hiUfT0mUysYnL1xui4+/zI3a36phZVLKnVp39vcKq/HJmo0nWX97fMIcKfWJBuirBA//m3YGM3S; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D
Source: global traffic	HTTP traffic detected: GET /js_tracking?aid=304142&pid=2c8482c2544201f4&ver=2&sid=5171fc655664ddf74ab763a094523fb7&ref_action=index&lang=en-us&stype=1&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|69\|1&m=UmFuZG9tSVYkc2RlIyh9YYo1mfebd19Q2WIimWOyIN1gUe4_-JQdNOBTMuHuYCJPue7ik10LWViyRYmmf149m9vSAg2JJTyfAEk9RiEQZejXjro5rDJvxnq57UaGsDKd0iBXLkMuV2sFYEHSFmXZW5zvkIdbv7-B87Oi9zo36Fnq7AU8K4Y8Y-SdtsN1A2dfLiciDUxBuNe45QSxoxZcHhPcdr6v26QamVEbge_7LQ_MDhbvlSKq9Lwf9P11FwHzxPymBNBmu_dZFb8tK9Z3wY0RAyYm7D0hfdu-LCtv4j3isKKp1L_CiYhwCnyC42X_OqimTrSjKXCbKfd3YnkJbQ HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3X-Booking-CSRF: RVfFZQAAAAA=qVueflVyIcgKOJdfCMKcmiDGjvY9UqM_W79drieypCCd1wLxtNOjZPcMNKEslcD0Tiyh8b7rdIv86FT89bynmubUkLo31LJ5cM248yQm3ulKZFWN-WKHCjXqy964TaJvn5A_S7b4oaNG1jhNZ7aGF2JNPgwXGQBCPiOREYDFBwUwhotUpEosEVmLfdyz_vXpYSXlaaCHZibCaVWmsec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAKFvpSuBsACAdICJDdhNmRhMmNiLThiNjMtNDQ1OS04MGUwLTI1OGM3NjBkNWQzMdgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: 2c8482c2544201f4X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,1912460\|1,1856870\|1,1912460\|7,1908890\|1,1912460\|6,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|4,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|2,cCHObKdBdUHINPSXeHDALOLOLMO\|5,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHOb
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqTECAAAA:KZH0LXn1LmtLax44cr3ulN7ZWKDKmkwD0f1NvxkTb/jMqN1qVF8/PPzxZ3FfGbac4KlwMzVqtHBLtnz3TlfY3lZFLuRxBo/G3GoxVpl40Pm79RmXzC5FffFVzmtAhflKkKku7qPdEaN9tz27eDhEX7WXyEmmwnE8ltFV9YWYokbWUXLMQfpGhpTzQoDT/hiUfT0mUysYnL1xui4+/zI3a36phZVLKnVp39vcKq/HJmo0nWX97fMIcKfWJBuirBA//m3YGM3S; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqTECAAAA:KZH0LXn1LmtLax44cr3ulN7ZWKDKmkwD0f1NvxkTb/jMqN1qVF8/PPzxZ3FfGbac4KlwMzVqtHBLtnz3TlfY3lZFLuRxBo/G3GoxVpl40Pm79RmXzC5FffFVzmtAhflKkKku7qPdEaN9tz27eDhEX7WXyEmmwnE8ltFV9YWYokbWUXLMQfpGhpTzQoDT/hiUfT0mUysYnL1xui4+/zI3a36phZVLKnVp39vcKq/HJmo0nWX97fMIcKfWJBuirBA//m3YGM3S; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqTECAAAA:KZH0LXn1LmtLax44cr3ulN7ZWKDKmkwD0f1NvxkTb/jMqN1qVF8/PPzxZ3FfGbac4KlwMzVqtHBLtnz3TlfY3lZFLuRxBo/G3GoxVpl40Pm79RmXzC5FffFVzmtAhflKkKku7qPdEaN9tz27eDhEX7WXyEmmwnE8ltFV9YWYokbWUXLMQfpGhpTzQoDT/hiUfT0mUysYnL1xui4+/zI3a36phZVLKnVp39vcKq/HJmo0nWX97fMIcKfWJBuirBA//m3YGM3S; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D
Source: global traffic	HTTP traffic detected: GET /dml/graphql?lang=en-us HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqTECAAAA:KZH0LXn1LmtLax44cr3ulN7ZWKDKmkwD0f1NvxkTb/jMqN1qVF8/PPzxZ3FfGbac4KlwMzVqtHBLtnz3TlfY3lZFLuRxBo/G3GoxVpl40Pm79RmXzC5FffFVzmtAhflKkKku7qPdEaN9tz27eDhEX7WXyEmmwnE8ltFV9YWYokbWUXLMQfpGhpTzQoDT/hiUfT0mUysYnL1xui4+/zI3a36phZVLKnVp39vcKq/HJmo0nWX97fMIcKfWJBuirBA//m3YGM3S; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D; aws-waf-token=cd5c45c3-88
Source: global traffic	HTTP traffic detected: GET /web-vitals/send-vitals HTTP/1.1Host: web-vitals.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D
Source: global traffic	HTTP traffic detected: GET /js_tracking?aid=304142&pid=2c8482c2544201f4&ver=2&sid=5171fc655664ddf74ab763a094523fb7&ref_action=index&lang=en-us&stype=1&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|69\|1&m=UmFuZG9tSVYkc2RlIyh9YYo1mfebd19Q2WIimWOyIN1gUe4_-JQdNOBTMuHuYCJPue7ik10LWViyRYmmf149m9vSAg2JJTyfAEk9RiEQZejXjro5rDJvxnq57UaGsDKd0iBXLkMuV2sFYEHSFmXZW5zvkIdbv7-B87Oi9zo36Fnq7AU8K4Y8Y-SdtsN1A2dfLiciDUxBuNe45QSxoxZcHhPcdr6v26QamVEbge_7LQ_MDhbvlSKq9Lwf9P11FwHzxPymBNBmu_dZFb8tK9Z3wY0RAyYm7D0hfdu-LCtv4j3isKKp1L_CiYhwCnyC42X_OqimTrSjKXCbKfd3YnkJbQ HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D; aws
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/reload?k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AJmcDEl4lP7G1sUzlkfo-ph5oEYDaZrMsr87jx805YMBfBXipJ4MvomJQXIF7z5TPrZE7LxvSiQSdmfSY1DEipM; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/client.38ffee15.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "c9009dc966b4c139ffffe886598ac0c0"If-Modified-Since: Thu, 08 Feb 2024 12:34:07 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/7bcb015e.5b709f3d.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "8b761ecf11f6b807d0d765ee8cd5851e"If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/eb60141d.cad86b29.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "2980ea90c3f4c27d77bffbd1527870a7"If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/c6a78acb.bffda4a9.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "6f3e8bb7938a05e927b3ca4454f98fa8"If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/f50a2dfc.837540b6.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "fdb620d16ddcb3d874c0d96880365b4d"If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/a6a21c13.8939445f.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "e262f92e286a4c74280bd4b3fdee8cbb"If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/f5d0e2e7.a54d85eb.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "88d8b9631fe60984baabd22260a86e6e"If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/d2a738da.079c3b4c.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "1a7c523a95596c5b0b122ad8d8e3b553"If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/4e596c2c.3a2fb681.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "51be0c43cc481b13fe70d3ba27e2ffd9"If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/53a8d0d3.b1818b84.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "f820477c322829e348f318a453e432a5"If-Modified-Since: Thu, 08 Feb 2024 11:37:52 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/4a89d2db.6c0ec4b3.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "71d148d7e362a60e9a0c56222e4c1c42"If-Modified-Since: Wed, 07 Feb 2024 05:15:19 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/0a098284.df965884.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "47bb1a597dd42cabf5425fe918f725b5"
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/7bcb015e.cf9d45ea.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "762dbdde80c9b4faddafa20df78215de"If-Modified-Since: Thu, 08 Feb 2024 14:53:52 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/eb60141d.05ae682b.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "8bd695624a0284c0c75e95e6cf849e19"If-Modified-Since: Mon, 05 Feb 2024 10:15:49 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/f50a2dfc.854e46ce.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "16cef59d8ed8d631e974161b3405d558"If-Modified-Since: Thu, 08 Feb 2024 10:31:47 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/a6a21c13.ad9f14d9.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "16323cfbc6f714b70bb4777cc3449e90"If-Modified-Since: Thu, 08 Feb 2024 11:37:54 GMT
Source: global traffic	HTTP traffic detected: GET /logo?ver=1&sid=5171fc655664ddf74ab763a094523fb7&t=17074173641 HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAcliCNHMNAAAA:n/cv5VZ9qVNMSvFL0bOQTKuI2OPvTEeFeyhTL7WjwGM0OG/n4w2baTykBBh/YZIH0afPSLTNxnTfx+/G0aiWdeVHZg/Gg5yqOc93MErd93yjeIsWQYtnDgUv4gK4d0shhZpxaBPa+/51H0+sJLfy6r/auQniQkQaNWbowrr4aiuZ1Hxn5YJ1OMhEssxQqS8lSl7lQ+l4Gvg/GzC+glgVIJ7q+Vvd2qNXBU8be/eAJXt3v+IBgPPT7+3k6BIj3HSxrID9I1jb; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBII%2FyfgaNcGcNRD%2FSIhmJOq2eq3%2BSsDkjCXhcZUnZ5lZoVH38ibtzR5rmv36AACzoYnyI6DkiXbs1zid0LilInunTzAXjjR4F9cb5ipLEysf66ICkaefY9O8pJ2ZjctKUTfhYUZ2omr4cRil0AUmIKbwrbYnWNYwUU%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/f5d0e2e7.5cd38fd6.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "2a4be84facf3e21bb4a9ebb12a10a92e"If-Modified-Since: Wed, 07 Feb 2024 09:32:56 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/d2a738da.35cba7bb.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "1aa264da71f354aad6dce94f5a3374d9"If-Modified-Since: Tue, 06 Feb 2024 10:33:56 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/4e596c2c.d3513b52.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "cbed6c40f80b88278fe92b7987f24d10"If-Modified-Since: Thu, 08 Feb 2024 14:16:47 GMT
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/21928fd5.cc39b346.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "32f6cb6519036a5cb6d7245e1f3f4a10"If-Modified-Since: Mon, 05 Feb 2024 10:15:48 GMT
Source: global traffic	HTTP traffic detected: GET /js_tracking?sid=5171fc655664ddf74ab763a094523fb7&aid=304142&ref_action=index&ver=2&pid=87e482caf42702d0&lang=en-us&stype=1&ete=&etg=&etcg=&ets=cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YUe5zZbLHt0YNre0CiGBBmP5hKTY_IzZqpWBtitYrnE-ba2NOPqZSPGdnbkQM2vO343hpsChBnayfrRG7jVW0hI1Ke4kKZ85U_m7O1xbR8NLSlv2Zn-4d5ku6anu7qAZgjoLQxWZjIis3cNA3ef3I_aOxDvMotUV5ZQc6OhcEEody8ooGsshLIhRMDad6kRNg_HeFvW36Wr8mOnNh6fMuy8OZ9w095BIb2XL0zt8fY-5SPQHxgI7NWrdI31vzPG5nOwkA1lE2mJxFh3z4YXPwcZPq5z6drlkg3iN9tdtKjt0cXf7rJdLIbIGLmOniyEf0g HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3X-Booking-CSRF: VFfFZQAAAAA=I0VyxrbmcRsXF8b8667mJSw00zD1jijstj9zA-B31AE-SHf9fwLae-NRdcEvORIZUidJgBp9cG2_VeJ_vvAjE9POdq-3lpUXJKUz5osKhhR_6IWR4vCHyNCN9_lrexSyhyl857y4-aUKLEPdAzHdPtU-69GNk1-tINwO8UxKp7l2RhgisIpi5FvtqY4OOakuCSFjRchHm9pnK7Y6sec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: 87e482caf42702d0X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,1856870\|1,1912460\|7,1912460\|1,1908890\|1,1912460\|6X-Booking-SiteType-Id: 1X-Requested-With: XMLHttpRequestX-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=17074173
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/3d066b0d.6a5d1f73.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "b9431959d1fba61458d500bc4cba3939"If-Modified-Since: Tue, 06 Feb 2024 05:16:14 GMT
Source: global traffic	HTTP traffic detected: GET /js_tracking?sid=5171fc655664ddf74ab763a094523fb7&aid=304142&ref_action=index&ver=2&pid=87e482caf42702d0&lang=en-us&stype=1&ete=&etg=&etcg=cCHObKdPHMfFdHMEKdbfZRLRMLFSZaTaTaET\|1&ets=cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YUe5zZbLHt0YNre0CiGBBmP5hKTY_IzZqpWBtitYrnE-ba2NOPqZSPGdnbkQM2vO343hpsChBnayfrRG7jVW0hI1Ke4kKZ85U_m7O1xbR8NLSlv2Zn-4d5ku6anu7qAZgjoLQxWZjIis3cNA3ef3I_aOxDvMotUV5ZQc6OhcEEody8ooGsshLIhRMDad6kRNg_HeFvW36Wr8mOnNh6fMuy8OZ9w095BIb2XL0zt8fY-5SPQHxgI7NWrdI31vzPG5nOwkA1lE2mJxFh3z4YXPwcZPq5z6drlkg3iN9tdtKjt0cXf7rJdLIbIGLmOniyEf0g HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6X-Booking-CSRF: VFfFZQAAAAA=I0VyxrbmcRsXF8b8667mJSw00zD1jijstj9zA-B31AE-SHf9fwLae-NRdcEvORIZUidJgBp9cG2_VeJ_vvAjE9POdq-3lpUXJKUz5osKhhR_6IWR4vCHyNCN9_lrexSyhyl857y4-aUKLEPdAzHdPtU-69GNk1-tINwO8UxKp7l2RhgisIpi5FvtqY4OOakuCSFjRchHm9pnK7Y6sec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: 87e482caf42702d0X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,1856870\|1,1912460\|7,1912460\|1,1908890\|1,1912460\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6X-Booking-SiteType-Id: 1X-Requested-With: XMLHttpRequestX-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-;
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/js/4a89d2db.6c0ec4b3.chunk.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-None-Match: "71d148d7e362a60e9a0c56222e4c1c42"If-Modified-Since: Wed, 07 Feb 2024 05:15:19 GMT
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js?render=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&onload=onLoadRecaptchaV3Callback&_=1707417367075 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AJmcDEl4lP7G1sUzlkfo-ph5oEYDaZrMsr87jx805YMBfBXipJ4MvomJQXIF7z5TPrZE7LxvSiQSdmfSY1DEipM; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /js_tracking?sid=5171fc655664ddf74ab763a094523fb7&aid=304142&ref_action=index&ver=2&pid=87e482caf42702d0&lang=en-us&stype=1&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|1&m=UmFuZG9tSVYkc2RlIyh9YUe5zZbLHt0YNre0CiGBBmP5hKTY_IzZqpWBtitYrnE-ba2NOPqZSPGdnbkQM2vO343hpsChBnayfrRG7jVW0hI1Ke4kKZ85U_m7O1xbR8NLSlv2Zn-4d5ku6anu7qAZgjoLQxWZjIis3cNA3ef3I_aOxDvMotUV5ZQc6OhcEEody8ooGsshLIhRMDad6kRNg_HeFvW36Wr8mOnNh6fMuy8OZ9w095BIb2XL0zt8fY-5SPQHxgI7NWrdI31vzPG5nOwkA1lE2mJxFh3z4YXPwcZPq5z6drlkg3iN9tdtKjt0cXf7rJdLIbIGLmOniyEf0g HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6X-Booking-CSRF: VFfFZQAAAAA=I0VyxrbmcRsXF8b8667mJSw00zD1jijstj9zA-B31AE-SHf9fwLae-NRdcEvORIZUidJgBp9cG2_VeJ_vvAjE9POdq-3lpUXJKUz5osKhhR_6IWR4vCHyNCN9_lrexSyhyl857y4-aUKLEPdAzHdPtU-69GNk1-tINwO8UxKp7l2RhgisIpi5FvtqY4OOakuCSFjRchHm9pnK7Y6sec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: 87e482caf42702d0X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,1856870\|1,1912460\|7,1912460\|1,1908890\|1,1912460\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6X-Booking-SiteType-Id: 1X-Requested-With: XMLHttpRequestX-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4e
Source: global traffic	HTTP traffic detected: GET /pr_ue?action=index&dest_ufi=-1&user_location=us&ttv_uc=undefined&date_in=-1&date_out=-1&rooms=-1&nights=-1&hr=-1&rid=undefined&p1=undefined&adults=-1&children=-1&city_name=-1&country_name=-1&dest_name=-1&region_name=-1&dest_cc=-1&dest_id=-1&dest_type=-1&lang=en-us&ai=304142&preferred_neighborhoods=undefined&preferred_star_ratings=undefined&seed=Pqit_vbiva0hUfw7CE5adQ&site=bookings2&sid=5171fc655664ddf74ab763a094523fb7&channel_id=3&exp_andy=undefined&stid=304142&exp_rmkt_test=global_on&famem=-1&famfn=-1&fampn=-1&logged_in=0&genis=&gwcur=-1&gwcuc=-1&bem=0&bip=0&book_window=&travel_type=unknown&currency=USD&em_sent=undefined&fn_sent=undefined&pn_sent=undefined&cv=-1&sage=33&atnm=&atnm_en=&pt_en=&cul=-1&mnns=-1&zz_val_eur=EUR&zz_look_action2id=undefined&zz_generic_id=undefined&zz_generic_id2=undefined&cip=81.181.57.74&cua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F117.0.0.0%20Safari%2F537.36&tms=gtm&sid_dyna=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000&rmk_var=-1&euuid=b3b664b2-c332-4da1-a30e-c26f69545b7c&gcem=-1&gcpn=-1&pguai=undefined&ttv=undefined&iamlt=&fbc=undefined&fbp=-1&msclid=undefined&pcid=3&bizp=&istnb=0&genisb=0&as=0&genaspb=1&p=https%3A%2F%2Fwww.booking.com%2Findex.html&r=&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&rbda=-1&tcl=undefined&cto_pld=undefined&cgumid=undefined&gtmcb=1882612592 HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw;
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/challenge.js HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9If-Modified-Since: Thu, 8 Feb 2024 18:35:46 +0000
Source: global traffic	HTTP traffic detected: GET /gsi/fedcm.json HTTP/1.1Host: accounts.google.comConnection: keep-aliveAccept: application/jsonSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: webidentityUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /td/fls/rul/activityi;fledge=1;src=4228414;type=views;cat=views;ord=4729221658983;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=900727044;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
Source: global traffic	HTTP traffic detected: GET /td/rul/988382855?random=1707417370534&cv=11&fst=1707417370534&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=qxb_CKLbrYADEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
Source: global traffic	HTTP traffic detected: GET /activity;src=4228414;type=views;cat=views;ord=4729221658983;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=900727044;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
Source: global traffic	HTTP traffic detected: GET /activity;register_conversion=1;src=4228414;type=views;cat=views;ord=4729221658983;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=900727044;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageAttribution-Reporting-Eligible: event-source, trigger, not-navigation-sourceReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
Source: global traffic	HTTP traffic detected: GET /js_errors?pid=87e482caf42702d0&url=https%3A%2F%2Fwww.booking.com%2Findex.html&m=UmFuZG9tSVYkc2RlIyh9YUe5zZbLHt0YNre0CiGBBmP5hKTY_IzZqpWBtitYrnE-ba2NOPqZSPGdnbkQM2vO343hpsChBnayfrRG7jVW0hI1Ke4kKZ85U_m7O1xbR8NLSlv2Zn-4d5ku6anu7qAZgjoLQxWZjIis3cNA3ef3I_aOxDvMotUV5ZQc6OhcEEody8ooGsshLIhRMDad6kRNg_HeFvW36Wr8mOnNh6fMuy8OZ9w095BIb2XL0zt8fY-5SPQHxgI7NWrdI31vzPG5nOwkA1lE2mJxFh3z4YXPwcZPq5z6drlkg3iN9tdtKjt0cXf7rJdLIbIGLmOniyEf0g&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2Findex.html&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSObZWJFfVDSMePCFYZWFXO&cors=1 HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-type: application/x-www-form-urlencodedAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAcliCNHMNAAAA:n/cv5VZ9qVNMSvFL0bOQTKuI2OPvTEeFeyhTL7WjwGM0OG/n4w2baTykBBh/YZIH0afPSLTNxnTfx+/G0aiWdeVHZg/Gg5yqOc93MErd93yjeIsWQYtnDgUv4gK4d0shhZpxaBPa+/51H0+sJLfy6r/auQniQkQaNWbowrr4aiuZ1Hxn5YJ1OMhEssxQqS8lSl7lQ+l4Gvg/GzC+glgVIJ7q+Vvd2qNXBU8be/eAJXt3v+IBgPPT7+3k6BI
Source: global traffic	HTTP traffic detected: GET /td/rul/1060768846?random=1707417370594&cv=11&fst=1707417370594&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nh4qqVoyv2KiIad5kPNddW86jrjYgKSk8&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=page_type%3Dhome%3Bcheckindate%3D-1%3Bcheckoutdate%3D-1%3Bhotelid%3D0%3Bbook_window%3D%3Bweekday%3D-1%3Bdest_cc%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bnights%3D-1%3Brooms%3D-1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Bguestcount%3D-1%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdest_ufi%3D-1%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
Source: global traffic	HTTP traffic detected: GET /td/rul/973712236?random=1707417370629&cv=11&fst=1707417370629&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=8GRyCJ3Eq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
Source: global traffic	HTTP traffic detected: GET /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=BXAbRIVE HTTP/1.1Host: accommodations.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/jsonx-booking-et-serialized-state: ESNA6-jww5PiZzyK_LfXmqWii5kpdRkL6a6nI9I91DYrlgCDdZE8nYAOQCA6hUpfEsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://www.booking.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; lastSeen=0; _ga=GA1.2.421694156.1707417338; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEcx%2FNBSM7hcmxfYRvnB2G9PFWrc9JWtc80%2BB7O9mau%2Fq%2F%2BQmqj8vmO7zmkRYgjc%2BJMYUHnygfC%2FFBh8jDDTeAvsn%2BiKEgv%2FBXfiRGJQAB8jx9PUIZybt6czbgdtg4epkv4DQISO29Dru4mhOYkQiObM%3D
Source: global traffic	HTTP traffic detected: GET /td/rul/973712236?random=1707417370647&cv=11&fst=1707417370647&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=LJXqCKDEq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
Source: global traffic	HTTP traffic detected: GET /td/rul/975716499?random=1707417370676&cv=11&fst=1707417370676&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=BcW9COaWsFgQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
Source: global traffic	HTTP traffic detected: GET /g/collect?v=2&tid=G-A12345&gtm=45je4250z879615461za200&_p=1707417370229&gcs=G1--&gcd=13l3l3l3l5&npa=0&dma=0&cid=421694156.1707417338&ul=en-us&sr=1280x1024&ur=US-FL&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pscdl=noapi&sst.uc=US&sst.rnd=1748118732.1707417371&sst.gcd=13l3l3l3l5&sst.tft=1707417370229&_s=1&sid=1707417345&sct=1&seg=1&dl=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=7431&richsstsse HTTP/1.1Host: gtm-mktg.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.booking.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEcx%2FNBSM7hcmxfYRvnB2G9PFWrc9JWtc80%2BB7O9mau%2Fq%2F%2BQmqj8
Source: global traffic	HTTP traffic detected: GET /cm/i?pid=54f04dd9-4d34-47ee-87a6-989713215c80&u_scsid=02478874-a277-465c-b9e7-ce2412232e4f&u_sclid=75022d4d-ae50-4a02-8ab1-d3d7e0695f9e HTTP/1.1Host: tr.snapchat.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
Source: global traffic	HTTP traffic detected: GET /td/rul/975716499?random=1707417370697&cv=11&fst=1707417370697&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=mzmpCMbAq1gQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1Host: td.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
Source: global traffic	HTTP traffic detected: GET /.well-known/web-identity HTTP/1.1Host: www.google.comConnection: keep-aliveAccept: application/jsonSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: webidentityUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /activity;dc_pre=CMCFs6-xnIQDFbjbuAgdwz4C4g;src=4228414;type=views;cat=views;ord=4729221658983;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=900727044;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: ad.doubleclick.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
Source: global traffic	HTTP traffic detected: GET /config/com/54f04dd9-4d34-47ee-87a6-989713215c80.js?v=3.9.1-2402072137 HTTP/1.1Host: tr.snapchat.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e&u_sclid=75022d4d-ae50-4a02-8ab1-d3d7e0695f9e&u_scsid=02478874-a277-465c-b9e7-ce2412232e4f&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&df=true&huah=true&m_dcl=4149&m_fcps=3889&m_pi=4089&m_pl=6944&m_pv=2&m_rd=7451&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&trackId=c904cd67-c0d8-4a0e-97fd-cc369431aa6a&ts=1707417370842&v=3.9.1-2402072137 HTTP/1.1Host: tr.snapchat.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
Source: global traffic	HTTP traffic detected: GET /user/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA%22%7D&cb=1707417371155&dep=2%2CPAGE_LOAD HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZkbWZLdDFSY2k0RytCMHNLTDhuVWhuQit1d1gzb2tkNjRDaHFUR2NwSy9hK25KRVljS2dwMUxocE53VFhBWmNEQUJYSEV6eURmdGtxL29kcXhpTnAyM0d6S1c1NzBROHppc083NktsbU9vZz0mY0M4cWljSXAxaDlIOFVBazhiS3FNM2xZeGtjPQ=="
Source: global traffic	HTTP traffic detected: GET /user/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1707417371157&dep=5%2CEVENT_TAGS_ABSENT HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://www.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZkbWZLdDFSY2k0RytCMHNLTDhuVWhuQit1d1gzb2tkNjRDaHFUR2NwSy9hK25KRVljS2dwMUxocE53VFhBWmNEQUJYSEV6eURmdGtxL29kcXhpTnAyM0d6S1c1NzBROHppc083NktsbU9vZz0mY0M4cWljSXAxaDlIOFVBazhiS3FNM2xZeGtjPQ=="
Source: global traffic	HTTP traffic detected: GET /psb/capla/static/css/4e596c2c.3a2fb681.chunk.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"If-None-Match: "51be0c43cc481b13fe70d3ba27e2ffd9"If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMTsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_gXMMKR8XlWQUw777UtDcji15Fuhz4qxcj8OlguUiWRdNRO6X&random=2004650583 HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /gsi/fedcm/listaccounts HTTP/1.1Host: accounts.google.comConnection: keep-aliveAccept: application/jsonSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: webidentityUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /ddm/fls/z/dc_pre=CMCFs6-xnIQDFbjbuAgdwz4C4g;src=4228414;type=views;cat=views;ord=4729221658983;npa=0;auiddc=;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=900727044;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2 HTTP/1.1Host: adservice.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/988382855/?random=1707417370534&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=qxb_CKLbrYADEIeNptcD&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_xJXFnZ-QZPYh1oZDyu_TZwxAXJ-Wp-8Ob2qjV2LC1aNJs2H7&random=1370815513&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&cb=k6nv978x042h HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: _GRECAPTCHA=09AJmcDEl4lP7G1sUzlkfo-ph5oEYDaZrMsr87jx805YMBfBXipJ4MvomJQXIF7z5TPrZE7LxvSiQSdmfSY1DEipM; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/1060768846/?random=1707417370594&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=6OEvCKaZ3wMQzpjo-QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nh4qqVoyv2KiIad5kPNddW86jrjYgKSk8&npa=0&data=page_type%3Dhome%3Bcheckindate%3D-1%3Bcheckoutdate%3D-1%3Bhotelid%3D0%3Bbook_window%3D%3Bweekday%3D-1%3Bdest_cc%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bnights%3D-1%3Brooms%3D-1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Bguestcount%3D-1%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdest_ufi%3D-1%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_gb44i39lGLaxfNcCIq_WTyFMLOl4BLrFxZyRf0JgbXaPZfmP&random=569072865&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /logo?ver=1&sid=5171fc655664ddf74ab763a094523fb7&t=17074173641 HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEcx%2FNBSM7hcmxfYRvnB2G9PFWrc9JWtc80%2BB7O9mau%2Fq%2F%2BQmqj8vmO7zmkRYgjc%2BJMYUHnygfC%2FFBh8jDDTeAvsn%2BiKEgv%2FBXfiRGJQAB8jx9PUIZybt6czbgdtg4epkv4DQISO29Dru4mhOYkQiObM%3D; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAg3CB3gkXAAAA:MjKO1hr2vGact9YeJE5WV1SAFZSdmyXEMmZGTBuMPoy2hCiHblFE1oJwqh74w2wYkPQpYmZm5TaLgscyzfAef0bGCVE84BqDPwyU6udlMs8GCG3PzswQ9vLdMJ3eBNxPiebxsmVae4EF0T/m8gLa4JND0Sx7w663Pbz8e+8pjoMz1FaGeU740v3HGmZFacbuBjwMiyNTkcequ0M6UxFRYtlVfsANbIrqXMaMiCClbaW3s0KrZ1Il53OxMrTfx3gNPFn9DPhd; lastSeen=1707417371728
Source: global traffic	HTTP traffic detected: GET /js_tracking?sid=5171fc655664ddf74ab763a094523fb7&aid=304142&ref_action=index&ver=2&pid=87e482caf42702d0&lang=en-us&stype=1&ete=&etg=&etcg=&ets=cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YUe5zZbLHt0YNre0CiGBBmP5hKTY_IzZqpWBtitYrnE-ba2NOPqZSPGdnbkQM2vO343hpsChBnayfrRG7jVW0hI1Ke4kKZ85U_m7O1xbR8NLSlv2Zn-4d5ku6anu7qAZgjoLQxWZjIis3cNA3ef3I_aOxDvMotUV5ZQc6OhcEEody8ooGsshLIhRMDad6kRNg_HeFvW36Wr8mOnNh6fMuy8OZ9w095BIb2XL0zt8fY-5SPQHxgI7NWrdI31vzPG5nOwkA1lE2mJxFh3z4YXPwcZPq5z6drlkg3iN9tdtKjt0cXf7rJdLIbIGLmOniyEf0g HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEcx%2FNBSM7hcmxfYRvnB2G9PFWrc9JWtc80%2BB7O9mau%2Fq%2F%2BQmqj8vmO7zmkRYgjc%2BJMYUHnygfC%2FFBh8jDDTeAvsn%2BiKEgv%2FBXfiRGJQAB8jx9PUIZybt6czbgdtg4epkv4DQISO29Dru4mhOYkQiObM%3D; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42;
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/973712236/?random=1707417370629&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=8GRyCJ3Eq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_wfHMD_o_GGHspVDwQ0qsVavCvt1YdLyJ8OCUdqTkuws2io1Q&random=3777251294&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /js_tracking?sid=5171fc655664ddf74ab763a094523fb7&aid=304142&ref_action=index&ver=2&pid=87e482caf42702d0&lang=en-us&stype=1&ete=&etg=&etcg=cCHObKdPHMfFdHMEKdbfZRLRMLFSZaTaTaET\|1&ets=cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YUe5zZbLHt0YNre0CiGBBmP5hKTY_IzZqpWBtitYrnE-ba2NOPqZSPGdnbkQM2vO343hpsChBnayfrRG7jVW0hI1Ke4kKZ85U_m7O1xbR8NLSlv2Zn-4d5ku6anu7qAZgjoLQxWZjIis3cNA3ef3I_aOxDvMotUV5ZQc6OhcEEody8ooGsshLIhRMDad6kRNg_HeFvW36Wr8mOnNh6fMuy8OZ9w095BIb2XL0zt8fY-5SPQHxgI7NWrdI31vzPG5nOwkA1lE2mJxFh3z4YXPwcZPq5z6drlkg3iN9tdtKjt0cXf7rJdLIbIGLmOniyEf0g HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEcx%2FNBSM7hcmxfYRvnB2G9PFWrc9JWtc80%2BB7O9mau%2Fq%2F%2BQmqj8vmO7zmkRYgjc%2BJMYUHnygfC%2FFBh8jDDTeAvsn%2BiKEgv%2FBXfiRGJQAB8jx9PUIZybt6czbgdtg4epkv4DQISO29Dru4mhOYkQiObM%3D; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a2
Source: global traffic	HTTP traffic detected: GET /c360/v1/track HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEcx%2FNBSM7hcmxfYRvnB2G9PFWrc9JWtc80%2BB7O9mau%2Fq%2F%2BQmqj8vmO7zmkRYgjc%2BJMYUHnygfC%2FFBh8jDDTeAvsn%2BiKEgv%2FBXfiRGJQAB8jx9PUIZybt6czbgdtg4epkv4DQISO29Dru4mhOYkQiObM%3D; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAg3CB3gkXAAAA:MjKO1hr2vGact9YeJE5WV1SAFZSdmyXEMmZGTBuMPoy2hCiHblFE1oJwqh74w2wYkPQpYmZm5TaLgscyzfAef0bGCVE84BqDPwyU6udlMs8GCG3PzswQ9vLdMJ3eBNxPiebxsmVae4EF0T/m8gLa4JND0Sx7w663Pbz8e+8pjoMz1FaGeU740v3HGmZFacbuBjwMiyNTkcequ0M6UxFRYtlVfsANbIrqXMaMiCClbaW3s0KrZ1Il53OxMrTfx3gNPFn9DPhd; lastSeen=1707417371728
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v3/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%226461a31a%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1707417371159 HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZkbWZLdDFSY2k0RytCMHNLTDhuVWhuQit1d1gzb2tkNjRDaHFUR2NwSy9hK25KRVljS2dwMUxocE53VFhBWmNEQUJYSEV6eURmdGtxL29kcXhpTnAyM0d6S1c1NzBROHppc083NktsbU9vZz0mY0M4cWljSXAxaDlIOFVBazhiS3FNM2xZeGtjPQ=="
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/973712236/?random=1707417370647&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=LJXqCKDEq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_LzMeppNpbu0uxxfgLr4cbwIUIsaW9vg634KHtXqQFMU7_h7j&random=1362733946&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/975716499/?random=1707417370676&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=BcW9COaWsFgQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_CrvmsnkrL4j8rnj7_ZOlfIaZanCgUCGkQWsiv5XQISf9Bc9m&random=76924871&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /pagead/1p-user-list/975716499/?random=1707417370697&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=mzmpCMbAq1gQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_TZaZIOlEuym-CAVb6ThpCoKygR4gz3I5SBnm0V9VIC71TcTV&random=4201010768&rmt_tld=0&ipr=y HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /v3/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1707417371889&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA%22%2C%22aem_eligible_list%22%3A%5B%22fn%22%5D%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%226461a31a%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D HTTP/1.1Host: ct.pinterest.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZkbWZLdDFSY2k0RytCMHNLTDhuVWhuQit1d1gzb2tkNjRDaHFUR2NwSy9hK25KRVljS2dwMUxocE53VFhBWmNEQUJYSEV6eURmdGtxL29kcXhpTnAyM0d6S1c1NzBROHppc083NktsbU9vZz0mY0M4cWljSXAxaDlIOFVBazhiS3FNM2xZeGtjPQ=="
Source: global traffic	HTTP traffic detected: GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=87e482caf42702d0&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|4,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|2,cCHObKdBdUHINPSXeHDALOLOLMO\|5,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv= HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-ET-Serialized-State: ESNA6-jww5PiZzyK_LfXmqWii5kpdRkL6a6nI9I91DYrlgCDdZE8nYAOQCA6hUpfEX-Booking-Language-Code: en-usX-Booking-Client-Info: sec-ch-ua-mobile: ?0X-Booking-AID: 304142User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: 87e482caf42702d0X-Booking-Info: X-Booking-SiteType-Id: 1X-Booking-Session-Id: db6e5bbb32eac0e80cfcae9b22f5390dsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=170741
Source: global traffic	HTTP traffic detected: GET /safeframe/1-0-40/html/container.html HTTP/1.1Host: 8ef290e4a40aabf645d441eeb66eb6e1.safeframe.googlesyndication.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /web-vitals/send-vitals HTTP/1.1Host: web-vitals.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPeeiS3HjtTZXkOelfN%2BTRHp5819aBVKUAWU8d6iXTYJyw%2FIPv4OCtUyuUq%2BVrS0WPtY38QJCqNkBX7o%2B2RRpjlx61DSmT7ufG1ri1CRFdQhX2zgjGT6dOcSaEzhDNd8bC3m%2FEZlK%2BzITAWgJ8rsgX6dWJnl%2BKVPp8Ic%3D; lastSeen=1707417372663
Source: global traffic	HTTP traffic detected: GET /activity;register_conversion=1;src=4228414;type=views;cat=views;ord=4729221658983;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=900727044;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1Host: ad.doubleclick.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
Source: global traffic	HTTP traffic detected: GET /g/collect?v=2&tid=G-A12345&gtm=45je4250z879615461za200&_p=1707417370229&gcs=G1--&gcd=13l3l3l3l5&npa=0&dma=0&cid=421694156.1707417338&ul=en-us&sr=1280x1024&ur=US-FL&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pscdl=noapi&sst.uc=US&sst.rnd=1748118732.1707417371&sst.gcd=13l3l3l3l5&sst.tft=1707417370229&_s=1&sid=1707417345&sct=1&seg=1&dl=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=7431&richsstsse HTTP/1.1Host: gtm-mktg.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPeeiS3HjtTZXkOelfN%2BTRHp5819aBVKUAWU8d6iXTYJyw%2FIPv4OCtUyuUq%2BVrS0WPtY38QJCqNkBX7o%2B2RRpjlx61DSmT7ufG1ri1CRFdQhX2zgjGT6dOcSaEzhDNd8bC3m%2FEZlK%2BzI
Source: global traffic	HTTP traffic detected: GET /js_tracking?sid=5171fc655664ddf74ab763a094523fb7&aid=304142&ref_action=index&ver=2&pid=87e482caf42702d0&lang=en-us&stype=1&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|1&m=UmFuZG9tSVYkc2RlIyh9YUe5zZbLHt0YNre0CiGBBmP5hKTY_IzZqpWBtitYrnE-ba2NOPqZSPGdnbkQM2vO343hpsChBnayfrRG7jVW0hI1Ke4kKZ85U_m7O1xbR8NLSlv2Zn-4d5ku6anu7qAZgjoLQxWZjIis3cNA3ef3I_aOxDvMotUV5ZQc6OhcEEody8ooGsshLIhRMDad6kRNg_HeFvW36Wr8mOnNh6fMuy8OZ9w095BIb2XL0zt8fY-5SPQHxgI7NWrdI31vzPG5nOwkA1lE2mJxFh3z4YXPwcZPq5z6drlkg3iN9tdtKjt0cXf7rJdLIbIGLmOniyEf0g HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPeeiS3HjtTZXkOelfN%2BTRHp5819aBVKUAWU8d6iXTYJyw%2FIPv4OCtUyuUq%2BVrS0WPtY38QJCqNkBX7o%2B2RRpjlx61DSmT7ufG1ri1CRFdQhX2zgjGT6dOcSaEzhDNd8bC3m%2FEZlK%2BzITAWgJ8rsgX6dWJnl%2BKVPp8Ic%3D; aws-waf-toke
Source: global traffic	HTTP traffic detected: GET /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=BXAbRIVE HTTP/1.1Host: accommodations.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPeeiS3HjtTZXkOelfN%2BTRHp5819aBVKUAWU8d6iXTYJyw%2FIPv4OCtUyuUq%2BVrS0WPtY38QJCqNkBX7o%2B2RRpjlx61DSmT7ufG1ri1CRFdQhX2zgjGT6dOcSaEzhDNd8bC3m%2FEZlK%2BzITAWgJ8rsgX6dWJnl%2BKVPp8Ic%3D; lastSeen=1707417372663
Source: global traffic	HTTP traffic detected: GET /js_errors?pid=87e482caf42702d0&url=https%3A%2F%2Fwww.booking.com%2Findex.html&m=UmFuZG9tSVYkc2RlIyh9YUe5zZbLHt0YNre0CiGBBmP5hKTY_IzZqpWBtitYrnE-ba2NOPqZSPGdnbkQM2vO343hpsChBnayfrRG7jVW0hI1Ke4kKZ85U_m7O1xbR8NLSlv2Zn-4d5ku6anu7qAZgjoLQxWZjIis3cNA3ef3I_aOxDvMotUV5ZQc6OhcEEody8ooGsshLIhRMDad6kRNg_HeFvW36Wr8mOnNh6fMuy8OZ9w095BIb2XL0zt8fY-5SPQHxgI7NWrdI31vzPG5nOwkA1lE2mJxFh3z4YXPwcZPq5z6drlkg3iN9tdtKjt0cXf7rJdLIbIGLmOniyEf0g&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2Findex.html&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSObZWJFfVDSMePCFYZWFXO&cors=1 HTTP/1.1Host: www.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPeeiS3HjtTZXkOelfN%2BTRHp5819aBV
Source: global traffic	HTTP traffic detected: GET /js_tracking?sid=5171fc655664ddf74ab763a094523fb7&aid=304142&ref_action=index&ver=2&pid=87e482caf42702d0&lang=en-us&stype=1&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|3889&m=UmFuZG9tSVYkc2RlIyh9YUe5zZbLHt0YNre0CiGBBmP5hKTY_IzZqpWBtitYrnE-ba2NOPqZSPGdnbkQM2vO343hpsChBnayfrRG7jVW0hI1Ke4kKZ85U_m7O1xbR8NLSlv2Zn-4d5ku6anu7qAZgjoLQxWZjIis3cNA3ef3I_aOxDvMotUV5ZQc6OhcEEody8ooGsshLIhRMDad6kRNg_HeFvW36Wr8mOnNh6fMuy8OZ9w095BIb2XL0zt8fY-5SPQHxgI7NWrdI31vzPG5nOwkA1lE2mJxFh3z4YXPwcZPq5z6drlkg3iN9tdtKjt0cXf7rJdLIbIGLmOniyEf0g HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-Language-Code: en-usX-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6X-Booking-CSRF: VFfFZQAAAAA=I0VyxrbmcRsXF8b8667mJSw00zD1jijstj9zA-B31AE-SHf9fwLae-NRdcEvORIZUidJgBp9cG2_VeJ_vvAjE9POdq-3lpUXJKUz5osKhhR_6IWR4vCHyNCN9_lrexSyhyl857y4-aUKLEPdAzHdPtU-69GNk1-tINwO8UxKp7l2RhgisIpi5FvtqY4OOakuCSFjRchHm9pnK7Y6sec-ch-ua-mobile: ?0X-Booking-AID: 304142X-Partner-Channel-Id: 3X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: 87e482caf42702d0X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,1856870\|1,1912460\|7,1912460\|1,1908890\|1,1912460\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|4,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|2,cCHObKdBdUHINPSXeHDALOLOLMO\|5,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMK
Source: global traffic	HTTP traffic detected: GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=87e482caf42702d0&ete=&etg=&etcg=cCHObEfEITNPfbeQMIaWYUQJFFQccCcCcCC\|5&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,cCHObKdBdUHINPSXeHDALOLOLMO\|3&etgwv= HTTP/1.1Host: www.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Booking-ET-Serialized-State: ESNA6-jww5PiZzyK_LfXmqWii5kpdRkL6a6nI9I91DYrlgCDdZE8nYAOQCA6hUpfEX-Booking-Language-Code: en-usX-Booking-Client-Info: sec-ch-ua-mobile: ?0X-Booking-AID: 304142User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36X-Booking-Pageview-Id: 87e482caf42702d0X-Booking-Info: X-Booking-SiteType-Id: 1X-Booking-Session-Id: db6e5bbb32eac0e80cfcae9b22f5390dsec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390dAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.170741737
Source: global traffic	HTTP traffic detected: GET /xdata/images/city/170x136/977416.jpg?k=ea06e0b572ff052f4fe4fcf35ac3616e8d1b7300f0402756c460a4e9c19e54ed&o= HTTP/1.1Host: q-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_423.2.dr	String found in binary or memory: href="https://www.linkedin.com/showcase/googlemarketingplatform" equals www.linkedin.com (Linkedin)
Source: chromecache_423.2.dr	String found in binary or memory: href="https://www.youtube.com/c/googlemarketingplatform" equals www.youtube.com (Youtube)
Source: chromecache_423.2.dr	String found in binary or memory: <script type="application/ld+json">{"@context": "http://schema.org","@type": "Webpage","name": "Enterprise","description": "Google Marketing Platform offers an enterprise analytics solution to gain insights into your advertising, marketing, customers, and sales.","url": "https://marketingplatform.google.com/about/enterprise/","@id": "https://marketingplatform.google.com/about/enterprise/#webpage","inLanguage": "English","headline": "Meaningful insights.<br>Smarter marketing.<br>Better results.","image": {"@type": "ImageObject","url": "https://lh3.googleusercontent.com/XjulzUQfPsVZjAC6DJrlVtyGdUQKM8_6sI0SAcqopIqEn18pOQ0BzWWrXZ5W6FoAx27IzI0AoLXmik0KlCEOr_27jhEfxbiNUp4k","isFamilyFriendly":"yes"},"publisher": {"@type": "Organization","url": "https://www.google.com/","@id": "https://www.google.com/#organization","logo": "https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png","sameAs": ["https://twitter.com/Google", "https://www.instagram.com/google/", "https://www.facebook.com/Google/", "https://www.youtube.com/user/Google", "https://www.linkedin.com/company/google", "https://www.wikidata.org/wiki/Q95", "https://en.wikipedia.org/wiki/Google"]},"copyrightHolder": {"@type": "Organization","name": "Google","url": "https://www.google.com/","@id": "https://www.google.com/#organization","logo": "https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png","sameAs": ["https://twitter.com/Google", "https://www.instagram.com/google/", "https://www.facebook.com/Google/", "https://www.youtube.com/user/Google", "https://www.linkedin.com/company/google", "https://www.wikidata.org/wiki/Q95", "https://en.wikipedia.org/wiki/Google"]},"breadcrumb": {"@type": "BreadcrumbList","itemListElement": [{"@type": "ListItem","position":"1","item": {"@id": "https://marketingplatform.google.com/about/","name": "Google Marketing Platform"}},{"@type": "ListItem","position":"2","item": {"@id": " https://marketingplatform.google.com/about/enterprise/","name": "Enterprise"}}]}}</script><!-- Open graph for facebook --> equals www.facebook.com (Facebook)
Source: chromecache_423.2.dr	String found in binary or memory: <script type="application/ld+json">{"@context": "http://schema.org","@type": "Webpage","name": "Enterprise","description": "Google Marketing Platform offers an enterprise analytics solution to gain insights into your advertising, marketing, customers, and sales.","url": "https://marketingplatform.google.com/about/enterprise/","@id": "https://marketingplatform.google.com/about/enterprise/#webpage","inLanguage": "English","headline": "Meaningful insights.<br>Smarter marketing.<br>Better results.","image": {"@type": "ImageObject","url": "https://lh3.googleusercontent.com/XjulzUQfPsVZjAC6DJrlVtyGdUQKM8_6sI0SAcqopIqEn18pOQ0BzWWrXZ5W6FoAx27IzI0AoLXmik0KlCEOr_27jhEfxbiNUp4k","isFamilyFriendly":"yes"},"publisher": {"@type": "Organization","url": "https://www.google.com/","@id": "https://www.google.com/#organization","logo": "https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png","sameAs": ["https://twitter.com/Google", "https://www.instagram.com/google/", "https://www.facebook.com/Google/", "https://www.youtube.com/user/Google", "https://www.linkedin.com/company/google", "https://www.wikidata.org/wiki/Q95", "https://en.wikipedia.org/wiki/Google"]},"copyrightHolder": {"@type": "Organization","name": "Google","url": "https://www.google.com/","@id": "https://www.google.com/#organization","logo": "https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png","sameAs": ["https://twitter.com/Google", "https://www.instagram.com/google/", "https://www.facebook.com/Google/", "https://www.youtube.com/user/Google", "https://www.linkedin.com/company/google", "https://www.wikidata.org/wiki/Q95", "https://en.wikipedia.org/wiki/Google"]},"breadcrumb": {"@type": "BreadcrumbList","itemListElement": [{"@type": "ListItem","position":"1","item": {"@id": "https://marketingplatform.google.com/about/","name": "Google Marketing Platform"}},{"@type": "ListItem","position":"2","item": {"@id": " https://marketingplatform.google.com/about/enterprise/","name": "Enterprise"}}]}}</script><!-- Open graph for facebook --> equals www.linkedin.com (Linkedin)
Source: chromecache_423.2.dr	String found in binary or memory: <script type="application/ld+json">{"@context": "http://schema.org","@type": "Webpage","name": "Enterprise","description": "Google Marketing Platform offers an enterprise analytics solution to gain insights into your advertising, marketing, customers, and sales.","url": "https://marketingplatform.google.com/about/enterprise/","@id": "https://marketingplatform.google.com/about/enterprise/#webpage","inLanguage": "English","headline": "Meaningful insights.<br>Smarter marketing.<br>Better results.","image": {"@type": "ImageObject","url": "https://lh3.googleusercontent.com/XjulzUQfPsVZjAC6DJrlVtyGdUQKM8_6sI0SAcqopIqEn18pOQ0BzWWrXZ5W6FoAx27IzI0AoLXmik0KlCEOr_27jhEfxbiNUp4k","isFamilyFriendly":"yes"},"publisher": {"@type": "Organization","url": "https://www.google.com/","@id": "https://www.google.com/#organization","logo": "https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png","sameAs": ["https://twitter.com/Google", "https://www.instagram.com/google/", "https://www.facebook.com/Google/", "https://www.youtube.com/user/Google", "https://www.linkedin.com/company/google", "https://www.wikidata.org/wiki/Q95", "https://en.wikipedia.org/wiki/Google"]},"copyrightHolder": {"@type": "Organization","name": "Google","url": "https://www.google.com/","@id": "https://www.google.com/#organization","logo": "https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png","sameAs": ["https://twitter.com/Google", "https://www.instagram.com/google/", "https://www.facebook.com/Google/", "https://www.youtube.com/user/Google", "https://www.linkedin.com/company/google", "https://www.wikidata.org/wiki/Q95", "https://en.wikipedia.org/wiki/Google"]},"breadcrumb": {"@type": "BreadcrumbList","itemListElement": [{"@type": "ListItem","position":"1","item": {"@id": "https://marketingplatform.google.com/about/","name": "Google Marketing Platform"}},{"@type": "ListItem","position":"2","item": {"@id": " https://marketingplatform.google.com/about/enterprise/","name": "Enterprise"}}]}}</script><!-- Open graph for facebook --> equals www.twitter.com (Twitter)
Source: chromecache_423.2.dr	String found in binary or memory: <script type="application/ld+json">{"@context": "http://schema.org","@type": "Webpage","name": "Enterprise","description": "Google Marketing Platform offers an enterprise analytics solution to gain insights into your advertising, marketing, customers, and sales.","url": "https://marketingplatform.google.com/about/enterprise/","@id": "https://marketingplatform.google.com/about/enterprise/#webpage","inLanguage": "English","headline": "Meaningful insights.<br>Smarter marketing.<br>Better results.","image": {"@type": "ImageObject","url": "https://lh3.googleusercontent.com/XjulzUQfPsVZjAC6DJrlVtyGdUQKM8_6sI0SAcqopIqEn18pOQ0BzWWrXZ5W6FoAx27IzI0AoLXmik0KlCEOr_27jhEfxbiNUp4k","isFamilyFriendly":"yes"},"publisher": {"@type": "Organization","url": "https://www.google.com/","@id": "https://www.google.com/#organization","logo": "https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png","sameAs": ["https://twitter.com/Google", "https://www.instagram.com/google/", "https://www.facebook.com/Google/", "https://www.youtube.com/user/Google", "https://www.linkedin.com/company/google", "https://www.wikidata.org/wiki/Q95", "https://en.wikipedia.org/wiki/Google"]},"copyrightHolder": {"@type": "Organization","name": "Google","url": "https://www.google.com/","@id": "https://www.google.com/#organization","logo": "https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png","sameAs": ["https://twitter.com/Google", "https://www.instagram.com/google/", "https://www.facebook.com/Google/", "https://www.youtube.com/user/Google", "https://www.linkedin.com/company/google", "https://www.wikidata.org/wiki/Q95", "https://en.wikipedia.org/wiki/Google"]},"breadcrumb": {"@type": "BreadcrumbList","itemListElement": [{"@type": "ListItem","position":"1","item": {"@id": "https://marketingplatform.google.com/about/","name": "Google Marketing Platform"}},{"@type": "ListItem","position":"2","item": {"@id": " https://marketingplatform.google.com/about/enterprise/","name": "Enterprise"}}]}}</script><!-- Open graph for facebook --> equals www.youtube.com (Youtube)
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: "https://www.facebook.com/bookingcom/", equals www.facebook.com (Facebook)
Source: chromecache_375.2.dr, chromecache_467.2.dr, chromecache_513.2.dr, chromecache_394.2.dr, chromecache_623.2.dr	String found in binary or memory: return b}aD.D="internal.enableAutoEventOnTimer";var xc=ca(["data-gtm-yt-inspected-"]),bD=["www.youtube.com","www.youtube-nocookie.com"],cD,dD=!1; equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Content-Length: 767Connection: closeserver: envoydate: Thu, 08 Feb 2024 18:36:46 GMTvary: Accept-Encoding,Originx-request-id: 0392afc0-c6b1-11ee-b5f7-c116a8c5fe13set-cookie: fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; Max-Age=86400; Domain=.booking.com; Path=/; Expires=Fri, 09 Feb 2024 18:36:46 GMT; HttpOnly; Secureset-cookie: fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; Path=/; Expires=Sun, 25 Feb 2024 19:17:15 GMT; HttpOnly; Secureaccess-control-allow-credentials: truecontent-security-policy: base-uri 'none'; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=block&e=UmFuZG9tSVYkc2RlIyh9YYX-8qB8sBWzju5WmDl7IHU&pid=0392afc0c6b111eeb5f7c116a8c5fe13; script-src 'nonce-d1071a4aec29f37b8d9f' 'report-sample' 'self' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' https:content-security-policy-report-only: frame-ancestors 'none'; frame-src https://*.booking.com https://*.doubleclick.net; report-uri https://nellie.booking.com/csp-report-uri?type=report&e=UmFuZG9tSVYkc2RlIyh9YYX-8qB8sBWzju5WmDl7IHU&pid=0392afc0c6b111eeb5f7c116a8c5fe13x-frame-options: SAMEORIGINx-content-type-options: nosniffx-xss-protection: 1; mode=blockstrict-transport-security: max-age=86400; includeSubDomainsX-Cache: Error from cloudfrontVia: 1.1 5c302f38578fa41a607d734b38629fc2.cloudfront.net (CloudFront)X-Amz-Cf-Pop: IAD79-C1X-Amz-Cf-Id: 9xVzd3CUiMqt0_OpnbTcYUgBHWjYzVqGELQppbZXSkIBY-EeluKteg==

Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: chromecache_337.2.dr	String found in binary or memory: http://benalman.com/about/license/
Source: chromecache_337.2.dr	String found in binary or memory: http://benalman.com/projects/jquery-hashchange-plugin/
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: http://cars.booking.com/Home.do?affiliateCode=booking-com&adplat=footer&preflang=en
Source: chromecache_564.2.dr	String found in binary or memory: http://cond01.etbxml.com/cond/common.js
Source: chromecache_536.2.dr	String found in binary or memory: http://github.com/jrburke/almond
Source: chromecache_337.2.dr	String found in binary or memory: http://josscrowcroft.github.com/accounting.js/
Source: chromecache_553.2.dr	String found in binary or memory: http://jquery.com/
Source: chromecache_553.2.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_682.2.dr	String found in binary or memory: http://leafo.net
Source: chromecache_682.2.dr	String found in binary or memory: http://mbostock.github.com/protovis/
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: http://ogp.me/ns#
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: http://ogp.me/ns/fb#
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: http://ogp.me/ns/fb/booking_com#
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_423.2.dr	String found in binary or memory: http://schema.org
Source: chromecache_553.2.dr	String found in binary or memory: http://sizzlejs.com/
Source: chromecache_655.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: chromecache_511.2.dr	String found in binary or memory: http://www.broofa.com
Source: chromecache_682.2.dr	String found in binary or memory: http://www.lokeshdhakar.com
Source: chromecache_682.2.dr	String found in binary or memory: http://www.opensource.org/licenses/bsd-license.php
Source: chromecache_682.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: http://www.opentable.com?ref=16087
Source: chromecache_564.2.dr	String found in binary or memory: http://www.quirksmode.org/js/cookies.html
Source: chromecache_423.2.dr	String found in binary or memory: https://about.google/
Source: chromecache_423.2.dr	String found in binary or memory: https://about.google/commitments/racialequity/
Source: chromecache_423.2.dr	String found in binary or memory: https://about.google/products/
Source: chromecache_411.2.dr	String found in binary or memory: https://account.booking.
Source: chromecache_564.2.dr	String found in binary or memory: https://account.booking.com/_/fvtrpw.gif
Source: chromecache_380.2.dr	String found in binary or memory: https://account.booking.com/auth/oauth2?aid=304142&dt=1707417350&response_type=sso&clien
Source: chromecache_470.2.dr	String found in binary or memory: https://account.booking.com/auth/oauth2?client_id=vO1Kblk7xX9tUn2cpZLS&bkng_action=packages_city
Source: chromecache_692.2.dr	String found in binary or memory: https://account.booking.com/auth/oauth2?dt=1707417365&lang=en-us&state=UpEDgkQNS1Kiqaag0En8T
Source: chromecache_470.2.dr	String found in binary or memory: https://account.booking.com/auth/oauth2?state=UpsDgkQNS1KiqaYS4b0Bj4eD6EPCRhrTCFgPrI95R7EsR-vzShv0bs
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://account.booking.com/oauth2/authorize?aid=304142;client_id=d1cDdLj40ACItEtxJLTo;redirect_uri=
Source: chromecache_599.2.dr	String found in binary or memory: https://account.booking.com/sso/logout
Source: chromecache_470.2.dr	String found in binary or memory: https://account.booking.com/sso/logout/v3
Source: chromecache_411.2.dr	String found in binary or memory: https://account.dqs.booking.com
Source: chromecache_597.2.dr	String found in binary or memory: https://accounts.google.com/gsi/
Source: chromecache_597.2.dr	String found in binary or memory: https://accounts.google.com/gsi/button
Source: chromecache_597.2.dr	String found in binary or memory: https://accounts.google.com/gsi/fedcm.json
Source: chromecache_597.2.dr	String found in binary or memory: https://accounts.google.com/gsi/fedcmcsp?client_id=
Source: chromecache_597.2.dr	String found in binary or memory: https://accounts.google.com/gsi/iframe/select
Source: chromecache_597.2.dr	String found in binary or memory: https://accounts.google.com/gsi/log
Source: chromecache_597.2.dr	String found in binary or memory: https://accounts.google.com/gsi/revoke
Source: chromecache_597.2.dr	String found in binary or memory: https://accounts.google.com/gsi/select
Source: chromecache_597.2.dr	String found in binary or memory: https://accounts.google.com/gsi/status
Source: chromecache_597.2.dr	String found in binary or memory: https://accounts.google.com/gsi/style
Source: chromecache_597.2.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/iframe
Source: chromecache_597.2.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/v2/auth
Source: chromecache_375.2.dr	String found in binary or memory: https://ad.doubleclick.net
Source: chromecache_375.2.dr	String found in binary or memory: https://ade.googlesyndication.com
Source: chromecache_423.2.dr	String found in binary or memory: https://admanager.google.com/home/
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://admin.booking.com/?lang=xu&utm_source=extranet_login_footer&utm_medium=frontend&utm_campaign
Source: chromecache_423.2.dr	String found in binary or memory: https://ads.google.com/home/?utm_source=marketingplatform.google.com&utm_medium=et&utm_campaign=mark
Source: chromecache_423.2.dr	String found in binary or memory: https://adsense.google.com/start/?subid=ww-en-et-ads-ot-a-marketing_platform
Source: chromecache_375.2.dr, chromecache_467.2.dr, chromecache_623.2.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk
Source: chromecache_375.2.dr, chromecache_467.2.dr, chromecache_623.2.dr	String found in binary or memory: https://adservice.googlesyndication.com/pagead/regclk
Source: chromecache_423.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/angularjs/1.6.6/angular-animate.min.js
Source: chromecache_423.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/angularjs/1.6.6/angular-touch.min.js
Source: chromecache_423.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/angularjs/1.6.6/angular.min.js
Source: chromecache_762.2.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: chromecache_423.2.dr	String found in binary or memory: https://analytics.google.com/analytics/academy/?utm_source=marketingplatform.google.com&utm_medium=e
Source: chromecache_411.2.dr	String found in binary or memory: https://apiref.riskified.com/curl/#beacon
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://booking.com/articles.en-us.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAEx
Source: chromecache_380.2.dr	String found in binary or memory: https://booking.com/articles.en-us.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AE
Source: chromecache_470.2.dr	String found in binary or memory: https://booking.com/packages/city/us/augusta.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI
Source: chromecache_470.2.dr	String found in binary or memory: https://booking.com/packages/city/us/biloxi.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8
Source: chromecache_470.2.dr	String found in binary or memory: https://booking.com/packages/city/us/birmingham.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1g
Source: chromecache_470.2.dr	String found in binary or memory: https://booking.com/packages/city/us/charleston.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1g
Source: chromecache_470.2.dr	String found in binary or memory: https://booking.com/packages/city/us/charlotte.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gE
Source: chromecache_470.2.dr	String found in binary or memory: https://booking.com/packages/city/us/columbia.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEa
Source: chromecache_470.2.dr	String found in binary or memory: https://booking.com/packages/city/us/daytona-beach.html?aid=304142&label=gen173nr-1FCAEoggI46AdI
Source: chromecache_470.2.dr	String found in binary or memory: https://booking.com/packages/city/us/gatlinburg.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1g
Source: chromecache_470.2.dr	String found in binary or memory: https://booking.com/packages/city/us/jacksonville.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM
Source: chromecache_470.2.dr	String found in binary or memory: https://booking.com/packages/city/us/miami-beach.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1
Source: chromecache_470.2.dr	String found in binary or memory: https://booking.com/packages/city/us/miami.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8C
Source: chromecache_470.2.dr	String found in binary or memory: https://booking.com/packages/city/us/myrtle-beach.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM
Source: chromecache_470.2.dr	String found in binary or memory: https://booking.com/packages/city/us/nashville.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gE
Source: chromecache_470.2.dr	String found in binary or memory: https://booking.com/packages/city/us/new-orleans.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1
Source: chromecache_470.2.dr	String found in binary or memory: https://booking.com/packages/city/us/new-york.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEa
Source: chromecache_470.2.dr	String found in binary or memory: https://booking.com/packages/city/us/orlando.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI
Source: chromecache_470.2.dr	String found in binary or memory: https://booking.com/packages/city/us/panama-city-beach.html?aid=304142&label=gen173nr-1FCAEoggI4
Source: chromecache_470.2.dr	String found in binary or memory: https://booking.com/packages/city/us/pigeon-forge.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM
Source: chromecache_470.2.dr	String found in binary or memory: https://booking.com/packages/city/us/savannah.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEa
Source: chromecache_470.2.dr	String found in binary or memory: https://booking.com/packages/city/us/tampa.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8C
Source: chromecache_380.2.dr	String found in binary or memory: https://booking.com/pxgo?aid=304142&token=UmFuZG9tSVYkc2RlIyh9YaAHsRE_5bn3dJjpGQEg323sZwX3_dEoB2yw7U
Source: chromecache_599.2.dr	String found in binary or memory: https://booking.com/pxgo?aid=304142&url=https%3A%2F%2Fwww.booking.com%2Fpackages.html%3Fentry%3Dxpb_
Source: chromecache_470.2.dr	String found in binary or memory: https://booking.com/pxgo?lang=en&url=https%3A%2F%2Fbooking.kayak.com%2Fin%3Fbdclc%3Den-us%26mc%3DUSD
Source: chromecache_599.2.dr	String found in binary or memory: https://booking.com/pxgo?lang=en&url=https%3A%2F%2Fbooking.kayak.com%2Fin%3Fp%3Dsearchbox_link%26sid
Source: chromecache_470.2.dr	String found in binary or memory: https://booking.com/pxgo?token=UmFuZG9tSVYkc2RlIyh9YWktmrwAPG7d0xk8r8arn9v4UeVW3jL63C9pD6N2vqLkl7SAr
Source: chromecache_692.2.dr	String found in binary or memory: https://booking.com/pxgo?url=https%3A%2F%2Fbooking.kayak.com%2Fin%3Fmc%3DUSD%26bdclc%3Den-us%26a%3Db
Source: chromecache_470.2.dr	String found in binary or memory: https://booking.com/resort_searchresults.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmA
Source: chromecache_380.2.dr	String found in binary or memory: https://business.booking.com/?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2A
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://business.booking.com/?aid=304142&lang=en-us&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAE
Source: chromecache_599.2.dr	String found in binary or memory: https://careers.booking.com
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr, chromecache_411.2.dr	String found in binary or memory: https://careers.booking.com/
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://careers.booking.com/?utm_source=corporate&utm_medium=footer
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://carrier.booking.com/google/places/webautocompletesimple
Source: chromecache_375.2.dr, chromecache_467.2.dr, chromecache_513.2.dr, chromecache_394.2.dr, chromecache_623.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: chromecache_411.2.dr	String found in binary or memory: https://cdn.cookielaw.org/consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/OtAutoBlock.js
Source: chromecache_564.2.dr	String found in binary or memory: https://cdn.cookielaw.org/consent/a387750c-a080-4dd0-b2d1-7dbdb601bb14/OtAutoBlock.js
Source: chromecache_772.2.dr, chromecache_411.2.dr	String found in binary or memory: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/images/
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/libs/current-script-polyfill/1.0.0/current-script-polyfill.min.js
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/libs/privacy-consent/releases/2.1.49/customer/cookie-banner.min.js
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/libs/promise/7.0.4/promise-7.0.4.min.js
Source: chromecache_564.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/
Source: chromecache_564.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/assets/326_4e98a27a96e8aa0e2044.js
Source: chromecache_564.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/assets/336_0efd436088eca267c0aa.js
Source: chromecache_564.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/assets/336_afde72b9aaa8302ff017.css
Source: chromecache_564.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/assets/431_7f56befa4bbedcba65c8.js
Source: chromecache_564.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/assets/45_1975cbc2f7eaad75f590.css
Source: chromecache_564.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/assets/45_de7f4b7ce86eab041180.js
Source: chromecache_564.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/assets/48_a501036cafaf1b1b6586.js
Source: chromecache_564.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/assets/826_0d1737e180931a217647.css
Source: chromecache_564.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/assets/903_0c38bb6dddbae47eeeea.js
Source: chromecache_564.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/assets/index_f26add0f1ee6ed4ed8de.js
Source: chromecache_564.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/assets/runtime~index_9239c9c6cbeb2a77c28f.js
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/0de3785e.401967bd.chunk.css
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/18cad957.d04abce3.chunk.css
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/1baf5a63.539e3a8f.chunk.css
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/21928fd5.c540d700.chunk.css
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/3d066b0d.a994f040.chunk.css
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/43e47265.9fb0fb7a.chunk.css
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/445be7a9.b944bd98.chunk.css
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/4e596c2c.3a2fb681.chunk.css
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/53a8d0d3.b1818b84.chunk.css
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/7bcb015e.5b709f3d.chunk.css
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/8207c303.9807c216.chunk.css
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/a6a21c13.8939445f.chunk.css
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/c6a78acb.bffda4a9.chunk.css
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/cfbdd235.7a595d50.chunk.css
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/client.38ffee15.css
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/client.d65aeb7e.css
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/d2a738da.079c3b4c.chunk.css
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/da34a25a.596e2bbe.chunk.css
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/dc32f6b7.745c5004.chunk.css
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/eb60141d.cad86b29.chunk.css
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/f50a2dfc.837540b6.chunk.css
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/css/f5d0e2e7.a54d85eb.chunk.css
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/js/0de3785e.66d5d08f.chunk.js
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/js/a4a24010.c06ec33d.chunk.js
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/js/client.2cf42118.js
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/js/da34a25a.be1d7e1b.chunk.js
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/psb/capla/static/js/f15792aa.a859b930.chunk.js
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/assistant_entrypoint_cloudfront_sd.iq_ltr/611b70b00745fa4412a01012
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/async_tt_quiz_cloudfront_sd.iq_ltr/ac73a1533c9b137d154e412af58b0b6
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/async_wpm_overlay_assets_cloudfront_sd.iq_ltr/abb304bf3600a5cf5f74
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/gprof_icons_cloudfront_sd.iq_ltr/f2fce41920df3c9225af5c680c3a8127d
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/incentives_cloudfront_sd.iq_ltr/f1558a6e9832a4eb8cfe1d3d14db176bd3
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/index_cloudfront_sd.iq_ltr/903b49ae71c75322442d1bc9a0dc298bb8a6e32
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/landing_pages_common_cloudfront_sd.iq_ltr/af1183ce024d54cd405252c3
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/main_cloudfront_sd.iq_ltr/e6474733abba1cd6bc8a66bea1aa8643d7435c30
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/main_exps_cloudfront_sd.iq_ltr/586b07455f7783cafa801bdea38881f1f98
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/packages_city_landing_page_cloudfront_sd.iq_ltr/93424469ff1c9690f5
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/print/0cc4ce4b7108d42a9f293fc9b654f749d84ba4eb.css
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/searchresults_cloudfront_sd.iq_ltr/a80f32e7f9693f304c247b0f22b0f10
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/ski_lp_overview_panel_cloudfront_sd.iq_ltr/2b3350935410fe4e36d74ef
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/static/css/xp-index-sb_cloudfront_sd.iq_ltr/5b5ab8ab66a5ce3092875d0725122439c
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/apple-touch-icon/5db9fd30d96b1796883ee94be7dddce50b73bb38.png
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/booking_logo_knowledge_graph/247454a990efac1952e44dddbf30c58677aa0
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/favicon/40749a316c45e239a7149b6711ea4c48d10f8d89.ico
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/favicon/4a3b40c4059be39cbf1ebaa5f97dbb7d150926b9.png
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/favicon/9ca83ba2a5a3293ff07452cb24949a5843af4592.svg
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/fb/2/b18514076ffef009d56c887c69af9c754bf020ae.jpg
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/ar/9cce2b91336709016282f06432a8b6366069e0c2.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/bg/540f2da5fee31b7385af127619ab5ca4fc3783b5.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/br/0cf5e55d996fdcf96a2d31733addf5c10bad1f74.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/catalonia/8578246a75d8b9dceaacb174072d0c6acaf
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/cn/5a221730f540facc62563bfa6192ce155a9f677e.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/cz/32002e60fead55ce886ff9827dfcf4af8cf4e277.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/de/668350ee17050ec21845c27503ae960695f341a9.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/dk/744575dd4e87590a543b7c8cbacaef6c3de4e4d2.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/ee/509074558f4fe7c71ceed57584dec0382274dd16.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/es/b3bd4690290a78b1303198dd6576bdab8d7f9a80.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/fi/465d3b73ff07d1d696cb5dd26fbb91097c175e1b.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/fr/c48bc65c9dc57035fa983df37e9732c0f0a2663f.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/gb/daba79fdd4066d133e8bf59070fd6819b951c403.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/gr/e0e42a97a7b860fc9be71954262902f2a4e94aa6.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/hr/e7a46f4dad977aecafa6a3680972e0c137a1bc41.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/hu/fc7cb24c5c7cb9de74a74fad271d6838daabc4cb.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/id/e7d3d00965d8c994a72807b43b21c648250cf906.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/il/fc1907ccd86aa051f7fbe22649d1e31ac6aee016.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/in/20aa535a5d3c505dd02fea275ed1a36c0fb1fe08.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/is/7d644655f895f8e346b964dc18cf5b6608a98d52.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/it/b8db3771480bd0c7971b9f94cad3640c89521882.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/jp/9bf7e50bc6dc66599aeede9189ca16de461c60b6.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/kr/4cb76b458a73ca4c1de034c7623475278d363ce6.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/lt/5bb712a60a82b7e075deba5b102aa36348bbb255.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/lv/393103a26c1d5f1fbd7d9674732bbdfc42296399.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/mx/f3a3f562a0185d68fb04b2ec01db2062ca6bdb76.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/my/6d811cf6127cea0a957ca0243546a03339fa19ac.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/nl/65e3bcc466c4026a08bdb2671799ca26c3228d19.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/no/827be8d24af5667778b4bc651fe03f738a812b60.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/ph/7048127466891462116ee2774154585fb5607aba.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/pl/4d6b6e962b0b049a03924fc618b959395d60ae39.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/pt/715db1dc3acc79e1e109a9563fbf8a172e873ae5.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/ro/2d67b91f7beb87bd9286975da3e6dadc70d9c64b.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/rs/c1bc4fc1d782713cfec17a071dadca6b755a233e.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/ru/2277320023a64803843c36ca6aa48ad77523dd0d.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/sa/44ab510f37755d1d9d4c4dfa9b1f25bed9b2a95c.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/se/5e126775c25a54a24956ddcc72c8bbcaeed20872.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/si/f0619cdd45548522566c6d72a660ddc011906184.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/sk/29e3667f5aca74c157af9225d5a97a74a41e52ef.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/th/53a76d6856962953d739d07ac61f04adee50a3d1.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/tr/f7ad0cb74f4ea5e7193cb6029c7f977e9786cfa2.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/ua/2ea50f1c1fb480c4557a5578f71657fc3152c3a1.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/us/fa2b2a0e643c840152ba856a8bb081c7ded40efa.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/vn/90b17da2aafaebce7b0c34189747e1e10dba8041.p
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/flags/new/48-squared/z4/ced4751e6ac2cbb9884a5878fff59a4e24c3e386.p
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/nobg_all_blue_iq/b700d9e3067c1186a3364012df4fe1c48ae6da44.png
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/resorts/landing_pages/airplane_bg/82842ea42e7cb6a992e722675e0556c5
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/tfl/group_logos/logo_agoda/1c9191b6a3651bf030e41e99a153b64f449845e
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/tfl/group_logos/logo_booking/27c8d1832de6a3123b6ee45b59ae2f81b0d9d
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/tfl/group_logos/logo_kayak/83ef7122074473a6566094e957ff834badb58ce
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/tfl/group_logos/logo_opentable/a4b50503eda6c15773d6e61c238230eb42f
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/tfl/group_logos/logo_priceline/f80e129541f2a952d470df2447373390f3d
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/tfl/group_logos/logo_rentalcars/6bc5ec89d870111592a378bbe7a2086f0b
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/img/twitter-image-else/566c7081f1deeaca39957e96365c3908f83b95af.jpg
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/assistant_entrypoint_cloudfront_sd/ef4280b820a27ed734dd50de76d082ea
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/async_atlas_v2_cn_cloudfront_sd/23e4582e33cfab1833229812a8df0e52f28
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/async_atlas_v2_non_cn_cloudfront_sd/464d329658f128e0bc0811be19d656b
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/async_flash_deals_countdown_cloudfront_sd/ed6ec8a2950ae6f5f3420107a
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/async_index_postcards_c360_cloudfront_sd/11d2b12d25c970340e0e5c5707
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/async_lists_cloudfront_sd/ea653b9852a85cb0190755d3979dbd317a486979.
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/async_tt_quiz_cloudfront_sd/8e3159ed1f490736c8984a2b979c73d5dbf0c86
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/async_wpm_overlay_assets_cloudfront_sd/c6cb9b63eea61102d4e96fe72b7c
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/atlas_cloudfront_sd/7aaea4329a86dd9e6dc4d51a92fef5573f6f9c09.js
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/atlas_cst_cloudfront_sd/138d388521c0fb45e14005cb8098ebebb7158dce.js
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/atlas_places_async_cloudfront_sd/c94b60c4da2dae6b55fd9eabf168f146fc
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/calendar2_cloudfront_sd/06071dd1c4e89fbe99e5ad6e21584a6bf9585e84.js
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/core-deps-inlinedet_cloudfront_sd/789c67928e597e7a413f9e99763adab71
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/error_catcher_bec_cloudfront_sd/0acd2ada6c74d5dec978a04ea837952bdf0
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/genius_vip_cloudfront_sd/aae975495cc56436f4f59463b9ea4e594bdb102a.j
Source: chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/index_cloudfront_sd/803ec559148a8e5c7a9eb8c3720e492f09588177.js
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/jquery_cloudfront_sd/e1e8c0e862309cb4caf3c0d5fbea48bfb8eaad42.js
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/landing_pages_common_cloudfront_sd/5d6270f9d99467ef1f2d14da9abb86c2
Source: chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/landingpage_cloudfront_sd/4417f0cf113c3ec51a8190be88e7c373a6d9295d.
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/lazy_load_images_cloudfront_sd/77204d4da4aa41b08b1a4062c8e66e462955
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/main_cloudfront_sd/22b1462412c8a51090dedf2fbe6ad45b3d8e8cf4.js
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/packages_city_landing_page_cloudfront_sd/172f7d6c1b0baff6a5977b7d91
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/raf_cloudfront_sd/92b3daaabd4371c78818992ce9342e212f673b31.js
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/searchbox_cloudfront_sd/2ef4e9ae9240f4bd123bc5c51eed3c306e710ecb.js
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/searchresults_cloudfront_sd/cede9dd040e94f8940ffa9b1176616cd398b097
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/searchresults_slick_cloudfront_sd/528359eb9f21194adf8c26f81e07c6eb2
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/ski_lp_overview_panel_cloudfront_sd/9d8e7cfd33a37ffb15285d98f697002
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/js/sp-on-maps_cloudfront_sd/d30eef4dc5202875d4c3301b8a0e8ff09f9a0e28.j
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/static/opensearch/en-us/e19e3ca297c466eb18e0b783736192a638f6a66e.xml
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/xdata/images/city/square250/352166.webp?k=70257e02f84d33fc68f9da008ec0c40b54a
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/xdata/images/city/square250/689152.webp?k=3e406cd8b3fabad15ed34e82484d43d44bb
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/xdata/images/city/square250/689523.webp?k=70ca656d88199dc2b8a04b0bccc877d2c97
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/xdata/images/city/square250/689573.webp?k=4aefe3aca3ad388dca94c5fc8123ddd89af
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/xdata/images/city/square250/689617.webp?k=edf88994b0c6b4c060300b942efdc124228
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/xdata/images/city/square250/689687.webp?k=654bc31e8dc1dabf9b94fb37ad00f6942dc
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/xdata/images/city/square250/689838.webp?k=32ffc2bfac0d85557bd5ddfc1ca92c73aef
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/xdata/images/city/square250/690179.webp?k=cb5eb236e7e9bf988a677e4fbdbf81ef955
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/xdata/images/city/square250/690242.webp?k=d237489ebaacd4fce01bee28f2947d5b8e4
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/xdata/images/city/square250/690267.webp?k=05055e2ec19868d57cf86ccb604589b988d
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/xdata/images/city/square250/786960.webp?k=e313213321010a516ee56b6ee04e367f770
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/xdata/images/city/square250/976708.webp?k=cb62481ca3494ac4e0b030345eedc770247
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/xdata/images/city/square250/976744.webp?k=d386664a0cfa562d8586fa2251c11c4f6d1
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/xdata/images/city/square250/976823.webp?k=96ffc687725d79086ffd57914e2f3280312
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/xdata/images/city/square250/976861.webp?k=16d2ae8c0dfb3a2fa26b763677f321f1381
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/xdata/images/city/square250/976877.webp?k=2aab28217f0fb039e0f35ea2b2c3976141b
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/xdata/images/city/square250/976919.webp?k=b4d2dd3f87340b547a0e1aa9fc7e89b47eb
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/xdata/images/city/square250/977381.webp?k=ab236c5e99ba40341684e2d3bfcd8256d36
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/xdata/images/city/square250/977388.webp?k=4c9c54255e9d2e2d8084959527abea6b6b8
Source: chromecache_470.2.dr	String found in binary or memory: https://cf.bstatic.com/xdata/images/city/square250/977416.webp?k=ea06e0b572ff052f4fe4fcf35ac3616e8d1
Source: chromecache_423.2.dr	String found in binary or memory: https://cloud.google.com/?utm_source=marketingplatform.google.com&utm_medium=et&utm_campaign=marketi
Source: chromecache_787.2.dr, chromecache_395.2.dr	String found in binary or memory: https://cloud.google.com/contact
Source: chromecache_787.2.dr, chromecache_395.2.dr	String found in binary or memory: https://cloud.google.com/recaptcha-enterprise/billing-information
Source: chromecache_687.2.dr	String found in binary or memory: https://collector-a.perimeterx.net/api/v2/collector/clientError?r=
Source: chromecache_470.2.dr	String found in binary or memory: https://community.booking.com/?profile.language=en
Source: chromecache_826.2.dr, chromecache_448.2.dr	String found in binary or memory: https://ct.pinterest.com/stats/
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://d8c14d4960ca.edge.sdk.awswaf.com/d8c14d4960ca/a18a4859af9c/challenge.js
Source: chromecache_564.2.dr	String found in binary or memory: https://d8c14d4960ca.edge.sdk.awswaf.com/d8c14d4960ca/c2181391033f/challenge.js
Source: chromecache_423.2.dr	String found in binary or memory: https://developers.google.com/ads-data-hub
Source: chromecache_423.2.dr	String found in binary or memory: https://developers.google.com/analytics/?utm_source=marketingplatform.google.com&utm_medium=et&utm_c
Source: chromecache_423.2.dr	String found in binary or memory: https://developers.google.com/doubleclick-advertisers/?utm_source=marketingplatform.google.com&utm_m
Source: chromecache_597.2.dr	String found in binary or memory: https://developers.google.com/identity/gsi/web/guides/fedcm-migration?s=dc#cross_origin)
Source: chromecache_597.2.dr	String found in binary or memory: https://developers.google.com/identity/gsi/web/guides/fedcm-migration?s=dc#display_moment
Source: chromecache_597.2.dr	String found in binary or memory: https://developers.google.com/identity/gsi/web/guides/fedcm-migration?s=dc#layout
Source: chromecache_597.2.dr	String found in binary or memory: https://developers.google.com/identity/gsi/web/guides/fedcm-migration?s=dc#skipped_moment
Source: chromecache_787.2.dr, chromecache_395.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: chromecache_787.2.dr, chromecache_395.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: chromecache_787.2.dr, chromecache_395.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: chromecache_423.2.dr	String found in binary or memory: https://developers.google.com/tag-manager/?utm_source=marketingplatform.google.com&utm_medium=et&utm
Source: chromecache_694.2.dr, chromecache_429.2.dr	String found in binary or memory: https://docs.aws.amazon.com/waf/latest/developerguide/waf-javascript-sdk.html
Source: chromecache_423.2.dr	String found in binary or memory: https://firebase.google.com/?utm_source=marketingplatform.google.com&utm_medium=et&utm_campaign=mark
Source: chromecache_599.2.dr	String found in binary or memory: https://flights-support.booking.com/hc/en-us
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/favicon.ico
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/flights/ATL-CHI/?type=ROUNDTRIP&adults=1&cabinClass=ECONOMY&
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/flights/ATL-CUN/?type=ROUNDTRIP&adults=1&cabinClass=ECONOMY&
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/flights/ATL-FLL/?type=ROUNDTRIP&adults=1&cabinClass=ECONOMY&
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/flights/ATL-HOU/?type=ROUNDTRIP&adults=1&cabinClass=ECONOMY&
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/flights/ATL-LAX/?type=ROUNDTRIP&adults=1&cabinClass=ECONOMY&
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/flights/ATL-MBJ/?type=ROUNDTRIP&adults=1&cabinClass=ECONOMY&
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/flights/ATL-MIA/?type=ROUNDTRIP&adults=1&cabinClass=ECONOMY&
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/flights/ATL-NYC/?type=ROUNDTRIP&adults=1&cabinClass=ECONOMY&
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/flights/ATL-ORL/?type=ROUNDTRIP&adults=1&cabinClass=ECONOMY&
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/flights/ATL-PUJ/?type=ROUNDTRIP&adults=1&cabinClass=ECONOMY&
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/flights/ATL-SJU/?type=ROUNDTRIP&adults=1&cabinClass=ECONOMY&
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/icons/apple-touch-icon-114x114.png
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/icons/apple-touch-icon-120x120.png
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/icons/apple-touch-icon-144x144.png
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/icons/apple-touch-icon-152x152.png
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/icons/apple-touch-icon-57x57.png
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/icons/apple-touch-icon-60x60.png
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/icons/apple-touch-icon-72x72.png
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/icons/apple-touch-icon-76x76.png
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/icons/favicon-128x128.png
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/icons/favicon-16x16.png
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/icons/favicon-196x196.png
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/icons/favicon-32x32.png
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/icons/favicon-96x96.png
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/icons/mstile-144x144.png
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/icons/mstile-150x150.png
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/icons/mstile-310x310.png
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/icons/mstile-70x70.png
Source: chromecache_411.2.dr	String found in binary or memory: https://flights.booking.com/manifest.json
Source: chromecache_423.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:100
Source: chromecache_686.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/cantarell/v17/B50NF7ZDq37KMUvlO015gqJrLK8.woff2)
Source: chromecache_686.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/cantarell/v17/B50NF7ZDq37KMUvlO015jKJr.woff2)
Source: chromecache_686.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oxygen/v15/2sDfZG1Wl4LcnbuKgE0mV0Q.woff2)
Source: chromecache_686.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oxygen/v15/2sDfZG1Wl4LcnbuKjk0m.woff2)
Source: chromecache_686.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4WxKOzY.woff2)
Source: chromecache_686.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2)
Source: chromecache_686.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu5mxKOzY.woff2)
Source: chromecache_686.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu72xKOzY.woff2)
Source: chromecache_686.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7GxKOzY.woff2)
Source: chromecache_686.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7WxKOzY.woff2)
Source: chromecache_686.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu7mxKOzY.woff2)
Source: chromecache_686.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ubuntu/v20/4iCs6KVjbNBYlgoKcQ72j00.woff2)
Source: chromecache_686.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ubuntu/v20/4iCs6KVjbNBYlgoKcg72j00.woff2)
Source: chromecache_686.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ubuntu/v20/4iCs6KVjbNBYlgoKcw72j00.woff2)
Source: chromecache_686.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ubuntu/v20/4iCs6KVjbNBYlgoKew72j00.woff2)
Source: chromecache_686.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ubuntu/v20/4iCs6KVjbNBYlgoKfA72j00.woff2)
Source: chromecache_686.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/ubuntu/v20/4iCs6KVjbNBYlgoKfw72.woff2)
Source: chromecache_549.2.dr	String found in binary or memory: https://github.com/google/safevalues/issues
Source: chromecache_553.2.dr	String found in binary or memory: https://github.com/jquery/jquery-migrate
Source: chromecache_375.2.dr, chromecache_623.2.dr	String found in binary or memory: https://github.com/krux/postscribe/blob/master/LICENSE.
Source: chromecache_682.2.dr	String found in binary or memory: https://github.com/toddmotto/echo
Source: chromecache_623.2.dr	String found in binary or memory: https://google.com
Source: chromecache_623.2.dr	String found in binary or memory: https://googleads.g.doubleclick.net
Source: chromecache_800.2.dr	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/988382855/?random
Source: chromecache_647.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/0de3785e.401967bd.chunk.css.map
Source: chromecache_637.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/18cad957.d04abce3.chunk.css.map
Source: chromecache_744.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/1baf5a63.539e3a8f.chunk.css.map
Source: chromecache_422.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/21928fd5.c540d700.chunk.css.map
Source: chromecache_381.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/3d066b0d.a994f040.chunk.css.map
Source: chromecache_357.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/43e47265.9fb0fb7a.chunk.css.map
Source: chromecache_720.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/445be7a9.b944bd98.chunk.css.map
Source: chromecache_425.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/4bac1f1e.6ef899ee.chunk.css.map
Source: chromecache_824.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/4e596c2c.3a2fb681.chunk.css.map
Source: chromecache_620.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/53a8d0d3.b1818b84.chunk.css.map
Source: chromecache_806.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/6197bcab.88b5a402.chunk.css.map
Source: chromecache_530.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/7bcb015e.5b709f3d.chunk.css.map
Source: chromecache_605.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/8207c303.9807c216.chunk.css.map
Source: chromecache_478.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/a6a21c13.8939445f.chunk.css.map
Source: chromecache_769.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/b9a82cb8.c62928a4.chunk.css.map
Source: chromecache_507.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/c6a78acb.bffda4a9.chunk.css.map
Source: chromecache_475.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/cfbdd235.7a595d50.chunk.css.map
Source: chromecache_671.2.dr, chromecache_618.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/client.38ffee15.css.map
Source: chromecache_353.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/client.d65aeb7e.css.map
Source: chromecache_740.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/d2a738da.079c3b4c.chunk.css.map
Source: chromecache_680.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/da34a25a.596e2bbe.chunk.css.map
Source: chromecache_562.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/dc32f6b7.745c5004.chunk.css.map
Source: chromecache_665.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/eb60141d.cad86b29.chunk.css.map
Source: chromecache_636.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/f50a2dfc.837540b6.chunk.css.map
Source: chromecache_703.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/css/f5d0e2e7.a54d85eb.chunk.css.map
Source: chromecache_552.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/0a098284.df965884.chunk.js.map
Source: chromecache_810.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/0de3785e.66d5d08f.chunk.js.map
Source: chromecache_525.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/18cad957.fe671709.chunk.js.map
Source: chromecache_392.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/1baf5a63.d24b4ba9.chunk.js.map
Source: chromecache_596.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/21928fd5.cc39b346.chunk.js.map
Source: chromecache_460.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/3d066b0d.6a5d1f73.chunk.js.map
Source: chromecache_734.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/43e47265.79cb7ba8.chunk.js.map
Source: chromecache_420.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/445be7a9.e9bb815f.chunk.js.map
Source: chromecache_714.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/4a89d2db.6c0ec4b3.chunk.js.map
Source: chromecache_343.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/4bac1f1e.ebb2755f.chunk.js.map
Source: chromecache_676.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/4e596c2c.d3513b52.chunk.js.map
Source: chromecache_369.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/53a8d0d3.8742f23d.chunk.js.map
Source: chromecache_555.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/6197bcab.619d148f.chunk.js.map
Source: chromecache_491.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/7bcb015e.cf9d45ea.chunk.js.map
Source: chromecache_763.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/8207c303.4d6b40b0.chunk.js.map
Source: chromecache_753.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/95f0c6f5.61e0b6e0.chunk.js.map
Source: chromecache_818.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/a4a24010.c06ec33d.chunk.js.map
Source: chromecache_700.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/a6808fc8.130754bc.chunk.js.map
Source: chromecache_479.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/a6a21c13.ad9f14d9.chunk.js.map
Source: chromecache_537.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/aee01701.c6972f88.chunk.js.map
Source: chromecache_717.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/b9a82cb8.5aa6563f.chunk.js.map
Source: chromecache_396.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/c6a78acb.9b7b7bd0.chunk.js.map
Source: chromecache_693.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/cfbdd235.02b9cad2.chunk.js.map
Source: chromecache_428.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/client.1b521280.js.map
Source: chromecache_498.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/client.2cf42118.js.map
Source: chromecache_441.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/client.5a83af42.js.map
Source: chromecache_789.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/d2a738da.35cba7bb.chunk.js.map
Source: chromecache_494.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/da34a25a.be1d7e1b.chunk.js.map
Source: chromecache_797.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/dc32f6b7.30f8c5b3.chunk.js.map
Source: chromecache_480.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/eb60141d.05ae682b.chunk.js.map
Source: chromecache_559.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/f15792aa.a859b930.chunk.js.map
Source: chromecache_539.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/f50a2dfc.854e46ce.chunk.js.map
Source: chromecache_378.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/f5d0e2e7.5cd38fd6.chunk.js.map
Source: chromecache_487.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/remoteEntry.40329cb8.client.js.map
Source: chromecache_685.2.dr, chromecache_672.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/remoteEntry.4935f89c.client.js.map
Source: chromecache_728.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/remoteEntry.aaaa260d.client.js.map
Source: chromecache_529.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/remoteEntry.b27ba5a8.client.js.map
Source: chromecache_450.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/remoteEntry.e62c532d.client.js.map
Source: chromecache_658.2.dr	String found in binary or memory: https://istatic.booking.com/internal-static/capla/static/js/remoteEntry.f0866eea.client.js.map
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://join.booking.com/?lang=en-us&aid=304142&utm_source=footer_menu&utm_medium=fronte
Source: chromecache_470.2.dr	String found in binary or memory: https://join.booking.com/?lang=en-us&utm_source=topbar&utm_medium=frontend&amp;label=gen
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/0Q6D6O_H1ln-2XsHxasKU98MASf2MLcp6b0YJcH7L_6jULLHCTh3-WhICIlKXbpr-D
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/4wKdcCWNhhdCSoEVMCTzXPiD1J0FYAfAEHVfqhAzWGBE1CNhPGWOaO6lzpsai7u3bH
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/5Yi9pUyi0xjbfbdG2p4kyVsYGlDWYrbQUlaLXLAiUlmRB9I3myFxlFusUi29QGev9g
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/9Ukdk5mlaSxOFDc98fBBHg0zz_mMebexFn8WtVRRS8QqsyGzLlvL2SCoY-CAyyXY0p
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/BfyS-j_OOTMqkt4eomWru4C8MOdli_YtSaXpmkI-qdjd6cAF1Po5s5CxF6i_iFSYfh
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/DJ26GEBH94yMQ3dofeAy0GTxU1JeuRSVQvfd9cxkfD4h-Yj8hpMMXKsgbToA49zQiJ
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/DgLaFV6_tiByMcu1ZzxH0AbKPc8_YTveTUBJHm7dKS3lsSNbA9dWibqtXp7TJHLkpl
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/DmpK8ugt7esqJ4s8hDBJRCeW_dVp40duUXRr-V4Yxvvon2ZxL-jM2Ukjyk834RQcHm
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/IaZ7OWBb5-6tf44cedpONxZuteHjRvHH8sDgPaCEGBYmD9fYII42iaUIcDUKA1DGa6
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/J1lW_pPLg0dOdxjYZ7eK61Q-Tgc0yUc0Ssp2Kdde9KHjl7iFptnFes6xVADOkzyYsn
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/LCXHdwCVFUVKVceZ7Ebxe5MnjHhCOrM5Tc1sUYiHSeF80cAZejxwYs_JoRRCDwZG4M
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/M3BEUZgVVGIo4Y9o1YaEaurfGUy3aquf87fXzlo5UnZC-iLOAQ-N1ho9u9Ywx-4Tmj
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/McJV-U6w665Cr7SFm8uBmRog_9DPfbCdntR4aK0tL2wjaXrKc0EsUT649iJOlZfVAA
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/T0P6stldNdtTJ9yCbmfQI3mgyERiFmiILsGPq2o-rbmsCCBUwGkqBZW94qiD-ldjJY
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/T0t-NlSp0OzDa4gqQgUcftzEXmWnhR6RfUDWq-8z9P_mCn9xkxqCSbsD5UiogxeoTo
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/TjCG9F-cHmWkQ9ZYIbHGWAJueckyNudq-tj6--z5E-gBYQtplStcE9dBBRXLYdWjbe
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/ToOoAIQwJV9q573oHPf0rmIGzxrYnExPpSlCMvlTtpZYddSDWUb4BS5w4vR_LoUSiQ
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/Xde_feRXsipCVqfFr7i0xr1K_OlsP_h7tfxcp3Xj0EZj78gF77vF4Lcj01B4S14zO5
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/XjulzUQfPsVZjAC6DJrlVtyGdUQKM8_6sI0SAcqopIqEn18pOQ0BzWWrXZ5W6FoAx2
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/XvcIkb0Lqs86H9rq4wocG56dgQmp7EFyIC18o1gJiMnxUJBkj7YyxUGViLIDPtB_KN
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/eBgXEvVz_cqaqw5ZZRjWndAKwLuWlFXuf9CW0NHHMgK3BY5TCrI2AE1tsq20ZeXM55
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/g1VeY9p01k-fMeY0yTPigiPXx09HBHtcK6SfGLrX_GVk1UO9zik80izCL5yecuKJqK
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/jZDSgvByFEvqdDnQR1gtUN1f86-ZbMJKLtlUshMU1Qk0c_Dzb3-NjxX-F1ZvGnEx_7
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/nJzFtXRNnCoIZXs6_v7xgf0Nz6l1X-0bKmGaJz0KTY3ovil-DDcimGKPyhkoEEONab
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/rIhH9x08DxI4YdYl9hB-MmC4e1MFaovevyo98RHu3ryszkuwXCkSYxgKD2-8btnf4x
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/secXuOC5WcxmNqaaKKhyAEU1GiiW8kg5Eh1SB-8jrhyrVLb_VWA0NIgNlwKhtaW8y9
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/uu1BWN2_yiSe1Ciw4nsEQ2gTDIzIOpTATkeVuPLijgZvHQxmJcjfF1RQJNmgb7VaJ_
Source: chromecache_423.2.dr	String found in binary or memory: https://lh3.googleusercontent.com/wrHKPwn_RKCusdpmICnKeZoYVzfup5x3e6UFj58iVzEymAnru1XWjhrl2mFu5eLJ8X
Source: chromecache_423.2.dr	String found in binary or memory: https://marketingplatform.google.com/about/enterprise/
Source: chromecache_423.2.dr	String found in binary or memory: https://marketingplatform.google.com/about/enterprise/#webpage
Source: chromecache_423.2.dr	String found in binary or memory: https://marketingplatform.google.com/home?openIntegrationCenter=true&utm_source=marketingplatfor
Source: chromecache_337.2.dr	String found in binary or memory: https://mths.be/cssescape
Source: chromecache_599.2.dr	String found in binary or memory: https://news.booking.com/en-us
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://news.booking.com/en-us/
Source: chromecache_597.2.dr	String found in binary or memory: https://oauth2.googleapis.com/revoke
Source: chromecache_623.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: chromecache_711.2.dr, chromecache_602.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/bg/%
Source: chromecache_333.2.dr, chromecache_646.2.dr, chromecache_451.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204/?id=turtlex_join_ig&tx_jig=$
Source: chromecache_655.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=error&bin=7&v=
Source: chromecache_655.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=error&name=invalid_geo&context=10
Source: chromecache_655.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=extra&rnd=
Source: chromecache_602.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224
Source: chromecache_711.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225
Source: chromecache_375.2.dr, chromecache_467.2.dr, chromecache_513.2.dr, chromecache_394.2.dr, chromecache_623.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/gen_204?id=tcfe
Source: chromecache_318.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/ping
Source: chromecache_653.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/sodar?
Source: chromecache_602.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224
Source: chromecache_711.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://partner.booking.com/en-gb?utm_campaign=footer_list&utm_medium=frontend_footer&utm_so
Source: chromecache_395.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://plus.google.com/105443419075154950489
Source: chromecache_411.2.dr	String found in binary or memory: https://q-cf.bstatic.com/psb/capla/static/css/4bac1f1e.6ef899ee.chunk.css
Source: chromecache_411.2.dr	String found in binary or memory: https://q-cf.bstatic.com/psb/capla/static/css/6197bcab.88b5a402.chunk.css
Source: chromecache_411.2.dr	String found in binary or memory: https://q-cf.bstatic.com/psb/capla/static/css/client.38ffee15.css
Source: chromecache_411.2.dr	String found in binary or memory: https://q-cf.bstatic.com/xdata/images/city/square100/653307.jpg?k=96840ba0ed6ab187b729e16cb1655ad614
Source: chromecache_411.2.dr	String found in binary or memory: https://q-xx.bstatic.com/flights/web/static/css/client.223e5f6f.css
Source: chromecache_411.2.dr	String found in binary or memory: https://q-xx.bstatic.com/flights/web/static/css/screens-Home.54999444.chunk.css
Source: chromecache_411.2.dr	String found in binary or memory: https://q-xx.bstatic.com/flights/web/static/js/client.ae384b8e.js
Source: chromecache_411.2.dr	String found in binary or memory: https://q-xx.bstatic.com/flights/web/static/js/screens-Home.67ba2cfc.chunk.js
Source: chromecache_411.2.dr	String found in binary or memory: https://q-xx.bstatic.com/xdata/images/city/square210/682559.jpg?k=eba0a86971de163610eaab458cd7c2483f
Source: chromecache_411.2.dr	String found in binary or memory: https://q-xx.bstatic.com/xdata/images/city/square210/688779.jpg?k=def43ae0127037a004ded67b24b8f97834
Source: chromecache_411.2.dr	String found in binary or memory: https://q-xx.bstatic.com/xdata/images/city/square210/688940.jpg?k=8c6ae0b4434360802cfc87335163787de4
Source: chromecache_411.2.dr	String found in binary or memory: https://q-xx.bstatic.com/xdata/images/city/square210/689744.jpg?k=3c7c6d59d968c2bade9003d9ebf8a13464
Source: chromecache_411.2.dr	String found in binary or memory: https://q-xx.bstatic.com/xdata/images/city/square210/690408.jpg?k=f59731e733077b90bc716596e05cfd0f85
Source: chromecache_411.2.dr	String found in binary or memory: https://q-xx.bstatic.com/xdata/images/city/square210/690620.jpg?k=5b801857b88469e1cc299707cda5a8ee86
Source: chromecache_411.2.dr	String found in binary or memory: https://q-xx.bstatic.com/xdata/images/city/square210/976905.jpg?k=5a3ac9e6ec03eb39b872674694fc81d056
Source: chromecache_411.2.dr	String found in binary or memory: https://q-xx.bstatic.com/xdata/images/city/square210/976918.jpg?k=ba17581113d23e0a509fba3480bb6c08fe
Source: chromecache_411.2.dr	String found in binary or memory: https://q-xx.bstatic.com/xdata/images/city/square210/977345.jpg?k=898a2e6c68a765bdc18cc57be5c78b3e1f
Source: chromecache_411.2.dr	String found in binary or memory: https://q-xx.bstatic.com/xdata/images/city/square210/977387.jpg?k=07aeb102ff72c498cfb8c4b92382aa6ada
Source: chromecache_411.2.dr	String found in binary or memory: https://q-xx.bstatic.com/xdata/images/city/square210/977415.jpg?k=fa67e6f0e70c09f18c4181bef46164f040
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://q-xx.bstatic.com/xdata/images/xphoto/500x500/184698944.png?k=6bb1bf3c13db4a7ba3c22a2d1f1051f
Source: chromecache_352.2.dr	String found in binary or memory: https://q.bstatic.com/libs/bui/7.3.1/bui.min.css
Source: chromecache_752.2.dr, chromecache_352.2.dr, chromecache_438.2.dr	String found in binary or memory: https://q.bstatic.com/libs/calango/0.500/bui.css
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://r-xx.bstatic.com/xdata/images/xphoto/714x300/293799350.jpeg?k=8a6f4e24c37096fbdcd3c3d30c9f3d
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://r-xx.bstatic.com/xdata/images/xphoto/720x217/308526620.jpeg?k=0663a1420ea98a013af0eda32bb4d1
Source: chromecache_564.2.dr	String found in binary or memory: https://r.bstatic.com/libs/asec/btmgmt/px.v7.5.3.min.js
Source: chromecache_752.2.dr, chromecache_438.2.dr	String found in binary or memory: https://r.bstatic.com/libs/bui/7.3.1/bui.min.css
Source: chromecache_682.2.dr	String found in binary or memory: https://raw.githubusercontent.com/lokesh/color-thief/master/LICENSE
Source: chromecache_395.2.dr	String found in binary or memory: https://recaptcha.net
Source: chromecache_375.2.dr	String found in binary or memory: https://s.pinimg.com/ct/core.js
Source: chromecache_826.2.dr	String found in binary or memory: https://s.pinimg.com/ct/lib/main.6461a31a.js
Source: chromecache_375.2.dr	String found in binary or memory: https://s.yimg.jp/images/listing/tool/cv/ytag.js
Source: chromecache_375.2.dr	String found in binary or memory: https://sc-static.net/scevent.min.js
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://schema.org
Source: chromecache_470.2.dr	String found in binary or memory: https://secure.booking.com
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://secure.booking.com/company/reservations.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8
Source: chromecache_380.2.dr	String found in binary or memory: https://secure.booking.com/company/reservations.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuA
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://secure.booking.com/company/search.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBm
Source: chromecache_380.2.dr	String found in binary or memory: https://secure.booking.com/company/search.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://secure.booking.com/content/complaints.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8Ci
Source: chromecache_380.2.dr	String found in binary or memory: https://secure.booking.com/content/complaints.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEX
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://secure.booking.com/content/cs.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExu
Source: chromecache_380.2.dr	String found in binary or memory: https://secure.booking.com/content/cs.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB
Source: chromecache_470.2.dr	String found in binary or memory: https://secure.booking.com/help.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAE
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://secure.booking.com/help.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAE
Source: chromecache_380.2.dr	String found in binary or memory: https://secure.booking.com/help.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-A
Source: chromecache_470.2.dr	String found in binary or memory: https://secure.booking.com/login.html?op=oauth_return
Source: chromecache_599.2.dr	String found in binary or memory: https://secure.booking.com/logout_callback.html
Source: chromecache_599.2.dr	String found in binary or memory: https://secure.booking.com/mydashboard.html?aid=304142;label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAEx
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://secure.booking.com/myreservations.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBm
Source: chromecache_599.2.dr	String found in binary or memory: https://secure.booking.com/myreservations.html?aid=304142;label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBm
Source: chromecache_380.2.dr	String found in binary or memory: https://secure.booking.com/myreservations.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM
Source: chromecache_470.2.dr	String found in binary or memory: https://secure.booking.com/mysettings.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExu
Source: chromecache_599.2.dr	String found in binary or memory: https://secure.booking.com/mysettings.html?aid=304142;label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExu
Source: chromecache_380.2.dr	String found in binary or memory: https://secure.booking.com/mysettings.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://secure.booking.com/reviewtimeline.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBm
Source: chromecache_380.2.dr	String found in binary or memory: https://secure.booking.com/reviewtimeline.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM
Source: chromecache_599.2.dr	String found in binary or memory: https://secure.booking.com/rewards_and_wallet.html?aid=304142;label=gen173nr-1FCAEoggI46AdIM1gEaI8Ci
Source: chromecache_318.2.dr, chromecache_549.2.dr	String found in binary or memory: https://securepubads.g.doubleclick.net/pagead/js/car.js
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://shelves.booking.com/
Source: chromecache_423.2.dr	String found in binary or memory: https://signup.withgoogle.com/newsletter/marketingplatform/
Source: chromecache_423.2.dr	String found in binary or memory: https://skillshop.withgoogle.com/
Source: chromecache_513.2.dr, chromecache_394.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect
Source: chromecache_513.2.dr, chromecache_394.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/g/collect?v=2&
Source: chromecache_762.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: chromecache_423.2.dr	String found in binary or memory: https://support.google.com/marketingplatform
Source: chromecache_395.2.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: chromecache_787.2.dr, chromecache_395.2.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: chromecache_787.2.dr, chromecache_395.2.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: chromecache_787.2.dr, chromecache_395.2.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://sustainability.booking.com/
Source: chromecache_762.2.dr	String found in binary or memory: https://tagassistant.google.com/
Source: chromecache_451.2.dr, chromecache_394.2.dr, chromecache_623.2.dr	String found in binary or memory: https://td.doubleclick.net
Source: chromecache_711.2.dr	String found in binary or memory: https://tpc.googlesyndication.com
Source: chromecache_711.2.dr	String found in binary or memory: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Source: chromecache_411.2.dr	String found in binary or memory: https://travel.state.gov/content/passports/en/alertswarnings.html
Source: chromecache_411.2.dr	String found in binary or memory: https://travel.state.gov/content/passports/en/country.html
Source: chromecache_423.2.dr	String found in binary or memory: https://twitter.com/GMktgPlatform
Source: chromecache_423.2.dr	String found in binary or memory: https://twitter.com/Google
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://twitter.com/bookingcom
Source: chromecache_423.2.dr	String found in binary or memory: https://workspace.google.com/?utm_source=marketingplatform.google.com&utm_medium=et&utm_campaign=mar
Source: chromecache_423.2.dr	String found in binary or memory: https://www.blog.google/products/marketingplatform/
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com
Source: chromecache_692.2.dr	String found in binary or memory: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExu
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmA
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/?prefer_site_type=mdot
Source: chromecache_564.2.dr	String found in binary or memory: https://www.booking.com/_etnht
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/_frdtcr?aid=304142
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/accommodations.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAEx
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/accommodations.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AE
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/affiliate-program/v2/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdI
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/affiliate-program/v2/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAE
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/airport.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAE
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/airport.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-A
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/apartments/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmA
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/apartments/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2
Source: chromecache_599.2.dr	String found in binary or memory: https://www.booking.com/articles.html
Source: chromecache_599.2.dr	String found in binary or memory: https://www.booking.com/attractions/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBm
Source: chromecache_599.2.dr	String found in binary or memory: https://www.booking.com/attractions/login.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBm
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/bed-and-breakfast/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/bed-and-breakfast/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuA
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/booking-home/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEB
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/booking-home/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAE
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/business.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyA
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/business.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-
Source: chromecache_599.2.dr	String found in binary or memory: https://www.booking.com/cars/index.html?aid=304142;lang=en-us;sid=5171fc655664ddf74ab763a094523fb7&
Source: chromecache_692.2.dr	String found in binary or memory: https://www.booking.com/cars/sitemap.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuA
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/cars/sitemap.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/city.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2A
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/city.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECi
Source: chromecache_599.2.dr	String found in binary or memory: https://www.booking.com/communities/index
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/content-moderation-policy/overview-page.html?aid=304142&label=gen173nr-1FCAE
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/content-moderation-policy/overview-page.html?label=gen173nr-1FCAEoggI46AdIM1
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/content/about.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExu
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/content/about.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB
Source: chromecache_599.2.dr	String found in binary or memory: https://www.booking.com/content/complaints.html
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/content/contact-us.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEB
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/content/contact-us.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAE
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/content/how_we_work.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAE
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/content/how_we_work.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyA
Source: chromecache_599.2.dr	String found in binary or memory: https://www.booking.com/content/privacy.html
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/content/privacy.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAE
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/content/privacy.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2A
Source: chromecache_599.2.dr	String found in binary or memory: https://www.booking.com/content/terms.html
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/content/terms.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExu
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/content/terms.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB
Source: chromecache_772.2.dr	String found in binary or memory: https://www.booking.com/cookiebanner.html
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/country.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAE
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/country.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-A
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/country/us.en-us.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiA
Source: chromecache_692.2.dr	String found in binary or memory: https://www.booking.com/country/us.en-us.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/covid-19-booking-faqs.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEa
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/covid-19-booking-faqs.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEX
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/deals/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAE
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/deals/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6A
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/dealspage.html?campaign_id=early_year
Source: chromecache_692.2.dr	String found in binary or memory: https://www.booking.com/destination.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAE
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/destination.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6A
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/destinationfinderdeals.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8C
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/destinationfinderdeals.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAE
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/district.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyA
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/district.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/extended-stays/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiA
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/extended-stays/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXy
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.ar.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.bg.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.ca.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.cs.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.da.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.de.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.el.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.en-gb.html
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/flights/index.en-us.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8
Source: chromecache_692.2.dr	String found in binary or memory: https://www.booking.com/flights/index.en-us.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyA
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.es-ar.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.es-mx.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.es.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.et.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.fi.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.fr.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.he.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.hi.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.hr.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.hu.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.id.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.is.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.it.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.ja.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.ko.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.lt.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.lv.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.ms.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.nl.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.no.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.pl.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.pt-br.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.pt-pt.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.ro.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.ru.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.sk.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.sl.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.sr.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.sv.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.th.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.tl.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.tr.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.uk.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.vi.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.zh-cn.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/index.zh-tw.html
Source: chromecache_411.2.dr	String found in binary or memory: https://www.booking.com/flights/route/atlanta-atl-bogota-bog.html?label=gen173nr-1FCAEoggI46AdIM1gEa
Source: chromecache_692.2.dr	String found in binary or memory: https://www.booking.com/flights/sitemap.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAE
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/flights/sitemap.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2A
Source: chromecache_599.2.dr	String found in binary or memory: https://www.booking.com/general.html?tmpl=docs/about
Source: chromecache_751.2.dr, chromecache_330.2.dr, chromecache_571.2.dr, chromecache_764.2.dr	String found in binary or memory: https://www.booking.com/general.html?tmpl=docs/privacy-policy
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/genius.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/genius.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AE
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/guest-house/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBm
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/guest-house/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/hostels/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExu
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/hostels/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/hotel/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAE
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/hotel/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6A
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.ar.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.bg.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.ca.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.cs.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.da.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.de.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.el.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.en-gb.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.es-ar.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.es-mx.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.es.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.et.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.fi.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.fr.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.he.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.hi.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.hr.html
Source: chromecache_599.2.dr	String found in binary or memory: https://www.booking.com/index.html
Source: chromecache_692.2.dr	String found in binary or memory: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXy
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2
Source: chromecache_599.2.dr	String found in binary or memory: https://www.booking.com/index.html?aid=304142;lang=en-us&
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AEC
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.hu.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.id.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.is.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.it.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.ja.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.ko.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.lt.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.lv.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.ms.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.nl.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.no.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.pl.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.pt-br.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.pt-pt.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.ro.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.ru.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.sk.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.sl.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.sr.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.sv.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.th.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.tl.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.tr.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.uk.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.vi.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.zh-cn.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/index.zh-tw.html
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/landmark.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyA
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/landmark.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.ar.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.bg.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.ca.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.cs.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.da.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.de.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.el.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.en-gb.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.es-ar.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.es-mx.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.es.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.et.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.fi.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.fr.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.he.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.hi.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.hr.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuA
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyA
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.hu.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.id.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.is.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.it.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.ja.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.ko.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.lt.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.lv.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.ms.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.nl.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.no.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.pl.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.pt-br.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.pt-pt.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.ro.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.ru.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.sk.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.sl.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.sr.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.sv.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.th.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.tl.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.tr.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.uk.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.vi.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.zh-cn.html
Source: chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/packages.zh-tw.html
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/region.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/region.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AE
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/resorts/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExu
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/resorts/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/reviews
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/searchresults.html
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/searchresults.html?aid=800210&si=ai
Source: chromecache_599.2.dr	String found in binary or memory: https://www.booking.com/taxi/index.html?aid=304142;lang=en-us;sid=5171fc655664ddf74ab763a094523fb7&
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/traveller-awards/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8C
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/traveller-awards/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAE
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/trust-and-safety.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmA
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/trust-and-safety.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2
Source: chromecache_692.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.booking.com/villas/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuA
Source: chromecache_380.2.dr	String found in binary or memory: https://www.booking.com/villas/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.bookingholdings.com/
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.bookingholdings.com/about/compliance-and-ethics/
Source: chromecache_564.2.dr	String found in binary or memory: https://www.bstatic.com/libs/privacy-consent/1.0.0/customer/cookie-banner.min.js
Source: chromecache_564.2.dr, chromecache_791.2.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_762.2.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_762.2.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_762.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_623.2.dr	String found in binary or memory: https://www.google.com
Source: chromecache_423.2.dr	String found in binary or memory: https://www.google.com/
Source: chromecache_423.2.dr	String found in binary or memory: https://www.google.com/#organization
Source: chromecache_762.2.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_423.2.dr	String found in binary or memory: https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png
Source: chromecache_423.2.dr	String found in binary or memory: https://www.google.com/intl/en/policies/privacy/
Source: chromecache_423.2.dr	String found in binary or memory: https://www.google.com/intl/en/policies/terms/
Source: chromecache_787.2.dr, chromecache_395.2.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: chromecache_485.2.dr, chromecache_326.2.dr, chromecache_386.2.dr	String found in binary or memory: https://www.google.com/pagead/1p-user-list/1060768846/?random
Source: chromecache_610.2.dr	String found in binary or memory: https://www.google.com/pagead/1p-user-list/1070314322/?random
Source: chromecache_638.2.dr	String found in binary or memory: https://www.google.com/pagead/1p-user-list/481216654/?random
Source: chromecache_736.2.dr, chromecache_551.2.dr, chromecache_681.2.dr, chromecache_754.2.dr, chromecache_376.2.dr, chromecache_400.2.dr	String found in binary or memory: https://www.google.com/pagead/1p-user-list/973712236/?random
Source: chromecache_329.2.dr, chromecache_436.2.dr, chromecache_580.2.dr, chromecache_792.2.dr, chromecache_650.2.dr, chromecache_468.2.dr	String found in binary or memory: https://www.google.com/pagead/1p-user-list/975716499/?random
Source: chromecache_510.2.dr, chromecache_649.2.dr, chromecache_360.2.dr	String found in binary or memory: https://www.google.com/pagead/1p-user-list/988382855/?random
Source: chromecache_354.2.dr, chromecache_595.2.dr, chromecache_787.2.dr, chromecache_395.2.dr, chromecache_590.2.dr, chromecache_609.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: chromecache_711.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/aframe
Source: chromecache_423.2.dr	String found in binary or memory: https://www.google.com/services/?utm_source=marketingplatform.google.com&utm_medium=et&utm_campaign=
Source: chromecache_623.2.dr	String found in binary or memory: https://www.googleadservices.com
Source: chromecache_655.2.dr	String found in binary or memory: https://www.googleadservices.com/pagead/managed/js/activeview/
Source: chromecache_375.2.dr, chromecache_467.2.dr, chromecache_513.2.dr, chromecache_394.2.dr, chromecache_623.2.dr	String found in binary or memory: https://www.googlesyndication.com
Source: chromecache_623.2.dr	String found in binary or memory: https://www.googletagmanager.com
Source: chromecache_375.2.dr	String found in binary or memory: https://www.googletagmanager.com/dclk/ns/v1.js
Source: chromecache_791.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js
Source: chromecache_762.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: chromecache_423.2.dr, chromecache_411.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: chromecache_470.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=GTM-5Q664QZ
Source: chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-5Q664QZ
Source: chromecache_423.2.dr	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-MPHTW35
Source: chromecache_787.2.dr, chromecache_395.2.dr	String found in binary or memory: https://www.gstatic.c..?/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__.
Source: chromecache_423.2.dr	String found in binary or memory: https://www.gstatic.com/glue/cookienotificationbar/cookienotificationbar.min.css
Source: chromecache_423.2.dr	String found in binary or memory: https://www.gstatic.com/glue/cookienotificationbar/cookienotificationbar.min.js
Source: chromecache_423.2.dr	String found in binary or memory: https://www.gstatic.com/images/branding/googleg/2x/googleg_standard_color_192dp.png
Source: chromecache_423.2.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/ico/googleg_alldp.ico
Source: chromecache_423.2.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/ico/googleg_standard_16dp.ico
Source: chromecache_423.2.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/ico/googleg_standard_32dp.ico
Source: chromecache_354.2.dr, chromecache_595.2.dr, chromecache_548.2.dr, chromecache_590.2.dr, chromecache_609.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__en.js
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.instagram.com/bookingcom/
Source: chromecache_423.2.dr	String found in binary or memory: https://www.instagram.com/google/
Source: chromecache_423.2.dr	String found in binary or memory: https://www.linkedin.com/showcase/googlemarketingplatform
Source: chromecache_513.2.dr, chromecache_394.2.dr	String found in binary or memory: https://www.merchant-center-analytics.goog/mc/collect
Source: chromecache_589.2.dr	String found in binary or memory: https://www.pinterest.com
Source: chromecache_423.2.dr	String found in binary or memory: https://www.thinkwithgoogle.com/?utm_source=marketingplatform.google.com&utm_medium=et&utm_campaign=
Source: chromecache_692.2.dr, chromecache_380.2.dr	String found in binary or memory: https://www.tiktok.com/
Source: chromecache_423.2.dr	String found in binary or memory: https://www.yourprimer.com/?utm_source=marketingplatform.google.com&utm_medium=et&utm_campaign=marke
Source: chromecache_423.2.dr	String found in binary or memory: https://www.youtube.com/c/googlemarketingplatform
Source: chromecache_564.2.dr	String found in binary or memory: https://xx.bstatic.com/static/img/favicon.ico
Source: chromecache_564.2.dr	String found in binary or memory: https://xx.bstatic.com/static/img/favicon.svg

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50738
Source: unknown	Network traffic detected: HTTP traffic on port 50726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50730
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 50578 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50747
Source: unknown	Network traffic detected: HTTP traffic on port 50440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50749
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50741
Source: unknown	Network traffic detected: HTTP traffic on port 50325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50600 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 50738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50758
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50752
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 50714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50768
Source: unknown	Network traffic detected: HTTP traffic on port 50280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50762
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50761
Source: unknown	Network traffic detected: HTTP traffic on port 50337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50612 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50763
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50510 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 50795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50591 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 50656 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50705
Source: unknown	Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 50313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50717
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50716
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50719
Source: unknown	Network traffic detected: HTTP traffic on port 50259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50718
Source: unknown	Network traffic detected: HTTP traffic on port 50808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 50771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50727
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50720
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 50369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 50420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50337
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50336
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50339
Source: unknown	Network traffic detected: HTTP traffic on port 50386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50338
Source: unknown	Network traffic detected: HTTP traffic on port 50546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50331
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50330
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50333
Source: unknown	Network traffic detected: HTTP traffic on port 50632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50332
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50335
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50334
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50347
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50349
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50340
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50342
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50344
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50343
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50345
Source: unknown	Network traffic detected: HTTP traffic on port 50673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50359
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50358
Source: unknown	Network traffic detected: HTTP traffic on port 50804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50351
Source: unknown	Network traffic detected: HTTP traffic on port 50558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50350
Source: unknown	Network traffic detected: HTTP traffic on port 50317 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50353
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50355
Source: unknown	Network traffic detected: HTTP traffic on port 50374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50357
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50356
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50620 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50369
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 50685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50361
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50364
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50363
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50366
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50365
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50368
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50367
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50778
Source: unknown	Network traffic detected: HTTP traffic on port 50571 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50774
Source: unknown	Network traffic detected: HTTP traffic on port 50350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50607 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50304
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50303
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50306
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50305
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50789
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50308
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50307
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50309
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50780
Source: unknown	Network traffic detected: HTTP traffic on port 50702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50300
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50302
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50301
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50315
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50314
Source: unknown	Network traffic detected: HTTP traffic on port 50791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50317
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50316
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50319
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50318
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50311
Source: unknown	Network traffic detected: HTTP traffic on port 50619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50310
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50313
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50312
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50796
Source: unknown	Network traffic detected: HTTP traffic on port 50349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50326
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50325
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50328
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50327
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50329
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50320
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50322
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50321
Source: unknown	Network traffic detected: HTTP traffic on port 50488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50324
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50323
Source: unknown	Network traffic detected: HTTP traffic on port 50746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50296
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50295
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50298
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50297
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50299
Source: unknown	Network traffic detected: HTTP traffic on port 50400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50549 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50665 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50365 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50259
Source: unknown	Network traffic detected: HTTP traffic on port 50424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50258
Source: unknown	Network traffic detected: HTTP traffic on port 50353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50260
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50265
Source: unknown	Network traffic detected: HTTP traffic on port 50639 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50264
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50267
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50266
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50269
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50268
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50270
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50272
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50271
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50468 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50273
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50276
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50275
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50277
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50279
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50281
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50280
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50283
Source: unknown	Network traffic detected: HTTP traffic on port 50412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50282
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50285
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50284
Source: unknown	Network traffic detected: HTTP traffic on port 50689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50287
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50286
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50289
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50288
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50290
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50292
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50294
Source: unknown	Network traffic detected: HTTP traffic on port 50799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50293
Source: unknown	Network traffic detected: HTTP traffic on port 50562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50627 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50357 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50517 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50603 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50529 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50615 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50586 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50345 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50530 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50436 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50659 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50296 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50542 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50509 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50321 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50493 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50554 -> 443

Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.5:49717 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_BITS_6428_992980896

Jump to behavior

Source: classification engine

Classification label: mal48.win@42/874@204/68

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1980,i,14640437719870964142,12986360728299235327,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://booking.search-13125.com/6513881796
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1980,i,14640437719870964142,12986360728299235327,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Drive-by Compromise	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	11 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://booking.search-13125.com/6513881796	100%	Avira URL Cloud	phishing
https://booking.search-13125.com/6513881796	100%	SlashNext	Credential Stealing type: Phishing & Social Engineering

Source	Detection	Scanner	Label
https://www.booking.com/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB	0%	Avira URL Cloud	safe
https://account.booking.	0%	Avira URL Cloud	safe
about:blank	0%	Avira URL Cloud	safe
https://d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com/d8c14d4960ca/c2181391033f/verify	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
d2i5gg36g14bzn.cloudfront.net	108.138.64.16	true	false	high
collector-pxikkul2rm.px-cloud.net	35.190.10.96	true	false	unknown
www.googletagservices.com	172.253.124.155	true	false	high
d2uxzmvxe6bz7q.cloudfront.net	3.162.125.32	true	false	high
www3.doubleclick.net	64.233.185.138	true	false	high
edge12.g.yimg.jp	182.22.24.252	true	false	high
adservice.google.com	64.233.177.157	true	false	high
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
d8c14d4960ca.edge.sdk.awswaf.com	18.165.98.45	true	false	unknown
gtm-mktg.booking.com	216.239.38.21	true	false	high
stats.g.doubleclick.net	142.250.105.155	true	false	high
d333i577x8trzi.cloudfront.net	99.84.208.90	true	false	high
www.google.com	108.177.122.106	true	false	high
gcp.api.sc-gw.com	35.190.43.134	true	false	unknown
marketingplatform.google.com	172.217.215.102	true	false	high
booking.search-13125.com	104.21.85.210	true	false	unknown
google.com	142.250.9.100	true	false	high
pagead-googlehosted.l.google.com	74.125.136.132	true	false	high
accounts.google.com	142.250.9.84	true	false	high
securepubads46.g.doubleclick.net	142.250.105.155	true	false	high
du1b3vb35hc0o.cloudfront.net	13.32.208.75	true	false	high
ad.doubleclick.net	172.253.124.149	true	false	high
sc-static.net	108.139.23.251	true	false	unknown
d32jgtbwout526.cloudfront.net	216.137.45.32	true	false	high
d1of1hbywxxm65.cloudfront.net	108.138.64.79	true	false	high
d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	18.67.65.55	true	false	unknown
de2trjlt8e8rj.cloudfront.net	3.161.193.71	true	false	high
prod.pinterest.global.map.fastly.net	151.101.128.84	true	false	unknown
analytics-alv.google.com	216.239.34.181	true	false	high
googleads.g.doubleclick.net	74.125.138.155	true	false	high
dualstack.pinterest.map.fastly.net	151.101.12.84	true	false	unknown
td.doubleclick.net	142.251.15.156	true	false	high
clients.l.google.com	172.217.215.101	true	false	high
usc1-gcp-v61.api.sc-gw.com	35.190.43.134	true	false	unknown
cdn.cookielaw.org	104.18.131.236	true	false	high
geolocation.onetrust.com	172.64.155.119	true	false	high
booking.com	108.138.64.67	true	false	high
securepubads.g.doubleclick.net	unknown	unknown	false	high
xx.bstatic.com	unknown	unknown	false	high
web-perf.booking.com	unknown	unknown	false	high
web-vitals.booking.com	unknown	unknown	false	high
tr.snapchat.com	unknown	unknown	false	high
flights.booking.com	unknown	unknown	false	high
r-xx.bstatic.com	unknown	unknown	false	high
r.bstatic.com	unknown	unknown	false	high
ct.pinterest.com	unknown	unknown	false	high
z.moatads.com	unknown	unknown	false	unknown
clients2.google.com	unknown	unknown	false	high
accommodations.booking.com	unknown	unknown	false	high
cf.bstatic.com	unknown	unknown	false	high
www.bstatic.com	unknown	unknown	false	high
t-cf.bstatic.com	unknown	unknown	false	high
nellie.booking.com	unknown	unknown	false	high
www.booking.com	unknown	unknown	false	high
s.yimg.jp	unknown	unknown	false	high
q-cf.bstatic.com	unknown	unknown	false	high
s.pinimg.com	unknown	unknown	false	high
account.booking.com	unknown	unknown	false	high
q-xx.bstatic.com	unknown	unknown	false	high
tr6.snapchat.com	unknown	unknown	false	high
analytics.google.com	unknown	unknown	false	high
shelves.booking.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdn.cookielaw.org/consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/OtAutoBlock.js	false		high
https://cf.bstatic.com/static/js/error_catcher_bec_cloudfront_sd/0acd2ada6c74d5dec978a04ea837952bdf050cd2.js	false		high
https://cf.bstatic.com/psb/capla/static/css/1baf5a63.539e3a8f.chunk.css	false		high
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-116109-18&cid=421694156.1707417338&jid=1759057297&gjid=1532392567&_gid=1662332493.1707417338&_u=SCCAgAIJAAAAAGgMI~&z=722720305	false		high
https://www.google.com/pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_MIRu885KDHLnHDVd1L_zOfvbAE7ka3IfdUmXyEJ6dX9lBxna&random=1657552313	false		high
https://cf.bstatic.com/static/js/landing_pages_common_cloudfront_sd/5d6270f9d99467ef1f2d14da9abb86c291f4bb0b.js	false		high
about:blank	false	Avira URL Cloud: safe	low
https://analytics.google.com/g/collect?v=2&tid=G-FPD6YLJCJ7&gtm=45je4250v888381215z879615461za200&_p=1707417343003&_gaz=1&gcs=G1--&gcd=13l3l3l3l5&npa=0&dma=0&cid=421694156.1707417338&ul=en-us&sr=1280x1024&ir=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pae=1&pscdl=noapi&_eu=EA&_s=1&cu=EUR&dl=https%3A%2F%2Fwww.booking.com%2F&sid=1707417345&sct=1&seg=0&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&_fv=1&_ss=1&ep.cd_action=index&ep.cd_adults=-1&ep.cd_page_url=https%3A%2F%2Fwww.booking.com%2F&ep.cd_ai=304142&ep.cd_book_window=&ep.cd_full_referrer=&ep.cd_glev=&ep.cd_language=en-us&epn.cd_logged_in=0&ep.cd_tsmp=1707417343416&ep.cd_user_location=us&ep.cd_site_section=Stays&up.up_ga_client_id=421694156.1707417338&upn.up_is_subscribed_to_newsletter=0&tfd=17690	false		high
https://cf.bstatic.com/xdata/images/city/square250/977381.webp?k=ab236c5e99ba40341684e2d3bfcd8256d36f5e63883350af9faa988cd4d49939&o=	false		high
https://cf.bstatic.com/psb/capla/static/css/445be7a9.b944bd98.chunk.css	false		high
https://t-cf.bstatic.com/design-assets/assets/v3.81.0/fonts-brand/BookingBold.woff	false		high
https://q-xx.bstatic.com/backend_static/common/flags/new/48-squared/us.png	false		high
https://q-xx.bstatic.com/xdata/images/city/square210/977345.jpg?k=898a2e6c68a765bdc18cc57be5c78b3e1f5b825c4d3167e7a0860c4c988a1af1&o=	false		high
https://account.booking.com/sign-in?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA	false		high
https://cdn.cookielaw.org/consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/3ea94870-d4b1-483a-b1d2-faf1d982bb31.json	false		high
https://cf.bstatic.com/xdata/images/city/square250/689838.webp?k=32ffc2bfac0d85557bd5ddfc1ca92c73aef20bc8b4b5f2ac8b77ad47b6b7d5c1&o=	false		high
https://www.google.com/pagead/1p-user-list/481216654/?random=1707417393396&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v843635506za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Fflights%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3D5171fc655664ddf74ab763a094523fb7%26from%3Dbooking%26&frm=0&tiba=Find%20cheap%20flights%20%26%20plane%20tickets%20%7C%20Booking.com&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_Q42k7LniCkJSmGP5qbVRNGdKG19C38wURmRQTCr_7yXYQedx&random=352684247&rmt_tld=0&ipr=y	false		high
https://cf.bstatic.com/static/css/packages_city_landing_page_cloudfront_sd.iq_ltr/93424469ff1c9690f5bca8925db03679a0eb6072.css	false		high
https://t-cf.bstatic.com/design-assets/assets/v3.81.0/fonts-brand/BookingRegular.woff	false		high
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js	false		high
https://cf.bstatic.com/psb/capla/static/css/eb60141d.cad86b29.chunk.css	false		high
https://cf.bstatic.com/psb/capla/static/css/4e596c2c.3a2fb681.chunk.css	false		high
https://cf.bstatic.com/static/js/genius_vip_cloudfront_sd/aae975495cc56436f4f59463b9ea4e594bdb102a.js	false		high
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&cb=c94raoawdzt3	false		high
https://cf.bstatic.com/xdata/images/city/square250/786960.webp?k=e313213321010a516ee56b6ee04e367f770af64eaae9e8e230cde42d2cbca75a&o=	false		high
https://d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com/d8c14d4960ca/c2181391033f/verify	false	Avira URL Cloud: safe	unknown
https://www.booking.com/js_errors?pid=d16682db432d0172&url=https%3A%2F%2Fwww.booking.com%2Fpackages.html&m=UmFuZG9tSVYkc2RlIyh9YdIXFZ7Nf82NAkuhhudQTioSutRpQn8uBcWgwMM-j5Sbuz9nv2vWLHLE4dV_SJngbBBk6UTeFiFgOcPnz7Gzoo2KA6TL2_i5J5f0Z_mULkN4439jWeHNCGdOf8Dnfr2mwd5U84qKx9veEXwn0ypiUZ29ohxd9ldgdVHyLvDvyEXRk_w3FXR-xkqyOsPLC6jUYYiSuqTleRS_1fViiRhT_YdQ6RNP48Cqy_dE7Kp_jNXyxS8D15Ld5uk&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=packages_city&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2Fpackages.html&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSObZWJFfVDSMePCFYZWFXO&cors=1	false		high
https://cf.bstatic.com/psb/accountsportal/assets/runtime~index_9239c9c6cbeb2a77c28f.js	false		high
https://cf.bstatic.com/static/css/searchresults_cloudfront_sd.iq_ltr/a80f32e7f9693f304c247b0f22b0f109a5fd7dd6.css	false		high
https://cf.bstatic.com/psb/accountsportal/assets/45_1975cbc2f7eaad75f590.css	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://cf.bstatic.com/static/img/flags/new/48-squared/il/fc1907ccd86aa051f7fbe22649d1e31ac6aee016.p	chromecache_470.2.dr	false		high
https://www.booking.com/flights/index.sv.html	chromecache_411.2.dr	false		high
https://istatic.booking.com/internal-static/capla/static/js/7bcb015e.cf9d45ea.chunk.js.map	chromecache_491.2.dr	false		high
https://cf.bstatic.com/static/img/flags/new/48-squared/lv/393103a26c1d5f1fbd7d9674732bbdfc42296399.p	chromecache_470.2.dr	false		high
https://istatic.booking.com/internal-static/capla/static/js/18cad957.fe671709.chunk.js.map	chromecache_525.2.dr	false		high
https://www.booking.com/index.fi.html	chromecache_692.2.dr, chromecache_380.2.dr	false		high
https://flights.booking.com/flights/ATL-LAX/?type=ROUNDTRIP&adults=1&cabinClass=ECONOMY&	chromecache_411.2.dr	false		high
https://cf.bstatic.com/static/img/flags/new/48-squared/fi/465d3b73ff07d1d696cb5dd26fbb91097c175e1b.p	chromecache_470.2.dr	false		high
https://ampcid.google.com/v1/publisher:getClientId	chromecache_762.2.dr	false		high
https://cf.bstatic.com/static/css/ski_lp_overview_panel_cloudfront_sd.iq_ltr/2b3350935410fe4e36d74ef	chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	false		high
https://www.booking.com/index.lv.html	chromecache_692.2.dr, chromecache_380.2.dr	false		high
https://cf.bstatic.com/static/js/packages_city_landing_page_cloudfront_sd/172f7d6c1b0baff6a5977b7d91	chromecache_470.2.dr	false		high
https://secure.booking.com/reviewtimeline.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBm	chromecache_692.2.dr, chromecache_470.2.dr	false		high
https://cf.bstatic.com/static/js/landing_pages_common_cloudfront_sd/5d6270f9d99467ef1f2d14da9abb86c2	chromecache_470.2.dr	false		high
https://www.booking.com/index.is.html	chromecache_692.2.dr, chromecache_380.2.dr	false		high
https://support.google.com/recaptcha/#6175971	chromecache_787.2.dr, chromecache_395.2.dr	false		high
https://www.booking.com/country/us.en-us.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2	chromecache_692.2.dr	false		high
http://www.quirksmode.org/js/cookies.html	chromecache_564.2.dr	false		high
https://booking.com/packages/city/us/miami.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8C	chromecache_470.2.dr	false		high
https://cf.bstatic.com/static/img/flags/new/48-squared/cz/32002e60fead55ce886ff9827dfcf4af8cf4e277.p	chromecache_470.2.dr	false		high
https://lh3.googleusercontent.com/eBgXEvVz_cqaqw5ZZRjWndAKwLuWlFXuf9CW0NHHMgK3BY5TCrI2AE1tsq20ZeXM55	chromecache_423.2.dr	false		high
https://account.booking.	chromecache_411.2.dr	false	Avira URL Cloud: safe	unknown
https://www.booking.com/extended-stays/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXy	chromecache_380.2.dr	false		high
https://cf.bstatic.com/xdata/images/city/square250/977381.webp?k=ab236c5e99ba40341684e2d3bfcd8256d36	chromecache_470.2.dr	false		high
https://www.booking.com/hostels/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExu	chromecache_692.2.dr, chromecache_470.2.dr	false		high
https://cf.bstatic.com/static/img/tfl/group_logos/logo_agoda/1c9191b6a3651bf030e41e99a153b64f449845e	chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	false		high
https://cf.bstatic.com/static/css/packages_city_landing_page_cloudfront_sd.iq_ltr/93424469ff1c9690f5	chromecache_470.2.dr	false		high
https://cf.bstatic.com/xdata/images/city/square250/690179.webp?k=cb5eb236e7e9bf988a677e4fbdbf81ef955	chromecache_470.2.dr	false		high
https://lh3.googleusercontent.com/wrHKPwn_RKCusdpmICnKeZoYVzfup5x3e6UFj58iVzEymAnru1XWjhrl2mFu5eLJ8X	chromecache_423.2.dr	false		high
https://lh3.googleusercontent.com/McJV-U6w665Cr7SFm8uBmRog_9DPfbCdntR4aK0tL2wjaXrKc0EsUT649iJOlZfVAA	chromecache_423.2.dr	false		high
https://cloud.google.com/?utm_source=marketingplatform.google.com&utm_medium=et&utm_campaign=marketi	chromecache_423.2.dr	false		high
https://www.booking.com/content-moderation-policy/overview-page.html?label=gen173nr-1FCAEoggI46AdIM1	chromecache_380.2.dr	false		high
https://www.booking.com/packages.ru.html	chromecache_470.2.dr	false		high
https://www.booking.com/flights/index.hi.html	chromecache_411.2.dr	false		high
https://www.booking.com/cars/index.html?aid=304142;lang=en-us;sid=5171fc655664ddf74ab763a094523fb7&	chromecache_599.2.dr	false		high
https://www.booking.com/destination.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6A	chromecache_380.2.dr	false		high
https://flights.booking.com/flights/ATL-PUJ/?type=ROUNDTRIP&adults=1&cabinClass=ECONOMY&	chromecache_411.2.dr	false		high
https://firebase.google.com/?utm_source=marketingplatform.google.com&utm_medium=et&utm_campaign=mark	chromecache_423.2.dr	false		high
https://www.booking.com/index.sk.html	chromecache_692.2.dr, chromecache_380.2.dr	false		high
https://account.booking.com/sso/logout/v3	chromecache_470.2.dr	false		high
https://secure.booking.com/help.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAE	chromecache_692.2.dr, chromecache_470.2.dr	false		high
https://www.booking.com/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB	chromecache_380.2.dr	false	Avira URL Cloud: safe	low
https://www.booking.com/packages.zh-cn.html	chromecache_470.2.dr	false		high
https://cf.bstatic.com/static/img/tfl/group_logos/logo_booking/27c8d1832de6a3123b6ee45b59ae2f81b0d9d	chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	false		high
https://www.booking.com/country.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-A	chromecache_380.2.dr	false		high
https://istatic.booking.com/internal-static/capla/static/js/client.1b521280.js.map	chromecache_428.2.dr	false		high
https://www.booking.com/flights/index.no.html	chromecache_411.2.dr	false		high
https://secure.booking.com/myreservations.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM	chromecache_380.2.dr	false		high
https://istatic.booking.com/internal-static/capla/static/css/1baf5a63.539e3a8f.chunk.css.map	chromecache_744.2.dr	false		high
https://www.booking.com/index.nl.html	chromecache_692.2.dr, chromecache_380.2.dr	false		high
https://istatic.booking.com/internal-static/capla/static/js/remoteEntry.40329cb8.client.js.map	chromecache_487.2.dr	false		high
https://istatic.booking.com/internal-static/capla/static/css/18cad957.d04abce3.chunk.css.map	chromecache_637.2.dr	false		high
https://flights.booking.com/icons/mstile-70x70.png	chromecache_411.2.dr	false		high
https://www.booking.com/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AEC	chromecache_380.2.dr	false		high
https://flights-support.booking.com/hc/en-us	chromecache_599.2.dr	false		high
https://github.com/google/safevalues/issues	chromecache_549.2.dr	false		high
https://q-cf.bstatic.com/xdata/images/city/square100/653307.jpg?k=96840ba0ed6ab187b729e16cb1655ad614	chromecache_411.2.dr	false		high
https://www.booking.com/packages.es-ar.html	chromecache_470.2.dr	false		high
https://cloud.google.com/contact	chromecache_787.2.dr, chromecache_395.2.dr	false		high
https://cf.bstatic.com/xdata/images/city/square250/690267.webp?k=05055e2ec19868d57cf86ccb604589b988d	chromecache_470.2.dr	false		high
https://www.booking.com/index.hu.html	chromecache_692.2.dr, chromecache_380.2.dr	false		high
https://www.booking.com/index.de.html	chromecache_692.2.dr, chromecache_380.2.dr	false		high
https://flights.booking.com/icons/mstile-150x150.png	chromecache_411.2.dr	false		high
https://www.booking.com/affiliate-program/v2/index.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAE	chromecache_380.2.dr	false		high
https://booking.com/packages/city/us/columbia.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEa	chromecache_470.2.dr	false		high
https://cf.bstatic.com/static/css/incentives_cloudfront_sd.iq_ltr/f1558a6e9832a4eb8cfe1d3d14db176bd3	chromecache_692.2.dr, chromecache_380.2.dr	false		high
https://cf.bstatic.com/static/js/async_lists_cloudfront_sd/ea653b9852a85cb0190755d3979dbd317a486979.	chromecache_692.2.dr, chromecache_380.2.dr, chromecache_470.2.dr	false		high
https://www.booking.com/attractions/login.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBm	chromecache_599.2.dr	false		high
https://www.booking.com/content/terms.html	chromecache_599.2.dr	false		high
https://www.booking.com/index.en-gb.html	chromecache_692.2.dr, chromecache_380.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
18.67.65.55	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	United States	3	MIT-GATEWAYSUS	false
64.233.177.84	unknown	United States	15169	GOOGLEUS	false
182.22.24.252	edge12.g.yimg.jp	Japan	23816	YAHOOYahooJapanCorporationJP	false
3.161.193.103	unknown	United States	16509	AMAZON-02US	false
172.253.124.149	ad.doubleclick.net	United States	15169	GOOGLEUS	false
151.101.128.84	prod.pinterest.global.map.fastly.net	United States	54113	FASTLYUS	false
64.233.185.138	www3.doubleclick.net	United States	15169	GOOGLEUS	false
172.253.124.132	unknown	United States	15169	GOOGLEUS	false
3.161.193.117	unknown	United States	16509	AMAZON-02US	false
64.233.177.99	unknown	United States	15169	GOOGLEUS	false
142.251.15.154	unknown	United States	15169	GOOGLEUS	false
108.177.122.106	www.google.com	United States	15169	GOOGLEUS	false
142.251.15.156	td.doubleclick.net	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.9.84	accounts.google.com	United States	15169	GOOGLEUS	false
151.101.192.84	unknown	United States	54113	FASTLYUS	false
64.233.185.148	unknown	United States	15169	GOOGLEUS	false
18.64.236.114	unknown	United States	3	MIT-GATEWAYSUS	false
64.233.177.157	adservice.google.com	United States	15169	GOOGLEUS	false
216.137.45.32	d32jgtbwout526.cloudfront.net	United States	16509	AMAZON-02US	false
216.239.38.21	gtm-mktg.booking.com	United States	15169	GOOGLEUS	false
104.18.131.236	cdn.cookielaw.org	United States	13335	CLOUDFLARENETUS	false
104.21.85.210	booking.search-13125.com	United States	13335	CLOUDFLARENETUS	false
74.125.136.138	unknown	United States	15169	GOOGLEUS	false
216.239.32.21	unknown	United States	15169	GOOGLEUS	false
35.190.43.134	gcp.api.sc-gw.com	United States	15169	GOOGLEUS	false
64.233.177.148	unknown	United States	15169	GOOGLEUS	false
108.138.64.16	d2i5gg36g14bzn.cloudfront.net	United States	16509	AMAZON-02US	false
64.233.185.99	unknown	United States	15169	GOOGLEUS	false
74.125.136.132	pagead-googlehosted.l.google.com	United States	15169	GOOGLEUS	false
18.64.236.100	unknown	United States	3	MIT-GATEWAYSUS	false
99.84.208.90	d333i577x8trzi.cloudfront.net	United States	16509	AMAZON-02US	false
108.138.64.95	unknown	United States	16509	AMAZON-02US	false
18.67.65.100	unknown	United States	3	MIT-GATEWAYSUS	false
216.239.34.181	analytics-alv.google.com	United States	15169	GOOGLEUS	false
18.67.65.7	unknown	United States	3	MIT-GATEWAYSUS	false
3.161.150.72	unknown	United States	16509	AMAZON-02US	false
104.18.32.137	unknown	United States	13335	CLOUDFLARENETUS	false
108.138.64.87	unknown	United States	16509	AMAZON-02US	false
142.250.9.132	unknown	United States	15169	GOOGLEUS	false
3.162.125.32	d2uxzmvxe6bz7q.cloudfront.net	United States	16509	AMAZON-02US	false
18.64.236.64	unknown	United States	3	MIT-GATEWAYSUS	false
74.125.138.147	unknown	United States	15169	GOOGLEUS	false
172.64.155.119	geolocation.onetrust.com	United States	13335	CLOUDFLARENETUS	false
151.101.12.84	dualstack.pinterest.map.fastly.net	United States	54113	FASTLYUS	false
3.162.125.41	unknown	United States	16509	AMAZON-02US	false
108.138.64.79	d1of1hbywxxm65.cloudfront.net	United States	16509	AMAZON-02US	false
108.177.122.148	unknown	United States	15169	GOOGLEUS	false
64.233.185.104	unknown	United States	15169	GOOGLEUS	false
35.190.10.96	collector-pxikkul2rm.px-cloud.net	United States	15169	GOOGLEUS	false
104.18.130.236	unknown	United States	13335	CLOUDFLARENETUS	false
108.139.23.251	sc-static.net	United States	16509	AMAZON-02US	false
99.84.208.123	unknown	United States	16509	AMAZON-02US	false
18.165.98.45	d8c14d4960ca.edge.sdk.awswaf.com	United States	3	MIT-GATEWAYSUS	false
64.233.176.157	unknown	United States	15169	GOOGLEUS	false
108.177.122.154	unknown	United States	15169	GOOGLEUS	false
108.138.64.67	booking.com	United States	16509	AMAZON-02US	false
18.64.236.43	unknown	United States	3	MIT-GATEWAYSUS	false
18.238.55.22	unknown	United States	16509	AMAZON-02US	false
18.67.65.25	unknown	United States	3	MIT-GATEWAYSUS	false
74.125.136.99	unknown	United States	15169	GOOGLEUS	false
142.250.105.105	unknown	United States	15169	GOOGLEUS	false
3.161.193.71	de2trjlt8e8rj.cloudfront.net	United States	16509	AMAZON-02US	false
142.250.9.100	google.com	United States	15169	GOOGLEUS	false
142.250.9.103	unknown	United States	15169	GOOGLEUS	false
13.32.208.75	du1b3vb35hc0o.cloudfront.net	United States	16509	AMAZON-02US	false
172.217.215.84	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1389406
Start date and time:	2024-02-08 19:34:28 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://booking.search-13125.com/6513881796
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@42/874@204/68
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://www.booking.com/#indexsearch Browse: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Browse: https://account.booking.com/auth/oauth2?client_id=vO1Kblk7xX9tUn2cpZLS&redirect_uri=https%3A%2F%2Fsecure.booking.com%2Flogin.html%3Fop%3Doauth_return&response_type=code&lang=en-us&aid=304142&bkng_action=index&prompt=signin&state=UrMBgkQNS1KiqaarhO6u8GC5pLvbDzh05Jv3O7fBVre6Nq4fPbBeTIEnVM3oarUsKJ_zmYJwP7hj2rzLKwHaucbz6cOiW6TMT2BoYQhI0E_OB8HcQpKUqnRkDABT1Fkn1G5_tqsYKNgKxwnCle9VWbm7sPUHFgkeTFM66Gm2zmKaFmeoqOY3vXIeOTBoWkkxDkiRQjBZqiN0i357B9QuByZ951RdWcagGjko7SwvUPhzQPaMKc0%3D*eyJpZCI6InRyYXZlbGxlcl9oZWFkZXIifQ%3D%3D Browse: https://booking.com/pxgo?aid=304142&url=https%3A%2F%2Fbooking.kayak.com%2Fin%3Fsid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d%26mc%3DUSD%26bdclc%3Den-us%26p%3Dsearchbox_link%26a%3Dbdc%252Fsearchbox&lang=en-us&token=UmFuZG9tSVYkc2RlIyh9YWktmrwAPG7d0xk8r8arn9uxQCG04RxbSQCG3Kyo3zIaNexHWMoKu0qbl3rRCWS9daSJZv4LhXctU_el3FE0vNgKJ8hNlWe9qJoXT5IhePG9dCyDOzJbnuHCaAGOCzeet0EOLiq91dkwzC3ofHESfaCoiRkvryR2KY9hMMMCEaSQbh42JWjprUVJgsytEbxWusKdmBV920vtDV0Qc4vKU6CWH5hM7ZIoyur88Q_Up5rVMrYTkwsOl8QIoeAGx-hxYwGnLLjiUSzuVu3HgAX40_N1KLIQ1pNmFuICDyi7Ok9OPeLqkFj305jGZy2W4qXbtafIffpjnJ_uHn5mJ1Oj19alqdXhZU4hYg2HAvm4g9WxCgjTS-qOIOywGNnYDMS-CUucLD6aezL-JbdWUx7y2nkZnDUbV898LDag3xjKOkNdisznqEjxMnvrsW4ZtxuQ6nmIsQrBtErZBrHZaWEJOLUGKwAwfV0VyghAdsJCXRGr&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ Browse: https://www.booking.com/packages.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 74.125.138.94, 34.104.35.123, 173.194.219.95, 142.250.105.95, 108.177.122.95, 64.233.177.95, 142.251.15.95, 142.250.9.95, 64.233.185.95, 64.233.176.95, 74.125.138.95, 172.217.215.95, 74.125.136.95, 172.253.124.95, 173.194.219.102, 173.194.219.139, 173.194.219.113, 173.194.219.138, 173.194.219.101, 173.194.219.100, 108.177.122.113, 108.177.122.102, 108.177.122.101, 108.177.122.100, 108.177.122.138, 108.177.122.139, 40.127.169.103, 23.40.205.43, 23.40.205.59, 23.40.205.65, 23.40.205.57, 23.40.205.66, 23.40.205.50, 23.40.205.67, 23.40.205.81, 23.40.205.73, 192.229.211.108, 52.165.164.15, 74.125.138.97, 142.250.105.156, 142.250.105.155, 142.250.105.154, 142.250.105.157, 64.233.177.94, 13.107.21.200, 204.79.197.200, 74.125.138.155, 74.125.138.154, 74.125.138.157, 74.125.138.156, 172.253.124.155, 172.253.124.157, 172.253.124.154, 172.253.124.156, 142.250.105.132, 173.194.219.132, 173.194.219.94, 74.125.136.157, 74.125.136.154, 74.125.136.156, 74.125.136.155, 172.253.124.94,
Excluded domains from analysis (whitelisted): www.googleadservices.com, slscr.update.microsoft.com, wildcard.moatads.com.edgekey.net, 0f492a439f0f79bcbc4fe15f41ea6011.safeframe.googlesyndication.com, clientservices.googleapis.com, 8ef290e4a40aabf645d441eeb66eb6e1.safeframe.googlesyndication.com, a767.dspw65.akamai.net, ocsp.digicert.com, www.googletagmanager.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, 2-01-37d2-0018.cdx.cedexis.net, sls.update.microsoft.com, bat.bing.com, update.googleapis.com, www.gstatic.com, www.google-analytics.com, glb.sls.prod.dcat.dsp.trafficmanager.net, 2-01-37d2-0020.cdx.cedexis.net, fonts.googleapis.com, fs.microsoft.com, content-autofill.googleapis.com, dual-a-0001.a-msedge.net, fonts.gstatic.com, ctldl.windowsupdate.com, pagead2.googlesyndication.com, 6187c7943c8809a450d5ea0d812d35d9.safeframe.googlesyndication.com, wu-bg-shim.trafficmanager.net, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, bat
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: https://booking.search-13125.com/6513881796

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Feb 8 17:35:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.979568107713565
Encrypted:	false
SSDEEP:	48:8XdoUTI4HPHfidAKZdA19ehwiZUklqehZy+3:8ZzJOy
MD5:	10892E74957257E27E8F85F891E35D27
SHA1:	220DA577DF76EAD2F3E3E3CCDD3BCC2CA8A91509
SHA-256:	9A5CD0D36613ACF93B3CB500A0D89659C7974A4FEB902A1B464EC68D80469C7C
SHA-512:	9192CA6FF209C8E6CDA42EC22DF3E93DAE68C0C846309828901A5411BE72A544078637964E06DDD1502B0D65B4B2936F3C229FB544A76B1C9B7194EA8086DBFA
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....!...Z..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IHXl.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VHXl.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VHXl.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VHXl............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VHXn............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Feb 8 17:35:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.993008021102329
Encrypted:	false
SSDEEP:	48:8ddoUTI4HPHfidAKZdA1weh/iZUkAQkqeh+y+2:8vzb9Q3y
MD5:	5D71BBD66048328780D379F7E6F6657B
SHA1:	70C22604FF579007DD5EDD4FF6834B3CA21C8838
SHA-256:	73E7D7F9E6EF4478170C9928C4CA62AD865BE98FBCE5428E437C3F490DBFE6D8
SHA-512:	75B1BAADDC1835296079E461DEC314EDF8FD24740E85CD7965563B5893B45048636290BCB1DB983FADBC8D67156A816C654F90E54328E1BA2C4099441B36011D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....Pv..Z..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IHXl.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VHXl.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VHXl.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VHXl............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VHXn............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.0029126436667894
Encrypted:	false
SSDEEP:	48:8xYdoUTI4HsHfidAKZdA14tseh7sFiZUkmgqeh7ssy+BX:8xszSnSy
MD5:	A8EA4487ACDD7004F7A916D6727D156E
SHA1:	B823C114EE17C0D8791C36A8BBA009570B60A9E2
SHA-256:	5A203BAE532716744DAB7C9A067A9C58F496E6DD121643344AA1E344376F594D
SHA-512:	887372D42D537AA31CA6C4677349677E50BE293013D31560A8EB7A9410BBFBDB4E9B04BDD83EEF236D91C315B52F68B3FBB8A6F2CF968A50674AF43BC195F1C5
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IHXl.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VHXl.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VHXl.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VHXl............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Feb 8 17:35:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.988431461258684
Encrypted:	false
SSDEEP:	48:8SdoUTI4HPHfidAKZdA1vehDiZUkwqehKy+R:8mz4Ey
MD5:	F5244EED79EC36D91EA192FDC68FDB7C
SHA1:	F3D31805973FCEB26F22B3ED0C2EA13165E7FB31
SHA-256:	ED14EF363A4757B27A423694B9C1025D93A7CAA3CC1E9CAD048A70A414BC3058
SHA-512:	DA076DB4CB69087E018DA469BC6DB7580E8F7E082A1B8CCAFC2D79A788035E1896DADF5BA41CFD21844D22B4F9E1122DE87D6A431318BA22BADF60183AF47F43
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....jkp..Z..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IHXl.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VHXl.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VHXl.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VHXl............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VHXn............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Feb 8 17:35:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9797778588603676
Encrypted:	false
SSDEEP:	48:8bdoUTI4HPHfidAKZdA1hehBiZUk1W1qehgy+C:8Nzo9Ay
MD5:	E8D1A35FB947B63636DC3E950ABFC074
SHA1:	A5B9A151941C87C8EC6253ECDD0D13B2D2D59E05
SHA-256:	A485676B57DB733094F3D75A1487591896C18E0EFBC3CD6551B2699EA6AA0E49
SHA-512:	3257C34A731884F0964B8626FD9A5DA2B1AC8DECF487A0AC97F66A58EC704C15492842878FFB9D91B23DB8697F2B2F3831CC85E4661BB64E9F8C82575003BDE2
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....b.}..Z..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IHXl.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VHXl.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VHXl.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VHXl............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VHXn............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Feb 8 17:35:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.992588349638061
Encrypted:	false
SSDEEP:	48:8VdoUTI4HPHfidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbSy+yT+:8nzGT/TbxWOvTbSy7T
MD5:	5E925E6D0873D127F76F5F57C3CA5389
SHA1:	AE2BEF6791EA9918DAB089BA847BC1DA1C7614AA
SHA-256:	8EA00556AAF16134BE10EC98343CA08CB0121738E62B04D831BBC4D0FD164048
SHA-512:	9F6A33B1BFC2A8912952098CCDEC6F80D2AA3BEAB71CA17B1B2D832C9768928CD52D89D81A1C3DC3A12A4E785C1CC31AAD29F16AE9609F277A679F0C47FB061B
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....\|.h..Z..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IHXl.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VHXl.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VHXl.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VHXl............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VHXn............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i....................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 316

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 70 x 26, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2146
Entropy (8bit):	7.8875883951747925
Encrypted:	false
SSDEEP:	48:j/6u3CtuLhUGh0H5UFe2pYo37Esd2gjEj7seiEfE/ODAtLx:jSRuLKA0ZUFnR4sPEUeJf8/
MD5:	27E71A5124018E16EAE0B8897618623D
SHA1:	D0D54D88B04EDFC71F338C19EAB9994632BC6CED
SHA-256:	1D6E86E59AB7235A8343F494C8E8DA6CC02C5A98A75D682401340E6D06935F20
SHA-512:	A9D6F6B881175780E2619843AA88AACE7E94DA178C53C3DDDE691A930C5412FC4CD817009D488757835903D9218758F808AC36C1F828371D57AF91EA9CF3170A
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...F..........b.....pHYs.................sRGB.........gAMA......a.....IDATx..Y.pT..>...........e....f.+(T.L..KiZ.....`..c;v .....u.M...h.........DJ..RQ..-?!FlB.}..~w./........3s..}..s.{...et.Kyy.....;v.....N..p.....I4=...t..'.BI.,/X..R.0.%.<.....F...i.6..rSJ.......Mgy0x.#.:....YYY....}.....~..L..M...........d.`..t...>Gi.K......)W.x.i?.5H.........Q...-0z..8 ?..IR.G`..N..`p...Q<.t.i2..~)K.G..l\y(4E..y.31.7.(....Wa..>......_RR....6.-..7...Iy..y;......~.<..T....)k.e...D.f...........2.k..0.=.[..D..n...W..V.B..uVUU..."5m.0W._.0a..^.'...V8x.. e.I...H8..... ..N;....".&.J...Hd.l).81....5.c...<.....W.o....U/(..,.O..+.c.ZZZ........L..c...V..[...... .g(.Y..P....>.>.-v?....>..&.?j.A....)5Q...KO....'.l..G...:.b{..#..4.`.[.]..V..20.k.-W.<.m[.q.BA.i........!...,.6.....N...l2.......`......1...o^...iY.]...&.O....\.c.>L.w...:.......u..d9.f.Ld.*....J...=...1....A.!&.c......f.}s....,."..e.....2....)...%..o..I\."_JL..id..c.N.y...k...p.m..A...

Chrome Cache Entry: 317

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	4.760973931417809
Encrypted:	false
SSDEEP:	3:YGNRuWV0JgdVAc9rrWWsA4DdzHfHYQsOrrWWpzxEC1Ww1g/dLivQKcpku1g/DXr1:YGzrpdVx1sHd71d4LU35TXepy
MD5:	1680EF5542C6337833319D8CD8754068
SHA1:	364FC071A9ADB1D27787C50FAF72A108BB9F1776
SHA-256:	20C9764BF96E3B429FD5A532D255FFC036E94C8F3CDC02A422BBD69300449C98
SHA-512:	0501297E5D28A62F17623AE72A0B92010E59ADB34C179E3C40799D60478B2C0682ACEF97A9055C7FD3B308CBBCD334183B927E869C740B8F08F7A743F809EC0A
Malicious:	false
Reputation:	low
Preview:	{"chunks":["95f0c6f5"],"experimentTags":{},"featureNames":{},"seoExperimentTags":{},"copyTags":{"a11y_aria_label_carousel_next_previous":"Next","a11y_aria_label_carousel_previous":"Previous"}}

Chrome Cache Entry: 318

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (32818)
Category:	downloaded
Size (bytes):	106099
Entropy (8bit):	5.4767626733382615
Encrypted:	false
SSDEEP:	1536:2NOBKGmVypZw//a4dtB+7OIMvTVjGqfQFrr9OlV694QnFh/63BrwASzfyWY+:XAAmdt2V8Fqn9OjJQnFW9wWWt
MD5:	E0DBF38C0F64D4C896AC5C370BC39BA0
SHA1:	F111F4EED1604E99B6C96CE96FFD3E44075A8705
SHA-256:	7B48A773E39B6E3C487352E0D1788001867006269CE3CC123647D182B538B936
SHA-512:	C19ED7145F6C95590C8C2C664C02B0021E4064E929372519AABB975615F6B8DE637F246D5D8D29DE30C00D7687FC8B89E92C18A0F87154CCF7B6E16CEB766701
Malicious:	false
Reputation:	low
URL:	https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Preview:	<!DOCTYPE html>.<html>. <head>. <meta charset="UTF-8" />. <title>Topics Frame</title>. <meta. http-equiv="origin-trial". content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0=". />. <script>. ./.. Copyright 2022 Google LLC. SPDX-License-Identifier: Apache-2.0./.var m,aa,ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},da=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find

Chrome Cache Entry: 319

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	14458
Entropy (8bit):	7.986537563561675
Encrypted:	false
SSDEEP:	384:5xQN2esinfv6DhQ/AwJHriUB91kxVxv42:5KsI0SHeUBR2
MD5:	95225159656D97EDEDFC54BEF4F5834B
SHA1:	63581AA67741F2020DBB1E6425A7BD62B477185E
SHA-256:	7E23CEEC5951F6E086E5EB4EFDAF1D2E998533211A3C669218B418216EA2774C
SHA-512:	F56C776C73BB371823170F1D52736AC917774EC7CCA4C775F947E8629918FF3F925C2BE4BEB1630F5EDC4E5625E89A0438EAC78E4DD627866F20237294963111
Malicious:	false
Reputation:	low
Preview:	RIFFr8..WEBPVP8 f8..0........>m,.F&#...V.`..... -v..i..A..z...Q...._.}.....4.H.]...o.s.}..)........?.~....w..._..D>..v.o...#.o....#.U...}..3...'.W.?W...v...?.?.?.?....(...#.........~..i...u.......%N..5.J..l.a..P.i.s...:Q..Y..6.q2...T..S..o#.>$..0e.\|..H.......l..".r0lb..,K..L..@5.5...@..5.~.l..G.7?zU.k..]y.,}.{.\.v`y......1..H.7......`$X....1.-u.I ..w.c....?...;...&.../(6...a\...Gjt..3.....2.^I.JwV.}.#..E....]...3..A...T..rZl.B.k <.Y.........W.#....G...Xk$....1.`..A..")..p..pv..\....L.7..=8..8J...D..".s.`.,..;....s.A&TTe.G_.v.ldyo...^..S@..@.0........l.X. .....m...d.hG...1.^.iP\ks..6.j.G...,.o.U~...Eg..~...;3...0lm.\|..`..+......$.o......d....%AL.x}.a.....b!_...;3R.1.q9...o.\|.'..v.e..B....G..9[.WM.\....Rl...z.Bg..7.&Q.Z).P-B...]d....n[.c!?........./..6..>...db.......]1..vM!...-..(....x..n../..l2(..o..1.....U..1.Z.Xu3...u._...G&...5Hk...z({........Z...{..@L.....\|.>5..1.!..n.(..^..f.7..b......2..F."...3..jy.&.,v=....zz.@.j.[$i...B..4..k.

Chrome Cache Entry: 320

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	dropped
Size (bytes):	7785
Entropy (8bit):	7.942304441167468
Encrypted:	false
SSDEEP:	192:mIz7jES2NH/E23E829U9x75bFJps8PsneD:nzdeH/d3BuU93bjEn8
MD5:	1FC2AD40BF5E2BB9E9A6DA12354BDF0C
SHA1:	DF3D86284273E52AC3C9640BC8C2A77FDAF7BEC5
SHA-256:	941865794957E393E58139AFB653B9EC09B2BF10185FF8CB3EE234D7B8434071
SHA-512:	A035F962A3C799A8A06434F940813398BC279459653CA7A502DC9766D420CBB788DC011BBB35A7CE9B6ED641554A0CADEA72CAABCDFCE24E2A4E32F68881CA67
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..Mv.{.....@.J6.>...W.h....\|C&....,<c.C/.G....... .J.=)..w&.x..Y.....L....D...0Ns.<u....M..T.9..H3...v..x<s.....M..V.F..@b..@.u..9.$:c.......\.H....g$..~8h/..?U..;...H....3..f..k.-..&...~:..}q.U{.Z..MKY....J.n.\|.Kw...Y.1.f.y.e.D."..<.5.6..<!o.:..B.a.8..N....g.Mx...Q4?.,g..XC.n.s.r;g=...4....jO$S..:6@.c......U...[..X.K.=QrM+\...JF.p$.FH...U...E4.......FG$.

Chrome Cache Entry: 321

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (38877)
Category:	downloaded
Size (bytes):	39861
Entropy (8bit):	5.664470516753155
Encrypted:	false
SSDEEP:	768:jlb2MIS2ZK+lhMYZBIdlQXIlLRkTi/MgrCUCH/lKEir3xa8fmCsYBGIUY:jlb2MkZflqoQgIdRzZOH/lKzr3c8MdIx
MD5:	04507E2F0E16A07AAB798AD8865161D8
SHA1:	DE0638B5400E6434C2E2D519116C1C4FAC54FE96
SHA-256:	B3A2E8FB24AC4C5B337A2716B8B0AC9BD0481D80368AC25A4ABCAFA10BAD4ED6
SHA-512:	471B4DF4D8D4AFF53BEA0F0FD33176B2F3C1B3BCE0F472840E38FF3E76BCFAD4AF0CF7B346AE8FD9A7B70BD1B40C8790C2A5A3A0CA7E2640357087992BF36657
Malicious:	false
Reputation:	low
URL:	https://pagead2.googlesyndication.com/bg/s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY.js
Preview:	//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjogMywic291cmNlcyI6WyIiXSwic291cmNlc0NvbnRlbnQiOlsiICJdLCJuYW1lcyI6WyJjbG9zdXJlRHluYW1pY0J1dHRvbiJdLCJtYXBwaW5ncyI6IkFBQUE7QUFBQTtBQUFBO0FBQUE7QUFBQTtBQUFBO0FBQUEifQ==. (function(){function Q(b){return b}var D=function(b){return Q.call(this,b)},k=function(b,w,Y,y,H){if((H=(y=n.trustedTypes,Y),!y)\|\|!y.createPolicy)return H;try{H=y.createPolicy(w,{createHTML:D,createScript:D,createScriptURL:D})}catch(G){if(n.console)n.console[b](G.message)}return H},n=this\|\|self;(0,eval)(function(b,w){return(w=k("error","bg",null))&&1===b.eval(w.createScript("1"))?function(Y){return w.createScript(Y)}:function(Y){return""+Y}}(n)(Array(7824*Math.random()\|0).join("\n")+['//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjogMywic291cmNlcyI6WyIiXSwic291cmNlc0NvbnRlbnQiOlsiICJdLCJuYW1lcyI6WyJjbG9zdXJlRHluYW1pY0J1dHRvbiJdLCJtYXBwaW5ncyI6IkFBQUE7QUFBQTtBQUFBO0FBQUE7QUFBQTtBQUFBO0FBQUEifQ==',.'(function(){var

Chrome Cache Entry: 322

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 540x270, components 3
Category:	downloaded
Size (bytes):	31567
Entropy (8bit):	7.969919187110913
Encrypted:	false
SSDEEP:	768:i7dZuXlHWsVHQ00x3zIYEPVKHVeB7+Vz+yd9fSoM:i7LasOYx3OPVkZz+ctM
MD5:	5C1E97DC9685017D4A764D7B97EDB4E6
SHA1:	AB82DAAC1C7F3EB7C7F3BA364314CDD732B02F5A
SHA-256:	48334DEF61EDA06E5D5F67AF8FF89206583DC90FFA1E0CB5F599327CB0608C28
SHA-512:	E505A4AD31DD87292B1638661CBCA1EFE1CEF379457E44A7B1E8863D8856E048BCE16AC404A389653FB1AFB8D05A6BB8A4EDFEE1E6BEE5E1C62FAE2C7D9F317F
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/540x270/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..Kt......F.\|.W.QY....0.'..5r.Na&b.I...\sq........pH?3t<.u,h...R1...j..S.Fi....}x..(.2...Ca...9.gR.#<..y....^.r(..'J.............CZ.r.o.\|.V9a...p.hFB[.-.. .z.m..I#v.q...H..T0.$..R)..h.+......JN...$.5.......$`..[...z....[.[T...Q....?...W...0H.n.nOAV-...5....!Vo^.#..5..6..&......q....,*.$.t..8.>....h....J.c6v.Fx..N.4Fx.....<.GL....im0...I$D...7.........

Chrome Cache Entry: 323

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1197
Entropy (8bit):	5.250746419165476
Encrypted:	false
SSDEEP:	24:2dYwahJhWDCLf3fbeVZmFy6yCXCWX9JVLNpwtbMIhU7C06Fa5QcPm:cyJhbf3fbOKy6yCdtJWWFL6FSQ/
MD5:	E8209D74AD093F151954A3820C12E5D8
SHA1:	12FBF39039F0182026ABAF8B0A22E75C9BB316F7
SHA-256:	C80B9838465A2C5AA19E06C25631CD22D81DD8C76563875EBFB4D35304DFBA47
SHA-512:	4DC04BF54E06A26D78C6D71EAA392059B21EA8A01BF6C6B1EB808F9A01758C18DB18A28A9D74A841B3D5F2249787890944EC94EE0A6D4B2F99042138534800F2
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/img/favicon/9ca83ba2a5a3293ff07452cb24949a5843af4592.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>. Lovingly exported by Jess Stubenbord for Booking.com in Amsterdam 16-03-2023 -->.<svg version="1.1" id="bdot-favicon" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 192 192" style="enable-background:new 0 0 192 192;" xml:space="preserve">.<style type="text/css">...squircle{fill:#003B95;}...bdot{fill:#FFFFFF;}.</style>.<path class="squircle" d="M37.8,0h116.5C175.1,0,192,16.9,192,37.8v116.5c0,20.9-16.9,37.8-37.8,37.8H37.8C16.9,192,0,175.1,0,154.2V37.8..C0,16.9,16.9,0,37.8,0z"/>.<g id="bdot-group">..<path class="bdot" d="M144.2,143.8c6.7,0,12.1-5.5,12.1-12.2c0-6.7-5.4-12.2-12.1-12.2c-6.7,0-12.1,5.4-12.1,12.2...C132.1,138.3,137.6,143.8,144.2,143.8z"/>..<path class="bdot" d="M106.7,91.9l-3.1-1.7l2.7-2.3c3.2-2.7,8.4-8.8,8.4-19.3c0-16.1-12.5-26.5-31.8-26.5H60.9h-2.5...c-5.7,0.2-10.3,4.9-10.4,10.6V144h35.4c21.5,0,35.4-11.7,35.4-29.8C118.7,104.4,114.2,96.1,106.7,91.9z M67.6,66c0-4.7,2-7,6.4

Chrome Cache Entry: 324

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65449)
Category:	downloaded
Size (bytes):	991736
Entropy (8bit):	5.505564179456703
Encrypted:	false
SSDEEP:	12288:ka6IBtgXUAM8dmDHJ76lUkh5mPEQ6y4qHtaIiDQONV:k8BtP8dml6lUkh5mcdgHdiDQOf
MD5:	5A95CD0457FBCC68BDE1C995EF69D6DF
SHA1:	D2942BE4AEBBA6D9BFE0619272E3A8001A4C262A
SHA-256:	0A4470229742BD70226C0C92A4A09EE8376A600D409E47F9CF72F3F4ADF3E27F
SHA-512:	08322AC9F8D1340B46AE6521B472E7448BB51C439C930F743598C054B3C2B5CEB5990971A9965D15EBBA3A555993C87B0B07CFE4102DB82167C4BBA2E37DB3AD
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/flights/web/static/js/screens-Search.f7031ba1.chunk.js
Preview:	/! For license information please see screens-Search.f7031ba1.chunk.js.LICENSE.txt /.(self.__LOADABLE_LOADED_CHUNKS__=self.__LOADABLE_LOADED_CHUNKS__\|\|[]).push([[28343],{27479:(e,t,n)=>{"use strict";n.d(t,{Z:()=>a});var r=n(67294);const a=function(){return r.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 80 32"},r.createElement("g",{fill:"none"},r.createElement("rect",{width:80,height:32.049,fill:"#004cb8",rx:4}),r.createElement("path",{fill:"#fff",d:"m44.9668352 5.5533056c.216944 0 .339024.090062.3661543.269157l.0058137.082203v6.00384c0 .598784.15488 1.081728.468224 1.446784.311552.365184.752384.546944 1.318784.546944.8360411 0 1.5222034-.3462224 2.0583844-1.0386671l.1210716-.1659409v-6.79296c0-.204512.088396-.320138.2661313-.345849l.0816447-.005511h2.201984c.203392 0 .318388.090062.343959.269157l.005481.082203v9.97056c0 .204512-.089572.318864-.267687.3442565l-.081753.0054395h-1.787008c-.2109806 0-.3651605-.0750446-.4590737-.2251337l-.0419183-.0812983-.26176-.6

Chrome Cache Entry: 325

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 210x210, components 3
Category:	dropped
Size (bytes):	10198
Entropy (8bit):	7.945091237788509
Encrypted:	false
SSDEEP:	192:myPEYawsByNpqTbfZiJAgDH5O0xS3GSBZ3+92wXDsnWajlhJQM:dFNpqTNSw0xkZnWajfWM
MD5:	017B94110A7E501229461904DE5F60EF
SHA1:	9DD4E626007122C59267B53E2D497D24002A0165
SHA-256:	70F0B164136D459CF84DA543EF790A7D6BBC86E32348A84E8059F7BDA63C2C5E
SHA-512:	097478A690E33B49B2CE3AC3709275E2269549B28F11B5D9BECB6B875BE36C997F4F244A0B9EBC75DF124680CA3A0FA6CA692822B90213DE4B48CC24FE9D0E3E
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..GJP9...z..<.k-8.N.+..Zr.T.i.0x..6$SR...O.....,.=y..4...9.1.i.Zi.D.FN:Ss...EH..(...^.;.\..Z.R.b....)......A..xa...'.....@..OZ.s..-G...U..`=.\|...*A~..G..$...4..'...n..12 ...g..B....s.J........R]P./ .C..U....a.5.z...+_A.Rm.6.-U..Z.W<S.6v.jo.M.s....".Y.......$.........)@...Z...@..(_jpZW........J....<.4".G.......(._.w.O...K$.....I........C.+NP.Z~(.(..F.

Chrome Cache Entry: 326

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2942), with no line terminators
Category:	downloaded
Size (bytes):	2942
Entropy (8bit):	5.9079868527482065
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08FmTIdwitzYigErxpXJABm7:wsbSUtJfxrqLWWWdV6j1psI5Nx1kV2
MD5:	ADC169021ED60602E28257F3BBCDCD44
SHA1:	524B9B003CAB9239F8C5B806BDA8FD3735BD579F
SHA-256:	DFA904D2C93AEACE57BE5770D72728F02CB95A7C8002D2D888B0B34308EE5A4A
SHA-512:	D511549AEEEB0EBBBCD0A4A9A7615B43EEFFCCFF1E5BCDB6315115988B5AFA633134AFEB9982C4AB123B4BA83539552646C6706F4F17C160484106BE397E279E
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1060768846/?random=1707417356687&cv=11&fst=1707417356687&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nh4qqVoyv2KiIad5kPNddW86jrjYgKSk8&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=page_type%3Dhome%3Bcheckindate%3D-1%3Bcheckoutdate%3D-1%3Bhotelid%3D0%3Bbook_window%3D%3Bweekday%3D-1%3Bdest_cc%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bnights%3D-1%3Brooms%3D-1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Bguestcount%3D-1%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdest_ufi%3D-1%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 327

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	dropped
Size (bytes):	3298
Entropy (8bit):	7.865439132060064
Encrypted:	false
SSDEEP:	48:o9YMbuERAfDM8bKVNktGMO2A43e9aLt1KeCPfRoYKDE+yV1Ypi8uTlbj7a:ghCESiN482A4O9cCPnV1x9N2
MD5:	259093AEA2A1CF46F3A2F3FBBCD6F235
SHA1:	70758D01E4167D664FAEB187C57921C9F1805D37
SHA-256:	CB01FEE7A456FF4EEA3D00EB1E4A94D50B86732F44C598AC5266B41416036D7D
SHA-512:	68CB8566B26B4B7BD01CCDA814F04E0BE4F89CFB800275B1DA8171D5322EC5A2F9453BFE0B4635FAAD92D867DA43A8F768615D20B9EFD7F8204E6B431BD28460
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......d.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..b.h..._.C....."F..q.].Im..T.k.\c$\|r...;..Ie.-.>...O..^=...I.X`....$...1...%.;..z.?W.zlo.......Xo]...R.H.-laq..z..Y$........P..I.^...Y....&V<.^4.vmB..J.cs..YX.&....],0m.{8..cDU.....1..k.M............[.5.~..F7g5..j4...2(..(.p...r..1U`..'.=.5.V...L.~s"*.....Y.@.i..8...1~G.s9I7.v..R.z.s..;$.Q....i4H\|.z....~U.6..o.\.-.-q.j.R.0....p...ks.......m.,g"..

Chrome Cache Entry: 328

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	5.250746419165476
Encrypted:	false
SSDEEP:	24:2dYwahJhWDCLf3fbeVZmFy6yCXCWX9JVLNpwtbMIhU7C06Fa5QcPm:cyJhbf3fbOKy6yCdtJWWFL6FSQ/
MD5:	E8209D74AD093F151954A3820C12E5D8
SHA1:	12FBF39039F0182026ABAF8B0A22E75C9BB316F7
SHA-256:	C80B9838465A2C5AA19E06C25631CD22D81DD8C76563875EBFB4D35304DFBA47
SHA-512:	4DC04BF54E06A26D78C6D71EAA392059B21EA8A01BF6C6B1EB808F9A01758C18DB18A28A9D74A841B3D5F2249787890944EC94EE0A6D4B2F99042138534800F2
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>. Lovingly exported by Jess Stubenbord for Booking.com in Amsterdam 16-03-2023 -->.<svg version="1.1" id="bdot-favicon" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 192 192" style="enable-background:new 0 0 192 192;" xml:space="preserve">.<style type="text/css">...squircle{fill:#003B95;}...bdot{fill:#FFFFFF;}.</style>.<path class="squircle" d="M37.8,0h116.5C175.1,0,192,16.9,192,37.8v116.5c0,20.9-16.9,37.8-37.8,37.8H37.8C16.9,192,0,175.1,0,154.2V37.8..C0,16.9,16.9,0,37.8,0z"/>.<g id="bdot-group">..<path class="bdot" d="M144.2,143.8c6.7,0,12.1-5.5,12.1-12.2c0-6.7-5.4-12.2-12.1-12.2c-6.7,0-12.1,5.4-12.1,12.2...C132.1,138.3,137.6,143.8,144.2,143.8z"/>..<path class="bdot" d="M106.7,91.9l-3.1-1.7l2.7-2.3c3.2-2.7,8.4-8.8,8.4-19.3c0-16.1-12.5-26.5-31.8-26.5H60.9h-2.5...c-5.7,0.2-10.3,4.9-10.4,10.6V144h35.4c21.5,0,35.4-11.7,35.4-29.8C118.7,104.4,114.2,96.1,106.7,91.9z M67.6,66c0-4.7,2-7,6.4

Chrome Cache Entry: 329

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2557), with no line terminators
Category:	downloaded
Size (bytes):	2557
Entropy (8bit):	5.958003021382895
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt0811qLt4VHIh9FhtzYig396:wsbSUtJfxrqLWWWdV6j1PqLyHo9tr
MD5:	B1C699BD5D94D339B61348AD8CF90CEC
SHA1:	D39C6CF63DD4F30BB9AAA1DB69556DE0FE550352
SHA-256:	649BC6C20814345D09C6DAD94C52057FC26FC4D310439F4D237FF867720B722A
SHA-512:	694A8F855867B5A5728284E40AB612A756DF4A617B8931FC9940350442FE4EABF027EA14B58A51F2944D397AA9FD63027A1904805CA06078EEDD638982BFC0B9
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975716499/?random=1707417370676&cv=11&fst=1707417370676&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=BcW9COaWsFgQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 330

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	48905
Entropy (8bit):	5.566694545871129
Encrypted:	false
SSDEEP:	768:AK6hDVMaqSynB3WhXcZ3RucJlYRSGBuF3UMR01V8rb2OtKCB:AK6hDClaXcRRuSlYRX8gM7B
MD5:	E79F8A15DF4826ED8289AA85A222B872
SHA1:	F7E408AAB2FB8138AA9F9FC6C77F9FEC3BB4897F
SHA-256:	F85B5995D7C06BEB250835238610EA7A2FBD4771700970446CC5FDF73863D8A4
SHA-512:	F826AFCEEBC9E2281B66F462B69A374E9B03F4845B96182F9AA03266C24C624EC393FF02EF96B75182A534A4E8AF924F2D8FDC6AB2A17B855DDD267DCD796C2F
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/consent/a387750c-a080-4dd0-b2d1-7dbdb601bb14/9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf/en-us.json
Preview:	{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","pccloseButtonType":"Icon","MainText":"Manage your privacy settings","MainInfoText":"Select which cookies you want to accept on Booking.com.","AboutText":"You can find more detailed info on cookie use and descriptions in our privacy and cookie policy.","AboutCookiesText":"Your Privacy","ConfirmText":"Allow All","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","CookiesDescText":"Description","AboutLink":"https://www.booking.com/general.html?tmpl=docs/privacy-policy","ActiveText":"Active","AlwaysActiveText":"Always Active","AlwaysInactiveText":"Always Inactive","PCShowAlwaysActiveToggle":true,"AlertNoticeText":"By clicking \"Accept,\" you agree to the use of analytical cookies (used to gain insight on website usage and to improve our site and services) and tracking cookies (bot

Chrome Cache Entry: 331

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	18472
Entropy (8bit):	7.989626741679038
Encrypted:	false
SSDEEP:	384:p8zGQdlJLFjrxvA8brrunLbFKDubWzfNVtZ:adljjrxvpbfu3Fcu6TZZ
MD5:	B199F5D218F36B5D8F65166EEC33DE83
SHA1:	2A550F03A520EA539BBEC4953717293711E0C25D
SHA-256:	2451293A1A3364863E6D85B37E09911CBDD2A10B4AB8015DA1D726C16256ACC0
SHA-512:	901CB10AE7C25A9C8A6A4B99F987CBD3CBE529E16990F368A60AB91AAC96256782554BFCF9D8DB86857265713A7F1C28B3BCAD42A474C8165267E4F32BD52FF1
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/square250/976877.webp?k=2aab28217f0fb039e0f35ea2b2c3976141b5860b074f74220edf998115935cda&o=
Preview:	RIFF H..WEBPVP8 .H...........>i(.E.#"...`.....S......k...._........l..>..o?\...........d.y.y...._.s.?........./....K.o.ow~..c....l..\|!to......#.o.......o.7..........w.?m;.6o...~......?R_........._...}Z.{.A........?....K.......^.~............+.....`s..!.`\...F....P..$.dzk......#..0.5.Y{.mz.(...W..CtQO.f....D..S..@r?.......P}.....<..$........;..0.r.C8..C;....V..4Pu..../..d.?%..Yt.M.%.....\|..\s...Y-c.B.mZ.1.+-.U.gm...b........V...-.j...6B<.....`>@.!;.4.).hI..WI....=T..;;l...-.`r......M..5,...Ik...2.......'i...B.,...o...3.?/../.5.CQH.;.6.hy..G...J........Od.......=.W7.Gk...U...~.lX.Uh. .q)L...\..l ..B...............Cp...r....7X.P7.(.4a/...j.L8.......iYU.s......N...7..A....:.b...B.Q../G.....X./e.j..<...`a_.........+...J[.H;...\.~....._OG....y...}y1.4..sX.j..n.r.DU.(.r.x`34...K?....wA....f..l.....aHayBp......t.YDq..l......=3_...%...8.\|r...;..b`g....,.@.?.a..szY%}.y...a...p>./,.F&h$3....,....*.Uv..\.......B.cR.T.hP...J.(}...7...:@..K.+.s

Chrome Cache Entry: 332

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	downloaded
Size (bytes):	8350
Entropy (8bit):	7.9431995395937385
Encrypted:	false
SSDEEP:	192:mIoyumNqtrhRbdqcm5XtTGb9TohlBUUPRpv9+HSJh6:noybNcrhRbJWXtTGbWPBUUZp846
MD5:	DEECEBFD96AFF60E10FD5E8D298F2E6A
SHA1:	45029E4B67085DA726802561C0B595862620D62E
SHA-256:	2F448C79E56FDF2F2C5C1D9C7FCA9DAD527EEDE734BFB329ED1303D54D365A70
SHA-512:	76B3ABA23CA9623D3D52C24ACEEB99C3EC7C06BB7136A6C109CAB6758CDCCDDD2CBFA4EA8FF829376FA9966C9EB8EA03D82B1FA62EC9839C53E3DA10268068A8
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/xdata/images/city/170x136/976877.jpg?k=2aab28217f0fb039e0f35ea2b2c3976141b5860b074f74220edf998115935cda&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...i.kXl...Q.B.?........B.fxc'i.7a.J..y.{..K.......`.V .....j.......#x. ..=.....k.\.Y.r..6V......D..A.<...y..x.LM?Sx.:..s)S =.?w.s....Y-.+....>.8..C..Y.=....7FG .a.......q..W).$.......v1..t.}.v.%...]..\...c....Q.5..sqr.uX....k....:.=.4... ...I....V..3.....I....+/.?..J...).A.@......X..g1....3.Z6...8==G9...:....3.4I.,.s.......qNo.....$....*...A.sZ5N.M.W..

Chrome Cache Entry: 333

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1002), with no line terminators
Category:	downloaded
Size (bytes):	1002
Entropy (8bit):	5.701644045708987
Encrypted:	false
SSDEEP:	24:kHkw8tSyngFuVAOdIcCcEzrcEzn/PqjCC5zqinzYjnpRnLxR2+YI:YyLVkczEzAEzmYnbuO
MD5:	ECEE2E29DD00A24FB536CF681B6D2FE2
SHA1:	40BC0B3B8D7BC13A5A7186538737144E0B02AA5E
SHA-256:	A4BDCF773739389E5154C8E46A2EBEF93B1E618BE8E742CF6BB171B3AAE0E4BE
SHA-512:	A02B0637C37B484075F4D293BACF6620DA01C64D3C52F69B1CDCBE5FD8674A3E05E1255A1E691BB3687E27CE258FCEDE4F08EECF35928BFCF7E9108262FC61DA
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/1060768846?random=1707417356687&cv=11&fst=1707417356687&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nh4qqVoyv2KiIad5kPNddW86jrjYgKSk8&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=page_type%3Dhome%3Bcheckindate%3D-1%3Bcheckoutdate%3D-1%3Bhotelid%3D0%3Bbook_window%3D%3Bweekday%3D-1%3Bdest_cc%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bnights%3D-1%3Brooms%3D-1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Bguestcount%3D-1%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdest_ufi%3D-1%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN
Preview:	<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j9270294"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j9270534"}}]};</script><script>for(let i of ig_list.interestGroups){try{if(i.action==0){navigator.joinAdInterestGroup(i.interestGroupAttributes,i.expirationTimeInSeconds);}else if(i.action==1){navigator.leaveAdInterestGroup(i.interestGroupAttributes);}}catch(e){navigator.sendBeacon(`https://pagead2.googlesyndication.com/pagead/gen_204/?id=turtlex_join_ig&tx_jig=${encodeURIComponent(JSON.stringify(i))}&tx_jem=${e.message}&tx_jen=${e.name}`);}}</script></body></htm

Chrome Cache Entry: 334

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	dropped
Size (bytes):	12530
Entropy (8bit):	7.956127740598182
Encrypted:	false
SSDEEP:	192:mg4zMtkG+mTPAhXyth0npcOwORd5ORBEFxLPwPjAcCNH9Zx9VnwKOdeYiMsc:38MtCaIJ0mnpcOnT5hXSCNH9FqFdF
MD5:	0EC8A6ACAFD2FF94EAD2387AAC012C13
SHA1:	697CBD26BAA47A35A86EB6FEAB2A7D9A9720947F
SHA-256:	48F88E754655911D3A8885792052DA8DDDCCD607F64F7E030FFAD6FB2D283A37
SHA-512:	5757F69AFF1A3B4E41E8FCB262AFC384BACB11F82CAF13A3CF61D1EFD63B65FF3FA20AE5B522600F8F7CB0F259B032DE485E950423911FA21A6B4605A56515BC
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..0).P.8...p...F.F.Y8.p.zq.....bFe......r...o.t..a.....ha/u.f?.Fs...n.Mk.,HT#.+R+$.S#..0......^V..R....:.:."V.....}i.R..E8..H.+.,@).R.J.Z..%.. ..W=.Y... mf+..z.........'......$[k.(...{...b..p......&.Ci.m.0x....q.j..c^....?..wa....C....T..Ig..'F`.*.Z...Gsi.Ge.......j.p.Q.i2..\|+.1..d.0Gy{s.:."R#>..b.Y.m.$..E.'B6...}q....W.Il.p[......X..QW.N3..n...h.S..

Chrome Cache Entry: 335

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 122 x 28, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2956
Entropy (8bit):	7.91027874894693
Encrypted:	false
SSDEEP:	48:k6UvC3gU6BW9XtbeAajpxe6r2qP/LwEpOxH5d10W40pa57f6U5z8P2fTudIRGm5B:rUqX6BMVeAadHr2qP/LC5d1BNU7h5o2P
MD5:	29471623E72AF49F6C95BE101D45A942
SHA1:	97DC407B5CD9F96099B67358DD56DF767A9BB121
SHA-256:	6691E3CEF8F3CEFDB1E47EFC33C1D33CE2F712F53A79F221DAD805ACA7AD57C7
SHA-512:	64FC513FA78B984034EA55124195F51144855B489A6379B00555E1B582E0D39ACF788FC36D283DB278AB60CEC5ABEC46C59A3434AB666FE7DC7A55EB1B24B2D5
Malicious:	false
Reputation:	low
URL:	https://tpc.googlesyndication.com/simgad/4555548899643362285?
Preview:	.PNG........IHDR...z.................sRGB.........gAMA......a.....pHYs..........o.d...!tEXtCreation Time.2023:01:30 09:45:10F~......IDAThC..pT....9w7$.(.....M...ok.cl.c...ci.iG......vh.jy....Rh.R,.V...Z.U+v\|TFg... B.` .......=.........fN...{....<6.B...T.P....?.6.}..............s...]..F'.XF..tdk&.~......^.H2PMRhI.x/c....'......O.B.b.%.._..m...=JZ.=...l'z...L.mZ...z.Z...q.$I)....i.\|x..{3).$.LL.......)d5W.....oV%.y.~..=&..N{..R.3.(R..........Y!.S+.Uk!j,....?...o.6..6...e^...4.a....7,.<I.Ea.@..]#..-.z....jI;_OV....8{.u=.ev....;..{...':.F.....{.I&...w..y..4^.x..h.R.1..1k...R?.......q..>.t.l;......#3J.......[.eG......J......;m..S.6...!......Rv.k....&...n_...cD!4].A...^...\`...z...Z~.....$]v.+0..bn.d..b..........k....p..K.Fg....xuJ_.23H...W...#.r...]w.rv.;5...x..0.b0.../.q.ld..c'....J...;....)........5F]...?t...^'....@3......'......x.3.Ff.olU....vTj'.:2Y%..%......J....'1/...M.y/s..Z.{....r......H.qZ...... {....F3..-.R.2. _?fL/:..!.

Chrome Cache Entry: 336

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	68
Entropy (8bit):	3.9878907834096475
Encrypted:	false
SSDEEP:	3:YGKeMfQ2pHWiR8HH4yOE9HEEpGlyRHfHyY:YGKed2pHDIiEltDyY
MD5:	A1CB0B2D60ABD78CD4AFD51130704B14
SHA1:	73A4754A1DC9F006CABEFAE9E0713BD6A7EA4C32
SHA-256:	7137416AE47607DA7C495B7636C7B8C58C9DC2C393B936B394AE13BABB25E175
SHA-512:	A3AEBCCEF719900B9D6445F6DD91307B8426517D2A3F24A1778F9F621401829FAAE280BEA6E597DF99E6805E2E0A4C5E9303E20E37E6422B4CFA784DFCB7C97A
Malicious:	false
Reputation:	low
URL:	https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Preview:	{"country":"US","state":"GA","stateName":"Georgia","continent":"NA"}

Chrome Cache Entry: 337

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (57572)
Category:	downloaded
Size (bytes):	584201
Entropy (8bit):	5.383638505587535
Encrypted:	false
SSDEEP:	6144:MEcYROiZTiIDs/FTdur2a2b242OwiNXpLquWTRD6QzxVLr8moxQwSoVQN2p7wtiO:MXYMUVDobhSD1l9zr8np7m
MD5:	4576E695610B47BCF694D6A3A06C43E1
SHA1:	ED2064787AC0E485B873362EB5C8CE51F08F16E9
SHA-256:	428E94A2C50BE5FA444B539B887A38A38C4EF06C927B86BBE580014DFB7306AA
SHA-512:	8E95AE6E481545C77F246E929C109D0C8FC06BB60D6C1626DA682433C3877D554B40A1AC93CD79BF759227C2CE01F5579E83CE56959757E1BF6A690DCED50BF5
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/main_cloudfront_sd/22b1462412c8a51090dedf2fbe6ad45b3d8e8cf4.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};function calcage(e,t,i){return _i_("3da:f8784014"),s=(Math.floor(e/t)%i).toString(),LeadingZero&&s.length<2&&(s="0"+s),_r_("<b>"+s+"</b>")}function CountBack(e){if(_i_("3da:732c2356"),e<0){if(document.getElementById("cntdwn"))return document.getElementById("cntdwn").innerHTML=FinishMessage,_r_()}else 86400<e?(DisplayStr_days=DisplayFormat_days.replace(/%%D%%/g,calcage(e,86400,1e5)),document.getElementById("flash_days").innerHTML=DisplayStr_days):document.getElementById("flash_days_wrapper").style.display="none";DisplayStr_hours=DisplayFormat_hours.replace(/%%H%%/g,calcage(e,3600,24)),DisplayStr_minutes=DisplayFormat_minutes.replace(/%%M%%/g,calcage(e,60,60)),DisplayStr_seconds=DisplayFormat_seconds.replace(/%%S%%/g,calcage(e,1,60)),document.getElementById("flash_hours").innerHTML=DisplayStr_hours,document.getElementById("flash_minutes").innerHTML=DisplayStr_minutes,document.getElementById("flash_seconds").innerHTML=Disp

Chrome Cache Entry: 338

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21778), with no line terminators
Category:	downloaded
Size (bytes):	21778
Entropy (8bit):	4.769188103585108
Encrypted:	false
SSDEEP:	384:+Z8C4hGoFjlCS7FGAVsq1nwGfg4xqsQMPNE:JmJ
MD5:	73BC4067D312180A1B19A4D883F42D6A
SHA1:	AD328A9A572FBEA43F295E7769835FF08F6FF1FD
SHA-256:	D3F7B0EC4DE079928A999641E781E80F33597A392A561BC460276DFB4EFB6EEC
SHA-512:	20B89462521684C258A8CE15E94DA67182C66397B0DE528357E01294FF06883C1AD96037A9D739E4575DB8722B1A1967578709A0C844CD45A49E6A51E1B6479D
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/scripttemplates/202310.2.0/assets/otCommonStyles.css
Preview:	#onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .onetrust-vendors-list-handler:hover{color:#1f96db}#onetrust-banner-sdk:focus{outline:2px solid #000;outline-offset:-2px}#onetrust-banner-sdk a:focus{outline:2px solid #000}#onetrust-banner-sdk #onetrust-accept-btn-handler,#onetrust-banner-sdk #onetrust-reject-all-handler,#onetrust-banner-sdk #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk.ot-bnr-w-logo .ot-bnr-logo{height:64px;width:64px}#onetrust-banner-sdk .ot-tcf2-vendor-count.ot-text-bold{font-weight:bold}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-icon,#ot-sync-ntfy .ot-close-icon{background-size:contain;background-repeat:no-repeat;background-position:center;height:12px;width:12px}#onetrust-banner-sdk .powered-by-logo,#onetrust-banner-sdk .ot-pc-fo

Chrome Cache Entry: 339

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13479), with no line terminators
Category:	downloaded
Size (bytes):	13479
Entropy (8bit):	5.449380986698998
Encrypted:	false
SSDEEP:	192:9HJ9jqfalLZJOx0/c7Gw7mziempFqSwCOLPoI3izRK8qCLth9SW0KAFrrHAozr+1:BjK63/CmKdVLV0KAFvHbYhwjDTOGs
MD5:	88389331FBABFE4A679DCBFC3E2CC56D
SHA1:	571D7F62AD0B7099A55AFE3DBFED13C5B02374F8
SHA-256:	F75B16CED45ABF30577DBBBC39DE46C69526A9F82044A6001B1DAA9517A41674
SHA-512:	72C17FF512013C434DCC9A87B28CB0A2FB33C263DEDFCAD6B628E12ECDCDB4405AF0B939AD78FF2A49A61F01449D402AD5A8E3F2BC52F71F76C02B2DE77DDE0F
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/accountsportal/assets/48_a501036cafaf1b1b6586.js
Preview:	"use strict";(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[48],{61786:function(t,n,e){var r,o,i,s,u,a,f,c,l;function p(t){return p="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(t){return typeof t}:function(t){return t&&"function"==typeof Symbol&&t.constructor===Symbol&&t!==Symbol.prototype?"symbol":typeof t},p(t)}e(6059),e(50110),e(11246),e(51876),e(96253),e(46331),e(66108),e(59357),function(t,n){if(!n.jstmpl){var e,r,o,i,s,u,a,f,c,l,p,h,g,_,v,m,d,y,b,T,E,S,w,A,L,M,j=[];i=function(t,n){this.closure=t,this.name=n},s=function(t){var n=[];return c(n,t,0),1===n.length?n[0]:n.join("")},a=function(t,n,e){return/^[0-9]+$/.test(t)?t:""===t?null:(M("Attempting to use non-numeric value '"+t+"' for translation tag '"+e+"'"),0)},M=function(r,o){r=r\|\|"BHCJS runtime issue",n&&n.env&&n.env.b_dev_server?(o&&console.warn("Template: "+o),console.error(r)):e.error_out&&t.onerror&&t.onerror("JSTMPL:: "+

Chrome Cache Entry: 340

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	39328
Entropy (8bit):	7.91647038087011
Encrypted:	false
SSDEEP:	768:sTr4PLxNiNEPGcuQ/a6fnySk3mlP+QbesnAnQ8Bno8ZKSUTWeO6d5ptuFO:sgPi6PGcuQ/aenypup7AnXnoCKFTW7q3
MD5:	417CE707E1BFD94EF710E908C06D973E
SHA1:	A2B3D1C72C9CC57F52DFBCC528649E73D43C5C2F
SHA-256:	1022F1662F9F02AC55DC95402144F2AE71D6F0A14C19B3E3041B68B529946CFC
SHA-512:	CF11FA71A5146A66B36D0CD33DC0805FF8B9DF3A6A8366F6D30EBF071E355E0CF5936B0E0A4D1085F392F17F0D01EB418F0D2E24C6315D198C5E346EAC3F4125
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR....................IDATx...X.V.g..t.l6u.M..l.f.{.n..q.)N..8v.n.{...1..cc.j0...7......6}....3...\|..G...J3..;..+.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.tz........C....E.X..b.v..]A.....;)Aw=.....m.....u...........Q\...P.N..B.W..b....f...X].:o.ejE.j1o..

Chrome Cache Entry: 341

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 120 x 120, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	3759
Entropy (8bit):	7.92345914707464
Encrypted:	false
SSDEEP:	96:Z3jbH7dSZvr9rbAd2c0dJ63XMvypW4Fpby7kXAZvgtX8DrJNa:Z3jLxSlBw2eIsW4Fpby7RZvK8n7a
MD5:	4F8BE30173D60369E61612204C1A9013
SHA1:	D66791AC7F8F1AAD4146D80F555A67571FD5BACC
SHA-256:	47B58F0909CAE06BC80A8D79E50758D188832800D541C7285A8BD72F3B23A0C2
SHA-512:	C8AAB2B2DB4EE533DAAA78A3C4FEFE8EFDE7CCCC4C9851AEEDB7F912467D18A1BA1739634FA1A460F81E36696FDBBC3E89D6372199CCC274D61232396A48F27B
Malicious:	false
Reputation:	low
URL:	https://t-cf.bstatic.com/design-assets/assets/v3.99.1/illustrations-traveller/TicketsUsp.png
Preview:	.PNG........IHDR...x...x.............PLTELiq..V....n.....\|....................C..D..........F..B..A.......F..............[r...............................G..H.............................A..7.....,......s..z ...l....i.......X..E.p..........G...x......L..j}.......\...vF......tRNS...-......I...m.{mB..=...V../......pHYs................8IDATx..Yy_......$.c.,3/U.MUA-.`7 ...K.'....j\1!.{.xDEh....{..J...x.#..G._...;_uk}T.......xS_....j.....y.....-.....b.o+..-Y..KH`..[k....b..o....N..o.A@.%_g.V.J+......O.!..jX..?....E:x...B./Fi....3A@..o.".Zy....X.....;,..o.,.Z.....Eq.$..U. A@._.5.....w.....k,........K.7.X.\|2.b..J+....1J...z...WlI....a....~.....u....[......W.I..`(%lW.k...&....{.t..]bi...p~r?..=.x.XZ...b.......y.bixIl.O...a.H)%../.W....Z..D.%...k...a.K.......H ..a.r...Zo&.......:....-Bs.A@..r\.....s...SLlw>?.+4.U.G..+^5.,....om.>.i.a.8.9.....h.AnU..'.w{f@."%.r%qu{...FQ..Q...W...lw~2.zA...P_..Kn.8f.x...~..6.(J..6q.9...O...n.l...p..wo.[.HI.Y

Chrome Cache Entry: 342

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 120 x 120, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	4038
Entropy (8bit):	7.894945624652839
Encrypted:	false
SSDEEP:	96:csld02SpHP9+D4+PFzs5Cb5XZHutFy7eHcY3Xso9uA:csHXSH70sIr2H3t
MD5:	DCA7C9B271C8B4799CE94491FA1B9EF2
SHA1:	8813DDE85839ADF022DEC0149893A96C0024B8B8
SHA-256:	54370E8F589FEF00FBDC853C168F40C1955C478A26C2F464F76F927951F9FFB4
SHA-512:	24322D7027B510E9310AF3C04EAC2105053357F3993EF9C180018A28769A5CBB3D47C4D02DE3AF9AFA159AEE93E2F4F083623AE086F5AD3822B02BF0A6ADAD57
Malicious:	false
Reputation:	low
URL:	https://t-cf.bstatic.com/design-assets/assets/v3.99.1/illustrations-traveller/MoneyUsp.png
Preview:	.PNG........IHDR...x...x............qPLTELiq..1...............\|......5........o...............................\..............................E....s..........u.}.............,............s..s........#.....`5...........t.....[..p../...................................................................s..}..........................w.......................~.............9...E...k..H.....[.....%....<f...DtRNS...........Z...C....... ..3..+J..q..`a.=.......n......\|......L.....}....pHYs.................IDATx...S.H....1.p.....'..Nv...[....C}..).ll....~.%C..ILR0.?....J......o..i.:.Nu.S..T...T.@.!O.._.8T;x=66.\j.q....6.<7.........RZ[.....r.$..s...}5.'......j...JH..lN(....OL4..!....Ip.............ww..._..,.?w.....[.._.z..E...l.nM..zr..mjM.w.W.?........W7.......9^9.o.z.........vC[.~f.B....w.....[.....k....W....O6'....5^.+...W_1..\|f.....k..3..U...I=...g.ah....I".D..............g.(s)..yv....n@.I.)e....){...+w.....3L......M.4.. B....8vb....c.`i...\|

Chrome Cache Entry: 343

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65455)
Category:	downloaded
Size (bytes):	275544
Entropy (8bit):	5.5031860641577
Encrypted:	false
SSDEEP:	3072:e19641W1QVYVJKQDJlB1yI9IraFpzWuzCE:eD1WFd1y/raPz/z5
MD5:	19AC003FF6AD2A469A19CB86C18EDBF4
SHA1:	4005F79F1ECA835595F1B461BC1EC76EF90647F8
SHA-256:	18B3EECC4697EB0462395620DF037B5B79439DFA06C29A362F67CE5492243F26
SHA-512:	B361AA2DD81F7FACD67C217E200728B674EE6DFFCFD4AF30BE03B88132F38B8E4F42BAF6CDED08FD172B6D2E3249FACDCC7A75C2FAF34F016DFB6AFD7174F440
Malicious:	false
Reputation:	low
URL:	https://q-cf.bstatic.com/psb/capla/static/js/4bac1f1e.ebb2755f.chunk.js
Preview:	/! For license information please see 4bac1f1e.ebb2755f.chunk.js.LICENSE.txt /.(self["b-web-shell-components__LOADABLE_LOADED_CHUNKS__"]=self["b-web-shell-components__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["4bac1f1e"],{d0989236:function(e,n,i){"use strict";i.d(n,{B:function(){return a}});var t=i("dc6d28ff");function a(){const e=(0,t.getRequestContext)();return{get acceptHeader(){return e.getAcceptHeader()},get actionName(){return e.getActionName()},get affiliate(){return e.getAffiliate()},get basePageUrl(){return e.getBasePageUrl()},get body(){return e.getBody()},get bPlatformEnvironment(){return e.getBPlatformEnvironment()},get CDNOrigin(){return e.getCDNOrigin()},get CSPNonce(){return e.getCSPNonce()},get CSRFToken(){return e.getCSRFToken()},get currency(){return e.getCurrency()},get encryptedCommonOauthState(){return e.getEncryptedCommonOauthState()},get ETSerializedState(){return e.getETSerializedState()},get isInternalIp(){return e.isInternalIp()},get isInternalUser(){return e.i

Chrome Cache Entry: 344

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	dropped
Size (bytes):	4271
Entropy (8bit):	7.908706925675349
Encrypted:	false
SSDEEP:	96:ghCEXly/PaXN3Zi9UFANanzP0k83mH93KJ91C2X6m0K:mCo2OZi93NgAud3OvC2X6mF
MD5:	623A7C12FAEF5B1649C9B6F551F140AD
SHA1:	51EDB83AA64DEDA1BF7C1145A31D8512DBC6D7FF
SHA-256:	C7EC25BAADF84673B55AC3EB47C2643C8B855B2DCD29D11A7757DE89307C64DF
SHA-512:	35624B9B2C897906C360F9B7857FEDEB41C48D16F50DA99329DFE4A0AE7407659A49BA154B8007BAC29A8FAA27862605A6A2ABF19FA8DAF6D43A0AB1043FFD98
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......d.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..V.M..m.'.5...d`W..C.j.O.`=h...9.w........Y.n.....z}k.F!A4....ap.m9-.^.~..NN8.t......M..E.B..8.:..Ud..\|.,.....~q..f.m...$....r..+Mu].......E]...../.9.^....si.iq.M....?*......(Z\|....,.>..n..T..R.}=kKE...y^S....m9...]f......mf...D%.x-.J......M2.T.\(U...u....bkM..q.O{........>.H..4h..60...Q\.Bd...dQ....OZ...}f.Y..6.O..'.....}k....\|.E.+e.,....8.......\..I\|....e

Chrome Cache Entry: 345

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1440x962, components 3
Category:	dropped
Size (bytes):	48905
Entropy (8bit):	7.943893596108332
Encrypted:	false
SSDEEP:	768:qEx3vwwzIeHH+32Rbs4hqVLbA/WroLKFgfKZUv8NsngAtf1FtV34zOL:qEx/fN3bHhqVQ/CR80A8Nsn1FXEOL
MD5:	5AD77D9314658FE91508D9B0129F5864
SHA1:	4EB74B7ED31B647FFF7FFF3B1AC8C79D536BBAEF
SHA-256:	351E52D0D5C74FCDDE61FBDFEC48277EBA66C403CBF8716B57CB18E84E9C2F8F
SHA-512:	91184630A69BDCFA30736B85044F73B4AF0FECB5DCCAFABF59A4DE05E502F4C7C742A5D16FFE72C2746B38EE788F46C72EAD18BAEB29D6D89A5AB5C054411696
Malicious:	false
Reputation:	low
Preview:	......JFIF...........................................+......+&.%#%.&D5//5DNB>BN_UU_wqw................................+......+&.%#%.&D5//5DNB>BN_UU_wqw..............".................................................T..C....1.r.l.K....i...Vj....S..n~.\|1KN..Mt..c.O..G..-7F...s3.). ....! I%$..&T..TL..Q131...^.%V.y..O[..2.V6.....9.ia}..ak..1.:z:k.}..9a.gMB..yI......H...$.T.).2.....ff&fc..m.S...7!..+..6.x.'{g.fU7ze...a....4.:E......w.w..o]..H@...B..!!.H..RJI.Q$.3.(.3...].....`S.....!_gV....5.q.4..]]....vOy...;u.C....@.}v.i.......$.A."RD.RJ.S2.JS12.&f3..uV...UUQ...,.{t...\|.W............N...^..1..xsg..W^.o..;;.Y...tJB.B. B.........)JJf&TB.....T...U_.j..y..F..,..sg&.}..e.G]k..f..;{..77.R.]..._....L'...2.H ..H.$.....e).....L.......uUUUT...9:..>^-6...,'^.S...y............e.y.m.N,/..K...{...mR'(.P..@.H..H$$..2.L..Q3eL.......t.....F1yO.&.z......c.].u.._).....>.../K.j..xg[u....u[s1...d......!.$"D.I$.).eBJR.Q.1...Un.....B..lxr.6...#~.ug_...5..U

Chrome Cache Entry: 346

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.321854365656768
Encrypted:	false
SSDEEP:	3:YGKSHvANxm0KBRqSABHY:YGKgOxm0HxY
MD5:	06FCFF9AD2CFBF648406A13875BD7E38
SHA1:	1C3620D1038C1578A3B5E21E80C0523123E1E304
SHA-256:	9A970E1A236FE3E8F4A13AC7FF4E00C30809380E97B856FF6575BC2A38BBBDD6
SHA-512:	DC781A227E30ED8C62D42029B2E81100CFF50D1991FF577A2F17C1039533E7A84596121A43E627D821D9F4804A6E88A9EBE8635C558E01F72595BB4A59DA75C1
Malicious:	false
Reputation:	low
Preview:	{"code":400,"message":"HTTP method not allowed"}

Chrome Cache Entry: 347

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	137014
Entropy (8bit):	5.0372726251075175
Encrypted:	false
SSDEEP:	1536:58peWHUB8wKAda616C+kJFPIHX5a0f8l9sdFcg18PLE:6AsSFPIHXtf8l9sdFcg+o
MD5:	AB26A43AF3574BFCB710E10B0C437DAB
SHA1:	2CA82068584D83DB545D665F3A5D8D46B6365B83
SHA-256:	7F70A77C7864D74B2DC38251713740BA211156734BE1742FF0F28CFA1B02F917
SHA-512:	72025CFC0AC11843D02C46912A2B230B6437403D6C95D0288BB35C3B2CF7FD695029ED7ED6E7A43153D890A81865754576A6DBF52B4222BC53DB9A0E9343E4F4
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/css/main_exps_cloudfront_sd.iq_ltr/586b07455f7783cafa801bdea38881f1f98ad36d.css
Preview:	.bbtool-notification{clear:both;position:relative;background-color:#e6e6e6;border-bottom:1px solid #fafcff}.bbtool-notification--top-menu{background-color:var(--bui_color_white);border-bottom:1px solid #ebf3ff;-webkit-box-shadow:0 1px 2px rgba(0,0,0,0.1);box-shadow:0 1px 2px rgba(0,0,0,0.1);font-size:14px;position:relative;z-index:2}.ultra-focus-body .bbtool-notification--top-menu{z-index:auto}.bbtool-notification--outside-tool{background-color:#f5f5f5}body.bb-sr-mo-own .bbtool-notification--top-menu{background-color:#e6e6e6}.company .bbtool-notification--top-menu{background-color:var(--bui_color_white)}.bbtool-notification--index{margin-bottom:10px}.bbtool-notification,.bbtool-notification a:link,.bbtool-notification a:visited{font-weight:normal}.bbtool-notification--outside-tool a.bbtool-top-menu-link:hover,.a11y .bbtool-notification--outside-tool a.bbtool-top-menu-link:hover{color:#333;background-color:#e6e6e6}.bbtool-notification__wrapper{max-width:1110px;margin:0 auto}.bbtool-noti

Chrome Cache Entry: 348

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 91 x 26, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1628
Entropy (8bit):	7.784928057284059
Encrypted:	false
SSDEEP:	24:DXGHdcP4D/gO2WdAnzMWSYfJhvbsUT/HZwDN9cbMkfYKjOmJeMs1R2t7UB3:DWHuP4XxIHQgHjbMkwsOTME2GR
MD5:	3E32EFD25AC0214B375FC8A6A32890F2
SHA1:	CD46A79DB7E53E19D5869B3CB3E7AA22EE523479
SHA-256:	807C8A1B498E17D227CF48A640B778BDC4398A9852493CB2F40BF0F33651D0DD
SHA-512:	E0F6807657EE1667876D66DCC13CD279C973EAE35E53509E86EC31951B8B07EBBCB0A1B3FC9BBDBC423F436C1F82BDC5C0440F875092E82A47CF51286CDE0C00
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...[..........2 P....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......IDATh...}l_e...O;......L..S'.G/n..22.bd..s..(d.x...(J.....!....E...%,..2..uceD\|...c.....u.._{[[\Lm3.7.....>/..<...>\|.8F..c...'..=..'{.1N.(.E./.\|......U..#:[./.Y.CY...~.6.X..,..k.F..X...H<...[d....oZ...a.o.T....59#.VL...l,G/.E..y[......59#.c.O..&l.............~\= .dy....2...e.c..d....j<....Y>....wc.f.....3i.3...")..&....b..i..'J!....\.....U....K.0.m.k;.>.o.....1.?i.k...g`.tK...-...U3?64.?...W..d.tl.@~.n.Q.....g...s...........A.V..k.y..>...........,f..e....0.y.... .O.=N..w.t...[p. {.:......N).......VI.Y.uV.....b.,...6=..~...qx.o..j.Cw.vj....D6Sp'.'y.......O..Ml..h_..../.\|...........g.'c....Yq.....O..{../...x.y........o:.WK.....}.,?....,V(..R"......57.,........].. ....<7V....x4t.....a....s1.xo....Q.}.Q.]../.......z..F.v1f......5..qyE.....h.W%{....,..K..[8...\|gE..W.\|w.6....U.g..8..n..q}E.W....S.bo..#y.PxCE......F...J1x

Chrome Cache Entry: 349

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	downloaded
Size (bytes):	3298
Entropy (8bit):	7.865439132060064
Encrypted:	false
SSDEEP:	48:o9YMbuERAfDM8bKVNktGMO2A43e9aLt1KeCPfRoYKDE+yV1Ypi8uTlbj7a:ghCESiN482A4O9cCPnV1x9N2
MD5:	259093AEA2A1CF46F3A2F3FBBCD6F235
SHA1:	70758D01E4167D664FAEB187C57921C9F1805D37
SHA-256:	CB01FEE7A456FF4EEA3D00EB1E4A94D50B86732F44C598AC5266B41416036D7D
SHA-512:	68CB8566B26B4B7BD01CCDA814F04E0BE4F89CFB800275B1DA8171D5322EC5A2F9453BFE0B4635FAAD92D867DA43A8F768615D20B9EFD7F8204E6B431BD28460
Malicious:	false
Reputation:	low
URL:	https://q-cf.bstatic.com/xdata/images/city/square100/690408.jpg?k=f59731e733077b90bc716596e05cfd0f85a2582341cc25c17b26ee2a755d7b55&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......d.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..b.h..._.C....."F..q.].Im..T.k.\c$\|r...;..Ie.-.>...O..^=...I.X`....$...1...%.;..z.?W.zlo.......Xo]...R.H.-laq..z..Y$........P..I.^...Y....&V<.^4.vmB..J.cs..YX.&....],0m.{8..cDU.....1..k.M............[.5.~..F7g5..j4...2(..(.p...r..1U`..'.=.5.V...L.~s"*.....Y.@.i..8...1~G.s9I7.v..R.z.s..;$.Q....i4H\|.z....~U.6..o.\.-.-q.j.R.0....p...ks.......m.,g"..

Chrome Cache Entry: 350

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	https://www.booking.com/js_errors?pid=d16682db432d0172&url=https%3A%2F%2Fwww.booking.com%2Fpackages.html&m=UmFuZG9tSVYkc2RlIyh9YdIXFZ7Nf82NAkuhhudQTioSutRpQn8uBcWgwMM-j5Sbuz9nv2vWLHLE4dV_SJngbBBk6UTeFiFgOcPnz7Gzoo2KA6TL2_i5J5f0Z_mULkN4439jWeHNCGdOf8Dnfr2mwd5U84qKx9veEXwn0ypiUZ29ohxd9ldgdVHyLvDvyEXRk_w3FXR-xkqyOsPLC6jUYYiSuqTleRS_1fViiRhT_YdQ6RNP48Cqy_dE7Kp_jNXyxS8D15Ld5uk&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=packages_city&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2Fpackages.html&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSObZWJFfVDSMePCFYZWFXO&cors=1
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 351

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.314128390879881
Encrypted:	false
SSDEEP:	3:2erWeKBRk35KLWAzRERxzfRX/H4Y3:29M3tRdfZN
MD5:	83A02FE42F8C2198E7C608AFF363AA49
SHA1:	7B20AE1014450492CC708E3C9DC7522B05C2EFFD
SHA-256:	E64954DC34E12C7190CC2338A54B07644FF0F102AA71CC7209BCBB49C3009F7C
SHA-512:	CD381A8C725C892E9A68D713254A31EA9ED25A39B212A5DC52D4BA2655F38AFDDB32519F03360F32A59D8E7701AF6C2AD0030A6AA760C3DE87C75063F5B65F54
Malicious:	false
Reputation:	low
Preview:	event: message.data: {"response":{"status_code":200,"body":""}}..

Chrome Cache Entry: 352

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	1614
Entropy (8bit):	4.762820188376248
Encrypted:	false
SSDEEP:	24:hYNspeCCZkpJ4MEz7agcn0LXTF2F76nQtSn8nwz8Xx:vpdBY7agCwTF2F7hx
MD5:	D89B01D392C1A60B64C1EB55CCCD1D9D
SHA1:	35607031083971A862472A2BB37FFB8BF0CDCD2D
SHA-256:	4D8CEAC04A145BE6F8968D458D8226320737D72F6ADA06990BD842C28F8951B6
SHA-512:	E2A195E382E79D1E3EEC8C5E0E6991405B1BE9BAC58909427F0DD7976E819771ED71AFCC5FB7C946D3E7206142DA1505D80580AF4293C1CAB0FABF5C949BF759
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<html lang="en">.<head>.<title>405 - Method Not Allowed</title>.<meta http-equiv="content-type" content="text/html; charset=utf-8" />.<meta name="viewport" content="width=device-width, initial-scale=1.0">.<meta http-equiv="X-UA-Compatible" content="ie=edge">.<link rel="stylesheet" href="https://q.bstatic.com/libs/bui/7.3.1/bui.min.css">.<link rel="stylesheet" href="https://q.bstatic.com/libs/calango/0.500/bui.css">.</head>.<body class="c-body">.<header id="c-header" class="header">.<div class="c-header__main">. <div class="bui-container bui-container--center">. <div class="bui-grid c-header--top">. <div class="bui-grid__column-3">. <a class="c-logo__wrap" href="/">. <span class="c-logo__type">. Bookings_Web_Accounts_Portal. </span>. </a>. </div>. </div>. </div>.</div>.</header>.<div class="bui-container bui-container--center c-main-body c-

Chrome Cache Entry: 353

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (45964)
Category:	downloaded
Size (bytes):	209722
Entropy (8bit):	5.181761655004813
Encrypted:	false
SSDEEP:	1536:uGH4e5slavvaydTC7XVccFLj5cCKjMC26:uGqlavvaydTC7XVccFLj5chjMS
MD5:	31D1EE8456BF79D48641456F821BB46B
SHA1:	C6F68F1B6B6FFF6CE8D79F286A080A9E85ACB64B
SHA-256:	6384CB062D4BDB2B113ADDDDDF7D4D64A819E5AE02F6E714CA9B86D4C9F80677
SHA-512:	FC0BB7292AD27206F201C32FB71BD02C85F80EF365835EF186FB498A05F458E58518BCB4E7F3F1E6110A93D2CCC67C44DFBD91F48AC779D6DDC156662FF317DA
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/client.d65aeb7e.css
Preview:	.db150fece4,.db150fece4>*{box-sizing:border-box;clear:both}.b232a3502b{width:calc(8.33333% - var(--bui_stack_gap))}.b1e9f8a61d{width:calc(16.66667% - var(--bui_stack_gap))}.c44c37515e{width:calc(25% - var(--bui_stack_gap))}.a7cf1a6b1d{width:calc(33.33333% - var(--bui_stack_gap))}.b8d011b59c{width:calc(41.66667% - var(--bui_stack_gap))}.b268b61489,.df1befa4db{width:calc(50% - var(--bui_stack_gap))}.e7f103ee9e{width:calc(58.33333% - var(--bui_stack_gap))}.e0ad3ea0c7{width:calc(66.66667% - var(--bui_stack_gap))}.d6cb5ce5de{width:calc(75% - var(--bui_stack_gap))}.d4e36dbd77{width:calc(83.33333% - var(--bui_stack_gap))}.bb4ce0a491{width:calc(91.66667% - var(--bui_stack_gap))}.b448d446fd,.b736e9e3f4{width:calc(100% - var(--bui_stack_gap))}@media (min-width:576px){.f5604e25b8{width:calc(8.33333% - var(--bui_stack_gap))}.b22a36df4a{width:calc(16.66667% - var(--bui_stack_gap))}.f09a70f559{width:calc(25% - var(--bui_stack_gap))}.c67cf8c745{width:calc(33.33333% - var(--bui_stack_gap))}.f10bbcad92

Chrome Cache Entry: 354

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1324), with no line terminators
Category:	downloaded
Size (bytes):	1324
Entropy (8bit):	5.829302579712547
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAwwWulNE6D6+KVCLTLv138EgFB5vtTGJTlWt1Q1XPsLqo40RWUnG:VKEcPw/VKonR3evtTA8k1XkLrwUnG
MD5:	E705BAD2BADE9B1CF920439BB926DDC4
SHA1:	86E2894FFECC374C44A613E2257DB7AB3E20DEF8
SHA-256:	2A2457D3D7E079B0E3FC74EAA6D209AB766718019FAA9103A7D31070449D362E
SHA-512:	6E2C578365B2647C5AC2E140B45CA4F1468DF0A793CC7A97E16843F99E04FBAA9027EC1CB6466C01CA00CFC0025469AFA89F3E93A437645C2882C3D0994CA7AC
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api.js?render=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&onload=onLoadRecaptchaV3Callback&_=1707417351908
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD');(cfg['onload']=cfg['onload']\|\|[]).push('onLoadRecaptchaV3Callback');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true;var m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='Az520Inasey3TAyqLyojQa8MnmCALSEU29yQFW8dePZ7xQTvSt73pHazLFTK5f7SyLUJSo2uKLesEtEa9aUYcgMAAACPeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/reca

Chrome Cache Entry: 355

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	39328
Entropy (8bit):	7.91647038087011
Encrypted:	false
SSDEEP:	768:sTr4PLxNiNEPGcuQ/a6fnySk3mlP+QbesnAnQ8Bno8ZKSUTWeO6d5ptuFO:sgPi6PGcuQ/aenypup7AnXnoCKFTW7q3
MD5:	417CE707E1BFD94EF710E908C06D973E
SHA1:	A2B3D1C72C9CC57F52DFBCC528649E73D43C5C2F
SHA-256:	1022F1662F9F02AC55DC95402144F2AE71D6F0A14C19B3E3041B68B529946CFC
SHA-512:	CF11FA71A5146A66B36D0CD33DC0805FF8B9DF3A6A8366F6D30EBF071E355E0CF5936B0E0A4D1085F392F17F0D01EB418F0D2E24C6315D198C5E346EAC3F4125
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/xdata/images/xphoto/500x500/184698944.png?k=6bb1bf3c13db4a7ba3c22a2d1f1051f793c525a78104703b4dec3eb12101f545&o=
Preview:	.PNG........IHDR....................IDATx...X.V.g..t.l6u.M..l.f.{.n..q.)N..8v.n.{...1..cc.j0...7......6}....3...\|..G...J3..;..+.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.tz........C....E.X..b.v..]A.....;)Aw=.....m.....u...........Q\...P.N..B.W..b....f...X].:o.ejE.j1o..

Chrome Cache Entry: 356

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	68
Entropy (8bit):	4.200601260429725
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM09/Woz59tVp:6v/lhPfZM09tzjTp
MD5:	C4A2B870062C2BB98C500BC1526C0498
SHA1:	528666CCDB12997358077BC8FCDBFB6B825C7788
SHA-256:	2AA4FA20701CDD6D8D56046069001186B5267E3EE7D0EF618AD2F4A683723E11
SHA-512:	2F1A3ABCD12125F7EF18D61A960901C0FD6F82DD02EA2B8041859E6D5F0A7F08DB17CC110DC6D8A3F7D0D1BA790C4BCCA2506D3C60EDFEB5CB29433E9F4F762E
Malicious:	false
Reputation:	low
URL:	https://tr.snapchat.com/p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e&u_sclid=75022d4d-ae50-4a02-8ab1-d3d7e0695f9e&u_scsid=15e0a621-1144-485d-901b-09bb638d2936&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&huah=true&m_dcl=8009&m_fcps=7323&m_pi=7989&m_pl=15337&m_pv=2&m_rd=17424&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F&trackId=c9cbee82-e00d-415b-9153-72ae9e8eb698&ts=1707417345114&v=3.9.1-2402072137
Preview:	.PNG........IHDR....................IDATx.c`...............IEND.B`.

Chrome Cache Entry: 357

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	374
Entropy (8bit):	5.2781425644004125
Encrypted:	false
SSDEEP:	6:w9NARNMJjQykRp6bXN25xBRZVXokLVEXNBezVL1Eh4pIoauw4dDOZ:qARsYUzN25HRZVXokSXNBezd1HIoauwV
MD5:	F1D67C93F1232808B430D12E5D784B19
SHA1:	E7BD4213A07D1BD54D07114DF90ED2D9A67FBC18
SHA-256:	113446BEBF9C745A55DAF1414AAED1672AA899C0604CAE103D5ADE7C38190F6D
SHA-512:	6F11D05CE7A2B8BD7C7131FA6931EA8E68679CE97DE13F391E98D7D5C4EE57DF11BF96688E75C31D13434A7AE49FA1C72B64D61275F07457EBE536D066167781
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/43e47265.9fb0fb7a.chunk.css
Preview:	.fc2f2c0da8{width:100%;display:block}.d840541ba4{padding:var(--bui_spacing_1x)}.ae9536be5d{max-width:918px}.f522a8d44b{padding:0 var(--bui_spacing_1x) var(--bui_spacing_1x) calc(var(--bui_spacing_8x) + var(--bui_spacing_1x))}.dc625444ef{white-space:pre-line}./# sourceMappingURL=https://istatic.booking.com/internal-static/capla/static/css/43e47265.9fb0fb7a.chunk.css.map/

Chrome Cache Entry: 358

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 540x270, components 3
Category:	downloaded
Size (bytes):	35918
Entropy (8bit):	7.969928422030634
Encrypted:	false
SSDEEP:	768:iRR5Abhk6j7hDhBAHxTSerGRzcvd2sihTbTP6zAn:iz5A9Zj9ohDvIsid/6G
MD5:	0726C7FCA592F0D3CDF299BF33CBD20E
SHA1:	BD1808F8AE74515255CF550F3397B80E19205D86
SHA-256:	F2479E1196E8F088C7A361701B299C8E3290BB7CEE74EB457729A14B0D10D222
SHA-512:	E2FF4F1CE883EE8D8260CBEE66D7051EADA2C7EBC958F5B9F56E3C6C1919FDB501803C8CED6DD3A12523FA5D8AE3367162D9E668D174BD0D9B5DEF58C6D34CE9
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/540x270/977409.jpg?k=82c14f9e6cea94829ee0528a3aa4324111d3482e9f095194500746fa7ca2769e&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..h..8...I...U..n.3F.....r?..].j.?y.{T.)......z..F..9..._.!m..XX.y<.1K....Z....//.J..-....%ul..^.....UQvf.)JK.#......^`...G\V....PKy..yP..>U.......mX.......n..!4...+...j.^...".~....D..'#.....Z..........+.M...wK"...z..+.6.#I..`)..z...V..T... .....Qt...H...v.4.,Ezv.1....h..Ou...TK.%...q......../.rP....Q.R.w.c....O.Wte.y..\.>k..H....{..RI.P...*....%.......T..q

Chrome Cache Entry: 359

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5036), with no line terminators
Category:	downloaded
Size (bytes):	5036
Entropy (8bit):	5.02691899528761
Encrypted:	false
SSDEEP:	48:ocwvvR3dn37Kfdx8zf0SBcqGeunymhVRl8hOfEwz4EwEgrTH5exO44H:CXn+fLobBjGeunyma8gN9gOF
MD5:	9478D8D20743C0422A70FDDF04DEB7FA
SHA1:	4D9B919969BCFF2E4E39E7D008A7A0C3F39ABDA1
SHA-256:	F9824E5F4727F34DD4B3F268CC3A51970A763E2E54FBE9934C44B7FFC1159E8B
SHA-512:	68206B543F68B46EFD8004FFCCB156CF3C3ACCB368137CC0228BEBC743E5B2A71CEA35DE6E27768ECE09C0FFA824D2CB33B1FEA7C48655ED012AAF4BF374B62E
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/css/print/0cc4ce4b7108d42a9f293fc9b654f749d84ba4eb.css
Preview:	.logolink,#banner_text,#tagline,#b25newName,#tabs,.help,.helpSmall,.browse,.but,#moreDestinations,#rssFormInc,.placeholder,.noPrint,.popup,.calender,.search h4,#sortAndDest,button,.scoreBarImg,.prevnextbar,div.top,.hotelnav2,.smallImgArea p,.curConv,#currencyConverter,#footer div,#footerbuttons,#footernav,#showReqRoomsHeader,#traveljigsaw_iframe,iframe#traveljigsaw_iframe,td.download-buttons,#bookStageNavInc,#mailafriend,#bookProgressBar,#languageselect,#calendar_popup,#netPromoterScore,#newslettersubscribe,#subheader-wrap,#registration,.breadcrumb_usersalutation,.notice-wrap{display:none!important;height:0!important;overflow:hidden!important}#bodyconstraint-inner{position:absolute!important}#top{background:0}#footer #footercert{display:block}body{margin:0;padding:0 0 18pt;color:#000}body,table,td,p,div,ul,ol,li{font:10pt/12pt "Arial","Helvetica",sans-serif}td,th{vertical-align:top;text-align:left;padding:3pt 6pt 3pt 0}.figure{text-align:right}h1{font-size:14pt;margin:0 0 3pt}h1.specia

Chrome Cache Entry: 360

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2344), with no line terminators
Category:	downloaded
Size (bytes):	2344
Entropy (8bit):	5.887974933072265
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08yBE8Aj4wetzYig3yg6:wsbSUtJfxrqLWWWdV6j1sERq1
MD5:	CC2917C052899DE3AFDB239C4F48652A
SHA1:	755AEFBB8A51CF1E86177E3D64CFF10C66FD8028
SHA-256:	C67EC460E4D6AAF799B620C3ABEC98CB629FA9C4C8B10ADA87556C4AB4A6F507
SHA-512:	3DC95F8F088E6D8023CA1B6137D88B6F0CAC51C35F3BDAAC3054E249AECE7B312EC4C4F53090AD5EBA361FB4932436D8FBF79F07BFE34655360B97B9E31AD870
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/988382855/?random=1707417356533&cv=11&fst=1707417356533&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 361

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	dropped
Size (bytes):	3170
Entropy (8bit):	7.854596680686955
Encrypted:	false
SSDEEP:	48:o9YMbuERARkSLIsx+29SGcY3GByhtyiQVAV6i8wO2chefJEF3s6Z8GOXgkaIAZH7:ghCE9i+NqQKSishqU3siyXgkadBKODB
MD5:	F427C285E94CA825342679D5D7B28062
SHA1:	2A1EDA11BE2BD74A596843E61C9129F2B5302C44
SHA-256:	283428B5D99BFF4920EC4625E2C9901FBAC38EF34A0E8EB6AB7635E06C6606DB
SHA-512:	CCC668849B513C6280B098B84BCECA17B6FF0CAF53C3E08A0CBF3CC0B9C49255C171B97BF68C17F7EA232F82D3C649FAB71229C2096F830AB701F9B457C8865B
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......d.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..FM.. ..T"..y.#Ux..`..Ux.\|.Z[...+ l...)64....2..08..d..#.2....V..2.%.e.:.~..!.T".VeA.....$...?0.s.F@.k....+...q@OjZ....)..\....p...2..#.M........@}..yf.(...Ee.#U....TjjE5W....7...7f....18.e...:WZ9.2.c.....s]..r.#.M.0......0.FE<%W..HmU%....:U.IKB.F...)E<.\..*.8- 5 4...".......B...d .s.z......... ....k...i..r..K.,..\|Rrv.(...(.G:..@...ph..er..O.[..G.......

Chrome Cache Entry: 362

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 363

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 2880x868, components 3
Category:	downloaded
Size (bytes):	245767
Entropy (8bit):	7.948498789608872
Encrypted:	false
SSDEEP:	6144:39mtb2UjDzQo+Nv2+8O5zhwJDDKW2r6F+QYLI87eb3VzFyZo:Nypj/B+VXiBDKW2r6dYjab3Hya
MD5:	FB85E3F5959D74E781F58FFAD5E3037D
SHA1:	9DF89DD837AECDC743E60E51B26C4CBC4A4A8FE1
SHA-256:	5D792D42BFE6AC44DAB107FE96F0E6EC90B3727EFC41B68146B20676392AF510
SHA-512:	97C813AE769FA5D524D755458C590AC035CC212EACF82FF199EF578529218C7606E96C23E6B2C44B40F2FD09D96C9CF114142132673C7CCE077BDB1BFE8EDDFC
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/xphoto/2880x868/308526620.jpeg?k=0663a1420ea98a013af0eda32bb4d11258521a39c5b8a5a4e2777ee5661dee55&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......d.@.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..."...E'..'...i>\........jA.S.....q.!.i.E3o4.....9..R..P.g<Rb..-.7..h.JH..i...P..O....8&.......3F0x..=y.8"....h....dS...b....P)...#8...A8jC..h.q.i6.......S..a...ORh4.`Rm..Jx...N).....@..ix.JF(... .....!.9..=...&....H..h.h..Q..wJ1.@....jQ.....9..8d.x...1GA.....9....4... .`*.H..zQ.....M=y..r.7..!p1.i S..I.....4..O....L..H.x..jv0:..!.`.`...iT......ql..n.....P...9..s

Chrome Cache Entry: 364

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	11060
Entropy (8bit):	7.982849666998035
Encrypted:	false
SSDEEP:	192:+y5J3DyXWVZe8CL+v2k5CNvYp+HCCZMD0I9MRBCLY4E6vhsSinkPdaH9sTTynI6C:5Ty22ACNUV+MII9MR0LY4rri6GG/yRC
MD5:	ADC5E6B0D1AB49C25CCB97528048BB9F
SHA1:	B962E347B0820DA723C877113A69B7E092DBF431
SHA-256:	8F797CD1C62D01F1B4F139E4F0591E7F4961AE33100C864CC7BDF4E202C942DE
SHA-512:	934B82E5D019EF8B998EC4F1373E2AD7AABD6FC73DCBA68D4AB4CCABDC280E1333059637E8C0568DA01808A8B8B21507E9748F6B93695517D343BC6DAEF70207
Malicious:	false
Reputation:	low
Preview:	RIFF,+..WEBPVP8 +...........>m0.F.$"..2....en.0<..>S.?Z+.>?.w......C.......>.......~.~....>.K}.#.7_..........9.....?....E}+~.....$D.J.2xRN`...]s..7x.5r\| .fr....d6{....'Y...Q..........p.J!...J.G....}_5a.%..!O._r.C........0.N.....K...u.k....PfX.)y..r.....Z..r..T...X.:...p......>....5.f.}.y$.9.......M...^...]?..d.........~&.8Y../>....u..V....tn....I.W\..}T.......$.by....bN,..'(.eb..m."...........W.uE..k..\.....X....}....:\|...,.._.......2l.b..=q.afl~k....r....9..,{.$.07.@.R...+..^h.m..dh..z.P_...g.8O;.J...R.?........P..6J..h.@...h..fD.....x..'.&,W.OR.req7r{8y...v3..N.[.q..@4..G..'........s#4..w...E].t..w.A.E......7C........}..I..O..Q-..:.Y-.{.v..g..g..U.W..~iI.AN!...........@dz.< .....+...Tt4..N.Y....QGW.p=..\.w..wh{.ZL.~.\|.f..'...e.s/6..PK.:h1...#2.4..FK...>..)j..Z.#..............5..T.... ......^ /,.]N...#..s..k./.=..^..Q..9&.(.,m^^2EF&Q....c[.uYx..[......?.A..3VM....".[..D..5...j........K.3...,%.&...M."..)Q.....< }.q.....

Chrome Cache Entry: 365

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (61251), with no line terminators
Category:	downloaded
Size (bytes):	61251
Entropy (8bit):	5.325650588761069
Encrypted:	false
SSDEEP:	384:J2xxZ8M170fOxf+sknbQplJPBk0p7aygr170XUrg6R3fTRMX:4xxqM170i+L8plJZL7or170XUPR3LRMX
MD5:	C23712FDF141E24DB80E23CB329D9B13
SHA1:	8986984DEE198755965A7C6E0B139380212235DD
SHA-256:	5522523714D946A5810383BBCA991C678457EED981B987D65F352C9FED2DC7D9
SHA-512:	F95FF903A5EF9593FAAD33BDE3910FA4A077823FB920225B8BE4AB482B03B231A86E51DCE25295A8A4F66AC0156AAF08F8EADDE02E7BA5B350482A640F5618CC
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/accountsportal/assets/826_0d1737e180931a217647.css
Preview:	:root{--bui_large_breakpoint:992px;--bui_huge_breakpoint:1200px}.partner-header>header{background:var(--bui_color_primary)}:root{--transition-time:300ms cubic-bezier(0.645,0.045,0.355,1)}.transition-container{margin:0 -4px;overflow:hidden;padding:0 4px 10px}.sliding-panel{position:relative}.app--loading .sliding-panel{opacity:.5}.animate-height{transition:height var(--transition-time)}.transition{position:relative;transition:transform var(--transition-time),opacity var(--transition-time)}.slide-enter{opacity:0;position:relative;transform:translateX(100%)}.slide-enter-active{position:relative}.slide-enter-active,.slide-exit{opacity:1;transform:translateX(0)}.slide-exit{position:absolute;top:0}.slide-exit-active{position:absolute}.slide-back-enter,.slide-exit-active{opacity:0;transform:translateX(-100%)}.slide-back-enter{position:relative}.slide-back-enter-active{opacity:1;position:relative;transform:translateX(0)}.slide-back-exit{opacity:1;position:absolute;top:0;transform:translateX(0)

Chrome Cache Entry: 366

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	21134
Entropy (8bit):	7.991676762963661
Encrypted:	true
SSDEEP:	384:PPsgL8YyB2TKATf7V0XJCy+eTBVgCEQSsCiYn9LInTb5HOK9Y:9C2T9TxATgsm39L25uK9Y
MD5:	CEBF68FB2D6614BDAF5D110803B1635C
SHA1:	24135DD12DEAFBD207FE406F69C1F50AF24F518B
SHA-256:	B592DCE471A02FD08F9CB92AE52265A328034F4EA27585F0CFB9BE08A06CC3EE
SHA-512:	909BE466FFC4BDFA460674FDAC976941171E0A5A10AA10F6BE5D20EC3BC7D1B90A144D214778E35C89B2F8A6A4D6753C3D91AF164FD817D0E63F8833CCC75630
Malicious:	false
Reputation:	low
Preview:	RIFF.R..WEBPVP8 zR...........>e&.E..".lg.X.D....S....N.yG.y.....W.y.....F..?^.v.../..7.........7.#..@..}.._..>...........}..#....#..._...~............/.O.....?...........=......................g.W.c...o.......3...I.....U..Q..\n..1.C..J...AE.....;..\|.bN..e..O.Un....j"...7uA9....1.T...{..((..K..<,ko.I........u4[w..u.g......p....8.+...\mx...{.T\A......=."..o.Q..Z(R4?tk8.w2...aJ+.`_../.XqlX.....^..K8.7"eO..<.@..i>.. >D....I.7..=7..d....H...<.N..}^U........#..s/z..},hZQL.q.#.k.....!o.m..C.e.^...r....U.E..n...a..!..[O..QF O..&.;.I`......"G..(.4....-....\|..&..i.........?........h~G.42..b..Eo../..P'...EN>......^....<........D..kV..V.....8...]..9'v.s.>./........2.;.)..b...p..}H...~<U;.O..> ...c4B ....J.....^..f..v.mG\~Ao<D...h.wZ...K.....y.d..:.e.....L.`.].3..hr{..$....\|l.....e_._.<...4.M.e<....... ...(........Rm..u.6..}b..E.S..Q...........ZA..D...a.(....g...L..7..H.......?(....@\....E......D'../...1.o.'.v..<..#.AoN.%g.9..d.\>_.0<I..H.+...<c.$

Chrome Cache Entry: 367

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:	384:ctE5KIuhGO+DSdXwye6i9Xm81v4vMHCbppV0pr3Ll9/w:cqrVO++tw/9CICFbQLlxw
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 368

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	6665
Entropy (8bit):	4.802851903376328
Encrypted:	false
SSDEEP:	192:FVF7pSdDHj4w8psdXH73uRCwpY6vepSdDH3xCXbzJtV:tdwDHj4/2XH73uswpzowDH3xCXbzJtV
MD5:	1F6D685BF8C9C558A9031B1640F4BA59
SHA1:	63381A030005D4AADDFD37E411D2B9F0173AB313
SHA-256:	2BFE24A072135C56F92507BCD88309BADA5FBD4945A512274ABE547DEE9FB189
SHA-512:	0B18266CC328447CB8F52F387F36961952B1A1021977DAEF154981AC3107DF6E352C77EA9438E1DD04DA79A86C812F40B2EC7551C6ED0D8B84CFBB8F6430CEC7
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/consent/a387750c-a080-4dd0-b2d1-7dbdb601bb14/a387750c-a080-4dd0-b2d1-7dbdb601bb14.json
Preview:	{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202305.1.0","OptanonDataJSON":"a387750c-a080-4dd0-b2d1-7dbdb601bb14","GeolocationUrl":"https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location","BulkDomainCheckUrl":"https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck","RuleSet":[{"Id":"9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf","Name":"US","Countries":["us"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","en-US":"en-US","bg":"bg","lt":"lt","lv":"lv","hr":"hr","fr":"fr","hu":"hu","default":"en-GB","zh-Hant":"zh-Hant","uk":"uk","sk":"sk","sl":"sl","id":"id","ca":"ca","sr":"sr","sv":"sv","ko":"ko","pt-BR":"pt-BR","ms":"ms","el":"el","en":"en","is":"is","it":"it","es-MX":"es-MX","es":"es","zh":"zh","et":"et","cs":"cs","ar":"ar","pt-PT":"pt-PT","vi":"vi","th":"th","es-

Chrome Cache Entry: 369

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (39976)
Category:	downloaded
Size (bytes):	40169
Entropy (8bit):	5.7975943949622
Encrypted:	false
SSDEEP:	768:J0g0lejl45Bg6w4WX7OUR1PdUYuyn0W8JMsYU3Dy7BeFwTiQ:Rz1GOoFJQ
MD5:	199D642C5B6C7F31E39C1A73F70EADDB
SHA1:	20E30BD846C8124506317E6ABEF29FD17286A6C1
SHA-256:	B0E7B60E17281EFBDDB919A4F66A71D96B2FF35F8C0353EED360F9760D03D965
SHA-512:	82936322EE55678232DD686772AB9B4CBE1FA12BECE50013BBA6A9AAB07AD7C836452130CF6DF35C19A159367CF3B010722853A4EE09602E1C509B2244833B41
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/53a8d0d3.8742f23d.chunk.js
Preview:	/! For license information please see 53a8d0d3.8742f23d.chunk.js.LICENSE.txt /.(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["53a8d0d3"],{"51a388c3":function(e,t,n){"use strict";var r=n("6e8b4072");t.Z=r.Z},af1e2b38:function(e,t,n){"use strict";n.d(t,{Z:function(){return i}});var r=n("6ee88c54"),a=n("dc6d28ff");const i=()=>{const e=(0,a.getRequestContext)().getSiteType()??r.N.WWW;return{isWWW:e===r.N.WWW,isMDOT:e===r.N.MDOT,isTDOT:e===r.N.TDOT}}},bca4b277:function(e,t,n){"use strict";n.r(t);var r=n("ead71eb0");t.default=function(){return r.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},r.createElement("path",{d:"M.153 22.237l.85 1.117c.634.76 1.724.856 2.456.244.078-.066.15-.138.216-.217l.944-1.132a.228.228 0 0 1 .349.001l.944 1.13a1.728 1.728 0 0 0 2.651.001l.944-1.132a.228.228 0 0 1 .349.001l.95 1.132a1.728 1.728 0 0 0 2.65 0l.942-1.133a.228.228 0 0 1 .349.001l.942 1.13a1.728 1.72

Chrome Cache Entry: 370

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	13904
Entropy (8bit):	7.9858014202596435
Encrypted:	false
SSDEEP:	384:qvF0SZJsx/sdqUxKTuuZXlpSV9PcJdWZ3ysS7RFlFTQZ:q93ZPq0nm1pSVpcJdi3yd79FTQZ
MD5:	373F7CCBD297248E76208FF46E442487
SHA1:	7D3910A92BE92EF2C912937D75CC53F6B6A7CC46
SHA-256:	DF9D4680F6A5679CFB790A03FEADDAED60F8685EE08E8E343D6766C373F7F0D0
SHA-512:	8DA384BE33DEC02AF86993E72A7296B534B0E8F6BD38460893408CBE895F4D19F3D91AA05E14A94D84AFA70E4BF8EA07A76F54EBDE06904CA6FC19EA62013161
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/square250/976708.webp?k=cb62481ca3494ac4e0b030345eedc77024732fb227f5642c773e5a11f534016c&o=
Preview:	RIFFH6..WEBPVP8 <6..........>m0.F.$"..U\P...ek+...q..p..m......7..._......E.:........}../...y.._..?.....?.^......c...;.....>.}....................o.+.?.....O./.^.?azf.......M...\|.Q6:......3E..,...:n@...p..#;M..'..Ec.V..._....y....!........;...7S6..3Ob.".......Z..M....\.....V.cr4...#.~....F..m8.@.M......v.(%....T0Dh...>.$....-.....:.e.&...;Gp.2.3.e...u.MK....g..?H.#`.1...1...5R.1$.....}..Va'e9.=t..:V\h>0.m..F..#...a.gV..T)8....(.d...gt..tcV.....-3..}. .....L."w\|7...j\|....b.4u..A"..Ap....b.A..Ks.O.A(._....d.........l...u.c...;..:\S.......=.s...vw.97...1....dhM...s.45....f.\.A..q.K_....7...Iy..K..T Y.....#q...Kv.*1...Y.#."."............J..H........k\.M........k..E.e.i. -.yU ....G.:..l.g%..c.uK..,T.w.._.......)O%.....E-.3.1.zVE......8W...G."O#`:.s...c..&e...`.....x.F.....<hy9.7........c!Q...4;$mvs..UU..:.$a.8?...".........u#y...X{".......w......6.......U.f.42P..W0%).r.....CL.".`v,.`..N~I.i1j......AO..?.\|..........s.F.Z...gM......y....K...

Chrome Cache Entry: 371

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	68
Entropy (8bit):	4.200601260429725
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM09/Woz59tVp:6v/lhPfZM09tzjTp
MD5:	C4A2B870062C2BB98C500BC1526C0498
SHA1:	528666CCDB12997358077BC8FCDBFB6B825C7788
SHA-256:	2AA4FA20701CDD6D8D56046069001186B5267E3EE7D0EF618AD2F4A683723E11
SHA-512:	2F1A3ABCD12125F7EF18D61A960901C0FD6F82DD02EA2B8041859E6D5F0A7F08DB17CC110DC6D8A3F7D0D1BA790C4BCCA2506D3C60EDFEB5CB29433E9F4F762E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR....................IDATx.c`...............IEND.B`.

Chrome Cache Entry: 372

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	48
Entropy (8bit):	4.194773835029477
Encrypted:	false
SSDEEP:	3:Y2iUiCnZNDrMPobI:/iUiCn7bI
MD5:	8BE6965A3AF192212F83EA10BFB6F9A7
SHA1:	2A1583FD8008B154C838666686B004BD2253B129
SHA-256:	AA25045356CA06FDF737769EFDF0CD3E6F6BA5E9D0999A11D1B6F9B98113A89F
SHA-512:	3CCC78C790DA3B187C2FA31FF97F42484222B730E9E657B6D2BE624CF8AD6653A22636B7C165E6BC2EC427230101D6F9668C28F8676C6DCF53F7016FC41CE1F6
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwmVTA3pnvnoqxIFDVNVgbUSBQ3OQUx6?alt=proto
Preview:	CiIKEw1TVYG1GgQICRgBGgQIVhgCIAEKCw3OQUx6GgQISxgC

Chrome Cache Entry: 373

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 714x300, components 3
Category:	downloaded
Size (bytes):	30612
Entropy (8bit):	7.962493421163404
Encrypted:	false
SSDEEP:	768:GF+J7sHAHkkVVY8DpASdWyYj0HwCBzesEeg:GAxsHAHk0VY8OQVYY3Be5
MD5:	7CE960E4070E2B6660CEB7AA8CB502FB
SHA1:	1B7DD5D49465071807299ABA9E3586909601BEBC
SHA-256:	A637D32244EC0B11738B3F7F109EC33F1089C088FBCD52D32D2981786B79EA19
SHA-512:	FDC1FB6AA6076A8F8B3D4E4FE599C28626A47AB79C479485833B43A5CAF28724BA1ACB165F80CD9F8335DB115423BA6F167F1998AC33A0C5CC8B2A6482828161
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/xdata/images/xphoto/714x300/293799350.jpeg?k=8a6f4e24c37096fbdcd3c3d30c9f3dcea15ce35751448466decf791918012a64&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......,...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..<R..P..`z.$.b..8........<Q.T..I'8..;.R....i)h........dR......@..".$.P..?Z....4...9....t\..j...@\|....t.b....31=.N,.....PhDW.yA./\.jA0..l....`=..l.8...H.....<.O...N.C.B.{b.{.A.0NA..] .\...E....;Ggwk.F..x...V.K..J..5....`v...N..S&kC..J.=......`.3....e...a.FG.)c...>b.#.z..)..m.d.r.4,0.g"...Q.....j......Q.S.$...m..b6......*.F..S6....5A.I......b......

Chrome Cache Entry: 374

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 109 x 26, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3221
Entropy (8bit):	7.926541742311065
Encrypted:	false
SSDEEP:	96:rIGMcponR70HgyaFrym+U95ICrxP5rxwSlA3hf2ZMAo6y:fFond0HgDmDCr3lm/D
MD5:	38784D782A29A302DAB9135D63AEF953
SHA1:	04DB0E863A35062A355C4B2EA9585EC83C4FFC3E
SHA-256:	8561E200A6A57195E480ED9D893B14579EF6ACDEABFBB3FE22B5E4EC9B84B455
SHA-512:	741DC6204353821D6CB76E16E36AF4176C1518EFC22AB064BABAA0D21DDB8BD9BA5A08F10A82D899DF3D880E5AF8BE76037CF342813D0D22A02A9558AAD12C67
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...m............/....sRGB........OIDATh..X.pU..>........(* .T......V...Z..m.Nk.."..CE..M\|..(-K....:.X.....Xd..P.(E.B.{...;/.&.3.3.3.;...;.?...._.%.8....("PD..@..".E........#..7.K.?.Q2.Z....=;......)..1.\|..,..n.\..,......R=/U<...../F...:.].\|>Q......O...#>.RUV^.\|.Vb.Q..%k.RB.a....8........h...O.=...Yu...q2.6.y.9...R~...@...2.........X.R..._=.../.\|..=......q~..G.{..w.......}.< g.#..!....}#-.........2...8....k.r.(.g........'..1...XF-..:...S..#..qny....%6.y.....h...GF..rMr...o.@f.J....../.+.}.j.G\ ...?.>..j..x.Q..a._.....(......(.i.xky.......tGGE"..BiH+.__YK7V7D...'.I..d.N.oj......c.$#...1..........`DV5...x....c...$...1..r...#...)..n..T.....DzsucX.<=.1p.....G&Q..............3.k\..4.............l.Q3.".t...WE.).i.O.U7.5...'.j..1.o...u..DT.d.D.W/.....T5...G.R.Cb.vG...B.Q2X..../s:Wn.. ......z.1.k.9...Y-......F5.zt......(...I~.....~..:....^.k.8!R.~.x.H.W.Y $/W#.*DB...[<.1..U.E....Z.-..F.n.l._e..d.q..6C.k\|..8.......j.$....

Chrome Cache Entry: 375

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (36296)
Category:	downloaded
Size (bytes):	446209
Entropy (8bit):	5.515052336351196
Encrypted:	false
SSDEEP:	6144:4j1DJjljMjEj5jQzxy2vdJ3+cfAPE7jaQIOGxQcRIqx:lzs2vmcAPT
MD5:	008CBE7EF4958ABB6A8285E69395BF47
SHA1:	761DC574A6D2DAF6DE34675F6FA937E4D7958375
SHA-256:	092394A12336662DC11893DC107E1B55510B19F5CF053D546BCAEA128BD07027
SHA-512:	E1C714EFC470B62E3A95996C0500E32662308CC813CE6AC4D3C0E59967329CE61A01A5816F3528990E01711701546D21894F3B7364D3B5203A1F8CC3C21D1E33
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/gtm.js?id=GTM-5Q664QZ
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. . (function(w,g){w[g]=w[g]\|\|{};. w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');. .(function(){..var data = {."resource": {. "version":"307",. . "macros":[{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"action"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"user_location"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"opt_out_companies.facebook"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"fbp"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"site"},{"function":"__e"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"n_b"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"cul"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"dest_u

Chrome Cache Entry: 376

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2340), with no line terminators
Category:	downloaded
Size (bytes):	2340
Entropy (8bit):	5.891972272720874
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08x/WAC4atzYig3E6:wsbSUtJfxrqLWWWdV6j1hWAcI
MD5:	02B26F10C31B7EB3AF63D793000C1032
SHA1:	08216302E4C8E35461C9E7C0D7DAAEC21169D46E
SHA-256:	D9555D4924659C7EAD2550B24AD989EC70BBC53F37D676CAD68F75E5C34460E2
SHA-512:	D3102CBB6363072061C6C852BDCDB2A048308857B035DC548C3742427683EC354E3499C4D36704207B6FA50CF47006A8447AD0E2FFA0106951937A2DE4506172
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/973712236/?random=1707417344582&cv=11&fst=1707417344582&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 377

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	65
Entropy (8bit):	4.314128390879881
Encrypted:	false
SSDEEP:	3:2erWeKBRk35KLWAzRERxzfRX/H4Y3:29M3tRdfZN
MD5:	83A02FE42F8C2198E7C608AFF363AA49
SHA1:	7B20AE1014450492CC708E3C9DC7522B05C2EFFD
SHA-256:	E64954DC34E12C7190CC2338A54B07644FF0F102AA71CC7209BCBB49C3009F7C
SHA-512:	CD381A8C725C892E9A68D713254A31EA9ED25A39B212A5DC52D4BA2655F38AFDDB32519F03360F32A59D8E7701AF6C2AD0030A6AA760C3DE87C75063F5B65F54
Malicious:	false
Reputation:	low
URL:	https://gtm-mktg.booking.com/g/collect?v=2&tid=G-A12345&gtm=45je4250z879615461za200&_p=1707417355756&gcs=G1--&gcd=13l3l3l3l5&npa=0&dma=0&cid=421694156.1707417338&ul=en-us&sr=1280x1024&ur=US-FL&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pscdl=noapi&sst.uc=US&sst.rnd=858995681.1707417357&sst.gcd=13l3l3l3l5&sst.tft=1707417355756&_s=1&sid=1707417345&sct=1&seg=1&dl=https%3A%2F%2Fwww.booking.com%2F&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=8579&richsstsse
Preview:	event: message.data: {"response":{"status_code":200,"body":""}}..

Chrome Cache Entry: 378

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65033)
Category:	downloaded
Size (bytes):	65226
Entropy (8bit):	5.498630035870181
Encrypted:	false
SSDEEP:	768:ulUUOd7sBA0/UAC/ywu4GjIHWIFa1R9riMzLnApxE8CB1LS3Yw6RZnM2+BtSYIE6:sO0CKfBRAYw2LqIbWURBYcb
MD5:	2A4BE84FACF3E21BB4A9EBB12A10A92E
SHA1:	E03A6EA6313A52CBE9685A8617465E307E471B79
SHA-256:	CCE0256A5EC747F4C0BF5339FE4870FD26B19926BB9E984B5EAA8FFF9AD160C0
SHA-512:	73B06DA27D26CE38EF0E03FCD4F692020DC599C96C8CF75A12D2AE9CACDB6DD0A4A86D38CD6612C4355B1EF576D498201DDEB0B9EB489FDCCC9EF3842A5D0421
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/f5d0e2e7.5cd38fd6.chunk.js
Preview:	/! For license information please see f5d0e2e7.5cd38fd6.chunk.js.LICENSE.txt /.(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["f5d0e2e7"],{af1e2b38:function(e,t,n){"use strict";n.d(t,{Z:function(){return r}});var a=n("6ee88c54"),i=n("dc6d28ff");const r=()=>{const e=(0,i.getRequestContext)().getSiteType()??a.N.WWW;return{isWWW:e===a.N.WWW,isMDOT:e===a.N.MDOT,isTDOT:e===a.N.TDOT}}},"4536290a":function(e,t,n){"use strict";n.d(t,{G_:function(){return i},Jh:function(){return s},er:function(){return a},tD:function(){return o},zW:function(){return r}});const a="https://bstatic.com/xdata/images/xphoto/max300/155161147.png?k=d70408f26332684fc7ad8476baf145813e2e71a7d8d89a40645bcc97cda6f00e&o=",i="https://bstatic.com/xdata/images/xphoto/max300/155161149.png?k=02a71e2df8269c8f9783c405dcc3854ef4a727b739a7202aed1caa64dae5141a&o=",r="https://bstatic.com/data/mobile/gneius_vip_logo_with_ripple_v2@LARGE.png",o="https://bstatic.co

Chrome Cache Entry: 379

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/973712236?random=1707417344582&cv=11&fst=1707417344582&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1
Preview:	<html></html>

Chrome Cache Entry: 380

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (5978)
Category:	downloaded
Size (bytes):	560387
Entropy (8bit):	5.945013004176746
Encrypted:	false
SSDEEP:	6144:e56GsvoSIeOXFMWnFPcRT0v4SRZtpILTzTgQITwflSk7khQMYzmI:epk61qleQB
MD5:	6CAD3C4F34EC7F302D5C5B798BB66D61
SHA1:	99849F70FD23B19AE2E4A73494A3D2F66A7B871E
SHA-256:	B6AD7AB6E87AC158B1D6CBB98C7DB522AB11772790416E05EF5B2520AB1B54B6
SHA-512:	3EC6F7E042C1574645A8E7527DC377D25BF2C6827A569B845E02C3B8436085D241AD69EB5C1C6D835EB70967A273B2A1E5F73E505ECA3AC9AE99FC1B7C6005A2
Malicious:	false
Reputation:	low
URL:	https://www.booking.com/
Preview:	<!DOCTYPE html>. .You know you could be getting paid to poke around in our code?.We're hiring designers and developers to work in Amsterdam:.https://careers.booking.com/.-->. wdot-802 -->.<script type="text/javascript" nonce="41DAHdU7wQYSt3l">.document.addEventListener('DOMContentLoaded', function () {./*. provides the current user's cookie consent.* in order to use it:.* 1. inline privacy/cookieConsent.js in the page you need to use it..* please note that this library relies on window.PCM.isCountryNeedCookieBanner to be initialised.* before using (calling getValue function) it.* 2. in your js file:.. var privacyCookieConsent = B.require('privacyCookieConsent');.* var consent = privacyCookieConsent.getValue();./.B.define('privacyCookieConsent', function () {.var consentGroupIsAllowed = {.analytical: 'C0002%3A1',.marketing: 'C0004%3A1'.};.var optanonConsentCookieName = 'OptanonConsent';.var optanonBoxClosedCookieName = 'OptanonAlertBoxClosed';.var halfOfYearMillis = 180 24

Chrome Cache Entry: 381

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5646)
Category:	downloaded
Size (bytes):	5762
Entropy (8bit):	5.312127207989446
Encrypted:	false
SSDEEP:	96:HxCgLnRo0x23QB7gyCi9rOLkLCk0IkT2bnpBNnEp8gm40So:HxBRvx23QB7gyCQHLJWT2bjNnkeqo
MD5:	054C06419579FBE2660760D03E545650
SHA1:	F480DFA7D4BA6C51F64070C5498C134700C42AE1
SHA-256:	3C6D7B33A8ABDDABFF7675B3BA9E53594A3333C84EBCEF766A60AE3A0D6B6A92
SHA-512:	E2244092C63BC40E98BEEFE33DACE920A4AC2361903A33BAC2B9DD6D9F9799DE7FC3C909B2632AD03F7FC41126AFD0575C1A89DAB3D2B6180F4B11E0F9F71B12
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/3d066b0d.a994f040.chunk.css
Preview:	.b82528c917{flex:1;display:flex;flex-direction:column;justify-content:center}.af4c164345,.c1a36e933c{margin-bottom:var(--bui_spacing_1x)}.c943cc056e{margin-top:var(--bui_spacing_4x)}.e11bafad86{margin-right:var(--bui_spacing_4x)}.e11bafad86:last-child{margin-right:0}.rtl .e11bafad86,[dir=rtl] .e11bafad86{margin-right:0;margin-left:var(--bui_spacing_4x)}.rtl .e11bafad86:last-child,[dir=rtl] .e11bafad86:last-child{margin-left:0}.d44dfae809 .af4c164345,.d44dfae809 .b3783c94f6,.d44dfae809 .c1a36e933c{color:var(--bui_color_foreground)}.be4381a9d6 .af4c164345,.be4381a9d6 .b3783c94f6,.be4381a9d6 .c1a36e933c{color:var(--bui_color_foreground_inverted)}.c8c234d161{min-height:184px;max-height:228px;height:100%;display:flex;flex-direction:row;justify-content:space-between;align-items:stretch;box-sizing:border-box;position:relative;border-radius:var(--bui_border_radius_200);border:none}.cecfb534b8{background:var(--bui_color_brand_primary_background)}.ff1bca3a8a{flex:1;display:flex;flex-direction:ro

Chrome Cache Entry: 382

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.273117654663556
Encrypted:	false
SSDEEP:	3:LUfQ2pHWiR8HH4yOE9HEEpGlyRHfHyI:x2pHDIiEltDyI
MD5:	9C96EB3A1A2B6FBD8C9F23363579B2D7
SHA1:	D86A36124C5389D77E44271F231834342A6B7706
SHA-256:	CC794D966E83D0ACB613258C28876A513C4148E6D0A607D97A4B09A9F8C1C6D5
SHA-512:	2C2640B5B09BA2EAB5214D3ADF4563C45236A656E8D9A9A6A9E192D3FD85CE3F1CD01EFF2B00A97E99F0F4022202776AD6106EEAD83A9A33D1AC70F8D5763130
Malicious:	false
Reputation:	low
Preview:	jsonFeed({"country":"US","state":"GA","stateName":"Georgia","continent":"NA"});

Chrome Cache Entry: 383

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	16626
Entropy (8bit):	6.017194162554605
Encrypted:	false
SSDEEP:	384:Rky5FLxou1i03HACfkBF+a+R9BcUipQl1PJ96LdmLgRR4YDT:Rnx1M0gokH+aw9BcUhRg9FDT
MD5:	7656D04A3FF586E1DC62B0255CC0EECE
SHA1:	E2FB7C10FA095C3AF21986AACF10DAC9EA17B43A
SHA-256:	2F95AE00EBA927544C73CF4504D71172C073114063DCA61123EBCB6F0352D9C8
SHA-512:	DB2BBBD3438F2B1B9098962AA3355AA3591697E16B8141D4FF2531F53D6CABF7F7AA134A69D599EB3EC07D9E90D14AB9116AE307EA72C75A494B6041DB16B2C1
Malicious:	false
Reputation:	low
Preview:	{"sodar_query_id":"IB_FZavgLt6ugrAPlpyNgAg","injector_basename":"sodar2","bg_hash_basename":"s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY","bg_binary":"XCKWJ7PTQDkV5X8cX1RKQrVhLmEDXqYjB68gbEF2shpddQbBblRUR2dykC7/+F66GWypUfU5Pao6RIRYUIZNfoJEJX25bT45HVPLNqMR147Kdduadlo08BoKWipMCAZQrqe4OcffRszJ1moaGCmP2GEX6WcTaAqcxTHFYrcal2Wg3CYPaOY+Iv97jjslNCTm5tD1sz86V5MF8ndx1wXNcIL8aHF4ywhV161EX2UKmGYolnOMTqPHJn3/JNQjbf0a39CdUCYvhyWpEI9kgWngA98Fsqb+cDg6Gi1ioBWd6MEJKafJiqVUkdjnekYwNuZX3FRfuyTxRgb4Lduodgnojq9OVcKZe3B8KoZldHI6hz85jsKt37nprDLo1CDdzNEeR5tm7e8PLs2A14xl5kiwoLidkDMeBaB6P+zmsE0z4ZxaTXnFpiKA0BsgBoPt+PdwHXoaXbkIcJLsZeIELHFA2Cpn/G4nqllrcL3ef9tGmtamkoweJGs+wf24+bYpSEh92lxkf+2TII2cUJKCXH6VGm7AuKmIyokIofScTBqdAs5zzGar1TEsWn3X0hJSONfF03sp2qvRUSuijvcGULOzD5LZo9Ig9p7lNIICoR90HW2CyY0Zn4p5rWe4N8DlP3Xc2KAyiqnxOWSOqBpWvuAVIswjoUvATp6/KOBp3OYB236bhBoRKx6G0WifOOwCnJfRZjZf+QA8TAP+7j+gjy7O7csdEn4yPEUO5LnOujsWvXtXXwtEPlbJEdhm7ORREihXD+hbAMzjEtZOdQ9iWeZT3xM45gKMz2Th/rYqItzANdPwXtGSXrFm2QmLU+LOi3J3yz0BPVpHVkKFrZZXp

Chrome Cache Entry: 384

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	68
Entropy (8bit):	4.200601260429725
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM09/Woz59tVp:6v/lhPfZM09tzjTp
MD5:	C4A2B870062C2BB98C500BC1526C0498
SHA1:	528666CCDB12997358077BC8FCDBFB6B825C7788
SHA-256:	2AA4FA20701CDD6D8D56046069001186B5267E3EE7D0EF618AD2F4A683723E11
SHA-512:	2F1A3ABCD12125F7EF18D61A960901C0FD6F82DD02EA2B8041859E6D5F0A7F08DB17CC110DC6D8A3F7D0D1BA790C4BCCA2506D3C60EDFEB5CB29433E9F4F762E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR....................IDATx.c`...............IEND.B`.

Chrome Cache Entry: 385

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 720x217, components 3
Category:	dropped
Size (bytes):	25671
Entropy (8bit):	7.964895192972628
Encrypted:	false
SSDEEP:	384:qlBZvk2iTaMf5rsNr+vzLpfdnGt2pW5MbdihLVEo32GTDNAoBNkKxN8Wn9LRvHym:qlAZ2e5rBGaWibdifGkpBNvN80KiMyP
MD5:	E8BC48549C1E82C951DF411059B81A85
SHA1:	1A77B13C57125FBF8DD5DEE35AD1DB4BABDC9427
SHA-256:	7398A7BF4867D9A59CE24A193BE3F38267F6B612BE70FD9EE9BF56718E69E9B9
SHA-512:	F0D1DB4FF187FC32F8354543525AE605139EFF45A4C8011A4EE65D91231DDC48828CCCDC617D92697792033220BA4B44A9A39539AC5C0BC6268B19AD66902953
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....i.....'.....-0..6.h.@.....&)v.S.0...H.@2E .}(+..uS.J.:R.\....U...L.}.h.m..J.m4.#.9W&....1..8..E.T8.D..Y6tE.$.T].. 5....."H..) ......A.,... sR+. ~t..K.\|..Uz.)...Q.s...^z..i.K..rLi..}.L.1N.6G..mI.J....I.ZM.9...W.....m5.....o..J\R...j6T..q.J."......c..f.F.~)i..{ph.5&)B.@...;m<-...2..m...m..b0.m.6...E.....M.\v#.J.5 ZpZ..#.K...J...0%.jP.m.q.m!^*m..q

Chrome Cache Entry: 386

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2811), with no line terminators
Category:	downloaded
Size (bytes):	2811
Entropy (8bit):	5.9170392037719965
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08Fa8ISwitzYigErxz/ZbmgX:wsbSUtJfxrqLWWWdV6j1pfI8NxzMkh
MD5:	85F321EA2D50374D3865D8A1E3867C3E
SHA1:	59ADD776E7147E71E5F524ACEC01D54D0E801035
SHA-256:	A618EE9E441431AA4624C4B79654B8CCDF4FDF66C8F8FE67D077BDAA9DEA2139
SHA-512:	F8541B077D714243B6A35CE1C4247403FED968A570E9EB5C3C3322553DB3DF53147EA330C89C673234C486C3D3640989CD3778FBD5883511806B2688FDD4F899
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1060768846/?random=1707417344498&cv=11&fst=1707417344498&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nh4qqVoyv2KiIad5kPNddW86jrjYgKSk8&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 387

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	downloaded
Size (bytes):	2224
Entropy (8bit):	7.784364795368813
Encrypted:	false
SSDEEP:	48:o9YMbuERAaqm35hJJbVZnTx3RIp2H6TeBQ9xJfmGNzv:ghCEUmj/x3iEm9xM+
MD5:	A61C1FA50F30CC69E20DD36913247B20
SHA1:	169E55CDAB5A5769D979BCE4EC7EDB77C16D91CF
SHA-256:	645529B8CC531BBC2314887FA7EF582C7AB472DF270B61BE897CEE1373610A8A
SHA-512:	C20C24CA6F8EADB7C265396A4C2F5112B5F73E41531D9FBFA8300809C0F7EECA35A8F9BBCE661B5D6D9CE9E740021C38CD57FE9781375BE739CAC2FAC60195A5
Malicious:	false
Reputation:	low
URL:	https://q-cf.bstatic.com/xdata/images/city/square100/977345.jpg?k=898a2e6c68a765bdc18cc57be5c78b3e1f5b825c4d3167e7a0860c4c988a1af1&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......d.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...&).......f)1O...w..1N...w..\S.F)...S.K.b..R.1@\n(.b..rLQ.~)1L.........1F)... ..Q.v(..q....Q...1K.v(.0..QN....v.b..&).\....1I..r<Q.....;.....P...1Rb.P...1O.A..@..+.d3.S./...4{..7.d...W..}2...1..N...<_"..b..;.9#....c(.,..l....=8..c..&+.............S...)..@:........u..3U.c[.'....Wm.......,"%...p....%.~Q<.If...zF..->;/...k.I...PY.9;p{...\X..8^......C..V.R

Chrome Cache Entry: 388

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 354x266, components 3
Category:	dropped
Size (bytes):	27416
Entropy (8bit):	7.968830524645385
Encrypted:	false
SSDEEP:	768:p11xafUsMAiyxKrehmChpoNocwpriRX1S:pPxwhFS1EpoGc6ES
MD5:	31344F2581B8A92C33340AD71D7505F5
SHA1:	FB749CCDC8E3D4A2A44020C691E0D87BE0233B75
SHA-256:	B7173A5CDE9494348C68E9273664D8DEEF68F10E4907C2C27EBBAA9FC178610B
SHA-512:	5D0398DF3370FB628AB2339BCD284CFCDD7855AE641AD6258AD535C589D3933222E7288C2A3200DF08D579C2D1EE09AD328D2C8F59B5F3BBAC01D9C83AE1B80E
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........b.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...M.OX....1.5..g...W..a3.........U...6...[.=.....QR..g0-....g.[..WP,..x...C.#E.9_.\.p......T-.S.....a.Uug..M....4......z7..+..F"h.'..T.e.ze.b...O..^.......~U(.......$.O0..i2.b..}...?p........6.$...J#...99?SS...qQ..zM..r.KbF.....z..M.P./y..J..z..\...i2i..4......G..]......".Z.i....4.x..!<U...=hX....?>..OQ.!x.\|..........Mnk>]ni...8[...-._...z...v}..

Chrome Cache Entry: 389

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 210x210, components 3
Category:	dropped
Size (bytes):	5745
Entropy (8bit):	7.892422930102046
Encrypted:	false
SSDEEP:	96:ghyEvTNaH7B0gHnsWBU50/IvBpwX+ZcJDydXUSGahADtUqMvBpiw7BvBiUrmon/Z:myeNaH7Buj1vrwacVy1bB9BJpiwPmcmE
MD5:	549AF9869817C9DA36D4A797CA851B6B
SHA1:	B4108F106CD0F326686D3BB15025CC230726713B
SHA-256:	D26B20BFDDB55B019BF71DC7256C376226384C008B837A0C1035D0CD211897FF
SHA-512:	71AF4FD57F49A6D1087AF66C27DACA94B918EECD6E58897C18BCE3AC25C8C239DC1BA50FE809A07CB317F6A0A17901A926287963B3E08B8D9D4505B0C6FB58A7
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..,.q......[.b..}1R....dl..}..6.<..9......}..4.ju.5.@....L.x..GB8W..G....TDMJ....[.U..).. ..Nx=.TZs.Kn..\.....F... t..[.<S....Uv....j....g..5e......&.q..........].X.0..I......".(....JV...9s.94..)T..q.N.a.h...4Qa..*.....U..YW`8...7.]..IG5I....z..$k..v.s...G.Kh..).....k[6..d.H.s..g..mg..Hl8.VM...b.'......a...X....".Fk\v...<WQw.21X.0..."#.. ...>Mn\..5.

Chrome Cache Entry: 390

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	downloaded
Size (bytes):	3971
Entropy (8bit):	7.894110085320742
Encrypted:	false
SSDEEP:	48:o9YMbuERApNwEXHat2aS4yG//meQA5rSVe0NF0RFsFHw+V7JBsthHKOJloJAoy8o:ghCEDEXHa4u/Foe030RF5QsloR46OYrQ
MD5:	37D8F82532F43CCDA8F02D6B802AA09C
SHA1:	5C7BA9AB8F7A353083A5BD6A76929B6AA884BA2D
SHA-256:	4FC8FD16368AF71998D14F8BF9884CCC1177E4AE94AA149E208ED2EAF1EA8FDC
SHA-512:	4F98D3B3C23AF72F5B5556354C439DA9CE912CEA2AFAC202261BF47A4A59CB55CF158CCCDED095BD8B178EA05F9E3002608E03B4DF852A2A176DB9D5764D6D58
Malicious:	false
Reputation:	low
URL:	https://q-cf.bstatic.com/xdata/images/city/square100/977387.jpg?k=07aeb102ff72c498cfb8c4b92382aa6ada5fd4e84ad283aa8b387b072c9fd7d3&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......d.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....2x..&.C...\|.[.9......~.M..9#^...8. ...w.\...\|6.M...B......._?.U....<Mig..F.........Q......L.w.4....A#..G_.z..kA.k.X.G.}.`.......[....-.[[.....M..3....\.....<Y.e.P......w..x.....*Z:t$.\|#.\G.2+..{9'.A. ....l...7.mG...^h.........`.....,.v.e.5.9]\E.F.T.+.4.)/.......MP..E.....z)...}>._....>.t.......--.M.....f.2..Zv..+I..H1....lt..q\..6.$.]...R...i.=.:..

Chrome Cache Entry: 391

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5028)
Category:	downloaded
Size (bytes):	9518
Entropy (8bit):	5.435103517373332
Encrypted:	false
SSDEEP:	192:kIn7+TKVDUMMrNkzU8NXOdECKDiNE9l6c1ohanHDf/dw6clqn/Dg1uGi:km+TKVDUMMJv847S4eosnHr/dHc0Dg1k
MD5:	9B8F6F7CBF709AE0175D7186F51518F8
SHA1:	081032DFBD691D80924F382C95CA882C3D648584
SHA-256:	D977B0E2280F68D3CF988C969ADF8DEAC254AA21E682946E64D2DA6225C65C54
SHA-512:	FAEDB38D1C8B7462BA9BE2B712D48D7F2576E14131976C247C1F236AF1ED270CA91D85FA5DCD10E524C8CA508F1EF7539929BB61E6F6FA2AAC476802D4E37EC0
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/OtAutoBlock.js
Preview:	!function(){function q(a){var c=[],b=[],e=function(f){for(var g={},h=0;h<u.length;h++){var d=u[h];if(d.Tag===f){g=d;break}var l=void 0,k=d.Tag;var C=(k=-1!==k.indexOf("http:")?k.replace("http:",""):k.replace("https:",""),-1!==(l=k.indexOf("?"))?k.replace(k.substring(l),""):k);if(f&&(-1!==f.indexOf(C)\|\|-1!==d.Tag.indexOf(f))){g=d;break}}return g}(a);return e.CategoryId&&(c=e.CategoryId),e.Vendor&&(b=e.Vendor.split(":")),!e.Tag&&D&&(b=c=function(f){var g=[],h=function(d){var l=document.createElement("a");.return l.href=d,-1!==(d=l.hostname.split(".")).indexOf("www")\|\|2<d.length?d.slice(1).join("."):l.hostname}(f);v.some(function(d){return d===h})&&(g=["C0004"]);return g}(a)),{categoryIds:c,vsCatIds:b}}function w(a){return!a\|\|!a.length\|\|(a&&window.OptanonActiveGroups?a.every(function(c){return-1!==window.OptanonActiveGroups.indexOf(","+c+",")}):void 0)}function m(a,c){void 0===c&&(c=null);var b=window,e=b.OneTrust&&b.OneTrust.IsVendorServiceEnabled;b=e&&b.OneTrust.IsVendorServiceEnabled()

Chrome Cache Entry: 392

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65455)
Category:	downloaded
Size (bytes):	83384
Entropy (8bit):	5.767796320572483
Encrypted:	false
SSDEEP:	1536:0GivdyMckLJAEbMChe1MrxNilJe8R8PwM3:9k9PMmeeilJz4
MD5:	83471831394C7500698DE10F9EA84AEF
SHA1:	99215C6845EC25A3F0C0E42A8F295EDB92347D68
SHA-256:	3EB946A5BC2475320DA8FE164DBA4813191A29F2C38BA689B46A3B1130B4D50F
SHA-512:	5438F45E21B4CC4AAF380F7D993FD5DB0300BC68B6E0643216A1BBC3DE02B5B3431437244CF9B38C474DE12AF35FBD0C083D2DED7DA96C90601635C2CBB53F3F
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/1baf5a63.d24b4ba9.chunk.js
Preview:	/! For license information please see 1baf5a63.d24b4ba9.chunk.js.LICENSE.txt /.(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["1baf5a63"],{bca1141e:function(e,t,n){"use strict";var r=n("72bf8c83");t.Z=r.Z},e908bbd3:function(e,t,n){"use strict";n.d(t,{Z:function(){return $}});var r=n("3d054e81"),i=n("dee2534d"),a=n("ead71eb0"),o=n.n(a),s="a529739de5",c="fe04f404b8",l="f538ae62ac",u="a244555425",d="a6271fb6c2",E="edb4db1de8",_="e98333fe6c",f="bc476201ed",m=n("c91f1a4c"),T=n("975f4b85"),A=n("6356c4a8"),I=n("6229d898"),h="e714215256",N="cb32f1ced0";var v=e=>{let{title:t,subtitle:n,variant:r="strong_1",titleLines:a=2,className:s}=e;const c=o().createElement(i.Text,{variant:"small_1"},n);return o().createElement(i.Title,{className:s,titleClassName:2===a?h:N,subtitleClassName:h,variant:r,title:t,subtitle:c})},R={stars:"d542f184f1",strong:"bca48d277f",ratingWrapper:"d22e41465c",triggerWrapper:"ebc0e717e3",additionalIcon:

Chrome Cache Entry: 393

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HgNR:A/
MD5:	3851194BD6168AF36F3A1B0D40220BBF
SHA1:	D4784248223C272668D39AE79451487FCA724B5F
SHA-256:	D569ECFF0594B02CAFE6EF3B208BE21C0CCD40048FC7664B986C982196C5D5C3
SHA-512:	D015EDEA332EB099EF6D7C63247DE631C9681F7AF78C3214D9C49F96DE221975C6EAB6A02F0C52840462B77B116E3C3266403023E0BCE900B369BFF3260311D3
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAmM4aAcsTj4xhIFDRqnfHo=?alt=proto
Preview:	CgkKBw0ap3x6GgA=

Chrome Cache Entry: 394

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3035)
Category:	downloaded
Size (bytes):	203138
Entropy (8bit):	5.525957196220287
Encrypted:	false
SSDEEP:	3072:2XWUbMSWBWF/d0Iq28vjxSY+5lr8zj/QIOGZXIlM7vS09+:q3WcF/3P5kj/QIOGxOYvI
MD5:	382E81BB095E5483D3454D2BA7E88241
SHA1:	475793CC42AA92703A9104010EA7E0961D8E5544
SHA-256:	36ED228B88AF6BA495BCCDF66E6E3F90D8F99A3BD5B0669263DC2A508140C530
SHA-512:	D24E7C219C80EE6D455104A36FDF88EFA56847B2255345EC7D32313C6D91FBE5A78DC8AE35DDD4FE27BB2D2EC5079C309982B024D7A998D3326FFCE8685287B4
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/gtag/js?id=G-A12345&l=dataLayer&cx=c
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"},{"function":"__cid"}],. "tags":[{"function":"__gct","once_per_event":true,"vtp_trackingId":["macro",1],"tag_id":1}],. "predicates":[{"function":"_eq","arg0":["macro",0],"arg1":"gtm.js"}],. "rules":[[["if",0],["add",0]]].},."runtime":[ [50,"__cid",[46,"a"],[36,[17,[13,[41,"$0"],[3,"$0",["require","getContainerVersion"]],["$0"]],"containerId"]]]. .].,"entities":{."__cid":{"2":true,"4":true,"3":true}...}.,"permissions":{."__cid":{"read_container_data":{}}...}....,"security_groups":{."google":[."__cid"..]...}....};...var aa,ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ca=function(a){return a.raw=a},ea=function(a,b){a.raw=b;return a},fa=function(a){var b="undefined"!=typeof Symbol&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if("number"==typeof a.length)return{next:ba(a)};throw Erro

Chrome Cache Entry: 395

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (566)
Category:	downloaded
Size (bytes):	501379
Entropy (8bit):	5.661931638556031
Encrypted:	false
SSDEEP:	6144:o2upgm9JdG0ukPIPQCUhS1PeLGIBmQ9qh90y5KQy9o66+U7nlIlg:kgIJdrubH1WVBmbz0y5ENq
MD5:	CA50556EED6C3EC820E1E84B8B8C4C89
SHA1:	94B412B047930720EA1CF6E26279821859F6A666
SHA-256:	5AA02AD9EC4550065DE8002EA1108BE5D10BBB1173D2F3447F88CE1AF317D4BD
SHA-512:	ACF6180697B349825C18EC7372C894A455C44683A72C7416FE2ABEE46873A585BDBA99B0167DBE77BCA6582928DE4F01A41A79899F61F5B30E3974B8C159E1B8
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././.. SPDX-License-Identifier: Apache-2.0././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var A=function(){return[function(d,k,C,e,p,t){if((((p=["pageYOffset",8,"scrollTop"],d-p[1]<<1<d&&(d-2\|28)>=d)&&I.call(this,k),4==(d>>2&14))&&(e=k.scrollingElement?k.scrollingElement:!C7&&f[36](9,k)?k.documentElement:k.body\|\|k.documentElement,C=k.parentWindow\|\|k.defaultView,t=EM&&C[p[0]]!=e[p[2]]?new B7(e[p[2]],e.scrollLeft):new B7(C[p[0]]\|\|e[p[2]],C.pageXOffset\|\|e.scrollLeft)),3==(d^56)>>3)&&(this.G=k,this.H=this.F=this.P=this.A=this.Y=0),(d&74)==d)try{t=k()}catch(Y){t=C}if((d\|48)==d)try{t=f[7](2,.1,k).getItem(C)}catch(Y){t=null}return t},function(d,k,C,e,p,t,Y,E,B,l,V,Q,r,J,S){if((d&((d+5&57)<(24<=d>>(S=[44,1,0],S[1])&&13>(d<<S[1]&16)

Chrome Cache Entry: 396

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10609)
Category:	downloaded
Size (bytes):	10721
Entropy (8bit):	6.147379849563543
Encrypted:	false
SSDEEP:	192:SQh8Cv7u4lugnDPTpOKkyvEYL7FuZ/PwQKSyjCjBGhILKMScqndZf3L:l7bluiwnyv3oXc25XScqXfL
MD5:	449F8ABD0585D68506A1E46AD4A8BBAD
SHA1:	D49E42C22BAA66DD9E51F38E8B1C348D782A9580
SHA-256:	C8D614605EE23556F294DB3FF2B379E8D25654661BFF372E6CAAF98EFC3110C9
SHA-512:	46710120F6E51A8B12D4263847155CEAC7F59E2EC0A076B331949A33C8FD26D4A687A7741B5968028045DD6B4C22B8A5A0A33F3BA9106C927F05A5003D6B3356
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/c6a78acb.9b7b7bd0.chunk.js
Preview:	"use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["c6a78acb"],{"07390ddb":function(e,t,A){A.r(t),A.d(t,{default:function(){return R}});var n,a,E=A("ead71eb0"),l=A.n(E),i=A("dee2534d"),Q=A("dc6d28ff"),B=A("d1e54a96"),C=A("c44dcb0c"),m="c779636eef",r="ff75376f23",s="f433c16992",h="ce6613f3e7",g="f742f17cff",c="c6286cd018";function I(){return I=Object.assign?Object.assign.bind():function(e){for(var t=1;t<arguments.length;t++){var A=arguments[t];for(var n in A)Object.prototype.hasOwnProperty.call(A,n)&&(e[n]=A[n])}return e},I.apply(this,arguments)}var q=e=>E.createElement("svg",I({xmlns:"http://www.w3.org/2000/svg",xmlnsXlink:"http://www.w3.org/1999/xlink",width:104,height:65,fill:"none"},e),n\|\|(n=E.createElement("path",{fill:"url(#prime_svg__a)",d:"M0 0h104v65H0z"})),a\|\|(a=E.createElement("defs",null,E.createElement("pattern",{id:"prime_svg__a",width:1,height:1,patternContentUnits:"objectBoundingBox"},E.crea

Chrome Cache Entry: 397

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 398

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	92562
Entropy (8bit):	5.854001294905316
Encrypted:	false
SSDEEP:	768:ODlxWTLjub9/mTACrp7vVcEBbynDw9JXBZijOX2ob4b:+NmfrtvVcEBbYD6ij9b
MD5:	D2E841CB3B0B0274A4196FD767D65EDB
SHA1:	24BE8A2C78BB2B763B7221DC2EAB540E4EE7DDA5
SHA-256:	2D74100A825FC1A4AF9272C442187CA4005D0DC1B7B8B61066E02059ADA4AB13
SHA-512:	3DE87B27C9B08226FEC55CB021C030BC1741AE44BD45B56D5E41B1D924B838FD5526874D547C13C294AA93A5F94A309FE5D337DDC9DF2E796341CFF3E74BD450
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/accountsportal/assets/45_1975cbc2f7eaad75f590.css
Preview:	.qNyS_PJsDl7qLq362De4{display:inline-block;vertical-align:middle}.QZbE_RL6_EYX18qNinNM{display:block}.g2P7vZdOVg8A40TmQACw{opacity:0;pointer-events:none;transition:var(--bui_timing-deliberate) var(--bui_easing-slow-out);transition-property:opacity,transform,visibility;visibility:hidden;z-index:var(--bui_z_index_4)}.g2P7vZdOVg8A40TmQACw .RmXZd1TVuqP5UvtHbnIb{display:inline-block;pointer-events:all;vertical-align:top}.g2P7vZdOVg8A40TmQACw.AGqFf8vdMJmSUDnM5_NB,.g2P7vZdOVg8A40TmQACw.BWtTA3sqw5D2se8pGm3s,.g2P7vZdOVg8A40TmQACw.hPdBN7sWTiDFklin9Ley{transform:translateY(calc(var(--bui_spacing_4x)-1))}.g2P7vZdOVg8A40TmQACw.AGqFf8vdMJmSUDnM5_NB.QtQrjwvMNp0vnbkvkxSA,.g2P7vZdOVg8A40TmQACw.BWtTA3sqw5D2se8pGm3s.QtQrjwvMNp0vnbkvkxSA,.g2P7vZdOVg8A40TmQACw.hPdBN7sWTiDFklin9Ley.QtQrjwvMNp0vnbkvkxSA{transform:translateY(calc(var(--bui_spacing_2x)-1))}.g2P7vZdOVg8A40TmQACw.D21MXVeY7EMOaLr6QjKW,.g2P7vZdOVg8A40TmQACw.KUL33ODxqxASTZvNvzzG,.g2P7vZdOVg8A40TmQACw.oBJ9GnCdOvFWQfBElSu7,.g2P7vZdOVg8A40TmQACw.qfL

Chrome Cache Entry: 399

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	68
Entropy (8bit):	4.579103649628449
Encrypted:	false
SSDEEP:	3:35SFHm2CM8WeJnQJnvpYkn:cFHJu1a9
MD5:	3CEDF1398F8891FAAB818514B28EA7C7
SHA1:	910BD19FBD7C13ED936D8320251A9D3DE4F79EDE
SHA-256:	D502855A360A67307C0E88EF9FE7806629F562F1C7C0F3D916E03521401250A7
SHA-512:	1A1C3EEB0A316E8BB3B4B9F819D1AF917A2E247F97988DF51ABB8E534A15AC07EA0CFD219CE0626A39AE1BDDE4219472A6244C22F0BA2AA47F13A3B9FA0B0DBF
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAlFuT3KP9CZsxIFDUWnAYsSHgm18MmG4UjH2hIFDbDytpQSBQ2w8raUEgUNlJCS-g==?alt=proto
Preview:	ChQKEg1FpwGLGgQICRgBGgUImgEYAgobCgcNsPK2lBoACgcNsPK2lBoACgcNlJCS+hoA

Chrome Cache Entry: 400

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2559), with no line terminators
Category:	downloaded
Size (bytes):	2559
Entropy (8bit):	5.95457257686001
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08r/XAt4VHIhFtzYig3tKk6:wsbSUtJfxrqLWWWdV6j1PXAyHoXyW
MD5:	A3CB4874C54B1A4D0099BBADC3FC34D9
SHA1:	36A68DFD8A3A75DD65F7FAC86371026A9F83D7DD
SHA-256:	B10710AED79EB290F45A8C724350422D60942206DEC311FE675A240DB767BC53
SHA-512:	FB5A4D8B1E74ADD2D0ED84B19C00A79CE31E5DF8C7A1166C48B5DA6309F6A76FC27502E2EA43EA054750B7E2D10F2BF77FADDA27C8A660EE1EC04D2C38A4CFA6
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/973712236/?random=1707417370629&cv=11&fst=1707417370629&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=8GRyCJ3Eq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 401

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	downloaded
Size (bytes):	413096
Entropy (8bit):	5.355713339434267
Encrypted:	false
SSDEEP:	6144:PP2yt+VxNn3VM3xfrnCdWPGSBE7qoHSqCrvpIDyP9ucHHs:XsVxNnqpBE7qVvprs
MD5:	53E75BD25E32C985E8459EBA598E5E64
SHA1:	9765A64B1E9C9DEA4ED7C93D619E59CE7EA2D1E0
SHA-256:	ED3A69E3267F056582ED012F7252319ADB227FED203A4781EB820EA732AA4594
SHA-512:	05680972387E0B4D04470F3F4F2F203F9B7DBA867FF1847E39E13476293550ABE8998859B4E52E3FB308ABB7D7C6280968F828813FC023E826042AE9DB13158F
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/scripttemplates/202305.1.0/otBannerSdk.js
Preview:	/** . * onetrust-banner-sdk. * v202305.1.0. * by OneTrust LLC. * Copyright 2023 . */.!function(){"use strict";var A=function(e,t){return(A=Object.setPrototypeOf\|\|({__proto__:[]}instanceof Array?function(e,t){e.__proto__=t}:function(e,t){for(var o in t)Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=t[o])}))(e,t)};function I(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");function o(){this.constructor=e}A(e,t),e.prototype=null===t?Object.create(t):(o.prototype=t.prototype,new o)}var L,_=function(){return(_=Object.assign\|\|function(e){for(var t,o=1,n=arguments.length;o<n;o++)for(var r in t=arguments[o])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e}).apply(this,arguments)};function d(e,s,a,l){return new(a=a\|\|Promise)(function(o,t){function n(e){try{i(l.next(e))}catch(e){t(e)}}function r(e){try{i(l.throw(e))}catch(e){t(e)}}function i(e){var t;e.done?o(e.value):((t=e.value)instanceof a?t:new a(fun

Chrome Cache Entry: 402

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/975716499?random=1707417344655&cv=11&fst=1707417344655&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1
Preview:	<html></html>

Chrome Cache Entry: 403

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (28522), with no line terminators
Category:	downloaded
Size (bytes):	28522
Entropy (8bit):	5.360107557703449
Encrypted:	false
SSDEEP:	768:kmh/ar13kmCljGstsjvRxVrWGW3bbJ+ZiVUGHckDENuh4XLx2MLEFdtsElADt9MS:oCIEjSuwDBt
MD5:	65BB69885E04A5E5D6825F1DD875645B
SHA1:	900EE5C9E2E45B29923B7536B1901D2893C90E8B
SHA-256:	388C3E8B7DC8F34D0FC03323B822DFE6B3557CAA563F6EBF789D3885741E112B
SHA-512:	16024BAD592C18E4A05F3C72F6E0F7D539B77C3C3288C199EB4AE2058A059970C68D8B903BDCD33CB258C60E94C48F77DB506FCF2FCA13DA175C59112DE70DCD
Malicious:	false
Reputation:	low
URL:	https://s.yimg.jp/images/listing/tool/cv/ytag.js
Preview:	(()=>{var e={999:(e,o,t)=>{const n=t(201),r=t(599);e.exports={tracker:n,ssaTracker:r}},768:e=>{const o=/^GCL\.(\d{10})\.[\w-.]+$/,t=e=>{const t=o.exec(e);return!(!t\|\|2!==t.length)&&(n=parseInt(t[1],10),!(Math.round((new Date).getTime()/1e3)-n>=7776e3));var n},n=e=>{const o=e.split(".");return 3!==o.length?"":o[2]},r=(e,o)=>{try{const n=e.localStorage.getItem(o);if(n){const e=decodeURIComponent(n);return t(e)?e:""}return""}catch(e){return""}},s=(e,o)=>{const n=e.cookie,r=new RegExp("^\\s"+o+"=\\s(.?)\\s$"),s=n.split(";");for(let e=0;e<s.length;e++){const o=r.exec(s[e]);if(!o\|\|2!==o.length)continue;const n=decodeURIComponent(o[1]);return t(n)?n:""}return""};e.exports={getClickId:(e,o,t)=>{const i=[];let a;t.yahoo_ss_ycl_cookie_prefix&&i.push(`_ycl_${t.yahoo_ss_ycl_cookie_prefix}_aw`),t.yahoo_conversion_id&&i.push(`_ycl_${t.yahoo_conversion_id}_aw`),i.push("_ycl_aw");for(const e of i)if(a=s(o,e),a)return n(a);for(const o of i)if(a=r(e,o),a)return n(a);return""},getNonCookieStorage:r}}

Chrome Cache Entry: 404

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	downloaded
Size (bytes):	5928
Entropy (8bit):	7.926017675472102
Encrypted:	false
SSDEEP:	96:ghIEuAUbFU7h4TP7yDg3y14lQFba7y+hxNADYxOc39yczZMXmnOKTHzhJz:mIxNpUtU7li14lQFm7y+b393WXmLTtJz
MD5:	BB290168F7786611283C023BDDE3C8E9
SHA1:	3ED9E7A50403500F00D2A9BC8D12A0B626065A14
SHA-256:	B82717756DA632DC8ABE664FC4238D3B91F8CDA4B801308D5B6FEAC4B6AE61A7
SHA-512:	8A90706148742B94CCB23EA04453F07CF6FB24884F778BAD179EAC221930FB24F7F8A3B9300BA50AAE40AC052D4D72AE91D2F4386CA81295F37DF520DD820CF5
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/city/170x136/977416.jpg?k=ea06e0b572ff052f4fe4fcf35ac3616e8d1b7300f0402756c460a4e9c19e54ed&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...v.N..+....m..m...)..Z9..ai.j@..s.(..<.p..=.\v(.5..u:.Y#'..?K.:.....\|...f#.S5..}..\X......I[uX.P..b.vI'..q..J.I.c..HV.......K...iv...)....j@..s.).SS+.:....l..7..MJ..m+.).......E..4.M0S.;......O..;...L..E..8SE>..c..~.%....E.x.'....._.j..[..A.<.. .x.5o....m..6.f%..N..W1..k..K ..aJrv......~AF.G.Dw......f.4r.....2X..*.....q.m..p..p..i.iE8R.r.Zp.....aqJ...)\\|.

Chrome Cache Entry: 405

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 406

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 210x210, components 3
Category:	downloaded
Size (bytes):	10198
Entropy (8bit):	7.945091237788509
Encrypted:	false
SSDEEP:	192:myPEYawsByNpqTbfZiJAgDH5O0xS3GSBZ3+92wXDsnWajlhJQM:dFNpqTNSw0xkZnWajfWM
MD5:	017B94110A7E501229461904DE5F60EF
SHA1:	9DD4E626007122C59267B53E2D497D24002A0165
SHA-256:	70F0B164136D459CF84DA543EF790A7D6BBC86E32348A84E8059F7BDA63C2C5E
SHA-512:	097478A690E33B49B2CE3AC3709275E2269549B28F11B5D9BECB6B875BE36C997F4F244A0B9EBC75DF124680CA3A0FA6CA692822B90213DE4B48CC24FE9D0E3E
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/city/square210/977415.jpg?k=fa67e6f0e70c09f18c4181bef46164f0406fbd367cad543314a3c748bfc7e411&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..GJP9...z..<.k-8.N.+..Zr.T.i.0x..6$SR...O.....,.=y..4...9.1.i.Zi.D.FN:Ss...EH..(...^.;.\..Z.R.b....)......A..xa...'.....@..OZ.s..-G...U..`=.\|...*A~..G..$...4..'...n..12 ...g..B....s.J........R]P./ .C..U....a.5.z...+_A.Rm.6.-U..Z.W<S.6v.jo.M.s....".Y.......$.........)@...Z...@..(_jpZW........J....<.4".G.......(._.w.O...K$.....I........C.+NP.Z~(.(..F.

Chrome Cache Entry: 407

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	5854
Entropy (8bit):	7.967728072496439
Encrypted:	false
SSDEEP:	96:CqjIEM8WTxQXti3hjYwnP8Jq/D5HeW5bcUjqvXIsyLm79D+SwPM3JKqwX:Cq8DxQXBwnP8Jqr5Heobtyy++Sw5qo
MD5:	83C1DB9FC7A4B569F8F30C07F3AF2F55
SHA1:	AE72744D12A5A2E1BF1E12AA37097A5E05B71726
SHA-256:	E57247C38D6EE6938FDCB39AF3E71DFDEC4F2BCE7357DD7E3A88D79EA636CECB
SHA-512:	2666F9C1B0A996B5D11CB61D8A77B211DFC4DD5BAFC2FCB15890198B36BDFD0CE76FAC005FACB51BFDFB095957996D9A4C90EA3128651E6B6E12BD872882F43A
Malicious:	false
Reputation:	low
Preview:	RIFF....WEBPVP8 ....P........>m0.F.$"!.V.....cj..._....\..`..W9;....^..3....{..o2_....w..`.L..=?.x}wt\|.u./m..p..]..iv..K~...o.p.z..zlm....5n....bs..YF..$.t.......T..Kr.>.'.<.!Ek{....C.W..?^Bj9.4.7.....xE.z.t..Z..=X^pYi.O.8......D..I......+.vMDQ.t4....m.....-}.'J.=...~..u{2.qr.\|.6.U.T .v.&..nhOt\|.T..m.yr..a...._3...B$[..\|..S{B..D.F.s.......N.Gx......\|.c;G.<.]m.<...n..H.T!.p..l>.....].....=H)......e..../...m.....Min.7.......fn.;..R....rMp..p=.U:.M...kPE3C.v...9.M.<Lr..1jx.....D. .....hO-....O.5d.Q.D..7bUm.8..>.&F.......qA.............W...Y.!l.N..........'..T.X_.-Y.\H....$W.HU....8..S+b.).=.._....y@.Al...Ff..{#.\..-.</.B.G{...D..b.1."....l.....A..'.m.^x6v...).6.=#...O...w".....v.K..n...h....k...{..:Jpc..BlQ....E...[...B4@E.O...z...1..Tte"...}..xYf.=....o...3..:.l.".m<C..~.-...}.........J..O.J.0./Q-.@I.@...>..W.5].G..!3.d..T......../...M.F...=.$.%^.d..3.K.,....h.A..P..fP.p.J3.r..EIQ...x._.{Z..&`....r/{..NuZ......0.P.l...J...

Chrome Cache Entry: 408

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1175), with no line terminators
Category:	downloaded
Size (bytes):	1175
Entropy (8bit):	5.165211296123877
Encrypted:	false
SSDEEP:	24:d9VlT3AO+YgA1bF+dxAc5v8zk1I1gAxmTcw7545aphZQ:jTQYgF4cLCG5454S
MD5:	016FB33BF364D240CE6C84A44F2F373E
SHA1:	B10F2654AA073B29EC282635FD646721FFAA237B
SHA-256:	FE9DE8A5A2C28664072AFEA737F96725927201921503755BCAAA170C57AF48A4
SHA-512:	43AFF3ACDF08954DBCB143A17E3090F7FBC30490C512821F94DA1E179F1B7F1E857CDDE461F5A7C7839CDAA82816E552DDD5C300F57981BCBB51BE6CEE234469
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/landing_pages_common_cloudfront_sd/5d6270f9d99467ef1f2d14da9abb86c291f4bb0b.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(i){return i};function equalizeHeightOfItems(a){_i_("5c2:6c1a307b"),a("section").each(function(i,e){_i_("5c2:d7823cfc");var t=a(this).find("[data-equal-height=true]"),c=-1;t.each(function(i,e){_i_("5c2:173d93c7"),c<a(this).height()&&(c=a(this).height()),t.css("min-height",c+"px"),_r_()}),_r_()}),_r_()}function executeLineClamps(n){_i_("5c2:0372db01"),n("[data-line-clamp]").each(function(i,e){_i_("5c2:dc29b2ee");var t=parseFloat(n(this).css("line-height")),c=n(this).data("line-clamp"),a=c*t;n(this).height(a+"px"),n(this).css("overflow","hidden"),n(this).css("-webkit-line-clamp",c.toString()),_r_()}),_r_()}B.when({events:"ready"}).run(function(){_i_("5c2:efd94133"),$("img.lazy").each(function(i){_i_("5c2:e17279d7"),$(this).attr("src",$(this).data("src")),$(this).removeClass("lazy"),_r_()}),$(".lazy-background").each(function(i){_i_("5c2:3fcb02fa"),$(this).css("background-image","url("+$(this).data("background-image")+")"),$(this).remov

Chrome Cache Entry: 409

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	"https://www.booking.com/js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=87e482caf42702d0&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|4,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|2,cCHObKdBdUHINPSXeHDALOLOLMO\|5,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv="
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 410

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	13702
Entropy (8bit):	7.98538893707152
Encrypted:	false
SSDEEP:	384:ucPgUoLu+dlEq41mrZjA2toUk6olz2Wyj:5TwHdlEIrfeaolqj
MD5:	32C878D94703CEDB9A4127314C17BFE9
SHA1:	566D98CF4E2163DD9F44095AD40E45080D3F8D0E
SHA-256:	9D6601997CB7F568940D4175721E60E668F0B5727E51DDC702E17364A6B5AD28
SHA-512:	E6097116DDA29D5CBE28400157373794C30A10E68B5712F32B903E2195CDCAD2F2B82A3AC99FE3EA71C80A5FE4077E04E360428E89579CF430CCC42CFAE310CD
Malicious:	false
Reputation:	low
Preview:	RIFF~5..WEBPVP8 r5..........>m,.F&#..<..`...}.Z.[..}.c(/.W.o...5.[.'...k.k....x..W..........>......?.=.........$.........Y.....~....../....E.......7....&~....../.?...=.?..........?m..<..........E......._.9.<..$."m....B....H.A..s....X'[9.vt/}`I4o.........o{gKh.0.-....=.....^....t.....Nl.....t..........F.PvC[ ...x..o.o^.....~d.Im.~<!m.hT.2...ia.i.\|.'....b@.g..L1M.Jk...~z^.2...............AQlp...I......'...X.)....[a...?D.3..R.....h\....E.]_.x...i........"i.K.\.2aHvy?l..gG..]...p../.V7...nQ"..d}....P.......1`i.R../.s. .wA.?.C..P....m._.:.".._......s9J.WmY.....f..Q...E2.!.syK~.....pt.U.%.~.e.c.0.....c.`.....S..N...]........5..8...v.....J. 6.x..^.#..._k.~*.....4....n6{='...N:..gq.# ..Zc..bn.6...2\|..e.h.......%[.v.v.4...W.j.<.I.V.v..............=>"3^M..^-..2..OQ...........,.?..@...Y!.`W."Y..G...v.6!.....qO.t.<'..@.I...%7.I.Fy.....az&+.K.....G._.'...f@...H...sD.....y.f........Af.M-k...?.4&...,....!...#(.J.. 3.u...qr.l8..n......x.G.g>..m[.C.....#...\..3.Ix

Chrome Cache Entry: 411

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (54061)
Category:	downloaded
Size (bytes):	901725
Entropy (8bit):	5.11887638830887
Encrypted:	false
SSDEEP:	6144:z9OTQgBNPrjRBux9oDNK14LPtTZHKif3kdP:z9OTQgBNv+xCtKif3kJ
MD5:	3B4798572DBCC83C3D78CF79973FC48B
SHA1:	5371E44D7D85762601A05FE61298BFCA8B066F05
SHA-256:	2E55A9EDE7FF15494F392A99AF4C958B37D3D808BF8A7B50D14503A42E4BEBB2
SHA-512:	8D46CDFF92C487C8D6016A1E868B2AC57BB8D681B7A35A97E1F2771743D8CD506E6E8C7FCE2002397ADCB667A577CABF5FE58B237BD52CEE5A3C3EB5034133FF
Malicious:	false
Reputation:	low
URL:	https://www.booking.com/flights/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=5171fc655664ddf74ab763a094523fb7&from=booking&
Preview:	<!doctype html>. .. You know you could be getting paid to poke around in our code?. We're hiring designers and developers to work in Amsterdam:. https://careers.booking.com/.. -->.. <html lang="en-us" dir="ltr" data-device="desktop">. <html lang="en-us">. <head>. <meta name="robots" content="index,follow">. <meta http-equiv="X-UA-Compatible" content="IE=edge" />. <meta charset='utf-8' />. <meta name="viewport" content="width=device-width, initial-scale=1" />. <meta name="msapplication-TileColor" content="#ffffff">. <meta name="theme-color" content="#003580">. <meta name="msapplication-TileImage" content="https://flights.booking.com/icons/mstile-144x144.png" />. <meta name="msapplication-square70x70logo" content="https://flights.booking.com/icons/mstile-70x70.png" />. <meta name="msapplication-square150x150logo" content="https://flights.booking.com/icons/mstile-150x150.png" />. <meta name="msapplicati

Chrome Cache Entry: 412

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	39328
Entropy (8bit):	7.91647038087011
Encrypted:	false
SSDEEP:	768:sTr4PLxNiNEPGcuQ/a6fnySk3mlP+QbesnAnQ8Bno8ZKSUTWeO6d5ptuFO:sgPi6PGcuQ/aenypup7AnXnoCKFTW7q3
MD5:	417CE707E1BFD94EF710E908C06D973E
SHA1:	A2B3D1C72C9CC57F52DFBCC528649E73D43C5C2F
SHA-256:	1022F1662F9F02AC55DC95402144F2AE71D6F0A14C19B3E3041B68B529946CFC
SHA-512:	CF11FA71A5146A66B36D0CD33DC0805FF8B9DF3A6A8366F6D30EBF071E355E0CF5936B0E0A4D1085F392F17F0D01EB418F0D2E24C6315D198C5E346EAC3F4125
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR....................IDATx...X.V.g..t.l6u.M..l.f.{.n..q.)N..8v.n.{...1..cc.j0...7......6}....3...\|..G...J3..;..+.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.tz........C....E.X..b.v..]A.....;)Aw=.....m.....u...........Q\...P.N..B.W..b....f...X].:o.ejE.j1o..

Chrome Cache Entry: 413

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	11060
Entropy (8bit):	7.982849666998035
Encrypted:	false
SSDEEP:	192:+y5J3DyXWVZe8CL+v2k5CNvYp+HCCZMD0I9MRBCLY4E6vhsSinkPdaH9sTTynI6C:5Ty22ACNUV+MII9MR0LY4rri6GG/yRC
MD5:	ADC5E6B0D1AB49C25CCB97528048BB9F
SHA1:	B962E347B0820DA723C877113A69B7E092DBF431
SHA-256:	8F797CD1C62D01F1B4F139E4F0591E7F4961AE33100C864CC7BDF4E202C942DE
SHA-512:	934B82E5D019EF8B998EC4F1373E2AD7AABD6FC73DCBA68D4AB4CCABDC280E1333059637E8C0568DA01808A8B8B21507E9748F6B93695517D343BC6DAEF70207
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/square250/977416.webp?k=ea06e0b572ff052f4fe4fcf35ac3616e8d1b7300f0402756c460a4e9c19e54ed&o=
Preview:	RIFF,+..WEBPVP8 +...........>m0.F.$"..2....en.0<..>S.?Z+.>?.w......C.......>.......~.~....>.K}.#.7_..........9.....?....E}+~.....$D.J.2xRN`...]s..7x.5r\| .fr....d6{....'Y...Q..........p.J!...J.G....}_5a.%..!O._r.C........0.N.....K...u.k....PfX.)y..r.....Z..r..T...X.:...p......>....5.f.}.y$.9.......M...^...]?..d.........~&.8Y../>....u..V....tn....I.W\..}T.......$.by....bN,..'(.eb..m."...........W.uE..k..\.....X....}....:\|...,.._.......2l.b..=q.afl~k....r....9..,{.$.07.@.R...+..^h.m..dh..z.P_...g.8O;.J...R.?........P..6J..h.@...h..fD.....x..'.&,W.OR.req7r{8y...v3..N.[.q..@4..G..'........s#4..w...E].t..w.A.E......7C........}..I..O..Q-..:.Y-.{.v..g..g..U.W..~iI.AN!...........@dz.< .....+...Tt4..N.Y....QGW.p=..\.w..wh{.ZL.~.\|.f..'...e.s/6..PK.:h1...#2.4..FK...>..)j..Z.#..............5..T.... ......^ /,.]N...#..s..k./.=..^..Q..9&.(.,m^^2EF&Q....c[.uYx..[......?.A..3VM....".[..D..5...j........K.3...,%.&...M."..)Q.....< }.q.....

Chrome Cache Entry: 414

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	"https://www.booking.com/js_tracking?ref_action=&ver=2&stype=1&lang=en-us&pid=feba38c8c78949209e6dc34689f0c290&ete=&etg=&etcg=&ets=YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|7&etgwv="
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 415

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 32x32, 16 colors, 4 bits/pixel, 24x24, 16 colors, 4 bits/pixel
Category:	downloaded
Size (bytes):	1582
Entropy (8bit):	2.0935949490559387
Encrypted:	false
SSDEEP:	24:KqH7QNbKDCaVH//zkVKaklSvDBkNothKK1suC8GCODul:fsN+lH//a7iNsj1RGY
MD5:	FAEDFE66CF96784098C9B7B1F405EF12
SHA1:	645DCE7842FA7483BB676DEF6DF255317F203F22
SHA-256:	A87EC2239235E2521BEBE6F92DC4A65CA035FD419EBD09B68D04B989AFD3141A
SHA-512:	26EF8C32AA51607F3A2C8F517D3A7578FB5F5B6D623581D5BDDC54FC458658E7376263D8511147CFC7A3A507DC51E295382A1FFBDE510C59445E6911AAACD47C
Malicious:	false
Reputation:	low
URL:	https://flights.booking.com/favicon.ico
Preview:	...... ..........6...........................(.......(... ...@................................5...M...jC..)...g..........................................................'w...............w....................................................................................................UUUUa...3.......UUUUU .330......UUUUUQ.330......UR.&UR.33 ......UR..UV..3.......UR..UT..........UT..UQ..........UUUUU`..........UUUUV...........UUUUU...........UR.EU`..........UR..Ua..........UR..U`..........UV.EUa..........UUUUU ..........UUUUV...........%UUU@.......................................................@...............q...............w..............wwt............'w................................................................................................................................(.......0........... ....................5...S...jD..>..........................................................w...............................................................UUT`.31.....UUUV.33....

Chrome Cache Entry: 416

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	downloaded
Size (bytes):	5928
Entropy (8bit):	7.926017675472102
Encrypted:	false
SSDEEP:	96:ghIEuAUbFU7h4TP7yDg3y14lQFba7y+hxNADYxOc39yczZMXmnOKTHzhJz:mIxNpUtU7li14lQFm7y+b393WXmLTtJz
MD5:	BB290168F7786611283C023BDDE3C8E9
SHA1:	3ED9E7A50403500F00D2A9BC8D12A0B626065A14
SHA-256:	B82717756DA632DC8ABE664FC4238D3B91F8CDA4B801308D5B6FEAC4B6AE61A7
SHA-512:	8A90706148742B94CCB23EA04453F07CF6FB24884F778BAD179EAC221930FB24F7F8A3B9300BA50AAE40AC052D4D72AE91D2F4386CA81295F37DF520DD820CF5
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/xdata/images/city/170x136/977416.jpg?k=ea06e0b572ff052f4fe4fcf35ac3616e8d1b7300f0402756c460a4e9c19e54ed&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...v.N..+....m..m...)..Z9..ai.j@..s.(..<.p..=.\v(.5..u:.Y#'..?K.:.....\|...f#.S5..}..\X......I[uX.P..b.vI'..q..J.I.c..HV.......K...iv...)....j@..s.).SS+.:....l..7..MJ..m+.).......E..4.M0S.;......O..;...L..E..8SE>..c..~.%....E.x.'....._.j..[..A.<.. .x.5o....m..6.f%..N..W1..k..K ..aJrv......~AF.G.Dw......f.4r.....2X..*.....q.m..p..p..i.iE8R.r.Zp.....aqJ...)\\|.

Chrome Cache Entry: 417

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/ga/rul?tid=G-FPD6YLJCJ7&gacid=421694156.1707417338&gtm=45je4250v888381215z879615461za200&dma=0&gcs=G1--&gcd=13l3l3l3l5&npa=0&pscdl=noapi&aip=1&fledge=1&z=1288257743
Preview:	<html></html>

Chrome Cache Entry: 418

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	68
Entropy (8bit):	4.200601260429725
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM09/Woz59tVp:6v/lhPfZM09tzjTp
MD5:	C4A2B870062C2BB98C500BC1526C0498
SHA1:	528666CCDB12997358077BC8FCDBFB6B825C7788
SHA-256:	2AA4FA20701CDD6D8D56046069001186B5267E3EE7D0EF618AD2F4A683723E11
SHA-512:	2F1A3ABCD12125F7EF18D61A960901C0FD6F82DD02EA2B8041859E6D5F0A7F08DB17CC110DC6D8A3F7D0D1BA790C4BCCA2506D3C60EDFEB5CB29433E9F4F762E
Malicious:	false
Reputation:	low
URL:	https://tr.snapchat.com/p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=CUSTOM_EVENT_2&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e&u_sclid=75022d4d-ae50-4a02-8ab1-d3d7e0695f9e&u_scsid=15e0a621-1144-485d-901b-09bb638d2936&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&huah=true&m_dcl=8009&m_fcps=7323&m_pi=7989&m_pl=15337&m_pv=2&m_rd=17436&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F&trackId=559cb617-2573-4523-9e5d-f09d91c1516c&ts=1707417345126&v=3.9.1-2402072137
Preview:	.PNG........IHDR....................IDATx.c`...............IEND.B`.

Chrome Cache Entry: 419

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	downloaded
Size (bytes):	8350
Entropy (8bit):	7.9431995395937385
Encrypted:	false
SSDEEP:	192:mIoyumNqtrhRbdqcm5XtTGb9TohlBUUPRpv9+HSJh6:noybNcrhRbJWXtTGbWPBUUZp846
MD5:	DEECEBFD96AFF60E10FD5E8D298F2E6A
SHA1:	45029E4B67085DA726802561C0B595862620D62E
SHA-256:	2F448C79E56FDF2F2C5C1D9C7FCA9DAD527EEDE734BFB329ED1303D54D365A70
SHA-512:	76B3ABA23CA9623D3D52C24ACEEB99C3EC7C06BB7136A6C109CAB6758CDCCDDD2CBFA4EA8FF829376FA9966C9EB8EA03D82B1FA62EC9839C53E3DA10268068A8
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/city/170x136/976877.jpg?k=2aab28217f0fb039e0f35ea2b2c3976141b5860b074f74220edf998115935cda&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...i.kXl...Q.B.?........B.fxc'i.7a.J..y.{..K.......`.V .....j.......#x. ..=.....k.\.Y.r..6V......D..A.<...y..x.LM?Sx.:..s)S =.?w.s....Y-.+....>.8..C..Y.=....7FG .a.......q..W).$.......v1..t.}.v.%...]..\...c....Q.5..sqr.uX....k....:.=.4... ...I....V..3.....I....+/.?..J...).A.@......X..g1....3.Z6...8==G9...:....3.4I.,.s.......qNo.....$....*...A.sZ5N.M.W..

Chrome Cache Entry: 420

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65455)
Category:	downloaded
Size (bytes):	83382
Entropy (8bit):	5.767709316086417
Encrypted:	false
SSDEEP:	1536:mGivdyMckLJ/pbMChe1MrxNilJe8R8PwMF:Tk9BMmeeilJzK
MD5:	725EDC238B6BE7AB351E6686B8B2B8E8
SHA1:	CE0F7D51CCABE7362BE9EAFF282F7BD91B557D49
SHA-256:	9041E58D9FD11519BADA1EC9A8B1CA612EEB728BC239AF8335A1309B862A2559
SHA-512:	50E42479D8456DE60CCAE8435D58D87676F4720535621835F456FC6BD843B1AB3A0A5FF4C61131D5D79C409E268B8D855FFA030C74F45AD4BA754D7F71B10E5F
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/445be7a9.e9bb815f.chunk.js
Preview:	/! For license information please see 445be7a9.e9bb815f.chunk.js.LICENSE.txt /.(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["445be7a9"],{bca1141e:function(e,t,n){"use strict";var r=n("72bf8c83");t.Z=r.Z},e908bbd3:function(e,t,n){"use strict";n.d(t,{Z:function(){return $}});var r=n("3d054e81"),i=n("dee2534d"),a=n("ead71eb0"),o=n.n(a),s="a529739de5",c="fe04f404b8",l="f538ae62ac",u="a244555425",d="a6271fb6c2",E="edb4db1de8",_="e98333fe6c",f="bc476201ed",m=n("c91f1a4c"),T=n("975f4b85"),A=n("6356c4a8"),I=n("6229d898"),h="e714215256",N="cb32f1ced0";var v=e=>{let{title:t,subtitle:n,variant:r="strong_1",titleLines:a=2,className:s}=e;const c=o().createElement(i.Text,{variant:"small_1"},n);return o().createElement(i.Title,{className:s,titleClassName:2===a?h:N,subtitleClassName:h,variant:r,title:t,subtitle:c})},R={stars:"d542f184f1",strong:"bca48d277f",ratingWrapper:"d22e41465c",triggerWrapper:"ebc0e717e3",additionalIcon:

Chrome Cache Entry: 421

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/975716499?random=1707417370697&cv=11&fst=1707417370697&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=mzmpCMbAq1gQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1
Preview:	<html></html>

Chrome Cache Entry: 422

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3070)
Category:	downloaded
Size (bytes):	3186
Entropy (8bit):	5.185231249127626
Encrypted:	false
SSDEEP:	48:G4aCJvTLa7tbAekC/fnPWatweFNUY//Qegl9Fy8q7Sqr:LlvTL+tbAekQnPW2Jv2U8mSe
MD5:	C4AA6CC0B7D7B70CD0B7409F2336E955
SHA1:	1E1BAC9FB81A0D905E2FA6116ACFA944CA06B78C
SHA-256:	A9F487E0A73997C7805867506804220858DC2A13F53AE2D02E6DE4644364B6D7
SHA-512:	0B6A0D544C4CEF1D6C38FCAB9719C94B6AB72D20010EF15A21AC825C7314621FF8B290682BC952246D8478C6CF39AF8F133502F46C7C79FAC785231F02622EC2
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/21928fd5.c540d700.chunk.css
Preview:	.c0408c1843{display:flex;flex-direction:column;height:100%;border-radius:var(--bui_border_radius_200);overflow:hidden;mask-image:none;-webkit-mask-image:-webkit-radial-gradient(#fff,#000)}.c0408c1843 .f87772bb74{opacity:0;transition:opacity .15s ease-out}.c0408c1843:hover .f87772bb74{opacity:1}.a529739de5{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch;border:var(--bui_border_width_100) solid;border-color:var(--bui_color_border_alt);border-radius:var(--bui_border_radius_200);overflow:hidden}.fe04f404b8{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch;box-shadow:var(--bui_shadow_100);border-radius:var(--bui_border_radius_200);overflow:hidden}.f538ae62ac{flex:1 1 0}.a244555425{background:var(--bui_color_background_alt)}.a6271fb6c2{margin-top:0!important}.edb4db1de8{flex-grow:1}.b8d585fcc6{border:none}.e98333fe6c{-webkit-line-clamp:2;display:-webkit-box;-webkit-box-orient:vertical;overflow

Chrome Cache Entry: 423

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (2081)
Category:	dropped
Size (bytes):	125161
Entropy (8bit):	5.125059919374461
Encrypted:	false
SSDEEP:	1536:AF9Q1Q/UEwtNGb4N4EXQdQUJ6v3Q7F+L0TVGsAU08NK5u1w+OKaS6PYIlbErBQnK:A9UEW27OZvPZqJnWjU
MD5:	F4BDFACAB974DE01CFF5748FFCAB22D1
SHA1:	EBAC180856D066E7B7D7D44AFEA5B7B8AF27915D
SHA-256:	9B8F4D2124FD7FFF5A976DB49A94543645561143B3776D4E9042D7E590210A8F
SHA-512:	AE8332FDE28F2B2503CE9EB26333CF4A8EC5341617DD5BA38963618CAE4C2BE9CB60EB88B824C18D6B5E52A9B12F52F6D9B8C3A45D962CFB0B348F612308E666
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<html class="glue-flexbox" lang="en">. <head>. <meta charset="utf-8">. <meta http-equiv="X-UA-Compatible" content="IE=edge" />. <meta content="initial-scale=1, minimum-scale=1, width=device-width" name="viewport">. <title>Enterprise Advertising & Analytics Solutions - Google Marketing Platform</title>. <meta name="description" content="Google Marketing Platform offers an enterprise analytics solution to gain insights into your advertising, marketing, customers, and sales." />. <link rel="canonical" href="https://marketingplatform.google.com/about/enterprise/"/>... <script type="application/ld+json">{"@context": "http://schema.org","@type": "Webpage","name": "Enterprise","description": "Google Marketing Platform offers an enterprise analytics solution to gain insights into your advertising, marketing, customers, and sales.","url": "https://marketingplatform.google.com/about/enterprise/","@id": "https://marketingplatform.google.com/about/enterprise/#

Chrome Cache Entry: 424

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	6742
Entropy (8bit):	7.969644226196262
Encrypted:	false
SSDEEP:	192:AFwGAGBhZCX6HqhAUemQfJWFMCILa+i42EGwTHw:1GAGB7HqhRemo8MCIli4Aws
MD5:	3BC69E017E8BE09CB58E17DBC9D80AFC
SHA1:	FC0FD4A1A279FC931EC34C368ABDB25EC75A3B9F
SHA-256:	F29E4CA6EA1C2B3B08B3A7166C6670FB48941059A56F5855723EFA1E4EC24C67
SHA-512:	E94C32EA8A9D98141740F6ACE55EDD464021793C971CC22384BC0598CA520AA1EDA650CB4B14A9B6403B38489C60997D44DCD742CE1B5783C4FA3954FFD12AFE
Malicious:	false
Reputation:	low
Preview:	RIFFN...WEBPVP8 B...........>m4.G&$...tz....gn(...8m.H................n.]......S.......w..a....;......?..t.K0.t U1J.. .1.5^.8z.>...3.o1v..N=...{...Y.}...E][#....Nw..?..]..M?.>....<..}N._<(... p..).>...z...m~..QsP'...... iQ.}.WA.4..l$.\.v....b...q.dRT..r.{8.....D......B...4>$t.X..Q....8..:...t.SJ.v...K.sQO.......?.0..........fd.~...:;^Q...(..p..........~..vM$...w..sTm.C...2P.ogIy.O......j...{.R;<S..&...7^..9.C..^....l<..,.G.+...H......P.......Snq.M.x.\|fw/?.7H..........Mh:r.c.u..i.C)!\|}!...6..n...k....h...Gn@.<..+;._.B@..6...}zt....}d.w_......R...-n..F.n...7......[=&.B7@&.:............'-.............]..../.a.. ...d.x.l..&.[z...5..Yy...g2$Q.B...ee.:\|.B.....n....dg....B@{..^zF=..3...w. .J.$.-<.H~...<<.~.=.E..N..b.\|{_...#.z.U.Y.....b...2-O.Vo.e&.<$.^.Im..P.}.5..N.n..c......>.6]..Fq$. .b....E.%_.=.....e..#H.+...l}...............E.[N..D..VA..j"T...F..0..bE]..........~..T..3D.-....p...Q.B.@...~..{1.n.TC./z4..g...\.ybP..&V..ti.>..H6$6....4..L

Chrome Cache Entry: 425

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2131)
Category:	downloaded
Size (bytes):	2247
Entropy (8bit):	5.196834711723118
Encrypted:	false
SSDEEP:	48:7amc3NKtTUggiZBYWKs7UDo05qgPm18eE8:7amc34tgggzso1GM8
MD5:	AB47DAE8D780CA3887E8FCD93DA2B469
SHA1:	D870557EFA9162CC5793634359E7ED9689314A9A
SHA-256:	4240B802CAF15CFD13641D11263A77C083E2A797AC0CC69231BAF19584FBFE75
SHA-512:	9B6996D1820D980964893C2F1D6100BCE57C963F88E29273EFEA579B28930635DD27EF5827329DAA336661EBA9783B3E2C9DFD95BBEDBB42413CCB35AAC56E11
Malicious:	false
Reputation:	low
URL:	https://q-cf.bstatic.com/psb/capla/static/css/4bac1f1e.6ef899ee.chunk.css
Preview:	.a75e2d7a8e{background-color:var(--bui_color_background_base_alt)}.f0e7479aae{padding-top:var(--bui_spacing_8x);padding-bottom:var(--bui_spacing_8x)}.f44d5e1099{max-width:196px}.be908b259a{background-color:var(--bui_color_background_base_alt)}.d9abe707c8.d9abe707c8{margin-right:0}.d864d96e77{padding-top:0}.b66fbb5449{margin-bottom:var(--bui_spacing_4x)}.bf4f093686{background-color:var(--bui_color_background_base)}.d6df7679a4{background-color:var(--bui_color_background_base_alt)}.dd8c1acad9:after{content:".";position:absolute;bottom:2px;right:-8px}.dd8c1acad9:last-child:after{content:"";margin:0}.f32f40e436{padding-top:0}@media (min-width:1024px){.f0e7479aae{padding:var(--bui_spacing_8x)}.d864d96e77,.ed1862b30d{padding-left:var(--bui_spacing_8x);padding-right:var(--bui_spacing_8x)}}.c1d3f059d6{border:var(--bui_border_width_100) solid var(--bui_color_border_alt)}.bd4974e1a6 li,.bd4974e1a6 ul{margin:0;padding:0;list-style-type:none}.bd4974e1a6{padding-top:var(--bui_spacing_1x);padding-bot

Chrome Cache Entry: 426

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 354x266, components 3
Category:	downloaded
Size (bytes):	27416
Entropy (8bit):	7.968830524645385
Encrypted:	false
SSDEEP:	768:p11xafUsMAiyxKrehmChpoNocwpriRX1S:pPxwhFS1EpoGc6ES
MD5:	31344F2581B8A92C33340AD71D7505F5
SHA1:	FB749CCDC8E3D4A2A44020C691E0D87BE0233B75
SHA-256:	B7173A5CDE9494348C68E9273664D8DEEF68F10E4907C2C27EBBAA9FC178610B
SHA-512:	5D0398DF3370FB628AB2339BCD284CFCDD7855AE641AD6258AD535C589D3933222E7288C2A3200DF08D579C2D1EE09AD328D2C8F59B5F3BBAC01D9C83AE1B80E
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/354x266/619763.jpg?k=3bfc62a779df5b92694287e9fc0b82d795f93700ddf8887d66f3191ee745dcc5&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........b.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...M.OX....1.5..g...W..a3.........U...6...[.=.....QR..g0-....g.[..WP,..x...C.#E.9_.\.p......T-.S.....a.Uug..M....4......z7..+..F"h.'..T.e.ze.b...O..^.......~U(.......$.O0..i2.b..}...?p........6.$...J#...99?SS...qQ..zM..r.KbF.....z..M.P./y..J..z..\...i2i..4......G..]......".Z.i....4.x..!<U...=hX....?>..OQ.!x.\|..........Mnk>]ni...8[...-._...z...v}..

Chrome Cache Entry: 427

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/988382855?random=1707417344353&cv=11&fst=1707417344353&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=ZgWTCPidsIkYEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1
Preview:	<html></html>

Chrome Cache Entry: 428

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65463)
Category:	downloaded
Size (bytes):	1041930
Entropy (8bit):	5.385418853207091
Encrypted:	false
SSDEEP:	12288:N5sK8IeoVIRVicxNs4XCtvJ5ZjQanbRE5SCxU7T+Q:N5sDIZVEVBxLQvVRE5SCxir
MD5:	0019423CF697E3596B6F4129D1CE5B92
SHA1:	AE9E54BE7ED08BAE330A4BFD7C2DED7B92D648CD
SHA-256:	3217C639298CDD0D5F9A8D09B82B72134DA9243F71E753A6A9689996CF212AF4
SHA-512:	86444B99E65EC7C93A83D648B094984A37FD19DF50362F837E22D2D9E81875AE396E7CFA88DF2E552E68A0ECDA0594499A655BB7855AA68C13E7AE8CA20A30CB
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/client.1b521280.js
Preview:	/! For license information please see client.1b521280.js.LICENSE.txt /.!function(){var e={"854b6ca1":function(e,t,n){"use strict";var r=this&&this.__createBinding\|\|(Object.create?function(e,t,n,r){void 0===r&&(r=n);var o=Object.getOwnPropertyDescriptor(t,n);o&&!("get"in o?!t.__esModule:o.writable\|\|o.configurable)\|\|(o={enumerable:!0,get:function(){return t[n]}}),Object.defineProperty(e,r,o)}:function(e,t,n,r){void 0===r&&(r=n),e[r]=t[n]}),o=this&&this.__setModuleDefault\|\|(Object.create?function(e,t){Object.defineProperty(e,"default",{enumerable:!0,value:t})}:function(e,t){e.default=t}),a=this&&this.__importStar\|\|function(e){if(e&&e.__esModule)return e;var t={};if(null!=e)for(var n in e)"default"!==n&&Object.prototype.hasOwnProperty.call(e,n)&&r(t,e,n);return o(t,e),t},i=this&&this.__importDefault\|\|function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.TGenerated=t.T=t.remoteFormatsForAsset=t.isRemoteVectorSet=t.isFlag=t.getFontAssetUrl=t.g

Chrome Cache Entry: 429

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65397)
Category:	downloaded
Size (bytes):	1093410
Entropy (8bit):	5.140163508861691
Encrypted:	false
SSDEEP:	24576:FdAvD7ci/Kf21N4s9XXa/agtX/Ax60UYDDH:Fj2nmm6fYDT
MD5:	2F0B9204C391AB01E04EDE2166E5A22F
SHA1:	DC04CDF3E26E4326D7A5A77F1FE1F9EF4CEADF4B
SHA-256:	2A48FC9A34B90AB153FC8D02860ED182B3BA96ADC1370180B3402482AF697F0E
SHA-512:	B7F966FBE9D244C3CE4B138274D1FFC8BF89D53AF6B4CC78588AFE11E2601AAC1E4B6804AB85C052E7A3903EAD080582DA5AA439C504A5D0E6889A927E1175CB
Malicious:	false
Reputation:	low
URL:	https://d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com/d8c14d4960ca/c2181391033f/challenge.js
Preview:	/! <!-@preserve AWS WAF Integration Developer Guide <https://docs.aws.amazon.com/waf/latest/developerguide/waf-javascript-sdk.html>--> /.var a2_0x33f3=['Only\x20PKCS#12\x20PFX\x20in\x20password\x20integrity\x20mode\x20supported.','Arial\x20TUR','pageX','firstReport','_j0','prime','siginfo','1.2.840.113549.3.7','2.5.4.42','getUTCMinutes','Stringified\x20UUID\x20is\x20invalid','freshestCRL','getChecksum','Invalid\x20Certificate\x20message.\x20Message\x20too\x20short.','export_restriction','ShockwaveFlash','ByteStringBuffer','670442qXIGfu','seedFile','instructionCode','BrowalliaUPC','certId','bindMouseScrollHandler','1.2.840.113549.1.9.6','1LvuttZ','codeSigning','170000','COLLECTORS','node-webkit','generateHashTable','Mesquite\x20Std','1.3.6.1.4.1.11129.2.4.2','Invalid\x20IV\x20parameter.','Cannot\x20read\x20RSASSA-PSS\x20parameter\x20block.','digitalSignature','Record\x20overflow.','rawCapture','frequencyBinCount','CommercialPi\x20BT','handleAlert','contentInfoValidator','stop','consol

Chrome Cache Entry: 430

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	downloaded
Size (bytes):	12530
Entropy (8bit):	7.956127740598182
Encrypted:	false
SSDEEP:	192:mg4zMtkG+mTPAhXyth0npcOwORd5ORBEFxLPwPjAcCNH9Zx9VnwKOdeYiMsc:38MtCaIJ0mnpcOnT5hXSCNH9FqFdF
MD5:	0EC8A6ACAFD2FF94EAD2387AAC012C13
SHA1:	697CBD26BAA47A35A86EB6FEAB2A7D9A9720947F
SHA-256:	48F88E754655911D3A8885792052DA8DDDCCD607F64F7E030FFAD6FB2D283A37
SHA-512:	5757F69AFF1A3B4E41E8FCB262AFC384BACB11F82CAF13A3CF61D1EFD63B65FF3FA20AE5B522600F8F7CB0F259B032DE485E950423911FA21A6B4605A56515BC
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/xdata/images/hotel/263x210/100235855.jpeg?k=5b6e6cff16cfd290e953768d63ee15f633b56348238a705c45759aa3a81ba82b&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..0).P.8...p...F.F.Y8.p.zq.....bFe......r...o.t..a.....ha/u.f?.Fs...n.Mk.,HT#.+R+$.S#..0......^V..R....:.:."V.....}i.R..E8..H.+.,@).R.J.Z..%.. ..W=.Y... mf+..z.........'......$[k.(...{...b..p......&.Ci.m.0x....q.j..c^....?..wa....C....T..Ig..'F`.*.Z...Gsi.Ge.......j.p.Q.i2..\|+.1..d.0Gy{s.:."R#>..b.Y.m.$..E.'B6...}q....W.Il.p[......X..QW.N3..n...h.S..

Chrome Cache Entry: 431

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 72 x 72, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	950
Entropy (8bit):	7.69670577809709
Encrypted:	false
SSDEEP:	24:ahvlk2c/6qz+2SDaUGyHHT+hYuwNdfCIaKFIxp8c1wolBTaGIx:Uvm2c/6gSDbHCWNdqIaKFIAc1D2fx
MD5:	025B409525836B9E0913038B2556D2CF
SHA1:	187B28FAD3A710B3712B56E53BE8FC4E142D9ABC
SHA-256:	BF146C2FCD8C33FDEA4570ACC5F92BC73B337B1EFBBB2C318089F7BEA5396672
SHA-512:	5B7A5EF3A3A941A92D33FF9713AAFEEBB0CD21E3E84332DDEE259562D33AEFDB36644A99F316A3627AFEC1ED9E51D1B0E3E47B846DE487A393EC768A63C150CE
Malicious:	false
Reputation:	low
URL:	https://t-cf.bstatic.com/design-assets/assets/v3.109.0/images-flags/Us@3x.png
Preview:	.PNG........IHDR...H...H.....b3Cu...TPLTE./].w\|.hm>Pw...!7c....=D.QXVIi+?iix....Yh.J\.5Hpz...............21Y.}...bg.....^u....pHYs.................IDATx..V.r. ......>7....).........}.Z............[.......B.G.@$z"......JH7..{...&..G....LVu~N.U."S.~K.F..B./..mYP.%..&`...B..:.It..]..4.....L...oIb.-U.B..c]Vu..Y.iy(.g.7...L.j...RC.!6...-..+..........D.3r./VB.7?'#}5s2..n..0Q.T?./....B2..nFr.........g,..."G..HlFm.....&..&.......{M`>.L..6=hn.O..p..h..:W...B...M.D.u.X....B.,e-Y...7..={..i...SwL.&..:..1......Xpidl..3.r.R....l.".FQ.^.t%.....q.eQ.sRv."..........5....a.....{.Z.....fX.-.35.{.p..c+.).F(P.9PN..!...Y..x....<Y.=.....{..1...r3*..#........Q..83.r-XM...6.f.6C+:.d....9.9.?.._...D.3.#....).F..... F..f.@...N..:O.....h}.0c.q/..'.Bh.b.B.%...p...#.r-....#.D<.Go.1..g.y$..f.N..r.3.......j....9.#yt...k..4..$hA9..Z..H...i....B??._{.....:.\|..p......_.P...B...........=_.P...B............x.....r=.!e....IEND.B`.

Chrome Cache Entry: 432

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	dropped
Size (bytes):	12530
Entropy (8bit):	7.956127740598182
Encrypted:	false
SSDEEP:	192:mg4zMtkG+mTPAhXyth0npcOwORd5ORBEFxLPwPjAcCNH9Zx9VnwKOdeYiMsc:38MtCaIJ0mnpcOnT5hXSCNH9FqFdF
MD5:	0EC8A6ACAFD2FF94EAD2387AAC012C13
SHA1:	697CBD26BAA47A35A86EB6FEAB2A7D9A9720947F
SHA-256:	48F88E754655911D3A8885792052DA8DDDCCD607F64F7E030FFAD6FB2D283A37
SHA-512:	5757F69AFF1A3B4E41E8FCB262AFC384BACB11F82CAF13A3CF61D1EFD63B65FF3FA20AE5B522600F8F7CB0F259B032DE485E950423911FA21A6B4605A56515BC
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..0).P.8...p...F.F.Y8.p.zq.....bFe......r...o.t..a.....ha/u.f?.Fs...n.Mk.,HT#.+R+$.S#..0......^V..R....:.:."V.....}i.R..E8..H.+.,@).R.J.Z..%.. ..W=.Y... mf+..z.........'......$[k.(...{...b..p......&.Ci.m.0x....q.j..c^....?..wa....C....T..Ig..'F`.*.Z...Gsi.Ge.......j.p.Q.i2..\|+.1..d.0Gy{s.:."R#>..b.Y.m.$..E.'B6...}q....W.Il.p[......X..QW.N3..n...h.S..

Chrome Cache Entry: 433

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 434

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	95
Entropy (8bit):	4.5934148248551665
Encrypted:	false
SSDEEP:	3:UW2ChW/BYwQPS1Rc/SaJqOMLDHk8f:P2dBTUMqJqOM3Hk8f
MD5:	335BE8900580E9C3875DBA57334294AE
SHA1:	A86597D2DDFA410DF13BCECA86FDF9A2291FE798
SHA-256:	8A882FD19A15567E53A5C3C08D22CDAB714FA87734ED92D854C4E8FDF3940B1F
SHA-512:	1D51C3CE06DF5B1B6D305691F1BED48E5EC155313DFA899A98AE94CC625E39429EC81A4D82378FCA04FC9F1F694913A61AB1B0E0F31FCAD5CE9B29A0AA0EBBE5
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/crossorigin_check_cloudfront_sd/2454015045ef79168d452ff4e7f30bdadff0aa81.js
Preview:	window.b_crossorigin_support=1,"function"==typeof window.b_cors_check&&window.b_cors_check(!0);

Chrome Cache Entry: 435

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	65
Entropy (8bit):	4.314128390879881
Encrypted:	false
SSDEEP:	3:2erWeKBRk35KLWAzRERxzfRX/H4Y3:29M3tRdfZN
MD5:	83A02FE42F8C2198E7C608AFF363AA49
SHA1:	7B20AE1014450492CC708E3C9DC7522B05C2EFFD
SHA-256:	E64954DC34E12C7190CC2338A54B07644FF0F102AA71CC7209BCBB49C3009F7C
SHA-512:	CD381A8C725C892E9A68D713254A31EA9ED25A39B212A5DC52D4BA2655F38AFDDB32519F03360F32A59D8E7701AF6C2AD0030A6AA760C3DE87C75063F5B65F54
Malicious:	false
Reputation:	low
URL:	https://gtm-mktg.booking.com/g/collect?v=2&tid=G-A12345&gtm=45je4250z879615461za200&_p=1707417343003&gcs=G1--&gcd=13l3l3l3l5&npa=0&dma=0&cid=421694156.1707417338&ul=en-us&sr=1280x1024&_fplc=0&ur=US-FL&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pscdl=noapi&sst.uc=US&sst.rnd=2080525821.1707417344&sst.gcd=13l3l3l3l5&sst.tft=1707417343003&_s=1&sid=1707417345&sct=1&seg=0&dl=https%3A%2F%2Fwww.booking.com%2F&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&_fv=1&_ss=1&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=17859&richsstsse
Preview:	event: message.data: {"response":{"status_code":200,"body":""}}..

Chrome Cache Entry: 436

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2341), with no line terminators
Category:	downloaded
Size (bytes):	2341
Entropy (8bit):	5.886534125013869
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt081124LX4vFhtzYig3cj6:wsbSUtJfxrqLWWWdV6j1P24L6tbO
MD5:	19FEAEE34F05A7A1EB8B69A19A014F1F
SHA1:	922E4E033B942C3DE20EBD5E73AE3C9A55A3C9ED
SHA-256:	8C8B750737F5EDB86C7C77A6F49B0CA7BEB341E1BC79EC37776ED3F0995986A6
SHA-512:	9B286AE9BC60491EABE0291BFA809119B0A5A3992C6721E0E6E4EC1F2F7EEE6E45DE56F0BFF194E17E79EB8B1014A5543281E5BCBB6E526B3CB1EEE0EEE0B259
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975716499/?random=1707417356784&cv=11&fst=1707417356784&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 437

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	downloaded
Size (bytes):	2315
Entropy (8bit):	7.804352635379051
Encrypted:	false
SSDEEP:	48:o9YMbuERA1fnBOn1xCW9Qlaxj+GoXHlm++1eP9t6Dy4DdGoHr:ghCEofBuCW9fDys+/w+UdGer
MD5:	20AF6F5CD699524D53B2C9957805E7DD
SHA1:	C789D5C63FB2BD4A25018B5DC06A0D5A4A2ECF06
SHA-256:	D6C5FAD185335F4C5D1D39B133EB3051171F6BA4AB859C0F9749263280A73D73
SHA-512:	0BC000418FD7299C68803AB1EDAB3569A31896B4737EC09A3BF53015D8DE7CEC919C848F10A8C80FA5BB5E708042A17103E1022897FE49109FE216564571D2AF
Malicious:	false
Reputation:	low
URL:	https://q-cf.bstatic.com/xdata/images/city/square100/682559.jpg?k=eba0a86971de163610eaab458cd7c2483f59ff8f350d2f63eceed77d21afbed3&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......d.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....+..>.y>..g.r..G.W..jO+..(.F.(.U.....>Q...:O....U'..Hc.a...M.&.....a..zQV6Q@.t.vv....=..[....B~o.b.M"i.7h..3.........._c.....9."b.a%A....n.[..on.nN?...r....L...<~B..-P...o'.....<p.h....>...d]..Y..O#.s[B.d..e(.-...o.Z~O.4.Z\.c7.1{V...a..q...i.......+..f.TU..=(.q...7......wt..". ...(..X.5..\$&e..<s...d.mt'......M....{.._..6'..!..J ......S..W.

Chrome Cache Entry: 438

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	1614
Entropy (8bit):	4.760771826237013
Encrypted:	false
SSDEEP:	24:hYNspeCCZkpG4MEz7agcn0LXTF2F76nQtSn8nwz8Xx:vp6BY7agCwTF2F7hx
MD5:	3F6DE1B2C52CBAA0F950DB18A6DA5AC0
SHA1:	479278BB90FEACD401CD16651B14098ABADCE5C2
SHA-256:	3488D26943604ABF009975BEC89855A18792D1E4CD3EFD9545786CAFB575B228
SHA-512:	60683A75452C1CFAC6C4257CB0241818D44090D5CA00C1AD1DBD16E11F2E809F5490269FB5EEFAA290C7C5F2C2485D3272DD4F77A8D1458DF7E298F1C6C19C30
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<html lang="en">.<head>.<title>405 - Method Not Allowed</title>.<meta http-equiv="content-type" content="text/html; charset=utf-8" />.<meta name="viewport" content="width=device-width, initial-scale=1.0">.<meta http-equiv="X-UA-Compatible" content="ie=edge">.<link rel="stylesheet" href="https://r.bstatic.com/libs/bui/7.3.1/bui.min.css">.<link rel="stylesheet" href="https://q.bstatic.com/libs/calango/0.500/bui.css">.</head>.<body class="c-body">.<header id="c-header" class="header">.<div class="c-header__main">. <div class="bui-container bui-container--center">. <div class="bui-grid c-header--top">. <div class="bui-grid__column-3">. <a class="c-logo__wrap" href="/">. <span class="c-logo__type">. Bookings_Web_Accounts_Portal. </span>. </a>. </div>. </div>. </div>.</div>.</header>.<div class="bui-container bui-container--center c-main-body c-

Chrome Cache Entry: 439

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	downloaded
Size (bytes):	6127
Entropy (8bit):	7.918430706952215
Encrypted:	false
SSDEEP:	96:ghIEFQHYedsuAOyk9NrGmhhTe/3iTfRY95uqQuAPzuSNeuG05diQzQfPzjVSRoBL:mIkZyVAO39cmhhG3+Y9jfALH5gQzQTj1
MD5:	A4F15F6110A2670D27788BEF9BBEBACB
SHA1:	F1307AA614B569BB3691989B0B7AED763064222E
SHA-256:	F5BDF32F8CBD1CBE73F07EA6AA33BA65F827BA1990E7AFCE48C2AB922C032447
SHA-512:	EC6053FE6B8EBB87BEB60FB6C0D47E5FB1DDB0AD2D1C789DEEDE4EF45729C4A237BB8BB5B20C2F35888E4B725D901B1A9181A2B11CA8D1CA612C4DC1C00064F8
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/xdata/images/city/170x136/977381.jpg?k=ab236c5e99ba40341684e2d3bfcd8256d36f5e63883350af9faa988cd4d49939&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..D...%9F@3E.`JpZxZ.Y&C..w.@.K......x..G\|..;...`.zw..\e....zjH..._A..j.t<dg..Tn......Y.y..[{.h.c.&.....`.QS.aF...(-.K.0.N..m$..N.y.....m\f...!..jm.l..b..m...v..-..jm.. .:.E...4.LE4..@E3..\C.D.*.3.j...>...5HE.Z.V.Z.Ees[......<.W....p.x>.^[[.0...V....p)C.(.....XE....6.]..!.@.)qN.K..@)...5&)...H...G5.....]...z.<..\yV.B..5.<Agc<..~..#.wwW>\XD......d.. ......oom..IW.8.\

Chrome Cache Entry: 440

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 210x210, components 3
Category:	dropped
Size (bytes):	13559
Entropy (8bit):	7.956203670624372
Encrypted:	false
SSDEEP:	192:myJVI4N1c5V0RzN+MBRq6+ROo8h801sxaol6AGWPaqTkfFe82fpOquRFoS0yfeLq:dTX1HUARR+RDweEPWPaqTkauRFbA/4b
MD5:	0EBE1F586F8CCA315DFA41789D657D87
SHA1:	18BAF3D6AA57F7CC557A4583457EF58AAB5B28E7
SHA-256:	0FC1E686C57CBBA65A6011DCDF2EA8B1D52B8DAD05373ECA5D0486AB7E6D80B2
SHA-512:	94F3AA46EC01BDDB6FBD1410399C82DB64CBEEFAF87AC909611B7760EC7D2E55D875C1E228C89085C1918845F379A7BC8DAB743751E497D24F4353EE5C812A5C
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....n...$8.:.....t.1{qgd.A..W.z.=3.&...l...h..<.........\....H...r..q.~...1r......YG..\.iH@L..v..c..N..5..6Q........Q.v....9..>..#Ki.2$h.E...O.'...xw.-#...U.}.?$h...QBm..@......t..j...$...!l. \|....Gb+..z./..qo.....y<.7.../............o..2..?.i7H....*8.J....i...l....s.OB{.......FQo!.&L\|.c$.<W._.l.:.r.7...@l.....q...Z....BZ.-.D~z..d+.0.p.f. .9lW....

Chrome Cache Entry: 441

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65463)
Category:	downloaded
Size (bytes):	1036167
Entropy (8bit):	5.381800728882531
Encrypted:	false
SSDEEP:	12288:+5sKw3TaioIHcPN8IHidqJ5JjQanLRE0SSx0bDaz:+5s3Da/I8P7gq1RE0SSxC+
MD5:	1A04F4294923713E0783AFDFDF1F0788
SHA1:	5D61A777B8A3ECC612FC9D78C236018E6F6DF341
SHA-256:	DF7EB8AC384D735C83EDE65BF9778DB549E46253F73A158CE54581F8A61655DB
SHA-512:	8EE3AC237FDC1B7EEEB740B3D83731D10B0480EF2B2DC6E4A7DA1E9BD35CC44726940A92837E04929ABEF5A82886DA4B61C79A273E4993C880AB829803679809
Malicious:	false
Reputation:	low
URL:	https://q-cf.bstatic.com/psb/capla/static/js/client.5a83af42.js
Preview:	/! For license information please see client.5a83af42.js.LICENSE.txt /.!function(){var e={"854b6ca1":function(e,t,n){"use strict";var r=this&&this.__createBinding\|\|(Object.create?function(e,t,n,r){void 0===r&&(r=n);var o=Object.getOwnPropertyDescriptor(t,n);o&&!("get"in o?!t.__esModule:o.writable\|\|o.configurable)\|\|(o={enumerable:!0,get:function(){return t[n]}}),Object.defineProperty(e,r,o)}:function(e,t,n,r){void 0===r&&(r=n),e[r]=t[n]}),o=this&&this.__setModuleDefault\|\|(Object.create?function(e,t){Object.defineProperty(e,"default",{enumerable:!0,value:t})}:function(e,t){e.default=t}),a=this&&this.__importStar\|\|function(e){if(e&&e.__esModule)return e;var t={};if(null!=e)for(var n in e)"default"!==n&&Object.prototype.hasOwnProperty.call(e,n)&&r(t,e,n);return o(t,e),t},i=this&&this.__importDefault\|\|function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.TGenerated=t.T=t.remoteFormatsForAsset=t.isRemoteVectorSet=t.isFlag=t.getFontAssetUrl=t.g

Chrome Cache Entry: 442

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65487)
Category:	dropped
Size (bytes):	226735
Entropy (8bit):	5.346118746193619
Encrypted:	false
SSDEEP:	3072:sosn/wOry3D0j+mTUXBwgPl/QC2NwmMxrrSeKdSF8UeZ28m4u7k5GT2/2uReiMmZ:64OrM4aWmd/QC2NwfagFAZBakfRV
MD5:	CAD5FE4C499F7568E14E7AB6FF9B3361
SHA1:	7CF66966B26C499B535EFD53C77F65DF7DA14338
SHA-256:	83F4228D1D92171186E8B8CCCE6E69B32AD6B322DB4AF7E4B6F54CE50E299587
SHA-512:	88320686F20F22AA51C2F9493EE8114A9E613C2C93B6F104FFBFDF7A096CE6A3111BA5ACA7598EE1BA1B4FE953D141C79598C5AD096FC89E81F1370D844AE886
Malicious:	false
Reputation:	low
Preview:	@font-face {. font-family: 'booking-iconset';. src: url(data:application/font-woff;charset=utf-8;base64,d09GRgABAAAAApe4AAwAAAACl2gAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAABHU1VCAAABHAAAKNwAACjcNQw8SU9TLzIAACn4AAAAYAAAAGAPEge7Y21hcAAAKlgAAAHMAAABzNfFHlhnYXNwAAAsJAAAAAgAAAAIAAAAEGdseWYAACwsAAJY7AACWOzKPBVGaGVhZAAChRgAAAA2AAAANhact9JoaGVhAAKFUAAAACQAAAAkEqwQt2htdHgAAoV0AAAIDAAACAyG4yWibG9jYQACjYAAAAgQAAAIEAJMgdxtYXhwAAKVkAAAACAAAAAgAiwDLm5hbWUAApWwAAAB5gAAAebQPj6JcG9zdAACl5gAAAAgAAAAIAADAAAAAQAAAAoAHgAsAAFsYXRuAAgABAAAAAAAAAABAAAAAWxpZ2EACAAAAAEAAAABAAQABAAAAAEACgAAAAEAOAAZAG4AhgCkBaAIzAyuD2wQShJEFCQU+hW6FeYWzhg+GIQZ2h1CHcAfZCLMJxwnYieUKJgAAQAZABAAEQASABMAFAAVABYAFwAYABkAGgAbABwAHQAeAB8AIAAhACIAIwAkACUAJgAnAgIAAQAEAbgACQAfABgAGgAeAA8AFAAfAB4AAQAEAbkADAAWABgAGgAjACQAFgAiAA8AFAAfAB4AOwB4AIgAqgDCANwA5gD6AQ4BOgFKAV4BdAGKAZ4BsgHGAegCCAIeAioCRgJUAnICjAKkArACvALMAuwDAgMOAy4DRANUA2gDdgOEA5QDogOwA8ADzgPgA/QEBAQaBDYEQgRQBGIEcAR8BIoEmASqBLgEwgTOBOoBRQAHACYAFgAiABIAGAAWAQgAEAAlABgAHQAWAB4AJAAWABUAIgAWAB

Chrome Cache Entry: 443

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 40120, version 2.0
Category:	downloaded
Size (bytes):	40120
Entropy (8bit):	7.988708091189265
Encrypted:	false
SSDEEP:	768:eVnUwEAWngEXoJ5ILphwzdg2wpmubDmM8yizNiWVqI1NaWQOByn3OqDC:QUwEtngsa5BG6ubDmMCiV2Byn3OqDC
MD5:	F2953AF89807609F49B87237180BB450
SHA1:	BCEF01E9E586A9A6C567602272C1A7955B77B0CA
SHA-256:	B02A3F6DFEB4EBF05D30EAECC8473664F1720190639CBFE43B2A7F9A00246E56
SHA-512:	270DD571D34269DAF11A1AD5931C1202B57C205DD3375276AF3DE78F51DA27601FC9ECDEA94CBDBFEB1ED6C29E9A91C267CB916CEA6BE7BA1C537B99393F02AC
Malicious:	false
Reputation:	low
URL:	https://t-cf.bstatic.com/design-assets/assets/v3.81.0/fonts-brand/BookingRegular.woff
Preview:	wOFF........................................GDEF..{\.......x\.].GPOS..\|X.......~.C2GSUB...<...z........OS/2.......Z...`i.@.cmap...x.......la.D.cvt ...<........#...fpgm...d.........0.6gasp..{P............glyf......c.......g.head.......6...6...Uhhea....... ...$....hmtx...T...$...D..v.loca...........$..D.maxp....... ... .7..name..zl..........G.post..{<....... ...Jprep.......).....m^.........(.#._.<...........K.....V.g.9...p..............x.c`d``...........YX.."(.i"............N...L......./.a...%......x.%.5.B....7...F.t.. 9.h.=.$D ...;\.r$@.z.....L...z.j:?......d..2.._...l.-]....W.M3..0....x.....K.....O..N.Y.m..'..6.m.m.ms._sz.M.9.\|.z........y.`....0.1H.9(5.Q-CQ...a.....-.....`?...~"..r..#......_d.D...d.........B..O...9..1$.4..LRJ....$.I.)!Y...g....._.e^.MCV.T...iv..;J\-..X...[F.]mY..XL;.t..T.X.l.1.=..+.c.$..b.-.c:.}..l....9.u.G...=..(...w..a.$.{.O3.I..$.57`...<2.\|.<2 2.3q...P$...e.s.@[Ez....+..Lr<R.(.R..^O.........ND!.=I^.Fg .z.,[.S..~....Y.. Kf.tdim.:.....&.{S..u.}.gc.F

Chrome Cache Entry: 444

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/975716499?random=1707417356784&cv=11&fst=1707417356784&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1
Preview:	<html></html>

Chrome Cache Entry: 445

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 446

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	32
Entropy (8bit):	4.054229296672174
Encrypted:	false
SSDEEP:	3:35SFHm2C2Y:cFHJO
MD5:	DE54CFE207D26D141D7892F98C6F164E
SHA1:	1F00A3232FB0EAF61D3666D35C1D17775B8E8898
SHA-256:	5F70CD1C98415012EF3FD820BC80E28950EECBCCF65A71A0B11DFF57277E24AA
SHA-512:	16874032F14943D593ADD76E01B910A16906658BAE942115D673C447E61380E1A9E330049E27AD8D645B9A04B6CE0F0F29BB029FD9810C26CA5BBB5CB09B79C2
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAlFuT3KP9CZsxIFDUWnAYs=?alt=proto
Preview:	ChQKEg1FpwGLGgQICRgBGgUImgEYAg==

Chrome Cache Entry: 447

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 210x210, components 3
Category:	downloaded
Size (bytes):	13871
Entropy (8bit):	7.961455667026666
Encrypted:	false
SSDEEP:	384:d7roS1CFuTQ5KHCSkY111GxROnFOweRFCcIeVnBU:d7r3ChQHnkY111sRKBe6cICBU
MD5:	C8E056CE8078976D110BF239A2945C9E
SHA1:	550750D448E83ED54319ED1E797F504C7ABF61B8
SHA-256:	9835C5F54C82372CE75DC89F52070A3FE68990FBB3B3722CD830EC20C860A715
SHA-512:	274345B7C4794C022EC5E5528B29C1C6B6BCACF9ED26F142DE706D7E524C8DFB5CB47394DDFC7BFB6F0998E813468B494184B79149AF86EDA5561FA6F0CFFEDA
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/city/square210/977408.jpg?k=125215335ffab346e954ff91ddbf6e4d2f15812d3e3a51b654ccd29705cce852&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.k.$.....t\|\|....v..Xn...Z#.l..:S.&..j.n..a..2G.Q.2e..Fp}).....9........]Y.7v.w.;).d.U.....@...$....?..6pW.#..J.g\oc.B.G.....(.U.t.s.od.....$.LsJ3....x.K2"..VnNM4.<.MiM.pR..fuT).....%s.%.!...(..R.8..z..%..r{..2O..(..h....G.Z..G.!~.\|.p3...n...h....Z..F2Z[i.%8f..{.R.t.6.).^.1.v...Y.....N3.=i.zs.rV.d.00@.=.}.I#...rG.YU..h[..F.W...Q=;..;H......z..$z.:~5

Chrome Cache Entry: 448

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4043), with no line terminators
Category:	downloaded
Size (bytes):	4043
Entropy (8bit):	5.552497156771192
Encrypted:	false
SSDEEP:	96:/2XjHo2SilP5rP42moGkmS6hY3t0wCp9seALwM7a:eMilPxDmo4+7CpigMm
MD5:	78412B2C11F2FE96714FADF0062F86A5
SHA1:	93104E850A60BE02524D262185A09C90353A8DE9
SHA-256:	9E39D8A3BEBA88972D3A22C7A5A6B5E7242DEB247E6ED99B895871D476C06120
SHA-512:	D2717BA02D194562C797E3FC8440C54E7BA6BABB84102DEFB1707136461E0005E227BAACF740AE2186D32EAA0BAB42C7A9E244DEE43BAB095FE10BF968D736BE
Malicious:	false
Reputation:	low
URL:	https://ct.pinterest.com/static/ct/token_create.js
Preview:	!function(t){var r={};function i(n){var e;return(r[n]\|\|(e=r[n]={i:n,l:!1,exports:{}},t[n].call(e.exports,e,e.exports,i),e.l=!0,e)).exports}i.m=t,i.c=r,i.d=function(n,e,t){i.o(n,e)\|\|Object.defineProperty(n,e,{enumerable:!0,get:t})},i.r=function(n){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(n,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(n,"u",{value:!0})},i.t=function(e,n){if(1&n&&(e=i(e)),8&n)return e;if(4&n&&"object"==typeof e&&e&&e.u)return e;var t=Object.create(null);if(i.r(t),Object.defineProperty(t,"default",{enumerable:!0,value:e}),2&n&&"string"!=typeof e)for(var r in e)i.d(t,r,function(n){return e[n]}.bind(null,r));return t},i.n=function(n){var e=n&&n.u?function(){return n.default}:function(){return n};return i.d(e,"a",e),e},i.o=function(n,e){return Object.prototype.hasOwnProperty.call(n,e)},i.p="",i(i.s=0)}([function(n,e,t){var r,i,t=t(1);try{r="A3dA86xx3SygInSznfsu98uiaY4VmGo/CaJTGvdsIU5xobyXgN1lb1smNdWPEoeyz54s3L60Kdxmc4VJmUrrIgoAAACVey

Chrome Cache Entry: 449

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	16142
Entropy (8bit):	6.01702677027839
Encrypted:	false
SSDEEP:	384:tN1zIfzAA43JiES99iyZgq4Zk/98sBRA2xM9ewGZ1gVOIvhsM:jpAzAnJitiy29+98s2U6e3ahT
MD5:	A0515331464ECEE959AAA5A67333DE47
SHA1:	D668660963A1FCBD98F8A8267B7EF27836E35C41
SHA-256:	13F887247BA0A51FB7F6E1A9C12F450419F5E5C9210878136B8D9B11C519D210
SHA-512:	E5C12A4E8DABCC7E46BE52F4B62A75ABE2C60ED1C968523EF4D4341D1C162AA5DBEFE6FB2DCBEE256533EE7ADC95BBE2195ACCCD678F0D82F69D038BD86257CD
Malicious:	false
Reputation:	low
URL:	https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202402010101&st=env
Preview:	{"sodar_query_id":"HR_FZfHSIMmgv8IPvuOZyAo","injector_basename":"sodar2","bg_hash_basename":"s6Lo-ySsTFszeicWuLCsm9BIHYA2isJaSryvoQutTtY","bg_binary":"XCKC07fcszi8bwejZJRTV4B74w6TBl8APwYBOMRhdeaBWnlKgpX5oLK39Sz7xtW5JMWnO7WF0TRL4hOyJ2bPYyEOtSxt9r+udFHrrGFMpC351V65F9r/87QTwGpsJdH+PXYSXyJC1oxXDCP/x/i2c3q9LDtlF9uZD/F7lmtB1EWPf+MQOg72NptSwBkze4hbMEjxgKOuI+lazj+Og2XOPoIVmE3rOpyXMqJVoCFZSzAwTEVgVuH5N0Rg79VgUvGUtqkfCAOzlYt8OLxvPGoal7Dok8DOQYTtbEMnSgCqeTH9UTRzb+ySjOLyT4qdt3Rrcg1tWjWfM0/VHtvREVLcF15DRAp87NfK30sot4WZbpKvNHFxqQgaFTwOWMWOOprjaYc+dqEtfV4Ql6iQ4IsafZjJrCVGC/vYTR/9YSyAYB1Ss9x52Hcm9dXhzPyRAsen3PX0Cp3nRKrc7plk6/cGGlRHcnn3hnBdI/iMXy+ZzOTk7eDqXQpVZ53Lrjsp12tbhN6CRb6v36uo6xbl54irUz9rjRmameiXUKUOO10NNeY9EkczMashRmTf+zrdvyZoucUsGJv0O3Z/h+yHwcmKk6dpAfq67NvNy0OFWv7pq9/cBUhFH5q54tbsDlYysbUcH/DM8oCFr8YOeiV/DpnqaixHJdA5kuU01gqwuPBc8YeMI2P2BYu9o/fxjBaHR0XDwJdWj+MrcEqWJmslbJfm1jeyiYg87Bi5u0+0voMEBVg/e+9veriMhiW7CqjYydpvOkeKOqgzAwjLasZpqzwc5G4MvhS1bYFtWGLdZFzgCB768IPEBFR1cP2nxhA+Cnr2pWbuvwczsDNYrcww0

Chrome Cache Entry: 450

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17874)
Category:	downloaded
Size (bytes):	17990
Entropy (8bit):	5.415845765890737
Encrypted:	false
SSDEEP:	384:wj9p86OmoCxjiXFehzkoejH7l0hKur1e3iBf2b:T6noQne77l+X1e3ips
MD5:	225AD398FEB446BB2302AD0C3A390259
SHA1:	F0D23424650A69DD1351612147329F3C861C0D80
SHA-256:	0C4A1813D08E05DFDE57F09576830F7916769EED8D2CDD57A5A643E2895E955A
SHA-512:	B9DD75DAA77610A36F5AD7AB71629F271654B941B999330C0FCD89E37D8038EF65A52760397CF5F4F72F1ADFE323305CC6AD6F6ADB66FF59D7842D8592C24581
Malicious:	false
Reputation:	low
URL:	https://q-cf.bstatic.com/psb/capla/static/js/remoteEntry.e62c532d.client.js
Preview:	var bFlightsIndexComponentService;!function(){"use strict";var e={b485706a:function(e,n,t){var r={"./InterlinkingComponent":function(){return t.e("6197bcab").then((function(){return function(){return t("36b3cbd8")}}))}},o=function(e,n){return t.R=n,n=t.o(r,e)?r[e]():Promise.resolve().then((function(){throw new Error('Module "'+e+'" does not exist in container.')})),t.R=void 0,n},c=function(e,n){if(t.S){var r="default",o=t.S[r];if(o&&o!==e)throw new Error("Container initialization failed as it has already been initialized with a different share scope");return t.S[r]=e,t.I(r,n)}};t.d(n,{get:function(){return o},init:function(){return c}})}},n={};function t(r){var o=n[r];if(void 0!==o)return o.exports;var c=n[r]={exports:{}};return e[r].call(c.exports,c,c.exports,t),c.exports}t.m=e,t.c=n,Object.defineProperty(t,"miniCssF",{set:function(){},get:function(){return function(e){return"static/css/"+e+"."+{"6197bcab":"88b5a402","540ab87e":"487eef89",f80a5102:"487eef89"}[e]+(window&&"rtl"===windo

Chrome Cache Entry: 451

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1002), with no line terminators
Category:	downloaded
Size (bytes):	1002
Entropy (8bit):	5.701644045708987
Encrypted:	false
SSDEEP:	24:kHkw8tSyngFuVAOdIcCcEzrcEzn/PqjCC5zqinzYjnpRnLxR2+YI:YyLVkczEzAEzmYnbuO
MD5:	ECEE2E29DD00A24FB536CF681B6D2FE2
SHA1:	40BC0B3B8D7BC13A5A7186538737144E0B02AA5E
SHA-256:	A4BDCF773739389E5154C8E46A2EBEF93B1E618BE8E742CF6BB171B3AAE0E4BE
SHA-512:	A02B0637C37B484075F4D293BACF6620DA01C64D3C52F69B1CDCBE5FD8674A3E05E1255A1E691BB3687E27CE258FCEDE4F08EECF35928BFCF7E9108262FC61DA
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/1060768846?random=1707417370594&cv=11&fst=1707417370594&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nh4qqVoyv2KiIad5kPNddW86jrjYgKSk8&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=page_type%3Dhome%3Bcheckindate%3D-1%3Bcheckoutdate%3D-1%3Bhotelid%3D0%3Bbook_window%3D%3Bweekday%3D-1%3Bdest_cc%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bnights%3D-1%3Brooms%3D-1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Bguestcount%3D-1%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdest_ufi%3D-1%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN
Preview:	<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j9270294"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j9270534"}}]};</script><script>for(let i of ig_list.interestGroups){try{if(i.action==0){navigator.joinAdInterestGroup(i.interestGroupAttributes,i.expirationTimeInSeconds);}else if(i.action==1){navigator.leaveAdInterestGroup(i.interestGroupAttributes);}}catch(e){navigator.sendBeacon(`https://pagead2.googlesyndication.com/pagead/gen_204/?id=turtlex_join_ig&tx_jig=${encodeURIComponent(JSON.stringify(i))}&tx_jem=${e.message}&tx_jen=${e.name}`);}}</script></body></htm

Chrome Cache Entry: 452

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	dropped
Size (bytes):	10257
Entropy (8bit):	7.9278460122891286
Encrypted:	false
SSDEEP:	192:mgARxUS0Dgu/UtwsBC1Rx7z0OPhgKy55wopcaiJUlK7AytFGDKOziV:3ARCH/UuZz5P52SUluA8IKqiV
MD5:	5F58A2EEB3F0B1D3CE899E3C629368A5
SHA1:	3DBABBE322B0EC1CFAF64ACFDE88D5ED67B674B1
SHA-256:	FA9F5DBE5AD251EB1A7DA4628C3D1CC55C9FF380671A9D7D2B070BF4E2C2324E
SHA-512:	41EEB02A2EDC6F19C53C526C8D329C0D13C710955D60D9D44E648D73531008DE7279D9365FFF2F2DACD93A6C080F1591D6720D0C2B8FA55928C81C1D646B26F3
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..%.z.H.sY...R....s{....4.....Is.../-.N.z....H50.......=..J>....`....Z...E.7b...-}..O..#h..?.....X....._....~...]...`.}....).P.6.AF..?}..a......=.:...v.AN.=..@........To.N.....b....!.l.....d..I$..e,I'$.)d9#5i......S....2.6=.s....[.......?,.\H^V,..D.u..}.K\|.?$C........*.9.oV9.4U.J).u...Sm.....!gd.....I#W.p}M6E..1....h.................Z..w/=.i....9

Chrome Cache Entry: 453

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (45806)
Category:	downloaded
Size (bytes):	45867
Entropy (8bit):	5.191690532189119
Encrypted:	false
SSDEEP:	768:MRZXj2vVp1t2QU4XsLxG/fX+Nxy3YbxNfm:cb7nm
MD5:	E8FE041D8C91154BB197A40DC785E5A4
SHA1:	85F7F9F8E32B9133C93070600D4547F66B50B753
SHA-256:	6527F37F5C1C9BB70437279D5068BCE778132277DB1B469F306893C894DA70C7
SHA-512:	A4FE89DDA8070BE0A57F3A3BF43310996FA2AE206D849C1C85572BE8539EA03C06BB294A8D304CE20D79FD39FB3C213D7540700A04AB5B38FB67EB1ACBF468B3
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/flights/web/static/css/screens-Search.f7732e67.chunk.css
Preview:	.Container-module__container___QbI23{min-width:350px;width:100%;display:flex;flex-direction:column;flex:1;max-width:1100px}@media (max-width:350px){.Container-module__container___QbI23{min-width:auto}}.Container-module__container___QbI23>div{width:100%}.useSideBarSticky-module__sticky___\+iLI\+{position:sticky;top:var(--bui_spacing_4x)}.useSideBarSticky-module__innerScroll___TbSUh{overflow:hidden;overflow-y:auto;max-height:calc(100vh - var(--bui_spacing_4x))}[dir=ltr] .useSideBarSticky-module__innerScroll___TbSUh[data-scroll-padding]{padding-right:var(--bui_spacing_4x)}[dir=rtl] .useSideBarSticky-module__innerScroll___TbSUh[data-scroll-padding]{padding-left:var(--bui_spacing_4x)}.FooterLinks-module__footerLinks___ZicAm{display:block;text-align:center;padding:0 var(--bui_spacing_2x);width:100%;overflow:hidden}.FooterLinks-module__footerLinksInline___CgAOk>div{display:inline}.FooterLinks-module__link___MfJTi{font-size:var(--bui_font_emphasized_2_font-size);font-weight:500;line-height:2;f

Chrome Cache Entry: 454

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	downloaded
Size (bytes):	8642
Entropy (8bit):	7.936811905814669
Encrypted:	false
SSDEEP:	192:mIRFaj6y6SGsxJJPZnPT11NmpbTJytPcdjxhlZK2:nR7RstPxTop/8Kls2
MD5:	C93A2183DB30C5988936B15E9BB2473C
SHA1:	9D5B308CF067E5B0EE544D3FDBA45740587D2F63
SHA-256:	2B8F25D9F2B16CB4F435787E273411EED1CDB83E7CCC56542358421AB0D90E4C
SHA-512:	066C23C192D868A2B5505813D40DE3515EA874636B70D67D9E8B93F37CDC0121D8D60B1A154DC77BB05D13E64081858EB843CEAC3649DB1F14D902054ADA68C3
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/city/170x136/977409.jpg?k=82c14f9e6cea94829ee0528a3aa4324111d3482e9f095194500746fa7ca2769e&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...Q.<....FF.+..]..qkVW.sq..Q.U.....X}. .J...s..e...SvWn...v..dL......A..Kt.#'..........d..j~.n..?1..:N.(..O1..0z.:...!..*;B:z..'...SI..k.#.X..."..[+..O......Gw#..2....t.....Mr"....F....1.V.......F.\|....q....>....JmE[...wB.H(....]4..5.....Y'..........C..KF +0...m...jVm....p..V;H.w.6H...:..>.RGy.Hnnm...^Fh...[..%...n.:3.8.rJ..K%...c.y,.3..O..T}...4..icW.n.

Chrome Cache Entry: 455

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	https://www.booking.com/logo?ver=1&sid=5171fc655664ddf74ab763a094523fb7&t=17074173311
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 456

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	dropped
Size (bytes):	2433
Entropy (8bit):	7.803666019198735
Encrypted:	false
SSDEEP:	48:o9YMbuERAiSQ1sebVHaJD7ut4AA7vCqiNz14k2oW2rGQB8IAK:ghCEVxR6JvuGAA7vViXHG2rGQB8IAK
MD5:	BE6C515CF539EEA17A2A3153C0047679
SHA1:	F62369C43572E8DCCC1E4A59A972227F2FA00272
SHA-256:	6F4F39506546768A5959AAA94EB1AFF88A5ED5E7D6D2A9B715CE61305A7802C7
SHA-512:	D9A6995E504772F6428BC57783EA60CD7667FD70EC545EB84401D22D2E1E3E479C8150CECE2CA154F0B9480CAA5FDC5A5428FB2038C99E2126C12DD4F0CC068C
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......d.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.../j....g..h..R8.2^...g..x.E#7.%....k<5]....L..h..M..Z.#6...0.Z.a..2.3.^..._1SLUW&.....QN....B.V.GP.U......{T...j.U..Z)..d.^...Z...@.{V.Fn&SEP.U...T-..h.f.f..3..i.}../j.".L..0.ZF.ji..H..7....<.j).....h..J.....H..L...x.M.../j.L..-....h....S!..hj...Z.j....S!..0..5.`...=...q3.>....i.=...j.ryL.....QO.\.rTSJ...y7=K.m..:..".E..U....V.PU....*......h.R.K...S.B..

Chrome Cache Entry: 457

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	10006
Entropy (8bit):	7.97889714105622
Encrypted:	false
SSDEEP:	192:TgfymjevN0pv/84iZoCks1vvaK+BZUNgq+hJ3Z2TMv0QAT1fv6m4S7m++zd4:kfljO26uFK+3h53Z+s26omLd4
MD5:	2BBC07CC665AC423BEFE32ADE5F55910
SHA1:	E120FBDE4C4F791B07E186DBF8441F0154C121C1
SHA-256:	5EED0383F330DAFB448F740EDAA2013D8C81458DC9C78455CC36AC5585F5C261
SHA-512:	B8E38D42BD0EDC583987D06F7862D2D770223573879788E54A5780A9C96113EA9F42E55A8954E444EF8A07AFC1794BC34860238FC8BAA13AC02D5556EB2AC74F
Malicious:	false
Reputation:	low
Preview:	RIFF.'..WEBPVP8 .'..0........>m0.G&#...q.....c...4.7..+.....o.b.~.b...y.a....sX.AQ..x.....&......P.X._...."._....)._i....!jAx..U.M.n.N0..X...Jz..+}.../...K4F~c\i..U..^.]G..Y....@..`....K.d0~.O..qyx........"x..N1....D.2{".'K.,..2,/.\|...@....`}G...W...4\|..9.Hg...e8.XB.....j....p.....3..;.Th:..,....w.Jfy......S...7..........4'7....y..c..........5;..f.)...v9'.d....z.O... 8w!..i.vP........P':>n.J.m.iW\$f.SPY.FA....?WU.9...T....{=.K_..i...Py.......p....:.q......../.(.9.q....9..9..\./.~CR2..V<JZ..R...}}..h...S.E#..9yG.^....;....z..t`n.M...Co....#.......Z:.1.....9i...~..5 ..Yz.....K....`.......J...X..EG.fE........J.Cc.K.rv..W.a.Gd0o.Z.%.....+\|!J!8}x...\....;..O..C`a;7.*...\1'..Z.....q...u.y:O...Q5.+b..._.Q:/...\Z.n....U..us....d_QCf.Q....W}6...#..n3.b.F0..9.%.-..H......uQ......S...]....c..i....if+G.1G.3................{. n.HV....Fz...s8...+.45.8.W......;z...4#...D.K.>2..7.....M.].u..s".$[.!i....0./E.....%l..].\..f.........d.W..Z.H.-.i...d...s

Chrome Cache Entry: 458

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 210x210, components 3
Category:	downloaded
Size (bytes):	13559
Entropy (8bit):	7.956203670624372
Encrypted:	false
SSDEEP:	192:myJVI4N1c5V0RzN+MBRq6+ROo8h801sxaol6AGWPaqTkfFe82fpOquRFoS0yfeLq:dTX1HUARR+RDweEPWPaqTkauRFbA/4b
MD5:	0EBE1F586F8CCA315DFA41789D657D87
SHA1:	18BAF3D6AA57F7CC557A4583457EF58AAB5B28E7
SHA-256:	0FC1E686C57CBBA65A6011DCDF2EA8B1D52B8DAD05373ECA5D0486AB7E6D80B2
SHA-512:	94F3AA46EC01BDDB6FBD1410399C82DB64CBEEFAF87AC909611B7760EC7D2E55D875C1E228C89085C1918845F379A7BC8DAB743751E497D24F4353EE5C812A5C
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/city/square210/977387.jpg?k=07aeb102ff72c498cfb8c4b92382aa6ada5fd4e84ad283aa8b387b072c9fd7d3&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....n...$8.:.....t.1{qgd.A..W.z.=3.&...l...h..<.........\....H...r..q.~...1r......YG..\.iH@L..v..c..N..5..6Q........Q.v....9..>..#Ki.2$h.E...O.'...xw.-#...U.}.?$h...QBm..@......t..j...$...!l. \|....Gb+..z./..qo.....y<.7.../............o..2..?.i7H....*8.J....i...l....s.OB{.......FQo!.&L\|.c$.<W._.l.:.r.7...@l.....q...Z....BZ.-.D~z..d+.0.p.f. .9lW....

Chrome Cache Entry: 459

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	13904
Entropy (8bit):	7.9858014202596435
Encrypted:	false
SSDEEP:	384:qvF0SZJsx/sdqUxKTuuZXlpSV9PcJdWZ3ysS7RFlFTQZ:q93ZPq0nm1pSVpcJdi3yd79FTQZ
MD5:	373F7CCBD297248E76208FF46E442487
SHA1:	7D3910A92BE92EF2C912937D75CC53F6B6A7CC46
SHA-256:	DF9D4680F6A5679CFB790A03FEADDAED60F8685EE08E8E343D6766C373F7F0D0
SHA-512:	8DA384BE33DEC02AF86993E72A7296B534B0E8F6BD38460893408CBE895F4D19F3D91AA05E14A94D84AFA70E4BF8EA07A76F54EBDE06904CA6FC19EA62013161
Malicious:	false
Reputation:	low
Preview:	RIFFH6..WEBPVP8 <6..........>m0.F.$"..U\P...ek+...q..p..m......7..._......E.:........}../...y.._..?.....?.^......c...;.....>.}....................o.+.?.....O./.^.?azf.......M...\|.Q6:......3E..,...:n@...p..#;M..'..Ec.V..._....y....!........;...7S6..3Ob.".......Z..M....\.....V.cr4...#.~....F..m8.@.M......v.(%....T0Dh...>.$....-.....:.e.&...;Gp.2.3.e...u.MK....g..?H.#`.1...1...5R.1$.....}..Va'e9.=t..:V\h>0.m..F..#...a.gV..T)8....(.d...gt..tcV.....-3..}. .....L."w\|7...j\|....b.4u..A"..Ap....b.A..Ks.O.A(._....d.........l...u.c...;..:\S.......=.s...vw.97...1....dhM...s.45....f.\.A..q.K_....7...Iy..K..T Y.....#q...Kv.*1...Y.#."."............J..H........k\.M........k..E.e.i. -.yU ....G.:..l.g%..c.uK..,T.w.._.......)O%.....E-.3.1.zVE......8W...G."O#`:.s...c..&e...`.....x.F.....<hy9.7........c!Q...4;$mvs..UU..:.$a.8?...".........u#y...X{".......w......6.......U.f.42P..W0%).r.....CL.".`v,.`..N~I.i1j......AO..?.\|..........s.F.Z...gM......y....K...

Chrome Cache Entry: 460

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65455)
Category:	downloaded
Size (bytes):	132016
Entropy (8bit):	5.531269323595622
Encrypted:	false
SSDEEP:	1536:D0c3FDB/OvuQdR1xBnIDBgjBgt65mhZLI4Hsp+3YW:HbOmQdRr9UVHsp+3YW
MD5:	B9431959D1FBA61458D500BC4CBA3939
SHA1:	CCF71CEAD991F0BCA0A6F87FEF896817F7FCE19F
SHA-256:	86010DEDCF83B8D2F0A9ACAB837DB04B884450D6E1B7CA5E8FF9089B9C60A01B
SHA-512:	59DB289F2501AE20166032839D15337D5C0277DBC9CF4822ABC16D0E8DB019A2E45B663AEFF20E1625B80E0D9875325D55383661BB875BCC45C9A6743512E627
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/3d066b0d.6a5d1f73.chunk.js
Preview:	/! For license information please see 3d066b0d.6a5d1f73.chunk.js.LICENSE.txt /.(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["3d066b0d"],{d7745882:function(e,n,i){"use strict";i.d(n,{Z:function(){return c}});var t=i("ead71eb0"),a=i.n(t);const r=e=>!!e&&(Array.isArray(e)?e.length>0:"object"!==typeof e\|\|null===e\|\|Object.keys(e).length>0),d=e=>e.every((e=>r(e)));function l(e){return"renderIf"in e}function o(e){return"doNotRenderIf"in e}var c=function(e){if(function(e){return"renderIfNonEmpty"in e}(e)&&r(e.renderIfNonEmpty))return e.renderNonEmpty(e.renderIfNonEmpty);if(function(e){return"renderIfAllNonEmpty"in e}(e)&&Array.isArray(e.renderIfAllNonEmpty)&&d(e.renderIfAllNonEmpty))return e.renderAllNonEmpty(...e.renderIfAllNonEmpty);if(l(e)\|\|o(e)){return l(e)&&!e.renderIf\|\|o(e)&&!!e.doNotRenderIf?null:a().createElement(t.Fragment,null,e.children)}return null}},b6ea4fe7:function(e,n,i){"use strict";i.d(n,{Z:function()

Chrome Cache Entry: 461

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	5836
Entropy (8bit):	7.959947047903202
Encrypted:	false
SSDEEP:	96:GnMBVrUQ3I8p1jSp4XRHBYl9AcYvXwuoxMkbtbFa8y8ALDaYNN:Gn4VrxBGp4IldY//Otbw8ydLp
MD5:	C23DE4A26E2BD5634A13C0A7BDE4EBC2
SHA1:	652353DCFFCAC1DC3B14E23F400F9CB645321BEB
SHA-256:	55D6DFEFEF64DFA4E7EC2BACC87A3E755C90B666A3D05A62D8259162CBB69695
SHA-512:	0E12C0DEF3BD5CD5447F40D12839FBC1164FE602844ED16BF68A095A2C2AC7DD6DD8B2DE8E5F14124781466E0CB08B03BD7F7B12528149001FB64B1CD741D681
Malicious:	false
Reputation:	low
Preview:	RIFF....WEBPVP8 .....{.......>m2.H.#...0.....cn-.Z..% .......}.%..W....e..x......0?p...._...x...wn...o._.reH.==$.C..\_..#...w.....G..>.....+ ...n..#..j.O...........vD........2..J?....;^.......F-.v..2X.._8........m..~.@....&n.y.@..eU..T..L]r.V..y....,....?9..irn0..@....S..O6R.@..=..VpqOS.@...........B:a....v..e3n.-+=.....f[..R.M.L...&>.P..o.k..\.........DJ...........X.v?i..AZ...4.....`.%..8....Jl.O.$....(~.Q...l..e.x...?..r8our..9.F.4......#..y..W>h.ZR....%...7...%.....&...z..._..h?..EZ.0........^.A._.5.i.!T31V....?W.~....GU.3^.v2d\'....c....)hC4..45...fo.[..c..B>7.4.5..H..K.X..z....o......%r.o.m-...l.f:.%.....L.*N...n...4{:....).hFC.r..)3.O`...$.......`...h.2n_....;p......P<O.E(.Y ......z.jc:.....^...B.F...>.X..#.0.F2q (.km..V.,}^a..a...'%.B'.bc%......P#Jph.>..gsjc..d.2[?.j$.Y4...e.J.][....Gi=.KMJ.I.4...a..U.zgi.B6.G.Lwr.1.M.j.\|n.....q.....O.D.J\|.H........8....-2[~....%..X....3.9.E<...pT.. ;.pC.p...c...6.XA.#.$..,c/.M.y.......y..>.<^..

Chrome Cache Entry: 462

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.090012084439345
Encrypted:	false
SSDEEP:	3:INhtq4btxbKBf+BiAIFRNVC3h0i7GeYHoIp//uxbKBf+BiAIFRNVC3AYZtXL1h8T:otqWtxbQLZVVi7GeqlcbQLZVZYZ7qT
MD5:	938464F4A51E80A29886967E2DD10247
SHA1:	6CA208768620D334DC104B093C6B816BEFD75CAD
SHA-256:	E5E1650378525B31C2E2805A4CF471C306C690A4F01466044490D53753E83BBF
SHA-512:	D432657412D9A0D75171CFC35F9F3A1DF6383406D76BF299A1EC230E859C2DDA71BF452129956E66538CB652732ED4F8E47BA363691F18C77D61A7442391C30C
Malicious:	false
Reputation:	low
Preview:	<HTML>.<HEAD>.<TITLE>HTTP method GET is not supported by this URL</TITLE>.</HEAD>.<BODY BGCOLOR="#FFFFFF" TEXT="#000000">.<H1>HTTP method GET is not supported by this URL</H1>.<H2>Error 405</H2>.</BODY>.</HTML>.

Chrome Cache Entry: 463

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	39328
Entropy (8bit):	7.91647038087011
Encrypted:	false
SSDEEP:	768:sTr4PLxNiNEPGcuQ/a6fnySk3mlP+QbesnAnQ8Bno8ZKSUTWeO6d5ptuFO:sgPi6PGcuQ/aenypup7AnXnoCKFTW7q3
MD5:	417CE707E1BFD94EF710E908C06D973E
SHA1:	A2B3D1C72C9CC57F52DFBCC528649E73D43C5C2F
SHA-256:	1022F1662F9F02AC55DC95402144F2AE71D6F0A14C19B3E3041B68B529946CFC
SHA-512:	CF11FA71A5146A66B36D0CD33DC0805FF8B9DF3A6A8366F6D30EBF071E355E0CF5936B0E0A4D1085F392F17F0D01EB418F0D2E24C6315D198C5E346EAC3F4125
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/xphoto/500x500/184698944.png?k=6bb1bf3c13db4a7ba3c22a2d1f1051f793c525a78104703b4dec3eb12101f545&o=
Preview:	.PNG........IHDR....................IDATx...X.V.g..t.l6u.M..l.f.{.n..q.)N..8v.n.{...1..cc.j0...7......6}....3...\|..G...J3..;..+.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.tz........C....E.X..b.v..]A.....;)Aw=.....m.....u...........Q\...P.N..B.W..b....f...X].:o.ejE.j1o..

Chrome Cache Entry: 464

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 714x300, components 3
Category:	dropped
Size (bytes):	30612
Entropy (8bit):	7.962493421163404
Encrypted:	false
SSDEEP:	768:GF+J7sHAHkkVVY8DpASdWyYj0HwCBzesEeg:GAxsHAHk0VY8OQVYY3Be5
MD5:	7CE960E4070E2B6660CEB7AA8CB502FB
SHA1:	1B7DD5D49465071807299ABA9E3586909601BEBC
SHA-256:	A637D32244EC0B11738B3F7F109EC33F1089C088FBCD52D32D2981786B79EA19
SHA-512:	FDC1FB6AA6076A8F8B3D4E4FE599C28626A47AB79C479485833B43A5CAF28724BA1ACB165F80CD9F8335DB115423BA6F167F1998AC33A0C5CC8B2A6482828161
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......,...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..<R..P..`z.$.b..8........<Q.T..I'8..;.R....i)h........dR......@..".$.P..?Z....4...9....t\..j...@\|....t.b....31=.N,.....PhDW.yA./\.jA0..l....`=..l.8...H.....<.O...N.C.B.{b.{.A.0NA..] .\...E....;Ggwk.F..x...V.K..J..5....`v...N..S&kC..J.=......`.3....e...a.FG.)c...>b.#.z..)..m.d.r.4,0.g"...Q.....j......Q.S.$...m..b6......*.F..S6....5A.I......b......

Chrome Cache Entry: 465

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 466

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	"https://www.booking.com/js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=87e482caf42702d0&ete=&etg=&etcg=cCHObEfEITNPfbeQMIaWYUQJFFQccCcCcCC\|5&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,cCHObKdBdUHINPSXeHDALOLOLMO\|3&etgwv="
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 467

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4179)
Category:	downloaded
Size (bytes):	215125
Entropy (8bit):	5.538811289142484
Encrypted:	false
SSDEEP:	3072:s6WUbMSWBWudiQg/28vnxSY+ZxJruqzj/QIOGZXIAoK:x3Wcu8QPL7j/QIOGxTF
MD5:	035D1DDAD14C58DD0B70FA442157EA2E
SHA1:	E3A96E4DB4F846EF56583118C554B9FEB405B4C3
SHA-256:	9AA173EDE3CE1554E5019D85AE45F968CCA3011E80E3936524B99C1A910C228A
SHA-512:	ADDFAE6241C850F4A6307EE5DCBBB9672739201601668277012EE0075B7F5A9A95ABBDF3830F86810934830B296A7861D669E3EE06E32E095CC34B7D96E87D0D
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/gtag/js?id=AW-1070314322
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"1",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_ads_datatos","priority":13,"vtp_instanceDestinationId":"AW-1070314322","tag_id":7},{"function":"__ogt_1p_data_v2","priority":3,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_lastNameType":"CSS_SELECTOR","vtp_autoAddressEnabled":false,"vtp_regi

Chrome Cache Entry: 468

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2341), with no line terminators
Category:	downloaded
Size (bytes):	2341
Entropy (8bit):	5.881255654747649
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt081yLzH4RohtzYig3raH6:wsbSUtJfxrqLWWWdV6j1hyLzjS
MD5:	591FD634EADFBC309C27184024EF4213
SHA1:	8EAF3E45A03529DB37768CD540EE9794BBB9E349
SHA-256:	9C51FC5B7FBB3A3509FE3DF99246F8B4EF047CB9FB931E16A9CA02634E6F3826
SHA-512:	0CC7A4BD6C76EF149AC584EEF9770EDC6F89729B7B55C0DA1BC15119EE987718B3D817D0254E25B4C7EAB73A4B981C3EA2AAB0CD399741A319F695206E177A1E
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975716499/?random=1707417344655&cv=11&fst=1707417344655&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 469

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	6427
Entropy (8bit):	4.861223156043332
Encrypted:	false
SSDEEP:	96:FQef+XH7M70djbWejwZ1ICFBr81YO7+VlyZ2PK/ppdkvbMFIKuFsVzgoAytvPBxr:FsrMYoZdD0dcg/HavbKm89
MD5:	D6865979621492BAC92096993C559C43
SHA1:	6FE79DBD9D775D24ACA921E5B6ED9EEC4572F31E
SHA-256:	3D5DB88A81FF70F7D26E336FC8ED4188F5AE5032F97D334E4288322889096B77
SHA-512:	2C6D42383FA0C6C441BB810B0E25322ABAE62903B3E2DC2AAB563F4DA6419DB196FABE1D1229583F682180C3A144E5709E2C3EE529EF53211010B11A05D9B3D5
Malicious:	false
Reputation:	low
URL:	https://accommodations.booking.com/orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=BXAbRIVE
Preview:	{"chunks":["b9a82cb8"],"experimentTags":{"YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO":1,"HMbOHNFPBJYIYKcPNSNHRUeBOFO":1},"featureNames":{"IeZXXDNFVFKOUYLLFJYbCceMNPVbPSUabSccETKe":false,"EBDIbIbXDeBGGTcZJFfHbeMPET":true,"IePFbJMFVFKOUYLLHNOVRe":true},"seoExperimentTags":{"YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO":0,"HMbOHNFPBJYIYKcPNSNHRUeBOFO":0},"copyTags":{"webcore_shell_footer_booking_statement":"{b_companyname} is part of Booking Holdings Inc., the world leader in online travel and related services.\n","webcore_shell_footer_copyright_statement":"Copyright . 1996.{currentYear} Booking.com.. All rights reserved.","a11y_webshell_close_currency_selector":"Close currency selector","a11y_webshell_close_language_selector":"Close language selector","a11y_webshell_header_tools_currency":"Prices in {selected_currency}","a11y_webshell_header_tools_language":"Language: {selected_lang}","traveller_header_account_currency_all":"All currencies","traveller_header_account_currency_most_often":"Suggested for

Chrome Cache Entry: 470

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (7214)
Category:	downloaded
Size (bytes):	448749
Entropy (8bit):	5.972183944312411
Encrypted:	false
SSDEEP:	6144:OHohejDmOe085RR2ppfG7b599T2gTf4O4:ONLzCuod4
MD5:	E9787FF5F1315D438296C1AFEA6CF1BE
SHA1:	56BA32B8CF38B56D3853DB2D7A5125433E8CD6A6
SHA-256:	53521F028C3A241FEB4DC7392E8784A8E9DEEF658F1DF658B99A56942D40FC16
SHA-512:	DC231CC0D7A0FC4AA87237362FE59E229B69168759D597A1DEA278EE3DE298B2BA5A125F68870ABA7A4A9F36D2F15C7DCC41B0C18B55D420A099FFFF52532D31
Malicious:	false
Reputation:	low
URL:	https://www.booking.com/packages.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d
Preview:	<!DOCTYPE html>. .You know you could be getting paid to poke around in our code?.We're hiring designers and developers to work in Amsterdam:.https://careers.booking.com/.-->. wdot-802 -->.<script type="text/javascript" nonce="sYkUlSNHJtq4KnM">.document.addEventListener('DOMContentLoaded', function () {./*. provides the current user's cookie consent.* in order to use it:.* 1. inline privacy/cookieConsent.js in the page you need to use it..* please note that this library relies on window.PCM.isCountryNeedCookieBanner to be initialised.* before using (calling getValue function) it.* 2. in your js file:.. var privacyCookieConsent = B.require('privacyCookieConsent');.* var consent = privacyCookieConsent.getValue();./.B.define('privacyCookieConsent', function () {.var consentGroupIsAllowed = {.analytical: 'C0002%3A1',.marketing: 'C0004%3A1'.};.var optanonConsentCookieName = 'OptanonConsent';.var optanonBoxClosedCookieName = 'OptanonAlertBoxClosed';.var halfOfYearMillis = 180 24

Chrome Cache Entry: 471

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	5836
Entropy (8bit):	7.959947047903202
Encrypted:	false
SSDEEP:	96:GnMBVrUQ3I8p1jSp4XRHBYl9AcYvXwuoxMkbtbFa8y8ALDaYNN:Gn4VrxBGp4IldY//Otbw8ydLp
MD5:	C23DE4A26E2BD5634A13C0A7BDE4EBC2
SHA1:	652353DCFFCAC1DC3B14E23F400F9CB645321BEB
SHA-256:	55D6DFEFEF64DFA4E7EC2BACC87A3E755C90B666A3D05A62D8259162CBB69695
SHA-512:	0E12C0DEF3BD5CD5447F40D12839FBC1164FE602844ED16BF68A095A2C2AC7DD6DD8B2DE8E5F14124781466E0CB08B03BD7F7B12528149001FB64B1CD741D681
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/square250/689617.webp?k=edf88994b0c6b4c060300b942efdc1242289d1a695fcea13493e20596edc7daa&o=
Preview:	RIFF....WEBPVP8 .....{.......>m2.H.#...0.....cn-.Z..% .......}.%..W....e..x......0?p...._...x...wn...o._.reH.==$.C..\_..#...w.....G..>.....+ ...n..#..j.O...........vD........2..J?....;^.......F-.v..2X.._8........m..~.@....&n.y.@..eU..T..L]r.V..y....,....?9..irn0..@....S..O6R.@..=..VpqOS.@...........B:a....v..e3n.-+=.....f[..R.M.L...&>.P..o.k..\.........DJ...........X.v?i..AZ...4.....`.%..8....Jl.O.$....(~.Q...l..e.x...?..r8our..9.F.4......#..y..W>h.ZR....%...7...%.....&...z..._..h?..EZ.0........^.A._.5.i.!T31V....?W.~....GU.3^.v2d\'....c....)hC4..45...fo.[..c..B>7.4.5..H..K.X..z....o......%r.o.m-...l.f:.%.....L.*N...n...4{:....).hFC.r..)3.O`...$.......`...h.2n_....;p......P<O.E(.Y ......z.jc:.....^...B.F...>.X..#.0.F2q (.km..V.,}^a..a...'%.B'.bc%......P#Jph.>..gsjc..d.2[?.j$.Y4...e.J.][....Gi=.KMJ.I.4...a..U.zgi.B6.G.Lwr.1.M.j.\|n.....q.....O.D.J\|.H........8....-2[~....%..X....3.9.E<...pT.. ;.pC.p...c...6.XA.#.$..,c/.M.y.......y..>.<^..

Chrome Cache Entry: 472

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 354x266, components 3
Category:	downloaded
Size (bytes):	13198
Entropy (8bit):	7.937859559336789
Encrypted:	false
SSDEEP:	384:npDVNz2rwEfVwmYYzS1f8hLSrNSNAR7mLpVBqm:pDg96mYYzS1f8hCNSNeqLpGm
MD5:	93B368DDFC86143393FC8D2260DE45CE
SHA1:	7745E46FEDB9BDA48C3C7A2EE002BF91F2A196A6
SHA-256:	AF077092217D66FEDAEFFE481B80D92AAE921617550F88C9A3270AC864DAE59D
SHA-512:	E34D0261746B44DBF200D95BDAAB0100FD22E361D30D36AC7041AFD7666A1CB3B31AEB8E1B2027AA3F55228CD66791A869E06C98370AB9709D4E8A646121FAB5
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/354x266/977346.jpg?k=0afb2125e3ce4648cf017d8dc1c2c73ce97eea5d441e17b3cc2106b2c5816029&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........b.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.........E-......P.QK.(.(.....R.b..QE..RS.(......QE..b.R.@.E-...R..)h......JZ(.....b..)qE...Z(.)qE..QK.S...R.!1E-...)h.bQKE ..Z(.1E.P.IKE.%..P.QKE.%.R..QKE.%......Z(.(......Q@..Q@..R..QKI@...P.QKE....1LAE-...R.@..R...(...IN..bb.Z(.(.....Z)..R...QF(......J)h.a.(.......(..P.E.(..%.b...E-...R.@.KE..QE..QKE.%..P!(....(..........u...)h....Q@.E-.......J)h.....C..Z)..QE..R.@.E-

Chrome Cache Entry: 473

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65487)
Category:	downloaded
Size (bytes):	226735
Entropy (8bit):	5.346118746193619
Encrypted:	false
SSDEEP:	3072:sosn/wOry3D0j+mTUXBwgPl/QC2NwmMxrrSeKdSF8UeZ28m4u7k5GT2/2uReiMmZ:64OrM4aWmd/QC2NwfagFAZBakfRV
MD5:	CAD5FE4C499F7568E14E7AB6FF9B3361
SHA1:	7CF66966B26C499B535EFD53C77F65DF7DA14338
SHA-256:	83F4228D1D92171186E8B8CCCE6E69B32AD6B322DB4AF7E4B6F54CE50E299587
SHA-512:	88320686F20F22AA51C2F9493EE8114A9E613C2C93B6F104FFBFDF7A096CE6A3111BA5ACA7598EE1BA1B4FE953D141C79598C5AD096FC89E81F1370D844AE886
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/css/fonticons_clean/base64/woff/5d61b8a7156073e5e3e9741f65dda44ae3eef7d2.css
Preview:	@font-face {. font-family: 'booking-iconset';. src: url(data:application/font-woff;charset=utf-8;base64,d09GRgABAAAAApe4AAwAAAACl2gAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAABHU1VCAAABHAAAKNwAACjcNQw8SU9TLzIAACn4AAAAYAAAAGAPEge7Y21hcAAAKlgAAAHMAAABzNfFHlhnYXNwAAAsJAAAAAgAAAAIAAAAEGdseWYAACwsAAJY7AACWOzKPBVGaGVhZAAChRgAAAA2AAAANhact9JoaGVhAAKFUAAAACQAAAAkEqwQt2htdHgAAoV0AAAIDAAACAyG4yWibG9jYQACjYAAAAgQAAAIEAJMgdxtYXhwAAKVkAAAACAAAAAgAiwDLm5hbWUAApWwAAAB5gAAAebQPj6JcG9zdAACl5gAAAAgAAAAIAADAAAAAQAAAAoAHgAsAAFsYXRuAAgABAAAAAAAAAABAAAAAWxpZ2EACAAAAAEAAAABAAQABAAAAAEACgAAAAEAOAAZAG4AhgCkBaAIzAyuD2wQShJEFCQU+hW6FeYWzhg+GIQZ2h1CHcAfZCLMJxwnYieUKJgAAQAZABAAEQASABMAFAAVABYAFwAYABkAGgAbABwAHQAeAB8AIAAhACIAIwAkACUAJgAnAgIAAQAEAbgACQAfABgAGgAeAA8AFAAfAB4AAQAEAbkADAAWABgAGgAjACQAFgAiAA8AFAAfAB4AOwB4AIgAqgDCANwA5gD6AQ4BOgFKAV4BdAGKAZ4BsgHGAegCCAIeAioCRgJUAnICjAKkArACvALMAuwDAgMOAy4DRANUA2gDdgOEA5QDogOwA8ADzgPgA/QEBAQaBDYEQgRQBGIEcAR8BIoEmASqBLgEwgTOBOoBRQAHACYAFgAiABIAGAAWAQgAEAAlABgAHQAWAB4AJAAWABUAIgAWAB

Chrome Cache Entry: 474

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	dropped
Size (bytes):	8350
Entropy (8bit):	7.9431995395937385
Encrypted:	false
SSDEEP:	192:mIoyumNqtrhRbdqcm5XtTGb9TohlBUUPRpv9+HSJh6:noybNcrhRbJWXtTGbWPBUUZp846
MD5:	DEECEBFD96AFF60E10FD5E8D298F2E6A
SHA1:	45029E4B67085DA726802561C0B595862620D62E
SHA-256:	2F448C79E56FDF2F2C5C1D9C7FCA9DAD527EEDE734BFB329ED1303D54D365A70
SHA-512:	76B3ABA23CA9623D3D52C24ACEEB99C3EC7C06BB7136A6C109CAB6758CDCCDDD2CBFA4EA8FF829376FA9966C9EB8EA03D82B1FA62EC9839C53E3DA10268068A8
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...i.kXl...Q.B.?........B.fxc'i.7a.J..y.{..K.......`.V .....j.......#x. ..=.....k.\.Y.r..6V......D..A.<...y..x.LM?Sx.:..s)S =.?w.s....Y-.+....>.8..C..Y.=....7FG .a.......q..W).$.......v1..t.}.v.%...]..\...c....Q.5..sqr.uX....k....:.=.4... ...I....V..3.....I....+/.?..J...).A.@......X..g1....3.Z6...8==G9...:....3.4I.,.s.......qNo.....$....*...A.sZ5N.M.W..

Chrome Cache Entry: 475

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2363)
Category:	downloaded
Size (bytes):	2479
Entropy (8bit):	5.178474925626043
Encrypted:	false
SSDEEP:	48:04aCJvTLa7tbAekC/fnPGPxqBurgWEgyTJ:5lvTL+tbAekQnPGPx2urgWEgyTJ
MD5:	F22EFE190D4CDFD20E43049D1C12A165
SHA1:	F51CE2FD8089135FD0EA35940D015C41DC4C94D1
SHA-256:	7846A1779E5D575E40796388DD2E7C23E5637ED2E4CD13B82D5AAF4CF444F539
SHA-512:	8FB3BBB7A9079DB43707BCB5B943EEB4728424EC8DC71F7506E8C4652C3E0FE80C21F822825DCFE55CB6BF88A49AD5AD659B7A910E10F90BE3E7B4AF49DEDC1C
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/cfbdd235.7a595d50.chunk.css
Preview:	.a529739de5{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch;border:var(--bui_border_width_100) solid;border-color:var(--bui_color_border_alt);border-radius:var(--bui_border_radius_200);overflow:hidden}.fe04f404b8{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch;box-shadow:var(--bui_shadow_100);border-radius:var(--bui_border_radius_200);overflow:hidden}.f538ae62ac{flex:1 1 0}.a244555425{background:var(--bui_color_background_alt)}.a6271fb6c2{margin-top:0!important}.edb4db1de8{flex-grow:1}.b8d585fcc6{border:none}.e98333fe6c{-webkit-line-clamp:2;display:-webkit-box;-webkit-box-orient:vertical;overflow:hidden}.bc476201ed>:nth-child(n){margin-inline-end:var(--bui_spacing_1x)}.e714215256{-webkit-line-clamp:2;display:-webkit-box;-webkit-box-orient:vertical;overflow:hidden}.cb32f1ced0{overflow:hidden;white-space:nowrap;text-overflow:ellipsis}.d542f184f1{fill:var(--bui_color_accent_border)}.bca48

Chrome Cache Entry: 476

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 477

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=4228414;type=views;cat=views;ord=4729221658983;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=900727044;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2?
Preview:	<html></html>

Chrome Cache Entry: 478

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	314
Entropy (8bit):	5.259531250480507
Encrypted:	false
SSDEEP:	6:CYQTS4JsSNGhqwXNr2fzR63ZX5h4pIoauw1le:C9e4JsPFNreRYeIoauw6
MD5:	E262F92E286A4C74280BD4B3FDEE8CBB
SHA1:	8339EBA25BEC526F3F7D9EB719BE268966BCF263
SHA-256:	809658CF80A3CC36DD168EB34ABBB4C00671A277CE8E560FA79C7564A9008BE4
SHA-512:	A007EFCC5351D1DF4C08E32AA603848A8EEB652A618A79C50929C04326B1FC6048A0C9E786DC32C0129E33F545A7857BA00665730B6C061A3B518E43D641BC0D
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/a6a21c13.8939445f.chunk.css
Preview:	.b2ca975670{margin:0}.fae1400be2{font-size:14px}.a41871ce38{margin-top:var(--bui_spacing_2x);padding:var(--bui_spacing_4x);padding-top:0;width:100%;box-sizing:border-box}.ee574b34fa{font-weight:700}./# sourceMappingURL=https://istatic.booking.com/internal-static/capla/static/css/a6a21c13.8939445f.chunk.css.map/

Chrome Cache Entry: 479

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (25760)
Category:	downloaded
Size (bytes):	25872
Entropy (8bit):	5.477999837956159
Encrypted:	false
SSDEEP:	768:BO6QDWmlrvhfaUxKD0gJd3HFFdy/tnG+H0KtYtwukH64h:c6QDWIq0c3FDy/L/2wut4h
MD5:	16323CFBC6F714B70BB4777CC3449E90
SHA1:	136DDBC61FBA2F9C28CE576FE06A62BCE62176D3
SHA-256:	73CAC66939CA176576B38E16CC17347ED3B9C486A8BB70A24D32C76DDD0CBF48
SHA-512:	4282694171DDB8E67A5A8FC6BCBDFF0DBA2EF77016A79FD53C400928D8DED4A410CDAA4EB703D1BCF96FD73BD9DFC4B8D9B2E3A5B95ABB6FDDF8BF4C54D666BB
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/a6a21c13.ad9f14d9.chunk.js
Preview:	"use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["a6a21c13"],{"34827c64":function(e,t,n){n.d(t,{M6:function(){return a},t0:function(){return r}});var i=n("ead71eb0");let a=function(e){return e.WILL_BE_SHOWN="WILL_BE_SHOWN",e.WILL_NOT_BE_SHOWN="WILL_NOT_BE_SHOWN",e.LOADING="LOADING",e}({});const r=()=>{const[e,t]=(0,i.useState)(a.LOADING);return(0,i.useEffect)((()=>{function e(e){const n=e.detail.willBannerBeShown?a.WILL_BE_SHOWN:a.WILL_NOT_BE_SHOWN;t(n)}return document.addEventListener("cookie_banner_loaded",e),(()=>{let e=!0;return window.PCM&&1===window.PCM.isCountryNeedCookieBanner&&window.PCM.isUserGaveConsent instanceof Function&&!window.PCM.isUserGaveConsent()&&(e=!1),e})()&&t(a.WILL_NOT_BE_SHOWN),()=>document.removeEventListener("cookie_banner_loaded",e)}),[]),e}},"0f5c0451":function(e,t,n){n.d(t,{Z:function(){return m}});var i=n("dee2534d"),a=n("ead71eb0"),r=n.n(a),c=n("04fa1900"),o="b2ca975670",

Chrome Cache Entry: 480

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65455)
Category:	downloaded
Size (bytes):	216272
Entropy (8bit):	6.082599575911287
Encrypted:	false
SSDEEP:	6144:JavRtnMZNk6A28X25M5H6uYMSfj604GPnm:JWt6s0zM8gim
MD5:	8BD695624A0284C0C75E95E6CF849E19
SHA1:	955D58097C9D3C3612F305ED997930310F6D5125
SHA-256:	E59758C9199BE9A8CE8C21BBE88674BF415A746706E84E55A66152365677A867
SHA-512:	9D3DBC2D1D607EF8B498466006A8D99BE517C5D4C7789012342120D395D9ABA0D4EAA9EDEE92276CAEF87A96D2FFC3FC63EB5FD47ED83B78DC42F7C3265BE168
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/eb60141d.05ae682b.chunk.js
Preview:	/! For license information please see eb60141d.05ae682b.chunk.js.LICENSE.txt /.(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["eb60141d"],{a6c91b97:function(A,g,n){var e={"./ad.png":"1b0e14ba","./ae.png":"79f4f2b2","./af.png":"47af882a","./ag.png":"ba989a08","./ai.png":"3fb7150c","./al.png":"a3f433e7","./am.png":"a720c5ab","./an.png":"2b655bfa","./ao.png":"59209aaf","./aq.png":"125a0ea0","./ar.png":"e6dce2b6","./arab_league.png":"2dc8a495","./as.png":"a027ae2c","./at.png":"21bd6a9c","./au.png":"6e89bff7","./aw.png":"b1f7eab1","./ax.png":"6067b69b","./az.png":"82701119","./ba.png":"ddafd303","./bb.png":"1803e935","./bd.png":"77c37d20","./be.png":"416a1ae3","./bf.png":"0bfbb5ee","./bg.png":"62c47655","./bh.png":"a675732a","./bi.png":"032a5203","./bj.png":"141d0cdb","./bl.png":"38f97126","./bm.png":"a489fcfc","./bn.png":"b8af7d74","./bo.png":"ecc4b24a","./bq.png":"b05c71ef","./br.png":"3b22eec4","./bs.png":"7128c28c

Chrome Cache Entry: 481

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	downloaded
Size (bytes):	2433
Entropy (8bit):	7.803666019198735
Encrypted:	false
SSDEEP:	48:o9YMbuERAiSQ1sebVHaJD7ut4AA7vCqiNz14k2oW2rGQB8IAK:ghCEVxR6JvuGAA7vViXHG2rGQB8IAK
MD5:	BE6C515CF539EEA17A2A3153C0047679
SHA1:	F62369C43572E8DCCC1E4A59A972227F2FA00272
SHA-256:	6F4F39506546768A5959AAA94EB1AFF88A5ED5E7D6D2A9B715CE61305A7802C7
SHA-512:	D9A6995E504772F6428BC57783EA60CD7667FD70EC545EB84401D22D2E1E3E479C8150CECE2CA154F0B9480CAA5FDC5A5428FB2038C99E2126C12DD4F0CC068C
Malicious:	false
Reputation:	low
URL:	https://q-cf.bstatic.com/xdata/images/city/square100/976905.jpg?k=5a3ac9e6ec03eb39b872674694fc81d05643a1cc7df66b2e93d0de4bf21801d7&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......d.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.../j....g..h..R8.2^...g..x.E#7.%....k<5]....L..h..M..Z.#6...0.Z.a..2.3.^..._1SLUW&.....QN....B.V.GP.U......{T...j.U..Z)..d.^...Z...@.{V.Fn&SEP.U...T-..h.f.f..3..i.}../j.".L..0.ZF.ji..H..7....<.j).....h..J.....H..L...x.M.../j.L..-....h....S!..hj...Z.j....S!..0..5.`...=...q3.>....i.=...j.ryL.....QO.\.rTSJ...y7=K.m..:..".E..U....V.PU....*......h.R.K...S.B..

Chrome Cache Entry: 482

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 483

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	5.250746419165476
Encrypted:	false
SSDEEP:	24:2dYwahJhWDCLf3fbeVZmFy6yCXCWX9JVLNpwtbMIhU7C06Fa5QcPm:cyJhbf3fbOKy6yCdtJWWFL6FSQ/
MD5:	E8209D74AD093F151954A3820C12E5D8
SHA1:	12FBF39039F0182026ABAF8B0A22E75C9BB316F7
SHA-256:	C80B9838465A2C5AA19E06C25631CD22D81DD8C76563875EBFB4D35304DFBA47
SHA-512:	4DC04BF54E06A26D78C6D71EAA392059B21EA8A01BF6C6B1EB808F9A01758C18DB18A28A9D74A841B3D5F2249787890944EC94EE0A6D4B2F99042138534800F2
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>. Lovingly exported by Jess Stubenbord for Booking.com in Amsterdam 16-03-2023 -->.<svg version="1.1" id="bdot-favicon" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 192 192" style="enable-background:new 0 0 192 192;" xml:space="preserve">.<style type="text/css">...squircle{fill:#003B95;}...bdot{fill:#FFFFFF;}.</style>.<path class="squircle" d="M37.8,0h116.5C175.1,0,192,16.9,192,37.8v116.5c0,20.9-16.9,37.8-37.8,37.8H37.8C16.9,192,0,175.1,0,154.2V37.8..C0,16.9,16.9,0,37.8,0z"/>.<g id="bdot-group">..<path class="bdot" d="M144.2,143.8c6.7,0,12.1-5.5,12.1-12.2c0-6.7-5.4-12.2-12.1-12.2c-6.7,0-12.1,5.4-12.1,12.2...C132.1,138.3,137.6,143.8,144.2,143.8z"/>..<path class="bdot" d="M106.7,91.9l-3.1-1.7l2.7-2.3c3.2-2.7,8.4-8.8,8.4-19.3c0-16.1-12.5-26.5-31.8-26.5H60.9h-2.5...c-5.7,0.2-10.3,4.9-10.4,10.6V144h35.4c21.5,0,35.4-11.7,35.4-29.8C118.7,104.4,114.2,96.1,106.7,91.9z M67.6,66c0-4.7,2-7,6.4

Chrome Cache Entry: 484

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 91 x 26, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1628
Entropy (8bit):	7.784928057284059
Encrypted:	false
SSDEEP:	24:DXGHdcP4D/gO2WdAnzMWSYfJhvbsUT/HZwDN9cbMkfYKjOmJeMs1R2t7UB3:DWHuP4XxIHQgHjbMkwsOTME2GR
MD5:	3E32EFD25AC0214B375FC8A6A32890F2
SHA1:	CD46A79DB7E53E19D5869B3CB3E7AA22EE523479
SHA-256:	807C8A1B498E17D227CF48A640B778BDC4398A9852493CB2F40BF0F33651D0DD
SHA-512:	E0F6807657EE1667876D66DCC13CD279C973EAE35E53509E86EC31951B8B07EBBCB0A1B3FC9BBDBC423F436C1F82BDC5C0440F875092E82A47CF51286CDE0C00
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/img/tfl/group_logos/logo_booking/27c8d1832de6a3123b6ee45b59ae2f81b0d9d0d0.png
Preview:	.PNG........IHDR...[..........2 P....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......IDATh...}l_e...O;......L..S'.G/n..22.bd..s..(d.x...(J.....!....E...%,..2..uceD\|...c.....u.._{[[\Lm3.7.....>/..<...>\|.8F..c...'..=..'{.1N.(.E./.\|......U..#:[./.Y.CY...~.6.X..,..k.F..X...H<...[d....oZ...a.o.T....59#.VL...l,G/.E..y[......59#.c.O..&l.............~\= .dy....2...e.c..d....j<....Y>....wc.f.....3i.3...")..&....b..i..'J!....\.....U....K.0.m.k;.>.o.....1.?i.k...g`.tK...-...U3?64.?...W..d.tl.@~.n.Q.....g...s...........A.V..k.y..>...........,f..e....0.y.... .O.=N..w.t...[p. {.:......N).......VI.Y.uV.....b.,...6=..~...qx.o..j.Cw.vj....D6Sp'.'y.......O..Ml..h_..../.\|...........g.'c....Yq.....O..{../...x.y........o:.WK.....}.,?....,V(..R"......57.,........].. ....<7V....x4t.....a....s1.xo....Q.}.Q.]../.......z..F.v1f......5..qyE.....h.W%{....,..K..[8...\|gE..W.\|w.6....U.g..8..n..q}E.W....S.bo..#y.PxCE......F...J1x

Chrome Cache Entry: 485

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3160), with no line terminators
Category:	downloaded
Size (bytes):	3160
Entropy (8bit):	5.949267133591452
Encrypted:	false
SSDEEP:	96:wsbSUtJfxrqLWWWdV6j1pKIXHoeNx1kk3:JrPWwwpKIYI5
MD5:	B9560CDBD63C2E3769F6B744639328B5
SHA1:	07B7916C58C7EBE8B5C44F2A7627A87DD1A7A790
SHA-256:	9CC48145D5535B84510CEA08A685D5926447F615528E74CA1CB1DE682AA89896
SHA-512:	9A28271E7F1F6B3F4EF8A894950E30C9DB02F26DD9E08D299D5D82225D29FB1CC42D3C485EC7EA8970669B70F26C5E330354650ACBA94DF4CE81735F0A854FAE
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1060768846/?random=1707417370594&cv=11&fst=1707417370594&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nh4qqVoyv2KiIad5kPNddW86jrjYgKSk8&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=page_type%3Dhome%3Bcheckindate%3D-1%3Bcheckoutdate%3D-1%3Bhotelid%3D0%3Bbook_window%3D%3Bweekday%3D-1%3Bdest_cc%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bnights%3D-1%3Brooms%3D-1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Bguestcount%3D-1%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdest_ufi%3D-1%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 486

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 487

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (22016)
Category:	downloaded
Size (bytes):	22132
Entropy (8bit):	5.42358311849877
Encrypted:	false
SSDEEP:	384:xn7lx/djHUSYGSPeushrnnwCh2dhAH98kFzBSedN+HmdOX2FUk:nx/djHU7Gqe1wCh2CH9NdOX2X
MD5:	38C1479DA92F5CD233A5FEED62E2D75E
SHA1:	065B4801B466DC3E7216C93E434E05E6CCEE8744
SHA-256:	DF8CA07B2ABFA3AB347600DB4D1E68C5A975DA80200F9E7E49F3F6088C3484ED
SHA-512:	E37CD309B37A775C8AB4DF16F1094DC64ACDA1C48233AB4ADEABCA33AA1824D7F7F8C577866615A7E246E8DE575B7F28BA9590D9300A2CCB6788BCAC63A29767
Malicious:	false
Reputation:	low
URL:	https://q-cf.bstatic.com/psb/capla/static/js/remoteEntry.40329cb8.client.js
Preview:	var bWebcorePromotionalComponentService;!function(){"use strict";var e={e186fc69:function(e,n,t){var r={"./GeniusWrapperAccommodationBookProcess":function(){return t.e("c3bd4f94").then((function(){return function(){return t("d2ab918f")}}))},"./GeniusWrapperAccommodationConfirmation":function(){return t.e("485b1120").then((function(){return function(){return t("876f5eb7")}}))},"./GeniusWrapperAttractionsBookProcess":function(){return t.e("20c9a2d0").then((function(){return function(){return t("f8a0243c")}}))},"./GeniusWrapperAttractionsConfirmation":function(){return t.e("8497f245").then((function(){return function(){return t("a8ab38fa")}}))},"./GeniusWrapperCarsBookProcess":function(){return t.e("acbe2261").then((function(){return function(){return t("47435bf4")}}))},"./GeniusWrapperCarsConfirmation":function(){return t.e("aa2eb83b").then((function(){return function(){return t("0add8e80")}}))},"./GeniusWrapperFlightsBookProcess":function(){return t.e("98d62e3f").then((function(){return

Chrome Cache Entry: 488

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 2880x868, components 3
Category:	dropped
Size (bytes):	245767
Entropy (8bit):	7.948498789608872
Encrypted:	false
SSDEEP:	6144:39mtb2UjDzQo+Nv2+8O5zhwJDDKW2r6F+QYLI87eb3VzFyZo:Nypj/B+VXiBDKW2r6dYjab3Hya
MD5:	FB85E3F5959D74E781F58FFAD5E3037D
SHA1:	9DF89DD837AECDC743E60E51B26C4CBC4A4A8FE1
SHA-256:	5D792D42BFE6AC44DAB107FE96F0E6EC90B3727EFC41B68146B20676392AF510
SHA-512:	97C813AE769FA5D524D755458C590AC035CC212EACF82FF199EF578529218C7606E96C23E6B2C44B40F2FD09D96C9CF114142132673C7CCE077BDB1BFE8EDDFC
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......d.@.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..."...E'..'...i>\........jA.S.....q.!.i.E3o4.....9..R..P.g<Rb..-.7..h.JH..i...P..O....8&.......3F0x..=y.8"....h....dS...b....P)...#8...A8jC..h.q.i6.......S..a...ORh4.`Rm..Jx...N).....@..ix.JF(... .....!.9..=...&....H..h.h..Q..wJ1.@....jQ.....9..8d.x...1GA.....9....4... .`*.H..zQ.....M=y..r.7..!p1.i S..I.....4..O....L..H.x..jv0:..!.`.`...iT......ql..n.....P...9..s

Chrome Cache Entry: 489

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65532), with no line terminators
Category:	downloaded
Size (bytes):	498537
Entropy (8bit):	5.56630259653198
Encrypted:	false
SSDEEP:	3072:uG+Zg6Jt0v0WpAD4jqAiqkQhdq9XHTwQ9KK/Z+vEY0D:mZg6J6v02STw01Z+8TD
MD5:	AE43B8D72CD3132BCB061DF36F217784
SHA1:	21CBE82E6073EE2718FD6F175CAECC3BFE1E569A
SHA-256:	AF71F1F6154A6771DB2C7DEB5071AE9CCE27694539BB36CFA8664BF0E0BCB600
SHA-512:	E57D4F176D741861376B74F7E2800E51B8ADA5CF55057A5C53FB1ADC5E5C6031587FBC00F9B9DA114F6A5A7B3799FFA48EB200A6A50A2DD5AFCD96FAE0C42615
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/accountsportal/assets/index_f26add0f1ee6ed4ed8de.js
Preview:	"use strict";(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[826],{30039:function(e,t,n){var r;function o(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function a(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}n.d(t,{n:function(){return s}}),n(59357),n(27476),n(95767),n(98837),n(94882),n(98351);var i=booking.env.aid,c=booking.env.is_cn_domain?"booking.cn":"booking.com",s=function(e,t){if(e.indexOf("{lang}")>=0&&(e=e.replace("{lang}",t)),e.indexOf("{domain}")>=0&&(e=e.replace("{domain}",c)),e.indexOf("{aid}")>=0){var n=e.indexOf("?")>=0?"&":"?";e=e.replace("{aid}",i?n+"aid="+i:"")}return e},l=booking.env.features?booking.env.features.enabled_integration:"",u="extranet"===l\|\|"attractions

Chrome Cache Entry: 490

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 491

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (15804)
Category:	downloaded
Size (bytes):	15916
Entropy (8bit):	5.361275167522276
Encrypted:	false
SSDEEP:	384:ygpcx5wqVKcIAMD/k3lcM0NtWQ/dYVxbWOcA9IunLintD:/puVdIAMD/k3lcMgtFdYVRWOcAeCLinl
MD5:	762DBDDE80C9B4FADDAFA20DF78215DE
SHA1:	2A51D08E79EC069C793D852775564B748E28D260
SHA-256:	61404440C550449DA11D26C7632D2E639F1B0C9C34E50E4D2D16C0645398197B
SHA-512:	CB318ACE7C83C732D991F86C510915C12004259EDBCD43104D966F810F046A1502B6ACB7D84FD5921E8D6DA601F5F72D2925ADA20EDB0F7B93D80F5279BAE858
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/7bcb015e.cf9d45ea.chunk.js
Preview:	"use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["7bcb015e"],{af1e2b38:function(e,t,n){n.d(t,{Z:function(){return i}});var a=n("6ee88c54"),r=n("dc6d28ff");const i=()=>{const e=(0,r.getRequestContext)().getSiteType()??a.N.WWW;return{isWWW:e===a.N.WWW,isMDOT:e===a.N.MDOT,isTDOT:e===a.N.TDOT}}},"261e3243":function(e,t,n){n.r(t),n.d(t,{default:function(){return J}});var a=n("ead71eb0"),r=n.n(a),i=n("af1e2b38"),s=n("dee2534d"),o=n("dc6d28ff"),c=n("d1e54a96"),l=n("975f4b85"),d=n("41c6c66e"),u=n("cedcabf9");const m={},_={kind:"Document",definitions:[{kind:"OperationDefinition",operation:"query",name:{kind:"Name",value:"GeniusGuestData"},variableDefinitions:[],directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"Field",name:{kind:"Name",value:"geniusGuestData"},arguments:[],directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"Field",name:{kind:"Name",value:"userInfo"},arguments:[],dir

Chrome Cache Entry: 492

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 720x217, components 3
Category:	dropped
Size (bytes):	25671
Entropy (8bit):	7.964895192972628
Encrypted:	false
SSDEEP:	384:qlBZvk2iTaMf5rsNr+vzLpfdnGt2pW5MbdihLVEo32GTDNAoBNkKxN8Wn9LRvHym:qlAZ2e5rBGaWibdifGkpBNvN80KiMyP
MD5:	E8BC48549C1E82C951DF411059B81A85
SHA1:	1A77B13C57125FBF8DD5DEE35AD1DB4BABDC9427
SHA-256:	7398A7BF4867D9A59CE24A193BE3F38267F6B612BE70FD9EE9BF56718E69E9B9
SHA-512:	F0D1DB4FF187FC32F8354543525AE605139EFF45A4C8011A4EE65D91231DDC48828CCCDC617D92697792033220BA4B44A9A39539AC5C0BC6268B19AD66902953
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....i.....'.....-0..6.h.@.....&)v.S.0...H.@2E .}(+..uS.J.:R.\....U...L.}.h.m..J.m4.#.9W&....1..8..E.T8.D..Y6tE.$.T].. 5....."H..) ......A.,... sR+. ~t..K.\|..Uz.)...Q.s...^z..i.K..rLi..}.L.1N.6G..mI.J....I.ZM.9...W.....m5.....o..J\R...j6T..q.J."......c..f.F.~)i..{ph.5&)B.@...;m<-...2..m...m..b0.m.6...E.....M.\v#.J.5 ZpZ..#.K...J...0%.jP.m.q.m!^*m..q

Chrome Cache Entry: 493

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 494

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (40932)
Category:	downloaded
Size (bytes):	41125
Entropy (8bit):	5.438866473473526
Encrypted:	false
SSDEEP:	768:JC0SSDcXzPAhitHVKD6AbpWOP1++NictSZ+Y3:ZRDcXzKit18PW81heN
MD5:	9A37E1026A86376B5F5A3992471355A6
SHA1:	71AF7D644A96E95FED51E5544C736628A1239308
SHA-256:	2DCA3F532156816D0EE81533016241C2DF2B1200F776EB6A2046DDEA07E9CFCB
SHA-512:	761D3AE02C6662AB743C195BD2126ED396879C9200C9CF12A8E6AF1DEABE9FFD4C39EC3733771CB325A03B00160B75E11C00ADD33B55A743485B4AD90C2C9DEE
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/da34a25a.be1d7e1b.chunk.js
Preview:	/! For license information please see da34a25a.be1d7e1b.chunk.js.LICENSE.txt /.(self["b-packages-core-packages-frontend__LOADABLE_LOADED_CHUNKS__"]=self["b-packages-core-packages-frontend__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["da34a25a"],{"95d18bc1":function(e,t,n){"use strict";t.Z=void 0;var r,a=(r=n("ead71eb0"))&&r.__esModule?r:{default:r};function o(){return o=Object.assign\|\|function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},o.apply(this,arguments)}var i=function(e){return a.default.createElement("svg",o({viewBox:"0 0 128 128",width:"1em",height:"1em"},e),a.default.createElement("path",{d:"M69.7 64l33.1-33.2a4 4 0 0 0-5.6-5.6L64 58.3 30.8 25.2a4 4 0 1 0-5.6 5.6L58.3 64 25.2 97.2a4 4 0 1 0 5.6 5.6L64 69.7l33.2 33.1a4 4 0 0 0 5.6-5.6z"}))};t.Z=i},aa4f11f5:function(e,t,n){"use strict";t.Z=void 0;var r,a=(r=n("ead71eb0"))&&r.__esModule?r:{default:r};function o(){return o=Object.assign\|\|fu

Chrome Cache Entry: 495

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (5657)
Category:	downloaded
Size (bytes):	6162
Entropy (8bit):	5.599076700545423
Encrypted:	false
SSDEEP:	192:Sb04pPhtmpvftu/PvJ/CMMKJ8UotoqzpfLEj:s0i5fPJ6FEPkIj
MD5:	6AAAF8E11A32FD37FB419E3A4CE9696C
SHA1:	1FD88F2EE4DE5422E0C344DEBEFE3F2B5ABB2592
SHA-256:	468959E93F9B4E6F07C6A8F8D0E93D8FCB37D76A8615A93EC153F5842247BA99
SHA-512:	748B27BDB7C7FA082D7BE6C69F56DC33302105784391320A5CF960531C594097BC406FD3F4690E4CF74F4016F4D56804A4296E9BD885562EB66699E1318F7000
Malicious:	false
Reputation:	low
URL:	https://6187c7943c8809a450d5ea0d812d35d9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Preview:	<!DOCTYPE html>.<html>. <head>. <meta charset="UTF-8">. <title>SafeFrame Container</title>. <script>.(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var f=this\|\|self,h=function(a){return a};var n=function(a,b){this.h=a===l&&b\|\|"";this.g=m},p=function(a){return a instanceof n&&a.constructor===n&&a.g===m?a.h:"type_error:Const"},m={},l={};var r=void 0;/.. SPDX-License-Identifier: Apache-2.0./.var t,aa=function(){if(void 0===t){var a=null,b=f.trustedTypes;if(b&&b.createPolicy){try{a=b.createPolicy("goog#html",{createHTML:h,createScript:h,createScriptURL:h})}catch(c){f.console&&f.console.error(c.message)}t=a}else t=a}return t};var ca=function(a){this.g=ba===ba?a:""};ca.prototype.toString=function(){return this.g+""};var ba={},da=function(a){var b=aa();a=b?b.createScriptURL(a):a;return new ca(a)};var ea={},u=function(a,b){this.g=b===ea?a:""};u.prototype.toString=function(){return this.g.toString()};var ha=function(){var a=v,b={messa

Chrome Cache Entry: 496

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 41884, version 2.0
Category:	downloaded
Size (bytes):	41884
Entropy (8bit):	7.989662178868263
Encrypted:	false
SSDEEP:	768:jvcmfwECQiuZ8ZlKLpPMEBFQpqFzMgyxoIx3ZLocdW6dqoVtkdJtq32yoODC:jvcmfwENiuZQl0PMEBFye9efELPoVtW/
MD5:	8F40A0D11EF71CCB75E5FC05A4BC3247
SHA1:	8313E0244032A1DA5889E3D8B3865653676804FD
SHA-256:	C98D56CD0DDFDB82B8E290EACB4357BD334DA7318EDF5E41FC5175E5E4233673
SHA-512:	3CCEA656A46C2E2B908B646B0ECA1994BF761DCC32C5372E8D6517D020F5DCDC5DB31577F9A53B5FBA88103F2AC81BC6C3C9D6CD0DA2326D7027B3EB53B26105
Malicious:	false
Reputation:	low
URL:	https://t-cf.bstatic.com/design-assets/assets/v3.81.0/fonts-brand/BookingMedium.woff
Preview:	wOFF.......................................GDEF..\|........x\.].GPOS..}... ......R._GSUB... ...z........OS/2.......[...`i.A.cmap...........la.D.cvt ...H........#...fpgm...t.........0.6gasp..\|.............glyf......d....B.+WLhead.......6...6...Nhhea....... ...$....hmtx...T...4...D.rd.loca...........$....maxp....... ... ....name..{...........G.post..\|p....... ...Jprep... ...(......@..........}S_.<...........K.....V.h....................x.c`d``.........r...L..................M...R......./.a..........x.c`a.b..............B3.d.b..`d.fcfb."...L......j8.......(..?....y.......ArL.L{..../..#.F.x.....I....z..d<.^l...m.m.m.wf{.[.{.Yo....Us...~qwj=I..&4.....[G=....f..Y}......K8c..G.;S./p.....`wH....=.^nc.s...O.0.F...c.........B%LM.3a...vT......J.'t.~P...8.2..-.......S..J+.z.{6,K.i.}..V@o...5..2gg....'v..A........p.."...C.....k.6..".E..5:J.w..N_m6.4.z..a`k-..h/M...&Mc..]\g..KncM.k.FM.Y.......`=...FkDC.l.x......B.u5.G$..\U.m..}....5..S.w....o.{S5.m...o.7....vQQXo...&E].]U

Chrome Cache Entry: 497

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 120 x 120, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3759
Entropy (8bit):	7.92345914707464
Encrypted:	false
SSDEEP:	96:Z3jbH7dSZvr9rbAd2c0dJ63XMvypW4Fpby7kXAZvgtX8DrJNa:Z3jLxSlBw2eIsW4Fpby7RZvK8n7a
MD5:	4F8BE30173D60369E61612204C1A9013
SHA1:	D66791AC7F8F1AAD4146D80F555A67571FD5BACC
SHA-256:	47B58F0909CAE06BC80A8D79E50758D188832800D541C7285A8BD72F3B23A0C2
SHA-512:	C8AAB2B2DB4EE533DAAA78A3C4FEFE8EFDE7CCCC4C9851AEEDB7F912467D18A1BA1739634FA1A460F81E36696FDBBC3E89D6372199CCC274D61232396A48F27B
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...x...x.............PLTELiq..V....n.....\|....................C..D..........F..B..A.......F..............[r...............................G..H.............................A..7.....,......s..z ...l....i.......X..E.p..........G...x......L..j}.......\...vF......tRNS...-......I...m.{mB..=...V../......pHYs................8IDATx..Yy_......$.c.,3/U.MUA-.`7 ...K.'....j\1!.{.xDEh....{..J...x.#..G._...;_uk}T.......xS_....j.....y.....-.....b.o+..-Y..KH`..[k....b..o....N..o.A@.%_g.V.J+......O.!..jX..?....E:x...B./Fi....3A@..o.".Zy....X.....;,..o.,.Z.....Eq.$..U. A@._.5.....w.....k,........K.7.X.\|2.b..J+....1J...z...WlI....a....~.....u....[......W.I..`(%lW.k...&....{.t..]bi...p~r?..=.x.XZ...b.......y.bixIl.O...a.H)%../.W....Z..D.%...k...a.K.......H ..a.r...Zo&.......:....-Bs.A@..r\.....s...SLlw>?.+4.U.G..+^5.,....om.>.i.a.8.9.....h.AnU..'.w{f@."%.r%qu{...FQ..Q...W...lw~2.zA...P_..Kn.8f.x...~..6.(J..6q.9...O...n.l...p..wo.[.HI.Y

Chrome Cache Entry: 498

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65463)
Category:	downloaded
Size (bytes):	1006490
Entropy (8bit):	5.370481567980528
Encrypted:	false
SSDEEP:	6144:gUbv0YPJ9dz8wJFinQ0rAYGll6iGuBHtNo4/wizS2cga3zq+5a9NnPCpvmCDrvVz:NwYPy4l6iGuLuMX9Nn6XvSzv6QUH/eo
MD5:	960030FDB11D5BD734786C251C3797E3
SHA1:	53B85F73336857C00D29F0860B41F2987A825AD3
SHA-256:	11B1F86FDC89376CEBC76C2BA8C8C81980C11C4055219F8B836E83DE1C40F2B2
SHA-512:	93CDF856D4E09AAB7341627C8392FE3057625E38C5408A84A6A19BD270BD27F35D364D1D059EC00C3C244BE84181C456E6E74D704631A7282896C9DB2EDE18C2
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/client.2cf42118.js
Preview:	/! For license information please see client.2cf42118.js.LICENSE.txt /.!function(){var e={"854b6ca1":function(e,t,n){"use strict";var r=this&&this.__createBinding\|\|(Object.create?function(e,t,n,r){void 0===r&&(r=n);var o=Object.getOwnPropertyDescriptor(t,n);o&&!("get"in o?!t.__esModule:o.writable\|\|o.configurable)\|\|(o={enumerable:!0,get:function(){return t[n]}}),Object.defineProperty(e,r,o)}:function(e,t,n,r){void 0===r&&(r=n),e[r]=t[n]}),o=this&&this.__setModuleDefault\|\|(Object.create?function(e,t){Object.defineProperty(e,"default",{enumerable:!0,value:t})}:function(e,t){e.default=t}),a=this&&this.__importStar\|\|function(e){if(e&&e.__esModule)return e;var t={};if(null!=e)for(var n in e)"default"!==n&&Object.prototype.hasOwnProperty.call(e,n)&&r(t,e,n);return o(t,e),t},i=this&&this.__importDefault\|\|function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.TGenerated=t.T=t.remoteFormatsForAsset=t.isRemoteVectorSet=t.isFlag=t.getFontAssetUrl=t.g

Chrome Cache Entry: 499

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	dropped
Size (bytes):	8621
Entropy (8bit):	7.916778967838765
Encrypted:	false
SSDEEP:	192:mgK0069awoQPCxLi6qpIcvC3GrJsIkYz9ix3hopvT:3G6Q+W8pnrs7YzBpvT
MD5:	72C870C967629F6F1C36561800EC1E38
SHA1:	C01C9FF688F5B9AD0B586069AFAA4B22DB171F6C
SHA-256:	FC11EDD43A2D8FBAF64E61FCD71475CC9702097CF6A33F0884CB800B4EFCAE4B
SHA-512:	608E3F35A30D183E6FED5F652FB2694842EE4740CD33C2B7BEDD7C59C5EF82311976877D7F6CB3A42B948AA8F3AAD84E76CE663E46EA2279161F140D02D2D8AC
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..3..M..q...x..\|..5.8N...K..z.@.MF...S..."pRVg"r.A....M...1...{d..l.l...M...Z..]...].~.i.........r.T.V.6....W ..r.<.....-..o2.&.E....}.4.*...e.(.G.I.E.@..ka.Qgo...e.QV...F.9.}..O..k7<.\....k...u......._...n.W..w.+.....pf."d8.\|.G?.A.....Ik;x....g..c.>..............M....O.5.....Up..^..hz.VZ.w.#.....'q..v:..m...t.~{.iS.;.......N.?......S...4...B.._.:.%%+..Q+.i_.,g.

Chrome Cache Entry: 500

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	7.784364795368813
Encrypted:	false
SSDEEP:	48:o9YMbuERAaqm35hJJbVZnTx3RIp2H6TeBQ9xJfmGNzv:ghCEUmj/x3iEm9xM+
MD5:	A61C1FA50F30CC69E20DD36913247B20
SHA1:	169E55CDAB5A5769D979BCE4EC7EDB77C16D91CF
SHA-256:	645529B8CC531BBC2314887FA7EF582C7AB472DF270B61BE897CEE1373610A8A
SHA-512:	C20C24CA6F8EADB7C265396A4C2F5112B5F73E41531D9FBFA8300809C0F7EECA35A8F9BBCE661B5D6D9CE9E740021C38CD57FE9781375BE739CAC2FAC60195A5
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......d.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...&).......f)1O...w..1N...w..\S.F)...S.K.b..R.1@\n(.b..rLQ.~)1L.........1F)... ..Q.v(..q....Q...1K.v(.0..QN....v.b..&).\....1I..r<Q.....;.....P...1Rb.P...1O.A..@..+.d3.S./...4{..7.d...W..}2...1..N...<_"..b..;.9#....c(.,..l....=8..c..&+.............S...)..@:........u..3U.c[.'....Wm.......,"%...p....%.~Q<.If...zF..->;/...k.I...PY.9;p{...\X..8^......C..V.R

Chrome Cache Entry: 501

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	dropped
Size (bytes):	8642
Entropy (8bit):	7.936811905814669
Encrypted:	false
SSDEEP:	192:mIRFaj6y6SGsxJJPZnPT11NmpbTJytPcdjxhlZK2:nR7RstPxTop/8Kls2
MD5:	C93A2183DB30C5988936B15E9BB2473C
SHA1:	9D5B308CF067E5B0EE544D3FDBA45740587D2F63
SHA-256:	2B8F25D9F2B16CB4F435787E273411EED1CDB83E7CCC56542358421AB0D90E4C
SHA-512:	066C23C192D868A2B5505813D40DE3515EA874636B70D67D9E8B93F37CDC0121D8D60B1A154DC77BB05D13E64081858EB843CEAC3649DB1F14D902054ADA68C3
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...Q.<....FF.+..]..qkVW.sq..Q.U.....X}. .J...s..e...SvWn...v..dL......A..Kt.#'..........d..j~.n..?1..:N.(..O1..0z.:...!..*;B:z..'...SI..k.#.X..."..[+..O......Gw#..2....t.....Mr"....F....1.V.......F.\|....q....>....JmE[...wB.H(....]4..5.....Y'..........C..KF +0...m...jVm....p..V;H.w.6H...:..>.RGy.Hnnm...^Fh...[..%...n.:3.8.rJ..K%...c.y,.3..O..T}...4..icW.n.

Chrome Cache Entry: 502

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17071), with no line terminators
Category:	downloaded
Size (bytes):	17071
Entropy (8bit):	5.583825404889978
Encrypted:	false
SSDEEP:	384:IKFzXBFiSaCCxNubXw66UZ3LNho9Gfl7xHF:/d7+CK8bXw66YLNho4ZL
MD5:	4BFCE2DD0BB45B7B4CA8E0D0F4424068
SHA1:	E0323AC57FF967F7A0EB0F3E4777A4FAF0BF88FF
SHA-256:	2A45857925117A45C6C9C769AD50BE518E840FE645E659762423221E1244D919
SHA-512:	3C174ABB8238F609DE7EE726BEC2A3A3B50CD24E1237AF5FA8B27792A2735453E5D38BCF49B0ABC003CFAF235576B2FB509BD2C4B8D03BBE2ADD21256643D0F4
Malicious:	false
Reputation:	low
URL:	https://www.google.com/js/bg/KkWFeSURekXGycdprVC-UY6ED-ZF5ll2JCMiHhJE2Rk.js
Preview:	/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t / (function(){var f=function(O){return O},R=this\|\|self,m=function(O,B){if(!(O=(B=R.trustedTypes,null),B)\|\|!B.createPolicy)return O;try{O=B.createPolicy("bg",{createHTML:f,createScript:f,createScriptURL:f})}catch(D){R.console&&R.console.error(D.message)}return O};(0,eval)(function(O,B){return(B=m())&&1===O.eval(B.createScript("1"))?function(D){return B.createScript(D)}:function(D){return""+D}}(R)(Array(7824Math.random()\|0).join("\n")+'(function(){var Oa=function(B,O){((O.push(B[0]<<24\|B[1]<<16\|B[2]<<8\|B[3]),O).push(B[4]<<24\|B[5]<<16\|B[6]<<8\|B[7]),O).push(B[8]<<24\|B[9]<<16\|B[10]<<8\|B[11])},Dg=function(B,O){return(O=J(B),O&128)&&(O=O&127\|J(B)<<7),O},$F=function(B,O,R,D,S,d){for(S=E((R=(O=E((D=B[jg]\|\|{},B)),D.Yh=E(B),D.S=[],B.R==B?(J(B)\|0)-1:1),B)),d=0;d<R;d++)D.S.push(E(B));for(D.cB=W(O,B);R--;)D.S[R]=W(D.S[R],B);return D.sG=W(S,B),D},U=this\|\|self,fY=function(B,O){return(O=O.create().shift(),B).Z.crea

Chrome Cache Entry: 503

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 210x210, components 3
Category:	downloaded
Size (bytes):	6208
Entropy (8bit):	7.915726822536868
Encrypted:	false
SSDEEP:	192:mynRBq8uPafCed0SkXF2+58eyLBNXe0Wi:dREPafCedrsn5aLPXj
MD5:	A7149E44DB8D60749A6142F551415A1F
SHA1:	71F09F7B2B654D63ECB1839C0EF2FA1AE26BAF26
SHA-256:	A4F87A318BFDBA1016E1189E2218978CE46D24CB0DA8FB898E7F40E79A356429
SHA-512:	4EB428A1425B028A8209BC3075AAB8132A6194BC3089923265AD61A2AA043858F330D0D014CF9B30499F1C43E40C480EF7972D8DEDF3C955BAAE154464FB2DA2
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/city/square210/682559.jpg?k=eba0a86971de163610eaab458cd7c2483f59ff8f350d2f63eceed77d21afbed3&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..m.v....v..vQ..\.m..m.(....S.e.r..m..Q..\.m.jm.yt..v...j6P.!+I...F..r..l.......6....r..m..I.C...Xf.....T...Z..[h.Rb..C#.S.E.r..F....Fw+....S.e1\...eO..e.r...eO..e.r..m..Q....;h.Sl.e+..v....R...C.....M...".F.m&)X.E....I..r-..{T.}.6.....+Sm..@.v..+F.C...EI.(......NOjiB.#..K..h..8.+"a...;.Vp...S.)Gm.jm.m.L.A...6.j6...6....0.ri...[Jb.a.(..Oe.j}.l.+..mNR.

Chrome Cache Entry: 504

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 505

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	642
Entropy (8bit):	7.485255326893554
Encrypted:	false
SSDEEP:	12:6v/7+FO+DpBBzM22sBdG4llNTJ6yHfbE8/jALtcq4PsesuZtC6mN:5tj2sBdpXlHfw8chcqgsCZxmN
MD5:	41A0E840AA47C87E19D2BFE0B1231C3F
SHA1:	B5F588CA91FC9E67B5EA658C5FF943B0639E57B9
SHA-256:	A333D02EEDDE7A4DD8643D58B0EA7947268A1762F35F517EB6000EC9E7FCFAE8
SHA-512:	8578A788F605BC27B4326EB38417A71E45A05AC885B971C49AC3C7D23F6DDF747F69F2CCF3DF0C461E1C90268247D6959F248D3001518F56888F6D6B8C1CDD2E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.....`......uPLTE..0<9p..0.'@.....0<:p.s}TS.....a_.HFymk.IFy.;I......yx....HGy..........Wd.........&@...mk.......G^............l.........tRNS...;%j.....IDATH..a..0..`..5..KiA8..S..O.y.....h><..4.......c..0..Pm.v......i...iuo..;..X..H'7LVM.....{..5zM.{.B"-4r[O..L..fw.hY..G...\.@h.U.kS...d.2`{...]i.....Zt@....t.,.z..W..x..........V-lB...S.!...S....U5.....E.+...g..4.....!.?...N..w.7-L[....<j..\|.+r5.u~..a0.<.l..._.h.q..4.....(.>.<.E.I...-t....X.S.77-nX.......^.T.*.....s.m.......~V....Lnz....Y...5......-...\|...{q...'.lN.W.4W]..<.......`!..A......D@...$.....0X.I..1XI.....T....C..@.}....IEND.B`.

Chrome Cache Entry: 506

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5619), with no line terminators
Category:	downloaded
Size (bytes):	5619
Entropy (8bit):	5.417620647133485
Encrypted:	false
SSDEEP:	96:jBk1uC0QWpquQRZ5xPD+ePa72OCvR+2v4KC6Jt4hM8ixH0MMn8Y5xg0KDlvoj5+f:jNCCpqHRZ5xbq2d1gQxH+8qwBSQvAgAi
MD5:	023FD7251563F3D53A56E92130146DCC
SHA1:	0E8228EA58A086A73E3FCD8E914B5759AFFE5E7A
SHA-256:	994EC33DE4B9253B6ABBF26965DAFB40C822E0B333E334456BE7FF2A6FA638FE
SHA-512:	900F8A68AC5AE4653B2D3CA64AF79E0A9B29577DDC2A07687D781B5B0E98F5CD4CC71B07BCDC221E1297B9998193D22CABDA1A7318FAA846AD03450F7B857131
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/lazy_load_images_cloudfront_sd/77204d4da4aa41b08b1a4062c8e66e4629550994.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};function ImageLazyLoader(){_i_("796:a3c4e208"),this.highResQueue=[],this.shouldLoadHighRes=!1,this.viewPortExtendedHeight=null,this.isWatchingForNewImages=!1,this.supportsIntersectionObserver="IntersectionObserver"in window&&"IntersectionObserverEntry"in window&&"intersectionRatio"in IntersectionObserverEntry.prototype&&"isIntersecting"in IntersectionObserverEntry.prototype,_r_()}ImageLazyLoader.prototype={SCREEN_HEIGHT_COEFFICIENT:1.4,SCREEN_SIDE_COEFFICIENT:1.33,LAZY_IMAGE_CLASS:".js-lazy-image",init:function(){if(_i_("796:ba3462d7"),this.watcher=this.getWatcher(),!this.supportsIntersectionObserver){var e=function(){_i_("796:8f1a9933"),this.viewPortExtendedHeight=(window.innerHeight\|\|document.documentElement.clientHeight)*this.SCREEN_HEIGHT_COEFFICIENT,_r_()}.bind(this);window.addEventListener("resize",e),window.addEventListener("orientationchange",e),e()}document.addEventListener("readystatechange",this.enableHighRes

Chrome Cache Entry: 507

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (737)
Category:	downloaded
Size (bytes):	853
Entropy (8bit):	5.277483296688978
Encrypted:	false
SSDEEP:	12:XfYcuq8hvhFxVpJW1VVLOgSqut1GexVWSzwB68a5ZwKtLOxEXWr2IoauwTBo:XAvq8hDxV+VKuujVbEB6PvixEXq6
MD5:	6F3E8BB7938A05E927B3CA4454F98FA8
SHA1:	C4E87597CFEB98F0BE34F2163978CD85DA36B1CD
SHA-256:	28A8DCCC02F121F8EA78E7CD78A70494B6593CB8345434FEF99D6B739DC5D1EB
SHA-512:	E24D656D6CD12AB29EF408F26809B5ED5ABB1552FA67D21576C903B6262867DCFD047D329DF25B0A5CE85B87369A7743F6C8211B4D764922BC9DA600A5DBB8C4
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/c6a78acb.bffda4a9.chunk.css
Preview:	.c779636eef{background-color:var(--bui_color_brand_primary_background);border-radius:var(--bui_spacing_2x);margin:var(--bui_spacing_6x) 0;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.ff75376f23{display:flex;margin:var(--bui_spacing_4x)}.f433c16992{height:120px;display:flex;flex-direction:column;justify-content:space-around;align-items:flex-start}.ce6613f3e7{width:140px;margin:0 var(--bui_spacing_4x) 0 0;align-self:stretch;display:flex;justify-content:center;align-items:center}.rtl .ce6613f3e7,[dir=rtl] .ce6613f3e7{margin:0 0 0 var(--bui_spacing_4x)}.f742f17cff div{color:var(--bui_color_white)}.c6286cd018{font-family:Avenir Next,BlinkMacSystemFont,-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif}./# sourceMappingURL=https://istatic.booking.com/internal-static/capla/static/css/c6a78acb.bffda4a9.chunk.css.map/

Chrome Cache Entry: 508

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 79 x 26, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	7.756974676688925
Encrypted:	false
SSDEEP:	24:zn1XTOSh5oncvg3/pzi9NUvZi/GZu4yVEb6cgfes54AVi8TgBgWPPKWfW:zde/3x+1OZkEbhgft5TbTgdPDW
MD5:	6384185CBE9A4F106857A3CB85CAEA98
SHA1:	0E31A4FE2CE98A8B4FDA60687AA71079B4D3A95B
SHA-256:	5839F0330821CF08029BEDDD6D248170DA1AF16CD7AFF253E7BD075D591F5D42
SHA-512:	E9C784DACADEAB6C3FAD53729701708EC5C21670086AA981953FF2D44DFB08BE13134707A4E7405826CC0D11C68F3AECFD6601AF910C537F6E14AF68175B50B7
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...O..........w.....IIDATx.....:..sl.g.ym.{ll=.m.m...f^.A.1zhg.i:...ZM..5@.YF.................o....hU9......B.s.h....<......=~........b..'.....5.l`..V...z...b5...E.........8.........f.C[.lS..z.IcI...X..r.:......x.Y.....}+.h^G....3......6.Ni..........G.......S.....W.Is.I..S.`.e..)p.hh..T....`...Q.....V......".}.X8..v........k......84.....-9..d.....lq....FuA.zJ5._..@cX.../....a..y.....;.r.>Lur[.w......O._~..:h+H..>.y...p...4..{.\|aBu..y].....a..w&L0.Y.e..}U...'.s...=.......n..^.r...+].I.-G...r....8].FkR.'.......u..e.c..w..%@.}.e...#..K..w..Ak.[@.R..gY.u.2/..y.Q.n.O.......]y.n..pk8.s7.......y.:..F...M..h......y....`..O....i.zqp..<........Zp..h.+..@...;/.#...0..u..N...v..)..6Oq.d..n<.M../.....0....EMn...3..=Q......r..../....8...'..wv/.w..'MS...[..........<.y}...4.Nm....qk.9d. n.Y....yZ1.?..!..Dg...m....;.N...A...I3.gn.]G.A[.w....7.6Om.........zD....v....._.D3x.v...6.]WR..7........=.."4.....\|.......:...a...Z....~..\..~

Chrome Cache Entry: 509

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (25134)
Category:	downloaded
Size (bytes):	42347
Entropy (8bit):	5.508936219287704
Encrypted:	false
SSDEEP:	768:J+a/6VUbdYHemeJzl516Uk2a++IhJ8aq9EpTEDGOzGx3vcM7G:J+VUMemsz16U7a9Iz8spTPOax3UMK
MD5:	49C3A4E7EB4227C22E1C6F8910A64EF9
SHA1:	99DFF9C031D2E8928947202C8F9212870CEAF2D8
SHA-256:	4FA43686588023170EB7FAF73F6286802413D5E1C23132A5E5962AA90A84C515
SHA-512:	7DCC14BD183E6CA479A5C9E7064B1AD79848757718C0F20E33862EB19442F30C8DFD8792A61286513ED91065D58CBB0666EBB5EAEA87CAB4478162E37497898C
Malicious:	false
Reputation:	low
URL:	https://sc-static.net/scevent.min.js
Preview:	/** Snapchat Pixel SDK */.!function(){"use strict";var n=function(){return n=Object.assign\|\|function(n){for(var t,r=1,e=arguments.length;r<e;r++)for(var i in t=arguments[r])Object.prototype.hasOwnProperty.call(t,i)&&(n[i]=t[i]);return n},n.apply(this,arguments)};function t(n,t,r,e){return new(r\|\|(r=Promise))((function(i,o){function a(n){try{u(e.next(n))}catch(n){o(n)}}function c(n){try{u(e.throw(n))}catch(n){o(n)}}function u(n){var t;n.done?i(n.value):(t=n.value,t instanceof r?t:new r((function(n){n(t)}))).then(a,c)}u((e=e.apply(n,t\|\|[])).next())}))}function r(n,t){var r,e,i,o,a={label:0,sent:function(){if(1&i[0])throw i[1];return i[1]},trys:[],ops:[]};return o={next:c(0),throw:c(1),return:c(2)},"function"==typeof Symbol&&(o[Symbol.iterator]=function(){return this}),o;function c(c){return function(u){return function(c){if(r)throw new TypeError("Generator is already executing.");for(;o&&(o=0,c[0]&&(a=0)),a;)try{if(r=1,e&&(i=2&c[0]?e.return:c[0]?e.throw\|\|((i=e.return)&&i.call(e),0):e.nex

Chrome Cache Entry: 510

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2344), with no line terminators
Category:	downloaded
Size (bytes):	2344
Entropy (8bit):	5.884538787171897
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08ydE8Ae4wetzYig3fZ36:wsbSUtJfxrqLWWWdV6j14ERHMc
MD5:	2FEB3C07023223A61F6464FD455C1741
SHA1:	BD4EF764785DD265728CFF2B6E788FEEF1E78A51
SHA-256:	378794BC688106D87063C8D0CAAB531FCA387A68EA5836CA97FF6BA9749B6432
SHA-512:	C16727FCB8F9A8F9A874B8C624652DEAC2FFBB1BBF9527A0681DD6F27566D7D33C01AEF0725458D3E3F3AC59211B7B427088D45AC7DAAFC14846AF59AA78E919
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/988382855/?random=1707417344393&cv=11&fst=1707417344393&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 511

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65386)
Category:	downloaded
Size (bytes):	446622
Entropy (8bit):	5.5010287358227234
Encrypted:	false
SSDEEP:	6144:uDNICfy5KD/Ky7HzORVewmLVZkGAAViiBFKcLNp:gICfy5QzXLrkhiBFv
MD5:	A2B35ED007A18A7591E31AB8A8334C3D
SHA1:	1E9341126A7186168E027255825C8AB3E9D9A3E9
SHA-256:	B00ED7AC792010CDEDDCB5D6C719FF7E719E5046DEDAC2053B3CAF64FCEB579A
SHA-512:	A8E48848ADEE26FB162B36F47CF919F5E94C28CCB107C4C57CC98F2986CE2D30E0F4FB41146D4D05E4FBA6BEC8AD5C94BD8D0371F33007C360FA07F0CB9CE5D7
Malicious:	false
Reputation:	low
URL:	https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402010101/pubads_impl.js
Preview:	(function(_){/* . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 ./ ./ . . SPDX-License-Identifier: Apache-2.0 .*/ .var ca,fa,ja,na,pa,sa,va,ua,wa,xa,ya,za,Aa,Ca,Da,Ha,Ja,Ka,Ma,Pa,Wa,db,fb,mb,ob,pb,qb,rb,tb,yb,Ab,Eb,Fb,Kb,Mb,Ob,Qb,Rb,ac,cc,bc,dc,ec,Xb,fc,lc,oc,rc,tc,uc,vc,wc,xc,yc,Ac,Cc,Dc,Gc,Hc,Kc,Mc,Nc,Pc,Rc,Oc,Tc,Vc,Wc,Yc,Zc,$c,bd,cd,dd,fd,ld,md,nd,od,jd,pd,hd,gd,qd,rd,sd,td,vd,wd,zd,yd,Cd,Dd,Fd,Id,Kd,Md,Nd,Od,Sd,Ud,Td,Zd,ae,$d,ce,be,de,fe,Ld,ke,le,se,xe,te,ve,we,ye,Be,De,Ee,Fe,Ie,Je,Ke,ue,Le,Me,Oe,Pe,Qe,Ue,Ve,We,Se,bf,Te,cf,gf,jf,lf,pf,qf,rf,vf,wf,xf,zf,Af,Bf,Cf,Df,Gf,Kf,Mf,Lf,Qf,Sf,Tf,Wf,Xf,Yf,ag,dg,fg,hg,lg,og,pg,qg,rg,sg,ug,vg,xg,yg,Ag,Bg,Cg,Dg,Eg,Fg,Ig,Kg,Og,Mg,Sg,Tg,Ug,Qg,Rg,Vg,Wg,Xg,gh,eh,jh,Dh,Yg,Rh,bi,ci,gi,hi,ti,vi,wi,zi,Di,Ji,Qi,Ti,Vi,Xi,Yi,Zi,$i,aj,bj,oj,qj,tj,vj,wj,zj,xj,Cj,Dj,Ej,Ij,Jj,Nj,Oj,ak,gk,ek,fk,lk,pk,rk,sk,tk,vk,zk,Gk,Ck,wk,Ok,Mk,Nk,Qk,Rk,Uk,$k,cl,dl,M,el,kl,il,vl,N,xl,yl,zl,Bl,Dl,El,Ll,Ml,Ol,Pl,Vl,bm,dm,fm,gm,hm,im,lm,pm,rm,tm

Chrome Cache Entry: 512

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 513

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5955)
Category:	downloaded
Size (bytes):	232527
Entropy (8bit):	5.56504740003246
Encrypted:	false
SSDEEP:	3072:b4iEWUbMSWBWFsdUIp28vmxSY+5lr8zj/QIOGZXI2zpM7nxf09+:0b3WcFszP5kj/QIOGxHzpYnxZ
MD5:	81847C954C1C81549979B6BC401F8920
SHA1:	3EA05A66C38804E250D0C9E807A0EAF1B657577C
SHA-256:	B8A80A2F6C6FC10FD6524EA0353FFACDF5B2204D786113927D7F5BCB753163DD
SHA-512:	C12C91855648DA126620DE4206151D37B3CE1FF54669A2097F13F396E68DCFEC701727E8FF8CA19BFA5C6B5331FCC20A9836B3B9F964CFC12AB5E63647DD89DA
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/gtag/js?id=G-FPD6YLJCJ7&l=dataLayer&cx=c
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0},{"function":"__c","vtp_value":false},{"vtp_signal":1,"function":"__c","vtp_value":1},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_referral_exclusion","priority":8,"vtp_includeConditions":["list","booking\\.com"],"tag_id":111},{"function":"__ogt_ip_mark","priority":8,"vtp_instanceOrder":0,"vtp_paramValue":"internal","vtp_ruleResult":["macro",4],"vtp_enableIpRegex":true,"tag_id":113},{"function":"__ogt_1p_data_v2","priority":8,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_c

Chrome Cache Entry: 514

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	5.29667321658567
Encrypted:	false
SSDEEP:	12:YNNGa0+CXz/iQseN7iDz8MZQZtfkh+HN5vT9l9IU27Tqb:YNNGa1CXz/iGwDxZKt8h+t5Rz20
MD5:	FD4EE90FC4384FD3F8DAF33BFC07F6B7
SHA1:	3D937294F3D7C558F79C374552245E3C75553B19
SHA-256:	D9967BFE34BC32073EEDF854714DF08729BCC6379920708EBC7111F9D374FE1A
SHA-512:	12EA45E066B6537DBE08E8B2CF2A2CDC1E834EBAD1378582602C3F1580D1F3E655C33D4A2E4EB54484B0AB9908BED645D6B71DC639BC3849C2AFD9DBF312D5AE
Malicious:	false
Reputation:	low
Preview:	{"/3102/bcom-www/accommodations/index/index-primary":["html",0,null,null,0,50,320,1,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,null,null,null,null,null,null,"AOrYGslXqzWxZnMwa10HhsoG5C0a","CMmp2rGxnIQDFf2t0QQdsysDYw",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1",null,null,null,null,null,null,null,null,null,null,null,"AA-V4qPak3bmnGDOr5fZS-IYFMqXd474Pv10qEHor0Qbk4u-TzKA7l4c5wFUxV3IHK5WFQo8z2Nt9FkPNCcshx1DYh6uZgRLUtsVk5whnWD05t90X9upVXB8wCtV0ikLQ0-8X-_crthfOnB32Np4dFRHVg_zbjm0l9Td_JjeVsYf4RMMQq93icqYyYw8NIQhPZTb72iXyXuemQwgKOcsxTsl4dxO66IqdWd-y0wXzsBb6rchVGeadzkIJt54HbPysNNpLZ04zCGoRH8_L9Pz7fW6ygpshuLwlOIqJr-v2g7Mf2MjqO63PUDRXpy2z_nzAn5LT86Ne6gi0h0maClbCoT4H_FbnZTteeV0",null,null,null,null,null,null,null,[]]}..

Chrome Cache Entry: 515

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 109 x 26, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3221
Entropy (8bit):	7.926541742311065
Encrypted:	false
SSDEEP:	96:rIGMcponR70HgyaFrym+U95ICrxP5rxwSlA3hf2ZMAo6y:fFond0HgDmDCr3lm/D
MD5:	38784D782A29A302DAB9135D63AEF953
SHA1:	04DB0E863A35062A355C4B2EA9585EC83C4FFC3E
SHA-256:	8561E200A6A57195E480ED9D893B14579EF6ACDEABFBB3FE22B5E4EC9B84B455
SHA-512:	741DC6204353821D6CB76E16E36AF4176C1518EFC22AB064BABAA0D21DDB8BD9BA5A08F10A82D899DF3D880E5AF8BE76037CF342813D0D22A02A9558AAD12C67
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/img/tfl/group_logos/logo_rentalcars/6bc5ec89d870111592a378bbe7a2086f0b01abc4.png
Preview:	.PNG........IHDR...m............/....sRGB........OIDATh..X.pU..>........(* .T......V...Z..m.Nk.."..CE..M\|..(-K....:.X.....Xd..P.(E.B.{...;/.&.3.3.3.;...;.?...._.%.8....("PD..@..".E........#..7.K.?.Q2.Z....=;......)..1.\|..,..n.\..,......R=/U<...../F...:.].\|>Q......O...#>.RUV^.\|.Vb.Q..%k.RB.a....8........h...O.=...Yu...q2.6.y.9...R~...@...2.........X.R..._=.../.\|..=......q~..G.{..w.......}.< g.#..!....}#-.........2...8....k.r.(.g........'..1...XF-..:...S..#..qny....%6.y.....h...GF..rMr...o.@f.J....../.+.}.j.G\ ...?.>..j..x.Q..a._.....(......(.i.xky.......tGGE"..BiH+.__YK7V7D...'.I..d.N.oj......c.$#...1..........`DV5...x....c...$...1..r...#...)..n..T.....DzsucX.<=.1p.....G&Q..............3.k\..4.............l.Q3.".t...WE.).i.O.U7.5...'.j..1.o...u..DT.d.D.W/.....T5...G.R.Cb.vG...B.Q2X..../s:Wn.. ......z.1.k.9...Y-......F5.zt......(...I~.....~..:....^.k.8!R.~.x.H.W.Y $/W#.*DB...[<.1..U.E....Z.-..F.n.l._e..d.q..6C.k\|..8.......j.$....

Chrome Cache Entry: 516

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	284453
Entropy (8bit):	5.466215306441189
Encrypted:	false
SSDEEP:	6144:fa+4Crzv0uta7Fg/rLuhvS7SNzL2Y9Ow4i:fa+Vuguh67gQi
MD5:	890C09286DE5B03B9EDF0D8DC6027B30
SHA1:	D5493F9BABF783A2D232A80B63248EF60011D30B
SHA-256:	B978CF12A8F23630144B8F62949EBDB94F931452073D2C99D2E6CFBF5BB6583B
SHA-512:	02A97578DAF92FB5D9AFC11EABEF95D561D9718BDB518277B70155E9E354CC4138DC65A2ECCDE44A08EF84717208C7561E808FB5D0D060988A224C2B84538032
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/flights/web/static/js/screens-Home.67ba2cfc.chunk.js
Preview:	(self.__LOADABLE_LOADED_CHUNKS__=self.__LOADABLE_LOADED_CHUNKS__\|\|[]).push([[89049],{27479:(e,t,n)=>{"use strict";n.d(t,{Z:()=>r});var a=n(67294);const r=function(){return a.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 80 32"},a.createElement("g",{fill:"none"},a.createElement("rect",{width:80,height:32.049,fill:"#004cb8",rx:4}),a.createElement("path",{fill:"#fff",d:"m44.9668352 5.5533056c.216944 0 .339024.090062.3661543.269157l.0058137.082203v6.00384c0 .598784.15488 1.081728.468224 1.446784.311552.365184.752384.546944 1.318784.546944.8360411 0 1.5222034-.3462224 2.0583844-1.0386671l.1210716-.1659409v-6.79296c0-.204512.088396-.320138.2661313-.345849l.0816447-.005511h2.201984c.203392 0 .318388.090062.343959.269157l.005481.082203v9.97056c0 .204512-.089572.318864-.267687.3442565l-.081753.0054395h-1.787008c-.2109806 0-.3651605-.0750446-.4590737-.2251337l-.0419183-.0812983-.26176-.635136c-.290944.26304-.542208.467328-.752256.612736-.210048.147072-.507904.282112-.89356

Chrome Cache Entry: 517

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65528), with no line terminators
Category:	downloaded
Size (bytes):	247198
Entropy (8bit):	5.43892231185021
Encrypted:	false
SSDEEP:	6144:rQuti2pGLwVurag1OTzHKhjFkVRGL8kNVxjA2ibr8r:cx1
MD5:	5CC5D35B05C9D01560ADD9BF4B5F350C
SHA1:	C975E31EB2088A490DA37A94FDF1D86A49802C79
SHA-256:	C5759677F0BFAB4FEC44ACC9BF4B8A7EDB433004D13DF87E84B9B4ABA2EC9AB4
SHA-512:	CD7D618ED521BD547E950A86E4A8384FA40729948539109DBC5358DD8C6F0F01FFA4749EE32B3B57FA0DAF8F3B848AB3142A4E91E54E845799F6E9FDB4E4BD53
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/searchbox_cloudfront_sd/2ef4e9ae9240f4bd123bc5c51eed3c306e710ecb.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.searchbox={loaded:!0,run:!1}),B.define("caret",function(){_i_("4ab:50a5d6aa");return _r_({getPosition:function(e){var t;if(_i_("4ab:1399bc4f"),!e)return _r_();if(document.selection)return e.focus(),(t=document.selection.createRange()).moveStart("character",-e.value.length),_r_(t.text.length);if(e.selectionStart\|\|0===e.selectionStart)return _r_(e.selectionStart);return _r_(0)},setPosition:function(e,t){var i;if(_i_("4ab:536e7091"),!e)return _r_();document.selection?(e.focus(),(i=document.selection.createRange()).moveStart("character",-e.value.length),i.moveStart("character",t),i.moveEnd("character",0),i.select()):(e.selectionStart\|\|0===e.selectionStart)&&(e.selectionStart=t,e.selectionEnd=t,e.focus()),_r_()},setSelection:function(e,t,i){var a;if(_i_("4ab:b3966198"),!e)return _r_();document.selection?(e.focus(),(a=document.selection.createRange()).moveStar

Chrome Cache Entry: 518

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	5854
Entropy (8bit):	7.967728072496439
Encrypted:	false
SSDEEP:	96:CqjIEM8WTxQXti3hjYwnP8Jq/D5HeW5bcUjqvXIsyLm79D+SwPM3JKqwX:Cq8DxQXBwnP8Jqr5Heobtyy++Sw5qo
MD5:	83C1DB9FC7A4B569F8F30C07F3AF2F55
SHA1:	AE72744D12A5A2E1BF1E12AA37097A5E05B71726
SHA-256:	E57247C38D6EE6938FDCB39AF3E71DFDEC4F2BCE7357DD7E3A88D79EA636CECB
SHA-512:	2666F9C1B0A996B5D11CB61D8A77B211DFC4DD5BAFC2FCB15890198B36BDFD0CE76FAC005FACB51BFDFB095957996D9A4C90EA3128651E6B6E12BD872882F43A
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/square250/690267.webp?k=05055e2ec19868d57cf86ccb604589b988d64eacbb3e6a8645af8e8e1f8256e0&o=
Preview:	RIFF....WEBPVP8 ....P........>m0.F.$"!.V.....cj..._....\..`..W9;....^..3....{..o2_....w..`.L..=?.x}wt\|.u./m..p..]..iv..K~...o.p.z..zlm....5n....bs..YF..$.t.......T..Kr.>.'.<.!Ek{....C.W..?^Bj9.4.7.....xE.z.t..Z..=X^pYi.O.8......D..I......+.vMDQ.t4....m.....-}.'J.=...~..u{2.qr.\|.6.U.T .v.&..nhOt\|.T..m.yr..a...._3...B$[..\|..S{B..D.F.s.......N.Gx......\|.c;G.<.]m.<...n..H.T!.p..l>.....].....=H)......e..../...m.....Min.7.......fn.;..R....rMp..p=.U:.M...kPE3C.v...9.M.<Lr..1jx.....D. .....hO-....O.5d.Q.D..7bUm.8..>.&F.......qA.............W...Y.!l.N..........'..T.X_.-Y.\H....$W.HU....8..S+b.).=.._....y@.Al...Ff..{#.\..-.</.B.G{...D..b.1."....l.....A..'.m.^x6v...).6.=#...O...w".....v.K..n...h....k...{..:Jpc..BlQ....E...[...B4@E.O...z...1..Tte"...}..xYf.=....o...3..:.l.".m<C..~.-...}.........J..O.J.0./Q-.@I.@...>..W.5].G..!3.d..T......../...M.F...=.$.%^.d..3.K.,....h.A..P..fP.p.J3.r..EIQ...x._.{Z..&`....r/{..NuZ......0.P.l...J...

Chrome Cache Entry: 519

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 210x210, components 3
Category:	dropped
Size (bytes):	5960
Entropy (8bit):	7.9084645685709125
Encrypted:	false
SSDEEP:	96:ghyE4w7p9vICe8XzrjbUl+2ugeDhHm3gYlzulAgmmiwiqGsf4CbB8Cf:myFw7pZNRr8g2ugYhUVRECZqGsfJbBNf
MD5:	1CC60BDB894DFC7A8DDAAD39A311DB2D
SHA1:	961EAA2A575269BBE4D8DB3CD75E28489FA819CA
SHA-256:	E5F480190A50287822519A5673DD9CCDAD45D16F9509806731E0168BBACE7F88
SHA-512:	973403FAA98E6AC48E21EF0F24D8EB6CC32BB80D84277129E2ECA660272EFCB364C4E859951640E2804263B4A8415F3DE1A9D6C6FFD2776C501F6F2871C8A319
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....I..V.....l.8....G.#2.^.Q.J..'....&0OC.\.9.....#..!.z......fa..6...#Z!.K.....?.4..O.K.Hm.....+2.L:.M......r.4.......3B!.N.8~.m..4....N......3l....:.<....ad.....4..z.....iE....).a..B...Z Ojc[...!4fy4y5...j<.Us.c;.......&.....V3..j<.j...R.>.s....Eiy4R..).9.{5.D..i..D..2L.rB.q.......`..K..m.;V7>..#.Bj'.%a.vf..ol..."..j....&.D..sQm4...Y.Ni..~Q.S....Y\..Hd

Chrome Cache Entry: 520

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	642
Entropy (8bit):	7.485255326893554
Encrypted:	false
SSDEEP:	12:6v/7+FO+DpBBzM22sBdG4llNTJ6yHfbE8/jALtcq4PsesuZtC6mN:5tj2sBdpXlHfw8chcqgsCZxmN
MD5:	41A0E840AA47C87E19D2BFE0B1231C3F
SHA1:	B5F588CA91FC9E67B5EA658C5FF943B0639E57B9
SHA-256:	A333D02EEDDE7A4DD8643D58B0EA7947268A1762F35F517EB6000EC9E7FCFAE8
SHA-512:	8578A788F605BC27B4326EB38417A71E45A05AC885B971C49AC3C7D23F6DDF747F69F2CCF3DF0C461E1C90268247D6959F248D3001518F56888F6D6B8C1CDD2E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.....`......uPLTE..0<9p..0.'@.....0<:p.s}TS.....a_.HFymk.IFy.;I......yx....HGy..........Wd.........&@...mk.......G^............l.........tRNS...;%j.....IDATH..a..0..`..5..KiA8..S..O.y.....h><..4.......c..0..Pm.v......i...iuo..;..X..H'7LVM.....{..5zM.{.B"-4r[O..L..fw.hY..G...\.@h.U.kS...d.2`{...]i.....Zt@....t.,.z..W..x..........V-lB...S.!...S....U5.....E.+...g..4.....!.?...N..w.7-L[....<j..\|.+r5.u~..a0.<.l..._.h.q..4.....(.>.<.E.I...-t....X.S.77-nX.......^.T.*.....s.m.......~V....Lnz....Y...5......-...\|...{q...'.lN.W.4W]..<.......`!..A......D@...$.....0X.I..1XI.....T....C..@.}....IEND.B`.

Chrome Cache Entry: 521

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	18472
Entropy (8bit):	7.989626741679038
Encrypted:	false
SSDEEP:	384:p8zGQdlJLFjrxvA8brrunLbFKDubWzfNVtZ:adljjrxvpbfu3Fcu6TZZ
MD5:	B199F5D218F36B5D8F65166EEC33DE83
SHA1:	2A550F03A520EA539BBEC4953717293711E0C25D
SHA-256:	2451293A1A3364863E6D85B37E09911CBDD2A10B4AB8015DA1D726C16256ACC0
SHA-512:	901CB10AE7C25A9C8A6A4B99F987CBD3CBE529E16990F368A60AB91AAC96256782554BFCF9D8DB86857265713A7F1C28B3BCAD42A474C8165267E4F32BD52FF1
Malicious:	false
Reputation:	low
Preview:	RIFF H..WEBPVP8 .H...........>i(.E.#"...`.....S......k...._........l..>..o?\...........d.y.y...._.s.?........./....K.o.ow~..c....l..\|!to......#.o.......o.7..........w.?m;.6o...~......?R_........._...}Z.{.A........?....K.......^.~............+.....`s..!.`\...F....P..$.dzk......#..0.5.Y{.mz.(...W..CtQO.f....D..S..@r?.......P}.....<..$........;..0.r.C8..C;....V..4Pu..../..d.?%..Yt.M.%.....\|..\s...Y-c.B.mZ.1.+-.U.gm...b........V...-.j...6B<.....`>@.!;.4.).hI..WI....=T..;;l...-.`r......M..5,...Ik...2.......'i...B.,...o...3.?/../.5.CQH.;.6.hy..G...J........Od.......=.W7.Gk...U...~.lX.Uh. .q)L...\..l ..B...............Cp...r....7X.P7.(.4a/...j.L8.......iYU.s......N...7..A....:.b...B.Q../G.....X./e.j..<...`a_.........+...J[.H;...\.~....._OG....y...}y1.4..sX.j..n.r.DU.(.r.x`34...K?....wA....f..l.....aHayBp......t.YDq..l......=3_...%...8.\|r...;..b`g....,.@.?.a..szY%}.y...a...p>./,.F&h$3....,....*.Uv..\.......B.cR.T.hP...J.(}...7...:@..K.+.s

Chrome Cache Entry: 522

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 523

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.321854365656768
Encrypted:	false
SSDEEP:	3:YGKSHvANxm0KBRqSABHY:YGKgOxm0HxY
MD5:	06FCFF9AD2CFBF648406A13875BD7E38
SHA1:	1C3620D1038C1578A3B5E21E80C0523123E1E304
SHA-256:	9A970E1A236FE3E8F4A13AC7FF4E00C30809380E97B856FF6575BC2A38BBBDD6
SHA-512:	DC781A227E30ED8C62D42029B2E81100CFF50D1991FF577A2F17C1039533E7A84596121A43E627D821D9F4804A6E88A9EBE8635C558E01F72595BB4A59DA75C1
Malicious:	false
Reputation:	low
Preview:	{"code":400,"message":"HTTP method not allowed"}

Chrome Cache Entry: 524

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 91 x 26, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1591
Entropy (8bit):	6.299213971363517
Encrypted:	false
SSDEEP:	24:DRINGdp3+42X9tK0Td/YpgLWnTmSPq/rZZhwjeqcJJG0ZtNy6LBiyy3XX6w:DCc3YNtK0R/YrnTmSPE1Z6sJjy+B8n6w
MD5:	B6D0B31340D7A113F63B936E23D06F78
SHA1:	268E3856DA737F7E56E679258949EF70DDDE47F4
SHA-256:	18C62988860A8FFD90BAB6376B4FE36A723BD39403C420D3943AA3EB5A0029C5
SHA-512:	FEF2D5BA4648EE1BA476E3FBD4852E52F93A0F40988F368AF90DF4188F64E6DCB09BDE79887A4AB3FE81774168D84E6DFCB61AFBA44DC6FB56C3C72D808E23DC
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...[............b....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....PLTE...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................If.....tRNS...........gx.]:..HR.0..#(..$/.+!....'-.....;...h\|ZW...u....iK..o....`e.....pP"...t.....V.....rO..... N..b..c.sm..3..[.4~.9.I.....M..n{.^a...UL.?...6T.l..<...@...B\.7...S........bKGD...-.....IDATH....WLQ....t!.\..b..S.4M2. 5..2#N.]NE........&B.T"..\.?.L.I..j...e.k....u..k...dA.......(p.. ZB..k.u.....e..BB7.bo.

Chrome Cache Entry: 525

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (35563)
Category:	downloaded
Size (bytes):	35756
Entropy (8bit):	5.511016346518282
Encrypted:	false
SSDEEP:	768:tqR5dvFU6p+7fkllZF4bZ4IMevRCPfQHgGqJEUL0x:cfafkvgbZ4IDkPfQHgGqJEUL0x
MD5:	AA2BB103C873E34C4BB7315D28B65588
SHA1:	02BC8E595213025032E36D1F140EFAE7597E4DDB
SHA-256:	99980CCEBD4D17DF9523D2581C5BDF134D1E933DD28DDE912E99932F59185A5B
SHA-512:	83AB8914E350287B0DA9154C4EEB0ABBB2EC143DDFE168286090E1E785D2D59710593799C651C73A29905E02BB67182D6954712AE0ACC6D51068C0F1B838AC16
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/18cad957.fe671709.chunk.js
Preview:	/! For license information please see 18cad957.fe671709.chunk.js.LICENSE.txt /.(self["b-native-display-ads-ndisplay-ad-component__LOADABLE_LOADED_CHUNKS__"]=self["b-native-display-ads-ndisplay-ad-component__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["18cad957"],{d4871583:function(e,t,n){"use strict";n.d(t,{jr:function(){return r},oR:function(){return o},x9:function(){return a}});const r=["fluid"],a="https://securepubads.g.doubleclick.net/tag/js/gpt.js";let o=function(e){return e.INDEX="index",e.SEARCHRESULTS="searchresults",e}({})},a018b278:function(e,t,n){"use strict";n.d(t,{Z:function(){return v}});var r=n("3d054e81"),a=n("ead71eb0"),o=n.n(a),i=n("6ee88c54"),c=n("dc6d28ff");var s=n("8521b397"),d=n.n(s),u=n("47596644"),f="f612b4bb42",l="f6a33970fc",p="e21d5dbea6";var v=e=>{const{isMDOT:t,isWWW:n}=(()=>{const e=(0,c.getRequestContext)().getSiteType()??i.N.WWW;return{isWWW:e===i.N.WWW,isMDOT:e===i.N.MDOT,isTDOT:e===i.N.TDOT}})();return o().createElement(u.Z,(0,r.Z)({},e,{className:d()(f,n

Chrome Cache Entry: 526

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (35625)
Category:	downloaded
Size (bytes):	99521
Entropy (8bit):	5.712695075452824
Encrypted:	false
SSDEEP:	1536:3xl7VfvmDLuO6zWW56Z55QoevsPq9eJdJvNBsFjc:bVfwL55QVvskgBsFI
MD5:	947C10B67F25CD70AF781FBF267824BC
SHA1:	EB08BC367E2F0125C5F6FF2885822F9D9D23EFED
SHA-256:	88438C2047CAAC53200355D81329D5CA8B33B47DCB955E90A2E11B169751B6D8
SHA-512:	9D38E6F9CBCCF2C8DD1C5E32D7C64780F2E896C8EE4939E40986BA55AF2D790E15B4EF104339D6829BD00030670BE93D9FD918E9CB98DDE5685C5ADAA156E998
Malicious:	false
Reputation:	low
URL:	https://securepubads.g.doubleclick.net/tag/js/gpt.js
Preview:	(function(sttc){var window=this;if(window.googletag&&googletag.evalScripts){googletag.evalScripts();}if(window.googletag&&googletag._loaded_)return;var n,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ca=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");},da=ca(this),ea="function"===typeof Symbol&&"symbol"===typeof Symbol("x"),t={},fa={},u=function(a,b,c){if(!c\|\|null!=a){c=fa[b];if(null==c)return a[b];c=a[c];return void 0!==c?c:a[b]}},v=function(a,b,c){if(b)a:{var d=a.split(".");a=1===d.length;var e=d[0],f;!a&&e in t?f=t:f=da;for(e=0;e<d.length-1;e++){var g=d[e];if(!(g in f))brea

Chrome Cache Entry: 527

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10122), with no line terminators
Category:	downloaded
Size (bytes):	10122
Entropy (8bit):	5.240243012907955
Encrypted:	false
SSDEEP:	192:jvnXnBZYfQkvdldR/FkHKYfBLPTdNTxJQizeCizYCizniziizCizUWU8/kXmz9bd:jv3BZYfzdBNkH/pjTzdJJ2wGf/YWUuDv
MD5:	F93685786A40C1963A769141C284FD50
SHA1:	E6946FAC5C6AF52D86508657D8EB703835E88D28
SHA-256:	3E7E0E0FBFAE64F6367B1DCE6BE37DD216E94B92846DD4FA9B380A57A988B795
SHA-512:	24DC7EDDE41744CB222D178C924B4C3435AE0826BF803CB855507091284FF1DA8AC623DDBE0172A3CDE8AAB7163C11CA0EDBC6B13FBA258DBAD10B68C14F609F
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/packages_city_landing_page_cloudfront_sd/172f7d6c1b0baff6a5977b7d9131abccccb65cf9.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(t){return t};B.define("search/destination/service-autocomplete",function(t,e,i){"use strict";_i_("f74:52621341");var a=t("event-emitter"),r=t("server-data"),n="en";function s(t,a,e){if(_i_("f74:48edc048"),!t\|\|!t.hits)return e(new Error("service-autocomplete-invalid-results"),null),_r_();t.results=t.hits.map(function(t,e){if(_i_("f74:92f295b3"),!t.data)return _r_(null);var i={cc1:t.data.admdiv.country,city:t.data.ab1.city&&0<t.data.ab1.city.length&&t.data.ab1.city[0],city_ufi:t.data.city_ufi,ctr_ac_clicks:t.data.ctr_ac_clicks,ctr_ac_imps:t.data.ctr_ac_imps,dest_id:t.data.dest_id,dest_type:t.data.dest_type,hotels:t.data.hotelcount,iata:t.data.iata,position:e,labels:[],language_code:n,latitude:t.data.latitude,lc:n,longitude:t.data.longitude,meta_matches:[],nr_hotels:t.data.hotelcount,nr_hotels_25:t.data.hotelcount_25,photo_uri:function(t){switch(_i_("f74:8a443745"),t.data.dest_type){case"city":return _r_("/static/img/cross_product_inde

Chrome Cache Entry: 528

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	dropped
Size (bytes):	2315
Entropy (8bit):	7.804352635379051
Encrypted:	false
SSDEEP:	48:o9YMbuERA1fnBOn1xCW9Qlaxj+GoXHlm++1eP9t6Dy4DdGoHr:ghCEofBuCW9fDys+/w+UdGer
MD5:	20AF6F5CD699524D53B2C9957805E7DD
SHA1:	C789D5C63FB2BD4A25018B5DC06A0D5A4A2ECF06
SHA-256:	D6C5FAD185335F4C5D1D39B133EB3051171F6BA4AB859C0F9749263280A73D73
SHA-512:	0BC000418FD7299C68803AB1EDAB3569A31896B4737EC09A3BF53015D8DE7CEC919C848F10A8C80FA5BB5E708042A17103E1022897FE49109FE216564571D2AF
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......d.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....+..>.y>..g.r..G.W..jO+..(.F.(.U.....>Q...:O....U'..Hc.a...M.&.....a..zQV6Q@.t.vv....=..[....B~o.b.M"i.7h..3.........._c.....9."b.a%A....n.[..on.nN?...r....L...<~B..-P...o'.....<p.h....>...d]..Y..O#.s[B.d..e(.-...o.Z~O.4.Z\.c7.1{V...a..q...i.......+..f.TU..=(.q...7......wt..". ...(..X.5..\$&e..<s...d.mt'......M....{.._..6'..!..J ......S..W.

Chrome Cache Entry: 529

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18597)
Category:	downloaded
Size (bytes):	18713
Entropy (8bit):	5.416650115560634
Encrypted:	false
SSDEEP:	384:njCMjHtmlLu2hX/F5eEzZ0TwNV1e3iBxH3:NjHo73ewZIk1e3i/X
MD5:	DF9D5129505BEBC7422F4D1CCAEED019
SHA1:	ED27169963CB333C622E2C4051D56731DB328C5B
SHA-256:	1DFC536658EDE131723D80F7487C67E7D747248F989F04F118956CF2F7142BA3
SHA-512:	F159AEF20096DF3B185CE989EC2404EB55FF7E3BC72162594EC3F1ECC41BB795F1ED86C5CBBF4AAE9F03112C1F9AF994F1FDEBC991751ED81950BB45F3CB1D9B
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/remoteEntry.b27ba5a8.client.js
Preview:	var bGeniusVipWebComponentService;!function(){"use strict";var e={ce7603eb:function(e,n,t){var r={"./GeniusVipMlpOnboardingSheet":function(){return t.e("8d7d1278").then((function(){return function(){return t("7ce44747")}}))},"./GeniusVipPriceMatchBookingDetailBanner":function(){return t.e("eb93ecdf").then((function(){return function(){return t("3149c9bc")}}))}},o=function(e,n){return t.R=n,n=t.o(r,e)?r[e]():Promise.resolve().then((function(){throw new Error('Module "'+e+'" does not exist in container.')})),t.R=void 0,n},c=function(e,n){if(t.S){var r="default",o=t.S[r];if(o&&o!==e)throw new Error("Container initialization failed as it has already been initialized with a different share scope");return t.S[r]=e,t.I(r,n)}};t.d(n,{get:function(){return o},init:function(){return c}})}},n={};function t(r){var o=n[r];if(void 0!==o)return o.exports;var c=n[r]={exports:{}};return e[r].call(c.exports,c,c.exports,t),c.exports}t.m=e,t.c=n,Object.defineProperty(t,"miniCssF",{set:function(){},get:fun

Chrome Cache Entry: 530

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2745)
Category:	downloaded
Size (bytes):	2861
Entropy (8bit):	5.139906240819931
Encrypted:	false
SSDEEP:	24:vwq8hDMEUZIOyxDj3c3k/Ehi6QEh8rZORUNoAQxlBENhXyQ565hDhpSZCzyCYrUt:vFGDMEKQjoWNOR8wlBTNMG0Wq9YFP
MD5:	8B761ECF11F6B807D0D765EE8CD5851E
SHA1:	02D6D3330BBD5E21A31AF2DBFD39169978FC309B
SHA-256:	1697CCCBAF108B5141E1C98485A4EF4558AF762868B1A7CB4D69A8BA04E08118
SHA-512:	E3DE452CDFAFD4C467D7F049CAA32890E171FA33CA1ED438F7F830FAA63D8EC2B439BF5013E4D574718A84F3B11F14B12F315CA57B041FA80EEFF77DBD938015
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/7bcb015e.5b709f3d.chunk.css
Preview:	.bc4e2c467a{-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;margin-bottom:var(--bui_spacing_6x);position:relative}.b8e920e088{text-decoration:none;text-align:center;display:flex;justify-content:flex-end;min-height:230px;padding:var(--bui_spacing_4x);overflow:hidden}.d39c27f89b{position:absolute;bottom:40px;left:-20px;height:64px;width:64px;background-color:var(--bui_color_accent_background);border-radius:50%}.d875fc0c4c{display:flex;margin:-100px 0;min-width:400px;padding-left:10%;flex-direction:column;justify-content:center;color:var(--bui_color_white);border-radius:50%;background-color:var(--bui_color_action_background);position:relative}.bb44aa69aa{padding:0;width:70%;text-align:left!important}.de7f9979e1{margin:0;height:32px;overflow:hidden;display:inline-block;vertical-align:bottom}.ccbae5d425{margin:var(--bui_spacing_4x) var(--bui_spacing_16x) 0 0;min-width:50%;max-width:70%}.a0670806ef{padding:0 0 0 var(--bui_spacing_8x);max-width:360px;width:40%;margin-righ

Chrome Cache Entry: 531

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	58659
Entropy (8bit):	5.622250867110808
Encrypted:	false
SSDEEP:	768:fr7c6JpusRUnOp+iliBLbvM7OQ7sAzEZbg1RfJ3zFHxl7LyGBtMs6bGwnsSFLiaJ:3kLRA23dk50ZcA1mW
MD5:	11FEA928A69579D153CAB50CF02EA8B3
SHA1:	CA2538AFAA856A9C9AA64DEE0402BCCAF654E15F
SHA-256:	FB2689495FBF5E3C35AAF2F2E3BC1F278708345E3EE17C4B8E2B244F20641600
SHA-512:	C20195D8366E3C8D136802A05AD483CCB790D9BCA09B7C471622664227AC7F9B2640F3A6002443CEAA2BF99603EE5A64F84366EA134D15FAE2CCB454F9A28515
Malicious:	false
Reputation:	low
URL:	https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3600888033459520&correlator=199404356530584&eid=44809527%2C31079963&output=ldjh&gdfp_req=1&vrg=202402010101&ptt=17&impl=fif&iu_parts=3102%2Cbcom-www%2Caccommodations%2Cindex%2Cindex-primary&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=320x50&fluid=height&ifi=1&sfv=1-0-40&click=https%3A%2F%2Fwww.booking.com%2Fbas%2Fndisplay%2Fredirect%3Fndisplay_ad_id%3D090e0e81-915c-46d5-8ca2-d703529bfe8b%26affiliate_id%3D304142%26rendered_ad_pageview_id%3D87e482caf42702d0%26rendered_ad_sitetype%3DWWW%26rendered_ad_vertical%3Daccommodations%26rendered_ad_position%3DINDEX_PRIMARY%26rendered_ad_pagename%3Dindex%26url%3D&sc=1&cookie=ID%3D0b43cf03ff4edaa9%3AT%3D1707417344%3ART%3D1707417344%3AS%3DALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw&gpic=UID%3D00000a0c30c5c51f%3AT%3D1707417344%3ART%3D1707417344%3AS%3DALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg&abxe=1&dt=1707417372267&lmt=1707417372&adxs=-12245933&adys=-12245933&biw=1263&bih=907&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&vis=1&psz=0x0&msz=0x0&fws=132&ohw=0&ga_vid=421694156.1707417338&ga_sid=1707417372&ga_hid=1539130009&ga_fc=true&td=1&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFsyLFtbIi8zMTAyL2Jjb20td3d3L2FjY29tbW9kYXRpb25zL2luZGV4L2luZGV4LXByaW1hcnkiLFtdXV1dLG51bGwsM10.&dlt=1707417364579&idt=1149&prev_scp=b-in%3Dfalse%26b-de%3Dwww%26b-la%3Den-us%26cal%3DAd&adks=3311837093&frm=20&eo_id_str=ID%3D848d5fda89230a58%3AT%3D1707417344%3ART%3D1707417344%3AS%3DAA-AfjblD-3JhdNa7xxiyNI1n_4V
Preview:	{"/3102/bcom-www/accommodations/index/index-primary":["html",1,null,null,1,0,0,0,0,"height",null,1,1,null,[138452372060],[6399295825],[14635551],[3259967680],null,null,[764188],[12289587],null,null,null,0,null,null,null,null,null,null,"AOrYGsklivLJM_sRnyFIBLvJt_nBPI9ekXdfmu42JlX72VqUscO1l3nx0npXBriX_poBlDvuQ54fEZYCxXo0zbSmmxEivxgozLMXoQ","CNbEoLCxnIQDFRSu0QQdZ2ME2Q",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1",null,null,null,null,null,null,null,null,null,null,null,"AA-V4qNQn6Z0PRo9EYgw1hnEECbaQVSS6ThJ4KPgXV99RnOskVjYmwTPYohSzvwAwz8v7CyegZmfpeaU_aaT-v0XAy2q2s2RnTKAl3zAwgKujBFrU3W1ImWHMm6rQ_5sktxK2GysyqlFvCM9NKwSQtiJLhNNTMnIhLf2P9YitiZjyKt8k9Z3rwT3fDF7FODrwxaVRI_fQ_2mq6iqFmrvQMnNC0k7yLGUBiyf6hRjEz5Cf8CK2LoBBrT1UX-16qlRB89xQgTjtUdW2-75VtA_NQ8DkS0LEXarDmeXH9ofuGK5VZRzjRoT91mmNNeRwGAVYwJHNzf0At-av3mBZ5LYO4C3NcIDtFreywuO",null,null,null,null,null,null,null,[]]}.<!DOCTYPE html><html><head><meta name="viewport" content="initial-scale=1.0, minimum-scale=1.0, maximum

Chrome Cache Entry: 532

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	https://www.booking.com/js_errors?pid=87e482caf42702d0&url=https%3A%2F%2Fwww.booking.com%2Findex.html&m=UmFuZG9tSVYkc2RlIyh9YUe5zZbLHt0YNre0CiGBBmP5hKTY_IzZqpWBtitYrnE-ba2NOPqZSPGdnbkQM2vO343hpsChBnayfrRG7jVW0hI1Ke4kKZ85U_m7O1xbR8NLSlv2Zn-4d5ku6anu7qAZgjoLQxWZjIis3cNA3ef3I_aOxDvMotUV5ZQc6OhcEEody8ooGsshLIhRMDad6kRNg_HeFvW36Wr8mOnNh6fMuy8OZ9w095BIb2XL0zt8fY-5SPQHxgI7NWrdI31vzPG5nOwkA1lE2mJxFh3z4YXPwcZPq5z6drlkg3iN9tdtKjt0cXf7rJdLIbIGLmOniyEf0g&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2Findex.html&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSObZWJFfVDSMePCFYZWFXO&cors=1
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 533

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	downloaded
Size (bytes):	4146
Entropy (8bit):	7.879386090200039
Encrypted:	false
SSDEEP:	96:ghCEar1nWNYjzUb9lA1ordcEKbXYfqpuBQc7g+sXQ:mCJr1n7gZlACrde6Au6B+5
MD5:	1B6BF74DA8A89D12343F5FE72D1E3361
SHA1:	E87597EB1A60945006757C7E377316D6F1687675
SHA-256:	62723382417704DC76F8F37079F1B130A8542198FE02987CE6127E833BFD131E
SHA-512:	8D6CC7C5F570796F3DD5C2A0E19793FC96F7146F99C9DB0B98BA32AA933DFB88906D94050B1B2BD4D79345991CEDD28635D4CD76F3DF9DEAB6697ADDFC1D34D7
Malicious:	false
Reputation:	low
URL:	https://q-cf.bstatic.com/xdata/images/city/square100/976918.jpg?k=ba17581113d23e0a509fba3480bb6c08fef757afd93d9c56808a343bc2612e18&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......d.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....;m.z.7.*...$m......x.Z.>......Z)$.I9....../tH2..a..;..ao..9.-......x9....j..j.%..:\|"#{o,C`f.We....=2s\...)..P./.E...a....[C`..v#9.\|.s.Z...5...)n$tny.[..:...[.m,..K.\|.-.....\....Tv...v~..........$&wE`.A..$...'O`..d.8......~^.WO.:M..k}..p..P.HA.3.=..3K.'....e.R.....G.dh.u..r(.;..V..9.....I.y..5..}.&K.8..hi{a...9...\..........x..)nVD.I..#t8 .09..L.i"]

Chrome Cache Entry: 534

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9646), with no line terminators
Category:	downloaded
Size (bytes):	9646
Entropy (8bit):	5.600276426669384
Encrypted:	false
SSDEEP:	192:jLkdu0NVSo1eS0dBoqQgON9tv2Bq8Phv23MwvsWfMVB:jQdusVSo1eSCoqvONOPpcKh
MD5:	F9D244B185BA0038EFF07F1E826A4BA3
SHA1:	D87CED00A66EAF3F7A175C278D2C8529C090829C
SHA-256:	B3B89B5B662B889776580C4AFA89727038D245C66F6C837D01627D2C487F1FFF
SHA-512:	DFEE4C60DC82CA1CE72000906AD57450656C9D01A728A01B87616B3BD9EC7B1D5EBE173BF7CC7A77C1A3A096B024B8F4DDDFB64D73F65F54C69C347BC186B64A
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/sp-on-maps_cloudfront_sd/d30eef4dc5202875d4c3301b8a0e8ff09f9a0e28.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};B.define("utils/bind-all",function(e,t,n){_i_("fe3:ca20d562"),n.exports=function(e){for(var t in _i_("fe3:fe723711"),e)"function"==typeof e[t]&&(e[t]=e[t].bind(e));return _r_(e)},_r_()}),B.define("component/sp/map-card-component",function(e,t,n){_i_("fe3:a635e494");var a,i,o=e("utils/bind-all"),s=e("events"),l=booking.env,_=booking.debug("sp_on_maps"),r=B.jstmpl,c=e("et");l.show_rocketmiles_av_frontend&&(a=e("rocketmiles-on-maps"),i=e("rocketmiles-api")),n.exports=e("component").extend({init:function(){_i_("fe3:f68b7edc"),o(this);var e=this;_.log("init sp_on_maps"),e.badgeTemplate=r("loyalty_badges_maps");var t=e.$el.attr("data-loyalty")\|\|"{}";e.loyaltyData=JSON.parse(t);var n=e.$el.attr("data-has-rocketmiles-extra");e.hasRocketmilesExtra=!!n,e.checkExtensions(),l.show_rocketmiles_av_frontend&&s.on(i.events.SR_RENDERED,this.updateRocketmilesExtension.bind(this)),e.bexContentData=JSON.parse(e.$el.attr("data-bex-content")

Chrome Cache Entry: 535

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/481216654?random=1707417393396&cv=11&fst=1707417393396&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v843635506za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Fflights%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3D5171fc655664ddf74ab763a094523fb7%26from%3Dbooking%26&hn=www.googleadservices.com&frm=0&tiba=Find%20cheap%20flights%20%26%20plane%20tickets%20%7C%20Booking.com&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1
Preview:	<html></html>

Chrome Cache Entry: 536

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (50049)
Category:	downloaded
Size (bytes):	50383
Entropy (8bit):	5.331197367914223
Encrypted:	false
SSDEEP:	768:RowpTCFG1Ikz+ybZd9ZI/KN8dEqJ0a45d7GpeamrAIOEEZXgU03:31iVKZd9ZI/2qJTeaCj
MD5:	17D98CB7755179F895BD6B750ADA6560
SHA1:	691433AECF12690A3B8DE77AFFA57D3787A1A775
SHA-256:	206E3A3774BD2E6581DFCC440EB19FB5A728F91F18F4E79C0F3E905A9B27E43C
SHA-512:	EAE8DE3F8F3AF1CACC9561615BD2E70D1458E7EA868AB24FF30D4C9AB4D152F6FB3AE4B46C68DFEABF6C7C92B0AB83EE27EDA8A160CBF542C0A38411947E8FE5
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/core-deps-inlinedet_cloudfront_sd/789c67928e597e7a413f9e99763adab71edbbfa8.js
Preview:	booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.core_deps={loaded:!0,run:!1}),function(){./*. @license almond 0.3.0 Copyright (c) 2011-2014, The Dojo Foundation All Rights Reserved.. * Available via the MIT or new BSD license.. * see: http://github.com/jrburke/almond for details. /.var e,t,i;!function(d){var o,a,p,h,m={},v={},_={},g={},n=Object.prototype.hasOwnProperty,r=[].slice,y=/\.js$/;function b(e,t){var n,r=B.env&&B.env.b_dev_server,i=(n=B.reportError)&&"[object Function]"==={}.toString.call(n)&&B.reportError.bind(B);if(r\|\|!i)throw new Error(e);i({message:e},t)}function w(e,t){return n.call(e,t)}function u(e,t){var n,r,i,o,a,u,s,c,l,f,d,p=t&&t.split("/"),h=_.map,m=h&&h[""]\|\|{};if(e&&"."===e.charAt(0))if(t){for(p=p.slice(0,p.length-1),a=(e=e.split("/")).length-1,_.nodeIdCompat&&y.test(e[a])&&(e[a]=e[a].replace(y,"")),e=p.concat(e),l=0;l<e.length;l+=1)if("."===(d=e[l]))e.splice(l,1),l-=1;else if(".."===d){if(1===l&&(".."===e[2]\|\|".."===e[0]))

Chrome Cache Entry: 537

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (16741)
Category:	downloaded
Size (bytes):	16853
Entropy (8bit):	5.193717088458406
Encrypted:	false
SSDEEP:	384:0qY/HHx/nXn/PQWE0EK8C7WlfQfEnxmzXYh+ImD3VYutnw:0qY4WIMtw
MD5:	9A4778EC8FD99573D02323E7F38B0E53
SHA1:	3D678E5795AE68EBF836AF59E125C6327FDEF1E8
SHA-256:	3D9866B9BA0DCECEC43BEC1553012FFEA0FB05F789BCF362D60D5B52D99DDE34
SHA-512:	DEDEB127F1B56D26EAE72CED460361D2D82C857760DF62B9FE5F5C267A669B8501894FC782BF87327AD730A1D2D5F4F62D16DE2F2389F6C990188A3C7A65812D
Malicious:	false
Reputation:	low
URL:	https://q-cf.bstatic.com/psb/capla/static/js/aee01701.c6972f88.chunk.js
Preview:	"use strict";(self["b-web-shell-header-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-web-shell-header-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["aee01701"],{"181eacc8":function(e,r,t){t.d(r,{d:function(){return i}});var s=t("6ee88c54"),o=t("dc6d28ff"),n=t("d1e54a96");const i=()=>{let e;const r=(0,o.getRequestContext)().getSiteType(),t=(0,n.isRTL)();switch(r){case s.N.ANDROID:case s.N.IOS:case s.N.MDOT:e="small";break;case s.N.TDOT:e="medium";break;default:e="large"}return{defaultViewportSize:e,defaultRTL:t}}},"64b778ad":function(e,r,t){t.r(r);var s=t("3d054e81"),o=t("dee2534d"),n=t.n(o),i=t("181eacc8"),l=t("93960411"),c=t.n(l),h=t("41c6c66e"),a=t.n(h),d=t("d16e9636"),u=t.n(d),v=t("ead71eb0"),m=t.n(v);const b={"/Playground":{component:(0,d.loadable)({resolved:{},chunkName(){return"Playground"},isReady(e){const r=this.resolve(e);return!0===this.resolved[r]&&!!t.m[r]},importAsync:()=>t.e("c7193fec").then(t.bind(t,"bdd0b6c1")),requireAsync(e){const r=this.resolve(e);return this.resolved[r]=!1,

Chrome Cache Entry: 538

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3448), with no line terminators
Category:	downloaded
Size (bytes):	3448
Entropy (8bit):	5.530693411500075
Encrypted:	false
SSDEEP:	96:jrD4sT8YpNJIG4QeSZK7qVwRDg9ZAfjxv4OVsBSnXHi9/D8a:j3jQigUjZK7qVwi9ZIjxv4OVsAXHW8a
MD5:	09A80A4A23BDC1DBA67F37FCA7AF6E1B
SHA1:	F37CD1B7B407485887C87717098A0FDA8FC268C6
SHA-256:	EB8A863847BBE73AED0FDFF596DD87C9CF66E85E4CE3526869D99FA9BDF01ACF
SHA-512:	47DA02BE31F6780E500F6B76D590401ADA521A011BA39BA7A262DF202221BD46FB08FFDD50742729A6A49A030BE020E31CEF09E197BE29FE073B8634449B7D2F
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/genius_vip_cloudfront_sd/aae975495cc56436f4f59463b9ea4e594bdb102a.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(_){return _};B.define("with-capla",function(_,i,e){_i_("edd:cabb24f6");var n=_("promise"),t={},r={};function d(_){return _i_("edd:4d350593"),_r_(_.slice(0,-8))}function a(i){return _i_("edd:dcecff49"),t[i]\|\|(t[i]=new n(function(_){_i_("edd:e000dba4"),r[i]=_,_r_()})),_r_({promise:t[i],resolve:r[i]})}window.B.__caplaInitialised&&Object.keys(window.B.__caplaInitialised).forEach(function(_){_i_("edd:1d620442"),a(d(_)).resolve(window.B.__caplaInitialised[_]),_r_()}),document.addEventListener("booking-capla-initialized",function(_){_i_("edd:bf4fa97b"),a(d(_.detail.namespace)).resolve(_.detail),_r_()}),e.exports=function(_,i,n){return _i_("edd:edf87387"),_r_(function(){_i_("edd:e42d11f1");var e=arguments;a("b-"+_+"-"+i).promise.then(function(_){_i_("edd:7774fbc2");var i=[].slice.call(e);i.unshift(_),n.apply(n,i),_r_()}),_r_()})},_r_()}),B.define("component/genius-vip/const",function(_,i,e){_i_("edd:9c374cd9");e.exports={CAMPAIGN:{SpendAndU

Chrome Cache Entry: 539

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (22461)
Category:	downloaded
Size (bytes):	22573
Entropy (8bit):	5.328213112423421
Encrypted:	false
SSDEEP:	384:BE0gImd3HokFdjy/lnukKaIFhnEU/4eOJOPS2MpWUy3XnnLaXVG:BE0gJd3HFFdy/tgnEG4eOmS2EWUyHnLN
MD5:	16CEF59D8ED8D631E974161B3405D558
SHA1:	73BB164CEE57495A24719304DF97779508A9D2F3
SHA-256:	B832754790D252C1320138FA7AD76EE1197F33FE256DBC02A1951311B2592D3B
SHA-512:	DAEC97ADBB92B9BC618583DE21F08F75E96048EC99A9F43AB62F1F1A257E19335E92E1430675598BCBEBEED4BAB57C8F0DFB904AA61E65DBECF19009F2D422BF
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/f50a2dfc.854e46ce.chunk.js
Preview:	"use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["f50a2dfc"],{"22b0f37c":function(e,t,n){var i=n("3679468e");t.Z=i.Z},"43bedd84":function(e,t,n){n.d(t,{p:function(){return i}});const i="Booking.com"},"3679468e":function(e,t,n){n.d(t,{Z:function(){return h}});var i=n("3d054e81"),a=n("ead71eb0"),r=n.n(a);var c=function(){return a.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 121 32"},a.createElement("g",{fill:"none"},a.createElement("path",{fill:"#fff",d:"m115.546514 25.2308571c0 .6226286-.299657 1.1181715-.905828 1.4864-.602743.3650286-1.398857.5492572-2.381257.5492572-1.1824 0-2.194743-.2813714-3.037486-.8470857-.842514-.5659429-1.432-1.2857143-1.771886-2.1629715-.1664-.4219428-.462857-.5357714-.885714-.3380571l-3.204114 1.4395429c-.4496.2009142-.576.5090285-.379658.9341714.646172 1.5837714 1.765258 2.8893714 3.353829 3.9206857 1.5888 1.0310857 3.603657 1.5467429 6.051657 1.5467429

Chrome Cache Entry: 540

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 120 x 120, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	4038
Entropy (8bit):	7.894945624652839
Encrypted:	false
SSDEEP:	96:csld02SpHP9+D4+PFzs5Cb5XZHutFy7eHcY3Xso9uA:csHXSH70sIr2H3t
MD5:	DCA7C9B271C8B4799CE94491FA1B9EF2
SHA1:	8813DDE85839ADF022DEC0149893A96C0024B8B8
SHA-256:	54370E8F589FEF00FBDC853C168F40C1955C478A26C2F464F76F927951F9FFB4
SHA-512:	24322D7027B510E9310AF3C04EAC2105053357F3993EF9C180018A28769A5CBB3D47C4D02DE3AF9AFA159AEE93E2F4F083623AE086F5AD3822B02BF0A6ADAD57
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...x...x............qPLTELiq..1...............\|......5........o...............................\..............................E....s..........u.}.............,............s..s........#.....`5...........t.....[..p../...................................................................s..}..........................w.......................~.............9...E...k..H.....[.....%....<f...DtRNS...........Z...C....... ..3..+J..q..`a.=.......n......\|......L.....}....pHYs.................IDATx...S.H....1.p.....'..Nv...[....C}..).ll....~.%C..ILR0.?....J......o..i.:.Nu.S..T...T.@.!O.._.8T;x=66.\j.q....6.<7.........RZ[.....r.$..s...}5.'......j...JH..lN(....OL4..!....Ip.............ww..._..,.?w.....[.._.z..E...l.nM..zr..mjM.w.W.?........W7.......9^9.o.z.........vC[.~f.B....w.....[.....k....W....O6'....5^.+...W_1..\|f.....k..3..U...I=...g.ah....I".D..............g.(s)..yv....n@.I.)e....){...+w.....3L......M.4.. B....8vb....c.`i...\|

Chrome Cache Entry: 541

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 542

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.314128390879881
Encrypted:	false
SSDEEP:	3:2erWeKBRk35KLWAzRERxzfRX/H4Y3:29M3tRdfZN
MD5:	83A02FE42F8C2198E7C608AFF363AA49
SHA1:	7B20AE1014450492CC708E3C9DC7522B05C2EFFD
SHA-256:	E64954DC34E12C7190CC2338A54B07644FF0F102AA71CC7209BCBB49C3009F7C
SHA-512:	CD381A8C725C892E9A68D713254A31EA9ED25A39B212A5DC52D4BA2655F38AFDDB32519F03360F32A59D8E7701AF6C2AD0030A6AA760C3DE87C75063F5B65F54
Malicious:	false
Reputation:	low
Preview:	event: message.data: {"response":{"status_code":200,"body":""}}..

Chrome Cache Entry: 543

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15552, version 1.0
Category:	downloaded
Size (bytes):	15552
Entropy (8bit):	7.983966851275127
Encrypted:	false
SSDEEP:	384:HDKhlQ8AGL0dgUoEGBQTc7r6QYMkyr/iobA2E4/jKcJZI7lhzi:jslQ+LhUoTB0Qr6Qjkg/DmcJufzi
MD5:	285467176F7FE6BB6A9C6873B3DAD2CC
SHA1:	EA04E4FF5142DDD69307C183DEF721A160E0A64E
SHA-256:	5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
SHA-512:	5F9BB763406EA8CE978EC675BD51A0263E9547021EA71188DBD62F0212EB00C1421B750D3B94550B50425BEBFF5F881C41299F6A33BBFA12FB1FF18C12BC7FF1
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Preview:	wOF2......<...........<Z.........................d..z..J.`..L.\..<.....<.....^...x.6.$..6. .... ..S..}%.......\|....x..[j.E...d..-A...]=sjf$X.o.5......V....i?}.\...;...V......5..mO=,[.B..d'..=..M...q...8..U'..N..G...[..8....Jp..xP...'.?....}.-.1F.C.....%z..#...Q...~.~..3.............r.Xk..v..7t.+bw...f..b...q.W..'E.....O..a..HI.....Y.B..i.K.0.:.d.E.Lw....Q..~.6.}B...bT.F.,<./....Qu....\|...H....Fk.-..H..p4.$......{.2.....".T'..........Va.6+.9uv....RW..U$8...p...........H5...B..N..V...{.1....5}p.q6..T...U.P.N...U...!.w..?..mI..8q.}.... >.Z.K.....tq..}.><Ok..w.. ..v....W...{....o...."+#+,..vdt...p.WKK:.p1...3`. 3.......Q.].V.$}.......:.S..bb!I...c.of.2uq.n.MaJ..Cf.......w.$.9C...sj.=...=.Z7...h.w M.D..A.t.....]..GVpL...U(.+.)m..e)..H.}i.o.L...S.r..m..Ko....i..M..J..84.=............S..@......Z.V.E..b...0.....@h>...."$.?....../..?.....?.J.a,..\|..d...\|`.m5..b..LWc...L...?.G.].i...Q..1.:..LJV.J...bU.2.:\.kt.......t.....k....B..i.z+...........A.....

Chrome Cache Entry: 544

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	642
Entropy (8bit):	7.485255326893554
Encrypted:	false
SSDEEP:	12:6v/7+FO+DpBBzM22sBdG4llNTJ6yHfbE8/jALtcq4PsesuZtC6mN:5tj2sBdpXlHfw8chcqgsCZxmN
MD5:	41A0E840AA47C87E19D2BFE0B1231C3F
SHA1:	B5F588CA91FC9E67B5EA658C5FF943B0639E57B9
SHA-256:	A333D02EEDDE7A4DD8643D58B0EA7947268A1762F35F517EB6000EC9E7FCFAE8
SHA-512:	8578A788F605BC27B4326EB38417A71E45A05AC885B971C49AC3C7D23F6DDF747F69F2CCF3DF0C461E1C90268247D6959F248D3001518F56888F6D6B8C1CDD2E
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/img/flags/new/48-squared/us/fa2b2a0e643c840152ba856a8bb081c7ded40efa.png
Preview:	.PNG........IHDR...0...0.....`......uPLTE..0<9p..0.'@.....0<:p.s}TS.....a_.HFymk.IFy.;I......yx....HGy..........Wd.........&@...mk.......G^............l.........tRNS...;%j.....IDATH..a..0..`..5..KiA8..S..O.y.....h><..4.......c..0..Pm.v......i...iuo..;..X..H'7LVM.....{..5zM.{.B"-4r[O..L..fw.hY..G...\.@h.U.kS...d.2`{...]i.....Zt@....t.,.z..W..x..........V-lB...S.!...S....U5.....E.+...g..4.....!.?...N..w.7-L[....<j..\|.+r5.u~..a0.<.l..._.h.q..4.....(.>.<.E.I...-t....X.S.77-nX.......^.T.*.....s.m.......~V....Lnz....Y...5......-...\|...{q...'.lN.W.4W]..<.......`!..A......D@...$.....0X.I..1XI.....T....C..@.}....IEND.B`.

Chrome Cache Entry: 545

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/988382855?random=1707417344393&cv=11&fst=1707417344393&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1
Preview:	<html></html>

Chrome Cache Entry: 546

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	16752
Entropy (8bit):	5.5189570850934695
Encrypted:	false
SSDEEP:	192:jlnENM+TeH1naWz/uDv7tbT5tOXaFFzNKvAVLIVZ6l/+/HF/LKdoUbcz8wew:jlENCVnl/u/XFsW4JUmew
MD5:	A6044585EE8339DB66B6A72BBA0687F6
SHA1:	47ED18B6BE06F6CAA670645F21D52C68ED4330BA
SHA-256:	EA2BA3DE6B6937E054AC02FF8D04142D882F38632452CE4E7E6F93A1C7C5D515
SHA-512:	1A1864B7BCDFCD79B46A62A83AC40AA090F5F856302B32E531F6902FD95DDE2369CEFAA74C9272775DC97FAFCE87B5AB731F76A000C2F9ABBB90BF808C17D4B2
Malicious:	false
Reputation:	low
URL:	https://www.booking.com/attractions/api/header?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&lang=en-us&aid=304142&product=flights
Preview:	{"header":{"currencies":{"list":["hotel_currency","ARS","AUD","AZN","BHD","BRL","BGN","XOF","CAD","CLP","CNY","COP","CZK","DKK","EGP","EUR","FJD","GEL","HKD","HUF","INR","IDR","JPY","JOD","KZT","KRW","KWD","MYR","MXN","MDL","NAD","ILS","TWD","NZD","NOK","OMR","PLN","GBP","QAR","RON","RUB","SAR","SGD","ZAR","SEK","CHF","THB","TRY","AED","USD","UAH"],"selected":"USD","all":{"FJD":{"utf8_symbol":"FJ$","b_symbol":"FJD","name":"Fijian Dollar","b_name":"Fijian Dollar","b_value":0.40908487,"b_code":"FJD"},"KRW":{"b_code":"KRW","b_value":0.00070009,"name":"Korean Won","b_name":"Korean Won","b_symbol":"KRW","utf8_symbol":"W"},"MXN":{"name":"Mexican Peso","b_name":"Mexican Peso","utf8_symbol":"MEX","b_symbol":"MXN","b_code":"MXN","b_value":0.05455785},"PLN":{"b_value":0.23029456,"b_code":"PLN","utf8_symbol":"ZL","b_symbol":"zł","b_name":"Polish Zloty","name":"Polish Zloty"},"MYR":{"b_name":"Malaysian Ringgit","name":"Malaysian Ringgit","b_symbol":"MYR","utf8_symbol":"RIN","b_code":"MYR","

Chrome Cache Entry: 547

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1440x962, components 3
Category:	downloaded
Size (bytes):	48905
Entropy (8bit):	7.943893596108332
Encrypted:	false
SSDEEP:	768:qEx3vwwzIeHH+32Rbs4hqVLbA/WroLKFgfKZUv8NsngAtf1FtV34zOL:qEx/fN3bHhqVQ/CR80A8Nsn1FXEOL
MD5:	5AD77D9314658FE91508D9B0129F5864
SHA1:	4EB74B7ED31B647FFF7FFF3B1AC8C79D536BBAEF
SHA-256:	351E52D0D5C74FCDDE61FBDFEC48277EBA66C403CBF8716B57CB18E84E9C2F8F
SHA-512:	91184630A69BDCFA30736B85044F73B4AF0FECB5DCCAFABF59A4DE05E502F4C7C742A5D16FFE72C2746B38EE788F46C72EAD18BAEB29D6D89A5AB5C054411696
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/img/resorts/landing_pages/airplane_bg/82842ea42e7cb6a992e722675e0556c5f8f9b172.jpg
Preview:	......JFIF...........................................+......+&.%#%.&D5//5DNB>BN_UU_wqw................................+......+&.%#%.&D5//5DNB>BN_UU_wqw..............".................................................T..C....1.r.l.K....i...Vj....S..n~.\|1KN..Mt..c.O..G..-7F...s3.). ....! I%$..&T..TL..Q131...^.%V.y..O[..2.V6.....9.ia}..ak..1.:z:k.}..9a.gMB..yI......H...$.T.).2.....ff&fc..m.S...7!..+..6.x.'{g.fU7ze...a....4.:E......w.w..o]..H@...B..!!.H..RJI.Q$.3.(.3...].....`S.....!_gV....5.q.4..]]....vOy...;u.C....@.}v.i.......$.A."RD.RJ.S2.JS12.&f3..uV...UUQ...,.{t...\|.W............N...^..1..xsg..W^.o..;;.Y...tJB.B. B.........)JJf&TB.....T...U_.j..y..F..,..sg&.}..e.G]k..f..;{..77.R.]..._....L'...2.H ..H.$.....e).....L.......uUUUT...9:..>^-6...,'^.S...y............e.y.m.N,/..K...{...mR'(.P..@.H..H$$..2.L..Q3eL.......t.....F1yO.&.z......c.].u.._).....>.../K.j..xg[u....u[s1...d......!.$"D.I$.).eBJR.Q.1...Un.....B..lxr.6...#~.ug_...5..U

Chrome Cache Entry: 548

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	102
Entropy (8bit):	4.933647524378761
Encrypted:	false
SSDEEP:	3:JSbMqSL1cdXWKQKBKklkxXhsnlKICWaee:PLKdXNQKBrkxXWlKHL
MD5:	987939F6563C8D52D53C80001E86B785
SHA1:	25B74DE17BDC9928AAC2506FB319C8D59A48C374
SHA-256:	3B918B6CEF39462C9FED66B7CE89D8FD5FE04984C12F689E88327A703D738A0A
SHA-512:	9936479D8187C2E53DF7BD32150A6BBADA499A6CB52AA0D7991DCEBE8FEE36B55C834848C650EDF29C8A60C14456E24967A93BF54C3C7B121263CC5889E8092D
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt
Preview:	importScripts('https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__en.js');

Chrome Cache Entry: 549

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2348)
Category:	downloaded
Size (bytes):	6105
Entropy (8bit):	5.437874807472625
Encrypted:	false
SSDEEP:	96:5NcjRhp0zrAPKI1xtOXVy6s9R4Y1CfPDqZaw2PMTBxj6kDxx1vnysfRjUlEYdO6s:5NcjR30zK3ws6s9R4YAfPDhNETflDBy2
MD5:	8E62FBC0AD68AF20BD820DED5B8DE62A
SHA1:	7EB712F30E1355CF59F28033C3F513EE0B5C8981
SHA-256:	367E9BA17BEE1E676E15D01DAA52D8FEC079988777F11440D25CF1710ECDA7EB
SHA-512:	9F3F76B22EC6C27AF29821A8DF0AE0009E63803E95EFF99D9A4E1047FD89A426899B147ACA03C1DBB18CDC529F3E74A31C1AE0B9E77F76E17CFFCD2064EB4827
Malicious:	false
Reputation:	low
URL:	https://securepubads.g.doubleclick.net/pagead/js/car.js
Preview:	/* . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 ./ .var f=this\|\|self,h=function(a,c){function b(){}b.prototype=c.prototype;a.D=c.prototype;a.prototype=new b;a.prototype.constructor=a;a.C=function(d,e,g){for(var y=Array(arguments.length-2),l=2;l<arguments.length;l++)y[l-2]=arguments[l];return c.prototype[e].apply(d,y)}},k=function(a){return a};/ . . SPDX-License-Identifier: Apache-2.0 .*/ .function m(a){return Object.isFrozen(a)&&Object.isFrozen(a.raw)}function n(a){return-1===a.toString().indexOf("`")}const p=n(a=>a``)\|\|n(a=>a`\0`)\|\|n(a=>a`\n`)\|\|n(a=>a`\u0000`),q=m``&&m`\0`&&m`\n`&&m`\u0000`;function r(a,c){if(Error.captureStackTrace)Error.captureStackTrace(this,r);else{const b=Error().stack;b&&(this.stack=b)}a&&(this.message=String(a));void 0!==c&&(this.cause=c)}h(r,Error);r.prototype.name="CustomError";function t(a,c){a=a.split("%s");let b="";const d=a.length-1;for(let e=0;e<d;e++)b+=a[e]+(e<c.length?c[e]:"%s");r.call(this,b+a[d])}h(t,r);t.protot

Chrome Cache Entry: 550

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	10200
Entropy (8bit):	7.98035540839143
Encrypted:	false
SSDEEP:	192:5Vi4VaP5qaPgrcw5Z9kXDpQDqs4+45GeQNtRbrqoiQYEOj/5mZgAQ+xO:5Vih5xXw5Z9kzpQr45GeQNtxqLnEe5mU
MD5:	2E1616472619A8FA186C1B02AE879C40
SHA1:	E84BC95A5E2004FAF9975FBBE1169316531D871B
SHA-256:	3CDB59FC14DC92F1A8210C78AB1EDC69C7EC2D680A9FF296857CA03CC825FA87
SHA-512:	775973537B65A1E67CDB56CF51B66C0C30AF683DC138A3039C83FF63D00840FDB23BFBE8936A987DAB45EA8651C3665BF5799CA66DF7D4CFBE0568B776CF9A1C
Malicious:	false
Reputation:	low
Preview:	RIFF.'..WEBPVP8 .'...........>m2.G.$"..V.....M..ks2-...V.C...u^.\|...t....7.....?.........X..~........U.K...;..O....'.....S.[._.?.../...y......../......u.1._.{.v..........._.?........d..\|............<\|D.u............W....g.Ze...OS.mr.2X.<..5sHp.n..sz..']....{....^..t.k...zN.....+c. .P=[..&.......>.......u?..N...,U....R.6.j.(........V.....D..?.....;2O...T........Q21.k[....N..s......D.p.C1}.Xj...#=.....&.`XP]o....kYEpZ}X...>.@.@.....pTp8..H4.;..:.Vc....j.......z..?..a1u..j.TP..=N.+.~.fm......Q..M..p.{..U..M..j..g..F.v.Gu..o..g.n..k.B.Ot.ve.B$.n./....V.D.+..`}.W..g......oB1T'..:......6.5.[.J.P......42x.2.!;wNw.._.....a..6.0[.w./.hMW..n.R..!.a.....#......)..1:.7.....@.oR.jl....xOr...{.9m.y...K...E.. J4.....6.'{p..u...mx.i.C..>B.. J....%..-..=.+.....Mf...'....=..,A.P..G1Z+ ....l..,$........ .0..p.+..3n..7^.V.w..JN`....i.V7.G..@.%.^....T{!.9.hf..fD...?q.g....B...v.GU;S....z...P.Es..bA......k...x. ]J.}...?E].%...^3...E...T..."L+A7.....O./]7...

Chrome Cache Entry: 551

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2340), with no line terminators
Category:	downloaded
Size (bytes):	2340
Entropy (8bit):	5.889833620759349
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08r/YAs47tzYig3r06:wsbSUtJfxrqLWWWdV6j1PYAX0
MD5:	1FD8D2D12DF37AB4F7E24B18E2AFF1D5
SHA1:	36E3959F9263032473228C2EB20AEEFC9721F75D
SHA-256:	CB64D4443F3CD59F2C51A8A7C5C0061FDCB4CD21DE6AA72FB3BBC40ADCF27EA4
SHA-512:	37F3C8682BB98783B7587614BC1C3197F423ADC7DA67C18C20E227968F17878F555FE88858A75605C8CC7A574846E33FE7AA7CE9421D6026834C4C282D1BB6DD
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/973712236/?random=1707417344535&cv=11&fst=1707417344535&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 552

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (39596)
Category:	downloaded
Size (bytes):	39708
Entropy (8bit):	5.417289989502092
Encrypted:	false
SSDEEP:	384:zi+bUxeXdDomhhVWy5xk5gwVMseabtjlTPMFM0AKZuojnnhylbchXsr6C/imSbsz:ziKjo4hwy5xklMdv2B++6ylmsNaR+
MD5:	47BB1A597DD42CABF5425FE918F725B5
SHA1:	7184636B500E10D3330CB58311529A1F01D0B840
SHA-256:	1FDB812C5D46CFA6B15B82D199DE7F7C86FB562B961161497CA7C4B13254EAB7
SHA-512:	A276D65D893A93E5520C6ABA06260CDE34E9632ABB938F017DC3F9007F701B75F4736065D0BC5E2369A461D7B8C74F23834E5354DC53134B0B728E971DF76372
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/0a098284.df965884.chunk.js
Preview:	(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["0a098284"],{"181eacc8":function(e,n,t){"use strict";t.d(n,{d:function(){return a}});var r=t("93960411"),s=t.n(r),o=t("6ee88c54"),i=t("dc6d28ff"),c=t("d1e54a96");const a=()=>{let e;const n=(0,i.getRequestContext)().getSiteType(),t=(0,c.isRTL)();switch(n){case o.N.ANDROID:case o.N.IOS:case o.N.MDOT:e="small";break;case o.N.TDOT:e="medium";break;default:e="large"}return{defaultViewportSize:e,defaultRTL:t,theme:s()}}},"64b778ad":function(e,n,t){"use strict";t.r(n);var r=t("ead71eb0"),s=t.n(r),o=t("cedcabf9"),i=t.n(o),c=t("181eacc8"),a=t("dee2534d"),u=t.n(a),l=t("6ee88c54"),d=t("dc6d28ff"),h=t.n(d),v=t("28dbd132"),p=t.n(v),m=t("41c6c66e"),f=t.n(m),y=t("d16e9636"),A=t.n(y),S=t("aef1fcb8"),b=t("3439c104"),E=t("81556d54"),R=t("98f608d3");const{staticRoutes:N,..._}=R,g=(0,y.loadable)({resolved:{},chunkName(){return"bWebcorePersonalisationComponentService-HomesGuestsLoveCarouse

Chrome Cache Entry: 553

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (60582)
Category:	downloaded
Size (bytes):	105026
Entropy (8bit):	5.3035505683416595
Encrypted:	false
SSDEEP:	1536:+cmChHGIhtB++W2VuIKhGt3QyjI4qPCooCW5BxUPRXc1d4B8q+8OCfe1bdfUsoK2:+fa3QDUWXB8cWSHKq36cz
MD5:	1A16F971ED98C047C8FA288987383922
SHA1:	04200A6F3B25CDFA04551F635D025FC64743B4FF
SHA-256:	5AD7526D50B7586DDFAEE62B3FC95E71207136DC08F6A2B7FFD671DED73FAB83
SHA-512:	84E0B04C038B49972937E37F28923D11D988DC23B54BD836FEBF71F0CEFF251EDC01CA2DC441A1502E9D34BBB234E1733C27164E47DE98F9548B1563F55130AC
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/jquery_cloudfront_sd/e1e8c0e862309cb4caf3c0d5fbea48bfb8eaad42.js
Preview:	/* @preserve. * jQuery JavaScript Library v1.11.3. * http://jquery.com/. . Includes Sizzle.js. * http://sizzlejs.com/. . Copyright 2005, 2014 jQuery Foundation, Inc. and other contributors. * Released under the MIT license. * http://jquery.org/license. . Date: 2015-04-28T16:19Z. */.!function(e,t){"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(h,e){var f=[],c=f.slice,g=f.concat,s=f.push,i=f.indexOf,n={},t=n.toString,m=n.hasOwnProperty,v={},r="1.11.3",C=function(e,t){return new C.fn.init(e,t)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,a=/^-ms-/,u=/-([\da-z])/gi,l=function(e,t){return t.toUpperCase()};function d(e){var t="length"in e&&e.length,n=C.type(e);if("function"===n\|\|C.isWindow(e))return!1;if(1===e.nodeType&&t)return!0;return"array"===n\|\|0===t\|\|"number"==typeof t&&0<t&&t-1 in e}C.f

Chrome Cache Entry: 554

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65455)
Category:	downloaded
Size (bytes):	329657
Entropy (8bit):	5.446833012552743
Encrypted:	false
SSDEEP:	6144:LzfNdoOXbiNkIo4omGTXapHCEB/DmpMmrjycaFCMV/LeG:LwzUjycWD
MD5:	2EAEC1DED279BEFB01F731D7BC109B01
SHA1:	134CA5AEC3A5CB07B2D99475CD5085B9071E9716
SHA-256:	17EE9936380D64560EC98DE2B972B3EBD0353C4264371AD85BDA9CD6E4EDFDD8
SHA-512:	D1B482078B89021CF2B111FDD98B1AD4D9C89BB3CD7B84E4E96F9424737D84F38403503C074BC8D39334E09436804D2AD7BDA0485DE432B03C6855416910A95B
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/accountsportal/assets/45_de7f4b7ce86eab041180.js
Preview:	/! For license information please see 45_de7f4b7ce86eab041180.js.LICENSE.txt /.(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[45],{44268:function(e,t,n){"use strict";n.d(t,{Wj:function(){return i}});var r=n(67294),i=function(){return r.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",fill:"none",viewBox:"0 0 180 30"},r.createElement("path",{fill:"#fff",d:"M70.6 2.73999C70.602 2.19808 70.7646 1.66892 71.0673 1.21943C71.3701 0.769947 71.7993 0.420321 72.3007 0.214768C72.8021 0.00921437 73.3532 -0.0430342 73.8843 0.064629C74.4155 0.172292 74.9027 0.435032 75.2845 0.819622C75.6663 1.20421 75.9255 1.69338 76.0293 2.22527C76.133 2.75716 76.0768 3.30788 75.8676 3.80779C75.6584 4.3077 75.3056 4.73434 74.8539 5.03377C74.4022 5.3332 73.8719 5.49197 73.33 5.48999C72.9702 5.48868 72.6141 5.41651 72.2822 5.2776C71.9503 5.13869 71.649 4.93576 71.3955 4.6804C71.1419 4.42504 70.9412 4.12225 70.8047 3.78931C70.6683

Chrome Cache Entry: 555

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20575)
Category:	downloaded
Size (bytes):	20768
Entropy (8bit):	5.499465235813467
Encrypted:	false
SSDEEP:	384:H3hbP7w0HfzgqixtYPB8aFwWitilg3dzi5mdnL7eSpw/xuqPdcVUCbr9+N:H3hbP7w0HLvK0B8pnL4dc+40
MD5:	B89FF6F5870E0EE50CA963284082208D
SHA1:	E6C1EDDDB6CFC8E81586257826A07F5656F5D0B4
SHA-256:	6A44EA0756D2B2DC741A10AA0B57D325AB34C210077B2AAC7DDFDF5D35AFE183
SHA-512:	C3511CA065FABF2A43022512396024621746FA631B9F0509BB91B8B61024F5DA474E9D870E645F178351CBD583A7D80DEE1BB926B6A773BE4A095A91F0CD8575
Malicious:	false
Reputation:	low
URL:	https://q-cf.bstatic.com/psb/capla/static/js/6197bcab.619d148f.chunk.js
Preview:	/! For license information please see 6197bcab.619d148f.chunk.js.LICENSE.txt /.(self["b-flights-index-component-service__LOADABLE_LOADED_CHUNKS__"]=self["b-flights-index-component-service__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["6197bcab"],{ef0aef99:function(e,t,n){"use strict";var r=n("ead71eb0");t.Z=function(){return r.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},r.createElement("path",{d:"M20.25 11.25h-7.5v-7.5a.75.75 0 0 0-1.5 0v7.5h-7.5a.75.75 0 0 0 0 1.5h7.5v7.5a.75.75 0 0 0 1.5 0v-7.5h7.5a.75.75 0 0 0 0-1.5z"}))}},"90018b64":function(e,t){"use strict";var n;Object.defineProperty(t,"__esModule",{value:!0}),function(e){e[e.MEDIUM=576]="MEDIUM",e[e.LARGE=1024]="LARGE",e[e.XLARGE=1280]="XLARGE"}(n\|\|(n={})),t.default=n},"36b3cbd8":function(e,t,n){"use strict";n.r(t),n.d(t,{default:function(){return ie}});var r=n("ead71eb0"),a=n.n(r);function i(){return i=Object.assign?Object.assign.bind():function(e){for(var t=1;t<arguments.length;t++){var n=argument

Chrome Cache Entry: 556

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/1070314322?random=1707417394312&cv=11&fst=1707417394312&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4250v882970024za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Fflights%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3D5171fc655664ddf74ab763a094523fb7%26from%3Dbooking%26&hn=www.googleadservices.com&frm=0&tiba=Find%20cheap%20flights%20%26%20plane%20tickets%20%7C%20Booking.com&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
Preview:	<html></html>

Chrome Cache Entry: 557

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21224)
Category:	downloaded
Size (bytes):	24203
Entropy (8bit):	5.349731623672621
Encrypted:	false
SSDEEP:	384:PLX1wtH+NTv0vDckjUhzU0ZppJeiUGg2TD7eC43YU/Us3ZYNbHG3W5AJdME9oPaV:jKtPQOaG3WFaoPaIK/zn
MD5:	F1DFC75C82E12DFE846D5593978E422A
SHA1:	12E580A708B09C9A8F4CA7CCBE9DD7DF32EDEE60
SHA-256:	08204982C484FAF6890C60557A4E642971F17625DDDDC0559DC0E3CA728AC9E0
SHA-512:	623412E6D454104251215E38A0F365F879EC70F77306769F5FA40E144C0EAB43237D1FE13B92031AD5848071A6A8910F01576F079E1A0904F4D8DD8959D922A5
Malicious:	false
Reputation:	low
URL:	https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var aa="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ba=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");},ca=ba(this),da=function(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&aa(c,a,{configurable:!0,writable:!0,value:b})}},ea=function(a){return a.raw=a},fa="function"==typeof Object.assign?Object.assign:function(a,b){for(var c=1;c<arguments.length;c++){var d=arguments[c];if(d)for(var e in d)Object.prototype.hasOwnProperty.call(d,e)&&(a[e]=d[e])}return a};da("Object.assign",f

Chrome Cache Entry: 558

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 559

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (308)
Category:	downloaded
Size (bytes):	420
Entropy (8bit):	5.541081296135164
Encrypted:	false
SSDEEP:	6:+OGOr/p1JMGOr/p1JLr3CHZ1PbIV0Fhy7eUnNRXS7h4pIoauw0QSfTVV:+Nu4yblTy31Ioauw0QSfTVV
MD5:	17DE6E7EE1D946D00ADEF2DFDE14B95B
SHA1:	DC1D26CB82689512EA8DD44A9FA09418B7007559
SHA-256:	ADD49CB3C237C0729A16C86509C04123CD132BF24BA9FCA0B61343E0D02FEE90
SHA-512:	B0AF197F15177336C28BE49EFB17FF2FF0B474DFA0E39EE23519AB8E8B04E06CC0A5496FFFC279B9DF16776C7E151166F22DC2FB5F96DB2D278F5D7EF29B4266
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/f15792aa.a859b930.chunk.js
Preview:	"use strict";(self["b-packages-core-packages-frontend__LOADABLE_LOADED_CHUNKS__"]=self["b-packages-core-packages-frontend__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["f15792aa"],{fe905f7b:function(e,a,_){_.r(a);var n=_("540adcd8");(0,n.serve)((function(){return _.e("a4a24010").then(_.bind(_,"64b778ad"))}))}}]);.//# sourceMappingURL=https://istatic.booking.com/internal-static/capla/static/js/f15792aa.a859b930.chunk.js.map

Chrome Cache Entry: 560

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	68
Entropy (8bit):	4.200601260429725
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM09/Woz59tVp:6v/lhPfZM09tzjTp
MD5:	C4A2B870062C2BB98C500BC1526C0498
SHA1:	528666CCDB12997358077BC8FCDBFB6B825C7788
SHA-256:	2AA4FA20701CDD6D8D56046069001186B5267E3EE7D0EF618AD2F4A683723E11
SHA-512:	2F1A3ABCD12125F7EF18D61A960901C0FD6F82DD02EA2B8041859E6D5F0A7F08DB17CC110DC6D8A3F7D0D1BA790C4BCCA2506D3C60EDFEB5CB29433E9F4F762E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR....................IDATx.c`...............IEND.B`.

Chrome Cache Entry: 561

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	https://www.booking.com/js_errors?pid=e4de82b919b800e4&url=https%3A%2F%2Fwww.booking.com%2F&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2F&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSObZWJFfVDSMePCFYZWFXO&cors=1
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 562

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4406)
Category:	downloaded
Size (bytes):	4522
Entropy (8bit):	5.192835133231759
Encrypted:	false
SSDEEP:	48:Kuhw05qgPm18etDBYWKs7U1g0cFRmdwlGGWXuNaWWHwG6bjP77iyiSikiJPV1HJu:KyBGcso1gnGwldWXuNf1G6bjGZYEWv
MD5:	65C942CFA2287AD1959F9B9ECA30FF42
SHA1:	392507EC70030843B826D63F9F99CCADDCD79236
SHA-256:	11140BC192A8BB08246109519D67501E6EC1D0C5E3ED1D9DD4C6DD78DD8D6000
SHA-512:	25B9B15D244D7CB0AB60D01FDFED579FC3368ACE33A1EFDCE0A78C344123DA7749C5A158F9A2B885E739A26B63B3D87605F75679CC9171452C8D2CF34D7DFF00
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/dc32f6b7.745c5004.chunk.css
Preview:	.af069031ff{margin:calc(var(--bui_spacing_3x)*-1);padding:var(--bui_spacing_2x)}.af069031ff svg{height:100%!important}.a8788abbae{vertical-align:text-top;margin-inline-start:var(--bui_spacing_2x)}.d2c0094da9{color:var(--bui_color_foreground_alt)}.fd740c4ca8{display:flex;align-items:center}.cd25237414{align-items:center;display:flex;margin-left:var(--bui_spacing_2x)}.a725c56ef4{display:flex;align-items:center}.ad161903fa{align-items:center;display:flex;margin-left:var(--bui_spacing_2x)}.a7cfd67d6d{display:flex}.cd1c86fdc1{margin-right:var(--bui_spacing_4x)}.d6743a6f92{display:flex;flex-direction:column}.c5bdd0072e:not(:first-child){margin-top:var(--bui_spacing_4x)}.eed9981066{list-style:none;padding:0;margin:0}.a1e3e96425{margin-top:var(--bui_spacing_4x);color:#6b6b6b;font-size:var(--bui_font_body_2_font-size);font-family:var(--bui_font_body_2_font-family)}.ea1163d21f{color:var(--bui_color_foreground_alt)}.bc6c5feac2{text-align:center;white-space:nowrap;width:var(--bui_spacing_6x)}.e8e8

Chrome Cache Entry: 563

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=6], baseline, precision 8, 799x466, components 3
Category:	dropped
Size (bytes):	132954
Entropy (8bit):	7.585403686264373
Encrypted:	false
SSDEEP:	3072:WALjM8PVfgPyRiZ9j/DsE0JKt1bmq5GggK:WALvPSyE3j/AE0wbmqIS
MD5:	344D44EF6AEE837A5E3C6797A4A3FE4B
SHA1:	A6460CC7001CA4700FD56AC33BB85808159EFAC1
SHA-256:	E772F5D8D214719D70A969153CB2F1C9A77C4E8D9B76FE3D64F0D8A4E7AEDAE5
SHA-512:	7BE84501A65563C6620A7F535E1460734F9022A2AC634CF7F32D8EC6B97CEC673A966C363BBF26C5AA71939C4E61D330F4039C0AA5C809F59113820F229FB6F9
Malicious:	false
Reputation:	low
Preview:	......JFIF.....,.,....1.Exif..MM.*.............&...b.............1.....&.....2...........i.....................V...F....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 564

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (23128)
Category:	downloaded
Size (bytes):	278898
Entropy (8bit):	4.912685550135022
Encrypted:	false
SSDEEP:	3072:CgxbQpQRFhJaKvSd4IGimvSd4IGiZvSd4IGiaIA9YcFxiZ:xFhJaKdo9U
MD5:	F954499FD6E853A753CB649036B9BC11
SHA1:	7796C1C5EE4D70F6608C0FEA5739E08C03EE82F9
SHA-256:	5688A56DF2FAA00B25C666DC571BB6827D4C0EE913C9636DA8F75CD0F273487B
SHA-512:	AEE5A7247AB66940E9D1BEFD4BCF54662BA08C56E5075055EFF1B828C3C44665D5E093D0D28A7F16F643C929F7CEEE0CC99EE0DCAF07DFA91F66C3A3112D6126
Malicious:	false
Reputation:	low
URL:	https://account.booking.com/sign-in?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA
Preview:	.<!DOCTYPE html>.<html class="no-js" lang="en-us">.<head>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />.. <script nonce="8AAdJYFHxQuvYgO">. .(function( win, doc ) {.. var errors = [],. errorCount = 0,. canParse = (function() {}).toString && /bkg/.test( function() { bkg; } );.. var NOW,. UNDEF;.. var LAST_CLIENT_EVENT;.. var SERVER_ASKED_TO_BLOCK = readCookie( 'error_catcher' ) === 'kill';.. var SHOULD_BLOCK = function( error ) {.. return SERVER_ASKED_TO_BLOCK \|\| error.index > 2;.. };.. var ERROR_TRANSPORT = {.. URL: '/js_errors',. METHOD: 'POST',. MAX_STACK_LINES: 12,. MAX_STACK_LENGTH: 900,. MAX_FUNCTION_BODY_LENGTH: 150,. STACK_TRUNCATED_TEXT: '(... truncated!)',.. SEND_ONLY_IF: function() {.. return !!doc.getElementById( 'req_info' );.. },.. IS_BOT: function( message ) {.. return getKey( '$u.b01' ) \|\| getKey( 'booking_extra.b

Chrome Cache Entry: 565

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 210x210, components 3
Category:	dropped
Size (bytes):	13871
Entropy (8bit):	7.961455667026666
Encrypted:	false
SSDEEP:	384:d7roS1CFuTQ5KHCSkY111GxROnFOweRFCcIeVnBU:d7r3ChQHnkY111sRKBe6cICBU
MD5:	C8E056CE8078976D110BF239A2945C9E
SHA1:	550750D448E83ED54319ED1E797F504C7ABF61B8
SHA-256:	9835C5F54C82372CE75DC89F52070A3FE68990FBB3B3722CD830EC20C860A715
SHA-512:	274345B7C4794C022EC5E5528B29C1C6B6BCACF9ED26F142DE706D7E524C8DFB5CB47394DDFC7BFB6F0998E813468B494184B79149AF86EDA5561FA6F0CFFEDA
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.k.$.....t\|\|....v..Xn...Z#.l..:S.&..j.n..a..2G.Q.2e..Fp}).....9........]Y.7v.w.;).d.U.....@...$....?..6pW.#..J.g\oc.B.G.....(.U.t.s.od.....$.LsJ3....x.K2"..VnNM4.<.MiM.pR..fuT).....%s.%.!...(..R.8..z..%..r{..2O..(..h....G.Z..G.!~.\|.p3...n...h....Z..F2Z[i.%8f..{.R.t.6.).^.1.v...Y.....N3.=i.zs.rV.d.00@.=.}.I#...rG.YU..h[..F.W...Q=;..;H......z..$z.:~5

Chrome Cache Entry: 566

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/975716499?random=1707417356815&cv=11&fst=1707417356815&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1
Preview:	<html></html>

Chrome Cache Entry: 567

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	10006
Entropy (8bit):	7.97889714105622
Encrypted:	false
SSDEEP:	192:TgfymjevN0pv/84iZoCks1vvaK+BZUNgq+hJ3Z2TMv0QAT1fv6m4S7m++zd4:kfljO26uFK+3h53Z+s26omLd4
MD5:	2BBC07CC665AC423BEFE32ADE5F55910
SHA1:	E120FBDE4C4F791B07E186DBF8441F0154C121C1
SHA-256:	5EED0383F330DAFB448F740EDAA2013D8C81458DC9C78455CC36AC5585F5C261
SHA-512:	B8E38D42BD0EDC583987D06F7862D2D770223573879788E54A5780A9C96113EA9F42E55A8954E444EF8A07AFC1794BC34860238FC8BAA13AC02D5556EB2AC74F
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/square250/690242.webp?k=d237489ebaacd4fce01bee28f2947d5b8e4e062f62a47f1b3f771473dae96fb9&o=
Preview:	RIFF.'..WEBPVP8 .'..0........>m0.G&#...q.....c...4.7..+.....o.b.~.b...y.a....sX.AQ..x.....&......P.X._...."._....)._i....!jAx..U.M.n.N0..X...Jz..+}.../...K4F~c\i..U..^.]G..Y....@..`....K.d0~.O..qyx........"x..N1....D.2{".'K.,..2,/.\|...@....`}G...W...4\|..9.Hg...e8.XB.....j....p.....3..;.Th:..,....w.Jfy......S...7..........4'7....y..c..........5;..f.)...v9'.d....z.O... 8w!..i.vP........P':>n.J.m.iW\$f.SPY.FA....?WU.9...T....{=.K_..i...Py.......p....:.q......../.(.9.q....9..9..\./.~CR2..V<JZ..R...}}..h...S.E#..9yG.^....;....z..t`n.M...Co....#.......Z:.1.....9i...~..5 ..Yz.....K....`.......J...X..EG.fE........J.Cc.K.rv..W.a.Gd0o.Z.%.....+\|!J!8}x...\....;..O..C`a;7.*...\1'..Z.....q...u.y:O...Q5.+b..._.Q:/...\Z.n....U..us....d_QCf.Q....W}6...#..n3.b.F0..9.%.-..H......uQ......S...]....c..i....if+G.1G.3................{. n.HV....Fz...s8...+.45.8.W......;z...4#...D.K.>2..7.....M.].u..s".$[.!i....0./E.....%l..].\..f.........d.W..Z.H.-.i...d...s

Chrome Cache Entry: 568

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65463)
Category:	downloaded
Size (bytes):	1154916
Entropy (8bit):	5.5459624658408435
Encrypted:	false
SSDEEP:	12288:Zyj4XUUySxBGYK6FDuR/8okvzl3YvDd2buCUud:Zyj4XUUy2BGY1DxokRIvJUuCUud
MD5:	69393D6B6A9AD309F4C96D0C1F6CFA5A
SHA1:	4961BBE3E20511539794ADABC5AEF177BA4A50B8
SHA-256:	8FBD8D54F8F570DE267C3C8461AC3589763A3EF28D3692FAC0727607D8188925
SHA-512:	9D3FF0E52D5224FA3290A2691AB7763E1E4F35043CB3DCFD7F753AE65A603C97F2F79F1E91C195120A403A89B30AF757F9A18BBEEE75640B0B12032BBA16AEAB
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/flights/web/static/js/client.ae384b8e.js
Preview:	/! For license information please see client.ae384b8e.js.LICENSE.txt /.var client;(()=>{var e={62243:function(e,t,n){"use strict";var r=this&&this.__createBinding\|\|(Object.create?function(e,t,n,r){void 0===r&&(r=n);var o=Object.getOwnPropertyDescriptor(t,n);o&&!("get"in o?!t.__esModule:o.writable\|\|o.configurable)\|\|(o={enumerable:!0,get:function(){return t[n]}}),Object.defineProperty(e,r,o)}:function(e,t,n,r){void 0===r&&(r=n),e[r]=t[n]}),o=this&&this.__setModuleDefault\|\|(Object.create?function(e,t){Object.defineProperty(e,"default",{enumerable:!0,value:t})}:function(e,t){e.default=t}),a=this&&this.__importStar\|\|function(e){if(e&&e.__esModule)return e;var t={};if(null!=e)for(var n in e)"default"!==n&&Object.prototype.hasOwnProperty.call(e,n)&&r(t,e,n);return o(t,e),t},i=this&&this.__importDefault\|\|function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.TGenerated=t.T=t.remoteFormatsForAsset=t.isRemoteVectorSet=t.isFlag=t.getFontAssetUrl=t.g

Chrome Cache Entry: 569

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 570

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	10200
Entropy (8bit):	7.98035540839143
Encrypted:	false
SSDEEP:	192:5Vi4VaP5qaPgrcw5Z9kXDpQDqs4+45GeQNtRbrqoiQYEOj/5mZgAQ+xO:5Vih5xXw5Z9kzpQr45GeQNtxqLnEe5mU
MD5:	2E1616472619A8FA186C1B02AE879C40
SHA1:	E84BC95A5E2004FAF9975FBBE1169316531D871B
SHA-256:	3CDB59FC14DC92F1A8210C78AB1EDC69C7EC2D680A9FF296857CA03CC825FA87
SHA-512:	775973537B65A1E67CDB56CF51B66C0C30AF683DC138A3039C83FF63D00840FDB23BFBE8936A987DAB45EA8651C3665BF5799CA66DF7D4CFBE0568B776CF9A1C
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/square250/689573.webp?k=4aefe3aca3ad388dca94c5fc8123ddd89aff34d443ccaa192a8b4ec6981c5b90&o=
Preview:	RIFF.'..WEBPVP8 .'...........>m2.G.$"..V.....M..ks2-...V.C...u^.\|...t....7.....?.........X..~........U.K...;..O....'.....S.[._.?.../...y......../......u.1._.{.v..........._.?........d..\|............<\|D.u............W....g.Ze...OS.mr.2X.<..5sHp.n..sz..']....{....^..t.k...zN.....+c. .P=[..&.......>.......u?..N...,U....R.6.j.(........V.....D..?.....;2O...T........Q21.k[....N..s......D.p.C1}.Xj...#=.....&.`XP]o....kYEpZ}X...>.@.@.....pTp8..H4.;..:.Vc....j.......z..?..a1u..j.TP..=N.+.~.fm......Q..M..p.{..U..M..j..g..F.v.Gu..o..g.n..k.B.Ot.ve.B$.n./....V.D.+..`}.W..g......oB1T'..:......6.5.[.J.P......42x.2.!;wNw.._.....a..6.0[.w./.hMW..n.R..!.a.....#......)..1:.7.....@.oR.jl....xOr...{.9m.y...K...E.. J4.....6.'{p..u...mx.i.C..>B.. J....%..-..=.+.....Mf...'....=..,A.P..G1Z+ ....l..,$........ .0..p.+..3n..7^.V.w..JN`....i.V7.G..@.%.^....T{!.9.hf..fD...?q.g....B...v.GU;S....z...P.Es..bA......k...x. ]J.}...?E].%...^3...E...T..."L+A7.....O./]7...

Chrome Cache Entry: 571

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	48905
Entropy (8bit):	5.566694545871129
Encrypted:	false
SSDEEP:	768:AK6hDVMaqSynB3WhXcZ3RucJlYRSGBuF3UMR01V8rb2OtKCB:AK6hDClaXcRRuSlYRX8gM7B
MD5:	E79F8A15DF4826ED8289AA85A222B872
SHA1:	F7E408AAB2FB8138AA9F9FC6C77F9FEC3BB4897F
SHA-256:	F85B5995D7C06BEB250835238610EA7A2FBD4771700970446CC5FDF73863D8A4
SHA-512:	F826AFCEEBC9E2281B66F462B69A374E9B03F4845B96182F9AA03266C24C624EC393FF02EF96B75182A534A4E8AF924F2D8FDC6AB2A17B855DDD267DCD796C2F
Malicious:	false
Reputation:	low
Preview:	{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","pccloseButtonType":"Icon","MainText":"Manage your privacy settings","MainInfoText":"Select which cookies you want to accept on Booking.com.","AboutText":"You can find more detailed info on cookie use and descriptions in our privacy and cookie policy.","AboutCookiesText":"Your Privacy","ConfirmText":"Allow All","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","CookiesDescText":"Description","AboutLink":"https://www.booking.com/general.html?tmpl=docs/privacy-policy","ActiveText":"Active","AlwaysActiveText":"Always Active","AlwaysInactiveText":"Always Inactive","PCShowAlwaysActiveToggle":true,"AlertNoticeText":"By clicking \"Accept,\" you agree to the use of analytical cookies (used to gain insight on website usage and to improve our site and services) and tracking cookies (bot

Chrome Cache Entry: 572

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	dropped
Size (bytes):	8642
Entropy (8bit):	7.936811905814669
Encrypted:	false
SSDEEP:	192:mIRFaj6y6SGsxJJPZnPT11NmpbTJytPcdjxhlZK2:nR7RstPxTop/8Kls2
MD5:	C93A2183DB30C5988936B15E9BB2473C
SHA1:	9D5B308CF067E5B0EE544D3FDBA45740587D2F63
SHA-256:	2B8F25D9F2B16CB4F435787E273411EED1CDB83E7CCC56542358421AB0D90E4C
SHA-512:	066C23C192D868A2B5505813D40DE3515EA874636B70D67D9E8B93F37CDC0121D8D60B1A154DC77BB05D13E64081858EB843CEAC3649DB1F14D902054ADA68C3
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...Q.<....FF.+..]..qkVW.sq..Q.U.....X}. .J...s..e...SvWn...v..dL......A..Kt.#'..........d..j~.n..?1..:N.(..O1..0z.:...!..*;B:z..'...SI..k.#.X..."..[+..O......Gw#..2....t.....Mr"....F....1.V.......F.\|....q....>....JmE[...wB.H(....]4..5.....Y'..........C..KF +0...m...jVm....p..V;H.w.6H...:..>.RGy.Hnnm...^Fh...[..%...n.:3.8.rJ..K%...c.y,.3..O..T}...4..icW.n.

Chrome Cache Entry: 573

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 210x210, components 3
Category:	downloaded
Size (bytes):	8808
Entropy (8bit):	7.943987588999884
Encrypted:	false
SSDEEP:	192:myliFmoNI0FJJxQR7F9jI0usCdw2GbyGR/H6rWk4z:dliFmooL9jIZq24arWkw
MD5:	45E7C421DEA0B99FE13C0CDD67D6D73F
SHA1:	BCC2D3A8B36FC9DCB020DEC4DBF1EA78014B6341
SHA-256:	8F11594B6847E6739368069387CFF15286326945ACD011453697CF1DA2DA5932
SHA-512:	41D61080FB54E7638B419494A27189BFEF33ED22C388761839DCD7DCD4ACEE40FCE9E4A416FBC1EE324881F364B58CA2E95C92D05361D4EDCC8DAE9EF8C53972
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/city/square210/690620.jpg?k=5b801857b88469e1cc299707cda5a8ee86c757a159c04ff69fbc1fbb37a9fe4c&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...e=x....T>A...X..,...d.R(.....z.SG>>...E.D...8.\dqS....4B......N..O....a..v.H!c....jP....."..6`.\|...T.1@..)..8sHc..........w.(.(...4..C.IF.L....Bh...4P#.M..T.R..S...)@...Mu...,..E!...`D.......>R....O.OC....1N.w..........T.....\..c...jQ#z.yt..Kh.q.F.n....;.,..K..R......wRm..@..7Q..m ....h...>.........u.).S.w.n....'..K.QPmj).W+.?Z.6;Vz...U..l.d.^.=).SYZ.

Chrome Cache Entry: 574

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	https://www.booking.com/js_errors?pid=2c8482c2544201f4&url=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&m=UmFuZG9tSVYkc2RlIyh9YYo1mfebd19Q2WIimWOyIN1gUe4_-JQdNOBTMuHuYCJPue7ik10LWViyRYmmf149m9vSAg2JJTyfAEk9RiEQZejXjro5rDJvxnq57UaGsDKd0iBXLkMuV2sFYEHSFmXZW5zvkIdbv7-B87Oi9zo36Fnq7AU8K4Y8Y-SdtsN1A2dfLiciDUxBuNe45QSxoxZcHhPcdr6v26QamVEbge_7LQ_MDhbvlSKq9Lwf9P11FwHzxPymBNBmu_dZFb8tK9Z3wY0RAyYm7D0hfdu-LCtv4j3isKKp1L_CiYhwCnyC42X_OqimTrSjKXCbKfd3YnkJbQ&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSObZWJFfVDSMePCFYZWFXO&cors=1
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 575

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 720x217, components 3
Category:	downloaded
Size (bytes):	25671
Entropy (8bit):	7.964895192972628
Encrypted:	false
SSDEEP:	384:qlBZvk2iTaMf5rsNr+vzLpfdnGt2pW5MbdihLVEo32GTDNAoBNkKxN8Wn9LRvHym:qlAZ2e5rBGaWibdifGkpBNvN80KiMyP
MD5:	E8BC48549C1E82C951DF411059B81A85
SHA1:	1A77B13C57125FBF8DD5DEE35AD1DB4BABDC9427
SHA-256:	7398A7BF4867D9A59CE24A193BE3F38267F6B612BE70FD9EE9BF56718E69E9B9
SHA-512:	F0D1DB4FF187FC32F8354543525AE605139EFF45A4C8011A4EE65D91231DDC48828CCCDC617D92697792033220BA4B44A9A39539AC5C0BC6268B19AD66902953
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/xphoto/720x217/308526620.jpeg?k=0663a1420ea98a013af0eda32bb4d11258521a39c5b8a5a4e2777ee5661dee55&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....i.....'.....-0..6.h.@.....&)v.S.0...H.@2E .}(+..uS.J.:R.\....U...L.}.h.m..J.m4.#.9W&....1..8..E.T8.D..Y6tE.$.T].. 5....."H..) ......A.,... sR+. ~t..K.\|..Uz.)...Q.s...^z..i.K..rLi..}.L.1N.6G..mI.J....I.ZM.9...W.....m5.....o..J\R...j6T..q.J."......c..f.F.~)i..{ph.5&)B.@...;m<-...2..m...m..b0.m.6...E.....M.\v#.J.5 ZpZ..#.K...J...0%.jP.m.q.m!^*m..q

Chrome Cache Entry: 576

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 577

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 354x266, components 3
Category:	dropped
Size (bytes):	13198
Entropy (8bit):	7.937859559336789
Encrypted:	false
SSDEEP:	384:npDVNz2rwEfVwmYYzS1f8hLSrNSNAR7mLpVBqm:pDg96mYYzS1f8hCNSNeqLpGm
MD5:	93B368DDFC86143393FC8D2260DE45CE
SHA1:	7745E46FEDB9BDA48C3C7A2EE002BF91F2A196A6
SHA-256:	AF077092217D66FEDAEFFE481B80D92AAE921617550F88C9A3270AC864DAE59D
SHA-512:	E34D0261746B44DBF200D95BDAAB0100FD22E361D30D36AC7041AFD7666A1CB3B31AEB8E1B2027AA3F55228CD66791A869E06C98370AB9709D4E8A646121FAB5
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........b.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.........E-......P.QK.(.(.....R.b..QE..RS.(......QE..b.R.@.E-...R..)h......JZ(.....b..)qE...Z(.)qE..QK.S...R.!1E-...)h.bQKE ..Z(.1E.P.IKE.%..P.QKE.%.R..QKE.%......Z(.(......Q@..Q@..R..QKI@...P.QKE....1LAE-...R.@..R...(...IN..bb.Z(.(.....Z)..R...QF(......J)h.a.(.......(..P.E.(..%.b...E-...R.@.KE..QE..QKE.%..P!(....(..........u...)h....Q@.E-.......J)h.....C..Z)..QE..R.@.E-

Chrome Cache Entry: 578

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/973712236?random=1707417370647&cv=11&fst=1707417370647&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=LJXqCKDEq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1
Preview:	<html></html>

Chrome Cache Entry: 579

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	21134
Entropy (8bit):	7.991676762963661
Encrypted:	true
SSDEEP:	384:PPsgL8YyB2TKATf7V0XJCy+eTBVgCEQSsCiYn9LInTb5HOK9Y:9C2T9TxATgsm39L25uK9Y
MD5:	CEBF68FB2D6614BDAF5D110803B1635C
SHA1:	24135DD12DEAFBD207FE406F69C1F50AF24F518B
SHA-256:	B592DCE471A02FD08F9CB92AE52265A328034F4EA27585F0CFB9BE08A06CC3EE
SHA-512:	909BE466FFC4BDFA460674FDAC976941171E0A5A10AA10F6BE5D20EC3BC7D1B90A144D214778E35C89B2F8A6A4D6753C3D91AF164FD817D0E63F8833CCC75630
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/square250/352166.webp?k=70257e02f84d33fc68f9da008ec0c40b54a86ce522305dfa807b0bc449ee690c&o=
Preview:	RIFF.R..WEBPVP8 zR...........>e&.E..".lg.X.D....S....N.yG.y.....W.y.....F..?^.v.../..7.........7.#..@..}.._..>...........}..#....#..._...~............/.O.....?...........=......................g.W.c...o.......3...I.....U..Q..\n..1.C..J...AE.....;..\|.bN..e..O.Un....j"...7uA9....1.T...{..((..K..<,ko.I........u4[w..u.g......p....8.+...\mx...{.T\A......=."..o.Q..Z(R4?tk8.w2...aJ+.`_../.XqlX.....^..K8.7"eO..<.@..i>.. >D....I.7..=7..d....H...<.N..}^U........#..s/z..},hZQL.q.#.k.....!o.m..C.e.^...r....U.E..n...a..!..[O..QF O..&.;.I`......"G..(.4....-....\|..&..i.........?........h~G.42..b..Eo../..P'...EN>......^....<........D..kV..V.....8...]..9'v.s.>./........2.;.)..b...p..}H...~<U;.O..> ...c4B ....J.....^..f..v.mG\~Ao<D...h.wZ...K.....y.d..:.e.....L.`.].3..hr{..$....\|l.....e_._.<...4.M.e<....... ...(........Rm..u.6..}b..E.S..Q...........ZA..D...a.(....g...L..7..H.......?(....@\....E......D'../...1.o.'.v..<..#.AoN.%g.9..d.\>_.0<I..H.+...<c.$

Chrome Cache Entry: 580

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2341), with no line terminators
Category:	downloaded
Size (bytes):	2341
Entropy (8bit):	5.8981982845428185
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt0811GLL4vFhtzYig3ml6:wsbSUtJfxrqLWWWdV6j1PGL+tk
MD5:	3C16F9684D237A0A0D7F42A3B399155D
SHA1:	96BECD4C69B26C6BA7B569778719E21B882F3707
SHA-256:	5970496F2D7269A355CB5C5F9D2FD74780F04927DE9D08244086C4AAC2A67CEA
SHA-512:	A39FF36308CD63F8620DA2DA409C1D7CB11963D1CBE56B89B40FCE0BAFAD651D7618D5F32D0481F5A3A0325E47BB329E7534D509688D4D078C93A266A860FB49
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975716499/?random=1707417344619&cv=11&fst=1707417344619&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 581

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 582

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 583

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/973712236?random=1707417344535&cv=11&fst=1707417344535&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1
Preview:	<html></html>

Chrome Cache Entry: 584

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	dropped
Size (bytes):	5928
Entropy (8bit):	7.926017675472102
Encrypted:	false
SSDEEP:	96:ghIEuAUbFU7h4TP7yDg3y14lQFba7y+hxNADYxOc39yczZMXmnOKTHzhJz:mIxNpUtU7li14lQFm7y+b393WXmLTtJz
MD5:	BB290168F7786611283C023BDDE3C8E9
SHA1:	3ED9E7A50403500F00D2A9BC8D12A0B626065A14
SHA-256:	B82717756DA632DC8ABE664FC4238D3B91F8CDA4B801308D5B6FEAC4B6AE61A7
SHA-512:	8A90706148742B94CCB23EA04453F07CF6FB24884F778BAD179EAC221930FB24F7F8A3B9300BA50AAE40AC052D4D72AE91D2F4386CA81295F37DF520DD820CF5
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...v.N..+....m..m...)..Z9..ai.j@..s.(..<.p..=.\v(.5..u:.Y#'..?K.:.....\|...f#.S5..}..\X......I[uX.P..b.vI'..q..J.I.c..HV.......K...iv...)....j@..s.).SS+.:....l..7..MJ..m+.).......E..4.M0S.;......O..;...L..E..8SE>..c..~.%....E.x.'....._.j..[..A.<.. .x.5o....m..6.f%..N..W1..k..K ..aJrv......~AF.G.Dw......f.4r.....2X..*.....q.m..p..p..i.iE8R.r.Zp.....aqJ...)\\|.

Chrome Cache Entry: 585

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/975716499?random=1707417344619&cv=11&fst=1707417344619&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1
Preview:	<html></html>

Chrome Cache Entry: 586

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	downloaded
Size (bytes):	12530
Entropy (8bit):	7.956127740598182
Encrypted:	false
SSDEEP:	192:mg4zMtkG+mTPAhXyth0npcOwORd5ORBEFxLPwPjAcCNH9Zx9VnwKOdeYiMsc:38MtCaIJ0mnpcOnT5hXSCNH9FqFdF
MD5:	0EC8A6ACAFD2FF94EAD2387AAC012C13
SHA1:	697CBD26BAA47A35A86EB6FEAB2A7D9A9720947F
SHA-256:	48F88E754655911D3A8885792052DA8DDDCCD607F64F7E030FFAD6FB2D283A37
SHA-512:	5757F69AFF1A3B4E41E8FCB262AFC384BACB11F82CAF13A3CF61D1EFD63B65FF3FA20AE5B522600F8F7CB0F259B032DE485E950423911FA21A6B4605A56515BC
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/hotel/263x210/100235855.jpeg?k=5b6e6cff16cfd290e953768d63ee15f633b56348238a705c45759aa3a81ba82b&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..0).P.8...p...F.F.Y8.p.zq.....bFe......r...o.t..a.....ha/u.f?.Fs...n.Mk.,HT#.+R+$.S#..0......^V..R....:.:."V.....}i.R..E8..H.+.,@).R.J.Z..%.. ..W=.Y... mf+..z.........'......$[k.(...{...b..p......&.Ci.m.0x....q.j..c^....?..wa....C....T..Ig..'F`.*.Z...Gsi.Ge.......j.p.Q.i2..\|+.1..d.0Gy{s.:."R#>..b.Y.m.$..E.'B6...}q....W.Il.p[......X..QW.N3..n...h.S..

Chrome Cache Entry: 587

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/973712236?random=1707417356745&cv=11&fst=1707417356745&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1
Preview:	<html></html>

Chrome Cache Entry: 588

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 589

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (565), with no line terminators
Category:	downloaded
Size (bytes):	565
Entropy (8bit):	5.013395369899308
Encrypted:	false
SSDEEP:	12:hR2zGkAIrR/+RRa2OXnlEceA9uJ33+SGf6bGEo3G1ONOI:hR26arh+R8xXeclk+h6vo2qOI
MD5:	433CBAC690542626F503B4269A8DA12A
SHA1:	3E810BC4ABACCF42AC5E4B0B939D63C03711BBD9
SHA-256:	F83B1A3EA61AD62E47FAD82DE5495A2547E2F12E591AD8108050538C566AE1E3
SHA-512:	569B3D704F2A979D16624064ABD3B97F38EEA3C9A5F3F09D31C9B83D62C360717F6F66EE44A6B53686760421A57D7EB4ABD54904556B105B05AA81D5850F34B9
Malicious:	false
Reputation:	low
URL:	https://ct.pinterest.com/ct.html
Preview:	<!DOCTYPE html><html lang="en"><head><title>Pinterest ct</title></head><body><div id="root"></div><script>window.addEventListener("message", (event) => {if (event.origin != "https://www.pinterest.com") {return;}try {if (event.data.key == "_epik_localstore") {window.localStorage.setItem(event.data.key, event.data.value);}} catch (error) {}}, false);window.addEventListener("load", (event) => {try {window.parent.postMessage({ key: "_epik_localstore", value: window.localStorage.getItem("_epik_localstore") }, "*")} catch (error) {}}, false);</script></body></html>

Chrome Cache Entry: 590

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1324), with no line terminators
Category:	downloaded
Size (bytes):	1324
Entropy (8bit):	5.829302579712547
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAwwWulNE6D6+KVCLTLv138EgFB5vtTGJTlWt1Q1XPsLqo40RWUnG:VKEcPw/VKonR3evtTA8k1XkLrwUnG
MD5:	E705BAD2BADE9B1CF920439BB926DDC4
SHA1:	86E2894FFECC374C44A613E2257DB7AB3E20DEF8
SHA-256:	2A2457D3D7E079B0E3FC74EAA6D209AB766718019FAA9103A7D31070449D362E
SHA-512:	6E2C578365B2647C5AC2E140B45CA4F1468DF0A793CC7A97E16843F99E04FBAA9027EC1CB6466C01CA00CFC0025469AFA89F3E93A437645C2882C3D0994CA7AC
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api.js?render=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&onload=onLoadRecaptchaV3Callback&_=1707417401851
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD');(cfg['onload']=cfg['onload']\|\|[]).push('onLoadRecaptchaV3Callback');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true;var m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='Az520Inasey3TAyqLyojQa8MnmCALSEU29yQFW8dePZ7xQTvSt73pHazLFTK5f7SyLUJSo2uKLesEtEa9aUYcgMAAACPeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/reca

Chrome Cache Entry: 591

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	14458
Entropy (8bit):	7.986537563561675
Encrypted:	false
SSDEEP:	384:5xQN2esinfv6DhQ/AwJHriUB91kxVxv42:5KsI0SHeUBR2
MD5:	95225159656D97EDEDFC54BEF4F5834B
SHA1:	63581AA67741F2020DBB1E6425A7BD62B477185E
SHA-256:	7E23CEEC5951F6E086E5EB4EFDAF1D2E998533211A3C669218B418216EA2774C
SHA-512:	F56C776C73BB371823170F1D52736AC917774EC7CCA4C775F947E8629918FF3F925C2BE4BEB1630F5EDC4E5625E89A0438EAC78E4DD627866F20237294963111
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/square250/976823.webp?k=96ffc687725d79086ffd57914e2f32803127412daf40ecf1195d9038107917bb&o=
Preview:	RIFFr8..WEBPVP8 f8..0........>m,.F&#...V.`..... -v..i..A..z...Q...._.}.....4.H.]...o.s.}..)........?.~....w..._..D>..v.o...#.o....#.U...}..3...'.W.?W...v...?.?.?.?....(...#.........~..i...u.......%N..5.J..l.a..P.i.s...:Q..Y..6.q2...T..S..o#.>$..0e.\|..H.......l..".r0lb..,K..L..@5.5...@..5.~.l..G.7?zU.k..]y.,}.{.\.v`y......1..H.7......`$X....1.-u.I ..w.c....?...;...&.../(6...a\...Gjt..3.....2.^I.JwV.}.#..E....]...3..A...T..rZl.B.k <.Y.........W.#....G...Xk$....1.`..A..")..p..pv..\....L.7..=8..8J...D..".s.`.,..;....s.A&TTe.G_.v.ldyo...^..S@..@.0........l.X. .....m...d.hG...1.^.iP\ks..6.j.G...,.o.U~...Eg..~...;3...0lm.\|..`..+......$.o......d....%AL.x}.a.....b!_...;3R.1.q9...o.\|.'..v.e..B....G..9[.WM.\....Rl...z.Bg..7.&Q.Z).P-B...]d....n[.c!?........./..6..>...db.......]1..vM!...-..(....x..n../..l2(..o..1.....U..1.Z.Xu3...u._...G&...5Hk...z({........Z...{..@L.....\|.>5..1.!..n.(..^..f.7..b......2..F."...3..jy.&.,v=....zz.@.j.[$i...B..4..k.

Chrome Cache Entry: 592

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	40
Entropy (8bit):	4.049581770147834
Encrypted:	false
SSDEEP:	3:mSCdXEXnoJEXno69inY:mSeUXnoKXno69L
MD5:	E748288EA34F548DCB5B8C6D5B13C13F
SHA1:	C6AEBC869F93C8951651545228F5CC9AC27832C3
SHA-256:	0DDC43544E41326A7A1A020D2B7DCBFEE044FEA93079BA0B5D34A4F8EA9D5DFA
SHA-512:	B18C841C574B2717C3F134B6E563E0FFB38C55D04574683A1D2A96344669E8BAA4871781AD76E3C65FCA38941EC95142360BE49CF0EAC0187ACE560CD74B0B69
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISHgm18MmG4UjH2hIFDbDytpQSBQ2w8raUEgUNlJCS-g==?alt=proto
Preview:	ChsKBw2w8raUGgAKBw2w8raUGgAKBw2UkJL6GgA=

Chrome Cache Entry: 593

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	9846
Entropy (8bit):	7.983338082810248
Encrypted:	false
SSDEEP:	192:ozQY/6HrG71FsG1MU00JxahO0bxCQ/9QA0uoHy7o2h2r5awLTbhY7rZAI:uQ46w1jcWaE09f/h0JgSTbCHZ1
MD5:	CF0D1CBBDF95A25F17307F4FB389DAA0
SHA1:	63D4E2A3009DAE49C75E8C1ECFB9A517147F10AD
SHA-256:	1334A2A666F85EFFBEABF2E1BE501BF343FA64F4DD5F1333CB74870D24078F2F
SHA-512:	7655CFF10EF218D274A42AB3F18436D92E4683B2CFB8EC4F293B62291AA7F6792AF290D425640D83502AFF96D2CAB4F477BFD8F64F01F35183747FEFFD1B6F9F
Malicious:	false
Reputation:	low
Preview:	RIFFn&..WEBPVP8 b&...........>m0.G&$#!..K....c3....z.U.4.[.-+b.7g..zs.......}......./\|.....w~7?...Z..7.o..d.g...?@.C._.C...n.C.#..\|......j:7.}.............w.C.....Q.t..O..eA..9..s........b.Bzv.......q7m$-]..........q...'.......4......t7..f...l.M.I.5..\..A._'e.4c%........Y.>c...].K_..#.Oj..]..Ap....d1.7\|h....e4.<..\...K4>.X.&.bOb.My.=;......D...#d#...".j.w..........V....57...R......e...y.,...._.....b..~.vm........%qr.73.Q..........<...,.(-.....5a.......A.v1_......e.......].f..Y0'...%O..YW..3....#iW.~.E...._8.tv....KLoZ..K....3S......W.T.Y.......f>.2.J....,..B}.j5......(.^.Z7.T.:(..2<:8...g;..........N.u9....zn.(u.{.....f.~b..U6._E.@...\|Q...s..&9..T...\!.sV.p..pH.>M.B..o., k.4.w.w7...^...\..({?...r.h....._........9...e.d...3q=q[.e. ..FN..].S...:Y....{...Y.K..K...j.76....U........ug{......d>e8..l...~.K.I..Iq...n.o.U.3...w.*g..@..k..s.@[V.i...B..F?..+.v.....Y...?.#...6x;":...4.-.....Nm..p...lb..X_.....d&_.$.. y.y.......+.......<hE:.

Chrome Cache Entry: 594

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 595

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1324), with no line terminators
Category:	downloaded
Size (bytes):	1324
Entropy (8bit):	5.829302579712547
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAwwWulNE6D6+KVCLTLv138EgFB5vtTGJTlWt1Q1XPsLqo40RWUnG:VKEcPw/VKonR3evtTA8k1XkLrwUnG
MD5:	E705BAD2BADE9B1CF920439BB926DDC4
SHA1:	86E2894FFECC374C44A613E2257DB7AB3E20DEF8
SHA-256:	2A2457D3D7E079B0E3FC74EAA6D209AB766718019FAA9103A7D31070449D362E
SHA-512:	6E2C578365B2647C5AC2E140B45CA4F1468DF0A793CC7A97E16843F99E04FBAA9027EC1CB6466C01CA00CFC0025469AFA89F3E93A437645C2882C3D0994CA7AC
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api.js?render=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&onload=onLoadRecaptchaV3Callback&_=1707417367075
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD');(cfg['onload']=cfg['onload']\|\|[]).push('onLoadRecaptchaV3Callback');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true;var m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='Az520Inasey3TAyqLyojQa8MnmCALSEU29yQFW8dePZ7xQTvSt73pHazLFTK5f7SyLUJSo2uKLesEtEa9aUYcgMAAACPeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/reca

Chrome Cache Entry: 596

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65455)
Category:	downloaded
Size (bytes):	171478
Entropy (8bit):	5.507840377168289
Encrypted:	false
SSDEEP:	1536:hvnw+we9q15F9fM7h74sOQmgnBgjBg785mNNSyq:C+wm6sOQzUb
MD5:	32F6CB6519036A5CB6D7245E1F3F4A10
SHA1:	E874D25C0C6FAE12EC76094EFA8A9CE4219E38B7
SHA-256:	28A1503DA4BA472B1DAF98F093E8417152ED47C81528E45C0834545D332D9E42
SHA-512:	F8B5DBCE53AF2C91891C8318F5EB53DFF8626714497F52DA1CCC661F997859F48AF2A122412B83BAF29FCB4999FBAA95D291597D01C7768D125F55D378EB182E
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/21928fd5.cc39b346.chunk.js
Preview:	/! For license information please see 21928fd5.cc39b346.chunk.js.LICENSE.txt /.(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["21928fd5"],{bca1141e:function(e,n,i){"use strict";var t=i("72bf8c83");n.Z=t.Z},e908bbd3:function(e,n,i){"use strict";i.d(n,{Z:function(){return U}});var t=i("3d054e81"),a=i("dee2534d"),d=i("ead71eb0"),r=i.n(d),l="a529739de5",s="fe04f404b8",o="f538ae62ac",c="a244555425",m="a6271fb6c2",u="edb4db1de8",k="e98333fe6c",v="bc476201ed",g=i("c91f1a4c"),N=i("975f4b85"),S=i("6356c4a8"),p=i("6229d898"),C="e714215256",I="cb32f1ced0";var F=e=>{let{title:n,subtitle:i,variant:t="strong_1",titleLines:d=2,className:l}=e;const s=r().createElement(a.Text,{variant:"small_1"},i);return r().createElement(a.Title,{className:l,titleClassName:2===d?C:I,subtitleClassName:C,variant:t,title:n,subtitle:s})},E={stars:"d542f184f1",strong:"bca48d277f",ratingWrapper:"d22e41465c",triggerWrapper:"ebc0e717e3",additionalIcon:

Chrome Cache Entry: 597

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2866)
Category:	downloaded
Size (bytes):	211339
Entropy (8bit):	5.545143028562962
Encrypted:	false
SSDEEP:	6144:bRLxI5l43y5p0yumb0fci6XaG2QuC8qckeMWTx:G5uyumepia7QuC8RkUx
MD5:	F41F49752188C7D341D3F913F5A4A1DB
SHA1:	611272DA1CE576EE110939A734504C8006A8BAB1
SHA-256:	EA85C5D9D64E67549E676EE84726108400D85D4C6E8C422D4AFE3D5AD4B8A041
SHA-512:	084A5A5B7B950171C532D46312F9FA83855B0C29CDC853740FC30F4C0C3FC39EE6970B819E2A53236BB8D054A6A328AA0E229C386A8CCEB36B624C8B77ED7CB3
Malicious:	false
Reputation:	low
URL:	https://accounts.google.com/gsi/client
Preview:	"use strict";this.default_gsi=this.default_gsi\|\|{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x742400, ]);.var aa,ba,ca,da,t,ea,fa,ha,ja;aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ca=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};da=ca(this);t=function(a,b){if(b)a:{var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,val

Chrome Cache Entry: 598

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 210x210, components 3
Category:	downloaded
Size (bytes):	5745
Entropy (8bit):	7.892422930102046
Encrypted:	false
SSDEEP:	96:ghyEvTNaH7B0gHnsWBU50/IvBpwX+ZcJDydXUSGahADtUqMvBpiw7BvBiUrmon/Z:myeNaH7Buj1vrwacVy1bB9BJpiwPmcmE
MD5:	549AF9869817C9DA36D4A797CA851B6B
SHA1:	B4108F106CD0F326686D3BB15025CC230726713B
SHA-256:	D26B20BFDDB55B019BF71DC7256C376226384C008B837A0C1035D0CD211897FF
SHA-512:	71AF4FD57F49A6D1087AF66C27DACA94B918EECD6E58897C18BCE3AC25C8C239DC1BA50FE809A07CB317F6A0A17901A926287963B3E08B8D9D4505B0C6FB58A7
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/city/square210/688779.jpg?k=def43ae0127037a004ded67b24b8f978345b16a8d10edd0832dcabbed12f2fcd&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..,.q......[.b..}1R....dl..}..6.<..9......}..4.ju.5.@....L.x..GB8W..G....TDMJ....[.U..).. ..Nx=.TZs.Kn..\.....F... t..[.<S....Uv....j....g..5e......&.q..........].X.0..I......".(....JV...9s.94..)T..q.N.a.h...4Qa..*.....U..YW`8...7.]..IG5I....z..$k..v.s...G.Kh..).....k[6..d.H.s..g..mg..Hl8.VM...b.'......a...X....".Fk\v...<WQw.21X.0..."#.. ...>Mn\..5.

Chrome Cache Entry: 599

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	16752
Entropy (8bit):	5.516735299744987
Encrypted:	false
SSDEEP:	192:44SOgPlmR/LauPtJqPn70BPQuj4yrZ42/0VGlAUxBliALiQfbButKl/OtTl/XL5:8PlmR/2uPtn/9F+q+Rd
MD5:	1DFCF2DB956EABA93B3B7EAF8E59B257
SHA1:	365BA0BDF1E7639242B1E1A636A75EFAB65F66B0
SHA-256:	140322075DB158C0EE5E3D7154849346FEABC75A0803BCBFED7F13063846D87B
SHA-512:	64B7A6A7FD86B98EA91C1ED09048217E9D0E74E51548D7EA0355770398510C730C1500B9D9DC7002FBDFD5F0F40C729CBB7050B4CAA895CACFB950F766E04D46
Malicious:	false
Reputation:	low
Preview:	{"header":{"products":{"selected":"flights","list":["accommodation","flights","packages","cars","attractions","airport_taxis"],"all":{"flights":{"href":"https://booking.com/pxgo?lang=en&url=https%3A%2F%2Fbooking.kayak.com%2Fin%3Fp%3Dsearchbox_link%26sid%3D5171fc655664ddf74ab763a094523fb7%26mc%3DUSD%26a%3Dbdc%252Fsearchbox%26bdclc%3Den-us&aid=304142&token=UmFuZG9tSVYkc2RlIyh9Yek6N0IyIDlt1D_n8GoSlCI0inwabKpuuJm4NUpeTtatqIkRkmEdpNOuaZ6ecHgAuquh83W8j3cEZYIPXk3tDeskWH6muEJOHJ03gD0kGNiEPeFPbz7TP_fuzgPCY_r-aa8hGj3_8rRxkOkR63WEhdtyy_gq3Y5_NbxTVOjDHVSOotHTtLWaDqnavu9ELosh8hTIVkhYLbco_8NcRuUNxhvCinPDpcwmKETdcflz-xrBG2Xys0YBuDxErAmVXMOrQvMg-OppAnWBRr0u5ZFoIqkdxjhKOe2GJGliS8bOUQq3H7N-U6VxeGk","id":"flights","label":"Flights","icon_key":"airplane"},"accommodation":{"icon_key":"building_house","label":"Stays","href":"https://www.booking.com/index.html?aid=304142;lang=en-us&","id":"accommodation"},"airport_taxis":{"label":"Airport Taxis","icon_key":"taxi","href":"https://www.booking.com/taxi/index.ht

Chrome Cache Entry: 600

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (5657)
Category:	downloaded
Size (bytes):	6162
Entropy (8bit):	5.599076700545423
Encrypted:	false
SSDEEP:	192:Sb04pPhtmpvftu/PvJ/CMMKJ8UotoqzpfLEj:s0i5fPJ6FEPkIj
MD5:	6AAAF8E11A32FD37FB419E3A4CE9696C
SHA1:	1FD88F2EE4DE5422E0C344DEBEFE3F2B5ABB2592
SHA-256:	468959E93F9B4E6F07C6A8F8D0E93D8FCB37D76A8615A93EC153F5842247BA99
SHA-512:	748B27BDB7C7FA082D7BE6C69F56DC33302105784391320A5CF960531C594097BC406FD3F4690E4CF74F4016F4D56804A4296E9BD885562EB66699E1318F7000
Malicious:	false
Reputation:	low
URL:	https://0f492a439f0f79bcbc4fe15f41ea6011.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Preview:	<!DOCTYPE html>.<html>. <head>. <meta charset="UTF-8">. <title>SafeFrame Container</title>. <script>.(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var f=this\|\|self,h=function(a){return a};var n=function(a,b){this.h=a===l&&b\|\|"";this.g=m},p=function(a){return a instanceof n&&a.constructor===n&&a.g===m?a.h:"type_error:Const"},m={},l={};var r=void 0;/.. SPDX-License-Identifier: Apache-2.0./.var t,aa=function(){if(void 0===t){var a=null,b=f.trustedTypes;if(b&&b.createPolicy){try{a=b.createPolicy("goog#html",{createHTML:h,createScript:h,createScriptURL:h})}catch(c){f.console&&f.console.error(c.message)}t=a}else t=a}return t};var ca=function(a){this.g=ba===ba?a:""};ca.prototype.toString=function(){return this.g+""};var ba={},da=function(a){var b=aa();a=b?b.createScriptURL(a):a;return new ca(a)};var ea={},u=function(a,b){this.g=b===ea?a:""};u.prototype.toString=function(){return this.g.toString()};var ha=function(){var a=v,b={messa

Chrome Cache Entry: 601

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=COTEnqOxnIQDFZE5RAgd3v0I0A;src=4228414;type=views;cat=views;ord=4995395844978;npa=0;auiddc=*;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=2105455417;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 602

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (2020)
Category:	downloaded
Size (bytes):	12817
Entropy (8bit):	5.34459161517544
Encrypted:	false
SSDEEP:	192:Gq6KPV24ZKs86O/DfVcOfFmI46coWCTGdhFKdbsWkzY:GkxI603wI46xWSGdhUr
MD5:	1D3D22DF067F5219073F9C0FABB74FDD
SHA1:	D5C226022639323D93946DF3571404116041E588
SHA-256:	55A119C0394F901A8A297E109C17B5E5402689708B999AB10691C16179F32A4A
SHA-512:	0B6B13B576E8CC05BD85B275631879875A5DBCB70FD78E6C93B259317ED6FD5D886F37D0CC6E099C3D3A8B66FEA2A4C2C631EB5548C1AB2CD7CB5FA4D41EA769
Malicious:	false
Reputation:	low
URL:	https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Preview:	<!DOCTYPE html>.<meta charset=utf-8><script>.(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.'use strict';function m(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var p="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,d){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=d.value;return a};.function aa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");}var r=aa(this),u="function"===typeof Symbol&&"symbol"===typeof Symbol("x"),v={},w={};function x(a,b){var d=w[b];if(null==d)return a[b];d=a[d];return void 0!==d?d:a[b]}.function y(a,b,d){if(b)a:{var e=a.split(".");a=1===e.length;var g=e[0],k;!a&&g in v?k=v:k=r;for(g=0;g<e.length-1;g++){var c=e[g];if(!(c in k))break a;k=k[c]}e=e[

Chrome Cache Entry: 603

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	downloaded
Size (bytes):	7768
Entropy (8bit):	7.936924535498852
Encrypted:	false
SSDEEP:	192:mIk5lAeKSkAguumq8HNw7MU7Kfl3baL1S5S9CkVtpR66/U6x:nelAmknHWcsl301SIgkVtpk6/Tx
MD5:	8916C59C9466E18D23DC7200B4EDD4DD
SHA1:	C1879666FC2DA5D23D349597132486CF1FD835F9
SHA-256:	5CA18D4B41E1FD2A9B990FC774A7177B30FAA68CA5A81CD8E2C0FD9ADE116085
SHA-512:	D332FCD01654C75CE1BF7237B62B80FDA8A2B4CBDA5EE2F75142835D8F0E21A6894B518BE071787BD26FE5602E7AC2A883A622B62A969D5008CE0463C6C08C90
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/city/170x136/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....v.q..G..r.(#p?.=8.z.v...v.B..<2.h,:......i......PC.#....Qi....Wg.......;%.+.>+S4.n.Wi.n.>..H.4...2.S.,v[..H.".g##...+..>.mo....%.2mt.8...`.-..-....a(..#c...)"..kH.g.9..a..x.z..n.].TF\|.V_......%.....c......q...wi... x.(.;..].'.N.'......h..R;m,.9A.7$c...q.jv`>...F@#=.kOH..J..1..F+...{.+..X.wFS..:/.A.....0."..h.0W8.}......lc..o..... .G..@.g.#5...7qnvH...

Chrome Cache Entry: 604

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	dropped
Size (bytes):	8350
Entropy (8bit):	7.9431995395937385
Encrypted:	false
SSDEEP:	192:mIoyumNqtrhRbdqcm5XtTGb9TohlBUUPRpv9+HSJh6:noybNcrhRbJWXtTGbWPBUUZp846
MD5:	DEECEBFD96AFF60E10FD5E8D298F2E6A
SHA1:	45029E4B67085DA726802561C0B595862620D62E
SHA-256:	2F448C79E56FDF2F2C5C1D9C7FCA9DAD527EEDE734BFB329ED1303D54D365A70
SHA-512:	76B3ABA23CA9623D3D52C24ACEEB99C3EC7C06BB7136A6C109CAB6758CDCCDDD2CBFA4EA8FF829376FA9966C9EB8EA03D82B1FA62EC9839C53E3DA10268068A8
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...i.kXl...Q.B.?........B.fxc'i.7a.J..y.{..K.......`.V .....j.......#x. ..=.....k.\.Y.r..6V......D..A.<...y..x.LM?Sx.:..s)S =.?w.s....Y-.+....>.8..C..Y.=....7FG .a.......q..W).$.......v1..t.}.v.%...]..\...c....Q.5..sqr.uX....k....:.=.4... ...I....V..3.....I....+/.?..J...).A.@......X..g1....3.Z6...8==G9...:....3.4I.,.s.......qNo.....$....*...A.sZ5N.M.W..

Chrome Cache Entry: 605

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (15235)
Category:	downloaded
Size (bytes):	15351
Entropy (8bit):	5.231577180854725
Encrypted:	false
SSDEEP:	192:kBMkOgdhLs024LHFifVHpvAJMg/fDUG3vtctzenzZ56ix9oQPxOhQvaHtTpBQdpb:kBF89oX3zSpedpek
MD5:	0EC216456DFBF94C83CC1323ACB4CB9D
SHA1:	EB7A8F2D49AEC5FACC7D7BABC0583FE79E494B02
SHA-256:	7A51D99C19A30FAF1DC52F60C43CEDD9BEE369B94C92026A69D2581DF76B476D
SHA-512:	AF2CBF54BDE139857D60FC4D668F4CA8DEDF0A4C1FD9EA5C8A2537D466074294F9BBFDC6DADC9FF837284C94B8093796BBEFC27AA14763E0539B8D1C33923C24
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/8207c303.9807c216.chunk.css
Preview:	.c9a7790c31{background-color:var(--bui_color_accent_background);border-radius:var(--bui_border_radius_200);box-shadow:var(--bui_shadow_100);display:flex;padding:var(--bui_spacing_1x);margin:var(--bui_spacing_6x) 0 var(--bui_spacing_4x)}.e22b782521{box-sizing:border-box;border-radius:var(--bui_border_radius_100);background-color:var(--bui_color_white);display:flex;flex:0 0 auto;margin-left:var(--bui_spacing_1x)}.e22b782521:first-child{flex:1 1 auto;margin-left:0}.e22b782521:not(:last-child):hover{box-shadow:0 0 0 1px var(--bui_color_callout_border)}.e22b782521>div{align-self:center;box-sizing:border-box;padding:var(--bui_spacing_2x);width:100%}.d12ff5f5bf{background-color:var(--bui_color_accent_background)}.c9a7790c31.f200fcc81a{flex-direction:column}.f200fcc81a .e22b782521{margin-left:0;margin-top:var(--bui_spacing_1x);min-height:50px}.f200fcc81a .e22b782521:first-child{margin-left:0;margin-top:0}.c9a7790c31.e79e8c68d5{padding:2px;margin:0;box-shadow:none}.e79e8c68d5 .e22b782521:not(:f

Chrome Cache Entry: 606

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 210x210, components 3
Category:	downloaded
Size (bytes):	6218
Entropy (8bit):	7.9027141362049385
Encrypted:	false
SSDEEP:	192:myyYFwtlqelmUcDeDkCwzfsCBfpSifBccoZb:dzwTLajfsCtTBccU
MD5:	11EE9FA32F1BAE7C2407F7E5EAF19E15
SHA1:	F3FF1079ECD437595BF4E0F48B5C275F3C9D33FC
SHA-256:	E8D71E66D554ECE2B8AEF3B38A507D1E14BF4064986DB4456D341CB1917B4529
SHA-512:	09EF6C15B99B181BB353F73143E0B9A8366A834637AC19EB3608455FA4AD325C83B2FEA6C94471748BF591E6F0DDF3586FE00ACCB9EC974423CFE560A50B5C55
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/city/square210/977345.jpg?k=898a2e6c68a765bdc18cc57be5c78b3e1f5b825c4d3167e7a0860c4c988a1af1&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......+..Ju...qF)...&)1N.. ..v)1@........b..P.b.Z(.(.....R.@.K.Z(..b...J1KE.p....qqE:.....R..&)1N.&(.(.-.....1@.6.u...6.\R..1K.(..E;.b.....Q@.%......Z(.)h...%.b..~(.RS$LQ.\Q@....RP.b.R.HcqF)......P.Q.Z(.1IN....b...LQK.1@..1K.1@..)...K.\Q@.E-...)qE2..N.&(..b..P.h.-...R.@..S.I..J)qF).....P.b.v(..7.b..1L........)h.....P.QN....Q.v(.2n6.S.I..n(.b...&)).b...QKF(..I.v(..%&)

Chrome Cache Entry: 607

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	320202
Entropy (8bit):	5.103225474344179
Encrypted:	false
SSDEEP:	1536:clrUT1OMPTl7a+Cn9YsFhkVQAkxbIodGIgf3pIFCQi32LJ3RmBmcz1CPBiY96bM9:clrUT1OMPTlmzna5DobIod+DbM9
MD5:	CBB6FD23BAA5369C6E3C1C1E1F946D85
SHA1:	6C3F3E95BA111D45F053B31D8324DD4BD9149223
SHA-256:	445D325CE20B1CD0484E2A314582AC2D9139041A2A6B4ABD0645A04215BB2BF8
SHA-512:	964CB90DFC4AF41632A0BC6EA57B096873925BE9D8AA9A639120F2A1E8630D98FCF372042370013C41DF5E4969B2EEDA2074A60109EEB0CA1A21DB4283D08938
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/flights/web/static/css/client.223e5f6f.css
Preview:	.Icon-module__root___tiYlo{display:inline-block;fill:currentcolor}.Icon-module__root___tiYlo svg{display:inline-block;vertical-align:top;height:100%;width:auto}[dir=rtl] .Icon-module__root___tiYlo svg[data-rtl-flip]{transform:scaleX(-1)}.Icon-module__root--display-block___7GCLK{display:block}.Icon-module__root--size-smallest___CKLlZ{height:var(--bui_spacing_3x)}.Icon-module__root--size-smaller___vpM7s{height:calc(var(--bui_spacing_3x) + var(--bui_spacing_half))}.Icon-module__root--size-small___UwcQH{height:var(--bui_spacing_4x)}.Icon-module__root--size-medium___CKnw6{height:calc(var(--bui_spacing_1x)5)}.Icon-module__root--size-large___6DYLv{height:var(--bui_spacing_6x)}.Icon-module__root--size-larger___qEXCB{height:calc(var(--bui_spacing_1x)7)}.Icon-module__root--size-largest___B49pI{height:calc(var(--bui_spacing_1x)*9)}@media (min-width:576px){.Icon-module__root--size-smallest--m___FxExv{height:var(--bui_spacing_3x)}.Icon-module__root--size-smaller--m___9JXs-{height:calc(var(--bui_s

Chrome Cache Entry: 608

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (59812)
Category:	downloaded
Size (bytes):	59904
Entropy (8bit):	5.54417047347664
Encrypted:	false
SSDEEP:	768:hOu/FTy3BJBgCxCIn61/usu8aSAvh7pzJaR/kX+sYfxEdU:D/dybQfu865O/kusy
MD5:	983BD6C8ED27A19CD0D72E94BE13C827
SHA1:	E09A2902D2175732EBFEB1759998217A040FDBBB
SHA-256:	F4C0AD1FB3E5A4C3D624EADD0AB6AE845894847F94FCEC8E31D64E3EAD4E4F1D
SHA-512:	8904539E6C419560E9AD6DFD250EBC67FA44E982D14FA1A82C6727064CEBCAEB842C3F2A98D79A1FD67FF1FD3CD4F5F45CD7CF89140717519FF29D608C92692F
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/accountsportal/assets/431_7f56befa4bbedcba65c8.js
Preview:	/! For license information please see 431_7f56befa4bbedcba65c8.js.LICENSE.txt /.(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[431],{70039:function(t,e,n){"use strict";n.d(e,{ZX:function(){return o}}),n(32600),n(20138),n(47493),n(96907),n(31883),n(12608),n(26234),n(28860),n(54824),n(73163),n(39720),n(95369),n(35789),n(56433),n(87298);var r=n(67294);n(94246),n(57400),n(69959),n(93390),n(70979),n(30276),n(80742),n(39883),n(53390),n(68362),n(65542),n(63682),n(68423),n(30618),n(92177),n(72665),n(9383),n(55567),n(94048),n(95884),n(16897),n(33283),n(16947),n(88557),n(99817),n(8659),n(78692),n(97921),n(32266),n(5078),n(30264),n(99971),n(94492),n(95163),n(79091),n(65096),n(72154),n(50452),n(26676),n(15758),n(85801),n(84091),n(10087),n(91905),n(49998),n(46161),n(60790),n(47954),n(75169),n(88213),n(23098),n(22242),n(51130),n(8129),n(25439),n(14637),n(14727),n(72070);var o=function(){return r.createElement("svg",{xm

Chrome Cache Entry: 609

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1324), with no line terminators
Category:	downloaded
Size (bytes):	1324
Entropy (8bit):	5.829302579712547
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAwwWulNE6D6+KVCLTLv138EgFB5vtTGJTlWt1Q1XPsLqo40RWUnG:VKEcPw/VKonR3evtTA8k1XkLrwUnG
MD5:	E705BAD2BADE9B1CF920439BB926DDC4
SHA1:	86E2894FFECC374C44A613E2257DB7AB3E20DEF8
SHA-256:	2A2457D3D7E079B0E3FC74EAA6D209AB766718019FAA9103A7D31070449D362E
SHA-512:	6E2C578365B2647C5AC2E140B45CA4F1468DF0A793CC7A97E16843F99E04FBAA9027EC1CB6466C01CA00CFC0025469AFA89F3E93A437645C2882C3D0994CA7AC
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api.js?render=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&onload=onLoadRecaptchaV3Callback&_=1707417334976
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD');(cfg['onload']=cfg['onload']\|\|[]).push('onLoadRecaptchaV3Callback');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true;var m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='Az520Inasey3TAyqLyojQa8MnmCALSEU29yQFW8dePZ7xQTvSt73pHazLFTK5f7SyLUJSo2uKLesEtEa9aUYcgMAAACPeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/reca

Chrome Cache Entry: 610

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2513), with no line terminators
Category:	downloaded
Size (bytes):	2513
Entropy (8bit):	5.940898637506872
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08ybm3HHI8jz+Oawn6:wsbSUtJfxrqLWWWdV6j1GbkHb+Tw6
MD5:	D207A38F5DC7FB38013B18BEEEA68DC2
SHA1:	AE4F903551E38D0DFA34AFE1CE78A4BB7321E563
SHA-256:	4AF6714D648D8DCFFC95302CF4A4C8155F77533E935EF612C414114BDFEE8E28
SHA-512:	8ED690014103E88D45235C9887771FF4863BCB233D4F1B5D2837DF238B68E3EE40FC5E907A04A5CC5B3091D5BF5B730BBE9134F854E59079D6444BD11DD8CD70
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1070314322/?random=1707417394312&cv=11&fst=1707417394312&bg=ffffff&guid=ON&async=1&gtm=45be4250v882970024za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Fflights%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3D5171fc655664ddf74ab763a094523fb7%26from%3Dbooking%26&hn=www.googleadservices.com&frm=0&tiba=Find%20cheap%20flights%20%26%20plane%20tickets%20%7C%20Booking.com&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 611

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1197
Entropy (8bit):	5.250746419165476
Encrypted:	false
SSDEEP:	24:2dYwahJhWDCLf3fbeVZmFy6yCXCWX9JVLNpwtbMIhU7C06Fa5QcPm:cyJhbf3fbOKy6yCdtJWWFL6FSQ/
MD5:	E8209D74AD093F151954A3820C12E5D8
SHA1:	12FBF39039F0182026ABAF8B0A22E75C9BB316F7
SHA-256:	C80B9838465A2C5AA19E06C25631CD22D81DD8C76563875EBFB4D35304DFBA47
SHA-512:	4DC04BF54E06A26D78C6D71EAA392059B21EA8A01BF6C6B1EB808F9A01758C18DB18A28A9D74A841B3D5F2249787890944EC94EE0A6D4B2F99042138534800F2
Malicious:	false
Reputation:	low
URL:	https://xx.bstatic.com/static/img/favicon.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>. Lovingly exported by Jess Stubenbord for Booking.com in Amsterdam 16-03-2023 -->.<svg version="1.1" id="bdot-favicon" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 192 192" style="enable-background:new 0 0 192 192;" xml:space="preserve">.<style type="text/css">...squircle{fill:#003B95;}...bdot{fill:#FFFFFF;}.</style>.<path class="squircle" d="M37.8,0h116.5C175.1,0,192,16.9,192,37.8v116.5c0,20.9-16.9,37.8-37.8,37.8H37.8C16.9,192,0,175.1,0,154.2V37.8..C0,16.9,16.9,0,37.8,0z"/>.<g id="bdot-group">..<path class="bdot" d="M144.2,143.8c6.7,0,12.1-5.5,12.1-12.2c0-6.7-5.4-12.2-12.1-12.2c-6.7,0-12.1,5.4-12.1,12.2...C132.1,138.3,137.6,143.8,144.2,143.8z"/>..<path class="bdot" d="M106.7,91.9l-3.1-1.7l2.7-2.3c3.2-2.7,8.4-8.8,8.4-19.3c0-16.1-12.5-26.5-31.8-26.5H60.9h-2.5...c-5.7,0.2-10.3,4.9-10.4,10.6V144h35.4c21.5,0,35.4-11.7,35.4-29.8C118.7,104.4,114.2,96.1,106.7,91.9z M67.6,66c0-4.7,2-7,6.4

Chrome Cache Entry: 612

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.314128390879881
Encrypted:	false
SSDEEP:	3:2erWeKBRk35KLWAzRERxzfRX/H4Y3:29M3tRdfZN
MD5:	83A02FE42F8C2198E7C608AFF363AA49
SHA1:	7B20AE1014450492CC708E3C9DC7522B05C2EFFD
SHA-256:	E64954DC34E12C7190CC2338A54B07644FF0F102AA71CC7209BCBB49C3009F7C
SHA-512:	CD381A8C725C892E9A68D713254A31EA9ED25A39B212A5DC52D4BA2655F38AFDDB32519F03360F32A59D8E7701AF6C2AD0030A6AA760C3DE87C75063F5B65F54
Malicious:	false
Reputation:	low
Preview:	event: message.data: {"response":{"status_code":200,"body":""}}..

Chrome Cache Entry: 613

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 210x210, components 3
Category:	dropped
Size (bytes):	6218
Entropy (8bit):	7.9027141362049385
Encrypted:	false
SSDEEP:	192:myyYFwtlqelmUcDeDkCwzfsCBfpSifBccoZb:dzwTLajfsCtTBccU
MD5:	11EE9FA32F1BAE7C2407F7E5EAF19E15
SHA1:	F3FF1079ECD437595BF4E0F48B5C275F3C9D33FC
SHA-256:	E8D71E66D554ECE2B8AEF3B38A507D1E14BF4064986DB4456D341CB1917B4529
SHA-512:	09EF6C15B99B181BB353F73143E0B9A8366A834637AC19EB3608455FA4AD325C83B2FEA6C94471748BF591E6F0DDF3586FE00ACCB9EC974423CFE560A50B5C55
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......+..Ju...qF)...&)1N.. ..v)1@........b..P.b.Z(.(.....R.@.K.Z(..b...J1KE.p....qqE:.....R..&)1N.&(.(.-.....1@.6.u...6.\R..1K.(..E;.b.....Q@.%......Z(.)h...%.b..~(.RS$LQ.\Q@....RP.b.R.HcqF)......P.Q.Z(.1IN....b...LQK.1@..1K.1@..)...K.\Q@.E-...)qE2..N.&(..b..P.h.-...R.@..S.I..J)qF).....P.b.v(..7.b..1L........)h.....P.QN....Q.v(.2n6.S.I..n(.b...&)).b...QKF(..I.v(..%&)

Chrome Cache Entry: 614

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	17122
Entropy (8bit):	7.988976471211867
Encrypted:	false
SSDEEP:	384:KwMEo4GnzvEemwJRhsMXnlB77SjGsHLXNCNLnIaIyg92wc1lXj1:KVJ9nDEVw5NXlBnSjGsoNO8wcrX5
MD5:	1ED508BA4ED9857069297C4C0324A6C5
SHA1:	41E7212ACAB83BB63BC29AE6FBF2EC65EA2CA3A1
SHA-256:	58EBB0860DDA76E5A80CA450319AA4724C8E951BA6E23E67FEC4825F4B14B96D
SHA-512:	C04AB6702BD1A79AB4FCA1011F10EE2BA6BFD4FB8E85CE0236D21A4B9784E8DB1B32B1877E4D6AE132F32DA40F11EE6525E4E5943495EA1413D31EAC65570478
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/square250/976919.webp?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o=
Preview:	RIFF.B..WEBPVP8 .B..0........>m.E.#...V.`..g.A..lg..3...N.>..[...}@nD.]rZ..._.^k.....?........_..\|.....a.[.'....'...K...?...?.....iF......G.....'......z....G........[.y.k....._........3.........?.~......o.w...?....y......IsCz..y...C..aS..$..Bu..?Q.3ee...+...........A..?..\a.w......v.to..:`.u......N.f.gd.m.zxN#..:/+..>w$.^>..i....9JeC...y....\|.......6zr..........B2.....'....UaAB.k'.(.\2^...j .Q\;....k...'b.K.i......$..'..b.......7X/.. .....\|Ygw....m/../<5s.g.YL....v}.[.8.j7FZY..0.x.}E.V.".<.z...'.!..J...l.".....u....Dc.f......Xy...V.Gs.ms..6X.....r.A!;.IU .P.o......q.4..6.4.:zqD.........\....8w...>.d.].q.v..m...6....<hJ3.......)k^7.(6.9_.\|s........g....\|-?tH.hh#..H>n2{..@...`...t...6..C...,SA............ .e...S./..i..u?I"..U."...Z0...o7J.W..&....:\|.....I... B.Q^.....a....H..G.2\...Z.b..?.Al..=..;...!C..:...F.K.....&..........D;...I.B..7.z.... .=...g'..U..D...m?.'Q.#T.v..[`.H.9n.$.kxF.K.A...uA....w......7u.W.......6.g..m...m7....+.

Chrome Cache Entry: 615

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6155), with no line terminators
Category:	downloaded
Size (bytes):	6155
Entropy (8bit):	5.322612950769379
Encrypted:	false
SSDEEP:	192:SeYjpkZzXkZMHISiYCNcgVRV5hmrHQVUm:AqroSRYHROKn
MD5:	1E32438142FCD82E3C2AEA1EC4900C2E
SHA1:	70F7F4732872C739C76969D77FE36D1D53333950
SHA-256:	C3F06CF6DED52069A79551343ACA5F2269A048CEDB9FBACD3CFFF7136980659C
SHA-512:	E390AF5B482CD7263CF2D3E00B001521F6E08936F8AAC0D0BC73BA8B092D96C82954C3E68F1F091214D6EBCB47B7D425F21B84A208572AD69EF0843AE049C6CD
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/error_catcher_bec_cloudfront_sd/0acd2ada6c74d5dec978a04ea837952bdf050cd2.js
Preview:	!function(l,_,f){var s,u=[],o=!!g();function g(){var e;if(l.XMLHttpRequest)try{e=new l.XMLHttpRequest}catch(e){return!1}else for(var r=new Array("Msxml2.XMLHTTP.5.0","Msxml2.XMLHTTP.4.0","Msxml2.XMLHTTP.3.0","Msxml2.XMLHTTP","Microsoft.XMLHTTP"),t=0;t<r.length;t++)try{e=new ActiveXObject(r[t]);break}catch(e){return!1}return e}function p(e){return e}function b(e,r,t,n,o){var i;function a(){var e,r,t;try{for(e=0,r=arguments.length;e<r;e+=1)if(t=c(arguments[e]))return t}catch(e){}return s}function c(e){var r;try{r=e()}catch(e){r=s}return r}return i={function_offset:c(function(){var e=u.length;return 0<e?p(u[e-1]):s}),caller_offset:c(function(){var e=u.length;return 1<e?p(u[e-2]):s}),message:a(function(){return e},function(){return o.message}),file:a(function(){return"string"==typeof e.srcElement.src?e.srcElement.src:s},function(){return r},function(){return l.document.location.href.split("?")[0]}),line:t,column:n,stack:c(function(){return o.stack}),bot:c(function(){return booking_extra.b0

Chrome Cache Entry: 616

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	downloaded
Size (bytes):	436675
Entropy (8bit):	5.3491438797198265
Encrypted:	false
SSDEEP:	6144:xQDr0bx2FTb4MT/XinkklO4E7q1uHBJUZ+jZQn54Nis:+sbx2FT8TE7qZZ+EWd
MD5:	5BC85A47C6673F1BEF3373BBED699DFE
SHA1:	2329667D5ED8323054AB72A5C2F9923002611AA1
SHA-256:	838F4B697DEEFB701F31EB892E6DDE74A92DD7C65D4D56F967BB79C17A66D79E
SHA-512:	4E187E5EB97D93D9877600B01A2FB59D77D5141D5DF986F074642A40E7708ABC602FCF17B343B5D0C8B07172F2ED955DAEE5BB196D32FE45D9D72B73CADDFEC7
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/scripttemplates/202310.2.0/otBannerSdk.js
Preview:	/** . * onetrust-banner-sdk. * v202310.2.0. * by OneTrust LLC. * Copyright 2023 . */.!function(){"use strict";var D=function(e,t){return(D=Object.setPrototypeOf\|\|({__proto__:[]}instanceof Array?function(e,t){e.__proto__=t}:function(e,t){for(var o in t)Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=t[o])}))(e,t)};function N(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");function o(){this.constructor=e}D(e,t),e.prototype=null===t?Object.create(t):(o.prototype=t.prototype,new o)}var H,F=function(){return(F=Object.assign\|\|function(e){for(var t,o=1,n=arguments.length;o<n;o++)for(var r in t=arguments[o])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e}).apply(this,arguments)};function R(e,s,a,l){return new(a=a\|\|Promise)(function(o,t){function n(e){try{i(l.next(e))}catch(e){t(e)}}function r(e){try{i(l.throw(e))}catch(e){t(e)}}function i(e){var t;e.done?o(e.value):((t=e.value)instanceof a?t:new a(fun

Chrome Cache Entry: 617

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (5657)
Category:	downloaded
Size (bytes):	6162
Entropy (8bit):	5.599076700545423
Encrypted:	false
SSDEEP:	192:Sb04pPhtmpvftu/PvJ/CMMKJ8UotoqzpfLEj:s0i5fPJ6FEPkIj
MD5:	6AAAF8E11A32FD37FB419E3A4CE9696C
SHA1:	1FD88F2EE4DE5422E0C344DEBEFE3F2B5ABB2592
SHA-256:	468959E93F9B4E6F07C6A8F8D0E93D8FCB37D76A8615A93EC153F5842247BA99
SHA-512:	748B27BDB7C7FA082D7BE6C69F56DC33302105784391320A5CF960531C594097BC406FD3F4690E4CF74F4016F4D56804A4296E9BD885562EB66699E1318F7000
Malicious:	false
Reputation:	low
URL:	https://8ef290e4a40aabf645d441eeb66eb6e1.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Preview:	<!DOCTYPE html>.<html>. <head>. <meta charset="UTF-8">. <title>SafeFrame Container</title>. <script>.(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var f=this\|\|self,h=function(a){return a};var n=function(a,b){this.h=a===l&&b\|\|"";this.g=m},p=function(a){return a instanceof n&&a.constructor===n&&a.g===m?a.h:"type_error:Const"},m={},l={};var r=void 0;/.. SPDX-License-Identifier: Apache-2.0./.var t,aa=function(){if(void 0===t){var a=null,b=f.trustedTypes;if(b&&b.createPolicy){try{a=b.createPolicy("goog#html",{createHTML:h,createScript:h,createScriptURL:h})}catch(c){f.console&&f.console.error(c.message)}t=a}else t=a}return t};var ca=function(a){this.g=ba===ba?a:""};ca.prototype.toString=function(){return this.g+""};var ba={},da=function(a){var b=aa();a=b?b.createScriptURL(a):a;return new ca(a)};var ea={},u=function(a,b){this.g=b===ea?a:""};u.prototype.toString=function(){return this.g.toString()};var ha=function(){var a=v,b={messa

Chrome Cache Entry: 618

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (54614)
Category:	downloaded
Size (bytes):	194527
Entropy (8bit):	5.167151152412945
Encrypted:	false
SSDEEP:	1536:O2LLHRmQlavvawlUGvBMYQQBiUGs/XfdfpR2Q:XlavvawlUGvBMY7iUGs/Bpf
MD5:	C9009DC966B4C139FFFFE886598AC0C0
SHA1:	12F197F947CF43340804CDE05AC1BD1BBFE5EA35
SHA-256:	5E5EAF9396E8ECD984A3D8F622C5A6EF767AE75AA2BF907305F6BAA56C2A7088
SHA-512:	533395A06300780810CE25B2F3B950D28A1699F8556323477AFAA5E2D246E9C6D598C9305F13C230BD7EC483CAF53A5255CCA35552BEF2CEFFDC0F73FF660800
Malicious:	false
Reputation:	low
URL:	https://q-cf.bstatic.com/psb/capla/static/css/client.38ffee15.css
Preview:	:root,[data-bui-theme=traveller-light]{--bui_color_border:#868686;--bui_color_border_alt:#e7e7e7;--bui_color_action_border:#006ce4;--bui_color_border_disabled:#d9d9d9;--bui_color_destructive_border:#d4111e;--bui_color_constructive_border:#008234;--bui_color_foreground:#1a1a1a;--bui_color_foreground_alt:#595959;--bui_color_foreground_inverted:#f5f5f5;--bui_color_accent_foreground:#946800;--bui_color_action_foreground:#006ce4;--bui_color_callout_foreground:#923e01;--bui_color_foreground_disabled:#a2a2a2;--bui_color_destructive_foreground:#d4111e;--bui_color_constructive_foreground:#008234;--bui_color_foreground_disabled_alt:#d9d9d9;--bui_color_brand_primary_foreground:#003b95;--bui_color_action_foreground_inverted:#57a6f4;--bui_color_action_focus:rgba(0,108,228,.24);--bui_color_highlighted_alt:rgba(26,26,26,.06);--bui_color_action_highlighted_alt:rgba(0,108,228,.06);--bui_color_destructive_highlighted_alt:rgba(212,17,30,.06);--bui_color_highlighted:#cecece;--bui_color_destructive_focus:r

Chrome Cache Entry: 619

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	68
Entropy (8bit):	4.200601260429725
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM09/Woz59tVp:6v/lhPfZM09tzjTp
MD5:	C4A2B870062C2BB98C500BC1526C0498
SHA1:	528666CCDB12997358077BC8FCDBFB6B825C7788
SHA-256:	2AA4FA20701CDD6D8D56046069001186B5267E3EE7D0EF618AD2F4A683723E11
SHA-512:	2F1A3ABCD12125F7EF18D61A960901C0FD6F82DD02EA2B8041859E6D5F0A7F08DB17CC110DC6D8A3F7D0D1BA790C4BCCA2506D3C60EDFEB5CB29433E9F4F762E
Malicious:	false
Reputation:	low
URL:	https://tr.snapchat.com/p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e&u_sclid=75022d4d-ae50-4a02-8ab1-d3d7e0695f9e&u_scsid=02478874-a277-465c-b9e7-ce2412232e4f&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&df=true&huah=true&m_dcl=4149&m_fcps=3889&m_pi=4089&m_pl=6944&m_pv=2&m_rd=7451&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&trackId=c904cd67-c0d8-4a0e-97fd-cc369431aa6a&ts=1707417370842&v=3.9.1-2402072137
Preview:	.PNG........IHDR....................IDATx.c`...............IEND.B`.

Chrome Cache Entry: 620

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1082)
Category:	downloaded
Size (bytes):	1198
Entropy (8bit):	5.1778284266462595
Encrypted:	false
SSDEEP:	24:oWV/lweFZ3UYVN/QZSKGkMF6l4Q5fELnhtE1lvJHmqa:oatweFNUY//Qegl9FELnhtEfBHDa
MD5:	F820477C322829E348F318A453E432A5
SHA1:	0A19F5B0104161288CAACDC1F5CB65820BD49CE6
SHA-256:	F18F3B120659261F6C59D02ED462452AA29CB24ECCC1D0F894FF3342FFDDFB38
SHA-512:	016F2E1711174239943BE712E5FB304AECC4FF0570023EBCDC4C0EBA90D758CBCFE4A8DCD87407A126C778977B3BB91FD7B347D4606F66E70D1F430BCABB89DE
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/53a8d0d3.b1818b84.chunk.css
Preview:	.a87be8268b{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch}.a87be8268b:link{color:var(--bui_color_foreground_alt);font-weight:500}.b0bcffb5dc{border-radius:var(--bui_border_radius_200)}.c3a4d3369f{margin-top:var(--bui_spacing_2x);margin-bottom:0!important}.c3a4d3369f div{margin-bottom:var(--bui_spacing_half)}.fbbd4482e9{position:absolute;top:var(--bui_spacing_3x);left:var(--bui_spacing_3x);margin-right:var(--bui_spacing_3x)}.dd8e2ae84f{color:var(--bui_color_black)}.d1c3bff2b4{width:100%;height:100%}.ae2824c1f5{border:1px solid var(--bui_color_action_foreground);color:var(--bui_color_action_foreground);text-align:center}.dcc1c777cd{width:-moz-min-content;width:min-content}.a9e2165731{display:-webkit-box;-webkit-line-clamp:3;-webkit-box-orient:vertical;overflow:hidden}.ed233f6bad{margin-bottom:var(--bui_spacing_8x)}.bca4b041e6{margin-bottom:var(--bui_spacing_4x);padding:var(--bui_spacing_4x);background-color:var(--bui_color_white)}.bca4

Chrome Cache Entry: 621

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	82
Entropy (8bit):	4.314111230350042
Encrypted:	false
SSDEEP:	3:YXULWAcYGOotCXAUQ9QRNAR54:Y9tUAUAQvARm
MD5:	256BEEAD963B0DFD7F463125ECB1B340
SHA1:	C12EC60B1F2C75B407BA84AC3193CD35DD83554C
SHA-256:	87D6B41EF4146DBCC286DE794DBF221D321726F775B333FA175D603CD24ACD0E
SHA-512:	0B4393CA899FFB4304D7C894B89FAE4BBE1AB0204792CAC9EC025A3C2A4FACAD0BA388E3CA7B8D76C1DB61EA4369642AB83B8EA71C5BDE8FF7ECBB8942A6ED7A
Malicious:	false
Reputation:	low
Preview:	{"response":"ET tracking endpoint: 'requests' array is required in request body."}

Chrome Cache Entry: 622

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	dropped
Size (bytes):	7768
Entropy (8bit):	7.936924535498852
Encrypted:	false
SSDEEP:	192:mIk5lAeKSkAguumq8HNw7MU7Kfl3baL1S5S9CkVtpR66/U6x:nelAmknHWcsl301SIgkVtpk6/Tx
MD5:	8916C59C9466E18D23DC7200B4EDD4DD
SHA1:	C1879666FC2DA5D23D349597132486CF1FD835F9
SHA-256:	5CA18D4B41E1FD2A9B990FC774A7177B30FAA68CA5A81CD8E2C0FD9ADE116085
SHA-512:	D332FCD01654C75CE1BF7237B62B80FDA8A2B4CBDA5EE2F75142835D8F0E21A6894B518BE071787BD26FE5602E7AC2A883A622B62A969D5008CE0463C6C08C90
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....v.q..G..r.(#p?.=8.z.v...v.B..<2.h,:......i......PC.#....Qi....Wg.......;%.+.>+S4.n.Wi.n.>..H.4...2.S.,v[..H.".g##...+..>.mo....%.2mt.8...`.-..-....a(..#c...)"..kH.g.9..a..x.z..n.].TF\|.V_......%.....c......q...wi... x.(.;..].'.N.'......h..R;m,.9A.7$c...q.jv`>...F@#=.kOH..J..1..F+...{.+..X.wFS..:/.A.....0."..h.0W8.}......lc..o..... .G..@.g.#5...7qnvH...

Chrome Cache Entry: 623

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5093)
Category:	downloaded
Size (bytes):	236023
Entropy (8bit):	5.5472240756927365
Encrypted:	false
SSDEEP:	3072:Oy5XdJWUbMSMBWudlI/28vGxSY+ZxJruqzj/QIOGZXIsU4p:OUdJ3McuePL7j/QIOGxN
MD5:	5F6F39E67B4AB44A9111939F5DF688B0
SHA1:	59D8A90244F662C8B099D6EF0AABC883F518DC72
SHA-256:	1DCC83DD59F65E003A31ACD77A3F0C596041C787DCC6470143A429354F7ABFDB
SHA-512:	5CF3AA91762E4983A43A923E7C812099B1C321E5A0BBABBD055213947AB8529150C28B1671B3768BC7B243B09398AEF827CE1845D6C0A432129BADAE177F7BA8
Malicious:	false
Reputation:	low
URL:	https://www.googletagmanager.com/gtm.js?id=GTM-PQHB9P4
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"18",. . "macros":[{"function":"__e"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":true,"vtp_defaultValue":"","vtp_name":"offerCurrency"},{"function":"__v","convert_case_to":1,"convert_null_to":"0","convert_undefined_to":"0","convert_true_to":"0","convert_false_to":"0","vtp_dataLayerVersion":2,"vtp_setDefaultValue":true,"vtp_defaultValue":"0","vtp_name":"offerPrice"},{"function":"__e"},{"function":"__u","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"lang"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"userLocation"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"affiliateId"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"cookieId"},{"function"

Chrome Cache Entry: 624

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/988382855?random=1707417356533&cv=11&fst=1707417356533&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1
Preview:	<html></html>

Chrome Cache Entry: 625

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	8854
Entropy (8bit):	7.980513008618794
Encrypted:	false
SSDEEP:	192:bLY7fUfSQozoRJDQvni9RYjGMeKfi/ynlApCPcuHwDq046G:bLYpQSsTYaMeQi/ylhPvwm046G
MD5:	1DF09AD32131CE5BFADC6B1A72C0C7AA
SHA1:	E965F4FE37288C58C4CE03F3916BA018C10A4E3C
SHA-256:	EE4807FF577AD59FF427FB0314FB708D42DD694B2F55448359468306EE7DC720
SHA-512:	D0040580C900EA387E5324D4EDABB9C35042E8AB9764B67A4378B457740C0314E7EB891B4B6C7ED1273105CF828CAD3DFC579B50EA6F1A241C3E16DC04ABB7DB
Malicious:	false
Reputation:	low
Preview:	RIFF."..WEBPVP8 ."...........>m2.H&$"........em.n.!..7.i....a..k9.2..L0.pZ.o.....?.....9......Z.{........b?v...;..{}.....g.........o......X..764.fK.r..IT{....h...1Z....&5...! ......\|...?....}..s..[p.k...2;R..F.......o.V....wo...83.v_K..H'.{+\|.J.a.kI.4:.....[.G}.Ti.v..]!..0...[.?..k.^.WwK....C.J.....C~....n...{.........^.DNh...k.y.T\..L."<E.O;k=..B.{l..:h.D.h.4P.[5...)@.(0..f.-..'"F!.._j).h...~&Pq.&...?U..SJU3d.{..tO..r.......A_^.n...N~.+.....T..A.j.#Z)..k\|....<6K...=L.h..Gd3`I..s.uGc..I....y..@.v...v.........o.XI~.....]....Z".u..s.l....$.....U!...H,..7d0.........D.NQ.}..2....I Y`...Y.~ku......F.&....{u.:............'+.>.2}A.......p.!.....=...#....9t4.(...G.$._c...7u...G<y..3G}.ri.......T..;9.V..=..fM.5k......n.m...@..x.b../.L.6.............AO>.....H.@2..H......O.....WIa.D"84...{j....D\|...ZX..%.M.u.=....v.o./R+X.R...3......I.?...6.X...Ih...S..j..r...y.%..j.M0......Y.u..]&g.)..5.5..2....6..0....An...O....]..Kyb ..g....U.V..A./O=9O.I..:..7.

Chrome Cache Entry: 626

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (18557), with NEL line terminators
Category:	downloaded
Size (bytes):	32162
Entropy (8bit):	5.41501937191479
Encrypted:	false
SSDEEP:	384:6akMXuHgnJQtyBBVty6GsGXpYtwBpZaYxHhFSbdD5t8IHNYhsrPhC:xqkLsrrv45iaUsrPhC
MD5:	C87FBA85F4E94843AF93E4F6A1819B4B
SHA1:	F8C13D203AD5CDA5F2931264FEFD0430DA0413DE
SHA-256:	DDA2B05DE1686CC556AE307D414E0F94854BA22E20EBB9631EE61C454AC5CF71
SHA-512:	F6D1212BBA4AA0FCD0DAD03F0B57558476C31C21808537A2CC082BF56C975AB332D672D1CDCF9297EAA32B23EF9F98F37D99A1AD5FF9B511C85D9EA1764BBAC0
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/accountsportal/assets/326_4e98a27a96e8aa0e2044.js
Preview:	(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[326],{24963:function(t){t.exports=function(t){if("function"!=typeof t)throw TypeError(t+" is not a function!");return t}},17722:function(t,r,n){var e=n(86314)("unscopables"),o=Array.prototype;null==o[e]&&n(87728)(o,e,{}),t.exports=function(t){o[e][t]=!0}},76793:function(t,r,n){"use strict";var e=n(24496)(!0);t.exports=function(t,r,n){return r+(n?e(t,r).length:1)}},27007:function(t,r,n){var e=n(55286);t.exports=function(t){if(!e(t))throw TypeError(t+" is not an object!");return t}},79315:function(t,r,n){var e=n(22110),o=n(10875),i=n(92337);t.exports=function(t){return function(r,n,u){var c,s=e(r),a=o(s.length),f=i(u,a);if(t&&n!=n){for(;a>f;)if((c=s[f++])!=c)return!0}else for(;a>f;f++)if((t\|\|f in s)&&s[f]===n)return t\|\|f\|\|0;return!t&&-1}}},10050:function(t,r,n){var e=n(741),o=n(49797),i=n(20508),u=n(10875),c=n(16886);t.exports=function(t,r){var n=1==t,s=2==t,a=3=

Chrome Cache Entry: 627

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	529
Entropy (8bit):	4.465811539159536
Encrypted:	false
SSDEEP:	6:YNMa9YaeRbUHjG2+z/iJNIlgotT4WCjdpmBSztE3:YNNGa0+CXz/i7ytJ4Ph4
MD5:	635AF6B985FCAC547E4002D5D1D760F5
SHA1:	E2B75C64C8A6C9991C1717E018E53B09B710A8D2
SHA-256:	A21FEDC068326B5910FF45BCC7623092A533D7A8D887C006A2226067B7D33B6C
SHA-512:	93B3BFBB758D7D79015D4ECD5AFAFF453CDE7D6AEB3411FE17B9AF8CE3E689FA49E7AA0460B5A3C435E3832612BB30CB6453F09B32B02F9D4F9568DB5EF52AC0
Malicious:	false
Reputation:	low
URL:	https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4454603560076402&correlator=4367748076460572&output=ldjh&gdfp_req=1&vrg=202402010101&ptt=17&impl=fif&iu_parts=3102%2Cbcom-www%2Caccommodations%2Cindex%2Cindex-primary&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=320x50&fluid=height&ifi=1&sfv=1-0-40&click=https%3A%2F%2Fwww.booking.com%2Fbas%2Fndisplay%2Fredirect%3Fndisplay_ad_id%3Dca0b5567-d3a2-4bad-ab35-d5f88b7b4c77%26affiliate_id%3D304142%26rendered_ad_pageview_id%3D2c8482c2544201f4%26rendered_ad_sitetype%3DWWW%26rendered_ad_vertical%3Daccommodations%26rendered_ad_position%3DINDEX_PRIMARY%26rendered_ad_pagename%3Dindex%26url%3D&sc=1&cookie=ID%3D0b43cf03ff4edaa9%3AT%3D1707417344%3ART%3D1707417344%3AS%3DALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw&gpic=UID%3D00000a0c30c5c51f%3AT%3D1707417344%3ART%3D1707417344%3AS%3DALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg&abxe=1&dt=1707417357535&lmt=1707417357&adxs=-12245933&adys=-12245933&biw=1263&bih=907&scr_x=0&scr_y=124&btvi=-1&ucis=1&oid=2&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&url=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&vis=1&psz=0x0&msz=0x0&fws=132&ohw=0&ga_vid=421694156.1707417338&ga_sid=1707417358&ga_hid=213391962&ga_fc=true&td=1&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFsyLFtbIi8zMTAyL2Jjb20td3d3L2FjY29tbW9kYXRpb25zL2luZGV4L2luZGV4LXByaW1hcnkiLFtdXV1dLG51bGwsM10.&dlt=1707417349478&idt=1776&prev_scp=b-in%3Dfalse%26b-de%3Dwww%26b-la%3Den-us%26cal%3DAd&adks=2001309784&frm=20&eo_id_str=ID%3D848d5fda89230a58%3AT%3D1707417344%3ART%3D1707417344%3AS%3DAA-AfjblD-3JhdNa7xxiyNI1n_4V
Preview:	{"/3102/bcom-www/accommodations/index/index-primary":["html",0,null,null,0,50,320,1,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,null,null,null,null,null,null,"AOrYGslXqzWxZnMwa10HhsoG5C0a","CKGjnqmxnIQDFVwHTwgdVtMKcg",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1",null,null,null,null,null,null,null,null,null,null,null,"AA-V4qMGj1BcW3cn1TIosrI1t1Cz5fQng-Fs5QGng-pO0o5B7tP8PLnbhGcFBoirtR5novLKFxVlwHda0V_nA9LdwkfnPCpdKA",null,null,null,null,null,null,null,[]]}..

Chrome Cache Entry: 628

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 95 x 26, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2344
Entropy (8bit):	7.885895023441641
Encrypted:	false
SSDEEP:	48:5qdKL8E2+5H4aj+orbjgcF4cU7f/wEr7BObNyhtvqTRrfrz:h4EzN4aCSjjQf/1rdObzTJz
MD5:	D05A0AB9BF394439A1584A2B0D44DB5C
SHA1:	183C28023D3BA3358A7A5DF1DB887582AE5340ED
SHA-256:	B23272A9692C4EC3C020935917E9D096490876C976ABEC1290BD3CC9AAE13974
SHA-512:	1710604C6F6AB042DE505286DC4A6FA2217BF4126C000A510156E82BA975DEE0818E74DC612D556E76A71753B8285F759D4DB7566799FA72034A3E5EE5305482
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/img/tfl/group_logos/logo_opentable/a4b50503eda6c15773d6e61c238230eb42fb050d.png
Preview:	.PNG........IHDR..._...............sRGB.........IDATh..X.l.......`.......K.'m...$...Ti.F..T.JK.4A."QZ...m......B.....B.....,...V....w68.......L.w>....>G.Pr#...{o..\|..{3.X.d..".E.CE.......J.Z.DH19[2nAi...;.X[..y....Q.?m..i...\|.d.N....RU..8.u..y...Ps..n'JE....d.w5..p.o.]..OWt.!..I.:j;....Fg:..+-c.j.6x.....s&........:jIu.'[.:...k?#.,.B.N[I....F.0.:d..e.-...`.GVT...:..,..)./"...8%34m.)c.w............J...ej.&>///....QXX.+((H....[.l.........y.P..z....M.3)b..r.}\.Zc.t.0..N.M1~..dJ..k:o..3AA.........X...........P..O.^ZZ:.q..M..,.0j'.#~..sn....m.++]..E..-..g/.....S..+....x....w\|0.#.....I)_.V..{zT..H...T..@9..b...(Ht...u...J.2...&...8...f...I76..<.....,.iT.c...?....%.....SJ....ZK@+..b)X^&....l.8...V.0]..0..A.3...q.w...r....._.(t...h.j...+.4.K.....4.....G.]I......JJJ.8..I).`._.D"'..`.....hnn....W....9.`)_..i.l..^....W.C.>...-.....i\|.R.....<{xx.....M4....F....#..-.@..h......G.F` .......\...?.1.....l.C[....s?A..?`\......n....G!./IkI.o..

Chrome Cache Entry: 629

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	192
Entropy (8bit):	4.760973931417809
Encrypted:	false
SSDEEP:	3:YGNRuWV0JgdVAc9rrWWsA4DdzHfHYQsOrrWWpzxEC1Ww1g/dLivQKcpku1g/DXr1:YGzrpdVx1sHd71d4LU35TXepy
MD5:	1680EF5542C6337833319D8CD8754068
SHA1:	364FC071A9ADB1D27787C50FAF72A108BB9F1776
SHA-256:	20C9764BF96E3B429FD5A532D255FFC036E94C8F3CDC02A422BBD69300449C98
SHA-512:	0501297E5D28A62F17623AE72A0B92010E59ADB34C179E3C40799D60478B2C0682ACEF97A9055C7FD3B308CBBCD334183B927E869C740B8F08F7A743F809EC0A
Malicious:	false
Reputation:	low
URL:	https://accommodations.booking.com/orca/chunk-metadata?chunk=95f0c6f5&mfe=b-web-shell-header-mfe&lang=en-us&namespace=cbMBXEQB
Preview:	{"chunks":["95f0c6f5"],"experimentTags":{},"featureNames":{},"seoExperimentTags":{},"copyTags":{"a11y_aria_label_carousel_next_previous":"Next","a11y_aria_label_carousel_previous":"Previous"}}

Chrome Cache Entry: 630

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 540x270, components 3
Category:	dropped
Size (bytes):	35918
Entropy (8bit):	7.969928422030634
Encrypted:	false
SSDEEP:	768:iRR5Abhk6j7hDhBAHxTSerGRzcvd2sihTbTP6zAn:iz5A9Zj9ohDvIsid/6G
MD5:	0726C7FCA592F0D3CDF299BF33CBD20E
SHA1:	BD1808F8AE74515255CF550F3397B80E19205D86
SHA-256:	F2479E1196E8F088C7A361701B299C8E3290BB7CEE74EB457729A14B0D10D222
SHA-512:	E2FF4F1CE883EE8D8260CBEE66D7051EADA2C7EBC958F5B9F56E3C6C1919FDB501803C8CED6DD3A12523FA5D8AE3367162D9E668D174BD0D9B5DEF58C6D34CE9
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..h..8...I...U..n.3F.....r?..].j.?y.{T.)......z..F..9..._.!m..XX.y<.1K....Z....//.J..-....%ul..^.....UQvf.)JK.#......^`...G\V....PKy..yP..>U.......mX.......n..!4...+...j.^...".~....D..'#.....Z..........+.M...wK"...z..+.6.#I..`)..z...V..T... .....Qt...H...v.4.,Ezv.1....h..Ou...TK.%...q......../.rP....Q.R.w.c....O.Wte.y..\.>k..H....{..RI.P...*....%.......T..q

Chrome Cache Entry: 631

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	15612
Entropy (8bit):	7.987857145236499
Encrypted:	false
SSDEEP:	384:g+AWo4CkYTQ2Hx1oqPheW6QHHlQ++12dsyjuGwdSVLk/KJzeXT:gp4CsEWqPXlQ++12dsyjuGwEVA/ND
MD5:	F573C163D2B4778C2E5C6A61DC52FB4E
SHA1:	DA15321AE0BC3581507ACDEB12F2D2B791BD63C4
SHA-256:	424A99E2A55D559E6980E00224B26F1CB13557522C8D9A5BE7261904FBA61296
SHA-512:	48B2ED2179796381823B88738B1B9A6E4A02363A71564F60698F4665578DF58E68FB4234C03A07228372A7AC2F6E85D5D8AB1264207E596BBC9FC23E5B69C250
Malicious:	false
Reputation:	low
Preview:	RIFF.<..WEBPVP8 .<..p........>i.E.#...n.`...:sL\.\|4.......y..h....9...u_`.Izy2...................#...~..w.O...u....g..W.?..=......y...........t.c.i...C.....I?b.s.9..............A.....G.....59\|.......2...~.(4"x...z{._.....j.h.<....82....s....Z...h......Yb1/{.a[.m[.+...z....K.....k...AZ..Gw....S..l.......s..z..0.W..~&..n.}..r.....-._;..4Q....b....V.^,..#.L.`.+...q~.0...m..l^......h...y..&....H.....m.c..K...)..l.Z.6.8..R..g...$...?.wH.[...4...B<8L..9....!r..".`..[...J.....:S-.-_o.0. ...[.m..i.(..J.....<.>...T".#...F...........:....o'..O.a.w.(...D. ..........'.A.. ......^..z.A.=..[..4..\.1Kd...M.T.......\....8..<.A9.G..#}.fe.$........h[y.....5........K.-.}k.......:.Y..2.....l..-.......[..S.Sn<.h...{Jn.#Z.h..5T...1V.!....C.M.F..87.d.s...}..d_t.^{.~,.......^.4...q....yg4.Rc..Q......Glmi.../........SJ.,.e....5.k&...V.`@u..Cn.....\|5..y^..[.t..Q..IyJ.N..kg..n...R...+.Uo.#../:........^..WU.g......R...*..0.N\|.,C....[......f!`.H\|1..l..!.\.I_..

Chrome Cache Entry: 632

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6665
Entropy (8bit):	4.802851903376328
Encrypted:	false
SSDEEP:	192:FVF7pSdDHj4w8psdXH73uRCwpY6vepSdDH3xCXbzJtV:tdwDHj4/2XH73uswpzowDH3xCXbzJtV
MD5:	1F6D685BF8C9C558A9031B1640F4BA59
SHA1:	63381A030005D4AADDFD37E411D2B9F0173AB313
SHA-256:	2BFE24A072135C56F92507BCD88309BADA5FBD4945A512274ABE547DEE9FB189
SHA-512:	0B18266CC328447CB8F52F387F36961952B1A1021977DAEF154981AC3107DF6E352C77EA9438E1DD04DA79A86C812F40B2EC7551C6ED0D8B84CFBB8F6430CEC7
Malicious:	false
Reputation:	low
Preview:	{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202305.1.0","OptanonDataJSON":"a387750c-a080-4dd0-b2d1-7dbdb601bb14","GeolocationUrl":"https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location","BulkDomainCheckUrl":"https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck","RuleSet":[{"Id":"9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf","Name":"US","Countries":["us"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","en-US":"en-US","bg":"bg","lt":"lt","lv":"lv","hr":"hr","fr":"fr","hu":"hu","default":"en-GB","zh-Hant":"zh-Hant","uk":"uk","sk":"sk","sl":"sl","id":"id","ca":"ca","sr":"sr","sv":"sv","ko":"ko","pt-BR":"pt-BR","ms":"ms","el":"el","en":"en","is":"is","it":"it","es-MX":"es-MX","es":"es","zh":"zh","et":"et","cs":"cs","ar":"ar","pt-PT":"pt-PT","vi":"vi","th":"th","es-

Chrome Cache Entry: 633

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (56398), with no line terminators
Category:	downloaded
Size (bytes):	56398
Entropy (8bit):	5.907604034780877
Encrypted:	false
SSDEEP:	768:+LUmmAWTe2uXYp8Mi+yKYlebyB5lxRx54PHSGdXXwW7MFWwXVuE2:4UcW6v+0B5chXwW49z2
MD5:	EB4BC511F79F7A1573B45F5775B3A99B
SHA1:	D910FB51AD7316AA54F055079374574698E74B35
SHA-256:	7859A62E04B0ACB06516EB12454DE6673883ECFAEAED6C254659BCA7CD59C050
SHA-512:	EC9BDF1C91B6262B183FD23F640EAC22016D1F42DB631380676ED34B962E01BADDA91F9CBDFA189B42FE3182A992F1B95A7353AF41E41B2D6E1DAB17E87637A0
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/styles__ltr.css
Preview:	.goog-inline-block{position:relative;display:-moz-inline-box;display:inline-block}* html .goog-inline-block{display:inline}*:first-child+html .goog-inline-block{display:inline}.recaptcha-checkbox{border:none;font-size:1px;height:28px;margin:4px;width:28px;overflow:visible;outline:0;vertical-align:text-bottom}.recaptcha-checkbox-border{-webkit-border-radius:2px;-moz-border-radius:2px;border-radius:2px;background-color:#fff;border:2px solid #c1c1c1;font-size:1px;height:24px;position:absolute;width:24px;z-index:1}.recaptcha-checkbox-borderAnimation{background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAFQAAANICAYAAABZl8i8AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAAABIAAAASABGyWs+AAAACXZwQWcAAABUAAADSAC4K4y8AAA4oElEQVR42u2dCZRV1ZX3q5iE4IQIiKQQCKBt0JLEIUZwCCk7pBNFiRMajZrIl9aOLZ8sY4CWdkDbT2McooaAEmNixFhpaYE2dCiLScWiQHCgoGQoGQuhGArKKl7V+c5/n33fO/V4w733nVuheXuv9V/rrnvP2Xud3zvTPee+ewsKxMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExP4OdtlT6ztAbRWvvLy8A3QkwxzH6tBGMMexI

Chrome Cache Entry: 634

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	621029
Entropy (8bit):	5.515995337175916
Encrypted:	false
SSDEEP:	6144:kivQ1VrwNwh2JQB4PTl0kDc9C1LOpYADQTV4wNwh2JQB4PVxNgSUttGls3Eul5eM:BQZQFxNgreAQCQIPA0TgSl5dVmgjvxH
MD5:	3A5094AD3864E2147BDDB05ECA0E04DC
SHA1:	93C30C0D71F5288A413B52AF75A39E50422B5CF6
SHA-256:	62E782627287817FDC848A0946C282383DFB97F00888AD3DFF6DD92D657D021B
SHA-512:	4AF46A5FDFB9289A11B56B7111807ED173D573501156292BA394DBC40A7A576AE47D0EFD0B04255F6A9A5D0A2CE099E74E1ED3775B0A47F51C4BDBD49AA6A3A4
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/atlas_cst_cloudfront_sd/138d388521c0fb45e14005cb8098ebebb7158dce.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.atlas_cst={loaded:!0,run:!1}),booking.jstmpl("atlas_iw_default",function(){_i_("373:2f8c4dd8");var i=['\n<div class="iw-container iw-default iw-','">\n <h3>\n ',"\n ","\n <span>","</span>\n ","\n </h3>\n</div>\n"],t=["b_basic_type","b_name","b_text"];return _r_(function(e){_i_("373:2f1cf5f9");var n="",_=this.fn;return n+=[i[0],_.MC(t[0]),i[1],_.MC(t[1]),i[2]].join(""),_.MD(t[2])&&(n+=[i[3],_.MC(t[2]),i[4]].join("")),n+=i[5],_r_(n)})}()),booking.jstmpl("atlas_iw_landmark",function(){_i_("373:8f20cd9b");var r=['\n <div class="mini ufi-label__container" data-marker-id="','">\n ','\n <div class="ufi-label__image-container">\n <div class="ufi-label__image" style="background: url(',') center center; background-size: cover;"></div>\n </div>\n ','\n <div class="ufi

Chrome Cache Entry: 635

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 122 x 28, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2956
Entropy (8bit):	7.91027874894693
Encrypted:	false
SSDEEP:	48:k6UvC3gU6BW9XtbeAajpxe6r2qP/LwEpOxH5d10W40pa57f6U5z8P2fTudIRGm5B:rUqX6BMVeAadHr2qP/LC5d1BNU7h5o2P
MD5:	29471623E72AF49F6C95BE101D45A942
SHA1:	97DC407B5CD9F96099B67358DD56DF767A9BB121
SHA-256:	6691E3CEF8F3CEFDB1E47EFC33C1D33CE2F712F53A79F221DAD805ACA7AD57C7
SHA-512:	64FC513FA78B984034EA55124195F51144855B489A6379B00555E1B582E0D39ACF788FC36D283DB278AB60CEC5ABEC46C59A3434AB666FE7DC7A55EB1B24B2D5
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...z.................sRGB.........gAMA......a.....pHYs..........o.d...!tEXtCreation Time.2023:01:30 09:45:10F~......IDAThC..pT....9w7$.(.....M...ok.cl.c...ci.iG......vh.jy....Rh.R,.V...Z.U+v\|TFg... B.` .......=.........fN...{....<6.B...T.P....?.6.}..............s...]..F'.XF..tdk&.~......^.H2PMRhI.x/c....'......O.B.b.%.._..m...=JZ.=...l'z...L.mZ...z.Z...q.$I)....i.\|x..{3).$.LL.......)d5W.....oV%.y.~..=&..N{..R.3.(R..........Y!.S+.Uk!j,....?...o.6..6...e^...4.a....7,.<I.Ea.@..]#..-.z....jI;_OV....8{.u=.ev....;..{...':.F.....{.I&...w..y..4^.x..h.R.1..1k...R?.......q..>.t.l;......#3J.......[.eG......J......;m..S.6...!......Rv.k....&...n_...cD!4].A...^...\`...z...Z~.....$]v.+0..bn.d..b..........k....p..K.Fg....xuJ_.23H...W...#.r...]w.rv.;5...x..0.b0.../.q.ld..c'....J...;....)........5F]...?t...^'....@3......'......x.3.Ff.olU....vTj'.:2Y%..%......J....'1/...M.y/s..Z.{....r......H.qZ...... {....F3..-.R.2. _?fL/:..!.

Chrome Cache Entry: 636

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1182)
Category:	downloaded
Size (bytes):	1298
Entropy (8bit):	5.192772061822323
Encrypted:	false
SSDEEP:	24:iEf5WDQALreRUPbZdrS9ZV/Zc/U4V41NdqxHU:iA5qQALPo63GPkx0
MD5:	FDB620D16DDCB3D874C0D96880365B4D
SHA1:	D95824D3B336670E2057A5B35B60D0FDB3A7ED2A
SHA-256:	4BCB7F636B154F714E61CB33C7904BE7684225B53149144F21D8E98EDE64BF84
SHA-512:	D1659BC4BEB1CCEAE42D326D39A41C9039D9271011F661D4275782A6FE1A0B369A68AFFB9BF818D80A30E73536B514BAC2CF4C06F70B6C44DBDB211DA68D278A
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/f50a2dfc.837540b6.chunk.css
Preview:	.e3e54067e8{position:relative;background-color:var(--bui_color_brand_genius_primary_background);color:var(--bui_color_foreground_inverted);padding-right:calc(151px - var(--bui_spacing_8x))}.e3e54067e8:before{content:"";position:absolute;top:0;left:0;z-index:0;width:100%;height:100%;background-image:url(../../static/media/baloons.79c0e51c.png);background-repeat:no-repeat;background-position:100% 0;background-size:contain}.e9d8cf9c55{margin-top:var(--bui_spacing_2x)}.e461545713{position:absolute;right:var(--bui_spacing_4x);bottom:var(--bui_spacing_4x)}.e945244cd4{background:url(../../static/media/world-map.7d457a5d.png) 100% 0 no-repeat;grid-column-gap:var(--bui_spacing_4x);padding:var(--bui_spacing_6x);grid-template-columns:160px auto;grid-template-rows:2fr auto;justify-items:stretch;align-items:stretch;display:grid;grid-template-areas:"image text" "image buttons"}.a7d8e8e811{max-width:442px;grid-area:text}.fed256e553{margin:0 0 -14px;grid-area:image;height:160px;width:160px}.b3b0631318

Chrome Cache Entry: 637

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	351
Entropy (8bit):	5.234119188578117
Encrypted:	false
SSDEEP:	6:kWT9JjkaopqsuSVaepVKEJq5kh4pIoauwqGmS17uXMWZ:kUf2q/AVfJqNIoauwqGmM7OMWZ
MD5:	E073BE315B762E550E327C95965FBADD
SHA1:	B55A01C7320FEDA4B3E35CE7170FF347EC21E05E
SHA-256:	C6920AA377603AB44E2116FF0EE57B62C785B646D1637E30911DAAE8DDA55642
SHA-512:	6D0DBAFB0B3AEE8015CFC7695ADD34A26D1A30D4B14D20CE9C1ADFD21E0879C5976E1DB51AFB202BD2CF98A8105E13A33D6A232479729CD3D1EBA7DD3C74DBBA
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/18cad957.d04abce3.chunk.css
Preview:	.a48a991fa6{display:none}.f612b4bb42{border-radius:var(--bui_spacing_2x);box-shadow:var(--bui_shadow_100);overflow:hidden}.f6a33970fc{margin-bottom:var(--bui_spacing_6x)}.e21d5dbea6{margin:0 var(--bui_spacing_3x) var(--bui_spacing_4x)}./# sourceMappingURL=https://istatic.booking.com/internal-static/capla/static/css/18cad957.d04abce3.chunk.css.map/

Chrome Cache Entry: 638

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2480), with no line terminators
Category:	downloaded
Size (bytes):	2480
Entropy (8bit):	5.952167232308992
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08ZSTBnHHI8jz+wCQT6:wsbSUtJfxrqLWWWdV6j1dSTFHb+Th
MD5:	39C06BCBE49B1E2D5362038D521AC0B2
SHA1:	1E13F384878ADFB7DE84EEB92CF079B227E97985
SHA-256:	719A34E2EB96FDACA7A29F45AF42D7639CC950056A5BC23B531CED512D5B230C
SHA-512:	B74F2A439420C5FD645EC9E4A17CC3803A46999163DCE534B10B0E20BCA3CC507CDF5197376691FDCCA9A708A3381B3FFAB65791D53D310FA713F535368CB247
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/481216654/?random=1707417393396&cv=11&fst=1707417393396&bg=ffffff&guid=ON&async=1&gtm=45He4250v843635506za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Fflights%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3D5171fc655664ddf74ab763a094523fb7%26from%3Dbooking%26&hn=www.googleadservices.com&frm=0&tiba=Find%20cheap%20flights%20%26%20plane%20tickets%20%7C%20Booking.com&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 639

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 640

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	downloaded
Size (bytes):	8621
Entropy (8bit):	7.916778967838765
Encrypted:	false
SSDEEP:	192:mgK0069awoQPCxLi6qpIcvC3GrJsIkYz9ix3hopvT:3G6Q+W8pnrs7YzBpvT
MD5:	72C870C967629F6F1C36561800EC1E38
SHA1:	C01C9FF688F5B9AD0B586069AFAA4B22DB171F6C
SHA-256:	FC11EDD43A2D8FBAF64E61FCD71475CC9702097CF6A33F0884CB800B4EFCAE4B
SHA-512:	608E3F35A30D183E6FED5F652FB2694842EE4740CD33C2B7BEDD7C59C5EF82311976877D7F6CB3A42B948AA8F3AAD84E76CE663E46EA2279161F140D02D2D8AC
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/xphoto/263x210/57584488.jpeg?k=d8d4706fc72ee789d870eb6b05c0e546fd4ad85d72a3af3e30fb80ca72f0ba57&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..3..M..q...x..\|..5.8N...K..z.@.MF...S..."pRVg"r.A....M...1...{d..l.l...M...Z..]...].~.i.........r.T.V.6....W ..r.<.....-..o2.&.E....}.4.*...e.(.G.I.E.@..ka.Qgo...e.QV...F.9.}..O..k7<.\....k...u......._...n.W..w.+.....pf."d8.\|.G?.A.....Ik;x....g..c.>..............M....O.5.....Up..^..hz.VZ.w.#.....'q..v:..m...t.~{.iS.;.......N.?......S...4...B.._.:.%%+..Q+.i_.,g.

Chrome Cache Entry: 641

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 642

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	downloaded
Size (bytes):	8642
Entropy (8bit):	7.936811905814669
Encrypted:	false
SSDEEP:	192:mIRFaj6y6SGsxJJPZnPT11NmpbTJytPcdjxhlZK2:nR7RstPxTop/8Kls2
MD5:	C93A2183DB30C5988936B15E9BB2473C
SHA1:	9D5B308CF067E5B0EE544D3FDBA45740587D2F63
SHA-256:	2B8F25D9F2B16CB4F435787E273411EED1CDB83E7CCC56542358421AB0D90E4C
SHA-512:	066C23C192D868A2B5505813D40DE3515EA874636B70D67D9E8B93F37CDC0121D8D60B1A154DC77BB05D13E64081858EB843CEAC3649DB1F14D902054ADA68C3
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/xdata/images/city/170x136/977409.jpg?k=82c14f9e6cea94829ee0528a3aa4324111d3482e9f095194500746fa7ca2769e&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...Q.<....FF.+..]..qkVW.sq..Q.U.....X}. .J...s..e...SvWn...v..dL......A..Kt.#'..........d..j~.n..?1..:N.(..O1..0z.:...!..*;B:z..'...SI..k.#.X..."..[+..O......Gw#..2....t.....Mr"....F....1.V.......F.\|....q....>....JmE[...wB.H(....]4..5.....Y'..........C..KF +0...m...jVm....p..V;H.w.6H...:..>.RGy.Hnnm...^Fh...[..%...n.:3.8.rJ..K%...c.y,.3..O..T}...4..icW.n.

Chrome Cache Entry: 643

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	dropped
Size (bytes):	7768
Entropy (8bit):	7.936924535498852
Encrypted:	false
SSDEEP:	192:mIk5lAeKSkAguumq8HNw7MU7Kfl3baL1S5S9CkVtpR66/U6x:nelAmknHWcsl301SIgkVtpk6/Tx
MD5:	8916C59C9466E18D23DC7200B4EDD4DD
SHA1:	C1879666FC2DA5D23D349597132486CF1FD835F9
SHA-256:	5CA18D4B41E1FD2A9B990FC774A7177B30FAA68CA5A81CD8E2C0FD9ADE116085
SHA-512:	D332FCD01654C75CE1BF7237B62B80FDA8A2B4CBDA5EE2F75142835D8F0E21A6894B518BE071787BD26FE5602E7AC2A883A622B62A969D5008CE0463C6C08C90
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....v.q..G..r.(#p?.=8.z.v...v.B..<2.h,:......i......PC.#....Qi....Wg.......;%.+.>+S4.n.Wi.n.>..H.4...2.S.,v[..H.".g##...+..>.mo....%.2mt.8...`.-..-....a(..#c...)"..kH.g.9..a..x.z..n.].TF\|.V_......%.....c......q...wi... x.(.;..].'.N.'......h..R;m,.9A.7$c...q.jv`>...F@#=.kOH..J..1..F+...{.+..X.wFS..:/.A.....0."..h.0W8.}......lc..o..... .G..@.g.#5...7qnvH...

Chrome Cache Entry: 644

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.321854365656768
Encrypted:	false
SSDEEP:	3:YGKSHvANxm0KBRqSABHY:YGKgOxm0HxY
MD5:	06FCFF9AD2CFBF648406A13875BD7E38
SHA1:	1C3620D1038C1578A3B5E21E80C0523123E1E304
SHA-256:	9A970E1A236FE3E8F4A13AC7FF4E00C30809380E97B856FF6575BC2A38BBBDD6
SHA-512:	DC781A227E30ED8C62D42029B2E81100CFF50D1991FF577A2F17C1039533E7A84596121A43E627D821D9F4804A6E88A9EBE8635C558E01F72595BB4A59DA75C1
Malicious:	false
Reputation:	low
Preview:	{"code":400,"message":"HTTP method not allowed"}

Chrome Cache Entry: 645

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	12702
Entropy (8bit):	7.986682189546755
Encrypted:	false
SSDEEP:	384:5S40+lUsYW0BBCAmoaeUdL0O5DLveEOgXdH2:gjW0BB1moDod0gXdW
MD5:	345351B34D03FC5EF995888D5B6D0272
SHA1:	C7340F02715ADA6A3FCE744C94B187F4928562BD
SHA-256:	0786B6165BA1306484E337603CA2CCBB0C119BE6DDB6EEAD17843C3A2B92D712
SHA-512:	8EFBE0D806AE593B10684F18653B20CAAEBF490B50CBF96BA9A9135738AB4C829F78CFAE6564B72D4BF0EC4212663F033C74D3E49AD369ADF9BA5E323DE169B9
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/square250/690179.webp?k=cb5eb236e7e9bf988a677e4fbdbf81ef955c828b5bfccac307c9f9786f31d48e&o=
Preview:	RIFF.1..WEBPVP8 .1...........>m0.G&$"..R.8...A...[.....y..?....#.3s.n>k.yOy.]~d~+..../..._.y.......a.1....B.......h\|^...^...}..g....K.......O..............G..M?.... .....<D.kH...{........G:._..4Sx...M.Vx..t.sJ'..s..\.C..... C...t.u...A.._......px....6 ...x~.........(M;.../.c.y........}z........s..5}0.G.,w..................t.fU3.Rg.F....vuG..K.y.=Y.j....&.@..._.._cqt...j"......d....UA.VS.......Sh.7fC..W.)..P..n..I....@..29..S.`v..._n...^.H....-..^.Um.....B..7r.`..BK..aa.-....t/..g}A.h..<..N.v.......@.....M3.=.n..........(_\......5.?.-.6.~.A....d..=._I{..{.+......O...:.....?(..B...n~....6.G....{....)o~%gy.b...rm.....d..........U..j...0.xVB......m\|...z..'z.W....iA../(n....f..r..d...9..io.'.u.+O...v.5..i............6.J..F.m..}...Z.. M..E`7#qe.P}.D..T.sW.V}.JM...s..c...<:.".mmO...,.U..L6.I...E-..!3.71..j.AL.0.......d.C..)..m..?.n..z.'.t.x.:0......2jhWn......V.={..gz.f..q9h....UI..Q...0n..~.R.;~...d..o..l[..6.r8...l....!.t.t./.gA..,.T....%..#..s

Chrome Cache Entry: 646

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (1002), with no line terminators
Category:	downloaded
Size (bytes):	1002
Entropy (8bit):	5.701644045708987
Encrypted:	false
SSDEEP:	24:kHkw8tSyngFuVAOdIcCcEzrcEzn/PqjCC5zqinzYjnpRnLxR2+YI:YyLVkczEzAEzmYnbuO
MD5:	ECEE2E29DD00A24FB536CF681B6D2FE2
SHA1:	40BC0B3B8D7BC13A5A7186538737144E0B02AA5E
SHA-256:	A4BDCF773739389E5154C8E46A2EBEF93B1E618BE8E742CF6BB171B3AAE0E4BE
SHA-512:	A02B0637C37B484075F4D293BACF6620DA01C64D3C52F69B1CDCBE5FD8674A3E05E1255A1E691BB3687E27CE258FCEDE4F08EECF35928BFCF7E9108262FC61DA
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/1060768846?random=1707417344498&cv=11&fst=1707417344498&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nh4qqVoyv2KiIad5kPNddW86jrjYgKSk8&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN
Preview:	<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j9270294"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j9270534"}}]};</script><script>for(let i of ig_list.interestGroups){try{if(i.action==0){navigator.joinAdInterestGroup(i.interestGroupAttributes,i.expirationTimeInSeconds);}else if(i.action==1){navigator.leaveAdInterestGroup(i.interestGroupAttributes);}}catch(e){navigator.sendBeacon(`https://pagead2.googlesyndication.com/pagead/gen_204/?id=turtlex_join_ig&tx_jig=${encodeURIComponent(JSON.stringify(i))}&tx_jem=${e.message}&tx_jen=${e.name}`);}}</script></body></htm

Chrome Cache Entry: 647

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (490)
Category:	downloaded
Size (bytes):	606
Entropy (8bit):	5.181139788366643
Encrypted:	false
SSDEEP:	12:MRVJ08g3fOLVYGeISPReNUyzVxfKPOKeIoauwopz:MvVg3fOgeUyxxS2KKqgz
MD5:	E7873A194C1C3D1E24807A3504B1558E
SHA1:	FA7FD5E73F0E62B67CEAC6C5F84A3D76EA32665E
SHA-256:	8B7CA9BE3700FA8145082439DB51F7DA65E4DE6B8ED8AA25E06DC1C54653A4AB
SHA-512:	E08BDEA803C181DFCE883A7E121A318C85E0FD298C079AE9AC754244619FD87D84358C58FFB06794DBC50BA4AF8DC6A759D1DC4B1D339F551BBFD4CB79A54DC3
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/0de3785e.401967bd.chunk.css
Preview:	.cc5acc416e{margin-bottom:var(--bui_spacing_4x);margin-top:var(--bui_spacing_4x)}.b799ba8345{align-items:center;border-radius:50%;display:flex;flex-shrink:0;height:40px;justify-content:center;margin-right:16px;width:40px}.f2c627f314{box-sizing:border-box;display:flex;overflow:hidden}.e9d1041e1d{background-color:var(--bui_color_callout_background)}.beab03ae02{background-color:var(--bui_color_brand_primary_background)}.c1fcdd83d1{background-color:var(--bui_color_constructive_background)}./# sourceMappingURL=https://istatic.booking.com/internal-static/capla/static/css/0de3785e.401967bd.chunk.css.map/

Chrome Cache Entry: 648

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	76199
Entropy (8bit):	5.062491294050728
Encrypted:	false
SSDEEP:	768:58pcPWW6C2sFRGMgxE6i31vpeA3PMRXnCOcY:58pcWW6C+AFBeA3A
MD5:	59B9BA105A6857533BBF8C4C3CABEF29
SHA1:	E6EFDC0B7A1D2C8CD9CD35F6652FF64F3B0B48FC
SHA-256:	DFE541A6C0C1481C3EBE6B417754EE08D8871EC885DAD30F723B89767732ED2C
SHA-512:	DFB4D7FDD81A8A90789A4CF9E95B3D2FDB56B08D01A3FE6595AE1602655511F1C647FFC01B4BFAA1D4FD5E61A6C263894B3F5872CF6C92B7BB1FE7A4FDA4FD43
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/css/xp-index-sb_cloudfront_sd.iq_ltr/5b5ab8ab66a5ce3092875d0725122439c4f2dfdd.css
Preview:	.bbtool-notification{clear:both;position:relative;background-color:#e6e6e6;border-bottom:1px solid #fafcff}.bbtool-notification--top-menu{background-color:var(--bui_color_white);border-bottom:1px solid #ebf3ff;-webkit-box-shadow:0 1px 2px rgba(0,0,0,0.1);box-shadow:0 1px 2px rgba(0,0,0,0.1);font-size:14px;position:relative;z-index:2}.ultra-focus-body .bbtool-notification--top-menu{z-index:auto}.bbtool-notification--outside-tool{background-color:#f5f5f5}body.bb-sr-mo-own .bbtool-notification--top-menu{background-color:#e6e6e6}.company .bbtool-notification--top-menu{background-color:var(--bui_color_white)}.bbtool-notification--index{margin-bottom:10px}.bbtool-notification,.bbtool-notification a:link,.bbtool-notification a:visited{font-weight:normal}.bbtool-notification--outside-tool a.bbtool-top-menu-link:hover,.a11y .bbtool-notification--outside-tool a.bbtool-top-menu-link:hover{color:#333;background-color:#e6e6e6}.bbtool-notification__wrapper{max-width:1110px;margin:0 auto}.bbtool-noti

Chrome Cache Entry: 649

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2562), with no line terminators
Category:	downloaded
Size (bytes):	2562
Entropy (8bit):	5.968383439394097
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08yjLE8Aq4VHIhyetzYig3X6:wsbSUtJfxrqLWWWdV6j16ERtHo9p
MD5:	440378408A59C092652C4B78D51155A3
SHA1:	5841AE1594C37669B257621E92A35FE6F360D09D
SHA-256:	69E7D1BEA0517E0004A09DD0B8EFBC5E1FB69E7C4990E5D51E86F7BE7CDCECC5
SHA-512:	64EACF1AD779E1411C38A8E3BD28DF16D23D9D76D315C298A31E6DF068C2EE2B80D5F935766C65719B7FCC00BBBECB7E6CE2F3268C4B09A5185C8A6EE89F06E3
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/988382855/?random=1707417370534&cv=11&fst=1707417370534&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=qxb_CKLbrYADEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 650

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2559), with no line terminators
Category:	downloaded
Size (bytes):	2559
Entropy (8bit):	5.95696948767973
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt0817LQ4VHIh3ohtzYig3sC6:wsbSUtJfxrqLWWWdV6j1h7LzHoKh
MD5:	7507AFE35E7F2A42BB4166F9889F7841
SHA1:	2C397367FE8FD57E43CFD23C925C8BF08518A0F7
SHA-256:	8DC5B632E1E847C9079342D0E85189A77929681234A63CD7D8990C972251D2B7
SHA-512:	8C6729F48AB99E9AA3FE81B3AF23754697DE142D9ABF2561E95E2C4BE2F1ABE24DFCA889DDF68B6F554E6E44FCCF8BA2EDE03DF1E65EB704CD14D0A6EB870012
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975716499/?random=1707417370697&cv=11&fst=1707417370697&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=mzmpCMbAq1gQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 651

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	downloaded
Size (bytes):	8621
Entropy (8bit):	7.916778967838765
Encrypted:	false
SSDEEP:	192:mgK0069awoQPCxLi6qpIcvC3GrJsIkYz9ix3hopvT:3G6Q+W8pnrs7YzBpvT
MD5:	72C870C967629F6F1C36561800EC1E38
SHA1:	C01C9FF688F5B9AD0B586069AFAA4B22DB171F6C
SHA-256:	FC11EDD43A2D8FBAF64E61FCD71475CC9702097CF6A33F0884CB800B4EFCAE4B
SHA-512:	608E3F35A30D183E6FED5F652FB2694842EE4740CD33C2B7BEDD7C59C5EF82311976877D7F6CB3A42B948AA8F3AAD84E76CE663E46EA2279161F140D02D2D8AC
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/xdata/images/xphoto/263x210/57584488.jpeg?k=d8d4706fc72ee789d870eb6b05c0e546fd4ad85d72a3af3e30fb80ca72f0ba57&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..3..M..q...x..\|..5.8N...K..z.@.MF...S..."pRVg"r.A....M...1...{d..l.l...M...Z..]...].~.i.........r.T.V.6....W ..r.<.....-..o2.&.E....}.4.*...e.(.G.I.E.@..ka.Qgo...e.QV...F.9.}..O..k7<.\....k...u......._...n.W..w.+.....pf."d8.\|.G?.A.....Ik;x....g..c.>..............M....O.5.....Up..^..hz.VZ.w.#.....'q..v:..m...t.~{.iS.;.......N.?......S...4...B.._.:.%%+..Q+.i_.,g.

Chrome Cache Entry: 652

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 92724, version 1.0
Category:	downloaded
Size (bytes):	92724
Entropy (8bit):	7.997553923653277
Encrypted:	true
SSDEEP:	1536:teR2vJkIpD1ojHcPqWmz/EPCGYPvI9iZ5zwgksuLhEjYfy3Na7SQs0eYMgUxQ4W8:iCJkKpogSRz/EPmI9S5zwgkd9EjWYNau
MD5:	F132633E65809EC36C0F01B8A29FA457
SHA1:	E68A5B0DE3E08AC85A13426CE3D8C13AD21D38FF
SHA-256:	A98C20990FE3E31203FE2DB8384AF8E05E7B358CDAE3C28B034E1F02B47DB630
SHA-512:	7F2AA9B95B95F93565DEEE578BF01C57A6D0A28DDE40A202DB6E4EB7554A5076E5C86FE9DED23E56F1BB4BA2B42EBC9AB44B03AE5EFB73E81A6EE077CC61D9E6
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/fonts/booking-iconset-original/29bca18dce5a8e111855e31314a9b1d750ea9beb.woff2
Preview:	wOF2......j4......%...i.........................?FFTM..Z. ....`..v.....L..i.....6.$.... ..{.._[.~r.bp..%t...bj.../..&q.._.!w.b...y...~.d....I#........j..IlqJ.Tj+..cB....eV...B.#\..g.M...7.;......\|.U........6.-.....6..U9......G....A].b..w....pV...rr!......p.V.....8.../?YC."A...-\NSQ..0.,..H<6.Y..Q{..U..r k..0agr)..o.g....f.h.V2.Wp.#..vd.7....O.s8.U....Sic..N&........b..........&I..@..Tl.5c.."..i.e.=...=...J6T.+~g.x/:..~...{`...Z...m..X...v..jW..e..U......{W8J.B.z.Q..K9.....V..b+.....Xz4.v4...&...4......... .....h.....I..1@D...{FN.=.7{..t...Rg/.!~...P@E..m.(.D{....5.T.@{..U....J.g.u.......u.s.......$p....?......d..F.....+....'!<.......I.B.Er.,S90.]..].O...O.h......Y`.m..<..s.TC.V....c.......!v....$G....j.S.{R%..;...u...{..&..-...0......\|.sj.x..,[2$......\|....:..i..y^.L.!$...?2.Ao<f.f..G....s?d..ZQqy8...&.G.P.!.^]...G5{.g;T.pA.......8.....@.....M9.ao.._....!....T..M.*K.U..wl......C....DE.D...T.Q36P.j...r...2PQt..XI.,6.Z......rs..9

Chrome Cache Entry: 653

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (829), with no line terminators
Category:	downloaded
Size (bytes):	829
Entropy (8bit):	5.412399428056004
Encrypted:	false
SSDEEP:	24:4Hkse6q5/Jz2pRNrBZJuvu8goqc0ioNhc+Y4+mI:2Sz2bNrVENtmN+k+j
MD5:	88762E698439BD784B17EF55765FDFCC
SHA1:	1E13127611A1F79F621C58C806FCA3A9E4E19069
SHA-256:	65FCDF35029545A50C42C07C9722965A81CB8F29F9EC4486B471B6D93D78CA2E
SHA-512:	CFED26D563FA95BA5D5A36BEFF5387E4087602282278F78D3845CF4C9F28B1AA758BD93FAAD862B386184787D52F448CA527ADF146AFAB76830E6BC3BB18F0A3
Malicious:	false
Reputation:	low
URL:	https://www.google.com/recaptcha/api2/aframe
Preview:	<!DOCTYPE HTML><html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"></head><body><script nonce="RFPqWuTXUJt5jc4Hq4GrUg">/** Anti-fraud and anti-abuse applications only. See google.com/recaptcha / try{var clients={'sodar':'https://pagead2.googlesyndication.com/pagead/sodar?'};window.addEventListener("message",function(a){try{if(a.source===window.parent){var b=JSON.parse(a.data);var c=clients[b['id']];if(c){var d=document.createElement('img');d.src=c+b['params']+'&rc='+(localStorage.getItem("rc::a")?sessionStorage.getItem("rc::b"):"");window.document.body.appendChild(d);sessionStorage.setItem("rc::e",parseInt(sessionStorage.getItem("rc::e")\|\|0)+1);localStorage.setItem("rc::h",'1707417347611');}}}catch(b){}});window.parent.postMessage("_grecaptcha_ready", "");}catch(b){}</script></body></html>

Chrome Cache Entry: 654

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	10578
Entropy (8bit):	7.981065523671133
Encrypted:	false
SSDEEP:	192:U+oScWULLIV0jJ2eA2+2a4jt5Jye6ZysSLJe8Y3G4FWXBKYhXKW7px:PoScjbjJRAoFtOyheD7MKYhzj
MD5:	712C1671013BF9C4F0407F7FFDB562DE
SHA1:	F3601D6E2652E5A6392B01B6ADC5705CE715F7A0
SHA-256:	9AD5633752679214F8CBFA8B4234DB8FAFA6298EF0CA2824EF023EB12BA096D5
SHA-512:	8531F1D98C0F70D44CC0B84DBDBA0EADA9DEC2CBE3F3A3E9D09DE40E2B7DE26E7D7F1B35BC3B782D93CBC4B5F7CF6031C62F03EB16602D2721E6C41F6B9A700A
Malicious:	false
Reputation:	low
Preview:	RIFFJ)..WEBPVP8 >)..........>m0.G.#.!.T.X...gm..7. ..X....I...UTs.....K....5.....S....R._.......&.~.......;.7......}....?.z..#.......>3...a...G...o.^.:V.......A...M&.y.{..I4..@.qD.......Mcx.J^..woJ.t.,:Wo....Q..<..;TbQ,.\|.K....yQ.........uiF.[.oH.....&..jZ...S.AG...X_...u.D.B.\.v.b.gE..cO:Us=....g..8...?yQd16k..=...P36......@._s/.~#tb.D.L..R..4.Y..T....n((...P..[....\|.....[n....$...G.A...R..<.E..(.....,.../.C.;./t.)......3...6...3.,]F...zu..D.@' .5..\{.7..C...?...@.......pR...f..=...6>s4k..L.;..)S.....=.....d.5.!.....A.B...l.^.o..h...g>z.i.\.g.z..T,vb./#.U....X1.S......_`...7..X........:.vx\].x..V=~M^^.hH.mL..9t%..8C.%..."P6.j."..v.7!pWA....E.x.`z..x7G'.Fo._w1.......z..4J7..7......j..j.........V.'.NMCD.vLc9u:.$:....K...x...1..$(....._.--.1w..)iY:hN..N...?5_....C;Uw.3..Z4.R.X.....~P..N.\|...........]V..H..tA...8.V`Ya...J.(_@..+yB.......3.~.t.j8.4..G.....t..X.r......b..../..._...:.......B&U.....v...S.amO..(.R..".....uR.^./...G....1f........

Chrome Cache Entry: 655

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3385)
Category:	downloaded
Size (bytes):	210250
Entropy (8bit):	5.396059788362883
Encrypted:	false
SSDEEP:	3072:QQkz2QTcQqx0LUU+oIhV60rarUrVLCojYy3vknU6SD4GuaXkT6Fd:Qjz2OQ0iACIiVLLt/knU6SD9uwkKd
MD5:	369A9B7552FFECF32A73EDBA29559CA0
SHA1:	11E70BBE0EE84C23C5DE66B28C45AD329E142CEC
SHA-256:	A89ADCD85F7CFD505DC7B42270543241B2E39B7F87F8551012B736EF64BBEF19
SHA-512:	35A3EE0B9191FF88F469365488A708279DAD463FE4A1BF824C5CA0BBEF3AB2F4C99784E536CE0C6695B15031C0C71EF70E816F695B60C2F4B6DB6B25349AE4DE
Malicious:	false
Reputation:	low
URL:	https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914
Preview:	(function(){var n,aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a},ca=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");},da=.ca(this),p=function(a,b){if(b)a:{var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}};.p("Symbol",function(a){if(a)return a;var b=function(f,g){this.Lg=f;ba(this,"description",{configurable:!0,writable:!0,value:g})};b.prototype.toString=function(){return this.Lg};var c="jscomp_symbol_"+(1E9*Math.random()>>>0)+"_",d=0,e=function(f){if(this instanceof e

Chrome Cache Entry: 656

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 72 x 72, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	950
Entropy (8bit):	7.69670577809709
Encrypted:	false
SSDEEP:	24:ahvlk2c/6qz+2SDaUGyHHT+hYuwNdfCIaKFIxp8c1wolBTaGIx:Uvm2c/6gSDbHCWNdqIaKFIAc1D2fx
MD5:	025B409525836B9E0913038B2556D2CF
SHA1:	187B28FAD3A710B3712B56E53BE8FC4E142D9ABC
SHA-256:	BF146C2FCD8C33FDEA4570ACC5F92BC73B337B1EFBBB2C318089F7BEA5396672
SHA-512:	5B7A5EF3A3A941A92D33FF9713AAFEEBB0CD21E3E84332DDEE259562D33AEFDB36644A99F316A3627AFEC1ED9E51D1B0E3E47B846DE487A393EC768A63C150CE
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...H...H.....b3Cu...TPLTE./].w\|.hm>Pw...!7c....=D.QXVIi+?iix....Yh.J\.5Hpz...............21Y.}...bg.....^u....pHYs.................IDATx..V.r. ......>7....).........}.Z............[.......B.G.@$z"......JH7..{...&..G....LVu~N.U."S.~K.F..B./..mYP.%..&`...B..:.It..]..4.....L...oIb.-U.B..c]Vu..Y.iy(.g.7...L.j...RC.!6...-..+..........D.3r./VB.7?'#}5s2..n..0Q.T?./....B2..nFr.........g,..."G..HlFm.....&..&.......{M`>.L..6=hn.O..p..h..:W...B...M.D.u.X....B.,e-Y...7..={..i...SwL.&..:..1......Xpidl..3.r.R....l.".FQ.^.t%.....q.eQ.sRv."..........5....a.....{.Z.....fX.-.35.{.p..c+.).F(P.9PN..!...Y..x....<Y.=.....{..1...r3*..#........Q..83.r-XM...6.f.6C+:.d....9.9.?.._...D.3.#....).F..... F..f.@...N..:O.....h}.0c.q/..'.Bh.b.B.%...p...#.r-....#.D<.Go.1..g.y$..f.N..r.3.......j....9.#yt...k..4..$hA9..Z..H...i....B??._{.....:.\|..p......_.P...B...........=_.P...B............x.....r=.!e....IEND.B`.

Chrome Cache Entry: 657

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	downloaded
Size (bytes):	10257
Entropy (8bit):	7.9278460122891286
Encrypted:	false
SSDEEP:	192:mgARxUS0Dgu/UtwsBC1Rx7z0OPhgKy55wopcaiJUlK7AytFGDKOziV:3ARCH/UuZz5P52SUluA8IKqiV
MD5:	5F58A2EEB3F0B1D3CE899E3C629368A5
SHA1:	3DBABBE322B0EC1CFAF64ACFDE88D5ED67B674B1
SHA-256:	FA9F5DBE5AD251EB1A7DA4628C3D1CC55C9FF380671A9D7D2B070BF4E2C2324E
SHA-512:	41EEB02A2EDC6F19C53C526C8D329C0D13C710955D60D9D44E648D73531008DE7279D9365FFF2F2DACD93A6C080F1591D6720D0C2B8FA55928C81C1D646B26F3
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/xdata/images/xphoto/263x210/45450084.jpeg?k=f8c2954e867a1dd4b479909c49528531dcfb676d8fbc0d60f51d7b51bb32d1d9&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..%.z.H.sY...R....s{....4.....Is.../-.N.z....H50.......=..J>....`....Z...E.7b...-}..O..#h..?.....X....._....~...]...`.}....).P.6.AF..?}..a......=.:...v.AN.=..@........To.N.....b....!.l.....d..I$..e,I'$.)d9#5i......S....2.6=.s....[.......?,.\H^V,..D.u..}.K\|.?$C........*.9.oV9.4U.J).u...Sm.....!gd.....I#W.p}M6E..1....h.................Z..w/=.i....9

Chrome Cache Entry: 658

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19849)
Category:	downloaded
Size (bytes):	19965
Entropy (8bit):	5.4268945066358505
Encrypted:	false
SSDEEP:	384:T71nbvjHUAW0VunhHnMsCh2LhwfxdOX2F48:VnbvjHUfeonChg6JdOX2z
MD5:	D78C34E2DBEC204465921F484C1997F8
SHA1:	B6B0D1AE5DF66C0637284827222B757ADB98C237
SHA-256:	07B50AC877934B1CE0BD68C040F83BAE04EFB2DB4E19B60681CDF4F367DCB2E0
SHA-512:	9E1D015154B7361482C5B22B35B1123A63911A45C241872DD637DBDEA2861ED3B8D89ABE0995B3B14125097FD666D769D300BB169919258001A412773F5BE781
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/remoteEntry.f0866eea.client.js
Preview:	var bWebcorePersonalisationComponentService;!function(){"use strict";var e={cc4c374e:function(e,n,t){var r={"./HomesGuestsLoveCarousel":function(){return t.e("bf9eb7a3").then((function(){return function(){return t("300e7fdc")}}))},"./RecentlyViewedPropertiesCarousel":function(){return t.e("e661b1b4").then((function(){return function(){return t("e3a9785f")}}))},"./SampleComponent":function(){return t.e("702a7b0b").then((function(){return function(){return t("b2dbdbc7")}}))},"./SimilarPropertiesCarousel":function(){return t.e("a4087d56").then((function(){return function(){return t("d9a597c0")}}))},"./UniqueStaysProperties":function(){return t.e("6289254d").then((function(){return function(){return t("088f7f58")}}))}},c=function(e,n){return t.R=n,n=t.o(r,e)?r[e]():Promise.resolve().then((function(){throw new Error('Module "'+e+'" does not exist in container.')})),t.R=void 0,n},o=function(e,n){if(t.S){var r="default",c=t.S[r];if(c&&c!==e)throw new Error("Container initialization failed as

Chrome Cache Entry: 659

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 540x270, components 3
Category:	dropped
Size (bytes):	31567
Entropy (8bit):	7.969919187110913
Encrypted:	false
SSDEEP:	768:i7dZuXlHWsVHQ00x3zIYEPVKHVeB7+Vz+yd9fSoM:i7LasOYx3OPVkZz+ctM
MD5:	5C1E97DC9685017D4A764D7B97EDB4E6
SHA1:	AB82DAAC1C7F3EB7C7F3BA364314CDD732B02F5A
SHA-256:	48334DEF61EDA06E5D5F67AF8FF89206583DC90FFA1E0CB5F599327CB0608C28
SHA-512:	E505A4AD31DD87292B1638661CBCA1EFE1CEF379457E44A7B1E8863D8856E048BCE16AC404A389653FB1AFB8D05A6BB8A4EDFEE1E6BEE5E1C62FAE2C7D9F317F
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..Kt......F.\|.W.QY....0.'..5r.Na&b.I...\sq........pH?3t<.u,h...R1...j..S.Fi....}x..(.2...Ca...9.gR.#<..y....^.r(..'J.............CZ.r.o.\|.V9a...p.hFB[.-.. .z.m..I#v.q...H..T0.$..R)..h.+......JN...$.5.......$`..[...z....[.[T...Q....?...W...0H.n.nOAV-...5....!Vo^.#..5..6..&......q....,*.$.t..8.>....h....J.c6v.Fx..N.4Fx.....<.GL....im0...I$D...7.........

Chrome Cache Entry: 660

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	767
Entropy (8bit):	4.859607813643146
Encrypted:	false
SSDEEP:	12:hY0ZuMCujsRB82f//GSECIGtD1gXTvNMRMFObXWY2eXycR4EdX8BOevTegbQL:hY0ZuMCugRx+SECV2pQDmY/AEF8BLE
MD5:	E96AE5E2423017C0D61B6246D249634C
SHA1:	7E317AEDDE4319B9B8B0B467E04C89D9D69D2A43
SHA-256:	5A28C67F983F26C9311A70C01F465ED653F8B3E72D001C8DD1EBDBC4354AF7E9
SHA-512:	5DF2D075D069300AEBCA1A2A3DB99D1B42F0D472CFB66BB23F92054315CF1CA654A1AA2D940068908157D6102681C43CA8D7481A163C169B82D3083ABF8677B5
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<html lang="en">. <head>. <meta http-equiv="X-UA-Compatible" content="IE=edge" />.<meta charset="utf-8" />.<meta name="viewport" content="width=device-width, initial-scale=1" />.<title>Booking Flights</title>.<style>. body {. background-color: #fafafa;. color: #333;. font-family: sans-serif;. padding: 1em;. }.. .container {. text-align: center;. margin: 0 auto;. max-width: 980px;. }.. .error-message {. padding: 32px;. text-align: center;. font-size: 24px;. margin-bottom: 3em;. }.</style>.. </head>. <body>. <main class="container">. <h1 class="error-message">Page not found</h1>. <p>. <a href="/">Go back to flights.booking.com</a>. </p>.. . </main>. </body>.</html>.

Chrome Cache Entry: 661

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	"https://www.booking.com/js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=e4de82b919b800e4&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|4,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|2,cCHObKdBdUHINPSXeHDALOLOLMO\|5,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv="
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 662

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 210x210, components 3
Category:	downloaded
Size (bytes):	5960
Entropy (8bit):	7.9084645685709125
Encrypted:	false
SSDEEP:	96:ghyE4w7p9vICe8XzrjbUl+2ugeDhHm3gYlzulAgmmiwiqGsf4CbB8Cf:myFw7pZNRr8g2ugYhUVRECZqGsfJbBNf
MD5:	1CC60BDB894DFC7A8DDAAD39A311DB2D
SHA1:	961EAA2A575269BBE4D8DB3CD75E28489FA819CA
SHA-256:	E5F480190A50287822519A5673DD9CCDAD45D16F9509806731E0168BBACE7F88
SHA-512:	973403FAA98E6AC48E21EF0F24D8EB6CC32BB80D84277129E2ECA660272EFCB364C4E859951640E2804263B4A8415F3DE1A9D6C6FFD2776C501F6F2871C8A319
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/city/square210/688940.jpg?k=8c6ae0b4434360802cfc87335163787de421d3fcb7df1a4bdffbc5f930fa8f2d&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....I..V.....l.8....G.#2.^.Q.J..'....&0OC.\.9.....#..!.z......fa..6...#Z!.K.....?.4..O.K.Hm.....+2.L:.M......r.4.......3B!.N.8~.m..4....N......3l....:.<....ad.....4..z.....iE....).a..B...Z Ojc[...!4fy4y5...j<.Us.c;.......&.....V3..j<.j...R.>.s....Eiy4R..).9.{5.D..i..D..2L.rB.q.......`..K..m.;V7>..#.Bj'.%a.vf..ol..."..j....&.D..sQm4...Y.Ni..~Q.S....Y\..Hd

Chrome Cache Entry: 663

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	52
Entropy (8bit):	4.296217602590056
Encrypted:	false
SSDEEP:	3:OCdXEXnoJEXno69inuSoICkY:OeUXnoKXno699SckY
MD5:	696F7CACE05310572041010EA54EA538
SHA1:	6E0765BB5FA9B3725312AD0606CD772469D7D948
SHA-256:	5C96884DF932B259908BAE22F15AF24ED92EDB400E6BB6617CDF88DCB675418F
SHA-512:	CA33DE4A629BF491C8CEAD4463B88E9C10717A7FFDCC6E837B3420B1D405FB52E3DBA2ED0CCE4BCCA608C312229F904F12F3557D9190803FB1BB2A05F87BCB4F
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISJQnORvfHaFnBOBIFDbDytpQSBQ2w8raUEgUNlJCS-hIFDVNaR8U=?alt=proto
Preview:	CiQKBw2w8raUGgAKBw2w8raUGgAKBw2UkJL6GgAKBw1TWkfFGgA=

Chrome Cache Entry: 664

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (12320)
Category:	downloaded
Size (bytes):	12379
Entropy (8bit):	5.176450085405192
Encrypted:	false
SSDEEP:	192:tv3yCWbZ+zpnRpApsWZlYbzd9n0WuRuWX2EELNr2KP7QtAcsorU5Jg1:tv3yZ/lsuRZX2f7sau
MD5:	42CAB72A22BDACD7EA326DC6C8422BBC
SHA1:	76C15E11DEF8A58EFA1020C576DF0A4FEE1D7F03
SHA-256:	71E463674248A7BDE877341C512C97A45859B31D2B4D81748474EC433C94051B
SHA-512:	738A9176087939ACA14E9CEBE89FCA85185FEBF5AEF06423BA4497E943AAEE4975F06925DB17B5A26C3BD69FC72C3135C6C212A50F1D3FD9923817CD5D72F42B
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/flights/web/static/css/screens-Home.54999444.chunk.css
Preview:	.CheapFlightsItem-module__anchorContainer___HUzeT{text-decoration:none;color:inherit}.CheapFlightsItem-module__image___nhIum{border-radius:var(--bui_border_radius_200)}.CheapFlightsItem-module__textContainer___Cpl2L{margin-top:var(--bui_spacing_4x)}.CheapFlightsItem-module__textLine___rr1kj{margin-top:var(--bui_spacing_half)}.Container-module__container___QbI23{min-width:350px;width:100%;display:flex;flex-direction:column;flex:1;max-width:1100px}@media (max-width:350px){.Container-module__container___QbI23{min-width:auto}}.Container-module__container___QbI23>div{width:100%}.useSideBarSticky-module__sticky___\+iLI\+{position:sticky;top:var(--bui_spacing_4x)}.useSideBarSticky-module__innerScroll___TbSUh{overflow:hidden;overflow-y:auto;max-height:calc(100vh - var(--bui_spacing_4x))}[dir=ltr] .useSideBarSticky-module__innerScroll___TbSUh[data-scroll-padding]{padding-right:var(--bui_spacing_4x)}[dir=rtl] .useSideBarSticky-module__innerScroll___TbSUh[data-scroll-padding]{padding-left:var(--b

Chrome Cache Entry: 665

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1385)
Category:	downloaded
Size (bytes):	1501
Entropy (8bit):	5.294345318137106
Encrypted:	false
SSDEEP:	24:pCeRnGqc9jYhfZqQ+P9sKggminjsle03mHNrVtqk:we5Gbkhf8v9nQmtRUk
MD5:	2980EA90C3F4C27D77BFFBD1527870A7
SHA1:	539A5FDC38B2EAAF9118BCF337C55353FBE35E18
SHA-256:	97473C5D5A46930143691CDA2D7E112551C0AD7EDA321BC5120B80F429F7D3AD
SHA-512:	F91017973B160039D6E494DC1D42AD24A0848D0317FC10E3F113B5E3D60C0236F91F0DC0AB666938FAFCC3113EE7B83F87AE76D1327548742B344D02120B206F
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/eb60141d.cad86b29.chunk.css
Preview:	.f395e522bd{width:100%;height:100%;display:flex;flex-direction:row}.fb0e8491f2{margin-block-end:var(--bui_spacing_4x)}.af0c2122fa{margin:var(--bui_spacing_4x) 0}.d412802652{height:100%;width:100%;position:relative;border:1px solid var(--bui_color_white);border-radius:var(--bui_border_radius_200);overflow:hidden;display:flex}.d412802652:not(:last-child){margin-right:var(--bui_spacing_4x)}.d412802652:hover{border:1px solid var(--bui_color_brand_genius_secondary_foreground);cursor:pointer}.d65598d5f9{width:100%;padding:var(--bui_spacing_6x) var(--bui_spacing_4x) var(--bui_spacing_6x);top:0;left:0;margin-bottom:var(--bui_spacing_3x);position:absolute;z-index:2;color:var(--bui_color_white);text-shadow:1px 1px 1px var(--bui_color_black);background:linear-gradient(180deg,rgba(0,27,65,.65) 0,rgba(0,27,65,0));filter:progid:DXImageTransform.Microsoft.gradient(startColorstr="#00224F",endColorstr="#00001e47",GradientType=0);box-sizing:border-box}.d412802652:hover .d65598d5f9{background:linear-grad

Chrome Cache Entry: 666

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 70 x 26, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2146
Entropy (8bit):	7.8875883951747925
Encrypted:	false
SSDEEP:	48:j/6u3CtuLhUGh0H5UFe2pYo37Esd2gjEj7seiEfE/ODAtLx:jSRuLKA0ZUFnR4sPEUeJf8/
MD5:	27E71A5124018E16EAE0B8897618623D
SHA1:	D0D54D88B04EDFC71F338C19EAB9994632BC6CED
SHA-256:	1D6E86E59AB7235A8343F494C8E8DA6CC02C5A98A75D682401340E6D06935F20
SHA-512:	A9D6F6B881175780E2619843AA88AACE7E94DA178C53C3DDDE691A930C5412FC4CD817009D488757835903D9218758F808AC36C1F828371D57AF91EA9CF3170A
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/img/tfl/group_logos/logo_agoda/1c9191b6a3651bf030e41e99a153b64f449845ed.png
Preview:	.PNG........IHDR...F..........b.....pHYs.................sRGB.........gAMA......a.....IDATx..Y.pT..>...........e....f.+(T.L..KiZ.....`..c;v .....u.M...h.........DJ..RQ..-?!FlB.}..~w./........3s..}..s.{...et.Kyy.....;v.....N..p.....I4=...t..'.BI.,/X..R.0.%.<.....F...i.6..rSJ.......Mgy0x.#.:....YYY....}.....~..L..M...........d.`..t...>Gi.K......)W.x.i?.5H.........Q...-0z..8 ?..IR.G`..N..`p...Q<.t.i2..~)K.G..l\y(4E..y.31.7.(....Wa..>......_RR....6.-..7...Iy..y;......~.<..T....)k.e...D.f...........2.k..0.=.[..D..n...W..V.B..uVUU..."5m.0W._.0a..^.'...V8x.. e.I...H8..... ..N;....".&.J...Hd.l).81....5.c...<.....W.o....U/(..,.O..+.c.ZZZ........L..c...V..[...... .g(.Y..P....>.>.-v?....>..&.?j.A....)5Q...KO....'.l..G...:.b{..#..4.`.[.]..V..20.k.-W.<.m[.q.BA.i........!...,.6.....N...l2.......`......1...o^...iY.]...&.O....\.c.>L.w...:.......u..d9.f.Ld.*....J...=...1....A.!&.c......f.}s....,."..e.....2....)...%..o..I\."_JL..id..c.N.y...k...p.m..A...

Chrome Cache Entry: 667

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 668

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	83810
Entropy (8bit):	5.061521584239104
Encrypted:	false
SSDEEP:	768:58pcPWW6C2sFRGMgxE6i31vpeA3PMRXnCOc4H7QIPSSCR:58pcWW6C+AFBeA3QH7QIPSSCR
MD5:	693E587EE0C56B1EC5EB4A6196DA010E
SHA1:	AE417D4BA3C6D25AA0910AB88DEF73304C9785B4
SHA-256:	D201A5613A376499B25664672751C20F421155D88E7120C6342045B53C2966A4
SHA-512:	D28F970EA41D6FE46480735E01942CCC6AEA232C18D652E8EA1EF03CDD1A9E49FEEBB51E934C81499A7ADB8417D1A50C83F6ED5EC030CF6C42F4D8CB1D2A6961
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/css/landing_pages_common_cloudfront_sd.iq_ltr/af1183ce024d54cd405252c30ee9c08c26b6d4f6.css
Preview:	.bbtool-notification{clear:both;position:relative;background-color:#e6e6e6;border-bottom:1px solid #fafcff}.bbtool-notification--top-menu{background-color:var(--bui_color_white);border-bottom:1px solid #ebf3ff;-webkit-box-shadow:0 1px 2px rgba(0,0,0,0.1);box-shadow:0 1px 2px rgba(0,0,0,0.1);font-size:14px;position:relative;z-index:2}.ultra-focus-body .bbtool-notification--top-menu{z-index:auto}.bbtool-notification--outside-tool{background-color:#f5f5f5}body.bb-sr-mo-own .bbtool-notification--top-menu{background-color:#e6e6e6}.company .bbtool-notification--top-menu{background-color:var(--bui_color_white)}.bbtool-notification--index{margin-bottom:10px}.bbtool-notification,.bbtool-notification a:link,.bbtool-notification a:visited{font-weight:normal}.bbtool-notification--outside-tool a.bbtool-top-menu-link:hover,.a11y .bbtool-notification--outside-tool a.bbtool-top-menu-link:hover{color:#333;background-color:#e6e6e6}.bbtool-notification__wrapper{max-width:1110px;margin:0 auto}.bbtool-noti

Chrome Cache Entry: 669

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (36716), with no line terminators
Category:	downloaded
Size (bytes):	36716
Entropy (8bit):	5.219455971257271
Encrypted:	false
SSDEEP:	768:gT7Evz5Cj857THYp8+32gNz/tefjJaqlSCVDdYCQCrwLchrOhwNZJEJRGVuaFKef:p/kef5FNdtLL
MD5:	83450205FDAE53D35568C0B20EBD7823
SHA1:	B767E5626F5C78A36E8267ADCE0EB4770CC7AF54
SHA-256:	0916F90FFE5B1EB07948B9F85568C812D3CCBB8A05D3B39D10F4D59FCC9E168D
SHA-512:	A5534E8E888C92ACBB5FD97909DA22CD1ADC08F43226482C37DE7880942F1E64C5E9420307E2D2F63073747D8BCCA3BD13A516A3CE2FA40311F59CD571A585F7
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/searchresults_slick_cloudfront_sd/528359eb9f21194adf8c26f81e07c6eb21a2cc89.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(i){return i};!function(i){"use strict";_i_("039b:c970d6c8"),"function"==typeof define&&define.amd?define(["jquery"],i):"undefined"!=typeof exports?module.exports=i(require("jquery")):i(jQuery),_r_()}(function(l){"use strict";_i_("039b:06d74a49");var r=window.Slick\|\|{};(r=function(){_i_("039b:1a9b8522");var r=0;return _r_(function(i,e){_i_("039b:aa04535a");var t,o,s,n=this;if(n.defaults={accessibility:!0,adaptiveHeight:!1,appendArrows:l(i),appendDots:l(i),arrows:!0,asNavFor:null,prevArrow:'<button type="button" data-role="none" class="slick-prev" aria-label="previous">Previous</button>',nextArrow:'<button type="button" data-role="none" class="slick-next" aria-label="next">Next</button>',autoplay:!1,autoplaySpeed:3e3,centerMode:!1,centerPadding:"50px",cssEase:"ease",customPaging:function(i,e){return _i_("039b:47add93f"),_r_('<button type="button" data-role="none">'+(e+1)+"</button>")},dots:!1,dotsClass:"slick-dots",draggable:!0,easing

Chrome Cache Entry: 670

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	https://account.booking.com/_/fvtrpw.gif
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 671

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (54614)
Category:	downloaded
Size (bytes):	194527
Entropy (8bit):	5.167151152412945
Encrypted:	false
SSDEEP:	1536:O2LLHRmQlavvawlUGvBMYQQBiUGs/XfdfpR2Q:XlavvawlUGvBMY7iUGs/Bpf
MD5:	C9009DC966B4C139FFFFE886598AC0C0
SHA1:	12F197F947CF43340804CDE05AC1BD1BBFE5EA35
SHA-256:	5E5EAF9396E8ECD984A3D8F622C5A6EF767AE75AA2BF907305F6BAA56C2A7088
SHA-512:	533395A06300780810CE25B2F3B950D28A1699F8556323477AFAA5E2D246E9C6D598C9305F13C230BD7EC483CAF53A5255CCA35552BEF2CEFFDC0F73FF660800
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/client.38ffee15.css
Preview:	:root,[data-bui-theme=traveller-light]{--bui_color_border:#868686;--bui_color_border_alt:#e7e7e7;--bui_color_action_border:#006ce4;--bui_color_border_disabled:#d9d9d9;--bui_color_destructive_border:#d4111e;--bui_color_constructive_border:#008234;--bui_color_foreground:#1a1a1a;--bui_color_foreground_alt:#595959;--bui_color_foreground_inverted:#f5f5f5;--bui_color_accent_foreground:#946800;--bui_color_action_foreground:#006ce4;--bui_color_callout_foreground:#923e01;--bui_color_foreground_disabled:#a2a2a2;--bui_color_destructive_foreground:#d4111e;--bui_color_constructive_foreground:#008234;--bui_color_foreground_disabled_alt:#d9d9d9;--bui_color_brand_primary_foreground:#003b95;--bui_color_action_foreground_inverted:#57a6f4;--bui_color_action_focus:rgba(0,108,228,.24);--bui_color_highlighted_alt:rgba(26,26,26,.06);--bui_color_action_highlighted_alt:rgba(0,108,228,.06);--bui_color_destructive_highlighted_alt:rgba(212,17,30,.06);--bui_color_highlighted:#cecece;--bui_color_destructive_focus:r

Chrome Cache Entry: 672

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (28698)
Category:	downloaded
Size (bytes):	28814
Entropy (8bit):	5.402197180263046
Encrypted:	false
SSDEEP:	384:nCAHg500tD1a85f5KDid0sIbqMr7GsQH8ip+oI+s2+W4+mB+LqB8J+AVxV2VSX8T:Ce0tD04FMry91H20XO9w2
MD5:	A687E666EE59C8527C21313ADBA1BF8F
SHA1:	C3554389E8C69A798465FD72C8BA33EB479D0D39
SHA-256:	D16079FE25B4BCAACFEE1B5BBB61A37AF318A6DDA9CCDBC285C5B51F9837DCAF
SHA-512:	10C220F8F2AE3D8527FD574731CE307D3E9083F900CB450FADACBA7242FF3E9C8F04EC044AEEF83317A0EE0CF2B43F4E5EA1E0D8DCF20FA491480CA6E4628972
Malicious:	false
Reputation:	low
URL:	https://q-cf.bstatic.com/psb/capla/static/js/remoteEntry.4935f89c.client.js
Preview:	var bWebShellComponents;!function(){"use strict";var e={"4edbbc8a":function(e,n,t){var c={"./AccommodationFooter":function(){return t.e("81da5f32").then((function(){return function(){return t("929bb6a1")}}))},"./AccommodationHeader":function(){return t.e("dc32f6b7").then((function(){return function(){return t("81e13fe6")}}))},"./AirportTaxiFooter":function(){return t.e("a9250ff2").then((function(){return function(){return t("c87e9946")}}))},"./AirportTaxiHeader":function(){return t.e("dd3bddab").then((function(){return function(){return t("5b336c3c")}}))},"./AirportTaxiMinimalFooter":function(){return t.e("51555e66").then((function(){return function(){return t("362aca0d")}}))},"./AirportTaxiMinimalHeader":function(){return t.e("ccbcade3").then((function(){return function(){return t("dd48b9f8")}}))},"./AttractionFooter":function(){return t.e("1c65b09f").then((function(){return function(){return t("bbb9d7c7")}}))},"./AttractionHeader":function(){return t.e("02f6e1c9").then((function(){re

Chrome Cache Entry: 673

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6427
Entropy (8bit):	4.861223156043332
Encrypted:	false
SSDEEP:	96:FQef+XH7M70djbWejwZ1ICFBr81YO7+VlyZ2PK/ppdkvbMFIKuFsVzgoAytvPBxr:FsrMYoZdD0dcg/HavbKm89
MD5:	D6865979621492BAC92096993C559C43
SHA1:	6FE79DBD9D775D24ACA921E5B6ED9EEC4572F31E
SHA-256:	3D5DB88A81FF70F7D26E336FC8ED4188F5AE5032F97D334E4288322889096B77
SHA-512:	2C6D42383FA0C6C441BB810B0E25322ABAE62903B3E2DC2AAB563F4DA6419DB196FABE1D1229583F682180C3A144E5709E2C3EE529EF53211010B11A05D9B3D5
Malicious:	false
Reputation:	low
Preview:	{"chunks":["b9a82cb8"],"experimentTags":{"YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO":1,"HMbOHNFPBJYIYKcPNSNHRUeBOFO":1},"featureNames":{"IeZXXDNFVFKOUYLLFJYbCceMNPVbPSUabSccETKe":false,"EBDIbIbXDeBGGTcZJFfHbeMPET":true,"IePFbJMFVFKOUYLLHNOVRe":true},"seoExperimentTags":{"YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO":0,"HMbOHNFPBJYIYKcPNSNHRUeBOFO":0},"copyTags":{"webcore_shell_footer_booking_statement":"{b_companyname} is part of Booking Holdings Inc., the world leader in online travel and related services.\n","webcore_shell_footer_copyright_statement":"Copyright . 1996.{currentYear} Booking.com.. All rights reserved.","a11y_webshell_close_currency_selector":"Close currency selector","a11y_webshell_close_language_selector":"Close language selector","a11y_webshell_header_tools_currency":"Prices in {selected_currency}","a11y_webshell_header_tools_language":"Language: {selected_lang}","traveller_header_account_currency_all":"All currencies","traveller_header_account_currency_most_often":"Suggested for

Chrome Cache Entry: 674

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	8854
Entropy (8bit):	7.980513008618794
Encrypted:	false
SSDEEP:	192:bLY7fUfSQozoRJDQvni9RYjGMeKfi/ynlApCPcuHwDq046G:bLYpQSsTYaMeQi/ylhPvwm046G
MD5:	1DF09AD32131CE5BFADC6B1A72C0C7AA
SHA1:	E965F4FE37288C58C4CE03F3916BA018C10A4E3C
SHA-256:	EE4807FF577AD59FF427FB0314FB708D42DD694B2F55448359468306EE7DC720
SHA-512:	D0040580C900EA387E5324D4EDABB9C35042E8AB9764B67A4378B457740C0314E7EB891B4B6C7ED1273105CF828CAD3DFC579B50EA6F1A241C3E16DC04ABB7DB
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/square250/689523.webp?k=70ca656d88199dc2b8a04b0bccc877d2c971f409cf9bd5e76c736432579c3467&o=
Preview:	RIFF."..WEBPVP8 ."...........>m2.H&$"........em.n.!..7.i....a..k9.2..L0.pZ.o.....?.....9......Z.{........b?v...;..{}.....g.........o......X..764.fK.r..IT{....h...1Z....&5...! ......\|...?....}..s..[p.k...2;R..F.......o.V....wo...83.v_K..H'.{+\|.J.a.kI.4:.....[.G}.Ti.v..]!..0...[.?..k.^.WwK....C.J.....C~....n...{.........^.DNh...k.y.T\..L."<E.O;k=..B.{l..:h.D.h.4P.[5...)@.(0..f.-..'"F!.._j).h...~&Pq.&...?U..SJU3d.{..tO..r.......A_^.n...N~.+.....T..A.j.#Z)..k\|....<6K...=L.h..Gd3`I..s.uGc..I....y..@.v...v.........o.XI~.....]....Z".u..s.l....$.....U!...H,..7d0.........D.NQ.}..2....I Y`...Y.~ku......F.&....{u.:............'+.>.2}A.......p.!.....=...#....9t4.(...G.$._c...7u...G<y..3G}.ri.......T..;9.V..=..fM.5k......n.m...@..x.b../.L.6.............AO>.....H.@2..H......O.....WIa.D"84...{j....D\|...ZX..%.M.u.=....v.o./R+X.R...3......I.?...6.X...Ih...S..j..r...y.%..j.M0......Y.u..]&g.)..5.5..2....6..0....An...O....]..Kyb ..g....U.V..A./O=9O.I..:..7.

Chrome Cache Entry: 675

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	349603
Entropy (8bit):	5.132956593940823
Encrypted:	false
SSDEEP:	6144:6idI1r1yYDNedS6h8bso0sAaxIe04+7IvttoH7QIPSSC4n1gDLzM:6idISKNedS6hB9e04+7IvttoH7QIPSSn
MD5:	15D4AC7C2330FD09F62F0D3C3E97DECA
SHA1:	B94E29B130610117299DF424B48C132DCE717EA7
SHA-256:	916961488BAC7D1FDB5A35843AD344307C8CC2E5B644675E77219DDA7652B5A4
SHA-512:	41F774B7AD3A7A2623DFE55B4FAC01EB4831274968E7C97C69E6BD6B36B8E6BBA0ED7DFAAB7F9D86975C54F64DD97A6C2783842F26899B6BD66CB29E63E28BC0
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/css/index_cloudfront_sd.iq_ltr/903b49ae71c75322442d1bc9a0dc298bb8a6e32e.css
Preview:	.destination-suggestion ul,.destination-suggestion li{margin:0;padding:0;border:0;vertical-align:baseline}.destination-suggestion ul{list-style:none}.destination-suggestion a:link,.destination-suggestion a:visited,.destination-suggestion a:hover,.destination-suggestion a:active{unicode-bidi:embed;text-decoration:none;color:#0071c2;font-weight:normal}.destination-suggestion a:hover,.destination-suggestion a:active{color:#febb02}.destination-suggestion a:visited{color:#838383}.destination-suggestion .tab-content .tab-panel{display:none}.destination-suggestion .tab-content .tab-panel.tab-panel-active{display:block}.destination-suggestion .tab-nav li{float:left;margin-left:-1px;border:1px solid #c8c8c8;border-width:1px 1px 0}.destination-suggestion .tab-nav li a{display:block;padding:5px 8px;border-bottom:1px solid #c8c8c8;background-color:#fafcff}.destination-suggestion .tab-nav li.tab-active-indicator{display:none}.destination-suggestion .tab-nav li a:link,.destination-suggestion .tab-na

Chrome Cache Entry: 676

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	870116
Entropy (8bit):	4.584445012817421
Encrypted:	false
SSDEEP:	3072:DyneVHECLcQqzl0Gxj1TiP/JQoFjW4QmiA4QXtmqNtYDdeAmeMjcXwFAIbtI/ocL:Wvxj1TiP/JQoFjWc37hovkcqZvfbSbT
MD5:	CBED6C40F80B88278FE92B7987F24D10
SHA1:	C11AC13D806CA5E2B071EEC7DFD76E78B07C5487
SHA-256:	5A8F37B9CE462BB9B32CE117050E0491FA3BCB13F8998E54250CBCAB3957D675
SHA-512:	EDB775FCD50B71B2D6A807CCA12417933E536986797390C7B02DA562D60C24CA02A46371D9CE393BFBEB24757CCF126AE5C6C4D40ECB6FCBF233553FDAD7F7EB
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/4e596c2c.d3513b52.chunk.js
Preview:	"use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["4e596c2c","64ca3669","b8cc452d","5eacf50d","c58d9455"],{"51a388c3":function(a,e,t){var n=t("6e8b4072");e.Z=n.Z},"44f0a6f8":function(a,e,t){var n=t("ead71eb0");e.Z=function(){return n.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},n.createElement("path",{d:"m 24 12 C 24 5.37 18.63 0 12 0 S 0 5.37 0 12 c 0 3.81 1.78 7.2 4.55 9.4 c 0 0 0 0.01 0.01 0.01 c 0.02 0.02 0.04 0.02 0.06 0.04 C 6.724 23.104 9.324 24.002 12 24 c 2.79 0 5.35 -0.96 7.39 -2.55 c 0.022 -0.01 0.042 -0.023 0.06 -0.04 c 0 0 0 -0.01 0.01 -0.01 C 22.22 19.2 24 15.81 24 12 z M 2 12 C 2 6.48 6.48 2 12 2 s 10 4.48 10 10 c 0.004 2.901 -1.26 5.659 -3.46 7.55 c -0.76 -0.61 -1.61 -1.12 -2.51 -1.49 C 14.75 17.53 13.38 17.25 12 17.25 c -1.38 0 -2.75 0.27 -4.03 0.81 c -0.91 0.38 -1.75 0.88 -2.51 1.49 C 3.26 17.659 1.996 14.901 2 12 z m 10 2.25 c -2.49 0 -4.5 -2.01 -4.5 -4.5

Chrome Cache Entry: 677

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	186
Entropy (8bit):	5.1501448784621715
Encrypted:	false
SSDEEP:	3:qQgfjg5anvEVUxQRJzRguRsXETPXIN1f4NoWjUHhJzWLKjUSHJb4CNw1B:qQQjgYkeEJ9uUgL4xjGULA1Hx4CNw1B
MD5:	0FB0DEA325BE6C7BC2504EA59A431FED
SHA1:	5F674E01154547FFC271D14E9FB6B8974C90173D
SHA-256:	8C0457D67BAF7BF919BEDA0F9F3EA46AA39987CF501A67035CF0B13B73F47E27
SHA-512:	76F131CD8C543C692F186AC6ECA48F18E4924F397611BD79AA5F7EC4CBF72654777FF3D0FC48C579190D623082D8C86D175C752E73BDF0464C91C5A118C76C78
Malicious:	false
Reputation:	low
URL:	https://tr.snapchat.com/config/com/54f04dd9-4d34-47ee-87a6-989713215c80.js?v=3.9.1-2402072137
Preview:	!function(){"use strict";try{window.snaptr.cfg('54f04dd9-4d34-47ee-87a6-989713215c80',{"asc":[],"a":["PII","AV3"],"ipg":"40","b":[],"t":"","v":"3.7.5-2401032347","ec":[]})}catch(e){}}();

Chrome Cache Entry: 678

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=6], baseline, precision 8, 799x466, components 3
Category:	downloaded
Size (bytes):	132954
Entropy (8bit):	7.585403686264373
Encrypted:	false
SSDEEP:	3072:WALjM8PVfgPyRiZ9j/DsE0JKt1bmq5GggK:WALvPSyE3j/AE0wbmqIS
MD5:	344D44EF6AEE837A5E3C6797A4A3FE4B
SHA1:	A6460CC7001CA4700FD56AC33BB85808159EFAC1
SHA-256:	E772F5D8D214719D70A969153CB2F1C9A77C4E8D9B76FE3D64F0D8A4E7AEDAE5
SHA-512:	7BE84501A65563C6620A7F535E1460734F9022A2AC634CF7F32D8EC6B97CEC673A966C363BBF26C5AA71939C4E61D330F4039C0AA5C809F59113820F229FB6F9
Malicious:	false
Reputation:	low
URL:	https://tpc.googlesyndication.com/simgad/10475942060785983755?
Preview:	......JFIF.....,.,....1.Exif..MM.*.............&...b.............1.....&.....2...........i.....................V...F....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 679

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 210x210, components 3
Category:	dropped
Size (bytes):	8808
Entropy (8bit):	7.943987588999884
Encrypted:	false
SSDEEP:	192:myliFmoNI0FJJxQR7F9jI0usCdw2GbyGR/H6rWk4z:dliFmooL9jIZq24arWkw
MD5:	45E7C421DEA0B99FE13C0CDD67D6D73F
SHA1:	BCC2D3A8B36FC9DCB020DEC4DBF1EA78014B6341
SHA-256:	8F11594B6847E6739368069387CFF15286326945ACD011453697CF1DA2DA5932
SHA-512:	41D61080FB54E7638B419494A27189BFEF33ED22C388761839DCD7DCD4ACEE40FCE9E4A416FBC1EE324881F364B58CA2E95C92D05361D4EDCC8DAE9EF8C53972
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...e=x....T>A...X..,...d.R(.....z.SG>>...E.D...8.\dqS....4B......N..O....a..v.H!c....jP....."..6`.\|...T.1@..)..8sHc..........w.(.(...4..C.IF.L....Bh...4P#.M..T.R..S...)@...Mu...,..E!...`D.......>R....O.OC....1N.w..........T.....\..c...jQ#z.yt..Kh.q.F.n....;.,..K..R......wRm..@..7Q..m ....h...>.........u.).S.w.n....'..K.QPmj).W+.?Z.6;Vz...U..l.d.^.=).SYZ.

Chrome Cache Entry: 680

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5142)
Category:	downloaded
Size (bytes):	5258
Entropy (8bit):	5.233801057013814
Encrypted:	false
SSDEEP:	96:3ZWPIuZx6YZmZZUisyK+UhKpCSpnyh9c3k1yPS8qxx:3ZWPI0xnZmZZxsaY9ckoq8kx
MD5:	4A228916B32250D7386CC77D8886133C
SHA1:	8EC947E302D6E99E3B963EEDB84634603809C0ED
SHA-256:	34F7569B0F660BEBE6952942A794E500FB723496FE16122C859B4BDAFDB0F2E2
SHA-512:	2DE9223B665DC39ABAB9F1E8605A46C89CEA88F1A0EA7E17A5B13A743D4B6D3287ECAC054F790BE6C45A576732936EAAA9220D560B3145C3DC09FE94D7F1B7FB
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/da34a25a.596e2bbe.chunk.css
Preview:	.c96d814461{background-color:var(--bui_color_accent_background);border-radius:var(--bui_border_radius_200);box-shadow:var(--bui_shadow_100);display:flex;padding:var(--bui_spacing_1x)}.c96d814461>*{margin-right:var(--bui_spacing_1x)}.c96d814461>:last-child{margin-right:0}.c96d814461>:last-child,.c96d814461>:nth-last-child(2),.c96d814461>:nth-last-child(3){flex-shrink:0}.e8c7146980{align-items:center;background-color:var(--bui_color_white);box-sizing:border-box;cursor:pointer;display:flex;flex-grow:1;font-size:14px;height:50px;justify-content:space-between;min-width:10%;padding:0 var(--bui_spacing_4x);position:relative}.af65965120{padding:0}.e8c7146980>:focus{outline:none}.de4cb1f9fd{background-color:var(--bui_color_destructive_background);color:var(--bui_color_white);left:var(--bui_spacing_4x);padding:var(--bui_spacing_1x) var(--bui_spacing_2x);position:absolute;top:100%;z-index:var(--bui_z_index_1)}.de4cb1f9fd:after{border-bottom:6px solid var(--bui_color_destructive_border);border-lef

Chrome Cache Entry: 681

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2340), with no line terminators
Category:	downloaded
Size (bytes):	2340
Entropy (8bit):	5.886613056687124
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08r/7Ac47tzYig3Osuu6:wsbSUtJfxrqLWWWdV6j1P7AnH
MD5:	DD763E43CB055C927B3F1BE327FCCAFC
SHA1:	A7E19EFC4A7D4E1A36CCDA0A3C3843B637600689
SHA-256:	93E0BCC72858AADAF090E5D6F4A7E065ED6A66C20E77BD2C0B085D25C82C4AD1
SHA-512:	4358DBF878717E54E86D65F7888DC70F38D238BB5EBAAC489F9A8BEE4406731A8EB62FCA6EE5D38986ED60C12D91A1DC4ED3982DA7AB0643F503F3A0DE874200
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/973712236/?random=1707417356716&cv=11&fst=1707417356716&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 682

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (51645)
Category:	downloaded
Size (bytes):	350307
Entropy (8bit):	5.393621304488295
Encrypted:	false
SSDEEP:	6144:qpH7ZuqIn70b5GS7y9VSknncVPnTYJJ6f5hJGXRqXLN8EqnmP10j2KUFoQmr:qNjInuTknKPn6JQmr
MD5:	261CD9524DE1941C0ADBBC5AB40E071F
SHA1:	B1D444CB7950CDABA1A586656133D83230716535
SHA-256:	90217691EF650AD862929297EF8A897D5FED3D2A44B042274C20B0529907E375
SHA-512:	7C332A531D7D0DC9485B38834ECA94BE69B8657A2292341A36B11371604A2FF31026F20F02EE3DAB2BAB0C5814A627280925843F347E594A7085776EEDAA231E
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/landingpage_cloudfront_sd/4417f0cf113c3ec51a8190be88e7c373a6d9295d.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};function DSF_url_builder(){for(var e in _i_("ec2:fdb138b6"),this.buckets)this.buckets.hasOwnProperty(e)&&(this.buckets[e]=[]);this.processed=!1,_r_()}function _select_event_cat(e,t){_i_("ec2:39bae2c8");var i=$(e.currentTarget);$(".lp_events_categories_tabs_tab.active").removeClass("active"),i.addClass("active"),$(".lp_promotion_cards_list_child.event_card").removeClass("show"),"ALL"==t?$(".lp_promotion_cards_list_child.event_card:lt(4)").addClass("show"):$(".lp_promotion_cards_list_child.event_card."+t.toLowerCase()+":lt(4)").addClass("show"),_r_()}function _expand_events(e){}function _prev_event_card(e){_i_("ec2:376c6086");var t,i=$(".lp_events_categories_tabs_tab.active").text().toLowerCase();0!=(t="all"==i?$(".lp_promotion_cards_list_child.event_card.show").first().prevAll(".lp_promotion_cards_list_child.event_card:not(.show)").first():$(".lp_promotion_cards_list_child.event_card.show").first().prevAll(".lp_promotion

Chrome Cache Entry: 683

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	10578
Entropy (8bit):	7.981065523671133
Encrypted:	false
SSDEEP:	192:U+oScWULLIV0jJ2eA2+2a4jt5Jye6ZysSLJe8Y3G4FWXBKYhXKW7px:PoScjbjJRAoFtOyheD7MKYhzj
MD5:	712C1671013BF9C4F0407F7FFDB562DE
SHA1:	F3601D6E2652E5A6392B01B6ADC5705CE715F7A0
SHA-256:	9AD5633752679214F8CBFA8B4234DB8FAFA6298EF0CA2824EF023EB12BA096D5
SHA-512:	8531F1D98C0F70D44CC0B84DBDBA0EADA9DEC2CBE3F3A3E9D09DE40E2B7DE26E7D7F1B35BC3B782D93CBC4B5F7CF6031C62F03EB16602D2721E6C41F6B9A700A
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/square250/977381.webp?k=ab236c5e99ba40341684e2d3bfcd8256d36f5e63883350af9faa988cd4d49939&o=
Preview:	RIFFJ)..WEBPVP8 >)..........>m0.G.#.!.T.X...gm..7. ..X....I...UTs.....K....5.....S....R._.......&.~.......;.7......}....?.z..#.......>3...a...G...o.^.:V.......A...M&.y.{..I4..@.qD.......Mcx.J^..woJ.t.,:Wo....Q..<..;TbQ,.\|.K....yQ.........uiF.[.oH.....&..jZ...S.AG...X_...u.D.B.\.v.b.gE..cO:Us=....g..8...?yQd16k..=...P36......@._s/.~#tb.D.L..R..4.Y..T....n((...P..[....\|.....[n....$...G.A...R..<.E..(.....,.../.C.;./t.)......3...6...3.,]F...zu..D.@' .5..\{.7..C...?...@.......pR...f..=...6>s4k..L.;..)S.....=.....d.5.!.....A.B...l.^.o..h...g>z.i.\.g.z..T,vb./#.U....X1.S......_`...7..X........:.vx\].x..V=~M^^.hH.mL..9t%..8C.%..."P6.j."..v.7!pWA....E.x.`z..x7G'.Fo._w1.......z..4J7..7......j..j.........V.'.NMCD.vLc9u:.$:....K...x...1..$(....._.--.1w..)iY:hN..N...?5_....C;Uw.3..Z4.R.X.....~P..N.\|...........]V..H..tA...8.V`Ya...J.(_@..+yB.......3.~.t.j8.4..G.....t..X.r......b..../..._...:.......B&U.....v...S.amO..(.R..".....uR.^./...G....1f........

Chrome Cache Entry: 684

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	7046
Entropy (8bit):	7.9723414964939305
Encrypted:	false
SSDEEP:	192:i3D3Jg+MEyE0GgFStWnZY4/qW0aNsrm51I2X9/v:Gdf0FstWn/q9aNAI9v
MD5:	3E3EEC6325475D013D98DB0B8B238C08
SHA1:	A62E863E9F976C16243D9124AD177EA1C753ECAA
SHA-256:	1D938B1F6B50A93EDEE83518D14BE92AFA0AF400FAA588E6991BEA31B76BB1CE
SHA-512:	6CBD2F4EAF025020B8CB8D7277FD2D0F1912AE07444511950DD935CF041BC75068B854DBFA22DEAFE7203FF661ABA7CA4124CAFBCC2581AEB00D548926086806
Malicious:	false
Reputation:	low
Preview:	RIFF~...WEBPVP8 r...p........>m0.G.#...4{....cm3..4...A.I ?\...:v\.W./F_-.W#<2<{9......O...GS.H......5.o..E1OS..W.y...?...tF.7.......0.E.Z.{.g.Ry../.b..=._.p4)......pL..\..4.K...H.>}$..~z..kg..}.i..g..z..3P4l..\G9WW.....h.I<DGA..d..:......Y..6`F.IP....T...g\|B..........[...o........nr.:...`~...1..M.i...xu...Q.h.c..r.nu5P)LVY7.9...h"....g..A.B.q.;0..P.N#r.....;T.N.)/..T8?p..........n....R?w\R>..q.....].d...hx".D\s.G&....?..v..B...&.&abu....\<b..&..X9"\|.H..N...!Q..A,.,.9-....}...Q.....#...%..X. '..k.1..%..7J.....5}..cG9...rH0h...(=......@Q.+o`....n...1V.........E...k$I2.2...9..S...e.y:........?.).."......[...D..JB.......9e.-8.k..<.2J..O.k...d..[F..!_..;7.4....k..."...I.@5:.E..{.e.:A....1... .\9.....@RjH.._[..P.N.^...........GG:I.? =~$.h4...F.T.S......+t.[..C..=..._..L..t.J.. K..~D0....HT..........q...v.....e..2a..L^h.......$.L.....(>..D....".%\|P\..t.f..j..}....l....m...\|;.9.`r..Y.5....\...A.....=a.I"...g.x.j..n.S:...i..P.>D...T..%*5.

Chrome Cache Entry: 685

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (28698)
Category:	downloaded
Size (bytes):	28814
Entropy (8bit):	5.402197180263046
Encrypted:	false
SSDEEP:	384:nCAHg500tD1a85f5KDid0sIbqMr7GsQH8ip+oI+s2+W4+mB+LqB8J+AVxV2VSX8T:Ce0tD04FMry91H20XO9w2
MD5:	A687E666EE59C8527C21313ADBA1BF8F
SHA1:	C3554389E8C69A798465FD72C8BA33EB479D0D39
SHA-256:	D16079FE25B4BCAACFEE1B5BBB61A37AF318A6DDA9CCDBC285C5B51F9837DCAF
SHA-512:	10C220F8F2AE3D8527FD574731CE307D3E9083F900CB450FADACBA7242FF3E9C8F04EC044AEEF83317A0EE0CF2B43F4E5EA1E0D8DCF20FA491480CA6E4628972
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/remoteEntry.4935f89c.client.js
Preview:	var bWebShellComponents;!function(){"use strict";var e={"4edbbc8a":function(e,n,t){var c={"./AccommodationFooter":function(){return t.e("81da5f32").then((function(){return function(){return t("929bb6a1")}}))},"./AccommodationHeader":function(){return t.e("dc32f6b7").then((function(){return function(){return t("81e13fe6")}}))},"./AirportTaxiFooter":function(){return t.e("a9250ff2").then((function(){return function(){return t("c87e9946")}}))},"./AirportTaxiHeader":function(){return t.e("dd3bddab").then((function(){return function(){return t("5b336c3c")}}))},"./AirportTaxiMinimalFooter":function(){return t.e("51555e66").then((function(){return function(){return t("362aca0d")}}))},"./AirportTaxiMinimalHeader":function(){return t.e("ccbcade3").then((function(){return function(){return t("dd48b9f8")}}))},"./AttractionFooter":function(){return t.e("1c65b09f").then((function(){return function(){return t("bbb9d7c7")}}))},"./AttractionHeader":function(){return t.e("02f6e1c9").then((function(){re

Chrome Cache Entry: 686

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	5436
Entropy (8bit):	5.422015703391253
Encrypted:	false
SSDEEP:	96:NOLIVc+u5OLzNROLukVc+utOLuBN1OLNFlOLNTFZKOLNZOLNW3yOLNwOLN8Vc+uh:YyLS5JjNFQNDN8NW3XNtNGqN+uk+9iEx
MD5:	AC207FB8EDBAC95F1413D004D91BC846
SHA1:	9C1B32B6490B3E152F3AF2BDFE470B0D2878C7D1
SHA-256:	0157BF11844AA35880F0F0EB506B969101E9F0C3FA2EEB029D896CA17C0049B2
SHA-512:	A8656C1F020726519112C956BE955A371A9D304076F4CCFAB50FB052B7114493CF2A506C1AAF10F7EC86EDCA4A23AA3E14E409D7C37BFA9DB437E1F68B4F0DBD
Malicious:	false
Reputation:	low
URL:	https://fonts.googleapis.com/css?family=Cantarell:400\|Oxygen:400\|Roboto:400\|Ubuntu:400&lang=en
Preview:	/* latin-ext /.@font-face {. font-family: 'Cantarell';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/cantarell/v17/B50NF7ZDq37KMUvlO015gqJrLK8.woff2) format('woff2');. unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;.}./ latin /.@font-face {. font-family: 'Cantarell';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/cantarell/v17/B50NF7ZDq37KMUvlO015jKJr.woff2) format('woff2');. unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;.}./ latin-ext */.@font-face {. font-family: 'Oxygen';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/oxygen/v15/2sDfZG1Wl4LcnbuKgE0mV0Q.woff2) format('woff2');. unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+

Chrome Cache Entry: 687

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (31997)
Category:	downloaded
Size (bytes):	275294
Entropy (8bit):	5.791794100205205
Encrypted:	false
SSDEEP:	6144:zLbrEybJFmZ6ACcd5m3xWge8snrES8bdi:PEop+
MD5:	DC5BE92988D9CC83931C8660DC2A71C2
SHA1:	BDF6785153B8A8ADA1C0824EE13FE0A556953764
SHA-256:	0E3CD6436C3188852C7BC0A21B4C6789C22306FE5F5D64C1507D9F24590F7670
SHA-512:	7D2717B2175BCFB74E791491EE506737D153CC5E257D41DAB88C166114BB73EF984E8A772E7D8E03AE5CE609C48738A14912E4A800186133DAA4C64B0A7B3F88
Malicious:	false
Reputation:	low
URL:	https://r.bstatic.com/libs/asec/btmgmt/px.v7.5.3.min.js
Preview:	// @license Copyright (C) 2014-2022 PerimeterX, Inc (www.perimeterx.com). Content of this file can not be copied and/or distributed..try{window._pxAppId="PXikKuL2RM",function(){function t(){return window.performance&&window.performance.now?window.performance.now():Date.now()}function e(e){return e&&(pu+=t()-e,bu+=1),{total:pu,amount:bu}}function n(n){var r=t(),o=hu[n];if(o)a=o;else{for(var i=mu(n),c="d8jF4yC",a="",d=0;d<i.length;++d){var u=c.charCodeAt(d%7);a+=String.fromCharCode(u^i.charCodeAt(d))}hu[n]=a}return e(r),a}function r(t){var e=Ou[t];return e\|\|"\\u"+("0000"+t.charCodeAt(0).toString(16)).slice(-4)}function o(t){return xu.lastIndex=0,'"'+(xu.test(t)?t.replace(xu,r):t)+'"'}function i(t){var e=void 0;switch(void 0===t?"undefined":Iu(t)){case wu:return"null";case Su:return String(t);case Au:var n=String(t);return"NaN"===n\|\|"Infinity"===n?Cu:n;case Tu:return o(t)}if(null===t\|\|t instanceof RegExp)return Cu;if(t instanceof Date)return['"',t.getFullYear(),"-",t.getMonth()+1,"-",t.g

Chrome Cache Entry: 688

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	dropped
Size (bytes):	10257
Entropy (8bit):	7.9278460122891286
Encrypted:	false
SSDEEP:	192:mgARxUS0Dgu/UtwsBC1Rx7z0OPhgKy55wopcaiJUlK7AytFGDKOziV:3ARCH/UuZz5P52SUluA8IKqiV
MD5:	5F58A2EEB3F0B1D3CE899E3C629368A5
SHA1:	3DBABBE322B0EC1CFAF64ACFDE88D5ED67B674B1
SHA-256:	FA9F5DBE5AD251EB1A7DA4628C3D1CC55C9FF380671A9D7D2B070BF4E2C2324E
SHA-512:	41EEB02A2EDC6F19C53C526C8D329C0D13C710955D60D9D44E648D73531008DE7279D9365FFF2F2DACD93A6C080F1591D6720D0C2B8FA55928C81C1D646B26F3
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..%.z.H.sY...R....s{....4.....Is.../-.N.z....H50.......=..J>....`....Z...E.7b...-}..O..#h..?.....X....._....~...]...`.}....).P.6.AF..?}..a......=.:...v.AN.=..@........To.N.....b....!.l.....d..I$..e,I'$.)d9#5i......S....2.6=.s....[.......?,.\H^V,..D.u..}.K\|.?$C........*.9.oV9.4U.J).u...Sm.....!gd.....I#W.p}M6E..1....h.................Z..w/=.i....9

Chrome Cache Entry: 689

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 690

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65532), with no line terminators
Category:	downloaded
Size (bytes):	198848
Entropy (8bit):	5.544327695282034
Encrypted:	false
SSDEEP:	6144:+VnOHxa476fynqBrkgCI037ufHfJG9ryXLZ6kqU:+UV6f9
MD5:	7CB101ED833498EE8C94867F2FEF745E
SHA1:	94DF8939A4DDC6849F008274772F51306F1CFABF
SHA-256:	E3B473F80C81B43F6547C7B848DDF863016745674072F415AFE22FF33C3F6B29
SHA-512:	59A7419E43D43E1D50C5286D7DFE6DD944B0BA058522562CB7ADEB5A39645F85BF1AAC25F5C82F8E47A0AD37E5B70F60708D88A0E8C91A4297C5D5D4F367BA2F
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/searchresults_cloudfront_sd/cede9dd040e94f8940ffa9b1176616cd398b0973.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.searchresults={loaded:!0,run:!1}),B.define("component/dismissible-item/block",function(e,t,i){_i_("cb9:1d6e38f0");var n=e("component"),_=e("dismiss-item"),r=e("read-data-options");i.exports=n.extend({init:function(){_i_("cb9:60262eac"),this.options=r(this.$el,{itemId:{name:"item-id",type:String,required:!0}}),this._bindEvents(),_r_()},_bindEvents:function(){_i_("cb9:bc2d0b27"),this.$el.on("click",".js-close",function(){_i_("cb9:5fb0e455"),this._dismissItem(),this.hide(),_r_()}.bind(this)),_r_()},_dismissItem:function(){return _i_("cb9:40f33ccd"),_r_(_(this.options.itemId))},hide:function(){_i_("cb9:9a2d9335"),this.$el.hide(),_r_()}}),_r_()}),booking.browserStorageHandler=function(l,e,d,u){_i_("cb9:a11e61ce");var f=!1;try{(f=!(!l.localStorage\|\|!l.sessionStorage))&&l.localStorage.setItem("btest","1")}catch(e){f=!1}var n={_readCookie:function(e){_i_("cb9:51

Chrome Cache Entry: 691

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	120436
Entropy (8bit):	5.336222005752591
Encrypted:	false
SSDEEP:	1536:meu5rTiSJ2lBJs7gV+3FxuBIRwTcDmUrdK6ERYFHUTu4w3:mdISJsJb+1oWRycmRaHUTu48
MD5:	666F1D5F09457615243BF4310F5C3E48
SHA1:	9B4F21312BBF59A1E30ABF4E4DB6CCC5A7AA597F
SHA-256:	4EDF6972E93E28D325080452B9E82A312493E68327E9CF374C27D9502F07176D
SHA-512:	4940BE56B5BF4D1D6F655249A99C831DFAEEC7DC9AE63C8EC1FD2E30C4657376C5255823DF2E037A8FD1BAA3F37ABA0930A7A31DF71F31E8ABAAB547D9566EE6
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/atlas_cloudfront_sd/7aaea4329a86dd9e6dc4d51a92fef5573f6f9c09.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.atlas={loaded:!0,run:!1}),function(){"use strict";_i_("d0b:3557c07a");var t="Atlas/";function i(e){return _i_("d0b:212232c8"),_r_(t+e)}function e(e,t){_i_("d0b:9d1725e1");var r=[].slice.call(arguments,0);return"string"==typeof e?r[0]=i(e):Array.isArray(e)?r[0]=e.map(i):Array.isArray(t)&&(r[1]=e.map(i)),_r_(B.require.apply(this,r))}B.atlas=B.atlas\|\|{requirejs:e,require:e,define:function(e,t){_i_("d0b:6f103607");var r=[].slice.call(arguments,0);r[0]=i(e),Array.isArray(t)&&(r[1]=t.map(i)),B.define.apply(this,r),_r_()},getVariant:function(){return _i_("d0b:fa3ca699"),_r_(0)}},_r_()}(),B.atlas.define("jQuery",function(){return _i_("d0b:2b36fd1f"),_r_(B.require("jquery"))}),B.atlas.define("util-array",function(){"use strict";function a(e){if(_i_("d0b:9f857ed0"),!Array.isArray)return _r_("[object Array]"===Object.prototype.toString.call(e));return _r_(Array.isA

Chrome Cache Entry: 692

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (5978)
Category:	downloaded
Size (bytes):	569973
Entropy (8bit):	5.9544740704495265
Encrypted:	false
SSDEEP:	6144:Sq6GsvoSIeOG0tKFKMz4JSc1HTRztpI3vpxnJMO+jloOzHVhQMdMjSG:SMgo14YDCV
MD5:	E96DB1B721F560F4086B3CC69103CBA9
SHA1:	0F802F2D914716EC459BC3507143B70AF7558131
SHA-256:	E9F0E57C38B5342AD7F3D5A22FD5170D0765970527D3B1B2D95B330878315FA5
SHA-512:	9E1461EF579F616B0725A4BCE766F5B9959DD9FADBDFFAC3E9859F037927C31C6ED18E1EB1F865C76E31C644E6DD6DB06DC354DB1967CBDC145DF510FE6985B7
Malicious:	false
Reputation:	low
URL:	https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d
Preview:	<!DOCTYPE html>. .You know you could be getting paid to poke around in our code?.We're hiring designers and developers to work in Amsterdam:.https://careers.booking.com/.-->. wdot-802 -->.<script type="text/javascript" nonce="sgM9tTbQfAjYkS8">.document.addEventListener('DOMContentLoaded', function () {./*. provides the current user's cookie consent.* in order to use it:.* 1. inline privacy/cookieConsent.js in the page you need to use it..* please note that this library relies on window.PCM.isCountryNeedCookieBanner to be initialised.* before using (calling getValue function) it.* 2. in your js file:.. var privacyCookieConsent = B.require('privacyCookieConsent');.* var consent = privacyCookieConsent.getValue();./.B.define('privacyCookieConsent', function () {.var consentGroupIsAllowed = {.analytical: 'C0002%3A1',.marketing: 'C0004%3A1'.};.var optanonConsentCookieName = 'OptanonConsent';.var optanonBoxClosedCookieName = 'OptanonAlertBoxClosed';.var halfOfYearMillis = 180 24

Chrome Cache Entry: 693

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65455)
Category:	downloaded
Size (bytes):	84714
Entropy (8bit):	5.769881851999303
Encrypted:	false
SSDEEP:	1536:9G1vdjukJpvXWdzye11hbNilJe8R8PwMu:jkb+dGerilJzt
MD5:	570A26CFFE5C8621685E1E4FBDC430E1
SHA1:	65F96D0A0603BECD351953767B00DD5A2B65BD1B
SHA-256:	58CA51DFD7E32EAF5CA25E4E5882F9804CB7AFDB5BD8A03F5EEA1185B0A61384
SHA-512:	F48C63D9F27DF57262FAEEE5DBE71E0AD5506C7C0C763948CD69D8B25A11E9639E736431CCDF02ED16735928744C35EDC285BCD21A4606031396DA18A6C708DA
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/cfbdd235.02b9cad2.chunk.js
Preview:	/! For license information please see cfbdd235.02b9cad2.chunk.js.LICENSE.txt /.(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["cfbdd235"],{bca1141e:function(e,t,n){"use strict";var r=n("72bf8c83");t.Z=r.Z},e908bbd3:function(e,t,n){"use strict";n.d(t,{Z:function(){return x}});var r=n("3d054e81"),i=n("dee2534d"),a=n("ead71eb0"),o=n.n(a),s="a529739de5",c="fe04f404b8",l="f538ae62ac",u="a244555425",d="a6271fb6c2",E="edb4db1de8",_="e98333fe6c",f="bc476201ed",m=n("c91f1a4c"),T=n("975f4b85"),A=n("6356c4a8"),I=n("6229d898"),h="e714215256",N="cb32f1ced0";var v=e=>{let{title:t,subtitle:n,variant:r="strong_1",titleLines:a=2,className:s}=e;const c=o().createElement(i.Text,{variant:"small_1"},n);return o().createElement(i.Title,{className:s,titleClassName:2===a?h:N,subtitleClassName:h,variant:r,title:t,subtitle:c})},R={stars:"d542f184f1",strong:"bca48d277f",ratingWrapper:"d22e41465c",triggerWrapper:"ebc0e717e3",additionalIcon:

Chrome Cache Entry: 694

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65397)
Category:	downloaded
Size (bytes):	1093410
Entropy (8bit):	5.1401295490309895
Encrypted:	false
SSDEEP:	24576:adavD7ci/Kf21N4s9XXa/agtX/Ax60UYDxH:ad2nmm6fYDN
MD5:	248FE7FF50064CF48442AEFE046B1E98
SHA1:	EFA0BE3B8A37445BAD5CB7A319F51A8802D67640
SHA-256:	8AD65E84EBD7379238F44B38A7207D37E563978AC448F9D9A39ADF7DEDD714B7
SHA-512:	4CFEAB43F8D328DCC37D22820CBD28F1F430F8C92EA304CB26DB9C12DBD5AA6A83E31C912362EC8B4A1EB5032D8D1F8DF5198B91406E60181965A3CBDB3BB972
Malicious:	false
Reputation:	low
URL:	https://d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com/d8c14d4960ca/a18a4859af9c/challenge.js
Preview:	/! <!-@preserve AWS WAF Integration Developer Guide <https://docs.aws.amazon.com/waf/latest/developerguide/waf-javascript-sdk.html>--> /.var a2_0x33f3=['Only\x20PKCS#12\x20PFX\x20in\x20password\x20integrity\x20mode\x20supported.','Arial\x20TUR','pageX','firstReport','_j0','prime','siginfo','1.2.840.113549.3.7','2.5.4.42','getUTCMinutes','Stringified\x20UUID\x20is\x20invalid','freshestCRL','getChecksum','Invalid\x20Certificate\x20message.\x20Message\x20too\x20short.','export_restriction','ShockwaveFlash','ByteStringBuffer','670442qXIGfu','seedFile','instructionCode','BrowalliaUPC','certId','bindMouseScrollHandler','1.2.840.113549.1.9.6','1LvuttZ','codeSigning','170000','COLLECTORS','node-webkit','generateHashTable','Mesquite\x20Std','1.3.6.1.4.1.11129.2.4.2','Invalid\x20IV\x20parameter.','Cannot\x20read\x20RSASSA-PSS\x20parameter\x20block.','digitalSignature','Record\x20overflow.','rawCapture','frequencyBinCount','CommercialPi\x20BT','handleAlert','contentInfoValidator','stop','consol

Chrome Cache Entry: 695

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	168278
Entropy (8bit):	5.07827049480942
Encrypted:	false
SSDEEP:	3072:3OKSKg1/Cgu9LaMyh/MDe3jyGsADi+BmuN+BjbW16qfxQrYHlCO:eKSKg1/Cgu9LaMyh/MDe3jyGsADi+Bme
MD5:	63163CF040DC9A8ACD6A9DE613C33E08
SHA1:	28CB29B61C0D4B9C9D7B6993A0C5547CE0C5D9C7
SHA-256:	DE069C51EC3B9926EE97D3BDA3A73BC6C5BDB1CE5854F1044B717376D2D047F0
SHA-512:	FDC89D4D6328B302941BC091424F648CDA94843DEA9CDB5A985F19452B10E6F6FC0A9BB8D5DF155A55FA0685181422B31BFAD8DD1EB8DD208C530A4476FF664C
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/css/gprof_icons_cloudfront_sd.iq_ltr/f2fce41920df3c9225af5c680c3a8127d2caaceb.css
Preview:	.b-booker-type__container{display:inline-block}form div label.b-booker-type{padding:0;font-weight:500}.label-business-trip{display:inline-block;margin-left:0;margin-right:5px;border-radius:20px 3px 3px 20px;padding:0 8px;line-height:24px;background-color:#fafcff;cursor:default;font-size:12px;font-weight:normal}.label-business-trip-icon{display:inline-block;margin-right:5px;color:#bad4f7}.label-business-trip.jq_tooltip{cursor:help}.label-room{background-color:var(--bui_color_white);border:1px solid #ebf3ff}.label-business-trip-icon .bicon-pricetag{vertical-align:text-bottom}.uc-company-section{background-color:#fafcff}.uc-company-section a:hover{background-color:#fafcff!important}.uc-company-details{float:left;width:237px}.uc-company-section-2{position:relative;padding:5px 0;background-color:#003580}.uc-company-section-2:before{position:absolute;content:'';top:-20px;right:10px;border-color:transparent transparent #003580 transparent;border-width:10px;border-style:solid}.uc-company-detai

Chrome Cache Entry: 696

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	11818
Entropy (8bit):	7.9860828029424535
Encrypted:	false
SSDEEP:	192:bKIy2MEpYoVUAvZGR9AFhsMVhT6XmvkuY2NZZuS2MpI/FRcQmu9s8FnMlBEnvJP:WP2MEpYyUqZFroGkuYOZeMsX6gnA4P
MD5:	0BC71CE2B9DFC4C90E517E3C02D1704E
SHA1:	1A11354A72CA44D3F11F8DEAB256C64F2EAD2D56
SHA-256:	C315B5110B88030A9FE985571D5F36EDEE908B78EF4391709A00D7BADDF14F58
SHA-512:	1C93DD89EF5C2C0443FA4497241DCD27F2236BA63880D1363AA31A370544E02BDD1AFAC1610C541D223D21F120E8793E325AC30F7EC29DAA3AE278C8067376FC
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/square250/689838.webp?k=32ffc2bfac0d85557bd5ddfc1ca92c73aef20bc8b4b5f2ac8b77ad47b6b7d5c1&o=
Preview:	RIFF"...WEBPVP8 ....P........>m..F.#....]H...e....?Z.....M.....\...m.0yY.........k..1.....b../._..%......Z...A..3...<?.......>.=`?.../..d/.W...po.3...=.u.>.Jhf.J...l_..i....wA."....%..{}#p...gI._L.w.....D.......ux.Lu.5.#.I....o.w[..s.......#..5...43.c.X'.t.J4...._%.?9.Qw.~!.<.%.O..u.xH).r......'.W...."r>....a.....r.....z.xet........t K..V..L.?.L....W".qB.....b.E.l..U....1....Q.(..H.=$..!.......U.....-..Lh~e}........t..)M.2..C..a.{(..zi..a.G......+......M\|y..&...'f(p..B\..<..2.awS........I.....$$Z<Kl.[..>Q....tQD.r....r.V...e...M6...."..gp....'..u...>o.a.......D.".a.}.......Ke.J.D.o......x...rw..d.~K=.T]>....v..\.....p..k..b.i8X...h.J...(%\|9<....]/........2..._.O...........$...M".t.......L...a.-...........<..7....~j.......]W...n..Z;>.KE.D.d;=E...Pc%.i\......t...i#....m_.aR...7.HT..m.m.ey._s.\|T'.:t*..v/..#..N...s..\N`..B..%.....=.RW[.2m2......"..d.w.a^.2H...N..~v..........a....}.....s.....&.a....Y..1.9.W.G..P....%..~......=FE

Chrome Cache Entry: 697

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.307354922057604
Encrypted:	false
SSDEEP:	3:D9inuSoICkY:D99SckY
MD5:	3955EA3429355866DAAE8DD5739A2FC6
SHA1:	691AEC4F58E4E8B46726F8873730F11D65FBBC15
SHA-256:	AB22FCFF7DF9B19212A4DC7EF5EF56B394D001490C3917FAC266D7BAF77DF497
SHA-512:	B082AEC52067D34E698A52BE8DCC28CEE1F7D6756AD54A7FEE09C5F9A6B3E684EA3B379864242DECA6A58F8711AA69E16DF097438C03A0EA5DA6BD9435725F67
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwlmXxtZnE_3AhIFDZSQkvoSBQ1TWkfF?alt=proto
Preview:	ChIKBw2UkJL6GgAKBw1TWkfFGgA=

Chrome Cache Entry: 698

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 79 x 26, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	7.756974676688925
Encrypted:	false
SSDEEP:	24:zn1XTOSh5oncvg3/pzi9NUvZi/GZu4yVEb6cgfes54AVi8TgBgWPPKWfW:zde/3x+1OZkEbhgft5TbTgdPDW
MD5:	6384185CBE9A4F106857A3CB85CAEA98
SHA1:	0E31A4FE2CE98A8B4FDA60687AA71079B4D3A95B
SHA-256:	5839F0330821CF08029BEDDD6D248170DA1AF16CD7AFF253E7BD075D591F5D42
SHA-512:	E9C784DACADEAB6C3FAD53729701708EC5C21670086AA981953FF2D44DFB08BE13134707A4E7405826CC0D11C68F3AECFD6601AF910C537F6E14AF68175B50B7
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/img/tfl/group_logos/logo_kayak/83ef7122074473a6566094e957ff834badb58ce6.png
Preview:	.PNG........IHDR...O..........w.....IIDATx.....:..sl.g.ym.{ll=.m.m...f^.A.1zhg.i:...ZM..5@.YF.................o....hU9......B.s.h....<......=~........b..'.....5.l`..V...z...b5...E.........8.........f.C[.lS..z.IcI...X..r.:......x.Y.....}+.h^G....3......6.Ni..........G.......S.....W.Is.I..S.`.e..)p.hh..T....`...Q.....V......".}.X8..v........k......84.....-9..d.....lq....FuA.zJ5._..@cX.../....a..y.....;.r.>Lur[.w......O._~..:h+H..>.y...p...4..{.\|aBu..y].....a..w&L0.Y.e..}U...'.s...=.......n..^.r...+].I.-G...r....8].FkR.'.......u..e.c..w..%@.}.e...#..K..w..Ak.[@.R..gY.u.2/..y.Q.n.O.......]y.n..pk8.s7.......y.:..F...M..h......y....`..O....i.zqp..<........Zp..h.+..@...;/.#...0..u..N...v..)..6Oq.d..n<.M../.....0....EMn...3..=Q......r..../....8...'..wv/.w..'MS...[..........<.y}...4.Nm....qk.9d. n.Y....yZ1.?..!..Dg...m....;.N...A...I3.gn.]G.A[.w....7.6Om.........zD....v....._.D3x.v...6.]WR..7........=.."4.....\|.......:...a...Z....~..\..~

Chrome Cache Entry: 699

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/ga/rul?tid=G-FPD6YLJCJ7&gacid=421694156.1707417338&gtm=45je4250v888381215z879615461za200&dma=0&gcs=G1--&gcd=13l3l3l3l5&npa=0&pscdl=noapi&aip=1&fledge=1&z=977750421
Preview:	<html></html>

Chrome Cache Entry: 700

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	383
Entropy (8bit):	5.591063490353031
Encrypted:	false
SSDEEP:	6:+4OiSIp1JqOiSIp1JLrxeZ1POtsKHUq8C+T37h4pIoauw6qZSVV:+KSPSOA7OmKHcC/Ioauw6oSVV
MD5:	75BCBE7945B1104286D727E632CDDA8E
SHA1:	DFC02D740200589BF695775908273D0104EFE043
SHA-256:	4DE0E36B05AFAD22D85DA9FD6CD699879C1A0DA9C5BDB166853DB1ACBF743D63
SHA-512:	B155F9F38F5CEFB927EF3CC22A110C0E98D3308BF8AC02EA7FA585C48F9F06C4232B8E5DBEB2B2EF576F28F6090DDE988E533306BA776432364A859DCB930B52
Malicious:	false
Reputation:	low
URL:	https://q-cf.bstatic.com/psb/capla/static/js/a6808fc8.130754bc.chunk.js
Preview:	"use strict";(self["b-web-shell-header-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-web-shell-header-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["a6808fc8"],{fe905f7b:function(e,_,f){f.r(_);var s=f("540adcd8");(0,s.serve)((()=>f.e("aee01701").then(f.bind(f,"64b778ad"))))}}]);.//# sourceMappingURL=https://istatic.booking.com/internal-static/capla/static/js/a6808fc8.130754bc.chunk.js.map

Chrome Cache Entry: 701

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 702

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 703

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4228)
Category:	downloaded
Size (bytes):	4344
Entropy (8bit):	5.211487803575441
Encrypted:	false
SSDEEP:	96:51kj5msLH21I3Mmfk4gtThfYBTnOgsE+C:51kj5hC1I8YeThAB7V+C
MD5:	88D8B9631FE60984BAABD22260A86E6E
SHA1:	B75D25134DEA474C10A42B570D1A0450C194BD7E
SHA-256:	493A3B2B0F2970B97F00FC6C123CEFC68D2AA27BA9433A2989F6C278D623BA70
SHA-512:	650F138A4FE435B277039403E904BA75C0DF7EF2DC8FC25C3CC237BD0BB6BFD034312ECD4AB755434C161A4E7A563A470F47E02114E70E592B7E364F603624E8
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/f5d0e2e7.a54d85eb.chunk.css
Preview:	:root{--gnsv_brand-secondary-color_web:#febb02;--gnsv_lp-campaign-card-height_mdot:176px;--gnsv_lp-campaign-card-height_www:208px}.f420f6bbf2:last-child{margin-bottom:0}.f420f6bbf2,.f420f6bbf2:only-child{margin-bottom:var(--bui_spacing_1x)}.eea513fff0{display:none}.c72aded5f7{display:block;margin-bottom:var(--bui_spacing_4x);padding:var(--bui_spacing_4x);background-color:var(--bui_color_white)}.c82d14d624{border-radius:var(--bui_spacing_3x);margin-bottom:var(--bui_spacing_6x)}.c82d14d624.de712accea{--bui_color_brand_primary_background:#003b95;--bui_color_cta_background:#006ce4;--bui_border_radius_100:4px;--bui_border_radius_200:8px;padding:var(--bui_spacing_6x);border-radius:var(--bui_border_radius_200)}.e7ce666a86{margin-right:var(--bui_spacing_8x)}.dccdf01c32{flex-basis:280px;position:relative;align-self:flex-end}.d6bedc5a57{color:var(--bui_color_brand_genius_secondary_foreground)}@media (max-width:575px){.c82d14d624{margin:0}.c82d14d624.de712accea{display:block;padding:var(--bui_spa

Chrome Cache Entry: 704

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 705

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	857
Entropy (8bit):	5.267445036735886
Encrypted:	false
SSDEEP:	12:YNNGa0+CXEV+q9N8ujS49knz/iTGJzy8bk9+g:YNNGa1CXEEq9N8uG49knz/iTS/bk9F
MD5:	0DDD3F8FDF98D9C8F3E669D739C2169B
SHA1:	77FB8B32BC6A9275451DBA1AF516072E66B5080C
SHA-256:	57E0D04D6105F232C98DBE9C6BE6EF94D8F0B39F373102A8C5D4A130973F629D
SHA-512:	14F2FF73DDB5ED845ACEC1C23C010AF908EFA729F4C734EBE0E0D542A3042DE8ED584A0B20CBFCDA0A712985A1EA94D8424F279A69AD77D184E8744DB561E8DE
Malicious:	false
Reputation:	low
URL:	https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3184967692328877&correlator=2934902597113450&eid=44809527%2C31068825&output=ldjh&gdfp_req=1&vrg=202402010101&ptt=17&impl=fif&iu_parts=3102%2Cbcom-www%2Caccommodations%2Cindex%2Cindex-primary&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=320x50&fluid=height&ifi=1&sfv=1-0-40&click=https%3A%2F%2Fwww.booking.com%2Fbas%2Fndisplay%2Fredirect%3Fndisplay_ad_id%3D37d88fb6-ac8c-4945-8597-20c3fcc3653c%26affiliate_id%3D304142%26rendered_ad_pageview_id%3De4de82b919b800e4%26rendered_ad_sitetype%3DWWW%26rendered_ad_vertical%3Daccommodations%26rendered_ad_position%3DINDEX_PRIMARY%26rendered_ad_pagename%3Dindex%26url%3D&sc=1&cookie_enabled=1&abxe=1&dt=1707417343563&lmt=1707417343&adxs=-12245933&adys=-12245933&biw=1263&bih=907&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=1&u_h=1024&u_w=1280&u_ah=984&u_aw=1280&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyJXaW5kb3dzIiwiMTAuMC4wIiwieDg2IiwiIiwiMTE3LjAuNTkzOC4xMzIiLG51bGwsMCxudWxsLCI2NCIsW1siR29vZ2xlIENocm9tZSIsIjExNy4wLjU5MzguMTMyIl0sWyJOb3Q7QT1CcmFuZCIsIjguMC4wLjAiXSxbIkNocm9taXVtIiwiMTE3LjAuNTkzOC4xMzIiXV0sMF0.&url=https%3A%2F%2Fwww.booking.com%2F&vis=1&psz=0x0&msz=0x0&fws=132&ohw=0&ga_vid=421694156.1707417338&ga_sid=1707417344&ga_hid=156129767&ga_fc=true&td=1&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFsyLFtbIi8zMTAyL2Jjb20td3d3L2FjY29tbW9kYXRpb25zL2luZGV4L2luZGV4LXByaW1hcnkiLFtdXV1dLG51bGwsM10.&dlt=1707417331388&idt=6712&prev_scp=b-in%3Dfalse%26b-de%3Dwww%26b-la%3Den-us%26cal%3DAd&adks=1825299478&frm=20
Preview:	{"/3102/bcom-www/accommodations/index/index-primary":["html",0,null,null,0,50,320,1,0,null,null,null,null,[["ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw",1741113344,"/","booking.com",1],["UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg",1741113344,"/","booking.com",2]],null,null,null,null,null,null,null,null,null,null,null,0,null,null,null,null,null,null,"AOrYGslXqzWxZnMwa10HhsoG5C0a","CMXzz6KxnIQDFeQ2Twgd1GEHIg",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1",null,null,null,null,null,null,null,null,null,null,null,"AA-V4qMuW3ZoQ4rGcfgPjNjQarStvp7W65iymc1uV2luTCfadPBbmnNyTs3y682eiLa4eR16eS1-Ih8gLg",null,null,null,null,null,null,[["ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V",1722969344,"/","booking.com"]],[]]}..

Chrome Cache Entry: 706

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	16834
Entropy (8bit):	7.988591059503799
Encrypted:	false
SSDEEP:	384:5HpKm8qnn/Oo+m09VFf0/O1laTAMjQI5vrc7gkuNCkNIWU:JPn/OogfeO1wMukcIWU
MD5:	D62D1FC71DEF17C646075B1F2A1AB6D3
SHA1:	C9094715C866F963150BAA976B2426DD30F3B9D3
SHA-256:	C9B93E9328CC63A35E59796EB7FD3A1D0EEC12CDFF6F3CBCFE02A7FFD4287F2D
SHA-512:	20D4065A77EDA956C834F59327FCD18ABCB444E5010C11F66C84CD644AB5A727D1C426544EBAAD58902F6D27078B413FCB436CDF6C4206A85D3D193719337001
Malicious:	false
Reputation:	low
Preview:	RIFF.A..WEBPVP8 .A...........>m,.F&#....0`....^..........?-..Kh.;...^....s...&,...{.O...............{...G.\|...g..n.G.w.G......R.o6>.{.~..W.;..?.?p..?..............>.e.c.......w...?y......`.Mw..mf.&...'...c.T...#..}..[........W..qv.4.-<... B...unQ.q0.,s.JG...H..\|...L(...0I..6nb,b.M!!I,Z....>_.9+A....(5s9.1.<8^Q....<3>....8D.q^W..L....:.xA.D..qW.:L.....,..x.G....&.;n.g.V.j.........%.Y.l-...2D..H6...D./...a...\|E..w.#3.1t../.$......V..%..w4.\(.e...Q......hu.....%.....V._..(b;..O..oP.........h.}....g\|N^...P.NO...m/...K.US.!L..s....+......<R$....o..%RB...."........I../. o.....Gjv<S..z..2..r8\|p....Hq.. ...Z.....N.ybF.@.8S...a..(.....!.\.A.F..D..Gd"...n...d.yO/.........{.......$......!...q3........:...N. ..Dz..u.#.+......l..#".....j......X.&..l.Of{...P..^t.W.yp.2s.MH.a.Y.K..%.+(.av...E....x........O...f.....\.....?....../.5......C.....\|+...?..Z.....N.{A..e/......8-q.. ..g.=...D...9r..u.W...<K..J&..5...=2.t.r...b8..aT.m.S...d..T..7..+1$8.

Chrome Cache Entry: 707

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21608), with no line terminators
Category:	downloaded
Size (bytes):	21608
Entropy (8bit):	4.768124050153233
Encrypted:	false
SSDEEP:	384:+I8C4hGoFXlCS7FGAVsq1nwGfg4xqsQMPNE:OaJ
MD5:	A169014CB8030D7BEB52C77DDF2FD9C6
SHA1:	FBE4667B4F8F01CD6C4DD2F9C9CACFB389CB54E1
SHA-256:	D0C233D327541D2961F1CDE9E53A6166279655F4D4041C1BC458AC1701827719
SHA-512:	F46123E7223B5AC490BADB950AA79D4A7BDC09D5C2A4533C3D82F3555A6308C54F1719F1959E75003A94CB2877ED65F35110529F33981C4C4C03256F345AE3C8
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/scripttemplates/202305.1.0/assets/otCommonStyles.css
Preview:	#onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .onetrust-vendors-list-handler:hover{color:#1f96db}#onetrust-banner-sdk:focus{outline:2px solid #000;outline-offset:-2px}#onetrust-banner-sdk a:focus{outline:2px solid #000}#onetrust-banner-sdk #onetrust-accept-btn-handler,#onetrust-banner-sdk #onetrust-reject-all-handler,#onetrust-banner-sdk #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk.ot-bnr-w-logo .ot-bnr-logo{height:64px;width:64px}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-icon,#ot-sync-ntfy .ot-close-icon{background-size:contain;background-repeat:no-repeat;background-position:center;height:12px;width:12px}#onetrust-banner-sdk .powered-by-logo,#onetrust-banner-sdk .ot-pc-footer-logo a,#onetrust-pc-sdk .powered-by-logo,#onetrust-pc-sdk .ot-pc-foo

Chrome Cache Entry: 708

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 709

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	65
Entropy (8bit):	4.314128390879881
Encrypted:	false
SSDEEP:	3:2erWeKBRk35KLWAzRERxzfRX/H4Y3:29M3tRdfZN
MD5:	83A02FE42F8C2198E7C608AFF363AA49
SHA1:	7B20AE1014450492CC708E3C9DC7522B05C2EFFD
SHA-256:	E64954DC34E12C7190CC2338A54B07644FF0F102AA71CC7209BCBB49C3009F7C
SHA-512:	CD381A8C725C892E9A68D713254A31EA9ED25A39B212A5DC52D4BA2655F38AFDDB32519F03360F32A59D8E7701AF6C2AD0030A6AA760C3DE87C75063F5B65F54
Malicious:	false
Reputation:	low
URL:	https://gtm-mktg.booking.com/g/collect?v=2&tid=G-A12345&gtm=45je4250z879615461za200&_p=1707417405583&gcs=G1--&gcd=13l3l3l3l5&npa=0&dma=0&cid=421694156.1707417338&ul=en-us&sr=1280x1024&ur=US-FL&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pscdl=noapi&sst.uc=US&sst.rnd=651343451.1707417406&sst.gcd=13l3l3l3l5&sst.tft=1707417405583&_s=1&sid=1707417345&sct=1&seg=1&dl=https%3A%2F%2Fwww.booking.com%2Fpackages.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&dt=All-inclusive%20Resorts%20and%20Flight%20%26%20Hotel%20packages%20%E2%80%93%20Booking.com&en=page_view&ep.is_aid_mcc_level_tracked=&ep.cd_action=packages_city&ep.n_b=&ep.hashed_email=&ep.partner_channel_id=3&tfd=8620&richsstsse
Preview:	event: message.data: {"response":{"status_code":200,"body":""}}..

Chrome Cache Entry: 710

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	https://www.booking.com/logo?ver=1&sid=5171fc655664ddf74ab763a094523fb7&t=17074173641
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 711

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1321)
Category:	downloaded
Size (bytes):	17314
Entropy (8bit):	5.342134706855769
Encrypted:	false
SSDEEP:	384:cCDFzlR6exHAiyyrYuy9ckdnfczIk7LcuNP/p:DlsexHAlii9NmIeLcE
MD5:	2CC87E9764AEBCBBF36FF2061E6A2793
SHA1:	B4F2FFDF4C695AA79F0E63651C18A88729C2407B
SHA-256:	61C32059A5E94075A7ECFF678B33907966FC9CFA384DAA01AA057F872DA14DBB
SHA-512:	4ED31BF4F54EB0666539D6426C851503E15079601A2B7EC7410EBF0F3D1EEC6A09F9D79F5CF40106249A710037A36DE58105A72D8A909E0CFCE872C736CB5E48
Malicious:	false
Reputation:	low
URL:	https://tpc.googlesyndication.com/sodar/sodar2.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.'use strict';function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var l="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ba(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var n=ba(this),p="function"===typeof Symbol&&"symbol"===typeof Symbol("x"),r={},u={};function w(a,b){var c=u[b];if(null==c)return a[b];c=a[c];return void 0!==c?c:a[b]}.function x(a,b,c){if(b)a:{var d=a.split(".");a=1===d.length;var g=d[0],h;!a&&g in r?h=r:h=n;for(g=0;g<d.length-1;g++){var e=d[g];if(!(e in h))break a;h=h[e]}d=d[d.length-1];c=p&&"es6"===c?h[d]:null;b=b(c);

Chrome Cache Entry: 712

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7107), with no line terminators
Category:	downloaded
Size (bytes):	7107
Entropy (8bit):	5.033756712873933
Encrypted:	false
SSDEEP:	96:6wIpQgOR15Y2/xFTera/r5rIr+rsWUCeRmFaIkWmGu0hV0b0xG5GlGTY/dLWb3RL:LIy3P7JQZW16
MD5:	F841B7B83EAE48FBF4574D3C0D53F4C3
SHA1:	E104126E57648FF6D51BF6ADE1357BC03CB500C5
SHA-256:	0A5447D9BE398DA3541FE01668F81B332FD26812C2842AA53DEB5C7883D58F73
SHA-512:	A1242457657CE06C62A487BCBFE78352910D530097F5EDA816E266E131201D5B543AFD8E244CBD28D53CBDD971532C06CE14E06A429681EAE8F9B9C116775331
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/css/incentives_cloudfront_sd.iq_ltr/f1558a6e9832a4eb8cfe1d3d14db176bd3564335.css
Preview:	.rewards-incentippy{width:24px;height:24px;background:url('//cf.bstatic.com/static/img/incentives/incentippy/d95ef8dbbf70b932813312468b55608088e91dcb.svg') no-repeat 50% 50%;background-size:24px 24px}.rewards-incentippy-gray{width:24px;height:24px;background:url('//cf.bstatic.com/static/img/incentives/incentippy_gray/2bda4622f06519a8b7a2173d4d0768ed9b7cf50f.svg') no-repeat 50% 50%;background-size:24px 24px}.rewards-incentippy-big{width:61px;height:48px;background:url('//cf.bstatic.com/static/img/incentives/incentippy_big/6073affa42fd7928b52ac15b5feaab77939687a5.svg') no-repeat 50% 50%;background-size:61px 48px}.rewards-gift-big{width:50px;height:50px;background:url('//cf.bstatic.com/static/img/incentives/incentive-gift-box-round-100px/d45438b0be0d579426436f74c2a77aef42d44c97.png') no-repeat 50% 50%;background-size:50px 50px}.rewards-ribbon{position:fixed;bottom:0;left:0;right:0;z-index:100;background-color:var(--bui_color_white)}.rewards-ribbon__icon-btn{float:right;height:24px;width:2

Chrome Cache Entry: 713

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10722)
Category:	downloaded
Size (bytes):	10770
Entropy (8bit):	5.368225686722229
Encrypted:	false
SSDEEP:	192:x96RPhHh+oYJ0BckA+oYn0BcH6+wYJ0BcWms+oYJ0BcG8EqQRLc+qtwIC0ahCh+H:x96Nn+oYJ0Bcr+oYn0Bca+wYJ0BcWp+e
MD5:	A197CE07CFB7A8CB87B370FE65362BFB
SHA1:	79B40088A7664C1B1F583BA92E855ED808C172F3
SHA-256:	4EF2C8EB00729D025D4D7F79294105C7CEA7EDDB4063D7C1BC5ACCF226D03199
SHA-512:	CF7DEC0722384FDF53D63CB926501D755314B7D80882B05D106F377B9AA0FE56938EDE53E47F843F5D7D6ED06423304612DC5EA2AD45FBEF9FB8BCBDA135E11D
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/flights/web/static/js/9806.15323e3e.chunk.js
Preview:	"use strict";(self.__LOADABLE_LOADED_CHUNKS__=self.__LOADABLE_LOADED_CHUNKS__\|\|[]).push([[9806],{49526:(t,e,a)=>{function n(t){return function(e){var a=e\|\|{},n=a.width?String(a.width):t.defaultWidth;return t.formats[n]\|\|t.formats[t.defaultWidth]}}a.d(e,{Z:()=>n})},88486:(t,e,a)=>{function n(t){return function(e,a){var n,r=a\|\|{};if("formatting"===(r.context?String(r.context):"standalone")&&t.formattingValues){var i=t.defaultFormattingWidth\|\|t.defaultWidth,o=r.width?String(r.width):i;n=t.formattingValues[o]\|\|t.formattingValues[i]}else{var d=t.defaultWidth,u=r.width?String(r.width):t.defaultWidth;n=t.values[u]\|\|t.values[d]}return n[t.argumentCallback?t.argumentCallback(e):e]}}a.d(e,{Z:()=>n})},76723:(t,e,a)=>{function n(t){return function(e,a){var n=String(e),r=a\|\|{},i=r.width,o=i&&t.matchPatterns[i]\|\|t.matchPatterns[t.defaultMatchWidth],d=n.match(o);if(!d)return null;var u,m=d[0],s=i&&t.parsePatterns[i]\|\|t.parsePatterns[t.defaultParseWidth];return u="[object Array]"===Object.prototype.to

Chrome Cache Entry: 714

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	375
Entropy (8bit):	5.631187580241556
Encrypted:	false
SSDEEP:	6:+oUp1JyUp1JLr6QQ1P4dtsyXiO+T37h4pIoauwiRzSVV:+F9KGyKiO/IoauwiVSVV
MD5:	71D148D7E362A60E9A0C56222E4C1C42
SHA1:	EFA6833AFFAFA5EE32CC538C0EE386673C92D169
SHA-256:	EEFD6838A88FF46EFD00A91C0C63F124352BAC2D328F583E87CAFE87056AAD31
SHA-512:	9EADD8798A416985F0C32BF711A36403E9B0641EF2FDB3E3D592F719A3D1171FC211438DCC1BB20578148647AD62F2785D3CCC20D1EE6BAC4A6D9ED4A372A594
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/4a89d2db.6c0ec4b3.chunk.js
Preview:	"use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["4a89d2db"],{fe905f7b:function(e,_,b){b.r(_);var d=b("540adcd8");(0,d.serve)((()=>b.e("0a098284").then(b.bind(b,"64b778ad"))))}}]);.//# sourceMappingURL=https://istatic.booking.com/internal-static/capla/static/js/4a89d2db.6c0ec4b3.chunk.js.map

Chrome Cache Entry: 715

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21099)
Category:	downloaded
Size (bytes):	21100
Entropy (8bit):	5.307475695141851
Encrypted:	false
SSDEEP:	384:TRFZ2wWtdbD5ABwXwLrekrff8eTr+xITxMcTn9LuJPvV/:T8wAD5ABwXw+krfflyxUxbn96/
MD5:	235F7E16895BB7A8A175D0D198BC8203
SHA1:	AFCD8CBABEEF43B0B1EFC536CF192F48925BE52F
SHA-256:	4BE1ADDF4EE8C28EFF431EF8BFBC475913C1234F6315C50047BC1EDA86DE71F3
SHA-512:	777AD0049B690E1F5AC67F8997458DEA118766D3334E17EA892F742EB086D07B495DC3B172AFDA527031E306B1F4765304BD757D249E5DA86AAE823C28483B08
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Preview:	var OneTrustStub=function(t){"use strict";var a,o,p=new function(){this.optanonCookieName="OptanonConsent",this.optanonHtmlGroupData=[],this.optanonHostData=[],this.genVendorsData=[],this.vendorsServiceData=[],this.IABCookieValue="",this.oneTrustIABCookieName="eupubconsent",this.oneTrustIsIABCrossConsentEnableParam="isIABGlobal",this.isStubReady=!0,this.geolocationCookiesParam="geolocation",this.EUCOUNTRIES=["BE","BG","CZ","DK","DE","EE","IE","GR","ES","FR","IT","CY","LV","LT","LU","HU","MT","NL","AT","PL","PT","RO","SI","SK","FI","SE","GB","HR","LI","NO","IS"],this.stubFileName="otSDKStub",this.DATAFILEATTRIBUTE="data-domain-script",this.bannerScriptName="otBannerSdk.js",this.mobileOnlineURL=[],this.isMigratedURL=!1,this.migratedCCTID="[[OldCCTID]]",this.migratedDomainId="[[NewDomainId]]",this.userLocation={country:"",state:""}};(m=g=g\|\|{})[m.Days=1]="Days",m[m.Weeks=7]="Weeks",m[m.Months=30]="Months",m[m.Years=365]="Years",(m=i=i\|\|{}).Name="OTGPPConsent",m[m.ChunkSize=4e3]="ChunkSize

Chrome Cache Entry: 716

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 717

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (57570)
Category:	downloaded
Size (bytes):	57682
Entropy (8bit):	5.489239636510569
Encrypted:	false
SSDEEP:	768:n7/jVM7g3z3wCpCMCtCmCMCtCJ+YuMvTB+ss5tfonEzJLGIRJ1oAKTCrWvtql:7nz3wJBgjBgYMd+35ocLGgrWvk
MD5:	5B8EEB30AE5A8B3BB0F20B42D67F1042
SHA1:	D64BBCB6C8C43470F5C9F48E7A08366472E39CDB
SHA-256:	6200C38069B4F258C6BD6D16CA8EEF5A0B7EE94DE1006369D7D5D8BB216B5848
SHA-512:	67B8660E2711830C8E8BCB84B3889D2215FA6107AE290EEE060B157B6B91A90C649697AD0E2E3FB45CB5F144AEFD6A08CA9B806BD451ED7AC49E199E0DB0FF1F
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/b9a82cb8.5aa6563f.chunk.js
Preview:	"use strict";(self["b-web-shell-components__LOADABLE_LOADED_CHUNKS__"]=self["b-web-shell-components__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["b9a82cb8"],{d0989236:function(e,n,i){i.d(n,{B:function(){return a}});var t=i("dc6d28ff");function a(){const e=(0,t.getRequestContext)();return{get acceptHeader(){return e.getAcceptHeader()},get actionName(){return e.getActionName()},get affiliate(){return e.getAffiliate()},get basePageUrl(){return e.getBasePageUrl()},get body(){return e.getBody()},get bPlatformEnvironment(){return e.getBPlatformEnvironment()},get CDNOrigin(){return e.getCDNOrigin()},get CSPNonce(){return e.getCSPNonce()},get CSRFToken(){return e.getCSRFToken()},get currency(){return e.getCurrency()},get encryptedCommonOauthState(){return e.getEncryptedCommonOauthState()},get ETSerializedState(){return e.getETSerializedState()},get isInternalIp(){return e.isInternalIp()},get isInternalUser(){return e.isInternalUser()},get isLanding(){return e.isLanding()},get isNormalRequest(){retu

Chrome Cache Entry: 718

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	https://www.booking.com/logo?ver=1&sid=5171fc655664ddf74ab763a094523fb7&t=17074173491
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 719

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	dropped
Size (bytes):	2617
Entropy (8bit):	7.814334415525114
Encrypted:	false
SSDEEP:	48:o9YMbuERAhD911xN8azUTW2/Mtq4G0pyaZackfXW9hADQtO/3tu3pk7X0IJhFz:ghCEGR3H8aUWYyq56ackfuGju8XHhFz
MD5:	2DBFF1EF8EF33EF78D5782231FE513E5
SHA1:	3CEB011E11B83FEA28154E087765A480C703FBF6
SHA-256:	4C2A5CA08BC34911CC94E2A88D8318F39E0F9618A419940FD43348113472066F
SHA-512:	4D171F198034C55EA7D7A56D582924D1B4BADCBD42360FEE439FBF3301E198B0FFFBE076A68A6A58BCCB652010E5F339EE5F606DD35EA0DE8F29F982F5E5AC0F
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......d.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...F.V<._.....R..F.VvQ..0r...M.kg..).)Wg....O..`.+l..V\|.O..0r..Q...T.\|..+l..ytQ.;...6{U...>s^B..6U..*.qr.vRl.~U/.G8r..Q...T.]...T..1....1....,5...})<..V.Rl........Vv.G..!.C.N..I..K`..G y=.......:..SN.....:.M.._=.+..`..3.{..g.^.I\.O..#^Z...3.....F...{..R(Pe......;.v.C".G...U...b..l.e6+.I....tk..^0y..5ga=...^.l..Tn<C....io172...8C.d..8..%....?b...W...

Chrome Cache Entry: 720

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1949)
Category:	downloaded
Size (bytes):	2065
Entropy (8bit):	5.192719296491818
Encrypted:	false
SSDEEP:	24:04WV/aJCQI27PWV/d1COAKrW+EA+JzAaotdz6C/f2GPGPXBqB1+vq5:04aCJvTLa7tbAekC/fnPGPxqB55
MD5:	9F91BB862449CB9E9205F6F0A89B9ECA
SHA1:	C9664885B77F670F955ACBFA0E4C417D6CB1FD32
SHA-256:	304F8A600D68F795F540EF1645BDE0F8A2E8F23E6AB3788E494076ABA6E26B76
SHA-512:	140F355792DD4CD6F742851FB96A22B1F6CC5E8823C59C076F18083C4FD394B6F3A4B4869EFF9FD383B2ACDF4C4802018A0DDA9B9ABA3E1C9375F95FF4A9463E
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/445be7a9.b944bd98.chunk.css
Preview:	.a529739de5{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch;border:var(--bui_border_width_100) solid;border-color:var(--bui_color_border_alt);border-radius:var(--bui_border_radius_200);overflow:hidden}.fe04f404b8{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch;box-shadow:var(--bui_shadow_100);border-radius:var(--bui_border_radius_200);overflow:hidden}.f538ae62ac{flex:1 1 0}.a244555425{background:var(--bui_color_background_alt)}.a6271fb6c2{margin-top:0!important}.edb4db1de8{flex-grow:1}.b8d585fcc6{border:none}.e98333fe6c{-webkit-line-clamp:2;display:-webkit-box;-webkit-box-orient:vertical;overflow:hidden}.bc476201ed>:nth-child(n){margin-inline-end:var(--bui_spacing_1x)}.e714215256{-webkit-line-clamp:2;display:-webkit-box;-webkit-box-orient:vertical;overflow:hidden}.cb32f1ced0{overflow:hidden;white-space:nowrap;text-overflow:ellipsis}.d542f184f1{fill:var(--bui_color_accent_border)}.bca48

Chrome Cache Entry: 721

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	15612
Entropy (8bit):	7.987857145236499
Encrypted:	false
SSDEEP:	384:g+AWo4CkYTQ2Hx1oqPheW6QHHlQ++12dsyjuGwdSVLk/KJzeXT:gp4CsEWqPXlQ++12dsyjuGwEVA/ND
MD5:	F573C163D2B4778C2E5C6A61DC52FB4E
SHA1:	DA15321AE0BC3581507ACDEB12F2D2B791BD63C4
SHA-256:	424A99E2A55D559E6980E00224B26F1CB13557522C8D9A5BE7261904FBA61296
SHA-512:	48B2ED2179796381823B88738B1B9A6E4A02363A71564F60698F4665578DF58E68FB4234C03A07228372A7AC2F6E85D5D8AB1264207E596BBC9FC23E5B69C250
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/square250/786960.webp?k=e313213321010a516ee56b6ee04e367f770af64eaae9e8e230cde42d2cbca75a&o=
Preview:	RIFF.<..WEBPVP8 .<..p........>i.E.#...n.`...:sL\.\|4.......y..h....9...u_`.Izy2...................#...~..w.O...u....g..W.?..=......y...........t.c.i...C.....I?b.s.9..............A.....G.....59\|.......2...~.(4"x...z{._.....j.h.<....82....s....Z...h......Yb1/{.a[.m[.+...z....K.....k...AZ..Gw....S..l.......s..z..0.W..~&..n.}..r.....-._;..4Q....b....V.^,..#.L.`.+...q~.0...m..l^......h...y..&....H.....m.c..K...)..l.Z.6.8..R..g...$...?.wH.[...4...B<8L..9....!r..".`..[...J.....:S-.-_o.0. ...[.m..i.(..J.....<.>...T".#...F...........:....o'..O.a.w.(...D. ..........'.A.. ......^..z.A.=..[..4..\.1Kd...M.T.......\....8..<.A9.G..#}.fe.$........h[y.....5........K.-.}k.......:.Y..2.....l..-.......[..S.Sn<.h...{Jn.#Z.h..5T...1V.!....C.M.F..87.d.s...}..d_t.^{.~,.......^.4...q....yg4.Rc..Q......Glmi.../........SJ.,.e....5.k&...V.`@u..Cn.....\|5..y^..[.t..Q..IyJ.N..kg..n...R...+.Uo.#../:........^..WU.g......R...*..0.N\|.,C....[......f!`.H\|1..l..!.\.I_..

Chrome Cache Entry: 722

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	17122
Entropy (8bit):	7.988976471211867
Encrypted:	false
SSDEEP:	384:KwMEo4GnzvEemwJRhsMXnlB77SjGsHLXNCNLnIaIyg92wc1lXj1:KVJ9nDEVw5NXlBnSjGsoNO8wcrX5
MD5:	1ED508BA4ED9857069297C4C0324A6C5
SHA1:	41E7212ACAB83BB63BC29AE6FBF2EC65EA2CA3A1
SHA-256:	58EBB0860DDA76E5A80CA450319AA4724C8E951BA6E23E67FEC4825F4B14B96D
SHA-512:	C04AB6702BD1A79AB4FCA1011F10EE2BA6BFD4FB8E85CE0236D21A4B9784E8DB1B32B1877E4D6AE132F32DA40F11EE6525E4E5943495EA1413D31EAC65570478
Malicious:	false
Reputation:	low
Preview:	RIFF.B..WEBPVP8 .B..0........>m.E.#...V.`..g.A..lg..3...N.>..[...}@nD.]rZ..._.^k.....?........_..\|.....a.[.'....'...K...?...?.....iF......G.....'......z....G........[.y.k....._........3.........?.~......o.w...?....y......IsCz..y...C..aS..$..Bu..?Q.3ee...+...........A..?..\a.w......v.to..:`.u......N.f.gd.m.zxN#..:/+..>w$.^>..i....9JeC...y....\|.......6zr..........B2.....'....UaAB.k'.(.\2^...j .Q\;....k...'b.K.i......$..'..b.......7X/.. .....\|Ygw....m/../<5s.g.YL....v}.[.8.j7FZY..0.x.}E.V.".<.z...'.!..J...l.".....u....Dc.f......Xy...V.Gs.ms..6X.....r.A!;.IU .P.o......q.4..6.4.:zqD.........\....8w...>.d.].q.v..m...6....<hJ3.......)k^7.(6.9_.\|s........g....\|-?tH.hh#..H>n2{..@...`...t...6..C...,SA............ .e...S./..i..u?I"..U."...Z0...o7J.W..&....:\|.....I... B.Q^.....a....H..G.2\...Z.b..?.Al..=..;...!C..:...F.K.....&..........D;...I.B..7.z.... .=...g'..U..D...m?.'Q.#T.v..[`.H.9n.$.kxF.K.A...uA....w......7u.W.......6.g..m...m7....+.

Chrome Cache Entry: 723

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	7046
Entropy (8bit):	7.9723414964939305
Encrypted:	false
SSDEEP:	192:i3D3Jg+MEyE0GgFStWnZY4/qW0aNsrm51I2X9/v:Gdf0FstWn/q9aNAI9v
MD5:	3E3EEC6325475D013D98DB0B8B238C08
SHA1:	A62E863E9F976C16243D9124AD177EA1C753ECAA
SHA-256:	1D938B1F6B50A93EDEE83518D14BE92AFA0AF400FAA588E6991BEA31B76BB1CE
SHA-512:	6CBD2F4EAF025020B8CB8D7277FD2D0F1912AE07444511950DD935CF041BC75068B854DBFA22DEAFE7203FF661ABA7CA4124CAFBCC2581AEB00D548926086806
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/square250/689152.webp?k=3e406cd8b3fabad15ed34e82484d43d44bb0a05899ba8252d2334f73dbbe3697&o=
Preview:	RIFF~...WEBPVP8 r...p........>m0.G.#...4{....cm3..4...A.I ?\...:v\.W./F_-.W#<2<{9......O...GS.H......5.o..E1OS..W.y...?...tF.7.......0.E.Z.{.g.Ry../.b..=._.p4)......pL..\..4.K...H.>}$..~z..kg..}.i..g..z..3P4l..\G9WW.....h.I<DGA..d..:......Y..6`F.IP....T...g\|B..........[...o........nr.:...`~...1..M.i...xu...Q.h.c..r.nu5P)LVY7.9...h"....g..A.B.q.;0..P.N#r.....;T.N.)/..T8?p..........n....R?w\R>..q.....].d...hx".D\s.G&....?..v..B...&.&abu....\<b..&..X9"\|.H..N...!Q..A,.,.9-....}...Q.....#...%..X. '..k.1..%..7J.....5}..cG9...rH0h...(=......@Q.+o`....n...1V.........E...k$I2.2...9..S...e.y:........?.).."......[...D..JB.......9e.-8.k..<.2J..O.k...d..[F..!_..;7.4....k..."...I.@5:.E..{.e.:A....1... .\9.....@RjH.._[..P.N.^...........GG:I.? =~$.h4...F.T.S......+t.[..C..=..._..L..t.J.. K..~D0....HT..........q...v.....e..2a..L^h.......$.L.....(>..D....".%\|P\..t.f..j..}....l....m...\|;.9.`r..Y.5....\...A.....=a.I"...g.x.j..n.S:...i..P.>D...T..%*5.

Chrome Cache Entry: 724

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	68
Entropy (8bit):	4.200601260429725
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM09/Woz59tVp:6v/lhPfZM09tzjTp
MD5:	C4A2B870062C2BB98C500BC1526C0498
SHA1:	528666CCDB12997358077BC8FCDBFB6B825C7788
SHA-256:	2AA4FA20701CDD6D8D56046069001186B5267E3EE7D0EF618AD2F4A683723E11
SHA-512:	2F1A3ABCD12125F7EF18D61A960901C0FD6F82DD02EA2B8041859E6D5F0A7F08DB17CC110DC6D8A3F7D0D1BA790C4BCCA2506D3C60EDFEB5CB29433E9F4F762E
Malicious:	false
Reputation:	low
URL:	https://tr.snapchat.com/p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e&u_sclid=75022d4d-ae50-4a02-8ab1-d3d7e0695f9e&u_scsid=224e9da2-3ebe-4de0-94ba-0d5d22c95b7f&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&df=true&huah=true&m_dcl=4806&m_fcps=3239&m_pi=4770&m_pl=7436&m_pv=2&m_rd=8600&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&trackId=42b0a81f-b07d-418a-b96a-d1b9785bfcee&ts=1707417357018&v=3.9.1-2402072137
Preview:	.PNG........IHDR....................IDATx.c`...............IEND.B`.

Chrome Cache Entry: 725

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 720x217, components 3
Category:	downloaded
Size (bytes):	25671
Entropy (8bit):	7.964895192972628
Encrypted:	false
SSDEEP:	384:qlBZvk2iTaMf5rsNr+vzLpfdnGt2pW5MbdihLVEo32GTDNAoBNkKxN8Wn9LRvHym:qlAZ2e5rBGaWibdifGkpBNvN80KiMyP
MD5:	E8BC48549C1E82C951DF411059B81A85
SHA1:	1A77B13C57125FBF8DD5DEE35AD1DB4BABDC9427
SHA-256:	7398A7BF4867D9A59CE24A193BE3F38267F6B612BE70FD9EE9BF56718E69E9B9
SHA-512:	F0D1DB4FF187FC32F8354543525AE605139EFF45A4C8011A4EE65D91231DDC48828CCCDC617D92697792033220BA4B44A9A39539AC5C0BC6268B19AD66902953
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/xdata/images/xphoto/720x217/308526620.jpeg?k=0663a1420ea98a013af0eda32bb4d11258521a39c5b8a5a4e2777ee5661dee55&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....i.....'.....-0..6.h.@.....&)v.S.0...H.@2E .}(+..uS.J.:R.\....U...L.}.h.m..J.m4.#.9W&....1..8..E.T8.D..Y6tE.$.T].. 5....."H..) ......A.,... sR+. ~t..K.\|..Uz.)...Q.s...^z..i.K..rLi..}.L.1N.6G..mI.J....I.ZM.9...W.....m5.....o..J\R...j6T..q.J."......c..f.F.~)i..{ph.5&)B.@...;m<-...2..m...m..b0.m.6...E.....M.\v#.J.5 ZpZ..#.K...J...0%.jP.m.q.m!^*m..q

Chrome Cache Entry: 726

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 354x266, components 3
Category:	downloaded
Size (bytes):	20782
Entropy (8bit):	7.962841998378122
Encrypted:	false
SSDEEP:	384:npp72TEMMbQHm6PLeVEcI2oYo0wzR/oPTyaO9n2IQOsVrNpQREBAHqkER9mV:pp72gAHmmAEcrOKPTw926sZ4eAHqkEbk
MD5:	BA108CFB9A91BFF88F47EC652D0F203B
SHA1:	099F148A9E04D4415E482079D9EA8E20C3D175E1
SHA-256:	B661FC1298BBE655E9BA10AF7B5F78C78B6195D6FDDA388D2757E549462A306A
SHA-512:	62A9D4DE5D8C0C8F6983DB45D757DF5E5EFEBF18AA9EAF1FFDDF82A4132A676FE683D7D5742FE09D974817B19E15BF5895971856A7C67B0F6D43DD884B222C1A
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/354x266/977416.jpg?k=ea06e0b572ff052f4fe4fcf35ac3616e8d1b7300f0402756c460a4e9c19e54ed&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........b.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..1K..K]..m.m8R.p..m..S.Xn.]...\Qp...).R...K.v)qJ.a...;.\R.Xn)@.b..\v.R...\...R.5.y.....?...xI...[.$...H....1....Ks............K..........S.L).L....Z.1...:.QqXf.M.&(.;..6..b..\,3m.jLQ.........\Qp...i...+.....N...W......v..1O.(.......~(.......1E..h.b..;......U\V.Z\.8..`....\V..PE&(.!....6.).\R.ii.b...QE.LR...p...R3.h].*............+S.....j..[.O...h.....HT...[...

Chrome Cache Entry: 727

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	dropped
Size (bytes):	8621
Entropy (8bit):	7.916778967838765
Encrypted:	false
SSDEEP:	192:mgK0069awoQPCxLi6qpIcvC3GrJsIkYz9ix3hopvT:3G6Q+W8pnrs7YzBpvT
MD5:	72C870C967629F6F1C36561800EC1E38
SHA1:	C01C9FF688F5B9AD0B586069AFAA4B22DB171F6C
SHA-256:	FC11EDD43A2D8FBAF64E61FCD71475CC9702097CF6A33F0884CB800B4EFCAE4B
SHA-512:	608E3F35A30D183E6FED5F652FB2694842EE4740CD33C2B7BEDD7C59C5EF82311976877D7F6CB3A42B948AA8F3AAD84E76CE663E46EA2279161F140D02D2D8AC
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..3..M..q...x..\|..5.8N...K..z.@.MF...S..."pRVg"r.A....M...1...{d..l.l...M...Z..]...].~.i.........r.T.V.6....W ..r.<.....-..o2.&.E....}.4.*...e.(.G.I.E.@..ka.Qgo...e.QV...F.9.}..O..k7<.\....k...u......._...n.W..w.+.....pf."d8.\|.G?.A.....Ik;x....g..c.>..............M....O.5.....Up..^..hz.VZ.w.#.....'q..v:..m...t.~{.iS.;.......N.?......S...4...B.._.:.%%+..Q+.i_.,g.

Chrome Cache Entry: 728

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (16970)
Category:	downloaded
Size (bytes):	17086
Entropy (8bit):	5.415003899069034
Encrypted:	false
SSDEEP:	384:OZ1JbnKjHAAWHG8POhOaA+ZiXVYunwz5sVSTa5pvp:I14jHAfVF+ZAueVSTaTR
MD5:	FAE183A6686E6CB57C05A81D2C6FCE0C
SHA1:	DEF4C56DE58B91C495B084BAC9D65308E97B7F0E
SHA-256:	0418C0B5699E521EBC7F0AE6A2DC701331FCA20F4BE4C1C34EC30D7D8C09C860
SHA-512:	9C7E2C21C626CA0288792CDB9A5F4D0889E00F30A03543DA911EBF60F43A6E51078A49FD5C98B96E3892BC6F0422BB36F9ECD302CD7719F1AD90B27027FE84A7
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/remoteEntry.aaaa260d.client.js
Preview:	var bNativeDisplayAdsNdisplayAdComponent;!function(){"use strict";var e={"59b4ee06":function(e,n,t){var r={"./IndexPrimaryAd":function(){return t.e("18cad957").then((function(){return function(){return t("e2912eda")}}))},"./IndexSecondaryAd":function(){return t.e("8067d7e4").then((function(){return function(){return t("0e92a2eb")}}))},"./SearchResultsPropertyCardAdWithProps":function(){return t.e("acdccaac").then((function(){return function(){return t("ceccbee2")}}))}},o=function(e,n){return t.R=n,n=t.o(r,e)?r[e]():Promise.resolve().then((function(){throw new Error('Module "'+e+'" does not exist in container.')})),t.R=void 0,n},c=function(e,n){if(t.S){var r="default",o=t.S[r];if(o&&o!==e)throw new Error("Container initialization failed as it has already been initialized with a different share scope");return t.S[r]=e,t.I(r,n)}};t.d(n,{get:function(){return o},init:function(){return c}})}},n={};function t(r){var o=n[r];if(void 0!==o)return o.exports;var c=n[r]={id:r,loaded:!1,exports:{}}

Chrome Cache Entry: 729

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	642
Entropy (8bit):	7.485255326893554
Encrypted:	false
SSDEEP:	12:6v/7+FO+DpBBzM22sBdG4llNTJ6yHfbE8/jALtcq4PsesuZtC6mN:5tj2sBdpXlHfw8chcqgsCZxmN
MD5:	41A0E840AA47C87E19D2BFE0B1231C3F
SHA1:	B5F588CA91FC9E67B5EA658C5FF943B0639E57B9
SHA-256:	A333D02EEDDE7A4DD8643D58B0EA7947268A1762F35F517EB6000EC9E7FCFAE8
SHA-512:	8578A788F605BC27B4326EB38417A71E45A05AC885B971C49AC3C7D23F6DDF747F69F2CCF3DF0C461E1C90268247D6959F248D3001518F56888F6D6B8C1CDD2E
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/backend_static/common/flags/new/48-squared/us.png
Preview:	.PNG........IHDR...0...0.....`......uPLTE..0<9p..0.'@.....0<:p.s}TS.....a_.HFymk.IFy.;I......yx....HGy..........Wd.........&@...mk.......G^............l.........tRNS...;%j.....IDATH..a..0..`..5..KiA8..S..O.y.....h><..4.......c..0..Pm.v......i...iuo..;..X..H'7LVM.....{..5zM.{.B"-4r[O..L..fw.hY..G...\.@h.U.kS...d.2`{...]i.....Zt@....t.,.z..W..x..........V-lB...S.!...S....U5.....E.+...g..4.....!.?...N..w.7-L[....<j..\|.+r5.u~..a0.<.l..._.h.q..4.....(.>.<.E.I...-t....X.S.77-nX.......^.T.*.....s.m.......~V....Lnz....Y...5......-...\|...{q...'.lN.W.4W]..<.......`!..A......D@...$.....0X.I..1XI.....T....C..@.}....IEND.B`.

Chrome Cache Entry: 730

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 120 x 120, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3358
Entropy (8bit):	7.907798798053907
Encrypted:	false
SSDEEP:	96:FVYvSYsTTNArki2QXr4oOucUuVWQ8+0dclqFKDp:FVYvSYs/NAQi2QXr4oytT5v
MD5:	5966A74D467AC8907792C738D59E8218
SHA1:	485CFDB9831DADE0391FCBAD72F8E62D931194C9
SHA-256:	6F8527D9408A651F17CF4DE43262A6FA2927AB2AF6CA98641828793AF062F118
SHA-512:	16B442140E6D6CC31062A375339F7C631B812120464CA6581A51193E95A4474A0083C8920A307038E8B6163E7775FFD2A0A281D13AF4E298021CE25709A8C4C3
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...x...x............#PLTELiq.k..h..s..]..m..a..s..n.....k..n..o..f..n..p..r..r..q..n........k........T...........G.................j..]..k!...yns(X........t...........q..............o..........................A..G..S..Y..L.....k..d..............g..;.(.....y...\|..%t.t..R.....e..%e.=..u..L...f..S....Mj........rJ.[o....)tRNS...........cx+N....h.:,...J...A.......FGS.....pHYs................lIDATx..gs....!....l.-w'AY..X.....H......+2. i9..D..$z5.4.....,..IOz.........gZ%{.xk.p....t...7......oRwgk..K......K\|g.ok.7r{....;h....$^..l.v......`.4.K.......R.R;...lI...........+x~?...ej..^x..j.dvWG.4..mv..R.r6\.LR....]V......XE9....u9......-....$r.Y...eE.^.....".......}.$....Z^..~x. ...!]........x.pm....z..e89w<W.dA.4.!..,...]..$.-...{37.r6.r...S...4.Y&T"U...../.<..hro..`I.N.#.Qt\b....K.j.5=S....z,x.......R$X.Y...X....+..w7e}p..0..&hex.4y,..1.a..... ...%....8go.Z$.6.2..T.Z..":..y......4WQ...+z...XC.1u..x=#K.;.=:.0N....;.1!....Zp:Kl~.5.9&.+

Chrome Cache Entry: 731

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 41976, version 2.0
Category:	downloaded
Size (bytes):	41976
Entropy (8bit):	7.989625983039537
Encrypted:	false
SSDEEP:	768:OQjdQDQwEmGLKtdFCmrIdlLBIU/Lvl1jpUgrNLHm87hJAeyupL/l+6WHdI8hDC:OQhQDQwEmGLKtOviuLHLHm87hJHEhHdo
MD5:	B2CA1822B16A92E0A0111C994CFE4B8A
SHA1:	AD3BF01829F003D1E837FDAE30B97E4911528C0F
SHA-256:	12269C2ADB9DA8C73E2D8E5628566E4662720BDFF4687C3BD6190571FF8C3B05
SHA-512:	2DDECA50F4E57226B3AF8571DC04E977255BA0303C7AB1F1B01BC0240189A4B2ED50DF296C42105F8F40DD9ABC7EB3C9DEB22619A513CBD7974E8FFFCB0A9AFD
Malicious:	false
Reputation:	low
URL:	https://t-cf.bstatic.com/design-assets/assets/v3.81.0/fonts-brand/BookingBold.woff
Preview:	wOFF........................................GDEF..\|........x\.].GPOS..}... ......m.GSUB...\|...z........OS/2.......Z...`j.C.cmap...........la.D.cvt ............!...fpgm...p.........0.6gasp..\|.............glyf......e/......z.head.......6...6...Jhhea....... ...$...&hmtx...T.......D..R.loca...........$1C^.maxp....... ... ....name..{...........G.post..\|........ ...Jprep...........K.L............])_.<...........K.....V.l....................x.c`d``..........=a...A.L...-.........M...X......./.a..........x.%.5.B....7...F.t.b0"9(.=.$D ..?..u.w...g.TY>.d..m7L5._...V@.`1.N.C..=....2.....;.........x....4G..o........fl.b.m.m..s.IM.7..WSU.p..[....o`<....k.xW.*[.3e].....[xG....{.....r.`.@.......?.=.......`.b<) K..i..d..]H-.%c.b..T..d......d&.@F...d.......3.I4./.q.'..1.o.......,...Kf.V'S....X.. qW..m....d.\.....i.9...P...n.lb.1...1..b.;.C.a...w.:....d...=....d.;.ed....n=L".................&..6..%O...X....~.{....t.:..I..D.<F..a?..^B.T?....u.e..Y`......9.gO...v..\.17...f

Chrome Cache Entry: 732

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	124312
Entropy (8bit):	5.368835617873961
Encrypted:	false
SSDEEP:	1536:DbRMV4Rdxeo/0PXTvdnzW8kvl+Q+bleEUFIuKhpKhq:fcocXTvdnzW85HeEUFu
MD5:	87F71169401FA4A8937B2720A3C36608
SHA1:	1C9D7A843BFC3EE2531F092DFF8625430A8D74E9
SHA-256:	00A8EAB62A33A1DB93E8CB1D8BD81BC6B2F2BAB681223292BE08CB2703DA5E59
SHA-512:	55F4A6D5B374400AA69AF3E730BA417D3AC36DD5C99BDB2916DD74064FB58E880954FE96853D6073F60FD748556455F450B2440D518888A77732314BEE55A13C
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/raf_cloudfront_sd/92b3daaabd4371c78818992ce9342e212f673b31.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.raf={loaded:!0,run:!1}),B.define("component/referral/floater",function(e,n,i){_i_("44d:439cb7dd");var r=e("component"),a=e("ga-tracker");i.exports=r.extend({init:function(){_i_("44d:bdf88b61");var e=this;this.$toggle=this.$el.find(".friend_landing_collapsible--header"),this.$toggleIcon=this.$el.find(".friend_landing_collapsible--toggle_icon"),this.$collapse=this.$el.find(".friend_landing_collapsible-action_button"),this.isMobile=this.$el.data("is-mobile"),this.toggleCollapseClass=this.$el.data("expanded-class"),this.toggleExpandClass=this.$el.data("collapsed-class"),this.isCollapsed=!!this.$el.data("is-collapsed"),this.isCollapsedClass=this.$el.data("landing-collapsed-class"),this.collapsingDisabled=this.$el.data("collapsing-disabled"),this.collapsingDisabled\|\|(this.$toggle.on("click",function(){_i_("44d:db6abdaa"),e.isCollapsed?e.expand():e.collapse(),_

Chrome Cache Entry: 733

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	dropped
Size (bytes):	10601
Entropy (8bit):	7.952829040090789
Encrypted:	false
SSDEEP:	192:mgDag35PTKU4bA9efpLxOrbnaaDyYPf+CZ1xOqPpXhk5J5CK77mycG3Bl7AZMNe2:3D/PTa1xNOXnaSy5CvxzpXhwjCKp3Blf
MD5:	33BFA10DC5BC4EF8339BD5ABEB8548EA
SHA1:	957C2B9E899E2520A2C97F21D638FCA030DA5A43
SHA-256:	0380753C60C2FA8BD19A5346B32E08DD50BE778FA3D850147638EB16C16BF0B2
SHA-512:	5EFA5E2FDED0BDAAB75AD6AB876FF35A3EAEAAD257E6BBFDD0E2F0D6789FD7D927E13F34CDFA3E4674F3062DAF2016F954D6DDEF4EBF1F21C6643A2E12D85BFD
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...N.J...F.\.&.3&..I.5.2U)S.M.....9o.F.$Gj..@..w..k.eb.We..... .S...{R.^N;Q..W..cc.FGqZ.4.B.....<..8...}...4.}C../.5.1.2;`...^.../.D$.n2:...EGd4l .........E..}......B...0...Ee.<....]........\\|@.....t....k....c[......;8'Fx.....ITm.\|.Mm..n...M>.K..w...VO.......G..ci.bp.`..\...0..{xA.9.\4.=....ZP...'...p?:..5.v.&.4.o}'.8..u.......:........*O.W.P.;r..

Chrome Cache Entry: 734

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	123288
Entropy (8bit):	5.321934214109361
Encrypted:	false
SSDEEP:	1536:By1J0vJzBgjBgJZR1tXjBgjBgZemmNIHLuUuRUb:UkvJZZTqe
MD5:	7FCE55AA3D0F49D490812A57BDDD13C4
SHA1:	9981F03DDB9F1B49627157498D6649EEB89CECFC
SHA-256:	D4BEAB6A53D05EEEEF092265AC072F44C66EEE56C5A522ABA7FCA5C107B4A9D4
SHA-512:	E8CE1FE188863EEEC91C33E6FFF80AEC4BB0BD9E9B06A852B99D5401BC2F9851FFAF40C97300F3DF85FFDDAF258E8712D7D3A4EA313DFE94818402DEF1E48F94
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/43e47265.79cb7ba8.chunk.js
Preview:	"use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["43e47265"],{d0989236:function(e,n,i){i.d(n,{B:function(){return a}});var t=i("dc6d28ff");function a(){const e=(0,t.getRequestContext)();return{get acceptHeader(){return e.getAcceptHeader()},get actionName(){return e.getActionName()},get affiliate(){return e.getAffiliate()},get basePageUrl(){return e.getBasePageUrl()},get body(){return e.getBody()},get bPlatformEnvironment(){return e.getBPlatformEnvironment()},get CDNOrigin(){return e.getCDNOrigin()},get CSPNonce(){return e.getCSPNonce()},get CSRFToken(){return e.getCSRFToken()},get currency(){return e.getCurrency()},get encryptedCommonOauthState(){return e.getEncryptedCommonOauthState()},get ETSerializedState(){return e.getETSerializedState()},get isInternalIp(){return e.isInternalIp()},get isInternalUser(){return e.isInternalUser()},get isLanding(){return e.isLanding()},get isNormalRequest(){return e.isN

Chrome Cache Entry: 735

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4651), with no line terminators
Category:	downloaded
Size (bytes):	4651
Entropy (8bit):	5.2578588026754325
Encrypted:	false
SSDEEP:	96:U0zVt95P3VWF4VRxCTv7qQv4nRU7DerZqG5FRcK0:NT/3RTARgnRU7DeNP0
MD5:	486DBFC2509A5B7F573CBE21281BACD7
SHA1:	DAEB06E3A01B43113B3F39C06804F25606B2EA35
SHA-256:	1F3B6D872420FB5262782438EC43056204E645915D132E05CDF886D40AE70B15
SHA-512:	D9609E2886443747C46CF1A84723C24F2EA4AF6C3F5E08AACD5AD7BEC9944123D3DFB8975C567F27A3B2EF114C8FA089E1720490803C03719E1B7CB4941EFBB2
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/accountsportal/assets/runtime~index_9239c9c6cbeb2a77c28f.js
Preview:	!function(){"use strict";var e,t,r,n,o,i={},u={};function a(e){var t=u[e];if(void 0!==t)return t.exports;var r=u[e]={id:e,loaded:!1,exports:{}};return i[e].call(r.exports,r,r.exports,a),r.loaded=!0,r.exports}a.m=i,e=[],a.O=function(t,r,n,o){if(!r){var i=1/0;for(l=0;l<e.length;l++){r=e[l][0],n=e[l][1],o=e[l][2];for(var u=!0,c=0;c<r.length;c++)(!1&o\|\|i>=o)&&Object.keys(a.O).every((function(e){return a.O[e](r[c])}))?r.splice(c--,1):(u=!1,o<i&&(i=o));if(u){e.splice(l--,1);var s=n();void 0!==s&&(t=s)}}return t}o=o\|\|0;for(var l=e.length;l>0&&e[l-1][2]>o;l--)e[l]=e[l-1];e[l]=[r,n,o]},a.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return a.d(t,{a:t}),t},a.d=function(e,t){for(var r in t)a.o(t,r)&&!a.o(e,r)&&Object.defineProperty(e,r,{enumerable:!0,get:t[r]})},a.f={},a.e=function(e){return Promise.all(Object.keys(a.f).reduce((function(t,r){return a.f[r](e,t),t}),[]))},a.u=function(e){return"assets/chunk_"+e+"_8ccf22dc56715584460d.js"},a.miniCssF=function(

Chrome Cache Entry: 736

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2559), with no line terminators
Category:	downloaded
Size (bytes):	2559
Entropy (8bit):	5.955755784843443
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08x/xAp4VHIh8tzYig30+6:wsbSUtJfxrqLWWWdV6j1hxAGHoKn
MD5:	AAA31BB595324536401048E38AB724F7
SHA1:	9AB054F8BD14E729861704B800392C86F8CC675B
SHA-256:	BB6592D657C9167970688E82EC4CD512A5080ACDD8F35EDC13D511B10CB223DE
SHA-512:	994A51348D4A33150E36C0CBBF05482F22FCAC81BFA49C2CAB28C32A33C06A9580D32F5DE79562C95CD288AEA04F89AB24C50527B08071A9FB2E153279BD251E
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/973712236/?random=1707417370647&cv=11&fst=1707417370647&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=LJXqCKDEq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 737

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (523)
Category:	downloaded
Size (bytes):	2779
Entropy (8bit):	5.256421685296428
Encrypted:	false
SSDEEP:	48:XFZp/sZ3lYQc7ArfSM3eIubF1QkNsKclMtPp/7qgAsFte6NPvD9T5AyNBK:1f/6lGUrff3eFLhNs+G6hb9xK
MD5:	7B430C6350A59A7CF22B9ADECCBA327B
SHA1:	B48D3C289BCB6809BB52FFFD8F013055ED6BCD65
SHA-256:	058ED961BFE422AF7BFC65865F4C08531EC8ACE995F8A1EC560A46581CB7712C
SHA-512:	BBB70E6C0318ED68FC6810E0210D010FC743B9987C6ED15A43C5D308A96A43331B79C3FAB1B39A9034398418FA3321EEC8C51998D79C981E3F511DA3B398326A
Malicious:	false
Reputation:	low
URL:	https://www.google-analytics.com/plugins/ua/ec.js
Preview:	(function(){var e=window,f="push",k="length",l="prototype",q=function(a){if(a.get&&a.set){this.clear();var d=a.get("buildHitTask");a.set("buildHitTask",n(this,d));a.set("_rlt",p(this,a.get("_rlt")))}},r={action:"pa",promoAction:"promoa",id:"ti",affiliation:"ta",revenue:"tr",tax:"tt",shipping:"ts",coupon:"tcc",step:"cos",label:"col",option:"col",options:"col",list:"pal",listSource:"pls"},t={id:"id",name:"nm",brand:"br",category:"ca",variant:"va",position:"ps",price:"pr",quantity:"qt",coupon:"cc","dimension(\\d+)":"cd",."metric(\\d+)":"cm"},u={id:"id",name:"nm",creative:"cr",position:"ps"},v=function(a,d){this.name=a;this.source=d;this.e=[]},w="detail checkout checkout_option click add remove purchase refund".split(" ");q[l].clear=function(){this.b=void 0;this.f=[];this.a=[];this.g=[];this.d=void 0};q[l].h=function(a,d){var b=d\|\|{};"promo_click"==a?b.promoAction="click":b.action=a;this.b=x(b)};q[l].j=function(a){(a=x(a))&&this.f[f](a)};.q[l].i=function(a){var d=x(a);if(d){var b,c=a.list\|

Chrome Cache Entry: 738

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	529
Entropy (8bit):	4.540013377890224
Encrypted:	false
SSDEEP:	6:YNMa9YaeRbUHjG2+z/iJdXu0iHDo/cj6kHKWM3xlgxDd3:YNNGa0+CXz/iTuqkCT3fwR
MD5:	6E37C1879BB26AB5CD9BAB02080F3973
SHA1:	AE861EC24A1F2818B7EFAB39205361C4FEC792DF
SHA-256:	AE80D8E84BE8837B20479FA1EB5E04060758E78E057ED9513C53CBA5BA0F9A64
SHA-512:	64A8CA2F6142CC47EF8D5B7FCF77B94AC10623D49201486E687229B8638EFC372EA252722FDC28964E330FC597B9528B93A12B76863391C5D82879D1B341E9CC
Malicious:	false
Reputation:	low
Preview:	{"/3102/bcom-www/accommodations/index/index-primary":["html",0,null,null,0,50,320,1,0,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,0,null,null,null,null,null,null,"AOrYGslXqzWxZnMwa10HhsoG5C0a","CNX1haqxnIQDFTgATwgd-QoAjg",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1",null,null,null,null,null,null,null,null,null,null,null,"AA-V4qMCHu_ELBxIh66RvuJmI7Wu59l0_QysfDKS51MV7BXABeHWCKuQZWbQqsW6P8wiUsVqmrt9mRVeIlcbReDoN6Tt0tTiVQ",null,null,null,null,null,null,null,[]]}..

Chrome Cache Entry: 739

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=CIu156ixnIQDFXji_QUdFZIKVQ;src=4228414;type=views;cat=views;ord=4050429631327;npa=0;auiddc=*;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=1884632172;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 740

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3814)
Category:	downloaded
Size (bytes):	3930
Entropy (8bit):	5.267050811992827
Encrypted:	false
SSDEEP:	48:qGw21GD4ijjnqHxUZk9WE8H6q/l21GDoA+KsazuIFPGDiILlNaiVH+9QKi+kD:ZwYijDwAzlIhKvzuIlQlMiVHuQKi+kD
MD5:	1A7C523A95596C5B0B122AD8D8E3B553
SHA1:	D5AA6D31940547945F222556B47021E4BE4A8F6B
SHA-256:	9E1C2B43278AF5E8C2F2672EF94438ECFE1C366448A79CCC0C22C837A4AE1E91
SHA-512:	3F212E5664920D72ACE0F8C11CAB56E9194C88CC9BB454A17C2D02DFE3F217ECE2AE27BDA965D79E7E23F9E3F2EFD2EDCC09234973AA07B4E5E66E06053CD17E
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/d2a738da.079c3b4c.chunk.css
Preview:	.b4e39ab2ab{width:100%;position:relative}.b4e39ab2ab.aa361a7d23{background:var(--bui_color_brand_primary_background)}.b4e39ab2ab.c68f130be1{background:var(--bui_color_white)}.be2031501f{max-width:1110px;min-height:375px;margin:0 auto;box-sizing:border-box;padding:var(--bui_spacing_12x) 5px calc(var(--bui_spacing_12x) + 30px);position:relative;display:flex;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.a3c3e0e78d{margin:auto 0;max-width:600px}.c9e1121963{width:100%;height:100%;position:absolute;-o-object-fit:cover;object-fit:cover}.rtl .c9e1121963,[dir=rtl] .c9e1121963{transform:scaleX(-1)}.b4e39ab2ab.a1aac51f24{background:#000;max-height:434px}.a1aac51f24 .be2031501f{z-index:3}.a1aac51f24 .c9e1121963{width:100%;max-width:1440px;height:100%;position:absolute;-o-object-fit:cover;object-fit:cover;left:0;right:0;margin:0 auto;z-index:1}.c355246e56{position:absolute;top:0;left:0;right:0;margin:0 auto;max-width:1440px;height:100%;z-index:2}@media screen and (min-width:

Chrome Cache Entry: 741

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 742

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 2880x868, components 3
Category:	dropped
Size (bytes):	245767
Entropy (8bit):	7.948498789608872
Encrypted:	false
SSDEEP:	6144:39mtb2UjDzQo+Nv2+8O5zhwJDDKW2r6F+QYLI87eb3VzFyZo:Nypj/B+VXiBDKW2r6dYjab3Hya
MD5:	FB85E3F5959D74E781F58FFAD5E3037D
SHA1:	9DF89DD837AECDC743E60E51B26C4CBC4A4A8FE1
SHA-256:	5D792D42BFE6AC44DAB107FE96F0E6EC90B3727EFC41B68146B20676392AF510
SHA-512:	97C813AE769FA5D524D755458C590AC035CC212EACF82FF199EF578529218C7606E96C23E6B2C44B40F2FD09D96C9CF114142132673C7CCE077BDB1BFE8EDDFC
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......d.@.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..."...E'..'...i>\........jA.S.....q.!.i.E3o4.....9..R..P.g<Rb..-.7..h.JH..i...P..O....8&.......3F0x..=y.8"....h....dS...b....P)...#8...A8jC..h.q.i6.......S..a...ORh4.`Rm..Jx...N).....@..ix.JF(... .....!.9..=...&....H..h.h..Q..wJ1.@....jQ.....9..8d.x...1GA.....9....4... .`*.H..zQ.....M=y..r.7..!p1.i S..I.....4..O....L..H.x..jv0:..!.`.`...iT......ql..n.....P...9..s

Chrome Cache Entry: 743

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 120 x 120, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	3358
Entropy (8bit):	7.907798798053907
Encrypted:	false
SSDEEP:	96:FVYvSYsTTNArki2QXr4oOucUuVWQ8+0dclqFKDp:FVYvSYs/NAQi2QXr4oytT5v
MD5:	5966A74D467AC8907792C738D59E8218
SHA1:	485CFDB9831DADE0391FCBAD72F8E62D931194C9
SHA-256:	6F8527D9408A651F17CF4DE43262A6FA2927AB2AF6CA98641828793AF062F118
SHA-512:	16B442140E6D6CC31062A375339F7C631B812120464CA6581A51193E95A4474A0083C8920A307038E8B6163E7775FFD2A0A281D13AF4E298021CE25709A8C4C3
Malicious:	false
Reputation:	low
URL:	https://t-cf.bstatic.com/design-assets/assets/v3.99.1/illustrations-traveller/MagnifyingGlassUsp.png
Preview:	.PNG........IHDR...x...x............#PLTELiq.k..h..s..]..m..a..s..n.....k..n..o..f..n..p..r..r..q..n........k........T...........G.................j..]..k!...yns(X........t...........q..............o..........................A..G..S..Y..L.....k..d..............g..;.(.....y...\|..%t.t..R.....e..%e.=..u..L...f..S....Mj........rJ.[o....)tRNS...........cx+N....h.:,...J...A.......FGS.....pHYs................lIDATx..gs....!....l.-w'AY..X.....H......+2. i9..D..$z5.4.....,..IOz.........gZ%{.xk.p....t...7......oRwgk..K......K\|g.ok.7r{....;h....$^..l.v......`.4.K.......R.R;...lI...........+x~?...ej..^x..j.dvWG.4..mv..R.r6\.LR....]V......XE9....u9......-....$r.Y...eE.^.....".......}.$....Z^..~x. ...!]........x.pm....z..e89w<W.dA.4.!..,...]..$.-...{37.r6.r...S...4.Y&T"U...../.<..hro..`I.N.#.Qt\b....K.j.5=S....z,x.......R$X.Y...X....+..w7e}p..0..&hex.4y,..1.a..... ...%....8go.Z$.6.2..T.Z..":..y......4WQ...+z...XC.1u..x=#K.;.=:.0N....;.1!....Zp:Kl~.5.9&.+

Chrome Cache Entry: 744

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1949)
Category:	downloaded
Size (bytes):	2065
Entropy (8bit):	5.1927602038234495
Encrypted:	false
SSDEEP:	24:04WV/aJCQI27PWV/d1COAKrW+EA+JzAaotdz6C/f2GPpBqB1+TmqT:04aCJvTLa7tbAekC/fnP3qBcDT
MD5:	E66324EF6E0246820FB69426FDB7B8AD
SHA1:	F6A4DF504FD1F1466D86F6A7B1BA87ECB1A65708
SHA-256:	C160F8B64AED88F471F6AF5717654B69C2AFEB7C760695B1B405C80D90ABD7F8
SHA-512:	3060418CA09B91CF3D15B0086DAE7B8057382766A59DD354081E65784DD5084ECF47BB9E9EE36CCF3D4FD5EE2B92B971942F9F9A396E65ABEFA2E3AB8F89E59C
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/1baf5a63.539e3a8f.chunk.css
Preview:	.a529739de5{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch;border:var(--bui_border_width_100) solid;border-color:var(--bui_color_border_alt);border-radius:var(--bui_border_radius_200);overflow:hidden}.fe04f404b8{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch;box-shadow:var(--bui_shadow_100);border-radius:var(--bui_border_radius_200);overflow:hidden}.f538ae62ac{flex:1 1 0}.a244555425{background:var(--bui_color_background_alt)}.a6271fb6c2{margin-top:0!important}.edb4db1de8{flex-grow:1}.b8d585fcc6{border:none}.e98333fe6c{-webkit-line-clamp:2;display:-webkit-box;-webkit-box-orient:vertical;overflow:hidden}.bc476201ed>:nth-child(n){margin-inline-end:var(--bui_spacing_1x)}.e714215256{-webkit-line-clamp:2;display:-webkit-box;-webkit-box-orient:vertical;overflow:hidden}.cb32f1ced0{overflow:hidden;white-space:nowrap;text-overflow:ellipsis}.d542f184f1{fill:var(--bui_color_accent_border)}.bca48

Chrome Cache Entry: 745

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
URL:	https://adservice.google.com/ddm/fls/z/dc_pre=CMCFs6-xnIQDFbjbuAgdwz4C4g;src=4228414;type=views;cat=views;ord=4729221658983;npa=0;auiddc=*;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=900727044;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2
Preview:	GIF89a.............!.......,...........D.;

Chrome Cache Entry: 746

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 747

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (46103), with no line terminators
Category:	downloaded
Size (bytes):	46104
Entropy (8bit):	5.3053668132686145
Encrypted:	false
SSDEEP:	768:OaOFhhRDUHahpROfRys3LzQRo4TYYyDMFWPKQ:OaOFnRrRURtzQy4ISWiQ
MD5:	7F75F159026F3A2C8CCCDA487B43157B
SHA1:	021CF5C854DB063CD79BF0394C24EB994E095640
SHA-256:	5E319852607809336B2534FFEB96F6933F26994DD040F535302C84F59CC0A214
SHA-512:	88276152EE25891D16E7B3B28A9B42CBD48D97E1A7D94C1BF5354612603868D5D537D2BA01A4E2F184E6DC6A492B67619D6A7C02DA992AD604F7D0ABEF27A7A1
Malicious:	false
Reputation:	low
URL:	https://bat.bing.com/bat.js
Preview:	function UET(o){this.stringExists=function(n){return n&&n.length>0};this.domain="bat.bing.com";this.domainCl="bat.bing.net";this.URLLENGTHLIMIT=4096;this.pageLoadEvt="pageLoad";this.customEvt="custom";this.pageViewEvt="page_view";o.Ver=o.Ver!==undefined&&(o.Ver==="1"\|\|o.Ver===1)?1:2;this.uetConfig={};this.uetConfig.consent={enabled:!1,adStorageAllowed:!0,adStorageUpdated:!1,hasWaited:!1,waitForUpdate:0};this.uetConfig.tcf={enabled:!1,vendorId:1126,hasLoaded:!1,timeoutId:null,gdprApplies:undefined,adStorageAllowed:undefined,measurementAllowed:undefined,personalizationAllowed:undefined};this.beaconParams={};this.supportsCORS=this.supportsXDR=!1;this.paramValidations={string_currency:{type:"regex",regex:/^[a-zA-Z]{3}$/,error:"{p} value must be ISO standard currency code"},number:{type:"num",digits:3,max:999999999999},integer:{type:"num",digits:0,max:999999999999},hct_los:{type:"num",digits:0,max:30},date:{type:"regex",regex:/^\d{4}-\d{2}-\d{2}$/,error:"{p} value must be in YYYY-MM-DD date

Chrome Cache Entry: 748

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=4228414;type=views;cat=views;ord=4050429631327;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=1884632172;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2?
Preview:	<html></html>

Chrome Cache Entry: 749

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	"https://www.booking.com/js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=2c8482c2544201f4&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|4,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|2,cCHObKdBdUHINPSXeHDALOLOLMO\|5,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv="
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 750

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	dropped
Size (bytes):	4146
Entropy (8bit):	7.879386090200039
Encrypted:	false
SSDEEP:	96:ghCEar1nWNYjzUb9lA1ordcEKbXYfqpuBQc7g+sXQ:mCJr1n7gZlACrde6Au6B+5
MD5:	1B6BF74DA8A89D12343F5FE72D1E3361
SHA1:	E87597EB1A60945006757C7E377316D6F1687675
SHA-256:	62723382417704DC76F8F37079F1B130A8542198FE02987CE6127E833BFD131E
SHA-512:	8D6CC7C5F570796F3DD5C2A0E19793FC96F7146F99C9DB0B98BA32AA933DFB88906D94050B1B2BD4D79345991CEDD28635D4CD76F3DF9DEAB6697ADDFC1D34D7
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......d.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....;m.z.7.*...$m......x.Z.>......Z)$.I9....../tH2..a..;..ao..9.-......x9....j..j.%..:\|"#{o,C`f.We....=2s\...)..P./.E...a....[C`..v#9.\|.s.Z...5...)n$tny.[..:...[.m,..K.\|.-.....\....Tv...v~..........$&wE`.A..$...'O`..d.8......~^.WO.:M..k}..p..P.HA.3.=..3K.'....e.R.....G.dh.u..r(.;..V..9.....I.y..5..}.&K.8..hi{a...9...\..........x..)nVD.I..#t8 .09..L.i"]

Chrome Cache Entry: 751

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	84947
Entropy (8bit):	5.396947593882615
Encrypted:	false
SSDEEP:	1536:AKkykki5kzkC/HL+sDOfC5RUC6eDaDcRRuSlYRXzu37B:PkVRCKsDMPeDaDmYNC7B
MD5:	C5DCEDD1A2D2A020EC849540BD3AA5B1
SHA1:	0C97C9581A9113D831B196E55F5CEDE654747FCE
SHA-256:	43829815B6CA075E109A80BA0540A8684AEACD48AEDFDFF6F197F04D55EB3C93
SHA-512:	24265B15E2E3982CE480EE89ECEDE8BE47441A4AE9EAEF1B1C9969B9004929A008170AF6820034E0D0973AD650D1EB612FDB3999DD0CC9E1990F2FEB94DAA46E
Malicious:	false
Reputation:	low
Preview:	{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","pccloseButtonType":"Icon","MainText":"Manage your privacy settings","MainInfoText":"Select which cookies you want to accept on Booking.com.","AboutText":"You can find more detailed info on cookie use and descriptions in our privacy and cookie policy.","AboutCookiesText":"Your Privacy","ConfirmText":"Allow All","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","CookiesDescText":"Description","AboutLink":"https://www.booking.com/general.html?tmpl=docs/privacy-policy","ActiveText":"Active","AlwaysActiveText":"Always Active","AlwaysInactiveText":"Always Inactive","PCShowAlwaysActiveToggle":true,"AlertNoticeText":"By clicking \"Accept,\" you agree to the use of analytical cookies (used to gain insight on website usage and to improve our site and services) and tracking cookies (bot

Chrome Cache Entry: 752

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	1631
Entropy (8bit):	4.781908887549421
Encrypted:	false
SSDEEP:	24:hYNspeCCZkpG4MEz7agcn0LXTF2FI6nQtSn8nwz8Xx:vp6BY7agCwTF2FIhx
MD5:	E6E0F6C608A325D3F89203CC8727A44D
SHA1:	9665476C087F5B221EFFA8317807FD4297F3C506
SHA-256:	63706E438A383CA6D990704F5F9FF89517A286517EA2320279A15E906D3D029E
SHA-512:	9313FC2C46ABD3FF14F01A7931A205CE63FCE0310315DACC5C9D6561491D2FA2E134FB6C3639FB64EE28EC14F6CFC766CCD4876222598995226301FA88CF5D53
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<html lang="en">.<head>.<title>405 - Method Not Allowed</title>.<meta http-equiv="content-type" content="text/html; charset=utf-8" />.<meta name="viewport" content="width=device-width, initial-scale=1.0">.<meta http-equiv="X-UA-Compatible" content="ie=edge">.<link rel="stylesheet" href="https://r.bstatic.com/libs/bui/7.3.1/bui.min.css">.<link rel="stylesheet" href="https://q.bstatic.com/libs/calango/0.500/bui.css">.</head>.<body class="c-body">.<header id="c-header" class="header">.<div class="c-header__main">. <div class="bui-container bui-container--center">. <div class="bui-grid c-header--top">. <div class="bui-grid__column-3">. <a class="c-logo__wrap" href="/">. <span class="c-logo__type">. Bookings_Web_Accounts_Portal. </span>. </a>. </div>. </div>. </div>.</div>.</header>.<div class="bui-container bui-container--center c-main-body c-

Chrome Cache Entry: 753

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (460)
Category:	downloaded
Size (bytes):	572
Entropy (8bit):	5.530219507352385
Encrypted:	false
SSDEEP:	12:+A+n+OdUzx8qaBZQmSkbIjnnX9kMSZkI4kIBQEIoauwam4VV:R+n+OWCPwhkbIjnSyInIB/qamsV
MD5:	5776FA326996FC5FAB93FC69B26CBE02
SHA1:	1C48BC70A948482031F12F972AF9070BC6A48CD4
SHA-256:	DAE41A4AF432FE6780ECEBF3FB7CCFE2B8D010895E636797E1D19B4AB8500617
SHA-512:	64A96595687D28343CB9847A310B1052A8D89C8AC0090010ED2B5A9BF9D0B1FC499ADF1E28B54B8706EA110398C99DD19D2110FEF8A4C727EB7FC008F7B4A17B
Malicious:	false
Reputation:	low
URL:	https://q-cf.bstatic.com/psb/capla/static/js/95f0c6f5.61e0b6e0.chunk.js
Preview:	"use strict";(self["b-flights-index-component-service__LOADABLE_LOADED_CHUNKS__"]=self["b-flights-index-component-service__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["95f0c6f5","8b5cc5d5"],{"751a3875":function(e,t,n){n.r(t);var i=n("ead71eb0"),o=n.n(i)().createContext({rtl:!1,setRTL:function(){},defaultViewportSize:"small",themeMode:"light",providerCount:0,providerId:"",idRef:{current:0},setThemeMode:function(){},invertThemeMode:function(){}});t.default=o}}]);.//# sourceMappingURL=https://istatic.booking.com/internal-static/capla/static/js/95f0c6f5.61e0b6e0.chunk.js.map

Chrome Cache Entry: 754

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2341), with no line terminators
Category:	downloaded
Size (bytes):	2341
Entropy (8bit):	5.900968743934257
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt08x/cAg4atzYig3Kvc6:wsbSUtJfxrqLWWWdV6j1hcAeHd
MD5:	87A5F362265726016D2AE009617D8136
SHA1:	87E9D9734E77F07D99725863522F96072E7DD1D7
SHA-256:	DC624BAB5E3B6A01C7E924225241274449E2CC0C9A0B2BC0977268E1F04704EF
SHA-512:	9D50966C2EF52F7BF0D88A5DD582D0629415D3FDFD385AD320CC03FF2470CA2D261AB0476828967645D83549E50481B5578352BBB53D75240D05C68CFD33CE85
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/973712236/?random=1707417356745&cv=11&fst=1707417356745&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 755

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	6661
Entropy (8bit):	4.80095747612634
Encrypted:	false
SSDEEP:	192:FnF7pSdDHj4w8psdXH73uRCwpY6vepSdDH3q3AJtd:vdwDHj4/2XH73uswpzowDH3q3AJtd
MD5:	C7F29EB8AB47BE7F1DA11F3476AFB880
SHA1:	129375120DA802DA9F47FB1B7784973844982354
SHA-256:	62042CDA60BEF4E79061BF0A8CE3F523224AC45986FCBCA22B1F187EE642CA3E
SHA-512:	2552EC1EEC83E494410ABEA29D962D8AD6BD1D20A4B3DBDB08029F28EC789B130115A9D839DEB85D08DE6AEFA9C027B6539A575A2BCC664790974CC870BAB29C
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/3ea94870-d4b1-483a-b1d2-faf1d982bb31.json
Preview:	{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202310.2.0","OptanonDataJSON":"3ea94870-d4b1-483a-b1d2-faf1d982bb31","GeolocationUrl":"https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location","BulkDomainCheckUrl":"https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck","RuleSet":[{"Id":"9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf","Name":"US","Countries":["us"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","en-US":"en-US","bg":"bg","lt":"lt","lv":"lv","hr":"hr","fr":"fr","hu":"hu","default":"en-GB","zh-Hant":"zh-Hant","uk":"uk","sk":"sk","sl":"sl","id":"id","ca":"ca","sr":"sr","sv":"sv","ko":"ko","pt-BR":"pt-BR","ms":"ms","el":"el","en":"en","is":"is","it":"it","es-MX":"es-MX","es":"es","zh":"zh","et":"et","cs":"cs","ar":"ar","pt-PT":"pt-PT","vi":"vi","th":"th","es-

Chrome Cache Entry: 756

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	11818
Entropy (8bit):	7.9860828029424535
Encrypted:	false
SSDEEP:	192:bKIy2MEpYoVUAvZGR9AFhsMVhT6XmvkuY2NZZuS2MpI/FRcQmu9s8FnMlBEnvJP:WP2MEpYyUqZFroGkuYOZeMsX6gnA4P
MD5:	0BC71CE2B9DFC4C90E517E3C02D1704E
SHA1:	1A11354A72CA44D3F11F8DEAB256C64F2EAD2D56
SHA-256:	C315B5110B88030A9FE985571D5F36EDEE908B78EF4391709A00D7BADDF14F58
SHA-512:	1C93DD89EF5C2C0443FA4497241DCD27F2236BA63880D1363AA31A370544E02BDD1AFAC1610C541D223D21F120E8793E325AC30F7EC29DAA3AE278C8067376FC
Malicious:	false
Reputation:	low
Preview:	RIFF"...WEBPVP8 ....P........>m..F.#....]H...e....?Z.....M.....\...m.0yY.........k..1.....b../._..%......Z...A..3...<?.......>.=`?.../..d/.W...po.3...=.u.>.Jhf.J...l_..i....wA."....%..{}#p...gI._L.w.....D.......ux.Lu.5.#.I....o.w[..s.......#..5...43.c.X'.t.J4...._%.?9.Qw.~!.<.%.O..u.xH).r......'.W...."r>....a.....r.....z.xet........t K..V..L.?.L....W".qB.....b.E.l..U....1....Q.(..H.=$..!.......U.....-..Lh~e}........t..)M.2..C..a.{(..zi..a.G......+......M\|y..&...'f(p..B\..<..2.awS........I.....$$Z<Kl.[..>Q....tQD.r....r.V...e...M6...."..gp....'..u...>o.a.......D.".a.}.......Ke.J.D.o......x...rw..d.~K=.T]>....v..\.....p..k..b.i8X...h.J...(%\|9<....]/........2..._.O...........$...M".t.......L...a.-...........<..7....~j.......]W...n..Z;>.KE.D.d;=E...Pc%.i\......t...i#....m_.aR...7.HT..m.m.ey._s.\|T'.:t*..v/..#..N...s..\N`..B..%.....=.RW[.2m2......"..d.w.a^.2H...N..~v..........a....}.....s.....&.a....Y..1.9.W.G..P....%..~......=FE

Chrome Cache Entry: 757

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	downloaded
Size (bytes):	7768
Entropy (8bit):	7.936924535498852
Encrypted:	false
SSDEEP:	192:mIk5lAeKSkAguumq8HNw7MU7Kfl3baL1S5S9CkVtpR66/U6x:nelAmknHWcsl301SIgkVtpk6/Tx
MD5:	8916C59C9466E18D23DC7200B4EDD4DD
SHA1:	C1879666FC2DA5D23D349597132486CF1FD835F9
SHA-256:	5CA18D4B41E1FD2A9B990FC774A7177B30FAA68CA5A81CD8E2C0FD9ADE116085
SHA-512:	D332FCD01654C75CE1BF7237B62B80FDA8A2B4CBDA5EE2F75142835D8F0E21A6894B518BE071787BD26FE5602E7AC2A883A622B62A969D5008CE0463C6C08C90
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/xdata/images/city/170x136/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....v.q..G..r.(#p?.=8.z.v...v.B..<2.h,:......i......PC.#....Qi....Wg.......;%.+.>+S4.n.Wi.n.>..H.4...2.S.,v[..H.".g##...+..>.mo....%.2mt.8...`.-..-....a(..#c...)"..kH.g.9..a..x.z..n.].TF\|.V_......%.....c......q...wi... x.(.;..].'.N.'......h..R;m,.9A.7$c...q.jv`>...F@#=.kOH..J..1..F+...{.+..X.wFS..:/.A.....0."..h.0W8.}......lc..o..... .G..@.g.#5...7qnvH...

Chrome Cache Entry: 758

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (23458), with no line terminators
Category:	downloaded
Size (bytes):	23458
Entropy (8bit):	5.423284243634457
Encrypted:	false
SSDEEP:	384:jXdisaaC+iSweA7/XinkmNof3kjJHpyvg65EEOcmqjdPyLO/x+0MBpQGdAXGpnE0:T8saaCdSweA7/XinkmNofUNHpyA3cmq6
MD5:	87EBAD5E35B16416E765E6E9D4A36BFD
SHA1:	83259840384C9875E3DE1E82E63741E8762FD39A
SHA-256:	FA611D2227AA0ABBE178EE1074EC65D5A0FBC5657BD4FFD299638C34909BA378
SHA-512:	79D4DA8B7966CAF83C06C0630EC7B394A4F737504B2EC7FA2C90EFEAC4ABBC4324EC57BFCF73BB7D9B3A93C5126000173460C2808BB0EC1937E41773419CBB05
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/index_cloudfront_sd/803ec559148a8e5c7a9eb8c3720e492f09588177.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};_i_("e4e:042769e2"),B.when({events:"ready",condition:B.env.b_personalized_layout_id}).run(function(e){_i_("e4e:712489dd"),setTimeout(function(){_i_("e4e:dca24cc5"),function(e){_i_("e4e:a978a9ec");var t=e("utils/throttled"),i=e("utils/inviewport"),n=e("et"),r=$("[data-qmab-component-id]").toArray().map(function(e){return _i_("e4e:c14f039d"),_r_({el:$(e),id:Number(e.getAttribute("data-qmab-component-id"))})}),_=[].map(function(e){return _i_("e4e:2f942a3a"),_r_({el:$(e.selector),id:e.id})}).concat(r);_.forEach(function(e){_i_("e4e:cf739732"),e.el.click(function(){_i_("e4e:b503ed4b"),s(B.env.b_personalized_layout_id,"click",e.id,B.env.b_index_personalized_layout_exp_name,B.env.b_index_personalized_layout_exp_variant),n.customGoal("cCGaYSddOEGcHNAEQfKCePBeZTPSeUFRURURHe",1),n.customGoal("cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO",1),_r_()}),_r_()});var a=t(function(){_i_("e4e:fef16651");var t=[];_.forEach(function(e){_i_("e4e:ccaf30

Chrome Cache Entry: 759

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.314128390879881
Encrypted:	false
SSDEEP:	3:2erWeKBRk35KLWAzRERxzfRX/H4Y3:29M3tRdfZN
MD5:	83A02FE42F8C2198E7C608AFF363AA49
SHA1:	7B20AE1014450492CC708E3C9DC7522B05C2EFFD
SHA-256:	E64954DC34E12C7190CC2338A54B07644FF0F102AA71CC7209BCBB49C3009F7C
SHA-512:	CD381A8C725C892E9A68D713254A31EA9ED25A39B212A5DC52D4BA2655F38AFDDB32519F03360F32A59D8E7701AF6C2AD0030A6AA760C3DE87C75063F5B65F54
Malicious:	false
Reputation:	low
Preview:	event: message.data: {"response":{"status_code":200,"body":""}}..

Chrome Cache Entry: 760

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10673), with no line terminators
Category:	downloaded
Size (bytes):	10673
Entropy (8bit):	5.399790184834529
Encrypted:	false
SSDEEP:	192:0shLGV0V1cxG18XIQvN4zawzpNMbiR3XqhmXBKMK+ufNe:0CLGVc1mG184Q14zxpkD8XBKNxfc
MD5:	51BB9219647A94E2D459B12795065182
SHA1:	0BECE94E156322E0EF450C37ED6A8908190248C4
SHA-256:	AF156ED875CD4DC98387C28D1BCEBB5D24E53465025FA0E64F47AB0D57F81BF0
SHA-512:	FFAEF5DC67753FBE990F613E53FEAB06DFDEC428F6E2CBED2A28B13D04C7F45F5A133078BDDA8C3225BFA7A35AD37A16763FC2AB04B812839EB8CF1E2BD7DA7A
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/libs/privacy-consent/releases/2.1.49/customer/cookie-banner.min.js
Preview:	!function(){var n,e,c=!1,p={analytical:"C0002%3A1",marketing:"C0004%3A1"},i="%2C",a="bkng_wvpc",t=(-1<(n=window&&window.location?window.location.href:"").indexOf("/")?n.split("/")[2]:n.split("/")[0]).split(":")[0].split("?")[0],o=/booking\.cn/.test(location.origin)?"booking.cn":"booking.com",r=t&&t==="www."+o,u=/\.(?:dev\|dqs)\.booking\.com/.test(location.origin)?"account.dqs.booking.com":"account."+o,s=31536e6,w="function"==typeof XDomainRequest,d=function(){var n=document.querySelector("script[src='privacy-consent']"),e="3ea94870-d4b1-483a-b1d2-faf1d982bb31";n&&n.hasAttribute("data-domain-script")&&(e=n.getAttribute("data-domain-script").trim(),r&&"87b85d0d-3ef2-4e5f-8f3b-5310072d545d"!==e&&"f2c56a5c-067b-4461-b2cd-c837c9f13afa"!==e?e="3ea94870-d4b1-483a-b1d2-faf1d982bb31":"3e90b6d8-de01-4c76-bf9c-161744d4f2f3"===e&&(r=!0));return e}(),l=(e=document.querySelector("script[src='privacy-consent']"))&&e.nonce,C=window.hasOwnProperty("otStubData")\|\|d.endsWith("-test")?"":";domain=."+t,_=

Chrome Cache Entry: 761

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	downloaded
Size (bytes):	3170
Entropy (8bit):	7.854596680686955
Encrypted:	false
SSDEEP:	48:o9YMbuERARkSLIsx+29SGcY3GByhtyiQVAV6i8wO2chefJEF3s6Z8GOXgkaIAZH7:ghCE9i+NqQKSishqU3siyXgkadBKODB
MD5:	F427C285E94CA825342679D5D7B28062
SHA1:	2A1EDA11BE2BD74A596843E61C9129F2B5302C44
SHA-256:	283428B5D99BFF4920EC4625E2C9901FBAC38EF34A0E8EB6AB7635E06C6606DB
SHA-512:	CCC668849B513C6280B098B84BCECA17B6FF0CAF53C3E08A0CBF3CC0B9C49255C171B97BF68C17F7EA232F82D3C649FAB71229C2096F830AB701F9B457C8865B
Malicious:	false
Reputation:	low
URL:	https://q-cf.bstatic.com/xdata/images/city/square100/977415.jpg?k=fa67e6f0e70c09f18c4181bef46164f0406fbd367cad543314a3c748bfc7e411&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......d.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..FM.. ..T"..y.#Ux..`..Ux.\|.Z[...+ l...)64....2..08..d..#.2....V..2.%.e.:.~..!.T".VeA.....$...?0.s.F@.k....+...q@OjZ....)..\....p...2..#.M........@}..yf.(...Ee.#U....TjjE5W....7...7f....18.e...:WZ9.2.c.....s]..r.#.M.0......0.FE<%W..HmU%....:U.IKB.F...)E<.\..*.8- 5 4...".......B...d .s.z......... ....k...i..r..K.,..\|Rrv.(...(.G:..@...ph..er..O.[..G.......

Chrome Cache Entry: 762

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2343)
Category:	downloaded
Size (bytes):	52916
Entropy (8bit):	5.51283890397623
Encrypted:	false
SSDEEP:	768:oHzaMKHBCwsZtisP5XqYofL+qviHOlTjdNoVJDe6VyKaqgYUD0ZTTE8yVfZsk:caMKH125hYiM8O9dNoVJ3N48yVL
MD5:	575B5480531DA4D14E7453E2016FE0BC
SHA1:	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1
SHA-256:	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
SHA-512:	174E48F4FB2A7E7A0BE1E16564F9ED2D0BBCC8B4AF18CB89AD49CF42B1C3894C8F8E29CE673BC5D9BC8552F88D1D47294EE0E216402566A3F446F04ACA24857A
Malicious:	false
Reputation:	low
URL:	https://www.google-analytics.com/analytics.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self,p=function(a,b){a=a.split(".");var c=n;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};function q(){for(var a=r,b={},c=0;c<a.length;++c)b[a[c]]=c;return b}function u(){var a="ABCDEFGHIJKLMNOPQRSTUVWXYZ";a+=a.toLowerCase()+"0123456789-_";return a+"."}var r,v;.function aa(a){function b(k){for(;d<a.length;){var m=a.charAt(d++),l=v[m];if(null!=l)return l;if(!/^[\s\xa0]*$/.test(m))throw Error("Unknown base64 encoding at char: "+m);}return k}r=r\|\|u();v=v\|\|q();for(var c="",d=0;;){var e=b(-1),f=b(0),h=b(64),g=b(64);if(64===g&&-1===e)return c;c+=String.fromCharCode(e<<2\|f>>4);64!=h&&(c+=String.fromCharCode(f<<4&240\|h>>2),64!=g&&(c+=String.fromCharCode(h<<6&192\|g)))}};var w={},y=function(a){w.TAGGING=w.TAGGING\|\|[];w.TAGGING[a]=!0};var ba=Array.isArray,c

Chrome Cache Entry: 763

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65455)
Category:	downloaded
Size (bytes):	539441
Entropy (8bit):	5.429017560763508
Encrypted:	false
SSDEEP:	6144:C8+Uf+lA9Xr8Pyc0cWRyLxstcWRo8uW8R6BjCXUSxBBjClBLTAQb+/JqPh8PeaoO:Pr8NQa/JqPh8PeaFKyhFhk2rf
MD5:	EC732EC4C890554C3E9288E5B5F07021
SHA1:	8B3111C875AE12674EB72A30A89ED5D24467C6B1
SHA-256:	0FE43DA343C1D4D5D2BA677261238F66BD22639155E1E513050602E582F43395
SHA-512:	E2673B91688CD359805989B82CAA751DFC5948471DA6219BCC9E12948E897B07EF7AF55609E55BA7C5336672AE7B063A12CE92ECD7C735F764072FD4A6310DFD
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/8207c303.4d6b40b0.chunk.js
Preview:	/! For license information please see 8207c303.4d6b40b0.chunk.js.LICENSE.txt /.(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["8207c303"],{d0989236:function(e,n,t){"use strict";t.d(n,{B:function(){return a}});var i=t("dc6d28ff");function a(){const e=(0,i.getRequestContext)();return{get acceptHeader(){return e.getAcceptHeader()},get actionName(){return e.getActionName()},get affiliate(){return e.getAffiliate()},get basePageUrl(){return e.getBasePageUrl()},get body(){return e.getBody()},get bPlatformEnvironment(){return e.getBPlatformEnvironment()},get CDNOrigin(){return e.getCDNOrigin()},get CSPNonce(){return e.getCSPNonce()},get CSRFToken(){return e.getCSRFToken()},get currency(){return e.getCurrency()},get encryptedCommonOauthState(){return e.getEncryptedCommonOauthState()},get ETSerializedState(){return e.getETSerializedState()},get isInternalIp(){return e.isInternalIp()},get isInternalUser(){return e.isInterna

Chrome Cache Entry: 764

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	84947
Entropy (8bit):	5.396947593882615
Encrypted:	false
SSDEEP:	1536:AKkykki5kzkC/HL+sDOfC5RUC6eDaDcRRuSlYRXzu37B:PkVRCKsDMPeDaDmYNC7B
MD5:	C5DCEDD1A2D2A020EC849540BD3AA5B1
SHA1:	0C97C9581A9113D831B196E55F5CEDE654747FCE
SHA-256:	43829815B6CA075E109A80BA0540A8684AEACD48AEDFDFF6F197F04D55EB3C93
SHA-512:	24265B15E2E3982CE480EE89ECEDE8BE47441A4AE9EAEF1B1C9969B9004929A008170AF6820034E0D0973AD650D1EB612FDB3999DD0CC9E1990F2FEB94DAA46E
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf/en-us.json
Preview:	{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","pccloseButtonType":"Icon","MainText":"Manage your privacy settings","MainInfoText":"Select which cookies you want to accept on Booking.com.","AboutText":"You can find more detailed info on cookie use and descriptions in our privacy and cookie policy.","AboutCookiesText":"Your Privacy","ConfirmText":"Allow All","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","CookiesDescText":"Description","AboutLink":"https://www.booking.com/general.html?tmpl=docs/privacy-policy","ActiveText":"Active","AlwaysActiveText":"Always Active","AlwaysInactiveText":"Always Inactive","PCShowAlwaysActiveToggle":true,"AlertNoticeText":"By clicking \"Accept,\" you agree to the use of analytical cookies (used to gain insight on website usage and to improve our site and services) and tracking cookies (bot

Chrome Cache Entry: 765

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	610
Entropy (8bit):	7.596151900307889
Encrypted:	false
SSDEEP:	12:6v/7iiaBY1azPX793IrzbrJif0E5zaB2klzfngSN17Aod/ja:rCMzPZ3Ir3rpkJk1/Ja
MD5:	6018807017AFEAD14417566F975FFDB4
SHA1:	2EE7C3239E4046E9567C8100DECD9ABE6093B79F
SHA-256:	99AF6690771B7B62A1325D0C0B38A9A0300C18921E4877DCF38A239B9C977502
SHA-512:	03C81DD6C526EE84F274F4BFE903FC694BFD4ED20B359C1A7BA09D940795316B816E869B59D4DA383AC8367B952E5ED7C7244795E1EDDB6976A358240421C789
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... .....szz....)IDATX..?L.a...w1.......KS..Z..hM.].......c].R...1v.hL...tS[[.....H.1i].ld.!..ppx.....g.{s...}..!.@M.[...0......C ...9.P5....h......P...4o..'Ri...z.Tfn..D......2.y].F.5k...!..<.\|.[r......GdO....vE..$.&...`a...........e.N.._..l..Y..\...\|...;F........u..w... ...e.....5......h..=.58#2..>..\|^....Z._4u.....&Y.M.Z.S.Kt.as.q..2...D......N.%.n.A...g.W....@:S`1....2....e..a.C#h.d...#f..=.i.....qo..+.HN.O.k.:....O.............V&..1.l.t...SHe...\|....W.ts.c.....zj..=..3..b........?8...}....!.F._..m./.T.jv.P."..2.......C....d........A1.....IEND.B`.

Chrome Cache Entry: 766

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (533), with no line terminators
Category:	downloaded
Size (bytes):	533
Entropy (8bit):	4.933115570682282
Encrypted:	false
SSDEEP:	12:X5eNcBWFXMOYEBAP5egtIzVWRwHjXJqIK+qIKzg0fUsq5eK:pemBkXWegazdDZq3+q3c08sceK
MD5:	FEB698008C36A09DFE88AB06A1C3E3B9
SHA1:	A871FBCBBE298AE7078D06627708B2C106A0FAF3
SHA-256:	1C4E7E389D73C6ACF7F19CC812514E71230740791FDE8A018C1D7EDCCF1590AE
SHA-512:	F8E3CA3E49B1C027232D1B3AAB82B5430F4A69334A5E18BEB4469C39D6A24D3F4D3FA4C473F360B619CE734977F0D7EFD03BE6ACB5EB7B9F69295FB2CBF94D9B
Malicious:	false
Reputation:	low
URL:	https://accounts.google.com/gsi/style
Preview:	#credential_picker_container{border:none;height:330px;position:fixed;right:20px;top:20px;width:391px;z-index:9999}#credential_picker_container iframe{border:none;width:391px;height:330px}#g_a11y_announcement{height:1px;left:-10000px;overflow:hidden;position:absolute;top:auto;width:1px}.L5Fo6c-sM5MNb{border:0;display:block;left:0;position:relative;top:0}.L5Fo6c-bF1uUb{-webkit-border-radius:4px;border-radius:4px;bottom:0;cursor:pointer;left:0;position:absolute;right:0;top:0}.L5Fo6c-bF1uUb:focus{border:none;outline:none}sentinel{}

Chrome Cache Entry: 767

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	610
Entropy (8bit):	7.596151900307889
Encrypted:	false
SSDEEP:	12:6v/7iiaBY1azPX793IrzbrJif0E5zaB2klzfngSN17Aod/ja:rCMzPZ3Ir3rpkJk1/Ja
MD5:	6018807017AFEAD14417566F975FFDB4
SHA1:	2EE7C3239E4046E9567C8100DECD9ABE6093B79F
SHA-256:	99AF6690771B7B62A1325D0C0B38A9A0300C18921E4877DCF38A239B9C977502
SHA-512:	03C81DD6C526EE84F274F4BFE903FC694BFD4ED20B359C1A7BA09D940795316B816E869B59D4DA383AC8367B952E5ED7C7244795E1EDDB6976A358240421C789
Malicious:	false
Reputation:	low
URL:	https://xx.bstatic.com/static/img/favicon.ico
Preview:	.PNG........IHDR... ... .....szz....)IDATX..?L.a...w1.......KS..Z..hM.].......c].R...1v.hL...tS[[.....H.1i].ld.!..ppx.....g.{s...}..!.@M.[...0......C ...9.P5....h......P...4o..'Ri...z.Tfn..D......2.y].F.5k...!..<.\|.[r......GdO....vE..$.&...`a...........e.N.._..l..Y..\...\|...;F........u..w... ...e.....5......h..=.58#2..>..\|^....Z._4u.....&Y.M.Z.S.Kt.as.q..2...D......N.%.n.A...g.W....@:S`1....2....e..a.C#h.d...#f..=.i.....qo..+.HN.O.k.:....O.............V&..1.l.t...SHe...\|....W.ts.c.....zj..=..3..b........?8...}....!.F._..m./.T.jv.P."..2.......C....d........A1.....IEND.B`.

Chrome Cache Entry: 768

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	2407
Entropy (8bit):	5.372970099285801
Encrypted:	false
SSDEEP:	48:Nqretq4wIZK/SB5db6yi/HIRyIzbFCls+7swuJqIKavVivHN0:nc/w5fifyyS6s+7swufzY0
MD5:	D7F862620CB2EFA2734845264AF198EB
SHA1:	28B2B818CAFBC67C7D4AC33E54E8EDF63C485D86
SHA-256:	D3C7C4DBE9A235E7BA1DBFE981C2AF6E18B722EF684EF16EB08C4FC2A82A6627
SHA-512:	BD1EF42B0C2110B455DBC489FA65395BF00487F47F2776FA8975E19DA696065E15571819EA61DA5F61C45EDC4A3C6B243E06A357FB381CBACEC63E31CF946BC8
Malicious:	false
Reputation:	low
URL:	https://www.booking.com/cookiebanner.html
Preview:	<!DOCTYPE html>.<html lang="en">.<head>.<script>.var OT_CONSENT_COOKIE = 'OptanonConsent';.var OT_ALERT_CLOSED_COOKIE = 'OptanonAlertBoxClosed';.window.addEventListener("message", receiveMessage, false);.function receiveMessage(event) {.if (event && event.data && event.data.OptanonConsent !== undefined && event.data.OptanonConsent !== "undefined") {.setCookie(OT_CONSENT_COOKIE, parseConsent(event.data.OptanonConsent));.if (event.data.OptanonAlertBoxClosed !== undefined && event.data.OptanonAlertBoxClosed !== "undefined") {.setCookie(OT_ALERT_CLOSED_COOKIE, event.data.OptanonAlertBoxClosed).}.}.}.function getCookie(name) {.var nameEq = name + '=', ca = document.cookie.split(';'), i, c;.for (i = 0; i < ca.length; i += 1) {.c = ca[i];.while (c.charAt(0) == ' ') { c = c.substring(1, c.length); }.if (c.indexOf(nameEq) == 0) { return c.substring(nameEq.length, c.length); }.}.return '';.}.function setCookie(name, value) {.var date = new Date();.date.setTime(date.getTime() + 365 * 24 * 60 * 60

Chrome Cache Entry: 769

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	374
Entropy (8bit):	5.241874464925297
Encrypted:	false
SSDEEP:	6:w9NARNMJjQykRp6bXN25xBRZVXokLVEXNBezVL1Eh4pIoauw1cmWrn:qARsYUzN25HRZVXokSXNBezd1HIoauwG
MD5:	D4CB397172A601054D15E416B713F8B5
SHA1:	162C867ED5844026AD8EE199E3FCA6CFFE035D78
SHA-256:	FF95DEF5529ADA643FD4B60EA36B338EC8DDA2F277C4238430CDE9BA13EB89EC
SHA-512:	1B2801D4B9C43D7EDA942C068FC0C079A547313B2CAB681E5D914AAEB5CD5218F1BEAFFC5CB64B46C1A2192FAB7FBFFF1EAE8A74893C5DEC1E91BCAE7267F3D2
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/b9a82cb8.c62928a4.chunk.css
Preview:	.fc2f2c0da8{width:100%;display:block}.d840541ba4{padding:var(--bui_spacing_1x)}.ae9536be5d{max-width:918px}.f522a8d44b{padding:0 var(--bui_spacing_1x) var(--bui_spacing_1x) calc(var(--bui_spacing_8x) + var(--bui_spacing_1x))}.dc625444ef{white-space:pre-line}./# sourceMappingURL=https://istatic.booking.com/internal-static/capla/static/css/b9a82cb8.c62928a4.chunk.css.map/

Chrome Cache Entry: 770

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1 x 1, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	68
Entropy (8bit):	4.200601260429725
Encrypted:	false
SSDEEP:	3:yionv//thPlE+tnM09/Woz59tVp:6v/lhPfZM09tzjTp
MD5:	C4A2B870062C2BB98C500BC1526C0498
SHA1:	528666CCDB12997358077BC8FCDBFB6B825C7788
SHA-256:	2AA4FA20701CDD6D8D56046069001186B5267E3EE7D0EF618AD2F4A683723E11
SHA-512:	2F1A3ABCD12125F7EF18D61A960901C0FD6F82DD02EA2B8041859E6D5F0A7F08DB17CC110DC6D8A3F7D0D1BA790C4BCCA2506D3C60EDFEB5CB29433E9F4F762E
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR....................IDATx.c`...............IEND.B`.

Chrome Cache Entry: 771

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/988382855?random=1707417370534&cv=11&fst=1707417370534&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=qxb_CKLbrYADEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1
Preview:	<html></html>

Chrome Cache Entry: 772

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3863), with no line terminators
Category:	downloaded
Size (bytes):	3863
Entropy (8bit):	5.348033267607059
Encrypted:	false
SSDEEP:	96:RDhtc1X7mpMmw1AHV6f4wX3SIB12xBNkZPde:G8Hw1MVNwX3BB12xvYle
MD5:	88339B3D539FCA74C62B7E0C50A96894
SHA1:	5FE3B4DD6D7126A8E81F94318D73FE863ED74FB8
SHA-256:	D84999D183797B4F966CB30922EA78D372A2572AE46E4EB91665C59F211A810C
SHA-512:	600691E0831804AD0C0F3094CC025A6F166F376A57B4FBC601789E839C2E7284B03982CE8F11CC194D05E2C4D813A0E3DCD832DCE4F1B963B669813E98E0718E
Malicious:	false
Reputation:	low
URL:	https://www.bstatic.com/libs/privacy-consent/1.0.0/customer/cookie-banner.min.js
Preview:	function OptanonWrapper(){window.PCM.Marketing=OptanonActiveGroups&&-1<OptanonActiveGroups.indexOf(",C0004,"),window.PCM.Analytical=OptanonActiveGroups&&-1<OptanonActiveGroups.indexOf(",C0002,");var t,e,n=window.PCM.__getCookie("OptanonAlertBoxClosed");if(null!==n&&(t={type:"onetrust",OptanonConsent:window.PCM.__getCookie("OptanonConsent"),OptanonAlertBoxClosed:n},(e=window.document.getElementById("OTcrossDomain"))&&e.contentWindow&&window.document.getElementById("OTcrossDomain").contentWindow.postMessage(t,"*")),Optanon&&Optanon.GetDomainData()&&Optanon.GetDomainData().ShowAlertNotice)for(var o,a=window.PCM.__eventCounter;a<dataLayer.length;a++){"trackOptanonEvent"===dataLayer[a].event&&("banner_accept_cookies"!==(o=dataLayer[a].optanonAction.toLowerCase().replace(/\s/g,"_"))&&"preferences_allow_all"!==o&&"banner_reject_all"!==o&&"preferences_save_settings"!==o\|\|window.PCM.__dispatchEvent("cookie_banner_closed")),window.PCM.__eventCounter++}else window.PCM.__dispatchEvent("cookie_cons

Chrome Cache Entry: 773

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 774

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	dropped
Size (bytes):	5928
Entropy (8bit):	7.926017675472102
Encrypted:	false
SSDEEP:	96:ghIEuAUbFU7h4TP7yDg3y14lQFba7y+hxNADYxOc39yczZMXmnOKTHzhJz:mIxNpUtU7li14lQFm7y+b393WXmLTtJz
MD5:	BB290168F7786611283C023BDDE3C8E9
SHA1:	3ED9E7A50403500F00D2A9BC8D12A0B626065A14
SHA-256:	B82717756DA632DC8ABE664FC4238D3B91F8CDA4B801308D5B6FEAC4B6AE61A7
SHA-512:	8A90706148742B94CCB23EA04453F07CF6FB24884F778BAD179EAC221930FB24F7F8A3B9300BA50AAE40AC052D4D72AE91D2F4386CA81295F37DF520DD820CF5
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...v.N..+....m..m...)..Z9..ai.j@..s.(..<.p..=.\v(.5..u:.Y#'..?K.:.....\|...f#.S5..}..\X......I[uX.P..b.vI'..q..J.I.c..HV.......K...iv...)....j@..s.).SS+.:....l..7..MJ..m+.).......E..4.M0S.;......O..;...L..E..8SE>..c..~.%....E.x.'....._.j..[..A.<.. .x.5o....m..6.f%..N..W1..k..K ..aJrv......~AF.G.Dw......f.4r.....2X..*.....q.m..p..p..i.iE8R.r.Zp.....aqJ...)\\|.

Chrome Cache Entry: 775

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	6742
Entropy (8bit):	7.969644226196262
Encrypted:	false
SSDEEP:	192:AFwGAGBhZCX6HqhAUemQfJWFMCILa+i42EGwTHw:1GAGB7HqhRemo8MCIli4Aws
MD5:	3BC69E017E8BE09CB58E17DBC9D80AFC
SHA1:	FC0FD4A1A279FC931EC34C368ABDB25EC75A3B9F
SHA-256:	F29E4CA6EA1C2B3B08B3A7166C6670FB48941059A56F5855723EFA1E4EC24C67
SHA-512:	E94C32EA8A9D98141740F6ACE55EDD464021793C971CC22384BC0598CA520AA1EDA650CB4B14A9B6403B38489C60997D44DCD742CE1B5783C4FA3954FFD12AFE
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/square250/976861.webp?k=16d2ae8c0dfb3a2fa26b763677f321f1381be233e5dceaca916c520802b840ad&o=
Preview:	RIFFN...WEBPVP8 B...........>m4.G&$...tz....gn(...8m.H................n.]......S.......w..a....;......?..t.K0.t U1J.. .1.5^.8z.>...3.o1v..N=...{...Y.}...E][#....Nw..?..]..M?.>....<..}N._<(... p..).>...z...m~..QsP'...... iQ.}.WA.4..l$.\.v....b...q.dRT..r.{8.....D......B...4>$t.X..Q....8..:...t.SJ.v...K.sQO.......?.0..........fd.~...:;^Q...(..p..........~..vM$...w..sTm.C...2P.ogIy.O......j...{.R;<S..&...7^..9.C..^....l<..,.G.+...H......P.......Snq.M.x.\|fw/?.7H..........Mh:r.c.u..i.C)!\|}!...6..n...k....h...Gn@.<..+;._.B@..6...}zt....}d.w_......R...-n..F.n...7......[=&.B7@&.:............'-.............]..../.a.. ...d.x.l..&.[z...5..Yy...g2$Q.B...ee.:\|.B.....n....dg....B@{..^zF=..3...w. .J.$.-<.H~...<<.~.=.E..N..b.\|{_...#.z.U.Y.....b...2-O.Vo.e&.<$.^.Im..P.}.5..N.n..c......>.6]..Fq$. .b....E.%_.=.....e..#H.+...l}...............E.[N..D..VA..j"T...F..0..bE]..........~..T..3D.-....p...Q.B.@...~..{1.n.TC./z4..g...\.ybP..&V..ti.>..H6$6....4..L

Chrome Cache Entry: 776

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	12702
Entropy (8bit):	7.986682189546755
Encrypted:	false
SSDEEP:	384:5S40+lUsYW0BBCAmoaeUdL0O5DLveEOgXdH2:gjW0BB1moDod0gXdW
MD5:	345351B34D03FC5EF995888D5B6D0272
SHA1:	C7340F02715ADA6A3FCE744C94B187F4928562BD
SHA-256:	0786B6165BA1306484E337603CA2CCBB0C119BE6DDB6EEAD17843C3A2B92D712
SHA-512:	8EFBE0D806AE593B10684F18653B20CAAEBF490B50CBF96BA9A9135738AB4C829F78CFAE6564B72D4BF0EC4212663F033C74D3E49AD369ADF9BA5E323DE169B9
Malicious:	false
Reputation:	low
Preview:	RIFF.1..WEBPVP8 .1...........>m0.G&$"..R.8...A...[.....y..?....#.3s.n>k.yOy.]~d~+..../..._.y.......a.1....B.......h\|^...^...}..g....K.......O..............G..M?.... .....<D.kH...{........G:._..4Sx...M.Vx..t.sJ'..s..\.C..... C...t.u...A.._......px....6 ...x~.........(M;.../.c.y........}z........s..5}0.G.,w..................t.fU3.Rg.F....vuG..K.y.=Y.j....&.@..._.._cqt...j"......d....UA.VS.......Sh.7fC..W.)..P..n..I....@..29..S.`v..._n...^.H....-..^.Um.....B..7r.`..BK..aa.-....t/..g}A.h..<..N.v.......@.....M3.=.n..........(_\......5.?.-.6.~.A....d..=._I{..{.+......O...:.....?(..B...n~....6.G....{....)o~%gy.b...rm.....d..........U..j...0.xVB......m\|...z..'z.W....iA../(n....f..r..d...9..io.'.u.+O...v.5..i............6.J..F.m..}...Z.. M..E`7#qe.P}.D..T.sW.V}.JM...s..c...<:.".mmO...,.U..L6.I...E-..!3.71..j.AL.0.......d.C..)..m..?.n..z.'.t.x.:0......2jhWn......V.={..gz.f..q9h....UI..Q...0n..~.R.;~...d..o..l[..6.r8...l....!.t.t./.gA..,.T....%..#..s

Chrome Cache Entry: 777

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	downloaded
Size (bytes):	10601
Entropy (8bit):	7.952829040090789
Encrypted:	false
SSDEEP:	192:mgDag35PTKU4bA9efpLxOrbnaaDyYPf+CZ1xOqPpXhk5J5CK77mycG3Bl7AZMNe2:3D/PTa1xNOXnaSy5CvxzpXhwjCKp3Blf
MD5:	33BFA10DC5BC4EF8339BD5ABEB8548EA
SHA1:	957C2B9E899E2520A2C97F21D638FCA030DA5A43
SHA-256:	0380753C60C2FA8BD19A5346B32E08DD50BE778FA3D850147638EB16C16BF0B2
SHA-512:	5EFA5E2FDED0BDAAB75AD6AB876FF35A3EAEAAD257E6BBFDD0E2F0D6789FD7D927E13F34CDFA3E4674F3062DAF2016F954D6DDEF4EBF1F21C6643A2E12D85BFD
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/xdata/images/hotel/263x210/119467716.jpeg?k=f3c2c6271ab71513e044e48dfde378fcd6bb80cb893e39b9b78b33a60c0131c9&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...N.J...F.\.&.3&..I.5.2U)S.M.....9o.F.$Gj..@..w..k.eb.We..... .S...{R.^N;Q..W..cc.FGqZ.4.B.....<..8...}...4.}C../.5.1.2;`...^.../.D$.n2:...EGd4l .........E..}......B...0...Ee.<....]........\\|@.....t....k....c[......;8'Fx.....ITm.\|.Mm..n...M>.K..w...VO.......G..ci.bp.`..\...0..{xA.9.\4.=....ZP...'...p?:..5.v.&.4.o}'.8..u.......:........*O.W.P.;r..

Chrome Cache Entry: 778

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	13702
Entropy (8bit):	7.98538893707152
Encrypted:	false
SSDEEP:	384:ucPgUoLu+dlEq41mrZjA2toUk6olz2Wyj:5TwHdlEIrfeaolqj
MD5:	32C878D94703CEDB9A4127314C17BFE9
SHA1:	566D98CF4E2163DD9F44095AD40E45080D3F8D0E
SHA-256:	9D6601997CB7F568940D4175721E60E668F0B5727E51DDC702E17364A6B5AD28
SHA-512:	E6097116DDA29D5CBE28400157373794C30A10E68B5712F32B903E2195CDCAD2F2B82A3AC99FE3EA71C80A5FE4077E04E360428E89579CF430CCC42CFAE310CD
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/square250/976744.webp?k=d386664a0cfa562d8586fa2251c11c4f6d14e554281a47189dd8c3bb5c2b798a&o=
Preview:	RIFF~5..WEBPVP8 r5..........>m,.F&#..<..`...}.Z.[..}.c(/.W.o...5.[.'...k.k....x..W..........>......?.=.........$.........Y.....~....../....E.......7....&~....../.?...=.?..........?m..<..........E......._.9.<..$."m....B....H.A..s....X'[9.vt/}`I4o.........o{gKh.0.-....=.....^....t.....Nl.....t..........F.PvC[ ...x..o.o^.....~d.Im.~<!m.hT.2...ia.i.\|.'....b@.g..L1M.Jk...~z^.2...............AQlp...I......'...X.)....[a...?D.3..R.....h\....E.]_.x...i........"i.K.\.2aHvy?l..gG..]...p../.V7...nQ"..d}....P.......1`i.R../.s. .wA.?.C..P....m._.:.".._......s9J.WmY.....f..Q...E2.!.syK~.....pt.U.%.~.e.c.0.....c.`.....S..N...]........5..8...v.....J. 6.x..^.#..._k.~*.....4....n6{='...N:..gq.# ..Zc..bn.6...2\|..e.h.......%[.v.v.4...W.j.<.I.V.v..............=>"3^M..^-..2..OQ...........,.?..@...Y!.`W."Y..G...v.6!.....qO.t.<'..@.I...%7.I.Fy.....az&+.K.....G._.'...f@...H...sD.....y.f........Af.M-k...?.4&...,....!...#(.J.. 3.u...qr.l8..n......x.G.g>..m[.C.....#...\..3.Ix

Chrome Cache Entry: 779

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 95 x 26, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2344
Entropy (8bit):	7.885895023441641
Encrypted:	false
SSDEEP:	48:5qdKL8E2+5H4aj+orbjgcF4cU7f/wEr7BObNyhtvqTRrfrz:h4EzN4aCSjjQf/1rdObzTJz
MD5:	D05A0AB9BF394439A1584A2B0D44DB5C
SHA1:	183C28023D3BA3358A7A5DF1DB887582AE5340ED
SHA-256:	B23272A9692C4EC3C020935917E9D096490876C976ABEC1290BD3CC9AAE13974
SHA-512:	1710604C6F6AB042DE505286DC4A6FA2217BF4126C000A510156E82BA975DEE0818E74DC612D556E76A71753B8285F759D4DB7566799FA72034A3E5EE5305482
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..._...............sRGB.........IDATh..X.l.......`.......K.'m...$...Ti.F..T.JK.4A."QZ...m......B.....B.....,...V....w68.......L.w>....>G.Pr#...{o..\|..{3.X.d..".E.CE.......J.Z.DH19[2nAi...;.X[..y....Q.?m..i...\|.d.N....RU..8.u..y...Ps..n'JE....d.w5..p.o.]..OWt.!..I.:j;....Fg:..+-c.j.6x.....s&........:jIu.'[.:...k?#.,.B.N[I....F.0.:d..e.-...`.GVT...:..,..)./"...8%34m.)c.w............J...ej.&>///....QXX.+((H....[.l.........y.P..z....M.3)b..r.}\.Zc.t.0..N.M1~..dJ..k:o..3AA.........X...........P..O.^ZZ:.q..M..,.0j'.#~..sn....m.++]..E..-..g/.....S..+....x....w\|0.#.....I)_.V..{zT..H...T..@9..b...(Ht...u...J.2...&...8...f...I76..<.....,.iT.c...?....%.....SJ....ZK@+..b)X^&....l.8...V.0]..0..A.3...q.w...r....._.(t...h.j...+.4.K.....4.....G.]I......JJJ.8..I).`._.D"'..`.....hnn....W....9.`)_..i.l..^....W.C.>...-.....i\|.R.....<{xx.....M4....F....#..-.@..h......G.F` .......\...?.1.....l.C[....s?A..?`\......n....G!./IkI.o..

Chrome Cache Entry: 780

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65454)
Category:	downloaded
Size (bytes):	191217
Entropy (8bit):	5.495533262443655
Encrypted:	false
SSDEEP:	3072:kRh2vTNJdzkz4bJq8AZRVphnsPV26jEgd1X/TVTtBoA7L6CM:kT2vTt5AZRh2vLVAwM
MD5:	E0B407117276D5446A94E49BB05DDF0C
SHA1:	A0530479576AA0F80C93D5BC08F4684DA2203053
SHA-256:	1C8AB394DE2BF124C40114DBAF276307D442D64A9CDE3AD8AA04A0EBC53BE42F
SHA-512:	017034D786D46EE7770BA0C3D28DED0A246C8D87B902CECF0450AC25F57ACFEE3A60364251824CA493C73219F36D241E8BC0BB5F99A9FE069C31CF9567188A14
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/accountsportal/assets/336_0efd436088eca267c0aa.js
Preview:	/! For license information please see 336_0efd436088eca267c0aa.js.LICENSE.txt /.(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[336],{1493:function(e,t,n){"use strict";n(67294)},47646:function(e,t,n){"use strict";n(67294)},46850:function(e,t,n){"use strict";var o=n(67294);t.Z=function(){return o.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24","data-rtl-flip":"true"},o.createElement("path",{d:"M9.45 6c.2 0 .39.078.53.22l5 5c.208.206.323.487.32.78a1.1 1.1 0 0 1-.32.78l-5 5a.75.75 0 0 1-1.06 0 .74.74 0 0 1 0-1.06L13.64 12 8.92 7.28a.74.74 0 0 1 0-1.06.73.73 0 0 1 .53-.22zm4.47 5.72zm0 .57z"}))}},21015:function(e,t,n){"use strict";n(67294)},74818:function(e,t,n){"use strict";n(67294)},16379:function(e,t,n){"use strict";n(67294)},65408:function(e,t,n){"use strict";n(67294)},89571:function(e,t,n){"use strict";var o=n(67294);t.Z=function(){return o.createElement("svg",{xmlns:"http://ww

Chrome Cache Entry: 781

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65267)
Category:	downloaded
Size (bytes):	145280
Entropy (8bit):	5.5733689490673175
Encrypted:	false
SSDEEP:	1536:T3/2+SHM3ILnWNd3s2Rj6vcQLpOU0tNo455wjd0mV2KjO+XMQOtdBDFTcitjuYfe:TPOes2RjyceOU03o4PwjRSBZTLq3
MD5:	F6ACACB27A21A12EC4799883592C8AB8
SHA1:	64141362ED1A1F318680C2B5319512526CFDF637
SHA-256:	632121C546675B676E6995810CA4B669015F742000A4CE49F3257910536DD947
SHA-512:	0C664227CC913735DD0E600A77544FB2A52FB8371E9B93D3DE5D3FBAC85097F3B2F7238B261E236BA0D1F08F6E14EB52A3B321177BD63E0FE4F9F33A5E2C52FC
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/accountsportal/assets/903_0c38bb6dddbae47eeeea.js
Preview:	/! For license information please see 903_0c38bb6dddbae47eeeea.js.LICENSE.txt /.(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[903],{73810:function(d,t,e){"use strict";var n=e(67294);t.Z=function(){return n.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 128 128"},n.createElement("path",{d:"M56.33 100a4 4 0 0 1-2.82-1.16L20.68 66.12a4 4 0 1 1 5.64-5.65l29.57 29.46 45.42-60.33a4 4 0 1 1 6.38 4.8l-48.17 64a4 4 0 0 1-2.91 1.6z"}))}},78259:function(d,t,e){"use strict";var n=e(67294);t.Z=function(){return n.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},n.createElement("path",{d:"M2.25 18.753h19.5a.75.75 0 0 0 0-1.5H2.25a.75.75 0 0 0 0 1.5zm0-6h19.5a.75.75 0 0 0 0-1.5H2.25a.75.75 0 0 0 0 1.5zm0-6h19.5a.75.75 0 0 0 0-1.5H2.25a.75.75 0 0 0 0 1.5z"}))}},94977:function(d,t,e){"use strict";var n=e(67294);t.Z=function(){return n.createElement("svg",{xmlns:"http://ww

Chrome Cache Entry: 782

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/973712236?random=1707417356716&cv=11&fst=1707417356716&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1
Preview:	<html></html>

Chrome Cache Entry: 783

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 2880x868, components 3
Category:	downloaded
Size (bytes):	245767
Entropy (8bit):	7.948498789608872
Encrypted:	false
SSDEEP:	6144:39mtb2UjDzQo+Nv2+8O5zhwJDDKW2r6F+QYLI87eb3VzFyZo:Nypj/B+VXiBDKW2r6dYjab3Hya
MD5:	FB85E3F5959D74E781F58FFAD5E3037D
SHA1:	9DF89DD837AECDC743E60E51B26C4CBC4A4A8FE1
SHA-256:	5D792D42BFE6AC44DAB107FE96F0E6EC90B3727EFC41B68146B20676392AF510
SHA-512:	97C813AE769FA5D524D755458C590AC035CC212EACF82FF199EF578529218C7606E96C23E6B2C44B40F2FD09D96C9CF114142132673C7CCE077BDB1BFE8EDDFC
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/xdata/images/xphoto/2880x868/308526620.jpeg?k=0663a1420ea98a013af0eda32bb4d11258521a39c5b8a5a4e2777ee5661dee55&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......d.@.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..."...E'..'...i>\........jA.S.....q.!.i.E3o4.....9..R..P.g<Rb..-.7..h.JH..i...P..O....8&.......3F0x..=y.8"....h....dS...b....P)...#8...A8jC..h.q.i6.......S..a...ORh4.`Rm..Jx...N).....@..ix.JF(... .....!.9..=...&....H..h.h..Q..wJ1.@....jQ.....9..8d.x...1GA.....9....4... .`*.H..zQ.....M=y..r.7..!p1.i S..I.....4..O....L..H.x..jv0:..!.`.`...iT......ql..n.....P...9..s

Chrome Cache Entry: 784

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	"https://www.booking.com/js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=e4de82b919b800e4&ete=&etg=&etcg=cCHObEfEITNPfbeQMIaWYUQJFFQccCcCcCC\|5&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,cCHObKdBdUHINPSXeHDALOLOLMO\|3&etgwv="
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 785

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	65
Entropy (8bit):	4.314128390879881
Encrypted:	false
SSDEEP:	3:2erWeKBRk35KLWAzRERxzfRX/H4Y3:29M3tRdfZN
MD5:	83A02FE42F8C2198E7C608AFF363AA49
SHA1:	7B20AE1014450492CC708E3C9DC7522B05C2EFFD
SHA-256:	E64954DC34E12C7190CC2338A54B07644FF0F102AA71CC7209BCBB49C3009F7C
SHA-512:	CD381A8C725C892E9A68D713254A31EA9ED25A39B212A5DC52D4BA2655F38AFDDB32519F03360F32A59D8E7701AF6C2AD0030A6AA760C3DE87C75063F5B65F54
Malicious:	false
Reputation:	low
URL:	https://gtm-mktg.booking.com/g/collect?v=2&tid=G-A12345&gtm=45je4250z879615461za200&_p=1707417370229&gcs=G1--&gcd=13l3l3l3l5&npa=0&dma=0&cid=421694156.1707417338&ul=en-us&sr=1280x1024&ur=US-FL&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pscdl=noapi&sst.uc=US&sst.rnd=1748118732.1707417371&sst.gcd=13l3l3l3l5&sst.tft=1707417370229&_s=1&sid=1707417345&sct=1&seg=1&dl=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=7431&richsstsse
Preview:	event: message.data: {"response":{"status_code":200,"body":""}}..

Chrome Cache Entry: 786

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, was "main.6461a31a.js", last modified: Tue Feb 6 19:51:55 2024, from Unix, original size modulo 2^32 65891
Category:	downloaded
Size (bytes):	21660
Entropy (8bit):	7.98970119353244
Encrypted:	false
SSDEEP:	384:PVNgNSAtn4MreX7m1mUpggUnWZiWxZLxCbpsNHkHLhH7fB2DNdxYSfgMY7ag:PvfAyMr0QynWIwsb6Ihr6yag
MD5:	08E95D77F762CC0C0C06CE86F8334B6F
SHA1:	C91727355904E7ECA9E6C5C5B7B13D2FA47730C9
SHA-256:	E94B5C7ACB0BC886275FC91C5344EECE2D28605D1426FA3C4F993FDE05A57C03
SHA-512:	0356530228FF537276EB0747809BD847DDD0E5EE7112BCA90EBC3754555E04FCADCF42A6BFE481C95395769D4BA4767777EA507BD4A413162B168E14883C4A7C
Malicious:	false
Reputation:	low
URL:	https://s.pinimg.com/ct/lib/main.6461a31a.js
Preview:	......e..main.6461a31a.js..\.s...2g..!...,;.......^.v...:.... ....H...~......H.q..66..............$.vB.n....v..{.-T3.fL....8.llN.>$.p...n.L...v.&.h8..k...v...uF.fM.<...[...&n6.S.?..B&.e@..S.$../.......2...,.a....../.Y._.Y....-....G..........7,]...__..~_......~.5....F...........E.f..]/[..{.x...Qr.p&K..~.....,../.Z.X.x:.VG........aQ..ELh.e..X0...5A..X....kAK\...._......#.\.Y..2.l)V..P.XW..\s-4D....2....e..2.K.5...R&).)..zP...@....V.F8.b....8J....37YR..p...q.#%.......f.....}fP..~B..Y.Y.K6=......G.M....1.>$.N&.LV...z.....O~.........,..G...d\|.....h....m.~.f...."N.K.z...>....f.......&...v..,.....+.Z...mA..o...'......B2..j6................(.@.{... ?.[..l..A.r..9J..T* .+.(..H.%.ja....H.5..r]..4.e..y..~=...y.L.ub.8..-.,...+. .z...].^.+.Wl-..I=w...R<..[.\|.&..%........+5...(..}.\.....U.....X..4Aj...^...".E.m6fKTt..t..x..L....S..[d.jT86.l<.EJIP+...).MA.=......lGzS.>..-H.....vhGF..m..egnJ.lkH.aM...3...I...f......mV..q..J..v.d.Z..l8Oo...`....

Chrome Cache Entry: 787

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (566)
Category:	downloaded
Size (bytes):	501379
Entropy (8bit):	5.661931638556031
Encrypted:	false
SSDEEP:	6144:o2upgm9JdG0ukPIPQCUhS1PeLGIBmQ9qh90y5KQy9o66+U7nlIlg:kgIJdrubH1WVBmbz0y5ENq
MD5:	CA50556EED6C3EC820E1E84B8B8C4C89
SHA1:	94B412B047930720EA1CF6E26279821859F6A666
SHA-256:	5AA02AD9EC4550065DE8002EA1108BE5D10BBB1173D2F3447F88CE1AF317D4BD
SHA-512:	ACF6180697B349825C18EC7372C894A455C44683A72C7416FE2ABEE46873A585BDBA99B0167DBE77BCA6582928DE4F01A41A79899F61F5B30E3974B8C159E1B8
Malicious:	false
Reputation:	low
URL:	https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT././.. SPDX-License-Identifier: Apache-2.0././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var A=function(){return[function(d,k,C,e,p,t){if((((p=["pageYOffset",8,"scrollTop"],d-p[1]<<1<d&&(d-2\|28)>=d)&&I.call(this,k),4==(d>>2&14))&&(e=k.scrollingElement?k.scrollingElement:!C7&&f[36](9,k)?k.documentElement:k.body\|\|k.documentElement,C=k.parentWindow\|\|k.defaultView,t=EM&&C[p[0]]!=e[p[2]]?new B7(e[p[2]],e.scrollLeft):new B7(C[p[0]]\|\|e[p[2]],C.pageXOffset\|\|e.scrollLeft)),3==(d^56)>>3)&&(this.G=k,this.H=this.F=this.P=this.A=this.Y=0),(d&74)==d)try{t=k()}catch(Y){t=C}if((d\|48)==d)try{t=f[7](2,.1,k).getItem(C)}catch(Y){t=null}return t},function(d,k,C,e,p,t,Y,E,B,l,V,Q,r,J,S){if((d&((d+5&57)<(24<=d>>(S=[44,1,0],S[1])&&13>(d<<S[1]&16)

Chrome Cache Entry: 788

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/975716499?random=1707417370676&cv=11&fst=1707417370676&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=BcW9COaWsFgQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1
Preview:	<html></html>

Chrome Cache Entry: 789

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65455)
Category:	downloaded
Size (bytes):	155082
Entropy (8bit):	5.5719473628585146
Encrypted:	false
SSDEEP:	1536:u0c3FDy/fkUAUhSftuzKC2BgjBg2QCSe3n9LvMTthb8vjd6TFDsa9d:c2fjZhSlu9n56r8L4TFDsqd
MD5:	1AA264DA71F354AAD6DCE94F5A3374D9
SHA1:	5A83BAC1901D1ABBCADF1CD9E9E21D2BFB48107E
SHA-256:	4982DEB5DA7B642C82DFB6DE3655F5D09BEFD84DE8F47D5A8A2FF660C5091ED4
SHA-512:	AA5913AF6C634C9D4D79201D14457BBC0C3F38C9B11C450F46AC873A0F896F5304FCE7FBE0267181F81A56BC095E6C76D5057CDB6AA6C72F31757A9B43140B21
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/d2a738da.35cba7bb.chunk.js
Preview:	/! For license information please see d2a738da.35cba7bb.chunk.js.LICENSE.txt /.(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["d2a738da"],{b6ea4fe7:function(e,n,t){"use strict";t.d(n,{Z:function(){return N}});var i=t("dee2534d"),a=t("c44dcb0c"),r=t("8521b397"),d=t.n(r),o=t("ead71eb0"),l=t.n(o),s=t("3679468e"),c="e3c3c86858",u="b11f70841a",m="b72f7730d6",v="b7b171467e",k="a6f35737db",g=t("43bedd84");function _(e){let{ctaURL:n,ctaNewWindow:t,children:a,className:r}=e;return l().createElement(i.Link,{className:r,text:a,href:n,attributes:{target:t?"_blank":""}})}var N=e=>{let{className:n="",ctaURL:t,ctaNewWindow:r=!1,size:o="small",inverted:N=!1}=e;return l().createElement("div",{className:d()([n,c])},l().createElement(i.Text,{color:"neutral_alt",className:d()(m,{[v]:N})},t?l().createElement(a.Trans,{tag:"web_ge_generic_signature_with_link",variables:{b_companyname:g.p,start_link:"<0>",end_link:"</0>"},components:[l(

Chrome Cache Entry: 790

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	dropped
Size (bytes):	3971
Entropy (8bit):	7.894110085320742
Encrypted:	false
SSDEEP:	48:o9YMbuERApNwEXHat2aS4yG//meQA5rSVe0NF0RFsFHw+V7JBsthHKOJloJAoy8o:ghCEDEXHa4u/Foe030RF5QsloR46OYrQ
MD5:	37D8F82532F43CCDA8F02D6B802AA09C
SHA1:	5C7BA9AB8F7A353083A5BD6A76929B6AA884BA2D
SHA-256:	4FC8FD16368AF71998D14F8BF9884CCC1177E4AE94AA149E208ED2EAF1EA8FDC
SHA-512:	4F98D3B3C23AF72F5B5556354C439DA9CE912CEA2AFAC202261BF47A4A59CB55CF158CCCDED095BD8B178EA05F9E3002608E03B4DF852A2A176DB9D5764D6D58
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......d.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....2x..&.C...\|.[.9......~.M..9#^...8. ...w.\...\|6.M...B......._?.U....<Mig..F.........Q......L.w.4....A#..G_.z..kA.k.X.G.}.`.......[....-.[[.....M..3....\.....<Y.e.P......w..x.....*Z:t$.\|#.\G.2+..{9'.A. ....l...7.mG...^h.........`.....,.v.e.5.9]\E.F.T.+.4.)/.......MP..E.....z)...}>._....>.t.......--.M.....f.2..Zv..+I..H1....lt..q\..6.$.]...R...i.=.:..

Chrome Cache Entry: 791

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (515)
Category:	downloaded
Size (bytes):	4983
Entropy (8bit):	5.277268511741918
Encrypted:	false
SSDEEP:	96:1GInbH6vTKvmYDDaLVxL8P9QlhaPr6gVHDf/HKIgG+vylylqn1Dg1juPjai:kIn7+TKVDUiPEhadHDf/Bw6clqn1Dg1y
MD5:	0B203B6737E7348814173F31EFCE0736
SHA1:	B60CA6B9E3D2DD734E85159A9E6C87564AA3C18F
SHA-256:	5446B2D0120DC4737C7593F47B9474B724BBE985B5E5231EB75E5BBBF7762880
SHA-512:	2593E6CCD6267BAC6D7BF3E6A4EBA784C64559FA591E88D46D8F1B2C9B5F74DEE63C9600F89E57493F81369C69DD5904A4903DD3D7E8FA962CF9872584F36219
Malicious:	false
Reputation:	low
URL:	https://cdn.cookielaw.org/consent/a387750c-a080-4dd0-b2d1-7dbdb601bb14/OtAutoBlock.js
Preview:	!function(){function q(a){var c=[],b=[],e=function(f){for(var g={},h=0;h<u.length;h++){var d=u[h];if(d.Tag===f){g=d;break}var l=void 0,k=d.Tag;var C=(k=-1!==k.indexOf("http:")?k.replace("http:",""):k.replace("https:",""),-1!==(l=k.indexOf("?"))?k.replace(k.substring(l),""):k);if(f&&(-1!==f.indexOf(C)\|\|-1!==d.Tag.indexOf(f))){g=d;break}}return g}(a);return e.CategoryId&&(c=e.CategoryId),e.Vendor&&(b=e.Vendor.split(":")),!e.Tag&&D&&(b=c=function(f){var g=[],h=function(d){var l=document.createElement("a");.return l.href=d,-1!==(d=l.hostname.split(".")).indexOf("www")\|\|2<d.length?d.slice(1).join("."):l.hostname}(f);v.some(function(d){return d===h})&&(g=["C0004"]);return g}(a)),{categoryIds:c,vsCatIds:b}}function w(a){return!a\|\|!a.length\|\|(a&&window.OptanonActiveGroups?a.every(function(c){return-1!==window.OptanonActiveGroups.indexOf(","+c+",")}):void 0)}function m(a,c){void 0===c&&(c=null);var b=window,e=b.OneTrust&&b.OneTrust.IsVendorServiceEnabled;b=e&&b.OneTrust.IsVendorServiceEnabled()

Chrome Cache Entry: 792

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2341), with no line terminators
Category:	downloaded
Size (bytes):	2341
Entropy (8bit):	5.894279745395548
Encrypted:	false
SSDEEP:	48:Ego2Y+iKasKEIzUtJQSIZyaQqe3q7SWWdCC6jykt081NL44RohtzYig33Uby6:wsbSUtJfxrqLWWWdV6j1hNLuuUbH
MD5:	A231DCCD11F69D0776C00366C0584699
SHA1:	94273444BF7BD7E76EE66117E1232653F9846899
SHA-256:	B85735573F93B10E17FCE546B656D76CF58882BAC21FD62F3EED30BA6385966E
SHA-512:	86EA832777406D56DCD9640C26B706C01E2142490CEA538FF6A3A381AB450822D5BF7058184A3872F24FD5AC888BE57AAC5C37FBCB3D02C69ACB32EC59A17B3E
Malicious:	false
Reputation:	low
URL:	https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975716499/?random=1707417356815&cv=11&fst=1707417356815&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 793

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/rul/973712236?random=1707417370629&cv=11&fst=1707417370629&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=8GRyCJ3Eq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1
Preview:	<html></html>

Chrome Cache Entry: 794

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21608), with no line terminators
Category:	dropped
Size (bytes):	21608
Entropy (8bit):	4.768124050153233
Encrypted:	false
SSDEEP:	384:+I8C4hGoFXlCS7FGAVsq1nwGfg4xqsQMPNE:OaJ
MD5:	A169014CB8030D7BEB52C77DDF2FD9C6
SHA1:	FBE4667B4F8F01CD6C4DD2F9C9CACFB389CB54E1
SHA-256:	D0C233D327541D2961F1CDE9E53A6166279655F4D4041C1BC458AC1701827719
SHA-512:	F46123E7223B5AC490BADB950AA79D4A7BDC09D5C2A4533C3D82F3555A6308C54F1719F1959E75003A94CB2877ED65F35110529F33981C4C4C03256F345AE3C8
Malicious:	false
Reputation:	low
Preview:	#onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .onetrust-vendors-list-handler:hover{color:#1f96db}#onetrust-banner-sdk:focus{outline:2px solid #000;outline-offset:-2px}#onetrust-banner-sdk a:focus{outline:2px solid #000}#onetrust-banner-sdk #onetrust-accept-btn-handler,#onetrust-banner-sdk #onetrust-reject-all-handler,#onetrust-banner-sdk #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk.ot-bnr-w-logo .ot-bnr-logo{height:64px;width:64px}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-icon,#ot-sync-ntfy .ot-close-icon{background-size:contain;background-repeat:no-repeat;background-position:center;height:12px;width:12px}#onetrust-banner-sdk .powered-by-logo,#onetrust-banner-sdk .ot-pc-footer-logo a,#onetrust-pc-sdk .powered-by-logo,#onetrust-pc-sdk .ot-pc-foo

Chrome Cache Entry: 795

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 796

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	574511
Entropy (8bit):	5.126422279017485
Encrypted:	false
SSDEEP:	6144:zZvtxBq/fWEJK6e7ZbD/GYnDX36LTfKI0Wcc:zZvtkU36LuI0Wcc
MD5:	EC5A2882D83ECD1C7C6CD294D5D615A7
SHA1:	EF3792B9856C5CF3F0B06A469CD3F4513503D444
SHA-256:	CFBBB64B7ED300BD80454892928BA6AE38BE3E6E01D2CB01C83322AE28CD8555
SHA-512:	C30C06470864B2E2458E8267F4F60CD88127F890450FCFC9CB3F639DC0297A74604CCC919AA09B7CC97D1C2E9DB7489E3BAA16969018504B6E63184F5D4BB9EC
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/css/main_cloudfront_sd.iq_ltr/e6474733abba1cd6bc8a66bea1aa8643d7435c30.css
Preview:	:root,[data-bui-theme="traveller-light"]{--bui_color_border:#868686;--bui_color_border_alt:#e7e7e7;--bui_color_action_border:#006ce4;--bui_color_border_disabled:#d9d9d9;--bui_color_destructive_border:#d4111e;--bui_color_constructive_border:#008234;--bui_color_foreground:#1a1a1a;--bui_color_foreground_alt:#474747;--bui_color_foreground_inverted:#f5f5f5;--bui_color_brand_primary_foreground:#003b95;--bui_color_accent_foreground:#946800;--bui_color_action_foreground:#006ce4;--bui_color_callout_foreground:#923e01;--bui_color_foreground_disabled:#a2a2a2;--bui_color_destructive_foreground:#d4111e;--bui_color_constructive_foreground:#008234;--bui_color_foreground_disabled_alt:#d9d9d9;--bui_color_action_foreground_inverted:#57a6f4;--bui_color_action_focus:rgba(0,108,228,0.24);--bui_color_highlighted_alt:rgba(26,26,26,0.06);--bui_color_action_highlighted_alt:rgba(0,108,228,0.06);--bui_color_destructive_highlighted_alt:rgba(212,17,30,0.06);--bui_color_highlighted:#cecece;--bui_color_destructive_f

Chrome Cache Entry: 797

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65455)
Category:	downloaded
Size (bytes):	348177
Entropy (8bit):	5.51412380696737
Encrypted:	false
SSDEEP:	6144:CQguutUFxSal63NlLEmFKESf85V6Gvks6oDoo:CDV564
MD5:	800BE105A38A4F7FA6DA493375B0EA49
SHA1:	C749BAD72CFD4B4C84988C23D4EF79FFD68B86FE
SHA-256:	4B0D910336673466209E9F380A248BF86AF22C5A7AD761118BE28DECA572D7A7
SHA-512:	493DE12F42285D40433FBF93D94A7F336DEC803F7D00CC5EC579D94C526787319AB2D0C437A115E2E84EB77D7A6E1BFECD1D19647B109B0D5DCCBD4757743032
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/dc32f6b7.30f8c5b3.chunk.js
Preview:	/! For license information please see dc32f6b7.30f8c5b3.chunk.js.LICENSE.txt /.(self["b-web-shell-components__LOADABLE_LOADED_CHUNKS__"]=self["b-web-shell-components__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["dc32f6b7"],{d0989236:function(e,n,t){"use strict";t.d(n,{B:function(){return a}});var i=t("dc6d28ff");function a(){const e=(0,i.getRequestContext)();return{get acceptHeader(){return e.getAcceptHeader()},get actionName(){return e.getActionName()},get affiliate(){return e.getAffiliate()},get basePageUrl(){return e.getBasePageUrl()},get body(){return e.getBody()},get bPlatformEnvironment(){return e.getBPlatformEnvironment()},get CDNOrigin(){return e.getCDNOrigin()},get CSPNonce(){return e.getCSPNonce()},get CSRFToken(){return e.getCSRFToken()},get currency(){return e.getCurrency()},get encryptedCommonOauthState(){return e.getEncryptedCommonOauthState()},get ETSerializedState(){return e.getETSerializedState()},get isInternalIp(){return e.isInternalIp()},get isInternalUser(){return e.i

Chrome Cache Entry: 798

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 32x32, 16 colors, 4 bits/pixel, 24x24, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	1582
Entropy (8bit):	2.0935949490559387
Encrypted:	false
SSDEEP:	24:KqH7QNbKDCaVH//zkVKaklSvDBkNothKK1suC8GCODul:fsN+lH//a7iNsj1RGY
MD5:	FAEDFE66CF96784098C9B7B1F405EF12
SHA1:	645DCE7842FA7483BB676DEF6DF255317F203F22
SHA-256:	A87EC2239235E2521BEBE6F92DC4A65CA035FD419EBD09B68D04B989AFD3141A
SHA-512:	26EF8C32AA51607F3A2C8F517D3A7578FB5F5B6D623581D5BDDC54FC458658E7376263D8511147CFC7A3A507DC51E295382A1FFBDE510C59445E6911AAACD47C
Malicious:	false
Reputation:	low
Preview:	...... ..........6...........................(.......(... ...@................................5...M...jC..)...g..........................................................'w...............w....................................................................................................UUUUa...3.......UUUUU .330......UUUUUQ.330......UR.&UR.33 ......UR..UV..3.......UR..UT..........UT..UQ..........UUUUU`..........UUUUV...........UUUUU...........UR.EU`..........UR..Ua..........UR..U`..........UV.EUa..........UUUUU ..........UUUUV...........%UUU@.......................................................@...............q...............w..............wwt............'w................................................................................................................................(.......0........... ....................5...S...jD..>..........................................................w...............................................................UUT`.31.....UUUV.33....

Chrome Cache Entry: 799

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	https://www.booking.com/logo?ver=1&sid=5171fc655664ddf74ab763a094523fb7&t=17074173981
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 800

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3156), with no line terminators
Category:	downloaded
Size (bytes):	3156
Entropy (8bit):	6.02407591019183
Encrypted:	false
SSDEEP:	96:wsbSUtJfxrqLWWWdV6j1XQElRKLf4bHRP8:JrPWww1vKza8
MD5:	26E3388444017DE23EB156D1D7165E84
SHA1:	C67E36078BCFA0C94D794F12C01D56E13A9D9FDC
SHA-256:	8448D3BDFC1B81027B5C963B5DE8E087A6955711AB713224CE6CA926F6BB3BB8
SHA-512:	C88326B9AE116F4B2C6FB05C17AC6FE3BF3A3F0655CCF2D1DC25FF5CC33B571302519826CA7C67A918282D1EFA2D0307A33E0F7E6247A321FE8F2595704396E1
Malicious:	false
Reputation:	low
URL:	https://www.googleadservices.com/pagead/conversion/988382855/?random=1707417344353&cv=11&fst=1707417344353&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=ZgWTCPidsIkYEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&rfmt=3&fmt=4
Preview:	(function(){var s = {};(function(){var e={};/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0 */ var f=this\|\|self;var g,k;a:{for(var l=["CLOSURE_FLAGS"],p=f,q=0;q<l.length;q++)if(p=p[l[q]],null==p){k=null;break a}k=p}var r=k&&k[610401301];g=null!=r?r:!1;var t,v=f.navigator;t=v?v.userAgentData\|\|null:null;function w(d){return g?t?t.brands.some(function(a){return(a=a.brand)&&-1!=a.indexOf(d)}):!1:!1}function x(d){var a;a:{if(a=f.navigator)if(a=a.userAgent)break a;a=""}return-1!=a.indexOf(d)};function y(){return g?!!t&&0<t.brands.length:!1}function z(){return y()?w("Chromium"):(x("Chrome")\|\|x("CriOS"))&&!(y()?0:x("Edge"))\|\|x("Silk")};!x("Android")\|\|z();z();!x("Safari")\|\|z()\|\|(y()?0:x("Coast"))\|\|(y()?0:x("Opera"))\|\|(y()?0:x("Edge"))\|\|(y()?w("Microsoft Edge"):x("Edg/"))\|\|y()&&w("Opera");var A=/#\|$/;function B(d){var a=d.search(A),b;a:{for(b=0;0<=(b=d.indexOf("fmt",b))&&b<a;){var c=d.charCodeAt(b-1);if(38==c\|\|63==c)if(c=d.charCodeAt(b+3),!c\|\|61==c\|\|38==c\|\|35==c)br

Chrome Cache Entry: 801

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	74745
Entropy (8bit):	5.550859977373029
Encrypted:	false
SSDEEP:	384:vQUsyGoiaJJHE2ixKEB92FY9X1tFpHiaSLPE+7JhOjFCeeJ/IPtKUL4yTxTJTX+q:oQE2iEeGYh1XpE9Eq/wIUL9h0h/PLy
MD5:	41A6BA0FB726B17A45F26570565EA765
SHA1:	CA82B58FA775D6FF562CD94639D92F50A91B0024
SHA-256:	4567D6213BC1480A45F493DA8D292339522D45AC15C8BA1723AA342B155393F7
SHA-512:	EEE4A76590F5926D0E72AB21F691615113FAFB5B9279C95367D1CF7CCD46753D5A7867400D3949036C9C47B807CD9BC9610D09BE1FD9FD26BE0306BC67FDF0F6
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/accountsportal/assets/336_afde72b9aaa8302ff017.css
Preview:	.wkTNdQjAfRVbKvFBiR1T{border:0;margin:0;padding:0}._nwGprfLZfZgMFjsmap7{align-items:flex-end;display:flex;padding:0 0 var(--bui_spacing_1x)}.ZGy7BLCX4XOvfADBFj11,.bqW7graHh09CTNANOrXt{-webkit-margin-start:var(--bui_spacing_1x);display:inline-block;margin-inline-start:var(--bui_spacing_1x)}.tsmwm5pXtK17w2173RXN{flex-grow:1;text-align:end}.CgEr4LoA7GBJSRxe_hwL{margin-top:var(--bui_spacing_1x)}.tpfLkcDxgJdgEODO7d3S{position:relative}.cTdJNASrkbE_mA7Ki5YQ{border:0;height:1px;left:0;margin:0;opacity:0;overflow:hidden;position:absolute;top:0;width:1px}.eaMQKfCQ1dJwRjhqXAoB .cTdJNASrkbE_mA7Ki5YQ,[dir=rtl] .cTdJNASrkbE_mA7Ki5YQ{left:auto;right:0}.EMqACHNFKIrBjLnCdYbI{display:none}@media (max-width:575px){.EMqACHNFKIrBjLnCdYbI{display:block;height:44px;position:absolute;top:50%;transform:translateY(-50%);width:100%}}.gsqI5txJew4n5F74e1ep{cursor:pointer;display:flex}.Jvd7a52AOzT8bz6CbBD1{flex-grow:1;margin-left:var(--bui_spacing_2x)}.eaMQKfCQ1dJwRjhqXAoB .Jvd7a52AOzT8bz6CbBD1,[dir=rtl] .Jvd7a52A

Chrome Cache Entry: 802

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 354x266, components 3
Category:	dropped
Size (bytes):	20782
Entropy (8bit):	7.962841998378122
Encrypted:	false
SSDEEP:	384:npp72TEMMbQHm6PLeVEcI2oYo0wzR/oPTyaO9n2IQOsVrNpQREBAHqkER9mV:pp72gAHmmAEcrOKPTw926sZ4eAHqkEbk
MD5:	BA108CFB9A91BFF88F47EC652D0F203B
SHA1:	099F148A9E04D4415E482079D9EA8E20C3D175E1
SHA-256:	B661FC1298BBE655E9BA10AF7B5F78C78B6195D6FDDA388D2757E549462A306A
SHA-512:	62A9D4DE5D8C0C8F6983DB45D757DF5E5EFEBF18AA9EAF1FFDDF82A4132A676FE683D7D5742FE09D974817B19E15BF5895971856A7C67B0F6D43DD884B222C1A
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........b.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..1K..K]..m.m8R.p..m..S.Xn.]...\Qp...).R...K.v)qJ.a...;.\R.Xn)@.b..\v.R...\...R.5.y.....?...xI...[.$...H....1....Ks............K..........S.L).L....Z.1...:.QqXf.M.&(.;..6..b..\,3m.jLQ.........\Qp...i...+.....N...W......v..1O.(.......~(.......1E..h.b..;......U\V.Z\.8..`....\V..PE&(.!....6.).\R.ii.b...QE.LR...p...R3.h].*............+S.....j..[.O...h.....HT...[...

Chrome Cache Entry: 803

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	downloaded
Size (bytes):	7785
Entropy (8bit):	7.942304441167468
Encrypted:	false
SSDEEP:	192:mIz7jES2NH/E23E829U9x75bFJps8PsneD:nzdeH/d3BuU93bjEn8
MD5:	1FC2AD40BF5E2BB9E9A6DA12354BDF0C
SHA1:	DF3D86284273E52AC3C9640BC8C2A77FDAF7BEC5
SHA-256:	941865794957E393E58139AFB653B9EC09B2BF10185FF8CB3EE234D7B8434071
SHA-512:	A035F962A3C799A8A06434F940813398BC279459653CA7A502DC9766D420CBB788DC011BBB35A7CE9B6ED641554A0CADEA72CAABCDFCE24E2A4E32F68881CA67
Malicious:	false
Reputation:	low
URL:	https://r-xx.bstatic.com/xdata/images/city/170x136/977388.jpg?k=4c9c54255e9d2e2d8084959527abea6b6b8a4b8a538a921f1df9e4bea2503ff6&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..Mv.{.....@.J6.>...W.h....\|C&....,<c.C/.G....... .J.=)..w&.x..Y.....L....D...0Ns.<u....M..T.9..H3...v..x<s.....M..V.F..@b..@.u..9.$:c.......\.H....g$..~8h/..?U..;...H....3..f..k.-..&...~:..}q.U{.Z..MKY....J.n.\|.Kw...Y.1.f.y.e.D."..<.5.6..<!o.:..B.a.8..N....g.Mx...Q4?.,g..XC.n.s.r;g=...4....jO$S..:6@.c......U...[..X.K.=QrM+\...JF.p$.FH...U...E4.......FG$.

Chrome Cache Entry: 804

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 91 x 26, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	1591
Entropy (8bit):	6.299213971363517
Encrypted:	false
SSDEEP:	24:DRINGdp3+42X9tK0Td/YpgLWnTmSPq/rZZhwjeqcJJG0ZtNy6LBiyy3XX6w:DCc3YNtK0R/YrnTmSPE1Z6sJjy+B8n6w
MD5:	B6D0B31340D7A113F63B936E23D06F78
SHA1:	268E3856DA737F7E56E679258949EF70DDDE47F4
SHA-256:	18C62988860A8FFD90BAB6376B4FE36A723BD39403C420D3943AA3EB5A0029C5
SHA-512:	FEF2D5BA4648EE1BA476E3FBD4852E52F93A0F40988F368AF90DF4188F64E6DCB09BDE79887A4AB3FE81774168D84E6DFCB61AFBA44DC6FB56C3C72D808E23DC
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/img/tfl/group_logos/logo_priceline/f80e129541f2a952d470df2447373390f3dd4e44.png
Preview:	.PNG........IHDR...[............b....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....PLTE...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................If.....tRNS...........gx.]:..HR.0..#(..$/.+!....'-.....;...h\|ZW...u....iK..o....`e.....pP"...t.....V.....rO..... N..b..c.sm..3..[.4~.9.I.....M..n{.^a...UL.?...6T.l..<...@...B\.7...S........bKGD...-.....IDATH....WLQ....t!.\..b..S.4M2. 5..2#N.]NE........&B.T"..\.?.L.I..j...e.k....u..k...dA.......(p.. ZB..k.u.....e..BB7.bo.

Chrome Cache Entry: 805

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (52155), with no line terminators
Category:	downloaded
Size (bytes):	52156
Entropy (8bit):	5.358566566679159
Encrypted:	false
SSDEEP:	1536:5GK5/2jEwG9BckF74OZk9zpbrzga2sPns:L5NwG9BckX+pfzV2sPns
MD5:	CCF26FB1244D25C75D392D7C23D61600
SHA1:	57C0E12FB0B1F039E151E1FDACABE931BFA3C38E
SHA-256:	2B5EFF8AB6AAD9F36198A6911AFA4EB1C1EDBD630AB8434962C5813313D02BD9
SHA-512:	D297C7B20262D3AB94688C5DFB8A52FC8D9A7347C63C8E4143CB2E413827763CEBF0DDE027105962D342D7FD05224CCF81F780EC2E753E36ADCF16F7EB35B23F
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/js/calendar2_cloudfront_sd/06071dd1c4e89fbe99e5ad6e21584a6bf9585e84.js
Preview:	var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(t){return t};booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.calendar2={loaded:!0,run:!1}),booking.ensureNamespaceExists("calendar2"),function(n,r,s,t,e){_i_("a41:4ad9b9b1"),s.ONE_DAY=864e5,s.SUNDAY_FIRST=!0,s.DAYS_IN_MONTH=[31,28,31,30,31,30,31,31,30,31,30,31],s.DAY_STATES={disabled:!0,weekend:!0,selected:!0,hilighted:!0,"in-range":!0,"first-in-range":!0,"last-in-range":!0,today:!0};var i=1;s.uid=function(){return _i_("a41:c7bf35e2"),_r_("calendar_"+ ++i)},s.today=function(){_i_("a41:f68deab7");var t=new Date(1e3*n.env.b_timestamp),e=new Date,i=Math.abs(t-e)>s.ONE_DAY;return _r_(i?new Date(t.getUTCFullYear(),t.getUTCMonth(),t.getUTCDate(),0,0,0,0):new Date(e.getFullYear(),e.getMonth(),e.getDate(),0,0,0,0))},s.minToday=function(){_i_("a41:544125b3");var t=new Date(Date.now()-396e5);return _r_(new Date(Date.UTC(t.getUTCFullYear(),t.getUTCMonth(),t.getUTCDate(),0,0,0,0)))},s.dayId=function(t,e,i){return _i_("a41:edc

Chrome Cache Entry: 806

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (774)
Category:	downloaded
Size (bytes):	890
Entropy (8bit):	5.159506822954023
Encrypted:	false
SSDEEP:	12:0hMoHE3cPyau5LhzXNNh5dmBE3cFXQLqQNo1Vk2GeMEKot5eVpDVQQCAv2IoauwZ:0ZEsPS9uEsFXQOQNgVWCeP5Q4Sqk+
MD5:	607EAC3F1DD66BFB5FC2869C5563E4D0
SHA1:	5783DAE1329D218171C41AEEA16BC06B97ED6E22
SHA-256:	0410B3E1D038DC6B0E7DA0416D737ED29CB3A272D4BE1928DC835BB725D04097
SHA-512:	0BD32EDF63E4AC0D15D1138255F7E4ABD006FCA6C4824412EF0DACFDD7D301AB0D561C7A85F56CB11B69245B93721995759C38825DE83F2C58C6DD7F46C81AEC
Malicious:	false
Reputation:	low
URL:	https://q-cf.bstatic.com/psb/capla/static/css/6197bcab.88b5a402.chunk.css
Preview:	.adcf70f536{--bui_stack_gap_last_child:0px;margin-top:var(--bui_spacing_4x)}.eb8c0de041{margin-top:var(--bui_spacing_4x)}.bb42d40a15{margin-bottom:calc(var(--bui_spacing_4x) + var(--bui_spacing_6x));display:block}a:link.bb42d40a15{text-decoration:none}.c274cb2e09{--bui_stack_gap_last_child:0px;margin-top:var(--bui_spacing_2x)}.cc60a7c247{margin-top:var(--bui_spacing_half)}.fc80fb4f60{display:none}.f43670e28a{width:64px;height:64px;border-radius:var(--bui_border_radius_100);background:var(--bui_color_action_background_alt);display:flex;align-items:center;justify-content:center}.a9960c6228{background:none;border:none;padding:0;cursor:pointer;color:var(--bui_color_action_foreground);display:block;width:100%}.a9960c6228:hover{color:var(--bui_color_action_highlighted)}./# sourceMappingURL=https://istatic.booking.com/internal-static/capla/static/css/6197bcab.88b5a402.chunk.css.map/

Chrome Cache Entry: 807

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	359630
Entropy (8bit):	5.109903054634253
Encrypted:	false
SSDEEP:	6144:54WNoSXzLCZVeASAQLAlPPEgxpeWMSS8n1gDLS:mWNoSXzLCZVeASAQOEJSS8n1gDLS
MD5:	EE4C10728223A6D6CF06CC033BE3B6B8
SHA1:	A98479776C10C2C700910912903064E6CA7DE294
SHA-256:	ED997E027B30559C9BE44193FD0BD581B0C4E79162180B61F1FF30395B1425FA
SHA-512:	1C411892C0674819F659DF802603ED4453116495D7BB717F2D52E8598F1998024517EF85DECEE5B1854CDFBF8E7A5D05B143DA6A0A36C1B4584C8D08BB2E70F4
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/css/searchresults_cloudfront_sd.iq_ltr/a80f32e7f9693f304c247b0f22b0f109a5fd7dd6.css
Preview:	.hotellist{clear:left;position:relative}#bodyconstraint-inner{min-width:980px}#bodyconstraint.bodyconstraint--full-width{max-width:none}.t_m_viewport #bodyconstraint-inner{min-width:inherit!important}.more_rooms_link{font-size:88%;font-weight:bold!important;text-decoration:none!important;color:#333!important;margin:0 8px;padding-left:12px;background:url("//cf.bstatic.com/static/img/experiments/more_rooms_arrow/ecef3c58a3c5ecaa079fd68a86909cb9eeb6d743.png") no-repeat 0}.more_rooms_hide{background-image:url("//cf.bstatic.com/static/img/experiments/more_rooms_arrow_up/a55dbca344ca9a6bfe12628f2b42d373be8905e8.png");padding-left:12px}form.improved_group_booking_block2 .more_rooms_hide{background-image:url("//cf.bstatic.com/static/img/experiments/more_rooms_arrow_up/a55dbca344ca9a6bfe12628f2b42d373be8905e8.png")}.hotellist tr.hidden{display:none}.sr_item .hotel_name_link{font-size:20px;text-decoration:none;vertical-align:top;word-break:break-word}.sr_item .sr-hotel__name{padding:3px 0}body.j

Chrome Cache Entry: 808

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 263x210, components 3
Category:	downloaded
Size (bytes):	10257
Entropy (8bit):	7.9278460122891286
Encrypted:	false
SSDEEP:	192:mgARxUS0Dgu/UtwsBC1Rx7z0OPhgKy55wopcaiJUlK7AytFGDKOziV:3ARCH/UuZz5P52SUluA8IKqiV
MD5:	5F58A2EEB3F0B1D3CE899E3C629368A5
SHA1:	3DBABBE322B0EC1CFAF64ACFDE88D5ED67B674B1
SHA-256:	FA9F5DBE5AD251EB1A7DA4628C3D1CC55C9FF380671A9D7D2B070BF4E2C2324E
SHA-512:	41EEB02A2EDC6F19C53C526C8D329C0D13C710955D60D9D44E648D73531008DE7279D9365FFF2F2DACD93A6C080F1591D6720D0C2B8FA55928C81C1D646B26F3
Malicious:	false
Reputation:	low
URL:	https://q-xx.bstatic.com/xdata/images/xphoto/263x210/45450084.jpeg?k=f8c2954e867a1dd4b479909c49528531dcfb676d8fbc0d60f51d7b51bb32d1d9&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..%.z.H.sY...R....s{....4.....Is.../-.N.z....H50.......=..J>....`....Z...E.7b...-}..O..#h..?.....X....._....~...]...`.}....).P.6.AF..?}..a......=.:...v.AN.=..@........To.N.....b....!.l.....d..I$..e,I'$.)d9#5i......S....2.6=.s....[.......?,.\H^V,..D.u..}.K\|.?$C........*.9.oV9.4U.J).u...Sm.....!gd.....I#W.p}M6E..1....h.................Z..w/=.i....9

Chrome Cache Entry: 809

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 210x210, components 3
Category:	dropped
Size (bytes):	6208
Entropy (8bit):	7.915726822536868
Encrypted:	false
SSDEEP:	192:mynRBq8uPafCed0SkXF2+58eyLBNXe0Wi:dREPafCedrsn5aLPXj
MD5:	A7149E44DB8D60749A6142F551415A1F
SHA1:	71F09F7B2B654D63ECB1839C0EF2FA1AE26BAF26
SHA-256:	A4F87A318BFDBA1016E1189E2218978CE46D24CB0DA8FB898E7F40E79A356429
SHA-512:	4EB428A1425B028A8209BC3075AAB8132A6194BC3089923265AD61A2AA043858F330D0D014CF9B30499F1C43E40C480EF7972D8DEDF3C955BAAE154464FB2DA2
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..m.v....v..vQ..\.m..m.(....S.e.r..m..Q..\.m.jm.yt..v...j6P.!+I...F..r..l.......6....r..m..I.C...Xf.....T...Z..[h.Rb..C#.S.E.r..F....Fw+....S.e1\...eO..e.r...eO..e.r..m..Q....;h.Sl.e+..v....R...C.....M...".F.m&)X.E....I..r-..{T.}.6.....+Sm..@.v..+F.C...EI.(......NOjiB.#..K..h..8.+"a...;.Vp...S.)Gm.jm.m.L.A...6.j6...6....0.ri...[Jb.a.(..Oe.j}.l.+..mNR.

Chrome Cache Entry: 810

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4166)
Category:	downloaded
Size (bytes):	4278
Entropy (8bit):	5.243410918474239
Encrypted:	false
SSDEEP:	96:FUWm/9PmWGP6WHNuraucbTqfXe+rgmgMChhV:FUZ9hExureGJcD
MD5:	C907B4996B597288D653238DFA600ECA
SHA1:	A0BC670D153DD429F704000F4FEFD3DD638E4FD8
SHA-256:	6B642438BC5A60832AC2BDBE607B9D64CF4C81A54E5A2A057754EEAD8967E1D6
SHA-512:	DD4B0230E51F579E21F77E9E8A2E21DE62A6E57C69E5EC891E63009C276D572FC99421DD5301D614A6BBF4F3FFA9E0467C3431A5B9B1AACB4CE14AF8FB0B6D74
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/0de3785e.66d5d08f.chunk.js
Preview:	"use strict";(self["b-packages-core-packages-frontend__LOADABLE_LOADED_CHUNKS__"]=self["b-packages-core-packages-frontend__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["0de3785e"],{"8c8af2c5":function(e,a,n){n.r(a),n.d(a,{default:function(){return E}});var t=n("ead71eb0"),r=n.n(t),c=n("dee2534d"),l={root:"cc5acc416e",iconContainer:"b799ba8345",uspContainer:"f2c627f314","iconContainer--callout":"e9d1041e1d","iconContainer--primary":"beab03ae02","iconContainer--constructive":"c1fcdd83d1"},o=function(e){var a=e.icon,n=e.iconContainerClass,t=e.header,o=e.body;return r().createElement("div",{className:l.uspContainer},r().createElement("div",{className:"".concat(l.iconContainer," ").concat(n)},r().createElement(c.Icon,{svg:a,color:"white",size:"large"})),r().createElement(c.Title,{variant:"strong_1",title:t,subtitle:o}))},i=n("899a651b"),s=n.n(i),_=n("e7e55977"),m=n.n(_);var d=function(){return t.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},t.createElement("path",{d

Chrome Cache Entry: 811

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	13
Entropy (8bit):	2.7773627950641693
Encrypted:	false
SSDEEP:	3:qVZPV:qzd
MD5:	C83301425B2AD1D496473A5FF3D9ECCA
SHA1:	941EFB7368E46B27B937D34B07FC4D41DA01B002
SHA-256:	B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
SHA-512:	83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
Malicious:	false
Reputation:	low
URL:	https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=4228414;type=views;cat=views;ord=4995395844978;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=2105455417;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2?
Preview:	<html></html>

Chrome Cache Entry: 812

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	9846
Entropy (8bit):	7.983338082810248
Encrypted:	false
SSDEEP:	192:ozQY/6HrG71FsG1MU00JxahO0bxCQ/9QA0uoHy7o2h2r5awLTbhY7rZAI:uQ46w1jcWaE09f/h0JgSTbCHZ1
MD5:	CF0D1CBBDF95A25F17307F4FB389DAA0
SHA1:	63D4E2A3009DAE49C75E8C1ECFB9A517147F10AD
SHA-256:	1334A2A666F85EFFBEABF2E1BE501BF343FA64F4DD5F1333CB74870D24078F2F
SHA-512:	7655CFF10EF218D274A42AB3F18436D92E4683B2CFB8EC4F293B62291AA7F6792AF290D425640D83502AFF96D2CAB4F477BFD8F64F01F35183747FEFFD1B6F9F
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/square250/689687.webp?k=654bc31e8dc1dabf9b94fb37ad00f6942dc9927f10cf0b7b6a9f43e10d49375e&o=
Preview:	RIFFn&..WEBPVP8 b&...........>m0.G&$#!..K....c3....z.U.4.[.-+b.7g..zs.......}......./\|.....w~7?...Z..7.o..d.g...?@.C._.C...n.C.#..\|......j:7.}.............w.C.....Q.t..O..eA..9..s........b.Bzv.......q7m$-]..........q...'.......4......t7..f...l.M.I.5..\..A._'e.4c%........Y.>c...].K_..#.Oj..]..Ap....d1.7\|h....e4.<..\...K4>.X.&.bOb.My.=;......D...#d#...".j.w..........V....57...R......e...y.,...._.....b..~.vm........%qr.73.Q..........<...,.(-.....5a.......A.v1_......e.......].f..Y0'...%O..YW..3....#iW.~.E...._8.tv....KLoZ..K....3S......W.T.Y.......f>.2.J....,..B}.j5......(.^.Z7.T.:(..2<:8...g;..........N.u9....zn.(u.{.....f.~b..U6._E.@...\|Q...s..&9..T...\!.sV.p..pH.>M.B..o., k.4.w.w7...^...\..({?...r.h....._........9...e.d...3q=q[.e. ..FN..].S...:Y....{...Y.K..K...j.76....U........ug{......d>e8..l...~.K.I..Iq...n.o.U.3...w.*g..@..k..s.@[V.i...B..F?..+.v.....Y...?.#...6x;":...4.-.....Nm..p...lb..X_.....d&_.$.. y.y.......+.......<hE:.

Chrome Cache Entry: 813

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	4.321854365656768
Encrypted:	false
SSDEEP:	3:YGKSHvANxm0KBRqSABHY:YGKgOxm0HxY
MD5:	06FCFF9AD2CFBF648406A13875BD7E38
SHA1:	1C3620D1038C1578A3B5E21E80C0523123E1E304
SHA-256:	9A970E1A236FE3E8F4A13AC7FF4E00C30809380E97B856FF6575BC2A38BBBDD6
SHA-512:	DC781A227E30ED8C62D42029B2E81100CFF50D1991FF577A2F17C1039533E7A84596121A43E627D821D9F4804A6E88A9EBE8635C558E01F72595BB4A59DA75C1
Malicious:	false
Reputation:	low
Preview:	{"code":400,"message":"HTTP method not allowed"}

Chrome Cache Entry: 814

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
URL:	"https://www.booking.com/js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=2c8482c2544201f4&ete=&etg=&etcg=cCHObEfEITNPfbeQMIaWYUQJFFQccCcCcCC\|5&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,cCHObKdBdUHINPSXeHDALOLOLMO\|3&etgwv="
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 815

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21778), with no line terminators
Category:	dropped
Size (bytes):	21778
Entropy (8bit):	4.769188103585108
Encrypted:	false
SSDEEP:	384:+Z8C4hGoFjlCS7FGAVsq1nwGfg4xqsQMPNE:JmJ
MD5:	73BC4067D312180A1B19A4D883F42D6A
SHA1:	AD328A9A572FBEA43F295E7769835FF08F6FF1FD
SHA-256:	D3F7B0EC4DE079928A999641E781E80F33597A392A561BC460276DFB4EFB6EEC
SHA-512:	20B89462521684C258A8CE15E94DA67182C66397B0DE528357E01294FF06883C1AD96037A9D739E4575DB8722B1A1967578709A0C844CD45A49E6A51E1B6479D
Malicious:	false
Reputation:	low
Preview:	#onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .onetrust-vendors-list-handler:hover{color:#1f96db}#onetrust-banner-sdk:focus{outline:2px solid #000;outline-offset:-2px}#onetrust-banner-sdk a:focus{outline:2px solid #000}#onetrust-banner-sdk #onetrust-accept-btn-handler,#onetrust-banner-sdk #onetrust-reject-all-handler,#onetrust-banner-sdk #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk.ot-bnr-w-logo .ot-bnr-logo{height:64px;width:64px}#onetrust-banner-sdk .ot-tcf2-vendor-count.ot-text-bold{font-weight:bold}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-icon,#ot-sync-ntfy .ot-close-icon{background-size:contain;background-repeat:no-repeat;background-position:center;height:12px;width:12px}#onetrust-banner-sdk .powered-by-logo,#onetrust-banner-sdk .ot-pc-fo

Chrome Cache Entry: 816

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6661
Entropy (8bit):	4.80095747612634
Encrypted:	false
SSDEEP:	192:FnF7pSdDHj4w8psdXH73uRCwpY6vepSdDH3q3AJtd:vdwDHj4/2XH73uswpzowDH3q3AJtd
MD5:	C7F29EB8AB47BE7F1DA11F3476AFB880
SHA1:	129375120DA802DA9F47FB1B7784973844982354
SHA-256:	62042CDA60BEF4E79061BF0A8CE3F523224AC45986FCBCA22B1F187EE642CA3E
SHA-512:	2552EC1EEC83E494410ABEA29D962D8AD6BD1D20A4B3DBDB08029F28EC789B130115A9D839DEB85D08DE6AEFA9C027B6539A575A2BCC664790974CC870BAB29C
Malicious:	false
Reputation:	low
Preview:	{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202310.2.0","OptanonDataJSON":"3ea94870-d4b1-483a-b1d2-faf1d982bb31","GeolocationUrl":"https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location","BulkDomainCheckUrl":"https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck","RuleSet":[{"Id":"9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf","Name":"US","Countries":["us"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","en-US":"en-US","bg":"bg","lt":"lt","lv":"lv","hr":"hr","fr":"fr","hu":"hu","default":"en-GB","zh-Hant":"zh-Hant","uk":"uk","sk":"sk","sl":"sl","id":"id","ca":"ca","sr":"sr","sv":"sv","ko":"ko","pt-BR":"pt-BR","ms":"ms","el":"el","en":"en","is":"is","it":"it","es-MX":"es-MX","es":"es","zh":"zh","et":"et","cs":"cs","ar":"ar","pt-PT":"pt-PT","vi":"vi","th":"th","es-

Chrome Cache Entry: 817

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4520), with no line terminators
Category:	downloaded
Size (bytes):	4520
Entropy (8bit):	4.976207596364779
Encrypted:	false
SSDEEP:	48:EOuzRsBQ4W4IijTBgdiG/3xjkbzWLUcqsBQ4MTG/3KRracwzP1XEc:mRxbKWLUcqrjw1Ec
MD5:	468D5FFE82E24BCEFD8BE735497AEA7D
SHA1:	E2EEF916004FCEC2AB78D261F89EBE060E224021
SHA-256:	9A4725C5124A915D0EB6F9159A150EFAD966B954CB07DEBFE22CDBF241E08812
SHA-512:	45E45CAFC3CDA083B913210700FE100CB45E1F7B5907CA1A49A9C2F526506D78BFE27D4E74214A72BA9C01688B9C7181C3FFA2E372185EF53AA88F0B19529E9E
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/static/css/packages_city_landing_page_cloudfront_sd.iq_ltr/93424469ff1c9690f5bca8925db03679a0eb6072.css
Preview:	a.bui-link{font-weight:400}.bui-f-font-display_three,.bui-f-font-display_two,.bui-f-font-display_one,.bui-f-font-heading,.bui-f-font-emphasized,.bui-f-font-featured,.bui-f-font-body,.bui-f-font-caption{margin:0;padding:0}.nobg.resort_searchresults #bodyconstraint,.nobg.resort_details #bodyconstraint,.nobg.resort_prebook #bodyconstraint,.nobg.resort_book #bodyconstraint{max-width:none}.res-header{background-color:#f5f5f5;border-bottom:1px solid #e6e6e6;margin-bottom:40px}.res-page__title{font-size:var(--bui_font_headline_1_font-size);font-weight:var(--bui_font_headline_1_font-weight);line-height:var(--bui_font_headline_1_line-height);font-family:var(--bui_font_headline_1_font-family);padding:32px 0 16px 0}.res-header .sb-searchbox__outer{padding:40px 0 0 0}.res-header .xp__fieldset{margin:0}.res-wrapper{position:relative;max-width:1110px;margin:0 auto;font-size:var(--bui_font_body_2_font-size);font-weight:var(--bui_font_body_2_font-weight);line-height:var(--bui_font_body_2_line-height);

Chrome Cache Entry: 818

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2610)
Category:	downloaded
Size (bytes):	2722
Entropy (8bit):	5.319710345664043
Encrypted:	false
SSDEEP:	48:WH4y0KCC4IOVLqjZxJrv9Yms1UlPvB2mOGKp5ecUl52+gKp5eQRUMj82jsBKp5e8:71TbIOVOTZ9JXpscPBXsC0KbAGLFJV
MD5:	8A9D8FFFD9FB9DA1E8561180E6EFEA0C
SHA1:	E8FE3E2B5A5B4A569A7492AD22D2808AF8321C5B
SHA-256:	F13A118AE51BA738400D89446B1BFF699B537192B9B88EFF6F35C6736C0270E8
SHA-512:	04F36C16D1EDC7A8DC9ECF4EEAE5999C7A16DEF51A31351E75CD52FE6ACBDC51CF8211E6BE50F8BEB06DCB6F223B6758B60B21126948FE7DE2B764B1EF46EB9C
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/js/a4a24010.c06ec33d.chunk.js
Preview:	"use strict";(self["b-packages-core-packages-frontend__LOADABLE_LOADED_CHUNKS__"]=self["b-packages-core-packages-frontend__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["a4a24010"],{"181eacc8":function(e,n,r){r.d(n,{d:function(){return a}});var t=r("6ee88c54"),o=r("dc6d28ff"),c=r("d1e54a96"),a=function(){var e,n=(0,o.getRequestContext)().getSiteType(),r=(0,c.isRTL)();switch(n){case t.N.ANDROID:case t.N.IOS:case t.N.MDOT:e="small";break;case t.N.TDOT:e="medium";break;default:e="large"}return{defaultViewportSize:e,defaultRTL:r}}},"64b778ad":function(e,n,r){r.r(n);var t=r("3d054e81"),o=r("ead71eb0"),c=r.n(o),a=r("d16e9636"),s=r.n(a),i=r("41c6c66e"),u=r.n(i),d=r("dee2534d"),l=r.n(d),f=r("181eacc8"),h=r("90a20ace"),v=r.n(h),p={"/SearchBox":(0,a.loadable)({resolved:{},chunkName:function(){return"components-SearchBoxLite-SearchBoxLite"},isReady:function(e){var n=this.resolve(e);return!0===this.resolved[n]&&!!r.m[n]},importAsync:function(){return r.e("da34a25a").then(r.bind(r,"4e160131"))},requireAsy

Chrome Cache Entry: 819

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 100x100, components 3
Category:	downloaded
Size (bytes):	2617
Entropy (8bit):	7.814334415525114
Encrypted:	false
SSDEEP:	48:o9YMbuERAhD911xN8azUTW2/Mtq4G0pyaZackfXW9hADQtO/3tu3pk7X0IJhFz:ghCEGR3H8aUWYyq56ackfuGju8XHhFz
MD5:	2DBFF1EF8EF33EF78D5782231FE513E5
SHA1:	3CEB011E11B83FEA28154E087765A480C703FBF6
SHA-256:	4C2A5CA08BC34911CC94E2A88D8318F39E0F9618A419940FD43348113472066F
SHA-512:	4D171F198034C55EA7D7A56D582924D1B4BADCBD42360FEE439FBF3301E198B0FFFBE076A68A6A58BCCB652010E5F339EE5F606DD35EA0DE8F29F982F5E5AC0F
Malicious:	false
Reputation:	low
URL:	https://q-cf.bstatic.com/xdata/images/city/square100/689744.jpg?k=3c7c6d59d968c2bade9003d9ebf8a1346455ce92abe94ffaa29247839161f09e&o=
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......d.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...F.V<._.....R..F.VvQ..0r...M.kg..).)Wg....O..`.+l..V\|.O..0r..Q...T.\|..+l..ytQ.;...6{U...>s^B..6U..*.qr.vRl.~U/.G8r..Q...T.]...T..1....1....,5...})<..V.Rl........Vv.G..!.C.N..I..K`..G y=.......:..SN.....:.M.._=.+..`..3.{..g.^.I\.O..#^Z...3.....F...{..R(Pe......;.v.C".G...U...b..l.e6+.I....tk..^0y..5ga=...^.l..Tn<C....io172...8C.d..8..%....?b...W...

Chrome Cache Entry: 820

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 250x250, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	downloaded
Size (bytes):	16834
Entropy (8bit):	7.988591059503799
Encrypted:	false
SSDEEP:	384:5HpKm8qnn/Oo+m09VFf0/O1laTAMjQI5vrc7gkuNCkNIWU:JPn/OogfeO1wMukcIWU
MD5:	D62D1FC71DEF17C646075B1F2A1AB6D3
SHA1:	C9094715C866F963150BAA976B2426DD30F3B9D3
SHA-256:	C9B93E9328CC63A35E59796EB7FD3A1D0EEC12CDFF6F3CBCFE02A7FFD4287F2D
SHA-512:	20D4065A77EDA956C834F59327FCD18ABCB444E5010C11F66C84CD644AB5A727D1C426544EBAAD58902F6D27078B413FCB436CDF6C4206A85D3D193719337001
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/xdata/images/city/square250/977388.webp?k=4c9c54255e9d2e2d8084959527abea6b6b8a4b8a538a921f1df9e4bea2503ff6&o=
Preview:	RIFF.A..WEBPVP8 .A...........>m,.F&#....0`....^..........?-..Kh.;...^....s...&,...{.O...............{...G.\|...g..n.G.w.G......R.o6>.{.~..W.;..?.?p..?..............>.e.c.......w...?y......`.Mw..mf.&...'...c.T...#..}..[........W..qv.4.-<... B...unQ.q0.,s.JG...H..\|...L(...0I..6nb,b.M!!I,Z....>_.9+A....(5s9.1.<8^Q....<3>....8D.q^W..L....:.xA.D..qW.:L.....,..x.G....&.;n.g.V.j.........%.Y.l-...2D..H6...D./...a...\|E..w.#3.1t../.$......V..%..w4.\(.e...Q......hu.....%.....V._..(b;..O..oP.........h.}....g\|N^...P.NO...m/...K.US.!L..s....+......<R$....o..%RB...."........I../. o.....Gjv<S..z..2..r8\|p....Hq.. ...Z.....N.ybF.@.8S...a..(.....!.\.A.F..D..Gd"...n...d.yO/.........{.......$......!...q3........:...N. ..Dz..u.#.+......l..#".....j......X.&..l.Of{...P..^t.W.yp.2s.MH.a.Y.K..%.+(.av...E....x........O...f.....\.....?....../.5......C.....\|+...?..Z.....N.{A..e/......8-q.. ..g.=...D...9r..u.W...<K..J&..5...=2.t.r...b8..aT.m.S...d..T..7..+1$8.

Chrome Cache Entry: 821

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	857
Entropy (8bit):	5.299042220070378
Encrypted:	false
SSDEEP:	12:YNNGa0+CDnixV1RN8DHXrRknz/it/st75zIEVrrZU5uE:YNNGa1CDiL1RN8DHXrRknz/i5S7bVriL
MD5:	5FBB79722DF69277F9D3CC9E46B445B0
SHA1:	FD56ED9DBC7747F523F0C2390E2CE6ECBAC60605
SHA-256:	BB43421FF6F72E2924CB5625112BE0460FC2F6AC694FE0B7BB8C56E02F1AB199
SHA-512:	CBC75E16C246F7F41E5BB51B4FB2F61BC7ABE8A2CB6EA80F30D6894C6B0C4372BB469C7D7CFCA6C04C496ED32D7A649A756BA4BA65BB5E9153C88043BF127F0F
Malicious:	false
Reputation:	low
Preview:	{"/3102/bcom-www/accommodations/index/index-primary":["html",0,null,null,0,50,320,1,0,null,null,null,null,[["ID=d01f0e55afb0ea19:T=1707417348:RT=1707417348:S=ALNI_MZi61Bks8JIjO3Bkh28vG4aQMWNjA",1741113348,"/","booking.com",1],["UID=00000a0c2f4fbb08:T=1707417348:RT=1707417348:S=ALNI_MZQQ7Vf5OfWBjUMOrptM2BKtWbPbQ",1741113348,"/","booking.com",2]],null,null,null,null,null,null,null,null,null,null,null,0,null,null,null,null,null,null,"AOrYGslXqzWxZnMwa10HhsoG5C0a","CJj0kaSxnIQDFXYKTwgddQsOjA",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"1",null,null,null,null,null,null,null,null,null,null,null,"AA-V4qPpTXnKrgKSiJCTDJVu-i9ThuWZ61hX1gxJVqnMfovqFQ6e0a-I6K2f37Hi2k9SeQcdGDJVakTmhQ",null,null,null,null,null,null,[["ID=148b73b153d2e8b3:T=1707417348:RT=1707417348:S=AA-AfjbY96esx-pDNwNIx7vdbru6",1722969348,"/","booking.com"]],[]]}..

Chrome Cache Entry: 822

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 170x136, components 3
Category:	dropped
Size (bytes):	6127
Entropy (8bit):	7.918430706952215
Encrypted:	false
SSDEEP:	96:ghIEFQHYedsuAOyk9NrGmhhTe/3iTfRY95uqQuAPzuSNeuG05diQzQfPzjVSRoBL:mIkZyVAO39cmhhG3+Y9jfALH5gQzQTj1
MD5:	A4F15F6110A2670D27788BEF9BBEBACB
SHA1:	F1307AA614B569BB3691989B0B7AED763064222E
SHA-256:	F5BDF32F8CBD1CBE73F07EA6AA33BA65F827BA1990E7AFCE48C2AB922C032447
SHA-512:	EC6053FE6B8EBB87BEB60FB6C0D47E5FB1DDB0AD2D1C789DEEDE4EF45729C4A237BB8BB5B20C2F35888E4B725D901B1A9181A2B11CA8D1CA612C4DC1C00064F8
Malicious:	false
Reputation:	low
Preview:	......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..D...%9F@3E.`JpZxZ.Y&C..w.@.K......x..G\|..;...`.zw..\e....zjH..._A..j.t<dg..Tn......Y.y..[{.h.c.&.....`.QS.aF...(-.K.0.N..m$..N.y.....m\f...!..jm.l..b..m...v..-..jm.. .:.E...4.LE4..@E3..\C.D.*.3.j...>...5HE.Z.V.Z.Ees[......<.W....p.x>.^[[.0...V....p)C.(.....XE....6.]..!.@.)qN.K..@)...5&)...H...G5.....]...z.<..\yV.B..5.<Agc<..~..#.wwW>\XD......d.. ......oom..IW.8.\

Chrome Cache Entry: 823

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 824

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1597)
Category:	downloaded
Size (bytes):	1713
Entropy (8bit):	5.174608444183338
Encrypted:	false
SSDEEP:	24:5ECLvGWV/lweFZ3UYVN/QZSKGkMF6l4Q5fJ9VArxijT0nuvLSSqoZ:5/LvGatweFNUY//Qegl9FJ9IijTXaoZ
MD5:	51BE0C43CC481B13FE70D3BA27E2FFD9
SHA1:	F25639014CDA8BF794AF82D1CD784871CC70A7DE
SHA-256:	CB8E8F2FA50E2C77C3717D0F81B9E7CD9483D9CF99BE47C93E6FB31295E52261
SHA-512:	074F5D81271E67A5841C40A362FCE33C0169D81B8BB8628FD12FA1A6616014B58272DA7D0F878524AEC4A0420CF9F878499EA34647F00908A1F7DB0EB06AE371
Malicious:	false
Reputation:	low
URL:	https://cf.bstatic.com/psb/capla/static/css/4e596c2c.3a2fb681.chunk.css
Preview:	.c1f4ef4d83{margin-top:var(--bui_spacing_1x);margin-bottom:var(--bui_spacing_2x)}.a8d1f39845{margin-bottom:var(--bui_spacing_4x)}.f742a100f0{margin-bottom:var(--bui_spacing_3x)}.d5376772eb{margin-bottom:var(--bui_spacing_2x)}.a87be8268b{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch}.a87be8268b:link{color:var(--bui_color_foreground_alt);font-weight:500}.b0bcffb5dc{border-radius:var(--bui_border_radius_200)}.c3a4d3369f{margin-top:var(--bui_spacing_2x);margin-bottom:0!important}.c3a4d3369f div{margin-bottom:var(--bui_spacing_half)}.fbbd4482e9{position:absolute;top:var(--bui_spacing_3x);left:var(--bui_spacing_3x);margin-right:var(--bui_spacing_3x)}.dd8e2ae84f{color:var(--bui_color_black)}.d1c3bff2b4{width:100%;height:100%}.ae2824c1f5{border:1px solid var(--bui_color_action_foreground);color:var(--bui_color_action_foreground);text-align:center}.dcc1c777cd{width:-moz-min-content;width:min-content}.a9e2165731{display:-webkit-box;-webkit-lin

Chrome Cache Entry: 825

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 40640, version 2.0
Category:	downloaded
Size (bytes):	40640
Entropy (8bit):	7.987542768068474
Encrypted:	false
SSDEEP:	768:FYkwEGsiAsf2taNWlKXLS2DFz/xMJEwrnP5QZrV71CCsDC:FYkwEGszsf2t1ILS2R6EWSd1FsDC
MD5:	44BB644882B70AA9444E491E812D4A4B
SHA1:	65F9D0215301CECC36B1433E562B131F7D26AD24
SHA-256:	96962B05C04EA77D8261A870A4CDA2784FA137EC63350587EB46B75F40D126C2
SHA-512:	4DD99C5713C179775719A0E748FAAAE97853CFF820038A831119C78B099861050B702EED02FDDDE08A4314C55DB25035CAFDB38E9B6CFE601934EC6343D5ADCA
Malicious:	false
Reputation:	low
URL:	https://t-cf.bstatic.com/design-assets/assets/v3.81.0/fonts-brand/BookingExtraBold.woff
Preview:	wOFF...............4........................GDEF..\|........x\.].GPOS..}....^....y...GSUB...D...z........OS/2.......Y...`k.D.cmap...h.......la.D.cvt ...$........$...fpgm...T.........0.6gasp..\|.............glyf......e....&. .head.......6...6...<hhea....... ...$...-hmtx...T.......D.D.loca...........$'.UImaxp....... ... . ..name..{...........G.post..\|........ ...Jprep......."....F..&........W.._.<...........K.....V.d....................x.c`d``..........]g9..A.L...5.........P...X......./.a..........x.%.E.......N..F..EArP.z.I.@..}2.....C/...\|..%.m.j1....l...j..3.4.G6...d.\....`H?.......x....%I....z..m.Y.xf5..m.m.m.m.}..Q...\|..EVg.fe...o.6...A...m....@I.(.h..A.:._.......p...".~$..v..q}?...?.k.W.f..6F..+I....v..%;.A.A.I.i#..\K....$IJI>.$.Ak.?.-....4...BY.].....m.E=....,..I'S.d...&...0.....$..X..u=U.y8h.l....l...1@.I./6..u("."=X..^...p......f+.!..>].Gb~..ND.I..cA.E.m.jR..}N..k...e{..E....O....Y.\.......]L&........o[S.4.f....Dn&.0.1..b...."...4.Z.I..........{....::

Chrome Cache Entry: 826

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4719), with no line terminators
Category:	downloaded
Size (bytes):	4719
Entropy (8bit):	5.4231317524428
Encrypted:	false
SSDEEP:	96:9WsFpRR6+6Y6yHuwCp0yHALwhLMpn42MGkdtq7eh1pecbt:9++2y7CpBhyDMa7Cwcbt
MD5:	0FF86D58500D816B1BAB19E76F4137DC
SHA1:	E39D79BEF4FAC0AAE13A6CFF12BCC3E8FF780BEC
SHA-256:	626ABB262FEBEA651856ADB8A4E9C4A0C909EBF8781E8956345A3764CDA2E5E7
SHA-512:	A374DE0BD096FCEE501F9BFC9DE58243293423FB8B627CE1BEA305C4FDCC4994B4C1DEF4F5471D96244F993CA92977EABE465712FBF0959B8F26DC64D58C6D83
Malicious:	false
Reputation:	low
URL:	https://s.pinimg.com/ct/core.js
Preview:	!function(t){var i={};function r(n){var e;return(i[n]\|\|(e=i[n]={i:n,l:!1,exports:{}},t[n].call(e.exports,e,e.exports,r),e.l=!0,e)).exports}r.m=t,r.c=i,r.d=function(n,e,t){r.o(n,e)\|\|Object.defineProperty(n,e,{enumerable:!0,get:t})},r.r=function(n){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(n,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(n,"u",{value:!0})},r.t=function(e,n){if(1&n&&(e=r(e)),8&n)return e;if(4&n&&"object"==typeof e&&e&&e.u)return e;var t=Object.create(null);if(r.r(t),Object.defineProperty(t,"default",{enumerable:!0,value:e}),2&n&&"string"!=typeof e)for(var i in e)r.d(t,i,function(n){return e[n]}.bind(null,i));return t},r.n=function(n){var e=n&&n.u?function(){return n.default}:function(){return n};return r.d(e,"a",e),e},r.o=function(n,e){return Object.prototype.hasOwnProperty.call(n,e)},r.p="",r(r.s=2)}([function(n,e){function t(n,e){return function(n){if(Array.isArray(n))return n}(n)\|\|function(n,e){var t=null==n?null:"undefined"!=typ

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 8, 2024 19:35:26.651220083 CET	192.168.2.5	1.1.1.1	0xbb00	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:26.652210951 CET	192.168.2.5	1.1.1.1	0xad0d	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:26.654186010 CET	192.168.2.5	1.1.1.1	0x36b1	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:26.654874086 CET	192.168.2.5	1.1.1.1	0x1943	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:28.443053961 CET	192.168.2.5	1.1.1.1	0x6ba4	Standard query (0)	booking.search-13125.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:28.443300009 CET	192.168.2.5	1.1.1.1	0x2af0	Standard query (0)	booking.search-13125.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:29.486996889 CET	192.168.2.5	1.1.1.1	0xce18	Standard query (0)	booking.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:29.487832069 CET	192.168.2.5	1.1.1.1	0x8260	Standard query (0)	booking.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:30.995707035 CET	192.168.2.5	1.1.1.1	0x1151	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:30.996077061 CET	192.168.2.5	1.1.1.1	0xcee0	Standard query (0)	www.google.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:31.000689030 CET	192.168.2.5	1.1.1.1	0x22f1	Standard query (0)	www.booking.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:31.001399994 CET	192.168.2.5	1.1.1.1	0x511b	Standard query (0)	www.booking.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:32.233028889 CET	192.168.2.5	1.1.1.1	0xbddd	Standard query (0)	shelves.booking.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:32.233764887 CET	192.168.2.5	1.1.1.1	0x3d36	Standard query (0)	shelves.booking.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:32.243143082 CET	192.168.2.5	1.1.1.1	0x7b1f	Standard query (0)	cf.bstatic.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:32.243704081 CET	192.168.2.5	1.1.1.1	0x132a	Standard query (0)	cf.bstatic.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:32.919115067 CET	192.168.2.5	1.1.1.1	0xfc42	Standard query (0)	q-xx.bstatic.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:32.919935942 CET	192.168.2.5	1.1.1.1	0xfe85	Standard query (0)	q-xx.bstatic.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:33.519030094 CET	192.168.2.5	1.1.1.1	0xa4b5	Standard query (0)	q-xx.bstatic.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:33.520065069 CET	192.168.2.5	1.1.1.1	0x7a3d	Standard query (0)	q-xx.bstatic.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:35.275258064 CET	192.168.2.5	1.1.1.1	0xb276	Standard query (0)	securepubads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:35.275587082 CET	192.168.2.5	1.1.1.1	0x1eca	Standard query (0)	securepubads.g.doubleclick.net	65	IN (0x0001)	false
Feb 8, 2024 19:35:35.277614117 CET	192.168.2.5	1.1.1.1	0x4828	Standard query (0)	cdn.cookielaw.org	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:35.278179884 CET	192.168.2.5	1.1.1.1	0x1102	Standard query (0)	cdn.cookielaw.org	65	IN (0x0001)	false
Feb 8, 2024 19:35:35.801058054 CET	192.168.2.5	1.1.1.1	0x457c	Standard query (0)	r-xx.bstatic.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:35.801533937 CET	192.168.2.5	1.1.1.1	0xac7c	Standard query (0)	r-xx.bstatic.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:35.810075998 CET	192.168.2.5	1.1.1.1	0x4f69	Standard query (0)	t-cf.bstatic.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:35.810594082 CET	192.168.2.5	1.1.1.1	0x70b1	Standard query (0)	t-cf.bstatic.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:36.394293070 CET	192.168.2.5	1.1.1.1	0x5b9	Standard query (0)	account.booking.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:36.394678116 CET	192.168.2.5	1.1.1.1	0x6046	Standard query (0)	account.booking.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:37.809875965 CET	192.168.2.5	1.1.1.1	0xc6e7	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:37.810132980 CET	192.168.2.5	1.1.1.1	0xf03b	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:37.902312040 CET	192.168.2.5	1.1.1.1	0xedad	Standard query (0)	cf.bstatic.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:37.902586937 CET	192.168.2.5	1.1.1.1	0xa973	Standard query (0)	cf.bstatic.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:37.981415987 CET	192.168.2.5	1.1.1.1	0xc63b	Standard query (0)	r-xx.bstatic.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:37.981563091 CET	192.168.2.5	1.1.1.1	0xc886	Standard query (0)	r-xx.bstatic.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:38.140852928 CET	192.168.2.5	1.1.1.1	0xccb1	Standard query (0)	www.booking.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:38.141204119 CET	192.168.2.5	1.1.1.1	0xf8af	Standard query (0)	www.booking.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:38.389347076 CET	192.168.2.5	1.1.1.1	0x8739	Standard query (0)	geolocation.onetrust.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:38.389347076 CET	192.168.2.5	1.1.1.1	0x96fa	Standard query (0)	geolocation.onetrust.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:38.391169071 CET	192.168.2.5	1.1.1.1	0x531b	Standard query (0)	cdn.cookielaw.org	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:38.391213894 CET	192.168.2.5	1.1.1.1	0xa407	Standard query (0)	cdn.cookielaw.org	65	IN (0x0001)	false
Feb 8, 2024 19:35:39.079435110 CET	192.168.2.5	1.1.1.1	0x199a	Standard query (0)	geolocation.onetrust.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.079843044 CET	192.168.2.5	1.1.1.1	0x9a8	Standard query (0)	geolocation.onetrust.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:39.198895931 CET	192.168.2.5	1.1.1.1	0x2955	Standard query (0)	account.booking.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:39.198895931 CET	192.168.2.5	1.1.1.1	0x276b	Standard query (0)	account.booking.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.237690926 CET	192.168.2.5	1.1.1.1	0x9bb7	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.238138914 CET	192.168.2.5	1.1.1.1	0xaf19	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Feb 8, 2024 19:35:39.790666103 CET	192.168.2.5	1.1.1.1	0xe002	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.790920973 CET	192.168.2.5	1.1.1.1	0xc991	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Feb 8, 2024 19:35:39.837346077 CET	192.168.2.5	1.1.1.1	0x681f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.840771914 CET	192.168.2.5	1.1.1.1	0x2f7d	Standard query (0)	www.google.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:40.105057955 CET	192.168.2.5	1.1.1.1	0xe81e	Standard query (0)	web-vitals.booking.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:40.106343985 CET	192.168.2.5	1.1.1.1	0x4dc	Standard query (0)	web-vitals.booking.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:40.391932964 CET	192.168.2.5	1.1.1.1	0xbc5a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:40.392110109 CET	192.168.2.5	1.1.1.1	0x8e3b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:41.339958906 CET	192.168.2.5	1.1.1.1	0xf46c	Standard query (0)	accommodations.booking.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:41.340599060 CET	192.168.2.5	1.1.1.1	0x4c29	Standard query (0)	accommodations.booking.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:41.552330971 CET	192.168.2.5	1.1.1.1	0xcdb9	Standard query (0)	web-vitals.booking.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:41.552798986 CET	192.168.2.5	1.1.1.1	0xc883	Standard query (0)	web-vitals.booking.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:43.273637056 CET	192.168.2.5	1.1.1.1	0xebd9	Standard query (0)	accommodations.booking.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:43.274185896 CET	192.168.2.5	1.1.1.1	0x4fce	Standard query (0)	accommodations.booking.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:43.765861034 CET	192.168.2.5	1.1.1.1	0x628e	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:43.766169071 CET	192.168.2.5	1.1.1.1	0x9c82	Standard query (0)	google.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:43.766815901 CET	192.168.2.5	1.1.1.1	0x4e63	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:43.767041922 CET	192.168.2.5	1.1.1.1	0xdd21	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:44.195739031 CET	192.168.2.5	1.1.1.1	0x1a86	Standard query (0)	www3.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.196199894 CET	192.168.2.5	1.1.1.1	0xf8da	Standard query (0)	www3.doubleclick.net	65	IN (0x0001)	false
Feb 8, 2024 19:35:44.389221907 CET	192.168.2.5	1.1.1.1	0x2a45	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.389902115 CET	192.168.2.5	1.1.1.1	0x5eef	Standard query (0)	www.google.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:44.524837971 CET	192.168.2.5	1.1.1.1	0x9aa8	Standard query (0)	securepubads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.525281906 CET	192.168.2.5	1.1.1.1	0xbbef	Standard query (0)	securepubads.g.doubleclick.net	65	IN (0x0001)	false
Feb 8, 2024 19:35:44.547683954 CET	192.168.2.5	1.1.1.1	0x5b2	Standard query (0)	d8c14d4960ca.edge.sdk.awswaf.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.548038006 CET	192.168.2.5	1.1.1.1	0xc8e9	Standard query (0)	d8c14d4960ca.edge.sdk.awswaf.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:44.781802893 CET	192.168.2.5	1.1.1.1	0xf4cb	Standard query (0)	marketingplatform.google.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.782622099 CET	192.168.2.5	1.1.1.1	0x1a2d	Standard query (0)	marketingplatform.google.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:45.038100004 CET	192.168.2.5	1.1.1.1	0xbc66	Standard query (0)	sc-static.net	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.038507938 CET	192.168.2.5	1.1.1.1	0xae74	Standard query (0)	sc-static.net	65	IN (0x0001)	false
Feb 8, 2024 19:35:45.039462090 CET	192.168.2.5	1.1.1.1	0xfccd	Standard query (0)	s.pinimg.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.039840937 CET	192.168.2.5	1.1.1.1	0x6706	Standard query (0)	s.pinimg.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:45.073725939 CET	192.168.2.5	1.1.1.1	0xf867	Standard query (0)	td.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.134042978 CET	192.168.2.5	1.1.1.1	0x842	Standard query (0)	td.doubleclick.net	65	IN (0x0001)	false
Feb 8, 2024 19:35:45.235210896 CET	192.168.2.5	1.1.1.1	0xc7a2	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.235594988 CET	192.168.2.5	1.1.1.1	0x8c76	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Feb 8, 2024 19:35:45.346409082 CET	192.168.2.5	1.1.1.1	0x915c	Standard query (0)	s.yimg.jp	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.346802950 CET	192.168.2.5	1.1.1.1	0xce42	Standard query (0)	s.yimg.jp	65	IN (0x0001)	false
Feb 8, 2024 19:35:45.443423033 CET	192.168.2.5	1.1.1.1	0xef2	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.443948030 CET	192.168.2.5	1.1.1.1	0x5e97	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:45.692687035 CET	192.168.2.5	1.1.1.1	0xe823	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.693228960 CET	192.168.2.5	1.1.1.1	0x61eb	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Feb 8, 2024 19:35:45.937138081 CET	192.168.2.5	1.1.1.1	0xe4cb	Standard query (0)	tr.snapchat.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.937441111 CET	192.168.2.5	1.1.1.1	0x70a0	Standard query (0)	tr.snapchat.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:46.263209105 CET	192.168.2.5	1.1.1.1	0xba63	Standard query (0)	gtm-mktg.booking.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:46.263248920 CET	192.168.2.5	1.1.1.1	0xb546	Standard query (0)	gtm-mktg.booking.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:46.358376026 CET	192.168.2.5	1.1.1.1	0xf4ee	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:46.358731985 CET	192.168.2.5	1.1.1.1	0x7507	Standard query (0)	www.google.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:46.380923986 CET	192.168.2.5	1.1.1.1	0xad53	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:46.381356955 CET	192.168.2.5	1.1.1.1	0x1245	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Feb 8, 2024 19:35:46.982165098 CET	192.168.2.5	1.1.1.1	0x8238	Standard query (0)	adservice.google.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:46.983201981 CET	192.168.2.5	1.1.1.1	0xc924	Standard query (0)	adservice.google.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:47.310884953 CET	192.168.2.5	1.1.1.1	0xf313	Standard query (0)	securepubads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.311264992 CET	192.168.2.5	1.1.1.1	0xfb9	Standard query (0)	securepubads.g.doubleclick.net	65	IN (0x0001)	false
Feb 8, 2024 19:35:47.311767101 CET	192.168.2.5	1.1.1.1	0x6e13	Standard query (0)	t-cf.bstatic.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.311978102 CET	192.168.2.5	1.1.1.1	0xab5	Standard query (0)	t-cf.bstatic.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:47.330986023 CET	192.168.2.5	1.1.1.1	0xd229	Standard query (0)	marketingplatform.google.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.331206083 CET	192.168.2.5	1.1.1.1	0xadb8	Standard query (0)	marketingplatform.google.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:47.340039968 CET	192.168.2.5	1.1.1.1	0x917e	Standard query (0)	tr.snapchat.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.340547085 CET	192.168.2.5	1.1.1.1	0x5280	Standard query (0)	tr.snapchat.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:47.350280046 CET	192.168.2.5	1.1.1.1	0x5c6e	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.350498915 CET	192.168.2.5	1.1.1.1	0xed26	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Feb 8, 2024 19:35:47.396365881 CET	192.168.2.5	1.1.1.1	0x1125	Standard query (0)	gtm-mktg.booking.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.396857977 CET	192.168.2.5	1.1.1.1	0x61a8	Standard query (0)	gtm-mktg.booking.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:47.614916086 CET	192.168.2.5	1.1.1.1	0x96b	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.615339041 CET	192.168.2.5	1.1.1.1	0x6ef9	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:47.666553974 CET	192.168.2.5	1.1.1.1	0xf5cb	Standard query (0)	adservice.google.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.666990995 CET	192.168.2.5	1.1.1.1	0x1aa6	Standard query (0)	adservice.google.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:47.711721897 CET	192.168.2.5	1.1.1.1	0xa560	Standard query (0)	ct.pinterest.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.711966038 CET	192.168.2.5	1.1.1.1	0xc267	Standard query (0)	ct.pinterest.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:48.018227100 CET	192.168.2.5	1.1.1.1	0x5150	Standard query (0)	tr.snapchat.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:48.018227100 CET	192.168.2.5	1.1.1.1	0xe607	Standard query (0)	tr.snapchat.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:48.375746965 CET	192.168.2.5	1.1.1.1	0x9391	Standard query (0)	ct.pinterest.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:48.375988960 CET	192.168.2.5	1.1.1.1	0x6b47	Standard query (0)	ct.pinterest.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:48.523665905 CET	192.168.2.5	1.1.1.1	0x91bd	Standard query (0)	analytics.google.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:48.524164915 CET	192.168.2.5	1.1.1.1	0x5a5e	Standard query (0)	analytics.google.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:48.624231100 CET	192.168.2.5	1.1.1.1	0xe69a	Standard query (0)	tr6.snapchat.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:48.626840115 CET	192.168.2.5	1.1.1.1	0xfdf3	Standard query (0)	tr6.snapchat.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:48.705209017 CET	192.168.2.5	1.1.1.1	0x902e	Standard query (0)	ct.pinterest.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:48.705748081 CET	192.168.2.5	1.1.1.1	0x8e2b	Standard query (0)	ct.pinterest.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:49.184972048 CET	192.168.2.5	1.1.1.1	0xdb2b	Standard query (0)	web-perf.booking.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:49.185739040 CET	192.168.2.5	1.1.1.1	0x5098	Standard query (0)	web-perf.booking.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:56.730206966 CET	192.168.2.5	1.1.1.1	0x4f02	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:56.731163025 CET	192.168.2.5	1.1.1.1	0x9dee	Standard query (0)	google.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:56.732382059 CET	192.168.2.5	1.1.1.1	0x5c0d	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:56.733014107 CET	192.168.2.5	1.1.1.1	0x598b	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:57.415044069 CET	192.168.2.5	1.1.1.1	0xc489	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:57.418287992 CET	192.168.2.5	1.1.1.1	0x5050	Standard query (0)	www.google.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:57.666126966 CET	192.168.2.5	1.1.1.1	0x367b	Standard query (0)	nellie.booking.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:57.666507006 CET	192.168.2.5	1.1.1.1	0x142a	Standard query (0)	nellie.booking.com	65	IN (0x0001)	false
Feb 8, 2024 19:35:58.706846952 CET	192.168.2.5	1.1.1.1	0xd293	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:58.707978010 CET	192.168.2.5	1.1.1.1	0xae3b	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Feb 8, 2024 19:36:11.072767019 CET	192.168.2.5	1.1.1.1	0xd2b9	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:11.073338985 CET	192.168.2.5	1.1.1.1	0x983c	Standard query (0)	google.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:11.073786974 CET	192.168.2.5	1.1.1.1	0x4d83	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:11.074290037 CET	192.168.2.5	1.1.1.1	0x5fc0	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:11.646173000 CET	192.168.2.5	1.1.1.1	0x5f7a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:11.646383047 CET	192.168.2.5	1.1.1.1	0xc387	Standard query (0)	www.google.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:11.865982056 CET	192.168.2.5	1.1.1.1	0x2f7f	Standard query (0)	ad.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:11.866462946 CET	192.168.2.5	1.1.1.1	0x5f27	Standard query (0)	ad.doubleclick.net	65	IN (0x0001)	false
Feb 8, 2024 19:36:14.016448021 CET	192.168.2.5	1.1.1.1	0xcfb	Standard query (0)	www.googletagservices.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:14.016938925 CET	192.168.2.5	1.1.1.1	0x9d26	Standard query (0)	www.googletagservices.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:14.017512083 CET	192.168.2.5	1.1.1.1	0x15e7	Standard query (0)	z.moatads.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:14.017755032 CET	192.168.2.5	1.1.1.1	0xbf85	Standard query (0)	z.moatads.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:18.365479946 CET	192.168.2.5	1.1.1.1	0x50b7	Standard query (0)	www.bstatic.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:18.366039038 CET	192.168.2.5	1.1.1.1	0x713e	Standard query (0)	www.bstatic.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:22.861202955 CET	192.168.2.5	1.1.1.1	0x4575	Standard query (0)	r.bstatic.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:22.861498117 CET	192.168.2.5	1.1.1.1	0xc211	Standard query (0)	r.bstatic.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:22.862135887 CET	192.168.2.5	1.1.1.1	0x7ee7	Standard query (0)	xx.bstatic.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:22.863182068 CET	192.168.2.5	1.1.1.1	0x1da0	Standard query (0)	xx.bstatic.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:23.616369963 CET	192.168.2.5	1.1.1.1	0x9a75	Standard query (0)	xx.bstatic.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:23.616369963 CET	192.168.2.5	1.1.1.1	0xa3	Standard query (0)	xx.bstatic.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:23.909555912 CET	192.168.2.5	1.1.1.1	0x9ff8	Standard query (0)	collector-pxikkul2rm.px-cloud.net	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:23.909596920 CET	192.168.2.5	1.1.1.1	0x36c2	Standard query (0)	collector-pxikkul2rm.px-cloud.net	65	IN (0x0001)	false
Feb 8, 2024 19:36:24.494649887 CET	192.168.2.5	1.1.1.1	0x647f	Standard query (0)	collector-pxikkul2rm.px-cloud.net	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:24.494967937 CET	192.168.2.5	1.1.1.1	0x7a69	Standard query (0)	collector-pxikkul2rm.px-cloud.net	65	IN (0x0001)	false
Feb 8, 2024 19:36:28.814327955 CET	192.168.2.5	1.1.1.1	0x949b	Standard query (0)	q-cf.bstatic.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:28.814757109 CET	192.168.2.5	1.1.1.1	0x90b7	Standard query (0)	q-cf.bstatic.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:32.280379057 CET	192.168.2.5	1.1.1.1	0x653d	Standard query (0)	www.booking.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:32.280838966 CET	192.168.2.5	1.1.1.1	0x3a01	Standard query (0)	www.booking.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:32.851628065 CET	192.168.2.5	1.1.1.1	0x69b5	Standard query (0)	flights.booking.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:32.852207899 CET	192.168.2.5	1.1.1.1	0x1a93	Standard query (0)	flights.booking.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:33.198303938 CET	192.168.2.5	1.1.1.1	0x7762	Standard query (0)	q-cf.bstatic.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:33.198524952 CET	192.168.2.5	1.1.1.1	0x91bf	Standard query (0)	q-cf.bstatic.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:34.806706905 CET	192.168.2.5	1.1.1.1	0x3625	Standard query (0)	flights.booking.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:34.806986094 CET	192.168.2.5	1.1.1.1	0xa579	Standard query (0)	flights.booking.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:38.022085905 CET	192.168.2.5	1.1.1.1	0x58cb	Standard query (0)	cf.bstatic.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:38.022634029 CET	192.168.2.5	1.1.1.1	0x8c76	Standard query (0)	cf.bstatic.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:38.043736935 CET	192.168.2.5	1.1.1.1	0x9039	Standard query (0)	booking.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:38.044060946 CET	192.168.2.5	1.1.1.1	0xf01c	Standard query (0)	booking.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:38.053119898 CET	192.168.2.5	1.1.1.1	0xac71	Standard query (0)	q-xx.bstatic.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:38.053340912 CET	192.168.2.5	1.1.1.1	0xcf86	Standard query (0)	q-xx.bstatic.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:38.172933102 CET	192.168.2.5	1.1.1.1	0x5ebc	Standard query (0)	t-cf.bstatic.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:38.173677921 CET	192.168.2.5	1.1.1.1	0x5d79	Standard query (0)	t-cf.bstatic.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:39.575982094 CET	192.168.2.5	1.1.1.1	0x89c4	Standard query (0)	shelves.booking.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:39.577024937 CET	192.168.2.5	1.1.1.1	0xc66f	Standard query (0)	shelves.booking.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:40.421575069 CET	192.168.2.5	1.1.1.1	0xb921	Standard query (0)	cf.bstatic.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:40.422097921 CET	192.168.2.5	1.1.1.1	0xc37f	Standard query (0)	cf.bstatic.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:43.725450039 CET	192.168.2.5	1.1.1.1	0xec1c	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:43.726305008 CET	192.168.2.5	1.1.1.1	0x3ca8	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Feb 8, 2024 19:36:44.027925968 CET	192.168.2.5	1.1.1.1	0x11b9	Standard query (0)	geolocation.onetrust.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:44.028316021 CET	192.168.2.5	1.1.1.1	0x2df2	Standard query (0)	geolocation.onetrust.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:44.161984921 CET	192.168.2.5	1.1.1.1	0x5fce	Standard query (0)	www.booking.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:44.162463903 CET	192.168.2.5	1.1.1.1	0xfb87	Standard query (0)	www.booking.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:44.483102083 CET	192.168.2.5	1.1.1.1	0x55fa	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:44.483465910 CET	192.168.2.5	1.1.1.1	0xbe8b	Standard query (0)	stats.g.doubleclick.net	65	IN (0x0001)	false
Feb 8, 2024 19:36:45.237088919 CET	192.168.2.5	1.1.1.1	0xc02a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:45.237363100 CET	192.168.2.5	1.1.1.1	0xb09	Standard query (0)	www.google.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:45.301712990 CET	192.168.2.5	1.1.1.1	0x65cc	Standard query (0)	web-vitals.booking.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:45.302686930 CET	192.168.2.5	1.1.1.1	0x57b	Standard query (0)	web-vitals.booking.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:46.093276024 CET	192.168.2.5	1.1.1.1	0x1518	Standard query (0)	web-vitals.booking.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:46.093904972 CET	192.168.2.5	1.1.1.1	0x5282	Standard query (0)	web-vitals.booking.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:46.466974974 CET	192.168.2.5	1.1.1.1	0x1635	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:46.467300892 CET	192.168.2.5	1.1.1.1	0xc6c6	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	65	IN (0x0001)	false
Feb 8, 2024 19:36:48.192256927 CET	192.168.2.5	1.1.1.1	0x2597	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:48.192579031 CET	192.168.2.5	1.1.1.1	0x5c94	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 8, 2024 19:35:26.769942999 CET	1.1.1.1	192.168.2.5	0xad0d	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:26.770277977 CET	1.1.1.1	192.168.2.5	0xbb00	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:26.770277977 CET	1.1.1.1	192.168.2.5	0xbb00	No error (0)	clients.l.google.com		172.217.215.101	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:26.770277977 CET	1.1.1.1	192.168.2.5	0xbb00	No error (0)	clients.l.google.com		172.217.215.139	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:26.770277977 CET	1.1.1.1	192.168.2.5	0xbb00	No error (0)	clients.l.google.com		172.217.215.113	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:26.770277977 CET	1.1.1.1	192.168.2.5	0xbb00	No error (0)	clients.l.google.com		172.217.215.100	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:26.770277977 CET	1.1.1.1	192.168.2.5	0xbb00	No error (0)	clients.l.google.com		172.217.215.138	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:26.770277977 CET	1.1.1.1	192.168.2.5	0xbb00	No error (0)	clients.l.google.com		172.217.215.102	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:26.771614075 CET	1.1.1.1	192.168.2.5	0x36b1	No error (0)	accounts.google.com		142.250.9.84	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:28.580110073 CET	1.1.1.1	192.168.2.5	0x2af0	No error (0)	booking.search-13125.com			65	IN (0x0001)	false
Feb 8, 2024 19:35:28.587836027 CET	1.1.1.1	192.168.2.5	0x6ba4	No error (0)	booking.search-13125.com		104.21.85.210	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:28.587836027 CET	1.1.1.1	192.168.2.5	0x6ba4	No error (0)	booking.search-13125.com		172.67.211.101	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:29.604238033 CET	1.1.1.1	192.168.2.5	0xce18	No error (0)	booking.com		108.138.64.67	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:29.604238033 CET	1.1.1.1	192.168.2.5	0xce18	No error (0)	booking.com		108.138.64.87	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:29.604238033 CET	1.1.1.1	192.168.2.5	0xce18	No error (0)	booking.com		108.138.64.58	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:29.604238033 CET	1.1.1.1	192.168.2.5	0xce18	No error (0)	booking.com		108.138.64.79	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:31.113019943 CET	1.1.1.1	192.168.2.5	0x1151	No error (0)	www.google.com		108.177.122.106	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:31.113019943 CET	1.1.1.1	192.168.2.5	0x1151	No error (0)	www.google.com		108.177.122.103	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:31.113019943 CET	1.1.1.1	192.168.2.5	0x1151	No error (0)	www.google.com		108.177.122.105	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:31.113019943 CET	1.1.1.1	192.168.2.5	0x1151	No error (0)	www.google.com		108.177.122.104	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:31.113019943 CET	1.1.1.1	192.168.2.5	0x1151	No error (0)	www.google.com		108.177.122.147	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:31.113019943 CET	1.1.1.1	192.168.2.5	0x1151	No error (0)	www.google.com		108.177.122.99	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:31.113351107 CET	1.1.1.1	192.168.2.5	0xcee0	No error (0)	www.google.com			65	IN (0x0001)	false
Feb 8, 2024 19:35:31.119146109 CET	1.1.1.1	192.168.2.5	0x22f1	No error (0)	www.booking.com	d1of1hbywxxm65.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:31.119146109 CET	1.1.1.1	192.168.2.5	0x22f1	No error (0)	d1of1hbywxxm65.cloudfront.net		108.138.64.79	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:31.119146109 CET	1.1.1.1	192.168.2.5	0x22f1	No error (0)	d1of1hbywxxm65.cloudfront.net		108.138.64.67	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:31.119146109 CET	1.1.1.1	192.168.2.5	0x22f1	No error (0)	d1of1hbywxxm65.cloudfront.net		108.138.64.58	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:31.119146109 CET	1.1.1.1	192.168.2.5	0x22f1	No error (0)	d1of1hbywxxm65.cloudfront.net		108.138.64.87	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:31.119910955 CET	1.1.1.1	192.168.2.5	0x511b	No error (0)	www.booking.com	d1of1hbywxxm65.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:32.351284027 CET	1.1.1.1	192.168.2.5	0xbddd	No error (0)	shelves.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:32.351284027 CET	1.1.1.1	192.168.2.5	0xbddd	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:32.351284027 CET	1.1.1.1	192.168.2.5	0xbddd	No error (0)	de2trjlt8e8rj.cloudfront.net		3.161.193.71	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:32.351284027 CET	1.1.1.1	192.168.2.5	0xbddd	No error (0)	de2trjlt8e8rj.cloudfront.net		3.161.193.117	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:32.351284027 CET	1.1.1.1	192.168.2.5	0xbddd	No error (0)	de2trjlt8e8rj.cloudfront.net		3.161.193.46	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:32.351284027 CET	1.1.1.1	192.168.2.5	0xbddd	No error (0)	de2trjlt8e8rj.cloudfront.net		3.161.193.103	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:32.351823092 CET	1.1.1.1	192.168.2.5	0x3d36	No error (0)	shelves.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:32.351823092 CET	1.1.1.1	192.168.2.5	0x3d36	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:32.360997915 CET	1.1.1.1	192.168.2.5	0x7b1f	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:32.360997915 CET	1.1.1.1	192.168.2.5	0x7b1f	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.16	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:32.360997915 CET	1.1.1.1	192.168.2.5	0x7b1f	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.25	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:32.360997915 CET	1.1.1.1	192.168.2.5	0x7b1f	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.95	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:32.360997915 CET	1.1.1.1	192.168.2.5	0x7b1f	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.79	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:32.361788988 CET	1.1.1.1	192.168.2.5	0x132a	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:33.037954092 CET	1.1.1.1	192.168.2.5	0xfc42	No error (0)	q-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:33.037954092 CET	1.1.1.1	192.168.2.5	0xfc42	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:33.037954092 CET	1.1.1.1	192.168.2.5	0xfc42	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:33.037954092 CET	1.1.1.1	192.168.2.5	0xfc42	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.64.236.114	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:33.037954092 CET	1.1.1.1	192.168.2.5	0xfc42	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.64.236.100	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:33.037954092 CET	1.1.1.1	192.168.2.5	0xfc42	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.64.236.43	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:33.037954092 CET	1.1.1.1	192.168.2.5	0xfc42	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.64.236.64	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:33.038317919 CET	1.1.1.1	192.168.2.5	0xfe85	No error (0)	q-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:33.038317919 CET	1.1.1.1	192.168.2.5	0xfe85	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:33.038317919 CET	1.1.1.1	192.168.2.5	0xfe85	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:33.636272907 CET	1.1.1.1	192.168.2.5	0xa4b5	No error (0)	q-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:33.636272907 CET	1.1.1.1	192.168.2.5	0xa4b5	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:33.636272907 CET	1.1.1.1	192.168.2.5	0xa4b5	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:33.636272907 CET	1.1.1.1	192.168.2.5	0xa4b5	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.16	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:33.636272907 CET	1.1.1.1	192.168.2.5	0xa4b5	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.79	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:33.636272907 CET	1.1.1.1	192.168.2.5	0xa4b5	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.25	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:33.636272907 CET	1.1.1.1	192.168.2.5	0xa4b5	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.95	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:33.638380051 CET	1.1.1.1	192.168.2.5	0x7a3d	No error (0)	q-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:33.638380051 CET	1.1.1.1	192.168.2.5	0x7a3d	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:33.638380051 CET	1.1.1.1	192.168.2.5	0x7a3d	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:35.392800093 CET	1.1.1.1	192.168.2.5	0xb276	No error (0)	securepubads.g.doubleclick.net	securepubads46.g.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:35.392800093 CET	1.1.1.1	192.168.2.5	0xb276	No error (0)	securepubads46.g.doubleclick.net		142.250.105.155	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:35.392800093 CET	1.1.1.1	192.168.2.5	0xb276	No error (0)	securepubads46.g.doubleclick.net		142.250.105.154	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:35.392800093 CET	1.1.1.1	192.168.2.5	0xb276	No error (0)	securepubads46.g.doubleclick.net		142.250.105.157	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:35.392800093 CET	1.1.1.1	192.168.2.5	0xb276	No error (0)	securepubads46.g.doubleclick.net		142.250.105.156	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:35.392926931 CET	1.1.1.1	192.168.2.5	0x1eca	No error (0)	securepubads.g.doubleclick.net	securepubads46.g.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:35.394974947 CET	1.1.1.1	192.168.2.5	0x4828	No error (0)	cdn.cookielaw.org		104.18.131.236	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:35.394974947 CET	1.1.1.1	192.168.2.5	0x4828	No error (0)	cdn.cookielaw.org		104.18.130.236	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:35.395327091 CET	1.1.1.1	192.168.2.5	0x1102	No error (0)	cdn.cookielaw.org			65	IN (0x0001)	false
Feb 8, 2024 19:35:35.919004917 CET	1.1.1.1	192.168.2.5	0x457c	No error (0)	r-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:35.919004917 CET	1.1.1.1	192.168.2.5	0x457c	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:35.919004917 CET	1.1.1.1	192.168.2.5	0x457c	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:35.919004917 CET	1.1.1.1	192.168.2.5	0x457c	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.238.55.22	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:35.919004917 CET	1.1.1.1	192.168.2.5	0x457c	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.238.55.43	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:35.919004917 CET	1.1.1.1	192.168.2.5	0x457c	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.238.55.108	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:35.919004917 CET	1.1.1.1	192.168.2.5	0x457c	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.238.55.120	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:35.919341087 CET	1.1.1.1	192.168.2.5	0xac7c	No error (0)	r-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:35.919341087 CET	1.1.1.1	192.168.2.5	0xac7c	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:35.919341087 CET	1.1.1.1	192.168.2.5	0xac7c	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:35.928534985 CET	1.1.1.1	192.168.2.5	0x4f69	No error (0)	t-cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:35.928534985 CET	1.1.1.1	192.168.2.5	0x4f69	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.16	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:35.928534985 CET	1.1.1.1	192.168.2.5	0x4f69	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.79	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:35.928534985 CET	1.1.1.1	192.168.2.5	0x4f69	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.25	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:35.928534985 CET	1.1.1.1	192.168.2.5	0x4f69	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.95	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:35.928924084 CET	1.1.1.1	192.168.2.5	0x70b1	No error (0)	t-cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:36.512377977 CET	1.1.1.1	192.168.2.5	0x6046	No error (0)	account.booking.com	du1b3vb35hc0o.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:36.514512062 CET	1.1.1.1	192.168.2.5	0x5b9	No error (0)	account.booking.com	du1b3vb35hc0o.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:36.514512062 CET	1.1.1.1	192.168.2.5	0x5b9	No error (0)	du1b3vb35hc0o.cloudfront.net		13.32.208.75	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:36.514512062 CET	1.1.1.1	192.168.2.5	0x5b9	No error (0)	du1b3vb35hc0o.cloudfront.net		13.32.208.52	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:36.514512062 CET	1.1.1.1	192.168.2.5	0x5b9	No error (0)	du1b3vb35hc0o.cloudfront.net		13.32.208.98	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:36.514512062 CET	1.1.1.1	192.168.2.5	0x5b9	No error (0)	du1b3vb35hc0o.cloudfront.net		13.32.208.58	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:37.927508116 CET	1.1.1.1	192.168.2.5	0xc6e7	No error (0)	accounts.google.com		64.233.177.84	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:38.019488096 CET	1.1.1.1	192.168.2.5	0xedad	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:38.019488096 CET	1.1.1.1	192.168.2.5	0xedad	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.64.236.43	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:38.019488096 CET	1.1.1.1	192.168.2.5	0xedad	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.64.236.100	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:38.019488096 CET	1.1.1.1	192.168.2.5	0xedad	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.64.236.114	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:38.019488096 CET	1.1.1.1	192.168.2.5	0xedad	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.64.236.64	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:38.021110058 CET	1.1.1.1	192.168.2.5	0xa973	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:38.099473953 CET	1.1.1.1	192.168.2.5	0xc886	No error (0)	r-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:38.099473953 CET	1.1.1.1	192.168.2.5	0xc886	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:38.099473953 CET	1.1.1.1	192.168.2.5	0xc886	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:38.099793911 CET	1.1.1.1	192.168.2.5	0xc63b	No error (0)	r-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:38.099793911 CET	1.1.1.1	192.168.2.5	0xc63b	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:38.099793911 CET	1.1.1.1	192.168.2.5	0xc63b	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:38.099793911 CET	1.1.1.1	192.168.2.5	0xc63b	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.95	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:38.099793911 CET	1.1.1.1	192.168.2.5	0xc63b	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.16	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:38.099793911 CET	1.1.1.1	192.168.2.5	0xc63b	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.79	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:38.099793911 CET	1.1.1.1	192.168.2.5	0xc63b	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.25	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:38.258822918 CET	1.1.1.1	192.168.2.5	0xccb1	No error (0)	www.booking.com	d1of1hbywxxm65.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:38.258822918 CET	1.1.1.1	192.168.2.5	0xccb1	No error (0)	d1of1hbywxxm65.cloudfront.net		108.138.64.87	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:38.258822918 CET	1.1.1.1	192.168.2.5	0xccb1	No error (0)	d1of1hbywxxm65.cloudfront.net		108.138.64.67	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:38.258822918 CET	1.1.1.1	192.168.2.5	0xccb1	No error (0)	d1of1hbywxxm65.cloudfront.net		108.138.64.58	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:38.258822918 CET	1.1.1.1	192.168.2.5	0xccb1	No error (0)	d1of1hbywxxm65.cloudfront.net		108.138.64.79	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:38.260154963 CET	1.1.1.1	192.168.2.5	0xf8af	No error (0)	www.booking.com	d1of1hbywxxm65.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:38.506866932 CET	1.1.1.1	192.168.2.5	0x8739	No error (0)	geolocation.onetrust.com		172.64.155.119	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:38.506866932 CET	1.1.1.1	192.168.2.5	0x8739	No error (0)	geolocation.onetrust.com		104.18.32.137	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:38.507884026 CET	1.1.1.1	192.168.2.5	0x96fa	No error (0)	geolocation.onetrust.com			65	IN (0x0001)	false
Feb 8, 2024 19:35:38.508548021 CET	1.1.1.1	192.168.2.5	0xa407	No error (0)	cdn.cookielaw.org			65	IN (0x0001)	false
Feb 8, 2024 19:35:38.508644104 CET	1.1.1.1	192.168.2.5	0x531b	No error (0)	cdn.cookielaw.org		104.18.130.236	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:38.508644104 CET	1.1.1.1	192.168.2.5	0x531b	No error (0)	cdn.cookielaw.org		104.18.131.236	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.196481943 CET	1.1.1.1	192.168.2.5	0x199a	No error (0)	geolocation.onetrust.com		104.18.32.137	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.196481943 CET	1.1.1.1	192.168.2.5	0x199a	No error (0)	geolocation.onetrust.com		172.64.155.119	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.196995020 CET	1.1.1.1	192.168.2.5	0x9a8	No error (0)	geolocation.onetrust.com			65	IN (0x0001)	false
Feb 8, 2024 19:35:39.316967964 CET	1.1.1.1	192.168.2.5	0x276b	No error (0)	account.booking.com	du1b3vb35hc0o.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:39.316967964 CET	1.1.1.1	192.168.2.5	0x276b	No error (0)	du1b3vb35hc0o.cloudfront.net		3.161.150.72	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.316967964 CET	1.1.1.1	192.168.2.5	0x276b	No error (0)	du1b3vb35hc0o.cloudfront.net		3.161.150.89	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.316967964 CET	1.1.1.1	192.168.2.5	0x276b	No error (0)	du1b3vb35hc0o.cloudfront.net		3.161.150.61	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.316967964 CET	1.1.1.1	192.168.2.5	0x276b	No error (0)	du1b3vb35hc0o.cloudfront.net		3.161.150.69	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.316984892 CET	1.1.1.1	192.168.2.5	0x2955	No error (0)	account.booking.com	du1b3vb35hc0o.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:39.354907990 CET	1.1.1.1	192.168.2.5	0x9bb7	No error (0)	stats.g.doubleclick.net		142.250.105.155	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.354907990 CET	1.1.1.1	192.168.2.5	0x9bb7	No error (0)	stats.g.doubleclick.net		142.250.105.154	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.354907990 CET	1.1.1.1	192.168.2.5	0x9bb7	No error (0)	stats.g.doubleclick.net		142.250.105.156	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.354907990 CET	1.1.1.1	192.168.2.5	0x9bb7	No error (0)	stats.g.doubleclick.net		142.250.105.157	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.909416914 CET	1.1.1.1	192.168.2.5	0xe002	No error (0)	stats.g.doubleclick.net		173.194.219.154	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.909416914 CET	1.1.1.1	192.168.2.5	0xe002	No error (0)	stats.g.doubleclick.net		173.194.219.157	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.909416914 CET	1.1.1.1	192.168.2.5	0xe002	No error (0)	stats.g.doubleclick.net		173.194.219.156	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.909416914 CET	1.1.1.1	192.168.2.5	0xe002	No error (0)	stats.g.doubleclick.net		173.194.219.155	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.955693007 CET	1.1.1.1	192.168.2.5	0x681f	No error (0)	www.google.com		74.125.138.147	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.955693007 CET	1.1.1.1	192.168.2.5	0x681f	No error (0)	www.google.com		74.125.138.104	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.955693007 CET	1.1.1.1	192.168.2.5	0x681f	No error (0)	www.google.com		74.125.138.103	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.955693007 CET	1.1.1.1	192.168.2.5	0x681f	No error (0)	www.google.com		74.125.138.99	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.955693007 CET	1.1.1.1	192.168.2.5	0x681f	No error (0)	www.google.com		74.125.138.105	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.955693007 CET	1.1.1.1	192.168.2.5	0x681f	No error (0)	www.google.com		74.125.138.106	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:39.959013939 CET	1.1.1.1	192.168.2.5	0x2f7d	No error (0)	www.google.com			65	IN (0x0001)	false
Feb 8, 2024 19:35:40.222824097 CET	1.1.1.1	192.168.2.5	0xe81e	No error (0)	web-vitals.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:40.222824097 CET	1.1.1.1	192.168.2.5	0xe81e	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:40.222824097 CET	1.1.1.1	192.168.2.5	0xe81e	No error (0)	de2trjlt8e8rj.cloudfront.net		3.161.193.117	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:40.222824097 CET	1.1.1.1	192.168.2.5	0xe81e	No error (0)	de2trjlt8e8rj.cloudfront.net		3.161.193.46	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:40.222824097 CET	1.1.1.1	192.168.2.5	0xe81e	No error (0)	de2trjlt8e8rj.cloudfront.net		3.161.193.103	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:40.222824097 CET	1.1.1.1	192.168.2.5	0xe81e	No error (0)	de2trjlt8e8rj.cloudfront.net		3.161.193.71	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:40.224659920 CET	1.1.1.1	192.168.2.5	0x4dc	No error (0)	web-vitals.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:40.224659920 CET	1.1.1.1	192.168.2.5	0x4dc	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:40.509244919 CET	1.1.1.1	192.168.2.5	0xbc5a	No error (0)	www.google.com		142.250.9.103	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:40.509244919 CET	1.1.1.1	192.168.2.5	0xbc5a	No error (0)	www.google.com		142.250.9.104	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:40.509244919 CET	1.1.1.1	192.168.2.5	0xbc5a	No error (0)	www.google.com		142.250.9.105	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:40.509244919 CET	1.1.1.1	192.168.2.5	0xbc5a	No error (0)	www.google.com		142.250.9.99	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:40.509244919 CET	1.1.1.1	192.168.2.5	0xbc5a	No error (0)	www.google.com		142.250.9.147	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:40.509244919 CET	1.1.1.1	192.168.2.5	0xbc5a	No error (0)	www.google.com		142.250.9.106	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:40.509680986 CET	1.1.1.1	192.168.2.5	0x8e3b	No error (0)	www.google.com			65	IN (0x0001)	false
Feb 8, 2024 19:35:41.458167076 CET	1.1.1.1	192.168.2.5	0xf46c	No error (0)	accommodations.booking.com	d2uxzmvxe6bz7q.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:41.458167076 CET	1.1.1.1	192.168.2.5	0xf46c	No error (0)	d2uxzmvxe6bz7q.cloudfront.net		3.162.125.32	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:41.458167076 CET	1.1.1.1	192.168.2.5	0xf46c	No error (0)	d2uxzmvxe6bz7q.cloudfront.net		3.162.125.73	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:41.458167076 CET	1.1.1.1	192.168.2.5	0xf46c	No error (0)	d2uxzmvxe6bz7q.cloudfront.net		3.162.125.15	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:41.458167076 CET	1.1.1.1	192.168.2.5	0xf46c	No error (0)	d2uxzmvxe6bz7q.cloudfront.net		3.162.125.41	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:41.458379984 CET	1.1.1.1	192.168.2.5	0x4c29	No error (0)	accommodations.booking.com	d2uxzmvxe6bz7q.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:41.670036077 CET	1.1.1.1	192.168.2.5	0xcdb9	No error (0)	web-vitals.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:41.670036077 CET	1.1.1.1	192.168.2.5	0xcdb9	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:41.670036077 CET	1.1.1.1	192.168.2.5	0xcdb9	No error (0)	de2trjlt8e8rj.cloudfront.net		3.161.193.117	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:41.670036077 CET	1.1.1.1	192.168.2.5	0xcdb9	No error (0)	de2trjlt8e8rj.cloudfront.net		3.161.193.71	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:41.670036077 CET	1.1.1.1	192.168.2.5	0xcdb9	No error (0)	de2trjlt8e8rj.cloudfront.net		3.161.193.103	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:41.670036077 CET	1.1.1.1	192.168.2.5	0xcdb9	No error (0)	de2trjlt8e8rj.cloudfront.net		3.161.193.46	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:41.675117970 CET	1.1.1.1	192.168.2.5	0xc883	No error (0)	web-vitals.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:41.675117970 CET	1.1.1.1	192.168.2.5	0xc883	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:42.053581953 CET	1.1.1.1	192.168.2.5	0xaedc	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:42.053581953 CET	1.1.1.1	192.168.2.5	0xaedc	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:43.391683102 CET	1.1.1.1	192.168.2.5	0xebd9	No error (0)	accommodations.booking.com	d2uxzmvxe6bz7q.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:43.391683102 CET	1.1.1.1	192.168.2.5	0xebd9	No error (0)	d2uxzmvxe6bz7q.cloudfront.net		3.162.125.41	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:43.391683102 CET	1.1.1.1	192.168.2.5	0xebd9	No error (0)	d2uxzmvxe6bz7q.cloudfront.net		3.162.125.15	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:43.391683102 CET	1.1.1.1	192.168.2.5	0xebd9	No error (0)	d2uxzmvxe6bz7q.cloudfront.net		3.162.125.73	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:43.391683102 CET	1.1.1.1	192.168.2.5	0xebd9	No error (0)	d2uxzmvxe6bz7q.cloudfront.net		3.162.125.32	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:43.393373966 CET	1.1.1.1	192.168.2.5	0x4fce	No error (0)	accommodations.booking.com	d2uxzmvxe6bz7q.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:43.883186102 CET	1.1.1.1	192.168.2.5	0x628e	No error (0)	google.com		142.250.9.100	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:43.883186102 CET	1.1.1.1	192.168.2.5	0x628e	No error (0)	google.com		142.250.9.113	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:43.883186102 CET	1.1.1.1	192.168.2.5	0x628e	No error (0)	google.com		142.250.9.139	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:43.883186102 CET	1.1.1.1	192.168.2.5	0x628e	No error (0)	google.com		142.250.9.101	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:43.883186102 CET	1.1.1.1	192.168.2.5	0x628e	No error (0)	google.com		142.250.9.102	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:43.883186102 CET	1.1.1.1	192.168.2.5	0x628e	No error (0)	google.com		142.250.9.138	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:43.883635044 CET	1.1.1.1	192.168.2.5	0x9c82	No error (0)	google.com			65	IN (0x0001)	false
Feb 8, 2024 19:35:43.884089947 CET	1.1.1.1	192.168.2.5	0x4e63	No error (0)	accounts.google.com		142.250.9.84	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.313251972 CET	1.1.1.1	192.168.2.5	0x1a86	No error (0)	www3.doubleclick.net		64.233.185.138	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.313251972 CET	1.1.1.1	192.168.2.5	0x1a86	No error (0)	www3.doubleclick.net		64.233.185.113	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.313251972 CET	1.1.1.1	192.168.2.5	0x1a86	No error (0)	www3.doubleclick.net		64.233.185.100	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.313251972 CET	1.1.1.1	192.168.2.5	0x1a86	No error (0)	www3.doubleclick.net		64.233.185.101	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.313251972 CET	1.1.1.1	192.168.2.5	0x1a86	No error (0)	www3.doubleclick.net		64.233.185.139	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.313251972 CET	1.1.1.1	192.168.2.5	0x1a86	No error (0)	www3.doubleclick.net		64.233.185.102	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.506752014 CET	1.1.1.1	192.168.2.5	0x2a45	No error (0)	www.google.com		142.250.105.105	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.506752014 CET	1.1.1.1	192.168.2.5	0x2a45	No error (0)	www.google.com		142.250.105.99	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.506752014 CET	1.1.1.1	192.168.2.5	0x2a45	No error (0)	www.google.com		142.250.105.103	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.506752014 CET	1.1.1.1	192.168.2.5	0x2a45	No error (0)	www.google.com		142.250.105.147	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.506752014 CET	1.1.1.1	192.168.2.5	0x2a45	No error (0)	www.google.com		142.250.105.106	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.506752014 CET	1.1.1.1	192.168.2.5	0x2a45	No error (0)	www.google.com		142.250.105.104	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.507299900 CET	1.1.1.1	192.168.2.5	0x5eef	No error (0)	www.google.com			65	IN (0x0001)	false
Feb 8, 2024 19:35:44.642098904 CET	1.1.1.1	192.168.2.5	0x9aa8	No error (0)	securepubads.g.doubleclick.net	securepubads46.g.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:44.642098904 CET	1.1.1.1	192.168.2.5	0x9aa8	No error (0)	securepubads46.g.doubleclick.net		74.125.138.157	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.642098904 CET	1.1.1.1	192.168.2.5	0x9aa8	No error (0)	securepubads46.g.doubleclick.net		74.125.138.154	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.642098904 CET	1.1.1.1	192.168.2.5	0x9aa8	No error (0)	securepubads46.g.doubleclick.net		74.125.138.155	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.642098904 CET	1.1.1.1	192.168.2.5	0x9aa8	No error (0)	securepubads46.g.doubleclick.net		74.125.138.156	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.643250942 CET	1.1.1.1	192.168.2.5	0xbbef	No error (0)	securepubads.g.doubleclick.net	securepubads46.g.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:44.657124996 CET	1.1.1.1	192.168.2.5	0x92a4	No error (0)	pagead-googlehosted.l.google.com		74.125.136.132	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.666081905 CET	1.1.1.1	192.168.2.5	0x5b2	No error (0)	d8c14d4960ca.edge.sdk.awswaf.com		18.165.98.45	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.666081905 CET	1.1.1.1	192.168.2.5	0x5b2	No error (0)	d8c14d4960ca.edge.sdk.awswaf.com		18.165.98.119	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.666081905 CET	1.1.1.1	192.168.2.5	0x5b2	No error (0)	d8c14d4960ca.edge.sdk.awswaf.com		18.165.98.20	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.666081905 CET	1.1.1.1	192.168.2.5	0x5b2	No error (0)	d8c14d4960ca.edge.sdk.awswaf.com		18.165.98.114	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.899094105 CET	1.1.1.1	192.168.2.5	0xf4cb	No error (0)	marketingplatform.google.com		172.217.215.102	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.899094105 CET	1.1.1.1	192.168.2.5	0xf4cb	No error (0)	marketingplatform.google.com		172.217.215.101	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.899094105 CET	1.1.1.1	192.168.2.5	0xf4cb	No error (0)	marketingplatform.google.com		172.217.215.100	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.899094105 CET	1.1.1.1	192.168.2.5	0xf4cb	No error (0)	marketingplatform.google.com		172.217.215.138	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.899094105 CET	1.1.1.1	192.168.2.5	0xf4cb	No error (0)	marketingplatform.google.com		172.217.215.139	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:44.899094105 CET	1.1.1.1	192.168.2.5	0xf4cb	No error (0)	marketingplatform.google.com		172.217.215.113	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.155133963 CET	1.1.1.1	192.168.2.5	0xbc66	No error (0)	sc-static.net		108.139.23.251	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.156980991 CET	1.1.1.1	192.168.2.5	0xfccd	No error (0)	s.pinimg.com	s-pinimg-com.gslb.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:45.156980991 CET	1.1.1.1	192.168.2.5	0xfccd	No error (0)	s-pinimg-com.gslb.pinterest.com	2-01-37d2-0020.cdx.cedexis.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:45.156980991 CET	1.1.1.1	192.168.2.5	0xfccd	No error (0)	dualstack.pinterest.map.fastly.net		151.101.12.84	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.157347918 CET	1.1.1.1	192.168.2.5	0x6706	No error (0)	s.pinimg.com	s-pinimg-com.gslb.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:45.157347918 CET	1.1.1.1	192.168.2.5	0x6706	No error (0)	s-pinimg-com.gslb.pinterest.com	2-01-37d2-0020.cdx.cedexis.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:45.190958023 CET	1.1.1.1	192.168.2.5	0xf867	No error (0)	td.doubleclick.net		142.251.15.156	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.190958023 CET	1.1.1.1	192.168.2.5	0xf867	No error (0)	td.doubleclick.net		142.251.15.157	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.190958023 CET	1.1.1.1	192.168.2.5	0xf867	No error (0)	td.doubleclick.net		142.251.15.155	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.190958023 CET	1.1.1.1	192.168.2.5	0xf867	No error (0)	td.doubleclick.net		142.251.15.154	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.353293896 CET	1.1.1.1	192.168.2.5	0x8c76	No error (0)	googleads.g.doubleclick.net			65	IN (0x0001)	false
Feb 8, 2024 19:35:45.353307009 CET	1.1.1.1	192.168.2.5	0xc7a2	No error (0)	googleads.g.doubleclick.net		74.125.138.155	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.353307009 CET	1.1.1.1	192.168.2.5	0xc7a2	No error (0)	googleads.g.doubleclick.net		74.125.138.154	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.353307009 CET	1.1.1.1	192.168.2.5	0xc7a2	No error (0)	googleads.g.doubleclick.net		74.125.138.157	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.353307009 CET	1.1.1.1	192.168.2.5	0xc7a2	No error (0)	googleads.g.doubleclick.net		74.125.138.156	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.463673115 CET	1.1.1.1	192.168.2.5	0x915c	No error (0)	s.yimg.jp	edge12.g.yimg.jp		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:45.463673115 CET	1.1.1.1	192.168.2.5	0x915c	No error (0)	edge12.g.yimg.jp		182.22.24.252	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.464004993 CET	1.1.1.1	192.168.2.5	0xce42	No error (0)	s.yimg.jp	edge12.g.yimg.jp		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:45.563554049 CET	1.1.1.1	192.168.2.5	0xef2	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		18.67.65.55	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.563554049 CET	1.1.1.1	192.168.2.5	0xef2	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		18.67.65.7	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.563554049 CET	1.1.1.1	192.168.2.5	0xef2	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		18.67.65.100	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.563554049 CET	1.1.1.1	192.168.2.5	0xef2	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		18.67.65.124	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.810041904 CET	1.1.1.1	192.168.2.5	0xe823	No error (0)	ad.doubleclick.net		172.253.124.149	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.810041904 CET	1.1.1.1	192.168.2.5	0xe823	No error (0)	ad.doubleclick.net		172.253.124.148	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:45.810648918 CET	1.1.1.1	192.168.2.5	0x61eb	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Feb 8, 2024 19:35:46.054538012 CET	1.1.1.1	192.168.2.5	0xe4cb	No error (0)	tr.snapchat.com	gcp.api.snapchat.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:46.054538012 CET	1.1.1.1	192.168.2.5	0xe4cb	No error (0)	gcp.api.snapchat.com	gcp.api.sc-gw.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:46.054538012 CET	1.1.1.1	192.168.2.5	0xe4cb	No error (0)	gcp.api.sc-gw.com		35.190.43.134	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:46.054971933 CET	1.1.1.1	192.168.2.5	0x70a0	No error (0)	tr.snapchat.com	gcp.api.snapchat.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:46.054971933 CET	1.1.1.1	192.168.2.5	0x70a0	No error (0)	gcp.api.snapchat.com	gcp.api.sc-gw.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:46.380482912 CET	1.1.1.1	192.168.2.5	0xba63	No error (0)	gtm-mktg.booking.com		216.239.38.21	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:46.380482912 CET	1.1.1.1	192.168.2.5	0xba63	No error (0)	gtm-mktg.booking.com		216.239.36.21	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:46.380482912 CET	1.1.1.1	192.168.2.5	0xba63	No error (0)	gtm-mktg.booking.com		216.239.32.21	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:46.380482912 CET	1.1.1.1	192.168.2.5	0xba63	No error (0)	gtm-mktg.booking.com		216.239.34.21	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:46.476109982 CET	1.1.1.1	192.168.2.5	0xf4ee	No error (0)	www.google.com		64.233.177.99	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:46.476109982 CET	1.1.1.1	192.168.2.5	0xf4ee	No error (0)	www.google.com		64.233.177.147	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:46.476109982 CET	1.1.1.1	192.168.2.5	0xf4ee	No error (0)	www.google.com		64.233.177.106	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:46.476109982 CET	1.1.1.1	192.168.2.5	0xf4ee	No error (0)	www.google.com		64.233.177.105	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:46.476109982 CET	1.1.1.1	192.168.2.5	0xf4ee	No error (0)	www.google.com		64.233.177.103	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:46.476109982 CET	1.1.1.1	192.168.2.5	0xf4ee	No error (0)	www.google.com		64.233.177.104	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:46.478585005 CET	1.1.1.1	192.168.2.5	0x7507	No error (0)	www.google.com			65	IN (0x0001)	false
Feb 8, 2024 19:35:46.498121977 CET	1.1.1.1	192.168.2.5	0xad53	No error (0)	ad.doubleclick.net		108.177.122.148	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:46.498121977 CET	1.1.1.1	192.168.2.5	0xad53	No error (0)	ad.doubleclick.net		108.177.122.149	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:46.498662949 CET	1.1.1.1	192.168.2.5	0x1245	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Feb 8, 2024 19:35:47.099751949 CET	1.1.1.1	192.168.2.5	0x8238	No error (0)	adservice.google.com		64.233.177.157	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.099751949 CET	1.1.1.1	192.168.2.5	0x8238	No error (0)	adservice.google.com		64.233.177.156	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.099751949 CET	1.1.1.1	192.168.2.5	0x8238	No error (0)	adservice.google.com		64.233.177.155	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.099751949 CET	1.1.1.1	192.168.2.5	0x8238	No error (0)	adservice.google.com		64.233.177.154	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.100528955 CET	1.1.1.1	192.168.2.5	0xc924	No error (0)	adservice.google.com			65	IN (0x0001)	false
Feb 8, 2024 19:35:47.428421021 CET	1.1.1.1	192.168.2.5	0xfb9	No error (0)	securepubads.g.doubleclick.net	securepubads46.g.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:47.428610086 CET	1.1.1.1	192.168.2.5	0xf313	No error (0)	securepubads.g.doubleclick.net	securepubads46.g.doubleclick.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:47.428610086 CET	1.1.1.1	192.168.2.5	0xf313	No error (0)	securepubads46.g.doubleclick.net		142.250.105.155	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.428610086 CET	1.1.1.1	192.168.2.5	0xf313	No error (0)	securepubads46.g.doubleclick.net		142.250.105.157	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.428610086 CET	1.1.1.1	192.168.2.5	0xf313	No error (0)	securepubads46.g.doubleclick.net		142.250.105.156	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.428610086 CET	1.1.1.1	192.168.2.5	0xf313	No error (0)	securepubads46.g.doubleclick.net		142.250.105.154	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.429575920 CET	1.1.1.1	192.168.2.5	0x6e13	No error (0)	t-cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:47.429575920 CET	1.1.1.1	192.168.2.5	0x6e13	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.95	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.429575920 CET	1.1.1.1	192.168.2.5	0x6e13	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.16	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.429575920 CET	1.1.1.1	192.168.2.5	0x6e13	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.25	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.429575920 CET	1.1.1.1	192.168.2.5	0x6e13	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.79	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.431123018 CET	1.1.1.1	192.168.2.5	0xab5	No error (0)	t-cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:47.448764086 CET	1.1.1.1	192.168.2.5	0xd229	No error (0)	marketingplatform.google.com		74.125.136.138	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.448764086 CET	1.1.1.1	192.168.2.5	0xd229	No error (0)	marketingplatform.google.com		74.125.136.100	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.448764086 CET	1.1.1.1	192.168.2.5	0xd229	No error (0)	marketingplatform.google.com		74.125.136.101	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.448764086 CET	1.1.1.1	192.168.2.5	0xd229	No error (0)	marketingplatform.google.com		74.125.136.102	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.448764086 CET	1.1.1.1	192.168.2.5	0xd229	No error (0)	marketingplatform.google.com		74.125.136.139	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.448764086 CET	1.1.1.1	192.168.2.5	0xd229	No error (0)	marketingplatform.google.com		74.125.136.113	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.459142923 CET	1.1.1.1	192.168.2.5	0x917e	No error (0)	tr.snapchat.com	gcp.api.snapchat.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:47.459142923 CET	1.1.1.1	192.168.2.5	0x917e	No error (0)	gcp.api.snapchat.com	gcp.api.sc-gw.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:47.459142923 CET	1.1.1.1	192.168.2.5	0x917e	No error (0)	gcp.api.sc-gw.com		35.190.43.134	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.459860086 CET	1.1.1.1	192.168.2.5	0x5280	No error (0)	tr.snapchat.com	gcp.api.snapchat.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:47.459860086 CET	1.1.1.1	192.168.2.5	0x5280	No error (0)	gcp.api.snapchat.com	gcp.api.sc-gw.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:47.467806101 CET	1.1.1.1	192.168.2.5	0xed26	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Feb 8, 2024 19:35:47.468033075 CET	1.1.1.1	192.168.2.5	0x5c6e	No error (0)	ad.doubleclick.net		108.177.122.148	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.468033075 CET	1.1.1.1	192.168.2.5	0x5c6e	No error (0)	ad.doubleclick.net		108.177.122.149	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.514614105 CET	1.1.1.1	192.168.2.5	0x1125	No error (0)	gtm-mktg.booking.com		216.239.32.21	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.514614105 CET	1.1.1.1	192.168.2.5	0x1125	No error (0)	gtm-mktg.booking.com		216.239.34.21	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.514614105 CET	1.1.1.1	192.168.2.5	0x1125	No error (0)	gtm-mktg.booking.com		216.239.38.21	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.514614105 CET	1.1.1.1	192.168.2.5	0x1125	No error (0)	gtm-mktg.booking.com		216.239.36.21	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.732727051 CET	1.1.1.1	192.168.2.5	0x96b	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		18.67.65.100	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.732727051 CET	1.1.1.1	192.168.2.5	0x96b	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		18.67.65.55	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.732727051 CET	1.1.1.1	192.168.2.5	0x96b	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		18.67.65.124	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.732727051 CET	1.1.1.1	192.168.2.5	0x96b	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		18.67.65.7	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.783786058 CET	1.1.1.1	192.168.2.5	0xf5cb	No error (0)	adservice.google.com		142.251.15.154	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.783786058 CET	1.1.1.1	192.168.2.5	0xf5cb	No error (0)	adservice.google.com		142.251.15.155	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.783786058 CET	1.1.1.1	192.168.2.5	0xf5cb	No error (0)	adservice.google.com		142.251.15.157	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.783786058 CET	1.1.1.1	192.168.2.5	0xf5cb	No error (0)	adservice.google.com		142.251.15.156	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.784215927 CET	1.1.1.1	192.168.2.5	0x1aa6	No error (0)	adservice.google.com			65	IN (0x0001)	false
Feb 8, 2024 19:35:47.829190016 CET	1.1.1.1	192.168.2.5	0xa560	No error (0)	ct.pinterest.com	www.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:47.829190016 CET	1.1.1.1	192.168.2.5	0xa560	No error (0)	www.pinterest.com	www-pinterest-com.gslb.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:47.829190016 CET	1.1.1.1	192.168.2.5	0xa560	No error (0)	www-pinterest-com.gslb.pinterest.com	2-01-37d2-0018.cdx.cedexis.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:47.829190016 CET	1.1.1.1	192.168.2.5	0xa560	No error (0)	prod.pinterest.global.map.fastly.net		151.101.128.84	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.829190016 CET	1.1.1.1	192.168.2.5	0xa560	No error (0)	prod.pinterest.global.map.fastly.net		151.101.0.84	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.829190016 CET	1.1.1.1	192.168.2.5	0xa560	No error (0)	prod.pinterest.global.map.fastly.net		151.101.192.84	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.829190016 CET	1.1.1.1	192.168.2.5	0xa560	No error (0)	prod.pinterest.global.map.fastly.net		151.101.64.84	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:47.829207897 CET	1.1.1.1	192.168.2.5	0xc267	No error (0)	ct.pinterest.com	www.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:47.829207897 CET	1.1.1.1	192.168.2.5	0xc267	No error (0)	www.pinterest.com	www-pinterest-com.gslb.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:47.829207897 CET	1.1.1.1	192.168.2.5	0xc267	No error (0)	www-pinterest-com.gslb.pinterest.com	2-01-37d2-0018.cdx.cedexis.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:48.135459900 CET	1.1.1.1	192.168.2.5	0x5150	No error (0)	tr.snapchat.com	gcp.api.snapchat.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:48.135459900 CET	1.1.1.1	192.168.2.5	0x5150	No error (0)	gcp.api.snapchat.com	gcp.api.sc-gw.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:48.135459900 CET	1.1.1.1	192.168.2.5	0x5150	No error (0)	gcp.api.sc-gw.com		35.190.43.134	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:48.135571003 CET	1.1.1.1	192.168.2.5	0xe607	No error (0)	tr.snapchat.com	gcp.api.snapchat.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:48.135571003 CET	1.1.1.1	192.168.2.5	0xe607	No error (0)	gcp.api.snapchat.com	gcp.api.sc-gw.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:48.493483067 CET	1.1.1.1	192.168.2.5	0x9391	No error (0)	ct.pinterest.com	www.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:48.493483067 CET	1.1.1.1	192.168.2.5	0x9391	No error (0)	www.pinterest.com	www-pinterest-com.gslb.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:48.493483067 CET	1.1.1.1	192.168.2.5	0x9391	No error (0)	www-pinterest-com.gslb.pinterest.com	2-01-37d2-0018.cdx.cedexis.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:48.493483067 CET	1.1.1.1	192.168.2.5	0x9391	No error (0)	prod.pinterest.global.map.fastly.net		151.101.192.84	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:48.493483067 CET	1.1.1.1	192.168.2.5	0x9391	No error (0)	prod.pinterest.global.map.fastly.net		151.101.64.84	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:48.493483067 CET	1.1.1.1	192.168.2.5	0x9391	No error (0)	prod.pinterest.global.map.fastly.net		151.101.0.84	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:48.493483067 CET	1.1.1.1	192.168.2.5	0x9391	No error (0)	prod.pinterest.global.map.fastly.net		151.101.128.84	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:48.493895054 CET	1.1.1.1	192.168.2.5	0x6b47	No error (0)	ct.pinterest.com	www.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:48.493895054 CET	1.1.1.1	192.168.2.5	0x6b47	No error (0)	www.pinterest.com	www-pinterest-com.gslb.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:48.493895054 CET	1.1.1.1	192.168.2.5	0x6b47	No error (0)	www-pinterest-com.gslb.pinterest.com	2-01-37d2-0018.cdx.cedexis.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:48.640711069 CET	1.1.1.1	192.168.2.5	0x91bd	No error (0)	analytics.google.com	analytics-alv.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:48.640711069 CET	1.1.1.1	192.168.2.5	0x91bd	No error (0)	analytics-alv.google.com		216.239.34.181	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:48.640711069 CET	1.1.1.1	192.168.2.5	0x91bd	No error (0)	analytics-alv.google.com		216.239.36.181	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:48.640711069 CET	1.1.1.1	192.168.2.5	0x91bd	No error (0)	analytics-alv.google.com		216.239.32.181	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:48.640711069 CET	1.1.1.1	192.168.2.5	0x91bd	No error (0)	analytics-alv.google.com		216.239.38.181	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:48.741972923 CET	1.1.1.1	192.168.2.5	0xe69a	No error (0)	tr6.snapchat.com	usc1-gcp-v61.api.sc-gw.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:48.741972923 CET	1.1.1.1	192.168.2.5	0xe69a	No error (0)	usc1-gcp-v61.api.sc-gw.com		35.190.43.134	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:48.744327068 CET	1.1.1.1	192.168.2.5	0xfdf3	No error (0)	tr6.snapchat.com	usc1-gcp-v61.api.sc-gw.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:48.822861910 CET	1.1.1.1	192.168.2.5	0x902e	No error (0)	ct.pinterest.com	www.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:48.822861910 CET	1.1.1.1	192.168.2.5	0x902e	No error (0)	www.pinterest.com	www-pinterest-com.gslb.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:48.822861910 CET	1.1.1.1	192.168.2.5	0x902e	No error (0)	www-pinterest-com.gslb.pinterest.com	2-01-37d2-0018.cdx.cedexis.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:48.822861910 CET	1.1.1.1	192.168.2.5	0x902e	No error (0)	prod.pinterest.global.map.fastly.net		151.101.192.84	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:48.822861910 CET	1.1.1.1	192.168.2.5	0x902e	No error (0)	prod.pinterest.global.map.fastly.net		151.101.64.84	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:48.822861910 CET	1.1.1.1	192.168.2.5	0x902e	No error (0)	prod.pinterest.global.map.fastly.net		151.101.128.84	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:48.822861910 CET	1.1.1.1	192.168.2.5	0x902e	No error (0)	prod.pinterest.global.map.fastly.net		151.101.0.84	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:48.822880030 CET	1.1.1.1	192.168.2.5	0x8e2b	No error (0)	ct.pinterest.com	www.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:48.822880030 CET	1.1.1.1	192.168.2.5	0x8e2b	No error (0)	www.pinterest.com	www-pinterest-com.gslb.pinterest.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:48.822880030 CET	1.1.1.1	192.168.2.5	0x8e2b	No error (0)	www-pinterest-com.gslb.pinterest.com	2-01-37d2-0018.cdx.cedexis.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:49.302891016 CET	1.1.1.1	192.168.2.5	0xdb2b	No error (0)	web-perf.booking.com	d32jgtbwout526.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:49.302891016 CET	1.1.1.1	192.168.2.5	0xdb2b	No error (0)	d32jgtbwout526.cloudfront.net		216.137.45.32	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:49.302891016 CET	1.1.1.1	192.168.2.5	0xdb2b	No error (0)	d32jgtbwout526.cloudfront.net		216.137.45.59	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:49.302891016 CET	1.1.1.1	192.168.2.5	0xdb2b	No error (0)	d32jgtbwout526.cloudfront.net		216.137.45.111	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:49.302891016 CET	1.1.1.1	192.168.2.5	0xdb2b	No error (0)	d32jgtbwout526.cloudfront.net		216.137.45.77	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:49.303847075 CET	1.1.1.1	192.168.2.5	0x5098	No error (0)	web-perf.booking.com	d32jgtbwout526.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:55.826353073 CET	1.1.1.1	192.168.2.5	0x96b2	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:55.826353073 CET	1.1.1.1	192.168.2.5	0x96b2	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:56.847774982 CET	1.1.1.1	192.168.2.5	0x4f02	No error (0)	google.com		172.217.215.139	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:56.847774982 CET	1.1.1.1	192.168.2.5	0x4f02	No error (0)	google.com		172.217.215.113	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:56.847774982 CET	1.1.1.1	192.168.2.5	0x4f02	No error (0)	google.com		172.217.215.100	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:56.847774982 CET	1.1.1.1	192.168.2.5	0x4f02	No error (0)	google.com		172.217.215.138	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:56.847774982 CET	1.1.1.1	192.168.2.5	0x4f02	No error (0)	google.com		172.217.215.101	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:56.847774982 CET	1.1.1.1	192.168.2.5	0x4f02	No error (0)	google.com		172.217.215.102	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:56.848813057 CET	1.1.1.1	192.168.2.5	0x9dee	No error (0)	google.com			65	IN (0x0001)	false
Feb 8, 2024 19:35:56.849872112 CET	1.1.1.1	192.168.2.5	0x5c0d	No error (0)	accounts.google.com		142.250.9.84	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:57.532263994 CET	1.1.1.1	192.168.2.5	0xc489	No error (0)	www.google.com		64.233.185.99	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:57.532263994 CET	1.1.1.1	192.168.2.5	0xc489	No error (0)	www.google.com		64.233.185.147	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:57.532263994 CET	1.1.1.1	192.168.2.5	0xc489	No error (0)	www.google.com		64.233.185.106	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:57.532263994 CET	1.1.1.1	192.168.2.5	0xc489	No error (0)	www.google.com		64.233.185.103	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:57.532263994 CET	1.1.1.1	192.168.2.5	0xc489	No error (0)	www.google.com		64.233.185.104	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:57.532263994 CET	1.1.1.1	192.168.2.5	0xc489	No error (0)	www.google.com		64.233.185.105	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:57.535516024 CET	1.1.1.1	192.168.2.5	0x5050	No error (0)	www.google.com			65	IN (0x0001)	false
Feb 8, 2024 19:35:57.784707069 CET	1.1.1.1	192.168.2.5	0x142a	No error (0)	nellie.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:57.784707069 CET	1.1.1.1	192.168.2.5	0x142a	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:57.785283089 CET	1.1.1.1	192.168.2.5	0x367b	No error (0)	nellie.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:57.785283089 CET	1.1.1.1	192.168.2.5	0x367b	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:35:57.785283089 CET	1.1.1.1	192.168.2.5	0x367b	No error (0)	de2trjlt8e8rj.cloudfront.net		3.161.193.117	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:57.785283089 CET	1.1.1.1	192.168.2.5	0x367b	No error (0)	de2trjlt8e8rj.cloudfront.net		3.161.193.71	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:57.785283089 CET	1.1.1.1	192.168.2.5	0x367b	No error (0)	de2trjlt8e8rj.cloudfront.net		3.161.193.103	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:57.785283089 CET	1.1.1.1	192.168.2.5	0x367b	No error (0)	de2trjlt8e8rj.cloudfront.net		3.161.193.46	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:58.491552114 CET	1.1.1.1	192.168.2.5	0x7960	No error (0)	pagead-googlehosted.l.google.com		172.253.124.132	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:58.824084044 CET	1.1.1.1	192.168.2.5	0xd293	No error (0)	ad.doubleclick.net		64.233.185.148	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:58.824084044 CET	1.1.1.1	192.168.2.5	0xd293	No error (0)	ad.doubleclick.net		64.233.185.149	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:35:58.825323105 CET	1.1.1.1	192.168.2.5	0xae3b	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Feb 8, 2024 19:36:11.190001011 CET	1.1.1.1	192.168.2.5	0xd2b9	No error (0)	google.com		172.217.215.101	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:11.190001011 CET	1.1.1.1	192.168.2.5	0xd2b9	No error (0)	google.com		172.217.215.100	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:11.190001011 CET	1.1.1.1	192.168.2.5	0xd2b9	No error (0)	google.com		172.217.215.102	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:11.190001011 CET	1.1.1.1	192.168.2.5	0xd2b9	No error (0)	google.com		172.217.215.138	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:11.190001011 CET	1.1.1.1	192.168.2.5	0xd2b9	No error (0)	google.com		172.217.215.113	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:11.190001011 CET	1.1.1.1	192.168.2.5	0xd2b9	No error (0)	google.com		172.217.215.139	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:11.190596104 CET	1.1.1.1	192.168.2.5	0x983c	No error (0)	google.com			65	IN (0x0001)	false
Feb 8, 2024 19:36:11.191159010 CET	1.1.1.1	192.168.2.5	0x4d83	No error (0)	accounts.google.com		172.217.215.84	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:11.763209105 CET	1.1.1.1	192.168.2.5	0x5f7a	No error (0)	www.google.com		64.233.185.104	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:11.763209105 CET	1.1.1.1	192.168.2.5	0x5f7a	No error (0)	www.google.com		64.233.185.147	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:11.763209105 CET	1.1.1.1	192.168.2.5	0x5f7a	No error (0)	www.google.com		64.233.185.103	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:11.763209105 CET	1.1.1.1	192.168.2.5	0x5f7a	No error (0)	www.google.com		64.233.185.106	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:11.763209105 CET	1.1.1.1	192.168.2.5	0x5f7a	No error (0)	www.google.com		64.233.185.105	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:11.763209105 CET	1.1.1.1	192.168.2.5	0x5f7a	No error (0)	www.google.com		64.233.185.99	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:11.763695002 CET	1.1.1.1	192.168.2.5	0xc387	No error (0)	www.google.com			65	IN (0x0001)	false
Feb 8, 2024 19:36:11.983555079 CET	1.1.1.1	192.168.2.5	0x2f7f	No error (0)	ad.doubleclick.net		64.233.177.148	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:11.983555079 CET	1.1.1.1	192.168.2.5	0x2f7f	No error (0)	ad.doubleclick.net		64.233.177.149	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:11.984051943 CET	1.1.1.1	192.168.2.5	0x5f27	No error (0)	ad.doubleclick.net			65	IN (0x0001)	false
Feb 8, 2024 19:36:13.266434908 CET	1.1.1.1	192.168.2.5	0x77c8	No error (0)	pagead-googlehosted.l.google.com		142.250.9.132	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:14.134010077 CET	1.1.1.1	192.168.2.5	0xcfb	No error (0)	www.googletagservices.com		172.253.124.155	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:14.134010077 CET	1.1.1.1	192.168.2.5	0xcfb	No error (0)	www.googletagservices.com		172.253.124.156	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:14.134010077 CET	1.1.1.1	192.168.2.5	0xcfb	No error (0)	www.googletagservices.com		172.253.124.154	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:14.134010077 CET	1.1.1.1	192.168.2.5	0xcfb	No error (0)	www.googletagservices.com		172.253.124.157	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:14.135345936 CET	1.1.1.1	192.168.2.5	0xbf85	No error (0)	z.moatads.com	wildcard.moatads.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:14.135760069 CET	1.1.1.1	192.168.2.5	0x15e7	No error (0)	z.moatads.com	wildcard.moatads.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:18.485037088 CET	1.1.1.1	192.168.2.5	0x713e	No error (0)	www.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:18.485037088 CET	1.1.1.1	192.168.2.5	0x713e	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:18.487673044 CET	1.1.1.1	192.168.2.5	0x50b7	No error (0)	www.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:18.487673044 CET	1.1.1.1	192.168.2.5	0x50b7	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:18.487673044 CET	1.1.1.1	192.168.2.5	0x50b7	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.64.236.100	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:18.487673044 CET	1.1.1.1	192.168.2.5	0x50b7	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.64.236.114	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:18.487673044 CET	1.1.1.1	192.168.2.5	0x50b7	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.64.236.43	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:18.487673044 CET	1.1.1.1	192.168.2.5	0x50b7	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.64.236.64	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:19.535126925 CET	1.1.1.1	192.168.2.5	0xd4aa	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:19.535126925 CET	1.1.1.1	192.168.2.5	0xd4aa	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:22.980755091 CET	1.1.1.1	192.168.2.5	0x7ee7	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:22.980755091 CET	1.1.1.1	192.168.2.5	0x7ee7	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:22.980755091 CET	1.1.1.1	192.168.2.5	0x7ee7	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.95	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:22.980755091 CET	1.1.1.1	192.168.2.5	0x7ee7	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.79	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:22.980755091 CET	1.1.1.1	192.168.2.5	0x7ee7	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.25	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:22.980755091 CET	1.1.1.1	192.168.2.5	0x7ee7	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.16	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:22.981595039 CET	1.1.1.1	192.168.2.5	0x1da0	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:22.981595039 CET	1.1.1.1	192.168.2.5	0x1da0	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:22.982672930 CET	1.1.1.1	192.168.2.5	0xc211	No error (0)	r.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:22.982672930 CET	1.1.1.1	192.168.2.5	0xc211	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:22.982672930 CET	1.1.1.1	192.168.2.5	0xc211	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:22.983627081 CET	1.1.1.1	192.168.2.5	0x4575	No error (0)	r.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:22.983627081 CET	1.1.1.1	192.168.2.5	0x4575	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:22.983627081 CET	1.1.1.1	192.168.2.5	0x4575	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:22.983627081 CET	1.1.1.1	192.168.2.5	0x4575	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.79	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:22.983627081 CET	1.1.1.1	192.168.2.5	0x4575	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.25	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:22.983627081 CET	1.1.1.1	192.168.2.5	0x4575	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.16	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:22.983627081 CET	1.1.1.1	192.168.2.5	0x4575	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.95	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:23.734493017 CET	1.1.1.1	192.168.2.5	0x9a75	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:23.734493017 CET	1.1.1.1	192.168.2.5	0x9a75	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:23.734493017 CET	1.1.1.1	192.168.2.5	0x9a75	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.95	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:23.734493017 CET	1.1.1.1	192.168.2.5	0x9a75	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.25	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:23.734493017 CET	1.1.1.1	192.168.2.5	0x9a75	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.16	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:23.734493017 CET	1.1.1.1	192.168.2.5	0x9a75	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.79	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:23.735671997 CET	1.1.1.1	192.168.2.5	0xa3	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:23.735671997 CET	1.1.1.1	192.168.2.5	0xa3	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:24.027307034 CET	1.1.1.1	192.168.2.5	0x9ff8	No error (0)	collector-pxikkul2rm.px-cloud.net		35.190.10.96	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:24.612596035 CET	1.1.1.1	192.168.2.5	0x647f	No error (0)	collector-pxikkul2rm.px-cloud.net		35.190.10.96	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:28.937818050 CET	1.1.1.1	192.168.2.5	0x90b7	No error (0)	q-cf.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:28.937818050 CET	1.1.1.1	192.168.2.5	0x90b7	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:28.937962055 CET	1.1.1.1	192.168.2.5	0x949b	No error (0)	q-cf.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:28.937962055 CET	1.1.1.1	192.168.2.5	0x949b	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:28.937962055 CET	1.1.1.1	192.168.2.5	0x949b	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.64.236.64	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:28.937962055 CET	1.1.1.1	192.168.2.5	0x949b	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.64.236.114	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:28.937962055 CET	1.1.1.1	192.168.2.5	0x949b	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.64.236.100	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:28.937962055 CET	1.1.1.1	192.168.2.5	0x949b	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.64.236.43	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:32.398482084 CET	1.1.1.1	192.168.2.5	0x653d	No error (0)	www.booking.com	d1of1hbywxxm65.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:32.398482084 CET	1.1.1.1	192.168.2.5	0x653d	No error (0)	d1of1hbywxxm65.cloudfront.net		108.138.64.87	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:32.398482084 CET	1.1.1.1	192.168.2.5	0x653d	No error (0)	d1of1hbywxxm65.cloudfront.net		108.138.64.79	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:32.398482084 CET	1.1.1.1	192.168.2.5	0x653d	No error (0)	d1of1hbywxxm65.cloudfront.net		108.138.64.67	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:32.398482084 CET	1.1.1.1	192.168.2.5	0x653d	No error (0)	d1of1hbywxxm65.cloudfront.net		108.138.64.58	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:32.398813963 CET	1.1.1.1	192.168.2.5	0x3a01	No error (0)	www.booking.com	d1of1hbywxxm65.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:32.971729040 CET	1.1.1.1	192.168.2.5	0x69b5	No error (0)	flights.booking.com	d333i577x8trzi.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:32.971729040 CET	1.1.1.1	192.168.2.5	0x69b5	No error (0)	d333i577x8trzi.cloudfront.net		99.84.208.90	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:32.971729040 CET	1.1.1.1	192.168.2.5	0x69b5	No error (0)	d333i577x8trzi.cloudfront.net		99.84.208.123	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:32.971729040 CET	1.1.1.1	192.168.2.5	0x69b5	No error (0)	d333i577x8trzi.cloudfront.net		99.84.208.32	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:32.971729040 CET	1.1.1.1	192.168.2.5	0x69b5	No error (0)	d333i577x8trzi.cloudfront.net		99.84.208.49	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:32.981169939 CET	1.1.1.1	192.168.2.5	0x1a93	No error (0)	flights.booking.com	d333i577x8trzi.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:33.319256067 CET	1.1.1.1	192.168.2.5	0x91bf	No error (0)	q-cf.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:33.319256067 CET	1.1.1.1	192.168.2.5	0x91bf	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:33.320138931 CET	1.1.1.1	192.168.2.5	0x7762	No error (0)	q-cf.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:33.320138931 CET	1.1.1.1	192.168.2.5	0x7762	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:33.320138931 CET	1.1.1.1	192.168.2.5	0x7762	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.95	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:33.320138931 CET	1.1.1.1	192.168.2.5	0x7762	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.16	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:33.320138931 CET	1.1.1.1	192.168.2.5	0x7762	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.25	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:33.320138931 CET	1.1.1.1	192.168.2.5	0x7762	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.79	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:34.924362898 CET	1.1.1.1	192.168.2.5	0x3625	No error (0)	flights.booking.com	d333i577x8trzi.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:34.924362898 CET	1.1.1.1	192.168.2.5	0x3625	No error (0)	d333i577x8trzi.cloudfront.net		99.84.208.123	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:34.924362898 CET	1.1.1.1	192.168.2.5	0x3625	No error (0)	d333i577x8trzi.cloudfront.net		99.84.208.90	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:34.924362898 CET	1.1.1.1	192.168.2.5	0x3625	No error (0)	d333i577x8trzi.cloudfront.net		99.84.208.49	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:34.924362898 CET	1.1.1.1	192.168.2.5	0x3625	No error (0)	d333i577x8trzi.cloudfront.net		99.84.208.32	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:34.924629927 CET	1.1.1.1	192.168.2.5	0xa579	No error (0)	flights.booking.com	d333i577x8trzi.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:38.140458107 CET	1.1.1.1	192.168.2.5	0x58cb	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:38.140458107 CET	1.1.1.1	192.168.2.5	0x58cb	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.16	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:38.140458107 CET	1.1.1.1	192.168.2.5	0x58cb	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.95	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:38.140458107 CET	1.1.1.1	192.168.2.5	0x58cb	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.79	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:38.140458107 CET	1.1.1.1	192.168.2.5	0x58cb	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.25	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:38.141932011 CET	1.1.1.1	192.168.2.5	0x8c76	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:38.161905050 CET	1.1.1.1	192.168.2.5	0x9039	No error (0)	booking.com		108.138.64.87	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:38.161905050 CET	1.1.1.1	192.168.2.5	0x9039	No error (0)	booking.com		108.138.64.79	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:38.161905050 CET	1.1.1.1	192.168.2.5	0x9039	No error (0)	booking.com		108.138.64.67	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:38.161905050 CET	1.1.1.1	192.168.2.5	0x9039	No error (0)	booking.com		108.138.64.58	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:38.171370029 CET	1.1.1.1	192.168.2.5	0xac71	No error (0)	q-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:38.171370029 CET	1.1.1.1	192.168.2.5	0xac71	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:38.171370029 CET	1.1.1.1	192.168.2.5	0xac71	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:38.171370029 CET	1.1.1.1	192.168.2.5	0xac71	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.95	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:38.171370029 CET	1.1.1.1	192.168.2.5	0xac71	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.79	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:38.171370029 CET	1.1.1.1	192.168.2.5	0xac71	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.25	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:38.171370029 CET	1.1.1.1	192.168.2.5	0xac71	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.16	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:38.171763897 CET	1.1.1.1	192.168.2.5	0xcf86	No error (0)	q-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:38.171763897 CET	1.1.1.1	192.168.2.5	0xcf86	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:38.171763897 CET	1.1.1.1	192.168.2.5	0xcf86	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:38.291750908 CET	1.1.1.1	192.168.2.5	0x5ebc	No error (0)	t-cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:38.291750908 CET	1.1.1.1	192.168.2.5	0x5ebc	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.64.236.43	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:38.291750908 CET	1.1.1.1	192.168.2.5	0x5ebc	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.64.236.64	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:38.291750908 CET	1.1.1.1	192.168.2.5	0x5ebc	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.64.236.114	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:38.291750908 CET	1.1.1.1	192.168.2.5	0x5ebc	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.64.236.100	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:38.293652058 CET	1.1.1.1	192.168.2.5	0x5d79	No error (0)	t-cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:39.412467003 CET	1.1.1.1	192.168.2.5	0x2946	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:39.412467003 CET	1.1.1.1	192.168.2.5	0x2946	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:39.694297075 CET	1.1.1.1	192.168.2.5	0x89c4	No error (0)	shelves.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:39.694297075 CET	1.1.1.1	192.168.2.5	0x89c4	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:39.694297075 CET	1.1.1.1	192.168.2.5	0x89c4	No error (0)	de2trjlt8e8rj.cloudfront.net		3.161.193.71	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:39.694297075 CET	1.1.1.1	192.168.2.5	0x89c4	No error (0)	de2trjlt8e8rj.cloudfront.net		3.161.193.46	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:39.694297075 CET	1.1.1.1	192.168.2.5	0x89c4	No error (0)	de2trjlt8e8rj.cloudfront.net		3.161.193.103	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:39.694297075 CET	1.1.1.1	192.168.2.5	0x89c4	No error (0)	de2trjlt8e8rj.cloudfront.net		3.161.193.117	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:39.695704937 CET	1.1.1.1	192.168.2.5	0xc66f	No error (0)	shelves.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:39.695704937 CET	1.1.1.1	192.168.2.5	0xc66f	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:40.539571047 CET	1.1.1.1	192.168.2.5	0xb921	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:40.539571047 CET	1.1.1.1	192.168.2.5	0xb921	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.79	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:40.539571047 CET	1.1.1.1	192.168.2.5	0xb921	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.95	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:40.539571047 CET	1.1.1.1	192.168.2.5	0xb921	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.16	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:40.539571047 CET	1.1.1.1	192.168.2.5	0xb921	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.64.25	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:40.540358067 CET	1.1.1.1	192.168.2.5	0xc37f	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:43.843300104 CET	1.1.1.1	192.168.2.5	0xec1c	No error (0)	stats.g.doubleclick.net		64.233.176.157	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:43.843300104 CET	1.1.1.1	192.168.2.5	0xec1c	No error (0)	stats.g.doubleclick.net		64.233.176.155	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:43.843300104 CET	1.1.1.1	192.168.2.5	0xec1c	No error (0)	stats.g.doubleclick.net		64.233.176.156	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:43.843300104 CET	1.1.1.1	192.168.2.5	0xec1c	No error (0)	stats.g.doubleclick.net		64.233.176.154	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:44.145262003 CET	1.1.1.1	192.168.2.5	0x11b9	No error (0)	geolocation.onetrust.com		104.18.32.137	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:44.145262003 CET	1.1.1.1	192.168.2.5	0x11b9	No error (0)	geolocation.onetrust.com		172.64.155.119	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:44.146228075 CET	1.1.1.1	192.168.2.5	0x2df2	No error (0)	geolocation.onetrust.com			65	IN (0x0001)	false
Feb 8, 2024 19:36:44.280025959 CET	1.1.1.1	192.168.2.5	0x5fce	No error (0)	www.booking.com	d1of1hbywxxm65.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:44.280025959 CET	1.1.1.1	192.168.2.5	0x5fce	No error (0)	d1of1hbywxxm65.cloudfront.net		108.138.64.79	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:44.280025959 CET	1.1.1.1	192.168.2.5	0x5fce	No error (0)	d1of1hbywxxm65.cloudfront.net		108.138.64.58	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:44.280025959 CET	1.1.1.1	192.168.2.5	0x5fce	No error (0)	d1of1hbywxxm65.cloudfront.net		108.138.64.87	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:44.280025959 CET	1.1.1.1	192.168.2.5	0x5fce	No error (0)	d1of1hbywxxm65.cloudfront.net		108.138.64.67	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:44.290375948 CET	1.1.1.1	192.168.2.5	0xfb87	No error (0)	www.booking.com	d1of1hbywxxm65.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:44.603189945 CET	1.1.1.1	192.168.2.5	0x55fa	No error (0)	stats.g.doubleclick.net		108.177.122.154	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:44.603189945 CET	1.1.1.1	192.168.2.5	0x55fa	No error (0)	stats.g.doubleclick.net		108.177.122.156	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:44.603189945 CET	1.1.1.1	192.168.2.5	0x55fa	No error (0)	stats.g.doubleclick.net		108.177.122.157	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:44.603189945 CET	1.1.1.1	192.168.2.5	0x55fa	No error (0)	stats.g.doubleclick.net		108.177.122.155	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:45.357758999 CET	1.1.1.1	192.168.2.5	0xc02a	No error (0)	www.google.com		74.125.136.99	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:45.357758999 CET	1.1.1.1	192.168.2.5	0xc02a	No error (0)	www.google.com		74.125.136.147	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:45.357758999 CET	1.1.1.1	192.168.2.5	0xc02a	No error (0)	www.google.com		74.125.136.106	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:45.357758999 CET	1.1.1.1	192.168.2.5	0xc02a	No error (0)	www.google.com		74.125.136.105	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:45.357758999 CET	1.1.1.1	192.168.2.5	0xc02a	No error (0)	www.google.com		74.125.136.103	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:45.357758999 CET	1.1.1.1	192.168.2.5	0xc02a	No error (0)	www.google.com		74.125.136.104	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:45.357897043 CET	1.1.1.1	192.168.2.5	0xb09	No error (0)	www.google.com			65	IN (0x0001)	false
Feb 8, 2024 19:36:45.424112082 CET	1.1.1.1	192.168.2.5	0x65cc	No error (0)	web-vitals.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:45.424112082 CET	1.1.1.1	192.168.2.5	0x65cc	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:45.424112082 CET	1.1.1.1	192.168.2.5	0x65cc	No error (0)	de2trjlt8e8rj.cloudfront.net		18.67.65.25	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:45.424112082 CET	1.1.1.1	192.168.2.5	0x65cc	No error (0)	de2trjlt8e8rj.cloudfront.net		18.67.65.112	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:45.424112082 CET	1.1.1.1	192.168.2.5	0x65cc	No error (0)	de2trjlt8e8rj.cloudfront.net		18.67.65.2	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:45.424112082 CET	1.1.1.1	192.168.2.5	0x65cc	No error (0)	de2trjlt8e8rj.cloudfront.net		18.67.65.49	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:45.424868107 CET	1.1.1.1	192.168.2.5	0x57b	No error (0)	web-vitals.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:45.424868107 CET	1.1.1.1	192.168.2.5	0x57b	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:46.211601019 CET	1.1.1.1	192.168.2.5	0x1518	No error (0)	web-vitals.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:46.211601019 CET	1.1.1.1	192.168.2.5	0x1518	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:46.211601019 CET	1.1.1.1	192.168.2.5	0x1518	No error (0)	de2trjlt8e8rj.cloudfront.net		3.161.193.103	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:46.211601019 CET	1.1.1.1	192.168.2.5	0x1518	No error (0)	de2trjlt8e8rj.cloudfront.net		3.161.193.117	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:46.211601019 CET	1.1.1.1	192.168.2.5	0x1518	No error (0)	de2trjlt8e8rj.cloudfront.net		3.161.193.46	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:46.211601019 CET	1.1.1.1	192.168.2.5	0x1518	No error (0)	de2trjlt8e8rj.cloudfront.net		3.161.193.71	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:46.214674950 CET	1.1.1.1	192.168.2.5	0x5282	No error (0)	web-vitals.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:46.214674950 CET	1.1.1.1	192.168.2.5	0x5282	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 8, 2024 19:36:46.585321903 CET	1.1.1.1	192.168.2.5	0x1635	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		18.67.65.55	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:46.585321903 CET	1.1.1.1	192.168.2.5	0x1635	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		18.67.65.124	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:46.585321903 CET	1.1.1.1	192.168.2.5	0x1635	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		18.67.65.100	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:46.585321903 CET	1.1.1.1	192.168.2.5	0x1635	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		18.67.65.7	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:48.310739994 CET	1.1.1.1	192.168.2.5	0x2597	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		18.67.65.7	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:48.310739994 CET	1.1.1.1	192.168.2.5	0x2597	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		18.67.65.100	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:48.310739994 CET	1.1.1.1	192.168.2.5	0x2597	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		18.67.65.124	A (IP address)	IN (0x0001)	false
Feb 8, 2024 19:36:48.310739994 CET	1.1.1.1	192.168.2.5	0x2597	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		18.67.65.55	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	142.250.9.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:27 UTC	680	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:27 UTC	1	OUT	Data Raw: 20 Data Ascii:
2024-02-08 18:35:27 UTC	1798	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 08 Feb 2024 18:35:27 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-gB0ws1dL51aEwtqMmCIvXA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* reporting-endpoints: default="/_/IdentityListAccountsHttp/web-reports?context=eJzjMtDikmLw1JBiOHxtB5Meyy0mIyCe2_2UaSEQH4x7znQUiHf4eLA4pc9gDQFiIW6O93unrGMT6JjaGAoAnhAWxw" Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:27 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2024-02-08 18:35:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	104.21.85.210	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:28 UTC	677	OUT	GET /6513881796 HTTP/1.1 Host: booking.search-13125.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:29 UTC	792	IN	HTTP/1.1 302 Found Date: Thu, 08 Feb 2024 18:35:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0qjlg2m8cvain3uir905gmc9h9; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Location: https://booking.com CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eafPpxI3BzudGsQYQcS%2BQAtoLeB7ajIdP%2FKOpIUehVDj9OoqOGSHU3KcfQvYL%2BjV8AaHFVEFYvWetwNPqPvP13%2F39zzFrFex31rE6oUBay0bTZrVCRagfy1Dw3fyolTrtpWSZDf51NEc%2Bzk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8525f9029ea46750-ATL alt-svc: h3=":443"; ma=86400
2024-02-08 18:35:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49713	108.138.64.67	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:29 UTC	654	OUT	GET / HTTP/1.1 Host: booking.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:30 UTC	912	IN	HTTP/1.1 301 Moved Permanently Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:30 GMT location: https://www.booking.com/ nel: {"max_age":604800,"report_to":"default"} report-to: {"group":"default","endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":604800} strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=1a5282b9a8450216&e=UmFuZG9tSVYkc2RlIyh9YdPFJGDFjZSqK4Z-4dNTMVtQMMKUwsD1L-if3T7ex8SSL41pjVip_CM x-terms-of-service: https://www.booking.com/content/terms.html x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 e6c353101750d150139bda8d95719802.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 9nOK8QOW6Rcbq1wSU0MywL2maeN1_JpjmNhUyVurG28VfL0FPNsbfA==
2024-02-08 18:35:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49715	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:31 UTC	658	OUT	GET / HTTP/1.1 Host: www.booking.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:31 UTC	2838	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:31 GMT vary: Accept-Encoding, User-Agent link: <https://cf.bstatic.com/static/css/gprof_icons_cloudfront_sd.iq_ltr/f2fce41920df3c9225af5c680c3a8127d2caaceb.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/incentives_cloudfront_sd.iq_ltr/f1558a6e9832a4eb8cfe1d3d14db176bd3564335.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/index_cloudfront_sd.iq_ltr/903b49ae71c75322442d1bc9a0dc298bb8a6e32e.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/main_cloudfront_sd.iq_ltr/e6474733abba1cd6bc8a66bea1aa8643d7435c30.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/main_exps_cloudfront_sd.iq_ltr/586b07455f7783cafa801bdea38881f1f98ad36d.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/xp-index-sb_cloudfront_sd.iq_ltr/5b5ab8ab66a5ce3092875d0725122439c4f2dfdd.css>; rel=preload; as=style nel: {"report_to":"default","max_age":604800} report-to: {"group":"default","max_age":604800,"endpoints":[{"url":"https://nellie.booking.com/report"}]} set-cookie: _implmdnbl=2__1__0; path=/; expires=Sat, 09-Feb-2019 18:35:31 GMT; HttpOnly set-cookie: px_init=0; domain=booking.com; expires=Tue, 17-May-2078 13:11:02 GMT; SameSite=Strict; secure; HttpOnly set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhDMSfLvcMG2VHcbU0a02MOY%2FoE3Pj42bdhHH9WLLA1HPYkJysgulFoMrtOulTRBzpAAVSg2Ic64ufepnGAfylJXnqeKJvDEAHVmYnj3dbGB7ygVV2JkX124%2BEixWTdIqcGu5Kd0Dv6tKmcPbpsN1xr5; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:31 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-type-options: nosniff x-recruiting: Like HTTP headers? Come write ours: https://careers.booking.com x-terms-of-service: https://www.booking.com/content/terms.html x-xss-protection: 1; mode=block set-cookie: bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; Domain=.booking.com; Path=/; Expires=Sat, 07 Feb 2026 18:35:31 GMT; HttpOnly; Secure set-cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; Domain=.booking.com; Path=/; Expires=Fri, 07 Feb 2025 18:35:31 GMT; HttpOnly; Secure X-Cache: Miss from cloudfront Via: 1.1 ea0f86c249e022d5015ce79f54e723d0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Cl2_2s6zZQPcsZIUBg_4wY9MdjU5QwLq62SBlX1e1LelG_rB-3p9tA==
2024-02-08 18:35:31 UTC	12068	IN	Data Raw: 32 66 31 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 59 6f 75 20 6b 6e 6f 77 20 79 6f 75 20 63 6f 75 6c 64 20 62 65 20 67 65 74 74 69 6e 67 20 70 61 69 64 20 74 6f 20 70 6f 6b 65 20 61 72 6f 75 6e 64 20 69 6e 20 6f 75 72 20 63 6f 64 65 3f 0a 57 65 27 72 65 20 68 69 72 69 6e 67 20 64 65 73 69 67 6e 65 72 73 20 61 6e 64 20 64 65 76 65 6c 6f 70 65 72 73 20 74 6f 20 77 6f 72 6b 20 69 6e 20 41 6d 73 74 65 72 64 61 6d 3a 0a 68 74 74 70 73 3a 2f 2f 63 61 72 65 65 72 73 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 0a 2d 2d 3e 0a 3c 21 2d 2d 20 77 64 6f 74 2d 38 30 32 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 32 45 6c 4f 48 30 6a 42 52 73 74 36 75 31 48 22 Data Ascii: 2f1c<!DOCTYPE html>...You know you could be getting paid to poke around in our code?We're hiring designers and developers to work in Amsterdam:https://careers.booking.com/-->... wdot-802 --><script type="text/javascript" nonce="2ElOH0jBRst6u1H"
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 37 66 66 61 0d 0a 3c 74 69 74 6c 65 3e 0a 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 7c 20 4f 66 66 69 63 69 61 6c 20 73 69 74 65 20 7c 20 54 68 65 20 62 65 73 74 20 68 6f 74 65 6c 73 2c 20 66 6c 69 67 68 74 73 2c 20 63 61 72 20 72 65 6e 74 61 6c 73 20 26 20 61 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 73 20 0a 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 45 78 70 6c 6f 72 65 20 74 68 65 20 77 6f 72 6c 64 20 77 69 74 68 20 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 2e 20 42 69 67 20 73 61 76 69 6e 67 73 20 6f 6e 20 68 6f 6d 65 73 2c 20 68 6f 74 65 6c 73 2c 20 66 6c 69 67 68 74 73 2c 20 63 61 72 20 72 65 6e 74 61 6c 73 2c 20 74 61 78 69 73 2c 20 61 6e 64 20 61 74 74 72 61 63 74 69 6f 6e 73 20 e2 Data Ascii: 7ffa<title>Booking.com \| Official site \| The best hotels, flights, car rentals & accommodations </title><meta name="description" content="Explore the world with Booking.com. Big savings on homes, hotels, flights, car rentals, taxis, and attractions
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 6e 7d 20 7b 66 75 6c 6c 5f 79 65 61 72 7d 22 2c 22 6e 75 6d 65 72 69 63 5f 64 61 74 65 5f 72 61 6e 67 65 22 3a 22 7b 6d 6f 6e 74 68 7d 2f 7b 64 61 79 5f 6f 66 5f 6d 6f 6e 74 68 7d 20 2d 20 7b 6d 6f 6e 74 68 5f 75 6e 74 69 6c 7d 2f 7b 64 61 79 5f 6f 66 5f 6d 6f 6e 74 68 5f 75 6e 74 69 6c 7d 22 2c 22 64 61 79 5f 73 68 6f 72 74 5f 6d 6f 6e 74 68 5f 79 65 61 72 5f 74 69 6d 65 5f 62 65 74 77 65 65 6e 22 3a 22 7b 73 68 6f 72 74 5f 6d 6f 6e 74 68 5f 6e 61 6d 65 7d 20 7b 64 61 79 5f 6f 66 5f 6d 6f 6e 74 68 7d 2c 20 7b 66 75 6c 6c 5f 79 65 61 72 7d 2c 20 7b 74 69 6d 65 7d 20 e2 80 93 20 7b 74 69 6d 65 5f 75 6e 74 69 6c 7d 22 2c 22 6e 75 6d 65 72 69 63 5f 64 61 79 5f 6d 6f 6e 74 68 5f 79 65 61 72 22 3a 22 7b 6d 6f 6e 74 68 5f 6e 61 6d 65 5f 30 7d 2f 7b 64 61 79 5f Data Ascii: n} {full_year}","numeric_date_range":"{month}/{day_of_month} - {month_until}/{day_of_month_until}","day_short_month_year_time_between":"{short_month_name} {day_of_month}, {full_year}, {time} {time_until}","numeric_day_month_year":"{month_name_0}/{day_
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 0d 0a 36 37 39 61 0d 0a 71 5f 6c 74 72 2f 61 63 37 33 61 31 35 33 33 63 39 62 31 33 37 64 31 35 34 65 34 31 32 61 66 35 38 62 30 62 36 61 37 34 65 32 30 39 61 35 2e 63 73 73 27 2c 0a 65 6d 70 74 79 3a 20 27 27 0a 7d 2c 0a 66 65 5f 65 6e 61 62 6c 65 5f 66 70 73 5f 67 6f 61 6c 5f 77 69 74 68 5f 76 61 6c 75 65 3a 20 31 2c 0a 62 5f 65 6d 61 69 6c 5f 76 61 6c 69 64 61 74 69 6f 6e 5f 72 65 67 65 78 20 3a 20 2f 5e 28 5b 5c 77 2d 5c 2e 5c 2b 5d 2b 40 28 5b 5c 77 2d 5d 2b 5c 2e 29 2b 5b 5c 77 2d 5d 7b 32 2c 31 34 7d 29 3f 24 2f 2c 0a 62 5f 64 6f 6d 61 69 6e 5f 65 6e 64 20 3a 20 27 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 27 2c 0a 62 5f 6f 72 69 67 69 6e 61 6c 5f 75 72 6c 20 3a 20 27 68 74 74 70 73 3a 26 23 34 37 3b 26 23 34 37 3b 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 Data Ascii: 679aq_ltr/ac73a1533c9b137d154e412af58b0b6a74e209a5.css',empty: ''},fe_enable_fps_goal_with_value: 1,b_email_validation_regex : /^([\w-\.\+]+@([\w-]+\.)+[\w-]{2,14})?$/,b_domain_end : '.booking.com',b_original_url : 'https://www.booking.c
2024-02-08 18:35:32 UTC	10148	IN	Data Raw: 49 45 59 58 57 49 59 4b 64 56 61 51 42 59 4e 5a 4a 64 44 42 4b 43 27 2c 0a 67 6e 73 53 70 75 6e 5f 6d 6f 64 61 6c 44 69 73 6d 69 73 73 5f 69 6e 64 65 78 3a 20 27 54 44 58 52 50 43 54 4f 59 45 53 45 49 45 59 4b 54 53 43 51 4a 4b 62 4e 56 5a 4d 59 49 4f 27 2c 0a 67 6e 73 53 70 75 6e 5f 72 65 6d 69 6e 64 65 72 4d 6f 64 61 6c 56 69 65 77 5f 69 6e 64 65 78 3a 20 27 54 44 58 52 50 43 54 4f 59 45 53 45 56 66 46 54 64 4a 56 44 42 61 55 58 61 57 4e 42 41 4c 4f 56 5a 4d 59 49 4f 27 2c 0a 67 6e 73 53 70 75 6e 5f 72 65 6d 69 6e 64 65 72 4d 6f 64 61 6c 43 74 61 43 6c 69 63 6b 5f 69 6e 64 65 78 3a 20 27 54 44 58 52 50 43 54 4f 59 45 53 45 56 66 46 54 64 4a 56 44 42 61 55 58 61 57 42 58 46 4a 56 47 53 42 42 4e 50 4d 50 53 58 57 65 27 2c 0a 67 6e 73 53 70 75 6e 5f 72 65 Data Ascii: IEYXWIYKdVaQBYNZJdDBKC',gnsSpun_modalDismiss_index: 'TDXRPCTOYESEIEYKTSCQJKbNVZMYIO',gnsSpun_reminderModalView_index: 'TDXRPCTOYESEVfFTdJVDBaUXaWNBALOVZMYIO',gnsSpun_reminderModalCtaClick_index: 'TDXRPCTOYESEVfFTdJVDBaUXaWBXFJVGSBBNPMPSXWe',gnsSpun_re
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 33 66 66 61 0d 0a 4e 64 50 47 4b 4e 53 43 4d 48 56 50 48 41 4c 4f 4c 4f 4c 4d 4f 22 3a 31 2c 22 48 57 41 46 4e 65 4f 59 53 55 61 65 63 66 62 45 49 45 59 58 54 22 3a 31 2c 22 63 43 48 4f 62 4b 64 4a 66 46 64 48 4d 58 43 45 46 52 55 52 55 52 48 65 22 3a 31 2c 22 4f 56 59 50 55 51 57 49 62 41 61 4c 46 53 65 62 55 4d 65 46 4c 4f 22 3a 31 2c 22 4f 4d 54 56 42 45 4e 4e 46 5a 46 4a 46 52 4c 52 47 4f 22 3a 31 2c 22 61 58 54 62 53 46 59 54 42 48 4d 48 48 56 62 52 65 49 59 42 42 56 59 55 66 46 64 48 4d 4e 51 4a 54 65 45 52 58 57 58 46 5a 45 56 43 22 3a 31 2c 22 4e 41 46 51 56 55 4e 4f 64 4f 4b 42 42 49 55 4a 4c 4d 4a 47 4f 47 5a 4e 43 54 59 41 62 62 4c 66 50 4a 61 41 4b 44 4b 65 22 3a 31 2c 22 62 51 47 42 50 5a 64 4f 57 63 61 54 4a 5a 53 41 63 63 54 58 59 61 57 48 Data Ascii: 3ffaNdPGKNSCMHVPHALOLOLMO":1,"HWAFNeOYSUaecfbEIEYXT":1,"cCHObKdJfFdHMXCEFRURURHe":1,"OVYPUQWIbAaLFSebUMeFLO":1,"OMTVBENNFZFJFRLRGO":1,"aXTbSFYTBHMHHVbReIYBBVYUfFdHMNQJTeERXWXFZEVC":1,"NAFQVUNOdOKBBIUJLMJGOGZNCTYAbbLfPJaAKDKe":1,"bQGBPZdOWcaTJZSAccTXYaWH
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 0d 0a 34 62 64 33 0d 0a 46 65 52 4c 50 59 4b 44 63 64 44 64 4f 4e 4f 65 66 46 4e 65 4a 4d 42 48 4f 65 46 5a 4f 46 48 65 22 3a 31 2c 22 4e 41 46 4c 65 4f 65 4a 63 43 63 43 63 43 57 4e 54 52 62 41 4f 64 5a 57 66 42 4a 66 42 5a 47 50 54 63 4e 48 43 22 3a 31 2c 22 48 4d 62 42 59 59 44 64 57 51 5a 51 42 4f 46 4f 22 3a 31 2c 22 61 61 41 4a 59 42 56 61 41 4a 44 62 41 50 51 66 51 4f 48 54 22 3a 31 2c 22 64 44 66 50 4a 4e 43 46 47 66 47 66 5a 62 43 45 57 5a 65 45 48 4a 64 64 45 50 58 65 43 22 3a 31 2c 22 48 49 4e 5a 4a 4c 65 55 58 53 61 5a 62 58 4b 42 65 62 66 44 55 46 59 51 46 58 53 42 59 51 4f 57 48 54 22 3a 31 2c 22 4f 4f 49 42 54 42 55 4e 4a 45 52 45 63 5a 62 65 4b 52 4a 4f 49 5a 43 42 4b 65 4a 56 49 5a 64 52 52 54 22 3a 31 2c 22 4e 41 46 51 43 4a 57 5a 55 62 Data Ascii: 4bd3FeRLPYKDcdDdONOefFNeJMBHOeFZOFHe":1,"NAFLeOeJcCcCcCWNTRbAOdZWfBJfBZGPTcNHC":1,"HMbBYYDdWQZQBOFO":1,"aaAJYBVaAJDbAPQfQOHT":1,"dDfPJNCFGfGfZbCEWZeEHJddEPXeC":1,"HINZJLeUXSaZbXKBebfDUFYQFXSBYQOWHT":1,"OOIBTBUNJEREcZbeKRJOIZCBKeJVIZdRRT":1,"NAFQCJWZUb
2024-02-08 18:35:32 UTC	3037	IN	Data Raw: 57 58 47 64 41 65 63 4c 55 54 64 57 4e 41 49 4b 47 50 41 4d 49 47 44 5a 48 58 52 54 22 3a 31 2c 22 4f 41 5a 4f 58 5a 64 62 45 4a 4e 5a 4a 53 55 44 50 5a 42 51 41 61 4e 43 57 52 65 22 3a 31 2c 22 61 57 51 4f 63 59 54 42 66 46 64 48 4d 65 50 43 65 66 41 45 52 45 48 47 53 58 56 56 51 61 57 65 22 3a 31 2c 22 48 4d 62 4b 64 46 54 48 58 53 57 45 59 63 5a 62 4d 53 56 58 4d 50 42 4f 53 56 66 46 66 5a 64 4f 55 63 4f 22 3a 31 2c 22 48 57 41 46 59 54 61 59 62 5a 4e 48 54 22 3a 31 2c 22 54 57 55 4c 46 63 53 4f 5a 61 54 61 54 61 42 63 51 59 49 4d 64 55 45 4c 57 64 5a 58 5a 54 51 51 42 43 22 3a 31 2c 22 48 4d 62 49 43 57 43 61 65 50 4d 5a 41 42 51 56 54 22 3a 31 2c 22 4e 41 46 4c 65 4f 65 4a 59 54 42 4e 41 46 51 56 46 62 45 4f 54 4f 43 62 65 51 4d 49 54 4b 65 22 3a 31 Data Ascii: WXGdAecLUTdWNAIKGPAMIGDZHXRT":1,"OAZOXZdbEJNZJSUDPZBQAaNCWRe":1,"aWQOcYTBfFdHMePCefAEREHGSXVVQaWe":1,"HMbKdFTHXSWEYcZbMSVXMPBOSVfFfZdOUcO":1,"HWAFYTaYbZNHT":1,"TWULFcSOZaTaTaBcQYIMdUELWdZXZTQQBC":1,"HMbICWCaePMZABQVT":1,"NAFLeOeJYTBNAFQVFbEOTOCbeQMITKe":1
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 33 66 66 39 0d 0a 43 62 63 4c 53 62 44 61 4c 53 47 44 42 58 4e 45 59 54 22 3a 31 2c 22 65 44 55 64 47 56 64 4e 64 5a 59 54 48 4c 43 4f 53 42 47 63 43 56 42 45 51 4e 65 52 65 22 3a 31 2c 22 63 43 48 4f 62 49 50 50 51 46 46 4e 63 55 57 42 5a 45 57 61 53 64 64 4b 4e 4b 4e 4b 57 65 22 3a 31 2c 22 55 45 54 54 4a 62 5a 57 4d 5a 66 50 41 4a 4e 4c 4a 50 47 45 62 66 57 45 42 4f 57 65 22 3a 31 2c 22 49 5a 62 52 45 5a 56 50 54 4c 4b 47 42 66 53 55 61 65 63 66 62 56 43 4d 49 52 65 22 3a 31 2c 22 48 57 41 46 59 57 51 4a 4a 53 56 48 46 41 55 56 63 49 4f 22 3a 31 2c 22 54 65 43 4f 65 4a 50 51 51 42 4a 4c 55 55 58 56 53 66 43 53 52 42 4a 4e 4e 66 47 50 43 44 4d 51 50 59 4f 22 3a 31 2c 22 4f 4d 54 56 42 45 4e 4e 46 5a 46 57 66 42 51 4d 41 5a 45 55 63 48 43 62 58 66 56 51 Data Ascii: 3ff9CbcLSbDaLSGDBXNEYT":1,"eDUdGVdNdZYTHLCOSBGcCVBEQNeRe":1,"cCHObIPPQFFNcUWBZEWaSddKNKNKWe":1,"UETTJbZWMZfPAJNLJPGEbfWEBOWe":1,"IZbREZVPTLKGBfSUaecfbVCMIRe":1,"HWAFYWQJJSVHFAUVcIO":1,"TeCOeJPQQBJLUUXVSfCSRBJNNfGPCDMQPYO":1,"OMTVBENNFZFWfBQMAZEUcHCbXfVQ
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 0a 38 30 30 30 0d 0a 42 4f 4f 49 42 54 4f 65 52 59 43 42 49 4e 51 59 66 4d 5a 43 54 4b 65 22 3a 31 2c 22 49 5a 56 47 50 56 55 66 45 46 4b 59 4f 65 65 4f 5a 62 4e 46 62 4b 48 44 48 54 22 3a 31 2c 22 4e 56 4e 5a 59 65 4a 65 56 59 50 58 50 5a 53 4d 64 62 44 63 4d 57 51 59 54 22 3a 31 2c 22 49 5a 56 54 57 52 47 56 5a 5a 51 4c 50 50 50 54 4a 41 4f 4e 4a 42 48 65 22 3a 31 2c 22 63 43 48 4f 62 4f 4e 64 50 62 49 5a 46 62 59 53 66 44 63 66 46 64 48 4d 62 4e 58 47 44 4a 64 4c 4f 4c 4f 4c 4d 4f 22 3a 31 2c 22 48 57 41 46 4e 48 55 65 52 46 4b 5a 62 54 5a 57 4b 4e 65 63 66 5a 49 56 46 5a 57 50 61 44 4d 43 22 3a 31 2c 22 61 57 51 4f 63 59 54 42 62 46 46 51 4c 41 5a 5a 43 65 4f 53 62 5a 48 65 22 3a 32 2c 22 61 58 54 62 53 46 59 54 42 48 4d 48 48 56 62 52 65 49 59 42 42 Data Ascii: 8000BOOIBTOeRYCBINQYfMZCTKe":1,"IZVGPVUfEFKYOeeOZbNFbKHDHT":1,"NVNZYeJeVYPXPZSMdbDcMWQYT":1,"IZVTWRGVZZQLPPPTJAONJBHe":1,"cCHObONdPbIZFbYSfDcfFdHMbNXGDJdLOLOLMO":1,"HWAFNHUeRFKZbTZWKNecfZIVFZWPaDMC":1,"aWQOcYTBbFFQLAZZCeOSbZHe":2,"aXTbSFYTBHMHHVbReIYBB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49716	23.220.189.216	443

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:32 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-02-08 18:35:32 UTC	532	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-MSEdge-Ref: Ref A: DBB3C8D083C94C75B95956C4186F17A2 Ref B: ASHEDGE1512 Ref C: 2024-02-06T10:22:19Z Cache-Control: public, max-age=56776 Date: Thu, 08 Feb 2024 18:35:32 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49717	23.220.189.216	443

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:32 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-02-08 18:35:32 UTC	661	IN	HTTP/1.1 200 OK Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-CID: 7 X-CCC: US X-Azure-Ref-OriginShield: Ref A: 58A8032E0A184202AC9E973C7E16DFBF Ref B: CH1AA2040904025 Ref C: 2023-07-09T06:25:19Z X-MSEdge-Ref: Ref A: 3FB884FE27194F46821180A0235E838A Ref B: CHI30EDGE0308 Ref C: 2023-07-09T06:26:49Z Content-Type: application/octet-stream Cache-Control: public, max-age=57089 Date: Thu, 08 Feb 2024 18:35:32 GMT Content-Length: 55 Connection: close X-CID: 2
2024-02-08 18:35:32 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49722	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:32 UTC	615	OUT	GET /static/css/gprof_icons_cloudfront_sd.iq_ltr/f2fce41920df3c9225af5c680c3a8127d2caaceb.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:32 UTC	795	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 168278 Connection: close Server: nginx Date: Wed, 07 Feb 2024 06:29:05 GMT Last-Modified: Mon, 08 Jan 2024 02:44:50 GMT Expires: Fri, 08 Mar 2024 06:29:05 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "659b61a2-29156" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 a1a074529ccb9ea97acd7d95c506f336.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 39W3nXHY9m7L3bmX4ljcBO45Fc-nXlzeyD6bImJcKKjs_2hUFG7i8A== Age: 129987
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 2e 62 2d 62 6f 6f 6b 65 72 2d 74 79 70 65 5f 5f 63 6f 6e 74 61 69 6e 65 72 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 66 6f 72 6d 20 64 69 76 20 6c 61 62 65 6c 2e 62 2d 62 6f 6f 6b 65 72 2d 74 79 70 65 7b 70 61 64 64 69 6e 67 3a 30 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 7d 2e 6c 61 62 65 6c 2d 62 75 73 69 6e 65 73 73 2d 74 72 69 70 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 35 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 32 30 70 78 20 33 70 78 20 33 70 78 20 32 30 70 78 3b 70 61 64 64 69 6e 67 3a 30 20 38 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 34 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a Data Ascii: .b-booker-type__container{display:inline-block}form div label.b-booker-type{padding:0;font-weight:500}.label-business-trip{display:inline-block;margin-left:0;margin-right:5px;border-radius:20px 3px 3px 20px;padding:0 8px;line-height:24px;background-color:
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 63 68 2d 74 6f 6f 6c 74 69 70 2d 70 61 72 61 67 72 61 70 68 2e 70 61 72 61 67 72 61 70 68 2d 70 75 62 6c 69 63 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 70 72 6f 66 69 6c 65 2d 61 72 65 61 5f 5f 73 69 64 65 62 61 72 2d 70 75 62 6c 69 63 2d 73 77 69 74 63 68 2d 74 6f 6f 6c 74 69 70 2e 69 73 2d 70 75 62 6c 69 63 20 2e 70 72 6f 66 69 6c 65 2d 61 72 65 61 5f 5f 73 69 64 65 62 61 72 2d 70 75 62 6c 69 63 2d 73 77 69 74 63 68 2d 74 6f 6f 6c 74 69 70 2d 70 61 72 61 67 72 61 70 68 2e 70 61 72 61 67 72 61 70 68 2d 70 72 69 76 61 74 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 70 75 62 6c 69 63 2d 74 69 6d 65 6c 69 6e 65 2d 74 6f 70 5f 5f 77 72 61 70 70 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 64 64 64 3b 6d 61 72 67 69 6e 3a 30 20 31 30 70 78 20 31 30 70 Data Ascii: ch-tooltip-paragraph.paragraph-public{display:none}.profile-area__sidebar-public-switch-tooltip.is-public .profile-area__sidebar-public-switch-tooltip-paragraph.paragraph-private{display:none}.public-timeline-top__wrapper{background:#ddd;margin:0 10px 10p
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 78 20 35 70 78 20 35 70 78 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 7d 2e 61 63 63 6f 75 6e 74 5f 73 69 64 65 62 61 72 5f 6d 65 6e 75 20 2e 75 73 65 72 5f 63 65 6e 74 65 72 5f 6f 70 74 69 6f 6e 5f 6e 6f 6a 73 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 30 70 78 7d 2e 75 73 65 72 5f 63 65 6e 74 65 72 5f 6f 70 74 69 6f 6e 5f 6e 6f 6a 73 20 61 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 7d 2e 75 73 65 72 5f 63 65 6e 74 65 72 5f 6f 70 74 69 6f 6e 5f 6e 6f 6a 73 20 2e 68 65 61 64 65 72 5f 6c 6f 67 6f 75 74 5f 6c 69 6e 6b 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 3b 66 6f 6e 74 2d 73 69 7a 65 Data Ascii: x 5px 5px;display:inline-block;font-size:12px}.account_sidebar_menu .user_center_option_nojs{padding-top:10px}.user_center_option_nojs a:hover{color:var(--bui_color_white)}.user_center_option_nojs .header_logout_link{color:var(--bui_color_white);font-size
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 3a 36 70 78 20 31 30 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 34 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 63 6f 6c 6f 72 3a 23 35 34 35 34 35 34 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 63 63 63 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 33 70 78 3b 2a 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2e 33 65 6d 7d 2e 69 6e 70 75 74 2d 62 6c 6f 63 6b 2d 6c 65 76 65 6c 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 31 30 30 25 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 33 30 70 78 3b Data Ascii: :6px 10px;margin-bottom:10px;font-size:12px;line-height:14px;vertical-align:middle;color:#545454;background-color:var(--bui_color_white);border:1px solid #ccc;border-radius:3px;*margin-left:.3em}.input-block-level{display:block;width:100%;min-height:30px;
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 7d 2e 70 72 6f 66 69 6c 65 2d 61 72 65 61 5f 5f 6e 61 76 2d 68 65 61 64 65 72 2d 70 61 72 74 6e 65 72 73 7b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 23 62 61 64 34 66 37 7d 2e 70 72 6f 66 69 6c 65 2d 61 72 65 61 5f 5f 6e 61 76 2d 69 63 6f 6e 2d 73 76 67 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 66 69 6c 6c 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 3b 68 65 69 67 68 74 3a 32 36 70 78 3b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 20 36 70 78 7d 2e 70 72 6f 66 69 6c 65 2d 61 72 65 61 5f 5f 6e 61 76 20 6c 69 20 61 3a 68 6f 76 65 72 20 2e 62 6b 2d 69 63 6f 6e 7b 66 69 6c 6c 3a 23 35 62 62 61 66 66 7d 2e 66 6f 72 6d 2d 69 6e 6c 69 6e 65 5f 5f 6e 6f 2d 62 6c 6f 63 6b 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 7d Data Ascii: }.profile-area__nav-header-partners{border-top:1px solid #bad4f7}.profile-area__nav-icon-svg{display:block;fill:var(--bui_color_white);height:26px;margin:0 auto 6px}.profile-area__nav li a:hover .bk-icon{fill:#5bbaff}.form-inline__no-block{display:inline}
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 34 29 20 69 6e 73 65 74 2c 30 20 31 70 78 20 32 30 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 34 29 7d 2e 75 73 65 72 2d 61 63 63 65 73 73 2d 66 6f 72 6d 2d 69 66 72 61 6d 65 20 23 69 61 6d 5f 69 66 72 61 6d 65 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 62 6f 72 64 65 72 3a 30 7d 2e 75 73 65 72 2d 61 63 63 65 73 73 2d 66 6f 72 6d 2d 69 66 72 61 6d 65 2d 70 61 64 64 69 6e 67 7b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 35 30 70 78 7d 2e 75 73 65 72 2d 61 63 63 65 73 73 2d 66 6f 72 6d 2d 69 66 72 61 6d 65 2d 6c 6f 61 64 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 62 Data Ascii: rgba(0,0,0,0.4) inset,0 1px 20px rgba(0,0,0,0.4)}.user-access-form-iframe #iam_iframe{background:#fff;border:0}.user-access-form-iframe-padding{width:100%;height:50px}.user-access-form-iframe-loader{position:absolute;top:0;left:0;width:100%;height:100%;b
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 68 65 61 72 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 2d 39 35 70 78 20 30 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 34 70 78 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 23 77 6c 5f 74 69 74 6c 65 20 2e 62 74 6e 7b 66 6c 6f 61 74 3a 72 69 67 68 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 74 6f 70 3a 35 70 78 7d 2e 61 64 64 5f 68 6f 74 65 6c 5f 6e 6f 74 65 20 2e 69 6e 70 75 74 54 65 78 74 7b 77 69 64 74 68 3a 33 32 30 70 78 3b 68 65 69 67 68 74 3a 35 30 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 33 70 78 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 63 63 63 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 35 70 78 7d 2e 77 6c 5f Data Ascii: heart{background-position:-95px 0;margin-right:4px;display:inline-block}#wl_title .btn{float:right;margin-left:10px;position:relative;top:5px}.add_hotel_note .inputText{width:320px;height:50px;border-radius:3px;border:1px solid #ccc;margin-bottom:5px}.wl_
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 62 75 74 74 6f 6e 73 2d 77 72 61 70 70 65 72 2d 2d 66 61 6c 6c 62 61 63 6b 20 2e 73 6f 63 69 61 6c 2d 63 6f 6e 6e 65 63 74 2d 62 75 74 74 6f 6e 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 66 6c 6f 61 74 3a 6c 65 66 74 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 77 69 64 74 68 3a 61 75 74 6f 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 2e 73 6f 63 69 61 6c 2d 63 6f 6e 6e 65 63 74 2d 62 75 74 74 6f 6e 2d 2d 77 65 63 68 61 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 63 66 2e 62 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f Data Ascii: buttons-wrapper--fallback .social-connect-button{display:block;float:left;-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box;width:auto;max-width:100%}.social-connect-button--wechat{background-image:url(//cf.bstatic.com/static/
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 76 65 72 7b 7a 2d 69 6e 64 65 78 3a 31 30 30 30 35 7d 2e 6d 6f 64 61 6c 2d 77 72 61 70 70 65 72 2e 66 65 65 64 62 61 63 6b 2d 6d 6f 64 61 6c 2d 77 72 61 70 70 65 72 5f 6f 76 65 72 7b 7a 2d 69 6e 64 65 78 3a 31 30 30 30 35 7d 2e 66 65 65 64 62 61 63 6b 2d 6c 6f 6f 70 2d 6c 69 67 68 74 62 6f 78 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 3a 30 3b 62 6f 72 64 65 72 3a 30 7d 2e 66 65 65 64 62 61 63 6b 2d 6c 6f 6f 70 2d 6c 69 67 68 74 62 6f 78 20 70 7b 6d 61 72 67 69 6e 3a 30 20 30 20 31 65 6d 20 30 7d 2e 66 65 65 64 62 61 63 6b 2d 6c 6f 6f 70 2d 6c 69 Data Ascii: ver{z-index:10005}.modal-wrapper.feedback-modal-wrapper_over{z-index:10005}.feedback-loop-lightbox{background:var(--bui_color_white);font-size:14px;line-height:1.4;display:none;margin:0;border:0}.feedback-loop-lightbox p{margin:0 0 1em 0}.feedback-loop-li
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 64 6f 74 63 6f 6d 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 62 34 32 64 22 7d 2e 62 69 63 6f 6e 2d 74 72 65 6e 64 2d 64 6f 77 6e 2d 72 69 67 68 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 62 34 32 63 22 7d 2e 62 69 63 6f 6e 2d 74 72 65 6e 64 2d 64 6f 77 6e 2d 6c 65 66 74 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 62 34 32 62 22 7d 2e 62 69 63 6f 6e 2d 68 69 6b 65 72 73 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 62 34 32 61 22 7d 2e 62 69 63 6f 6e 2d 6c 65 61 66 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 62 34 32 39 22 7d 2e 62 69 63 6f 6e 2d 70 65 6f 70 6c 65 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 62 34 32 38 22 7d 2e 62 69 63 6f 6e 2d 79 6f 67 61 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 Data Ascii: dotcom:before{content:"\b42d"}.bicon-trend-down-right:before{content:"\b42c"}.bicon-trend-down-left:before{content:"\b42b"}.bicon-hikers:before{content:"\b42a"}.bicon-leaf:before{content:"\b429"}.bicon-people:before{content:"\b428"}.bicon-yoga:before{cont

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49723	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:32 UTC	614	OUT	GET /static/css/incentives_cloudfront_sd.iq_ltr/f1558a6e9832a4eb8cfe1d3d14db176bd3564335.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:32 UTC	792	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 7107 Connection: close Server: nginx Date: Thu, 01 Feb 2024 10:18:10 GMT Last-Modified: Fri, 28 Jul 2023 11:29:02 GMT ETag: "64c3a67e-1bc3" Expires: Sat, 02 Mar 2024 10:18:10 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 e6c353101750d150139bda8d95719802.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: ok5etlu78QaVuvN3Ve4BSYPebbolr3NI9s0q7x1YmOCw4igF66MCTg== Age: 634642
2024-02-08 18:35:32 UTC	7107	IN	Data Raw: 2e 72 65 77 61 72 64 73 2d 69 6e 63 65 6e 74 69 70 70 79 7b 77 69 64 74 68 3a 32 34 70 78 3b 68 65 69 67 68 74 3a 32 34 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 27 2f 2f 63 66 2e 62 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 69 6d 67 2f 69 6e 63 65 6e 74 69 76 65 73 2f 69 6e 63 65 6e 74 69 70 70 79 2f 64 39 35 65 66 38 64 62 62 66 37 30 62 39 33 32 38 31 33 33 31 32 34 36 38 62 35 35 36 30 38 30 38 38 65 39 31 64 63 62 2e 73 76 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 35 30 25 20 35 30 25 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 32 34 70 78 20 32 34 70 78 7d 2e 72 65 77 61 72 64 73 2d 69 6e 63 65 6e 74 69 70 70 79 2d 67 72 61 79 7b 77 69 64 74 68 3a 32 34 70 78 3b 68 65 69 67 68 74 3a 32 34 70 78 3b 62 61 63 6b 67 72 6f Data Ascii: .rewards-incentippy{width:24px;height:24px;background:url('//cf.bstatic.com/static/img/incentives/incentippy/d95ef8dbbf70b932813312468b55608088e91dcb.svg') no-repeat 50% 50%;background-size:24px 24px}.rewards-incentippy-gray{width:24px;height:24px;backgro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49718	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:32 UTC	609	OUT	GET /static/css/index_cloudfront_sd.iq_ltr/903b49ae71c75322442d1bc9a0dc298bb8a6e32e.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:32 UTC	796	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 349603 Connection: close Server: nginx Date: Wed, 24 Jan 2024 14:09:45 GMT Last-Modified: Tue, 23 Jan 2024 12:08:22 GMT ETag: "65afac36-555a3" Expires: Fri, 23 Feb 2024 14:09:45 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 4a91a321d4c2ab7334c6f285093956ae.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: i1NujQF7g83dTep1hpQi3YZZZGql3tdc2dpZgeS7EOZtdz4EPDh-Uw== Age: 1311947
2024-02-08 18:35:32 UTC	15588	IN	Data Raw: 2e 64 65 73 74 69 6e 61 74 69 6f 6e 2d 73 75 67 67 65 73 74 69 6f 6e 20 75 6c 2c 2e 64 65 73 74 69 6e 61 74 69 6f 6e 2d 73 75 67 67 65 73 74 69 6f 6e 20 6c 69 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 62 6f 72 64 65 72 3a 30 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 7d 2e 64 65 73 74 69 6e 61 74 69 6f 6e 2d 73 75 67 67 65 73 74 69 6f 6e 20 75 6c 7b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d 2e 64 65 73 74 69 6e 61 74 69 6f 6e 2d 73 75 67 67 65 73 74 69 6f 6e 20 61 3a 6c 69 6e 6b 2c 2e 64 65 73 74 69 6e 61 74 69 6f 6e 2d 73 75 67 67 65 73 74 69 6f 6e 20 61 3a 76 69 73 69 74 65 64 2c 2e 64 65 73 74 69 6e 61 74 69 6f 6e 2d 73 75 67 67 65 73 74 69 6f 6e 20 61 3a 68 6f 76 65 72 2c 2e 64 65 73 74 69 6e 61 74 Data Ascii: .destination-suggestion ul,.destination-suggestion li{margin:0;padding:0;border:0;vertical-align:baseline}.destination-suggestion ul{list-style:none}.destination-suggestion a:link,.destination-suggestion a:visited,.destination-suggestion a:hover,.destinat
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 3a 30 3b 6c 65 66 74 3a 30 7d 2e 77 69 74 68 5f 72 65 63 5f 74 6f 6f 6c 74 69 70 20 2e 70 72 32 5f 62 67 7b 6d 61 72 67 69 6e 3a 31 35 70 78 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 74 72 61 6e 73 69 74 69 6f 6e 2d 33 30 30 6d 73 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 33 73 20 65 61 73 65 3b 2d 30 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 33 73 20 65 61 73 65 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 33 73 20 65 61 73 65 7d 2e 74 72 61 6e 73 69 74 69 6f 6e 2d 35 30 30 6d 73 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 35 73 20 65 61 73 65 3b 2d 30 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 35 73 20 65 61 73 65 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 35 73 20 Data Ascii: :0;left:0}.with_rec_tooltip .pr2_bg{margin:15px!important}.transition-300ms{-webkit-transition:all .3s ease;-0-transition:all .3s ease;transition:all .3s ease}.transition-500ms{-webkit-transition:all .5s ease;-0-transition:all .5s ease;transition:all .5s
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 57 33 31 71 71 70 46 6f 77 67 44 32 70 36 67 53 72 46 49 57 46 59 62 68 50 74 39 63 4c 67 50 4e 30 4b 4a 67 39 34 77 7a 38 57 42 58 73 48 41 7a 34 2f 77 61 45 7a 73 6d 63 77 75 4c 62 4f 5a 51 6c 64 36 43 7a 66 4f 64 58 6a 73 4c 6f 65 39 75 54 2f 4d 61 67 72 74 4e 48 78 6a 74 37 6a 7a 6d 36 73 6f 57 58 70 74 55 53 38 31 6f 67 2f 2f 7a 34 58 4c 78 73 4c 41 53 67 41 41 41 41 41 53 55 56 4f 52 4b 35 43 59 49 49 41 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 31 32 70 78 20 35 30 25 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 34 32 70 78 7d 61 2e 74 6f 70 5f 64 65 73 74 5f 6d 6f 72 65 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 Data Ascii: W31qqpFowgD2p6gSrFIWFYbhPt9cLgPN0KJg94wz8WBXsHAz4/waEzsmcwuLbOZQld6CzfOdXjsLoe9uT/MagrtNHxjt7jzm6soWXptUS81og//z4XLxsLASgAAAAASUVORK5CYIIA);background-position:12px 50%;background-repeat:no-repeat;padding-left:42px}a.top_dest_more:hover{background-image:u
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 35 70 78 7d 2e 67 75 69 64 65 73 5f 69 6e 64 65 78 5f 65 6e 74 72 79 5f 70 6f 69 6e 74 20 2e 67 75 69 64 65 73 5f 65 6e 74 72 79 5f 70 6f 69 6e 74 2d 2d 74 69 74 6c 65 7b 6d 61 72 67 69 6e 3a 30 20 30 20 35 70 78 3b 70 61 64 64 69 6e 67 3a 30 7d 2e 67 75 69 64 65 73 5f 69 6e 64 65 78 5f 65 6e 74 72 79 5f 70 6f 69 6e 74 20 2e 67 75 69 64 65 73 5f 65 6e 74 72 79 5f 70 6f 69 6e 74 2d 2d 63 6f 70 79 7b 6d 61 72 67 69 6e 3a 30 20 30 20 2e 37 35 65 6d 20 30 7d 2e 67 75 69 64 65 73 5f 69 6e 64 65 78 5f 65 6e 74 72 79 5f 70 6f 69 6e 74 20 2e 67 75 69 64 65 73 5f 69 6e 64 65 78 5f 65 6e 74 72 79 5f 70 6f 69 6e 74 2d 2d 62 6f 64 79 20 2e 67 75 69 64 65 73 5f 65 6e 74 72 79 5f 70 6f 69 6e 74 2d 2d 63 74 61 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 Data Ascii: 5px}.guides_index_entry_point .guides_entry_point--title{margin:0 0 5px;padding:0}.guides_index_entry_point .guides_entry_point--copy{margin:0 0 .75em 0}.guides_index_entry_point .guides_index_entry_point--body .guides_entry_point--cta{background-color:#0
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 2e 72 65 76 69 65 77 5f 63 74 61 5f 62 75 74 74 6f 6e 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 30 30 33 35 38 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 38 36 30 70 78 29 7b 6c 61 62 65 6c 2e 72 65 76 69 65 77 5f 63 74 61 5f 6c 61 62 65 6c 7b 77 69 64 74 68 3a 31 30 30 25 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 65 6d 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 30 7d 61 2e 72 65 76 69 65 77 5f 63 74 61 5f 62 75 74 74 6f 6e 7b 77 69 64 74 68 3a 39 32 25 7d 6c 61 62 65 6c 2e 72 65 76 69 65 77 5f 63 74 61 5f 6c 61 62 65 6c 5f 72 74 6c 7b 77 69 64 74 68 3a 31 30 30 25 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 65 6d 3b 70 61 64 64 69 6e 67 2d Data Ascii: coration:none}a.review_cta_button:hover{background:#003580}@media screen and (max-width:860px){label.review_cta_label{width:100%;margin-bottom:1em;padding-top:0}a.review_cta_button{width:92%}label.review_cta_label_rtl{width:100%;margin-bottom:1em;padding-
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 75 73 2d 2d 62 6f 64 79 2d 2d 69 6d 61 67 65 7b 2d 77 65 62 6b 69 74 2d 61 6c 69 67 6e 2d 73 65 6c 66 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 69 74 65 6d 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 73 65 6c 66 3a 63 65 6e 74 65 72 3b 68 65 69 67 68 74 3a 31 33 30 70 78 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 32 34 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 32 34 70 78 3b 77 69 64 74 68 3a 31 33 30 70 78 7d 2e 67 65 6e 69 75 73 2d 6c 65 76 65 6c 73 2d 73 74 61 74 75 73 5f 5f 6e 65 77 2d 69 64 65 6e 74 69 74 79 20 2e 67 65 6e 69 75 73 2d 6c 65 76 65 6c 73 2d 73 74 61 74 75 73 2d 2d 6c 69 73 74 2d 2d 69 63 6f 6e 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 38 70 78 3b 2d 77 65 62 6b 69 74 2d 61 6c 69 67 6e 2d 73 65 6c 66 3a 66 6c Data Ascii: us--body--image{-webkit-align-self:center;-ms-flex-item-align:center;align-self:center;height:130px;margin-left:24px;margin-right:24px;width:130px}.genius-levels-status__new-identity .genius-levels-status--list--icon{margin-right:8px;-webkit-align-self:fl
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 2d 6e 61 6d 65 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 7d 2e 72 6c 70 2d 73 69 64 65 62 61 72 2d 6e 61 76 2d 62 74 6e 5f 5f 68 6f 74 65 6c 2d 64 65 73 63 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 77 6f 72 64 2d 62 72 65 61 6b 3a 62 72 65 61 6b 2d 77 6f 72 64 7d 2e 72 6c 70 2d 6e 61 76 2d 2d 73 75 62 63 6f 75 6e 74 72 79 7b 68 65 69 67 68 74 3a 34 35 70 78 7d 2e 72 6c 70 2d 6e 61 76 5f 5f 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 78 2d 77 69 64 74 68 3a 31 30 39 36 70 78 3b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 20 37 70 78 7d 2e 72 6c 70 2d 6e 61 76 2d 62 74 6e 2d 2d 73 75 62 63 6f 75 6e 74 72 79 7b 70 61 64 64 69 6e 67 3a 30 20 35 70 78 20 30 20 30 7d 2e 72 6c 70 2d Data Ascii: -name{font-weight:bold}.rlp-sidebar-nav-btn__hotel-desc{display:inline;word-break:break-word}.rlp-nav--subcountry{height:45px}.rlp-nav__container{max-width:1096px;list-style:none;margin:0 auto;padding:0 7px}.rlp-nav-btn--subcountry{padding:0 5px 0 0}.rlp-
2024-02-08 18:35:33 UTC	14028	IN	Data Raw: 72 67 69 6e 3a 31 30 70 78 3b 70 61 64 64 69 6e 67 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 72 67 62 61 28 30 2c 35 32 2c 31 32 37 2c 30 2e 36 31 29 7d 2e 70 61 73 73 69 6f 6e 5f 62 61 6e 6e 65 72 5f 5f 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 2e 70 61 73 73 69 6f 6e 5f 62 61 6e 6e 65 72 5f 5f 74 69 74 6c 65 2d 2d 73 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 38 70 78 7d 2e 70 61 73 73 69 6f 6e 5f 62 61 6e 6e 65 72 5f 5f 73 75 62 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 6d 61 72 67 69 6e 3a 35 70 78 20 30 20 31 30 70 78 20 30 7d Data Ascii: rgin:10px;padding:12px;color:var(--bui_color_white);background:rgba(0,52,127,0.61)}.passion_banner__title{font-size:34px;font-weight:700}.passion_banner__title--s{font-size:28px}.passion_banner__subtitle{font-size:16px;font-weight:400;margin:5px 0 10px 0}
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 3b 68 65 69 67 68 74 3a 31 65 6d 3b 74 6f 70 3a 32 36 70 78 7d 2e 64 65 73 74 69 6e 61 74 69 6f 6e 2d 70 6f 73 74 63 61 72 64 2d 63 6f 6d 62 69 6e 65 64 20 2e 69 6e 64 65 78 5f 70 6f 70 75 6c 61 72 5f 64 65 73 74 69 6e 61 74 69 6f 6e 73 2c 2e 75 6e 69 66 69 65 64 2d 70 6f 73 74 63 61 72 64 20 2e 69 6e 64 65 78 5f 70 6f 70 75 6c 61 72 5f 64 65 73 74 69 6e 61 74 69 6f 6e 73 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 62 6f 72 64 65 72 3a 30 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 20 31 35 70 78 20 30 7d 2e 64 65 73 74 69 6e 61 74 69 6f 6e 2d 70 6f 73 74 63 61 72 64 2d 63 6f 6d 62 69 6e 65 64 20 2e 69 6e 64 65 78 5f 70 6f 70 75 6c 61 72 Data Ascii: em;line-height:1;height:1em;top:26px}.destination-postcard-combined .index_popular_destinations,.unified-postcard .index_popular_destinations{background:transparent;text-align:left;border:0;padding:10px 15px 0}.destination-postcard-combined .index_popular
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 5f 62 6f 64 79 5f 32 5f 66 6f 6e 74 2d 77 65 69 67 68 74 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 62 6f 64 79 5f 32 5f 6c 69 6e 65 2d 68 65 69 67 68 74 29 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 62 6f 64 79 5f 32 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 70 61 64 64 69 6e 67 3a 34 70 78 20 38 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 34 70 78 7d 2e 70 72 6f 6d 6f 74 69 6f 6e 2d 70 6f 73 74 63 61 72 64 73 5f 5f 72 6f 77 7b 70 Data Ascii: _body_2_font-weight);line-height:var(--bui_font_body_2_line-height);font-family:var(--bui_font_body_2_font-family);-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box;padding:4px 8px;border-radius:4px}.promotion-postcards__row{p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49721	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:32 UTC	608	OUT	GET /static/css/main_cloudfront_sd.iq_ltr/e6474733abba1cd6bc8a66bea1aa8643d7435c30.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:32 UTC	796	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 574511 Connection: close Server: nginx Date: Mon, 22 Jan 2024 14:01:36 GMT Last-Modified: Mon, 22 Jan 2024 09:26:03 GMT ETag: "65ae34ab-8c42f" Expires: Wed, 21 Feb 2024 14:01:36 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 a53ebc5c4d12bc9682b9c11ea18dccbe.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: nDgy7HQfT_LG2-7UkMryXHEiNpkU4-5gQDB3sODeDlfeyX_TM3o_Lg== Age: 1485236
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 3a 72 6f 6f 74 2c 5b 64 61 74 61 2d 62 75 69 2d 74 68 65 6d 65 3d 22 74 72 61 76 65 6c 6c 65 72 2d 6c 69 67 68 74 22 5d 7b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 3a 23 38 36 38 36 38 36 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 5f 61 6c 74 3a 23 65 37 65 37 65 37 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 62 6f 72 64 65 72 3a 23 30 30 36 63 65 34 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 5f 64 69 73 61 62 6c 65 64 3a 23 64 39 64 39 64 39 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 62 6f 72 64 65 72 3a 23 64 34 31 31 31 65 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 6f 6e 73 74 72 75 63 74 69 76 65 5f 62 6f 72 64 65 72 3a 23 30 30 38 32 33 34 3b 2d 2d 62 75 69 5f 63 Data Ascii: :root,[data-bui-theme="traveller-light"]{--bui_color_border:#868686;--bui_color_border_alt:#e7e7e7;--bui_color_action_border:#006ce4;--bui_color_border_disabled:#d9d9d9;--bui_color_destructive_border:#d4111e;--bui_color_constructive_border:#008234;--bui_c
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 72 69 66 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 31 5f 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 31 5f 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 31 5f 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 34 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 31 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 53 65 67 6f 65 20 55 49 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 32 5f 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b Data Ascii: rif;--bui_font_strong_1_font-size:16px;--bui_font_strong_1_font-weight:700;--bui_font_strong_1_line-height:24px;--bui_font_strong_1_font-family:BlinkMacSystemFont,-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;--bui_font_strong_2_font-size:14px;
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 65 3a 34 38 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 33 5f 66 6f 6e 74 2d 77 65 69 67 68 74 3a 38 30 30 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 33 5f 6c 69 6e 65 2d 68 65 69 67 68 74 3a 36 32 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 33 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 42 6c 75 65 20 53 61 6e 73 22 2c 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 53 65 67 6f 65 20 55 49 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 31 5f 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 66 65 61 74 Data Ascii: e:48px;--bui_font_display_3_font-weight:800;--bui_font_display_3_line-height:62px;--bui_font_display_3_font-family:"Blue Sans",BlinkMacSystemFont,-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;--bui_font_featured_1_font-size:32px;--bui_font_feat
2024-02-08 18:35:33 UTC	14808	IN	Data Raw: 61 74 75 72 65 64 5f 32 5f 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 38 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 32 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 42 6c 75 65 20 53 61 6e 73 22 2c 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 53 65 67 6f 65 20 55 49 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 33 5f 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 33 5f 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 33 5f 6c 69 6e 65 2d 68 65 69 67 68 Data Ascii: atured_2_line-height:28px;--bui_font_featured_2_font-family:"Blue Sans",BlinkMacSystemFont,-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;--bui_font_featured_3_font-size:20px;--bui_font_featured_3_font-weight:400;--bui_font_featured_3_line-heigh
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 6c 6f 72 5f 68 69 67 68 6c 69 67 68 74 65 64 5f 61 6c 74 3a 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 2c 30 2e 31 32 29 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 66 6f 63 75 73 3a 72 67 62 61 28 32 35 35 2c 39 32 2c 39 32 2c 30 2e 32 34 29 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 68 69 67 68 6c 69 67 68 74 65 64 5f 61 6c 74 3a 72 67 62 61 28 36 31 2c 31 37 34 2c 32 35 35 2c 30 2e 31 32 29 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 68 69 67 68 6c 69 67 68 74 65 64 5f 61 6c 74 3a 72 67 62 61 28 32 35 35 2c 39 32 2c 39 32 2c 30 2e 31 32 29 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 6f 6e 5f 62 61 63 6b 67 72 6f 75 6e 64 3a 23 32 36 32 36 32 36 3b 2d 2d 62 75 69 5f 63 6f 6c Data Ascii: lor_highlighted_alt:rgba(255,255,255,0.12);--bui_color_destructive_focus:rgba(255,92,92,0.24);--bui_color_action_highlighted_alt:rgba(61,174,255,0.12);--bui_color_destructive_highlighted_alt:rgba(255,92,92,0.12);--bui_color_on_background:#262626;--bui_col
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 74 69 6d 69 6e 67 2d 73 6c 6f 77 3a 33 30 30 6d 73 3b 2d 2d 62 75 69 5f 74 69 6d 69 6e 67 2d 73 6c 6f 77 65 72 3a 36 30 30 6d 73 3b 2d 2d 62 75 69 5f 74 69 6d 69 6e 67 2d 73 6c 6f 77 65 73 74 3a 31 30 30 30 6d 73 3b 2d 2d 62 75 69 5f 74 69 6d 69 6e 67 2d 70 61 75 73 65 64 3a 31 36 30 30 6d 73 3b 2d 2d 62 75 69 5f 62 61 73 65 6c 69 6e 65 3a 32 34 70 78 3b 2d 2d 62 75 69 5f 70 61 64 64 69 6e 67 3a 31 32 70 78 3b 2d 2d 62 75 69 5f 6e 65 67 61 74 69 76 65 5f 70 61 64 64 69 6e 67 3a 2d 31 32 70 78 3b 2d 2d 62 75 69 5f 6d 65 64 69 75 6d 5f 62 72 65 61 6b 70 6f 69 6e 74 3a 35 37 36 70 78 3b 2d 2d 62 75 69 5f 6c 61 72 67 65 5f 62 72 65 61 6b 70 6f 69 6e 74 3a 31 30 32 34 70 78 3b 2d 2d 62 75 69 5f 68 75 67 65 5f 62 72 65 61 6b 70 6f 69 6e 74 3a 31 32 38 30 70 78 Data Ascii: timing-slow:300ms;--bui_timing-slower:600ms;--bui_timing-slowest:1000ms;--bui_timing-paused:1600ms;--bui_baseline:24px;--bui_padding:12px;--bui_negative_padding:-12px;--bui_medium_breakpoint:576px;--bui_large_breakpoint:1024px;--bui_huge_breakpoint:1280px
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 61 64 64 69 6e 67 2d 74 6f 70 2d 2d 34 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 75 6e 69 74 5f 73 6d 61 6c 6c 29 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 62 75 69 2d 75 2d 70 61 64 64 69 6e 67 2d 74 6f 70 2d 2d 38 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 75 6e 69 74 5f 6d 65 64 69 75 6d 29 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 62 75 69 2d 75 2d 70 61 64 64 69 6e 67 2d 74 6f 70 2d 2d 31 36 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 75 6e 69 74 5f 6c 61 72 67 65 29 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 62 75 69 2d 75 2d 70 61 64 64 69 6e 67 2d 74 6f 70 2d 2d 32 34 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 75 6e 69 74 5f 6c 61 72 67 65 72 29 21 69 6d 70 6f 72 Data Ascii: adding-top--4{padding-top:var(--bui_unit_small)!important}.bui-u-padding-top--8{padding-top:var(--bui_unit_medium)!important}.bui-u-padding-top--16{padding-top:var(--bui_unit_large)!important}.bui-u-padding-top--24{padding-top:var(--bui_unit_larger)!impor
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 62 75 69 2d 61 6c 65 72 74 5f 5f 74 65 78 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 2e 62 75 69 2d 61 6c 65 72 74 5f 5f 74 65 78 74 3a 66 69 72 73 74 2d 63 68 69 6c 64 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 68 61 6c 66 29 7d 2e 62 75 69 2d 61 6c 65 72 74 5f 5f 74 65 78 74 3a 6c 61 73 74 2d 63 68 69 6c 64 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 62 75 69 2d 61 6c 65 72 74 2d 2d 69 6e 66 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 61 6c 6c 6f 75 74 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 61 6c 74 29 3b 62 6f 72 64 65 72 2d 63 Data Ascii: argin-bottom:0}.bui-alert__text{margin:0 0 var(--bui_spacing_4x)}.bui-alert__text:first-child{margin-top:var(--bui_spacing_half)}.bui-alert__text:last-child{margin-bottom:0}.bui-alert--info{background-color:var(--bui_color_callout_background_alt);border-c
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 65 64 69 61 20 2e 62 75 69 2d 62 61 6e 6e 65 72 5f 5f 74 69 74 6c 65 7b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 5b 64 69 72 3d 72 74 6c 5d 20 2e 62 75 69 2d 62 61 6e 6e 65 72 2d 2d 6d 65 64 69 61 20 2e 62 75 69 2d 62 61 6e 6e 65 72 5f 5f 74 69 74 6c 65 7b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 7d 2e 62 75 69 2d 62 61 6e 6e 65 72 2d 2d 6d 65 64 69 61 20 2e 62 75 69 2d 62 61 6e 6e 65 72 5f 5f 63 6c 6f 73 65 7b 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 3b 72 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 3b 66 69 6c 6c 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 3b 6f 70 61 63 69 74 79 3a 2e 38 7d 5b 64 69 72 3d Data Ascii: edia .bui-banner__title{padding-right:0}[dir=rtl] .bui-banner--media .bui-banner__title{padding-right:0;padding-left:0}.bui-banner--media .bui-banner__close{top:var(--bui_spacing_4x);right:var(--bui_spacing_4x);fill:var(--bui_color_white);opacity:.8}[dir=
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 62 75 74 74 6f 6e 2d 2d 64 65 73 74 72 75 63 74 69 76 65 3a 61 63 74 69 76 65 2c 2e 62 75 69 2d 62 75 74 74 6f 6e 2d 2d 64 65 73 74 72 75 63 74 69 76 65 3a 66 6f 63 75 73 2c 2e 62 75 69 2d 62 75 74 74 6f 6e 2d 2d 64 65 73 74 72 75 63 74 69 76 65 3a 68 6f 76 65 72 2c 2e 62 75 69 2d 62 75 74 74 6f 6e 2d 2d 64 65 73 74 72 75 63 74 69 76 65 3a 6c 69 6e 6b 2c 2e 62 75 69 2d 62 75 74 74 6f 6e 2d 2d 64 65 73 74 72 75 63 74 69 76 65 3a 76 69 73 69 74 65 64 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 6f 6e 5f 64 65 73 74 72 75 63 74 69 76 65 5f 62 61 63 6b 67 72 6f 75 6e 64 29 7d 2e 62 75 69 2d 62 75 74 74 6f 6e 2d 2d 64 65 73 74 72 75 63 74 69 76 65 3a 6e 6f 74 28 2e 62 75 69 2d 69 73 2d 6c 6f 61 64 69 6e 67 29 3a 68 6f 76 65 72 3a 62 65 Data Ascii: button--destructive:active,.bui-button--destructive:focus,.bui-button--destructive:hover,.bui-button--destructive:link,.bui-button--destructive:visited{color:var(--bui_color_on_destructive_background)}.bui-button--destructive:not(.bui-is-loading):hover:be

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49726	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:32 UTC	630	OUT	GET /static/js/core-deps-inlinedet_cloudfront_sd/789c67928e597e7a413f9e99763adab71edbbfa8.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:32 UTC	807	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 50383 Connection: close Server: nginx Date: Fri, 02 Feb 2024 09:35:24 GMT Last-Modified: Fri, 02 Feb 2024 09:08:58 GMT ETag: "65bcb12a-c4cf" Expires: Sun, 03 Mar 2024 09:35:24 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 76f3fedc86826a7b266250e33ee41082.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Pkjjv8l2i4BQf11_L08VaD8YSCfashIn_T5iI4D5S_NDj0gD7laZGg== Age: 550808
2024-02-08 18:35:32 UTC	15577	IN	Data Raw: 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 65 6e 61 62 6c 65 5f 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 26 26 28 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 2e 63 6f 72 65 5f 64 65 70 73 3d 7b 6c 6f 61 64 65 64 3a 21 30 2c 72 75 6e 3a 21 31 7d 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 2f 2a 2a 0a 20 20 20 20 20 2a 20 40 6c 69 63 65 6e 73 65 20 61 6c 6d 6f 6e 64 20 30 2e 33 2e 30 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 31 31 2d 32 30 31 34 2c 20 54 68 65 20 44 6f 6a 6f 20 46 6f 75 6e 64 61 74 69 6f 6e 20 41 6c 6c 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2e 0a 20 20 20 20 20 2a 20 41 76 61 69 6c 61 62 6c 65 20 76 69 61 20 74 68 65 20 4d 49 54 20 6f 72 20 6e 65 77 20 42 53 44 20 6c 69 63 65 6e 73 65 Data Ascii: booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.core_deps={loaded:!0,run:!1}),function(){/** * @license almond 0.3.0 Copyright (c) 2011-2014, The Dojo Foundation All Rights Reserved. * Available via the MIT or new BSD license
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 20 22 29 2c 6c 3d 70 61 72 73 65 49 6e 74 28 63 5b 32 5d 2d 63 5b 30 5d 2c 31 30 29 2c 66 3d 70 61 72 73 65 49 6e 74 28 63 5b 33 5d 2d 63 5b 31 5d 2c 31 30 29 3b 74 26 26 21 72 3f 72 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 74 2f 28 66 2f 6c 29 29 3a 72 26 26 21 74 26 26 28 74 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 72 2f 28 6c 2f 66 29 29 29 2c 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 6e 2c 7b 77 69 64 74 68 3a 72 7c 7c 6c 2c 68 65 69 67 68 74 3a 74 7c 7c 66 2c 76 69 65 77 42 6f 78 3a 73 2c 63 6c 61 73 73 3a 69 7d 29 3b 76 61 72 20 64 3d 7b 63 6f 6c 6f 72 3a 22 66 69 6c 6c 22 7d 2c 70 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 6e 29 2e 72 65 64 75 63 65 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 65 2b 22 20 22 2b 28 64 5b 74 5d 7c 7c 74 29 2b Data Ascii: "),l=parseInt(c[2]-c[0],10),f=parseInt(c[3]-c[1],10);t&&!r?r=Math.floor(t/(f/l)):r&&!t&&(t=Math.floor(r/(l/f))),Object.assign(n,{width:r\|\|l,height:t\|\|f,viewBox:s,class:i});var d={color:"fill"},p=Object.keys(n).reduce(function(e,t){return e+" "+(d[t]\|\|t)+
2024-02-08 18:35:32 UTC	16009	IN	Data Raw: 6e 3d 61 5b 69 5d 29 2e 69 6e 64 65 78 4f 66 28 22 20 22 29 29 26 26 28 74 3d 6e 2e 73 6c 69 63 65 28 6f 2b 31 29 2c 6e 3d 6e 2e 73 6c 69 63 65 28 30 2c 6f 29 29 2c 75 2e 70 75 73 68 28 7b 65 76 74 3a 6e 2c 6e 6f 64 65 3a 74 7d 29 3b 72 65 74 75 72 6e 20 75 7d 28 65 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 69 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 65 28 21 30 29 7d 66 6f 72 28 3b 72 2e 6c 65 6e 67 74 68 3b 29 73 77 69 74 63 68 28 6e 3d 72 2e 70 6f 70 28 29 2c 21 30 29 7b 63 61 73 65 22 76 69 65 77 22 3d 3d 3d 6e 2e 65 76 74 26 26 21 21 6e 2e 6e 6f 64 65 3a 6f 28 6e 2e 6e 6f 64 65 2c 74 29 3b 62 72 65 61 6b 3b 63 61 73 65 21 21 6e 2e 6e 6f 64 65 3a 63 28 6e 2e 6e 6f 64 65 29 2e 6f 6e 65 28 6e 2e 65 76 74 2c 74 29 3b 62 Data Ascii: n=a[i]).indexOf(" "))&&(t=n.slice(o+1),n=n.slice(0,o)),u.push({evt:n,node:t});return u}(e);return new i(function(e){function t(){e(!0)}for(;r.length;)switch(n=r.pop(),!0){case"view"===n.evt&&!!n.node:o(n.node,t);break;case!!n.node:c(n.node).one(n.evt,t);b
2024-02-08 18:35:32 UTC	2413	IN	Data Raw: 65 72 43 61 73 65 28 29 3a 73 29 29 2c 6f 3d 76 2e 67 65 74 46 75 6c 6c 43 6f 75 6e 74 72 79 4e 61 6d 65 28 69 29 7c 7c 76 2e 67 65 74 46 75 6c 6c 43 6f 75 6e 74 72 79 4e 61 6d 65 28 76 2e 72 65 61 64 50 72 6f 70 46 72 6f 6d 45 6e 76 28 22 62 5f 63 6f 75 6e 74 72 79 63 6f 64 65 22 29 29 2c 61 3d 61 7c 7c 76 2e 72 65 61 64 50 72 6f 70 46 72 6f 6d 45 6e 76 28 22 62 5f 64 65 73 74 69 6e 61 74 69 6f 6e 5f 6e 61 6d 65 22 29 3b 76 61 72 20 6c 3d 7b 69 74 65 6d 73 3a 5b 5d 2c 5f 63 6c 65 61 72 3a 21 30 2c 70 61 79 6d 65 6e 74 5f 6f 70 74 69 6f 6e 3a 76 6f 69 64 20 30 2c 70 61 79 6d 65 6e 74 5f 6d 65 74 68 6f 64 3a 76 6f 69 64 20 30 7d 2c 66 3d 7b 69 74 65 6d 5f 69 64 3a 65 7c 7c 76 2e 72 65 61 64 50 72 6f 70 46 72 6f 6d 45 6e 76 28 22 62 5f 68 6f 74 65 6c 5f 69 Data Ascii: erCase():s)),o=v.getFullCountryName(i)\|\|v.getFullCountryName(v.readPropFromEnv("b_countrycode")),a=a\|\|v.readPropFromEnv("b_destination_name");var l={items:[],_clear:!0,payment_option:void 0,payment_method:void 0},f={item_id:e\|\|v.readPropFromEnv("b_hotel_i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49720	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:32 UTC	613	OUT	GET /static/css/main_exps_cloudfront_sd.iq_ltr/586b07455f7783cafa801bdea38881f1f98ad36d.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:32 UTC	795	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 137014 Connection: close Server: nginx Date: Thu, 01 Feb 2024 14:45:12 GMT Last-Modified: Tue, 03 Oct 2023 11:16:32 GMT ETag: "651bf810-21736" Expires: Sat, 02 Mar 2024 14:45:12 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 4a9f56098c7d51e12b8d2ac77b6f1bcc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Rg2MmCvzRgg7fkPeo32hlHS416IiO-dZ3nKwm5MV4lC1LmPiAAAxCg== Age: 618620
2024-02-08 18:35:32 UTC	15589	IN	Data Raw: 2e 62 62 74 6f 6f 6c 2d 6e 6f 74 69 66 69 63 61 74 69 6f 6e 7b 63 6c 65 61 72 3a 62 6f 74 68 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 36 65 36 65 36 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 66 61 66 63 66 66 7d 2e 62 62 74 6f 6f 6c 2d 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2d 2d 74 6f 70 2d 6d 65 6e 75 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 65 62 66 33 66 66 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 31 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 29 3b Data Ascii: .bbtool-notification{clear:both;position:relative;background-color:#e6e6e6;border-bottom:1px solid #fafcff}.bbtool-notification--top-menu{background-color:var(--bui_color_white);border-bottom:1px solid #ebf3ff;-webkit-box-shadow:0 1px 2px rgba(0,0,0,0.1);
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 69 6e 20 2e 63 32 2d 64 61 79 3a 68 6f 76 65 72 2c 2e 63 32 2d 77 72 61 70 70 65 72 2d 73 2d 72 61 6e 67 65 2d 61 72 72 6f 77 73 2e 63 32 2d 77 72 61 70 70 65 72 2d 73 2d 63 68 65 63 6b 6f 75 74 20 2e 63 32 2d 64 61 79 2d 73 2d 73 65 6c 65 63 74 65 64 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 27 2f 2f 63 66 2e 62 73 74 61 74 69 63 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 69 6d 67 2f 65 78 70 65 72 69 6d 65 6e 74 73 2f 63 61 6c 32 5f 64 69 72 65 63 74 69 6f 6e 61 6c 5f 61 72 72 6f 77 73 2f 33 34 62 62 61 66 36 63 34 37 33 65 32 30 33 37 31 36 34 38 30 35 38 65 34 62 35 37 32 66 32 31 30 35 38 36 62 36 65 63 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 63 32 2d 77 72 61 70 70 65 72 2d 73 2d 72 61 6e 67 65 2d 61 72 72 Data Ascii: in .c2-day:hover,.c2-wrapper-s-range-arrows.c2-wrapper-s-checkout .c2-day-s-selected{background:url('//cf.bstatic.com/static/img/experiments/cal2_directional_arrows/34bbaf6c473e20371648058e4b572f210586b6ec.png') no-repeat!important}.c2-wrapper-s-range-arr
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 74 3a 6e 6f 72 6d 61 6c 7d 2e 68 6f 74 65 6c 6c 69 73 74 20 2e 73 72 5f 69 74 65 6d 5f 63 6f 6e 74 65 6e 74 20 2e 62 2d 62 75 73 69 6e 65 73 73 2d 77 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 31 36 30 70 78 7d 2e 62 2d 62 75 73 69 6e 65 73 73 5f 5f 74 6f 6f 6c 74 69 70 3a 68 6f 76 65 72 20 2e 62 2d 62 75 73 69 6e 65 73 73 2d 77 7b 74 6f 70 3a 32 39 70 78 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6f 70 61 63 69 74 79 3a 31 7d 2e 62 2d 62 75 73 69 6e 65 73 73 2d 77 3a 62 65 66 6f 72 65 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 2d 31 30 70 78 3b 6c 65 66 74 3a 35 30 25 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 30 3b 68 65 69 67 68 74 3a 30 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 3b 63 6f 6e 74 65 Data Ascii: t:normal}.hotellist .sr_item_content .b-business-w{margin-left:-160px}.b-business__tooltip:hover .b-business-w{top:29px;display:block;opacity:1}.b-business-w:before{position:absolute;top:-10px;left:50%;display:block;width:0;height:0;margin-left:-5px;conte
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 65 69 67 68 74 3a 32 30 70 78 7d 2e 63 6f 6d 70 6f 6e 65 6e 74 2d 74 6f 6f 6c 74 69 70 2e 6f 6e 7b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 3b 6f 70 61 63 69 74 79 3a 31 3b 6d 61 72 67 69 6e 3a 30 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 2d 64 65 6c 61 79 3a 2e 32 73 3b 74 72 61 6e 73 69 74 69 6f 6e 2d 64 65 6c 61 79 3a 2e 32 73 7d 2e 6c 61 6e 64 6d 61 72 6b 2d 6d 61 70 7b 77 69 64 74 68 3a 33 38 30 70 78 7d 2e 73 62 2d 61 75 74 6f 63 6f 6d 70 6c 65 74 65 5f 5f 6c 69 73 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 35 30 30 70 78 3b 6d 61 78 2d 68 65 69 67 68 74 3a 6e 6f 6e 65 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a Data Ascii: eight:20px}.component-tooltip.on{visibility:visible;opacity:1;margin:0;-webkit-transition-delay:.2s;transition-delay:.2s}.landmark-map{width:380px}.sb-autocomplete__list{width:100%;min-width:500px;max-height:none;-webkit-box-sizing:border-box;-moz-box-siz
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 74 72 69 67 67 65 72 7b 63 6f 6c 6f 72 3a 23 33 33 33 7d 2e 6c 70 5f 73 62 5f 74 72 69 67 67 65 72 5f 63 6f 6e 74 61 69 6e 65 72 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 35 70 78 7d 2e 73 62 2d 6c 69 67 68 74 62 6f 78 2d 62 72 69 63 6b 2d 65 72 72 6f 72 7b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 36 29 3b 74 6f 70 3a 30 3b 62 6f 74 74 6f 6d 3a 30 3b 6c 65 66 74 3a 30 3b 72 69 67 68 74 3a 30 3b 7a 2d 69 6e 64 65 78 3a 39 39 39 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 73 62 2d 6c 69 67 68 74 62 6f 78 2d 62 72 69 63 6b 2d 65 72 72 6f 72 20 70 7b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 32 30 70 78 3b 62 61 Data Ascii: trigger{color:#333}.lp_sb_trigger_container{text-align:center;margin-bottom:15px}.sb-lightbox-brick-error{position:fixed;background:rgba(0,0,0,0.6);top:0;bottom:0;left:0;right:0;z-index:999;text-align:center}.sb-lightbox-brick-error p{padding:30px 20px;ba
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 2b 20 32 2e 34 65 6d 29 7d 40 73 75 70 70 6f 72 74 73 28 6d 61 73 6b 2d 74 79 70 65 3a 61 6c 70 68 61 29 7b 2e 73 62 2d 63 75 73 74 6f 6d 2d 73 65 6c 65 63 74 7b 6f 76 65 72 66 6c 6f 77 3a 76 69 73 69 62 6c 65 7d 2e 73 62 2d 63 75 73 74 6f 6d 2d 73 65 6c 65 63 74 20 73 65 6c 65 63 74 7b 2d 6d 6f 7a 2d 61 70 70 65 61 72 61 6e 63 65 3a 6e 6f 6e 65 3b 77 69 64 74 68 3a 31 30 30 25 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 65 6d 7d 7d 7d 2e 73 62 2d 63 75 73 74 6f 6d 2d 73 65 6c 65 63 74 20 73 65 6c 65 63 74 3a 2d 6d 6f 7a 2d 66 6f 63 75 73 72 69 6e 67 7b 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 74 65 78 74 2d 73 68 61 64 6f 77 3a 30 20 30 20 30 20 23 30 30 30 3b 6f 75 74 6c 69 6e 65 2d 63 6f 6c 6f 72 3a 23 33 38 33 38 33 38 3b 6f 75 74 6c Data Ascii: + 2.4em)}@supports(mask-type:alpha){.sb-custom-select{overflow:visible}.sb-custom-select select{-moz-appearance:none;width:100%;padding-right:2em}}}.sb-custom-select select:-moz-focusring{color:transparent;text-shadow:0 0 0 #000;outline-color:#383838;outl
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 6c 65 2d 64 61 74 65 73 2d 6d 6f 6e 74 68 2d 6e 61 6d 65 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 7d 2e 66 6c 65 78 69 62 6c 65 2d 64 61 74 65 73 2d 66 6f 6f 74 65 72 7b 62 6f 72 64 65 72 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 77 69 64 74 68 5f 31 30 30 29 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 5f 61 6c 74 29 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 38 78 29 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 72 69 67 68 74 7d 2e 66 6c 65 78 69 62 6c 65 2d 64 61 74 65 73 2d 66 6f 6f 74 65 72 2d 63 74 61 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a Data Ascii: le-dates-month-name{font-weight:500}.flexible-dates-footer{border-top:var(--bui_border_width_100) solid var(--bui_color_border_alt);margin-top:var(--bui_spacing_8x);padding-top:var(--bui_spacing_4x);text-align:right}.flexible-dates-footer-cta{margin-left:
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 6f 75 6e 64 3a 23 65 36 65 36 65 36 7d 62 6f 64 79 2e 62 62 74 5f 6e 65 77 5f 68 65 61 64 65 72 2e 6e 65 77 5f 67 65 6e 69 75 73 5f 62 72 61 6e 64 69 6e 67 20 23 75 73 65 72 5f 66 6f 72 6d 20 2e 75 73 65 72 5f 63 65 6e 74 65 72 5f 6e 61 76 20 6c 69 20 61 2e 70 6f 70 6f 76 65 72 5f 74 72 69 67 67 65 72 2e 67 65 6e 69 75 73 5f 75 73 65 72 5f 62 6f 78 5f 75 70 64 61 74 65 2c 62 6f 64 79 2e 62 62 74 5f 6e 65 77 5f 68 65 61 64 65 72 2e 6e 65 77 5f 67 65 6e 69 75 73 5f 62 72 61 6e 64 69 6e 67 20 23 75 73 65 72 5f 66 6f 72 6d 20 2e 75 73 65 72 5f 63 65 6e 74 65 72 5f 6e 61 76 20 6c 69 20 61 2e 70 6f 70 6f 76 65 72 5f 74 72 69 67 67 65 72 2e 67 65 6e 69 75 73 5f 75 73 65 72 5f 62 6f 78 5f 75 70 64 61 74 65 3a 68 6f 76 65 72 2c 62 6f 64 79 2e 62 62 74 5f 6e 65 77 Data Ascii: ound:#e6e6e6}body.bbt_new_header.new_genius_branding #user_form .user_center_nav li a.popover_trigger.genius_user_box_update,body.bbt_new_header.new_genius_branding #user_form .user_center_nav li a.popover_trigger.genius_user_box_update:hover,body.bbt_new
2024-02-08 18:35:33 UTC	6737	IN	Data Raw: 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 36 70 78 7d 2e 68 70 2d 63 61 72 2d 72 65 6e 74 61 6c 2d 62 61 6e 6e 65 72 5f 5f 63 6f 6e 74 65 6e 74 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 77 69 64 74 68 3a 35 30 30 70 78 7d 2e 68 70 2d 63 61 72 2d 72 65 6e 74 61 6c 2d 62 61 6e 6e 65 Data Ascii: kit-box;display:-webkit-flex;display:-ms-flexbox;display:flex;-webkit-box-align:center;-webkit-align-items:center;-ms-flex-align:center;align-items:center;margin-bottom:16px}.hp-car-rental-banner__content{text-align:center;width:500px}.hp-car-rental-banne

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49727	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:32 UTC	617	OUT	GET /static/js/jquery_cloudfront_sd/e1e8c0e862309cb4caf3c0d5fbea48bfb8eaad42.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:32 UTC	810	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 105026 Connection: close Server: nginx Date: Sun, 21 Jan 2024 09:54:57 GMT Last-Modified: Tue, 28 Jun 2022 13:43:41 GMT ETag: "62bb058d-19a42" Expires: Tue, 20 Feb 2024 09:54:57 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 31341771a4bfa40d7b1f61883ffb56c6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: LIJzMBkCOn7LdmJRoSxR2f3LmQlp1cZ5k3S22fpy4DM-tf2ZCfoZWw== Age: 1586435
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 2f 2a 20 40 70 72 65 73 65 72 76 65 0a 20 2a 20 6a 51 75 65 72 79 20 4a 61 76 61 53 63 72 69 70 74 20 4c 69 62 72 61 72 79 20 76 31 2e 31 31 2e 33 0a 20 2a 20 68 74 74 70 3a 2f 2f 6a 71 75 65 72 79 2e 63 6f 6d 2f 0a 20 2a 0a 20 2a 20 49 6e 63 6c 75 64 65 73 20 53 69 7a 7a 6c 65 2e 6a 73 0a 20 2a 20 68 74 74 70 3a 2f 2f 73 69 7a 7a 6c 65 6a 73 2e 63 6f 6d 2f 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 30 35 2c 20 32 30 31 34 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 2c 20 49 6e 63 2e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 6c 69 63 65 6e 73 65 0a 20 2a 20 68 74 74 70 3a 2f 2f 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e Data Ascii: /* @preserve * jQuery JavaScript Library v1.11.3 * http://jquery.com/ * * Includes Sizzle.js * http://sizzlejs.com/ * * Copyright 2005, 2014 jQuery Foundation, Inc. and other contributors * Released under the MIT license * http://jquery.org/licen
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 74 29 7b 66 6f 72 28 76 61 72 20 6e 2c 72 3d 61 28 65 2c 6f 29 2c 69 3d 72 2e 6c 65 6e 67 74 68 3b 69 2d 2d 3b 29 65 5b 6e 3d 71 28 65 2c 72 5b 69 5d 29 5d 3d 21 28 74 5b 6e 5d 3d 72 5b 69 5d 29 7d 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 61 28 65 2c 30 2c 74 29 7d 3b 72 65 74 75 72 6e 20 61 7d 7d 2c 70 73 65 75 64 6f 73 3a 7b 6e 6f 74 3a 61 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 72 3d 5b 5d 2c 69 3d 5b 5d 2c 73 3d 66 28 65 2e 72 65 70 6c 61 63 65 28 24 2c 22 24 31 22 29 29 3b 72 65 74 75 72 6e 20 73 5b 4e 5d 3f 61 65 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 66 6f 72 28 76 61 72 20 69 2c 6f 3d 73 28 65 2c 6e 75 6c 6c 2c 72 2c 5b 5d 29 2c 61 3d 65 2e 6c 65 6e 67 74 68 3b 61 2d 2d 3b 29 28 69 3d 6f 5b 61 Data Ascii: t){for(var n,r=a(e,o),i=r.length;i--;)e[n=q(e,r[i])]=!(t[n]=r[i])}):function(e){return a(e,0,t)};return a}},pseudos:{not:ae(function(e){var r=[],i=[],s=f(e.replace($,"$1"));return s[N]?ae(function(e,t,n,r){for(var i,o=s(e,null,r,[]),a=e.length;a--;)(i=o[a
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 3f 65 5b 61 5d 3d 66 2e 70 6f 70 28 29 7c 7c 43 2e 67 75 69 64 2b 2b 3a 61 29 2c 75 5b 6c 5d 7c 7c 28 75 5b 6c 5d 3d 73 3f 7b 7d 3a 7b 74 6f 4a 53 4f 4e 3a 43 2e 6e 6f 6f 70 7d 29 2c 22 6f 62 6a 65 63 74 22 21 3d 74 79 70 65 6f 66 20 74 26 26 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 74 7c 7c 28 72 3f 75 5b 6c 5d 3d 43 2e 65 78 74 65 6e 64 28 75 5b 6c 5d 2c 74 29 3a 75 5b 6c 5d 2e 64 61 74 61 3d 43 2e 65 78 74 65 6e 64 28 75 5b 6c 5d 2e 64 61 74 61 2c 74 29 29 2c 6f 3d 75 5b 6c 5d 2c 72 7c 7c 28 6f 2e 64 61 74 61 7c 7c 28 6f 2e 64 61 74 61 3d 7b 7d 29 2c 6f 3d 6f 2e 64 61 74 61 29 2c 76 6f 69 64 20 30 21 3d 3d 6e 26 26 28 6f 5b 43 2e 63 61 6d 65 6c 43 61 73 65 28 74 29 5d 3d 6e 29 2c 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 3f Data Ascii: ?e[a]=f.pop()\|\|C.guid++:a),u[l]\|\|(u[l]=s?{}:{toJSON:C.noop}),"object"!=typeof t&&"function"!=typeof t\|\|(r?u[l]=C.extend(u[l],t):u[l].data=C.extend(u[l].data,t)),o=u[l],r\|\|(o.data\|\|(o.data={}),o=o.data),void 0!==n&&(o[C.camelCase(t)]=n),"string"==typeof t?
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 74 3a 76 2e 68 74 6d 6c 53 65 72 69 61 6c 69 7a 65 3f 5b 30 2c 22 22 2c 22 22 5d 3a 5b 31 2c 22 58 3c 64 69 76 3e 22 2c 22 3c 2f 64 69 76 3e 22 5d 7d 2c 67 65 3d 74 65 28 4e 29 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 4e 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 29 3b 66 75 6e 63 74 69 6f 6e 20 6d 65 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 2c 69 3d 30 2c 6f 3d 74 79 70 65 6f 66 20 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 21 3d 3d 4d 3f 65 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 74 7c 7c 22 2a 22 29 3a 74 79 70 65 6f 66 20 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 21 3d 3d 4d 3f 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 74 7c 7c 22 2a 22 29 3a 76 6f 69 64 20 30 Data Ascii: t:v.htmlSerialize?[0,"",""]:[1,"X<div>","</div>"]},ge=te(N).appendChild(N.createElement("div"));function me(e,t){var n,r,i=0,o=typeof e.getElementsByTagName!==M?e.getElementsByTagName(t\|\|""):typeof e.querySelectorAll!==M?e.querySelectorAll(t\|\|""):void 0
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 26 28 6e 75 6c 6c 21 3d 65 2e 65 6c 65 6d 2e 73 74 79 6c 65 5b 43 2e 63 73 73 50 72 6f 70 73 5b 65 2e 70 72 6f 70 5d 5d 7c 7c 43 2e 63 73 73 48 6f 6f 6b 73 5b 65 2e 70 72 6f 70 5d 29 3f 43 2e 73 74 79 6c 65 28 65 2e 65 6c 65 6d 2c 65 2e 70 72 6f 70 2c 65 2e 6e 6f 77 2b 65 2e 75 6e 69 74 29 3a 65 2e 65 6c 65 6d 5b 65 2e 70 72 6f 70 5d 3d 65 2e 6e 6f 77 7d 7d 7d 29 2e 73 63 72 6f 6c 6c 54 6f 70 3d 4a 65 2e 70 72 6f 70 48 6f 6f 6b 73 2e 73 63 72 6f 6c 6c 4c 65 66 74 3d 7b 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 6c 65 6d 2e 6e 6f 64 65 54 79 70 65 26 26 65 2e 65 6c 65 6d 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 28 65 2e 65 6c 65 6d 5b 65 2e 70 72 6f 70 5d 3d 65 2e 6e 6f 77 29 7d 7d 2c 43 2e 65 61 73 69 6e 67 3d 7b 6c 69 6e 65 61 72 3a 66 75 6e Data Ascii: &(null!=e.elem.style[C.cssProps[e.prop]]\|\|C.cssHooks[e.prop])?C.style(e.elem,e.prop,e.now+e.unit):e.elem[e.prop]=e.now}}}).scrollTop=Je.propHooks.scrollLeft={set:function(e){e.elem.nodeType&&e.elem.parentNode&&(e.elem[e.prop]=e.now)}},C.easing={linear:fun
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 26 26 28 28 69 5b 72 5d 3f 65 3a 6e 7c 7c 28 6e 3d 7b 7d 29 29 5b 72 5d 3d 74 5b 72 5d 29 3b 72 65 74 75 72 6e 20 6e 26 26 43 2e 65 78 74 65 6e 64 28 21 30 2c 65 2c 6e 29 2c 65 7d 4e 74 3d 4c 74 2e 65 78 65 63 28 45 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 7c 7c 5b 5d 2c 43 2e 65 78 74 65 6e 64 28 7b 61 63 74 69 76 65 3a 30 2c 6c 61 73 74 4d 6f 64 69 66 69 65 64 3a 7b 7d 2c 65 74 61 67 3a 7b 7d 2c 61 6a 61 78 53 65 74 74 69 6e 67 73 3a 7b 75 72 6c 3a 45 74 2c 74 79 70 65 3a 22 47 45 54 22 2c 69 73 4c 6f 63 61 6c 3a 2f 5e 28 3f 3a 61 62 6f 75 74 7c 61 70 70 7c 61 70 70 2d 73 74 6f 72 61 67 65 7c 2e 2b 2d 65 78 74 65 6e 73 69 6f 6e 7c 66 69 6c 65 7c 72 65 73 7c 77 69 64 67 65 74 29 3a 24 2f 2e 74 65 73 74 28 4e 74 5b 31 5d 29 2c 67 6c 6f 62 61 6c 3a Data Ascii: &&((i[r]?e:n\|\|(n={}))[r]=t[r]);return n&&C.extend(!0,e,n),e}Nt=Lt.exec(Et.toLowerCase())\|\|[],C.extend({active:0,lastModified:{},etag:{},ajaxSettings:{url:Et,type:"GET",isLocal:/^(?:about\|app\|app-storage\|.+-extension\|file\|res\|widget):$/.test(Nt[1]),global:
2024-02-08 18:35:33 UTC	6722	IN	Data Raw: 65 4e 6f 64 65 28 74 29 29 26 26 21 31 21 3d 3d 6e 2e 6e 6f 64 65 56 61 6c 75 65 3f 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3a 61 7d 2c 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3b 72 65 74 75 72 6e 21 31 3d 3d 3d 74 3f 6c 2e 72 65 6d 6f 76 65 41 74 74 72 28 65 2c 6e 29 3a 28 28 72 3d 6c 2e 70 72 6f 70 46 69 78 5b 6e 5d 7c 7c 6e 29 69 6e 20 65 26 26 28 65 5b 72 5d 3d 21 30 29 2c 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6e 2c 6e 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 29 2c 6e 7d 7d 2c 68 2e 74 65 73 74 28 69 29 26 26 63 28 22 6a 51 75 65 72 79 2e 66 6e 2e 61 74 74 72 28 27 22 2b 69 2b 22 27 29 20 6d 61 79 20 75 73 65 20 70 72 6f 70 65 72 74 79 20 69 6e 73 74 65 61 64 20 6f 66 20 61 74 74 72 69 62 75 74 65 22 Data Ascii: eNode(t))&&!1!==n.nodeValue?t.toLowerCase():a},set:function(e,t,n){var r;return!1===t?l.removeAttr(e,n):((r=l.propFix[n]\|\|n)in e&&(e[r]=!0),e.setAttribute(n,n.toLowerCase())),n}},h.test(i)&&c("jQuery.fn.attr('"+i+"') may use property instead of attribute"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49725	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:32 UTC	615	OUT	GET /static/js/main_cloudfront_sd/22b1462412c8a51090dedf2fbe6ad45b3d8e8cf4.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:32 UTC	809	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 584201 Connection: close Server: nginx Date: Mon, 05 Feb 2024 15:22:28 GMT Last-Modified: Mon, 05 Feb 2024 13:52:53 GMT ETag: "65c0e835-8ea09" Expires: Wed, 06 Mar 2024 15:22:28 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 f588325f7617672d954c4267c8bee1ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: OurIM1Z92cCdjqFtv8iiq4ushM2FlETDw-XPNAqozy0qHqzrcUc_pw== Age: 270784
2024-02-08 18:35:32 UTC	15575	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 63 61 6c 63 61 67 65 28 65 2c 74 2c 69 29 7b 72 65 74 75 72 6e 20 5f 69 5f 28 22 33 64 61 3a 66 38 37 38 34 30 31 34 22 29 2c 73 3d 28 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 2f 74 29 25 69 29 2e 74 6f 53 74 72 69 6e 67 28 29 2c 4c 65 61 64 69 6e 67 5a 65 72 6f 26 26 73 2e 6c 65 6e 67 74 68 3c 32 26 26 28 73 3d 22 30 22 2b 73 29 2c 5f 72 5f 28 22 3c 62 3e 22 2b 73 2b 22 3c 2f 62 3e 22 29 7d 66 75 6e 63 74 69 6f 6e 20 43 6f 75 6e 74 42 61 63 6b 28 65 29 7b 69 66 28 5f 69 5f 28 22 33 64 61 3a 37 33 32 63 32 33 35 36 22 29 2c 65 3c 30 29 Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};function calcage(e,t,i){return _i_("3da:f8784014"),s=(Math.floor(e/t)%i).toString(),LeadingZero&&s.length<2&&(s="0"+s),_r_("<b>"+s+"</b>")}function CountBack(e){if(_i_("3da:732c2356"),e<0)
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 77 69 6e 64 6f 77 2e 65 78 74 65 72 6e 61 6c 2e 41 64 64 46 61 76 6f 72 69 74 65 28 74 2c 65 29 3a 61 6c 65 72 74 28 22 53 6f 72 72 79 20 79 6f 75 72 20 62 72 6f 77 73 65 72 20 64 6f 65 73 6e 27 74 20 73 75 70 70 6f 72 74 20 74 68 69 73 20 66 75 6e 63 74 69 6f 6e 5c 6e 54 6f 20 62 6f 6f 6b 6d 61 72 6b 20 74 68 69 73 20 70 61 67 65 5c 6e 57 69 6e 64 6f 77 73 20 75 73 65 72 73 20 70 72 65 73 73 20 63 74 72 6c 20 2b 20 44 5c 6e 4d 61 63 20 75 73 65 72 73 20 70 72 65 73 73 20 63 6d 64 20 2b 20 44 22 29 2c 5f 72 5f 28 29 7d 2c 77 69 6e 64 6f 77 2e 68 69 64 65 46 72 61 6d 65 43 6f 6e 74 61 69 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 28 5f 69 5f 28 22 33 64 61 3a 35 65 36 65 36 31 65 62 22 29 2c 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 Data Ascii: window.external.AddFavorite(t,e):alert("Sorry your browser doesn't support this function\nTo bookmark this page\nWindows users press ctrl + D\nMac users press cmd + D"),_r_()},window.hideFrameContainer=function(e){(_i_("3da:5e6e61eb"),document.getElementB
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 7b 65 76 65 6e 74 73 3a 65 7d 29 2e 72 75 6e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 33 64 61 3a 66 37 33 62 39 34 30 34 22 29 2c 74 68 69 73 2e 66 72 61 67 6d 65 6e 74 4c 6f 61 64 46 72 61 67 6d 65 6e 74 28 29 2c 5f 72 5f 28 29 7d 2e 62 69 6e 64 28 74 68 69 73 29 29 2c 5f 72 5f 28 29 7d 2c 66 72 61 67 6d 65 6e 74 50 61 72 61 6d 41 74 74 72 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 33 64 61 3a 35 32 65 33 34 39 62 31 22 29 3b 66 6f 72 28 76 61 72 20 65 2c 74 2c 69 3d 7b 7d 2c 6e 3d 74 68 69 73 2e 65 6c 2e 61 74 74 72 69 62 75 74 65 73 2c 72 3d 30 2c 61 3d 6e 2e 6c 65 6e 67 74 68 3b 72 3c 61 3b 72 2b 2b 29 28 74 3d 28 65 3d 6e 5b 72 5d 29 2e 6e 6f 64 65 4e 61 6d 65 29 26 26 35 3c 74 2e 6c 65 6e 67 74 68 26 26 30 3d 3d 3d 74 2e 69 6e Data Ascii: {events:e}).run(function(){_i_("3da:f73b9404"),this.fragmentLoadFragment(),_r_()}.bind(this)),_r_()},fragmentParamAttrs:function(){_i_("3da:52e349b1");for(var e,t,i={},n=this.el.attributes,r=0,a=n.length;r<a;r++)(t=(e=n[r]).nodeName)&&5<t.length&&0===t.in
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 68 2e 66 6c 6f 6f 72 28 33 30 2e 36 30 30 31 2a 75 29 2c 69 3d 75 2d 31 2c 31 33 3c 75 26 26 28 63 2b 3d 31 2c 69 3d 75 2d 31 33 29 2c 6e 3d 63 2d 34 37 31 36 3b 76 61 72 20 66 3d 73 2d 31 39 34 38 30 38 34 2c 68 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 66 2f 31 30 36 33 31 29 3b 66 2d 3d 31 30 36 33 31 2a 68 3b 76 61 72 20 70 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 28 66 2d 2e 31 33 33 35 29 2f 28 31 30 36 33 31 2f 33 30 29 29 2c 6d 3d 33 30 2a 68 2b 70 3b 66 2d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 70 2a 28 31 30 36 33 31 2f 33 30 29 2b 2e 31 33 33 35 29 3b 76 61 72 20 76 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 28 66 2b 32 38 2e 35 30 30 31 29 2f 32 39 2e 35 29 3b 31 33 3d 3d 76 26 26 28 76 3d 31 32 29 3b 76 61 72 20 62 3d 66 2d 4d 61 74 68 2e 66 6c 6f 6f 72 28 32 39 Data Ascii: h.floor(30.6001u),i=u-1,13<u&&(c+=1,i=u-13),n=c-4716;var f=s-1948084,h=Math.floor(f/10631);f-=10631h;var p=Math.floor((f-.1335)/(10631/30)),m=30h+p;f-=Math.floor(p(10631/30)+.1335);var v=Math.floor((f+28.5001)/29.5);13==v&&(v=12);var b=f-Math.floor(29
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 2e 6f 66 66 28 22 6d 6f 75 73 65 6c 65 61 76 65 22 29 2e 6d 6f 75 73 65 6c 65 61 76 65 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 33 64 61 3a 65 61 66 35 39 32 36 38 22 29 2c 65 2e 5f 68 69 64 65 54 69 6d 65 6f 75 74 3d 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 33 64 61 3a 38 65 37 33 63 63 30 66 22 29 2c 65 2e 68 69 64 65 28 29 2c 5f 72 5f 28 29 7d 2c 65 2e 6f 70 74 69 6f 6e 73 2e 68 69 64 65 44 65 6c 61 79 29 2c 5f 72 5f 28 29 7d 29 29 2c 5f 72 5f 28 29 7d 2c 6f 6e 6d 6f 75 73 65 6c 65 61 76 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 33 64 61 3a 32 35 65 38 30 37 34 64 22 29 3b 76 61 72 20 65 3d 74 68 69 73 3b 74 68 69 73 2e 5f 73 68 6f 77 54 69 6d 65 6f 75 74 26 26 28 63 6c 65 61 72 54 69 6d 65 Data Ascii: .off("mouseleave").mouseleave(function(){_i_("3da:eaf59268"),e._hideTimeout=setTimeout(function(){_i_("3da:8e73cc0f"),e.hide(),_r_()},e.options.hideDelay),_r_()})),_r_()},onmouseleave:function(){_i_("3da:25e8074d");var e=this;this._showTimeout&&(clearTime
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 3d 41 72 72 61 79 28 65 29 2c 74 3d 30 3b 74 3c 65 3b 74 2b 2b 29 73 5b 74 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 74 5d 3b 72 65 74 75 72 6e 20 5f 72 5f 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 72 65 74 75 72 6e 20 5f 69 5f 28 22 33 64 61 3a 30 36 30 35 35 33 34 39 22 29 2c 5f 72 5f 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 5f 69 5f 28 22 33 64 61 3a 65 35 36 31 66 62 30 33 22 29 3b 76 61 72 20 6e 3d 5f 28 65 2c 74 2c 69 29 2c 72 3d 6e 2e 64 69 73 70 61 74 63 68 2c 61 3d 5b 5d 2c 6f 3d 7b 67 65 74 53 74 61 74 65 3a 6e 2e 67 65 74 53 74 61 74 65 2c 64 69 73 70 61 74 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 5f 69 5f 28 22 33 64 61 3a 30 66 65 35 34 31 31 62 22 29 2c 5f 72 5f 28 72 28 65 29 29 7d 7d 3b 72 65 74 75 72 6e 20 61 3d Data Ascii: =Array(e),t=0;t<e;t++)s[t]=arguments[t];return _r_(function(_){return _i_("3da:06055349"),_r_(function(e,t,i){_i_("3da:e561fb03");var n=_(e,t,i),r=n.dispatch,a=[],o={getState:n.getState,dispatch:function(e){return _i_("3da:0fe5411b"),_r_(r(e))}};return a=
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 29 2c 5f 72 5f 28 29 7d 29 2c 5f 72 5f 28 29 7d 29 7d 2c 5f 72 5f 28 29 7d 29 2c 42 2e 77 68 65 6e 28 7b 65 76 65 6e 74 73 3a 22 6c 6f 61 64 22 2c 63 6f 6e 64 69 74 69 6f 6e 3a 42 2e 65 6e 76 2e 66 65 5f 63 6f 6f 6b 69 65 5f 77 61 72 6e 69 6e 67 26 26 42 2e 65 6e 76 2e 62 5f 62 6f 6f 6b 69 6e 67 73 5f 6f 77 6e 65 64 26 26 42 2e 65 6e 76 2e 66 65 5f 63 6f 6f 6b 69 65 5f 64 65 74 65 63 74 6f 72 7d 29 2e 72 75 6e 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 5f 69 5f 28 22 33 64 61 3a 30 37 63 33 65 62 38 33 22 29 2c 21 42 2e 65 76 65 6e 74 45 6d 69 74 74 65 72 7c 7c 21 77 69 6e 64 6f 77 2e 6e 61 76 69 67 61 74 6f 72 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 6e 61 76 69 67 61 74 6f 72 2e 73 65 6e 64 42 65 61 63 6f Data Ascii: ),_r_()}),_r_()})},_r_()}),B.when({events:"load",condition:B.env.fe_cookie_warning&&B.env.b_bookings_owned&&B.env.fe_cookie_detector}).run(function(e){if(_i_("3da:07c3eb83"),!B.eventEmitter\|\|!window.navigator\|\|"function"!=typeof window.navigator.sendBeaco
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 2e 63 73 73 28 22 62 6f 72 64 65 72 22 2b 69 2b 22 57 69 64 74 68 22 29 2c 31 30 29 7c 7c 30 29 2c 66 5b 72 5d 2b 3d 68 5b 6e 5d 7c 7c 30 2c 70 2e 6f 76 65 72 5b 6e 5d 26 26 28 66 5b 72 5d 2b 3d 75 5b 22 78 22 3d 3d 3d 74 3f 22 77 69 64 74 68 22 3a 22 68 65 69 67 68 74 22 5d 28 29 2a 70 2e 6f 76 65 72 5b 6e 5d 29 29 3a 28 69 3d 75 5b 6e 5d 2c 66 5b 72 5d 3d 69 2e 73 6c 69 63 65 26 26 22 25 22 3d 3d 3d 69 2e 73 6c 69 63 65 28 2d 31 29 3f 70 61 72 73 65 46 6c 6f 61 74 28 69 29 2f 31 30 30 2a 6f 3a 69 29 2c 70 2e 6c 69 6d 69 74 26 26 2f 5e 5c 64 2b 24 2f 2e 74 65 73 74 28 66 5b 72 5d 29 26 26 28 66 5b 72 5d 3d 66 5b 72 5d 3c 3d 30 3f 30 3a 4d 61 74 68 2e 6d 69 6e 28 66 5b 72 5d 2c 6f 29 29 2c 21 65 26 26 31 3c 70 2e 61 78 69 73 2e 6c 65 6e 67 74 68 26 26 28 Data Ascii: .css("border"+i+"Width"),10)\|\|0),f[r]+=h[n]\|\|0,p.over[n]&&(f[r]+=u["x"===t?"width":"height"]()p.over[n])):(i=u[n],f[r]=i.slice&&"%"===i.slice(-1)?parseFloat(i)/100o:i),p.limit&&/^\d+$/.test(f[r])&&(f[r]=f[r]<=0?0:Math.min(f[r],o)),!e&&1<p.axis.length&&(
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 65 2e 61 6d 64 29 64 65 66 69 6e 65 28 5b 22 65 78 70 6f 72 74 73 22 5d 2c 74 29 3b 65 6c 73 65 20 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 7b 76 61 72 20 69 3d 7b 7d 3b 74 28 69 29 2c 65 2e 67 6f 6f 67 6c 65 4f 6e 65 54 61 70 3d 69 7d 5f 72 5f 28 29 7d 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 3f 74 68 69 73 3a 73 65 6c 66 3a 67 6c 6f 62 61 6c 54 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 75 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 5f 69 5f 28 22 33 64 61 3a 36 30 31 Data Ascii: e.amd)define(["exports"],t);else if("undefined"!=typeof exports)t(exports);else{var i={};t(i),e.googleOneTap=i}_r_()}("undefined"==typeof globalThis?"undefined"==typeof self?this:self:globalThis,function(e){"use strict";function u(e,t){return _i_("3da:601
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 28 22 33 64 61 3a 35 36 36 33 33 66 64 34 22 29 2c 5f 2e 62 69 6e 64 28 7b 73 63 72 6f 6c 6c 3a 68 2c 72 65 73 69 7a 65 3a 70 2c 6c 6f 61 64 3a 70 7d 29 2c 5f 72 5f 28 29 2c 62 28 29 2c 77 28 29 2c 68 28 29 2c 5f 72 5f 28 29 7d 2c 72 65 73 74 61 72 74 50 6f 73 69 74 69 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 33 64 61 3a 33 64 33 32 32 32 32 32 22 29 2c 75 3d 6f 2e 69 73 28 22 3a 76 69 73 69 62 6c 65 22 29 3f 70 61 72 73 65 49 6e 74 28 6f 2e 6f 66 66 73 65 74 28 29 2e 74 6f 70 2c 31 30 29 3a 70 61 72 73 65 49 6e 74 28 61 2e 6f 66 66 73 65 74 28 29 2e 74 6f 70 2c 31 30 29 2c 70 28 29 2c 77 28 29 2c 68 28 29 2c 5f 72 5f 28 29 7d 2c 67 65 74 45 6c 65 6d 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 69 5f 28 22 33 64 61 Data Ascii: ("3da:56633fd4"),_.bind({scroll:h,resize:p,load:p}),_r_(),b(),w(),h(),_r_()},restartPosition:function(){_i_("3da:3d322222"),u=o.is(":visible")?parseInt(o.offset().top,10):parseInt(a.offset().top,10),p(),w(),h(),_r_()},getElement:function(){return _i_("3da

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49724	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:32 UTC	616	OUT	GET /static/js/index_cloudfront_sd/803ec559148a8e5c7a9eb8c3720e492f09588177.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:32 UTC	807	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 23458 Connection: close Server: nginx Date: Thu, 01 Feb 2024 11:26:31 GMT Last-Modified: Thu, 01 Feb 2024 10:40:35 GMT ETag: "65bb7523-5ba2" Expires: Sat, 02 Mar 2024 11:26:31 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 34411558fb3a23efdbbaaddb8a12b574.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: dYJ-zufgkURkS2TmHs4T-1HKnMMfBM6UhjB9c-EkYolmdzb75IKGvg== Age: 630541
2024-02-08 18:35:32 UTC	15577	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 3b 5f 69 5f 28 22 65 34 65 3a 30 34 32 37 36 39 65 32 22 29 2c 42 2e 77 68 65 6e 28 7b 65 76 65 6e 74 73 3a 22 72 65 61 64 79 22 2c 63 6f 6e 64 69 74 69 6f 6e 3a 42 2e 65 6e 76 2e 62 5f 70 65 72 73 6f 6e 61 6c 69 7a 65 64 5f 6c 61 79 6f 75 74 5f 69 64 7d 29 2e 72 75 6e 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 65 34 65 3a 37 31 32 34 38 39 64 64 22 29 2c 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 65 34 65 3a 64 63 61 32 34 63 63 35 22 29 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 65 34 65 3a 61 39 37 Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};_i_("e4e:042769e2"),B.when({events:"ready",condition:B.env.b_personalized_layout_id}).run(function(e){_i_("e4e:712489dd"),setTimeout(function(){_i_("e4e:dca24cc5"),function(e){_i_("e4e:a97
2024-02-08 18:35:32 UTC	7881	IN	Data Raw: 69 2e 4d 43 28 72 5b 32 5d 29 2c 6e 5b 33 5d 2c 69 2e 4d 43 28 72 5b 33 5d 29 2c 6e 5b 34 5d 5d 2e 6a 6f 69 6e 28 22 22 29 2c 5f 72 5f 28 74 29 7d 29 7d 28 29 29 2c 42 2e 77 68 65 6e 28 7b 61 63 74 69 6f 6e 3a 22 69 6e 64 65 78 22 2c 65 76 65 6e 74 73 3a 22 72 65 61 64 79 22 2c 63 6f 6e 64 69 74 69 6f 6e 3a 42 2e 65 6e 76 2e 62 5f 75 73 65 72 5f 61 75 74 68 5f 6c 65 76 65 6c 3d 3d 42 2e 65 6e 76 2e 61 75 74 68 5f 6c 65 76 65 6c 5f 68 69 67 68 7d 29 2e 72 75 6e 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 65 34 65 3a 38 65 39 35 34 30 64 36 22 29 3b 76 61 72 20 72 3d 65 28 22 6a 71 75 65 72 79 22 29 2c 69 3d 65 28 22 63 33 36 30 54 72 61 63 6b 65 72 22 29 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 5f 69 5f 28 22 65 34 Data Ascii: i.MC(r[2]),n[3],i.MC(r[3]),n[4]].join(""),_r_(t)})}()),B.when({action:"index",events:"ready",condition:B.env.b_user_auth_level==B.env.auth_level_high}).run(function(e){_i_("e4e:8e9540d6");var r=e("jquery"),i=e("c360Tracker");function n(e,t){return _i_("e4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49729	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:32 UTC	622	OUT	GET /static/js/landingpage_cloudfront_sd/4417f0cf113c3ec51a8190be88e7c373a6d9295d.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:32 UTC	810	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 350307 Connection: close Server: nginx Date: Mon, 22 Jan 2024 17:22:57 GMT Last-Modified: Wed, 20 Sep 2023 10:48:00 GMT ETag: "650acde0-55863" Expires: Wed, 21 Feb 2024 17:22:57 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 f588325f7617672d954c4267c8bee1ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: BuaijCCrLXLv7kKZ32O-DiPQZ1BClE5SiI0K0598i-3264WrwizvXQ== Age: 1473155
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 44 53 46 5f 75 72 6c 5f 62 75 69 6c 64 65 72 28 29 7b 66 6f 72 28 76 61 72 20 65 20 69 6e 20 5f 69 5f 28 22 65 63 32 3a 66 64 62 31 33 38 62 36 22 29 2c 74 68 69 73 2e 62 75 63 6b 65 74 73 29 74 68 69 73 2e 62 75 63 6b 65 74 73 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 65 29 26 26 28 74 68 69 73 2e 62 75 63 6b 65 74 73 5b 65 5d 3d 5b 5d 29 3b 74 68 69 73 2e 70 72 6f 63 65 73 73 65 64 3d 21 31 2c 5f 72 5f 28 29 7d 66 75 6e 63 74 69 6f 6e 20 5f 73 65 6c 65 63 74 5f 65 76 65 6e 74 5f 63 61 74 28 65 2c 74 29 7b 5f 69 5f 28 22 65 Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};function DSF_url_builder(){for(var e in _i_("ec2:fdb138b6"),this.buckets)this.buckets.hasOwnProperty(e)&&(this.buckets[e]=[]);this.processed=!1,_r_()}function _select_event_cat(e,t){_i_("e
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 2c 74 68 69 73 2e 64 61 79 53 65 6c 65 63 74 2e 76 61 6c 28 69 29 2c 5f 72 5f 28 69 29 7d 2c 5f 62 75 69 6c 64 44 61 79 4f 70 74 69 6f 6e 73 46 6f 72 4d 6f 6e 74 68 59 65 61 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 5f 69 5f 28 22 65 63 32 3a 39 33 38 66 61 66 35 32 22 29 3b 76 61 72 20 69 2c 6e 3d 6e 65 77 20 44 61 74 65 28 65 2c 74 2c 31 29 2e 67 65 74 44 61 79 28 29 2c 6f 3d 74 68 69 73 2e 67 65 74 44 61 79 73 49 6e 4d 6f 6e 74 68 28 65 2c 74 29 2c 72 3d 5b 5d 2c 73 3d 74 68 69 73 2e 73 68 6f 77 57 65 65 6b 44 61 79 73 3b 74 68 69 73 2e 64 61 79 53 65 6c 65 63 74 2e 66 69 6e 64 28 22 6f 70 74 69 6f 6e 3a 66 69 72 73 74 22 29 2e 76 61 6c 28 29 7c 7c 72 2e 70 75 73 68 28 22 3c 6f 70 74 69 6f 6e 3e 3c 2f 6f 70 74 69 6f 6e 3e 22 29 3b 66 6f 72 28 76 Data Ascii: ,this.daySelect.val(i),_r_(i)},_buildDayOptionsForMonthYear:function(e,t){_i_("ec2:938faf52");var i,n=new Date(e,t,1).getDay(),o=this.getDaysInMonth(e,t),r=[],s=this.showWeekDays;this.daySelect.find("option:first").val()\|\|r.push("<option></option>");for(v
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 65 63 32 3a 33 37 61 39 61 34 65 65 22 29 3b 76 61 72 20 6e 3d 65 28 22 71 75 65 72 79 73 74 72 69 6e 67 22 29 3b 66 75 6e 63 74 69 6f 6e 20 61 28 65 29 7b 72 65 74 75 72 6e 20 5f 69 5f 28 22 65 63 32 3a 33 61 34 64 64 62 38 34 22 29 2c 5f 72 5f 28 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 69 3f 65 3a 6e 65 77 20 69 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 3f 6e 2e 70 61 72 73 65 55 72 6c 28 65 29 3a 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 69 28 65 29 7b 5f 69 5f 28 22 65 63 32 3a 38 31 64 33 33 37 64 31 22 29 2c 74 68 69 73 2e 62 61 73 65 3d 65 2e 62 61 73 65 7c 7c 22 22 2c 74 68 69 73 2e 71 75 65 72 79 3d 65 2e 71 75 65 72 79 2c 74 68 69 73 2e 68 61 73 68 3d 65 2e 68 61 73 68 3b 76 61 72 20 74 3d 74 68 69 73 2e 62 61 73 65 2e 6d 61 74 63 68 Data Ascii: ec2:37a9a4ee");var n=e("querystring");function a(e){return _i_("ec2:3a4ddb84"),_r_(e instanceof i?e:new i("string"==typeof e?n.parseUrl(e):e))}function i(e){_i_("ec2:81d337d1"),this.base=e.base\|\|"",this.query=e.query,this.hash=e.hash;var t=this.base.match
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 69 6e 64 28 7b 6d 6f 75 73 65 64 6f 77 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 65 63 32 3a 35 30 33 36 32 38 39 32 22 29 2c 65 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 5f 72 5f 28 29 7d 2c 63 6c 69 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 65 63 32 3a 35 36 33 34 30 63 63 39 22 29 2c 72 28 65 2e 74 61 72 67 65 74 29 2c 5f 72 5f 28 29 7d 2c 6b 65 79 64 6f 77 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 65 63 32 3a 31 61 35 66 31 63 34 34 22 29 3b 76 61 72 20 74 3d 65 2e 6b 65 79 43 6f 64 65 2c 69 3d 65 2e 74 61 72 67 65 74 3b 73 77 69 74 63 68 28 74 29 7b 63 61 73 65 20 63 3a 63 61 73 65 20 5f 3a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 5f 69 5f 28 22 65 63 32 3a 66 30 65 30 37 31 62 36 22 29 Data Ascii: ind({mousedown:function(e){_i_("ec2:50362892"),e.preventDefault(),_r_()},click:function(e){_i_("ec2:56340cc9"),r(e.target),_r_()},keydown:function(e){_i_("ec2:1a5f1c44");var t=e.keyCode,i=e.target;switch(t){case c:case _:!function(e,t){_i_("ec2:f0e071b6")
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 35 65 22 29 2c 6e 2e 63 73 73 28 22 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 22 2c 22 75 72 6c 28 22 2b 74 2b 22 29 22 29 2c 5f 72 5f 28 29 7d 2c 69 2e 73 72 63 3d 65 7d 5f 72 5f 28 29 7d 29 2c 5f 72 5f 28 29 7d 28 29 2c 5f 69 5f 28 22 65 63 32 3a 65 36 62 39 32 34 66 63 22 29 2c 42 2e 77 68 65 6e 28 7b 65 76 65 6e 74 73 3a 22 72 65 61 64 79 22 7d 29 2e 72 75 6e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 65 63 32 3a 33 65 64 32 34 36 63 33 22 29 2c 24 28 22 2e 73 68 2d 70 6f 73 74 63 61 72 64 2d 72 65 6d 6f 76 65 22 29 2e 63 6c 69 63 6b 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 65 63 32 3a 34 37 30 63 35 31 37 62 22 29 3b 76 61 72 20 65 3d 24 28 74 68 69 73 29 2c 74 3d 65 2e 70 61 72 65 6e 74 73 28 22 2e 73 68 2d 70 6f 73 74 63 61 Data Ascii: 5e"),n.css("background-image","url("+t+")"),_r_()},i.src=e}_r_()}),_r_()}(),_i_("ec2:e6b924fc"),B.when({events:"ready"}).run(function(){_i_("ec2:3ed246c3"),$(".sh-postcard-remove").click(function(){_i_("ec2:470c517b");var e=$(this),t=e.parents(".sh-postca
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 5f 69 5f 28 22 65 63 32 3a 66 63 62 65 61 32 31 61 22 29 2c 70 3d 21 30 2c 4f 2e 6f 66 66 28 22 74 6f 75 63 68 6d 6f 76 65 22 2c 6e 29 2c 4f 2e 6f 66 66 28 22 73 63 72 6f 6c 6c 22 2c 6e 29 2c 4f 2e 6f 66 66 28 22 72 65 73 69 7a 65 22 2c 74 29 2c 6a 28 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 29 2e 6f 66 66 28 22 73 74 69 63 6b 79 5f 6b 69 74 3a 72 65 63 61 6c 63 22 2c 74 29 2c 73 2e 6f 66 66 28 22 73 74 69 63 6b 79 5f 6b 69 74 3a 64 65 74 61 63 68 22 2c 65 29 2c 73 2e 72 65 6d 6f 76 65 44 61 74 61 28 22 73 74 69 63 6b 79 5f 6b 69 74 22 29 2c 73 2e 63 73 73 28 7b 70 6f 73 69 74 69 6f 6e 3a 22 22 2c 62 6f 74 74 6f 6d 3a 22 22 2c 74 6f 70 3a 22 22 2c 77 69 64 74 68 3a 22 22 7d 29 2c 6d 2e 70 6f 73 69 74 69 6f 6e 28 22 70 Data Ascii: unction(){if(_i_("ec2:fcbea21a"),p=!0,O.off("touchmove",n),O.off("scroll",n),O.off("resize",t),j(document.body).off("sticky_kit:recalc",t),s.off("sticky_kit:detach",e),s.removeData("sticky_kit"),s.css({position:"",bottom:"",top:"",width:""}),m.position("p
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 2e 24 70 72 65 76 41 72 72 6f 77 2e 62 69 6e 64 28 22 63 6c 69 63 6b 2e 73 6c 69 63 6b 22 2c 7b 6d 65 73 73 61 67 65 3a 22 70 72 65 76 69 6f 75 73 22 7d 2c 65 2e 63 68 61 6e 67 65 53 6c 69 64 65 29 2c 65 2e 24 6e 65 78 74 41 72 72 6f 77 2e 62 69 6e 64 28 22 63 6c 69 63 6b 2e 73 6c 69 63 6b 22 2c 7b 6d 65 73 73 61 67 65 3a 22 6e 65 78 74 22 7d 2c 65 2e 63 68 61 6e 67 65 53 6c 69 64 65 29 29 2c 5f 72 5f 28 29 7d 2c 73 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 69 74 44 6f 74 45 76 65 6e 74 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 65 63 32 3a 66 32 35 33 31 66 65 62 22 29 3b 76 61 72 20 65 3d 74 68 69 73 3b 21 30 3d 3d 3d 65 2e 6f 70 74 69 6f 6e 73 2e 64 6f 74 73 26 26 65 2e 73 6c 69 64 65 43 6f 75 6e 74 3e 65 2e 6f 70 74 69 6f 6e 73 2e 73 6c 69 64 Data Ascii: .$prevArrow.bind("click.slick",{message:"previous"},e.changeSlide),e.$nextArrow.bind("click.slick",{message:"next"},e.changeSlide)),_r_()},s.prototype.initDotEvents=function(){_i_("ec2:f2531feb");var e=this;!0===e.options.dots&&e.slideCount>e.options.slid
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 74 2e 73 74 61 72 74 58 21 3d 3d 69 2e 74 6f 75 63 68 4f 62 6a 65 63 74 2e 63 75 72 58 26 26 28 69 2e 73 6c 69 64 65 48 61 6e 64 6c 65 72 28 69 2e 63 75 72 72 65 6e 74 53 6c 69 64 65 29 2c 69 2e 74 6f 75 63 68 4f 62 6a 65 63 74 3d 7b 7d 29 3b 5f 72 5f 28 29 7d 2c 73 2e 70 72 6f 74 6f 74 79 70 65 2e 73 77 69 70 65 48 61 6e 64 6c 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 65 63 32 3a 65 31 62 62 63 31 61 37 22 29 3b 76 61 72 20 74 3d 74 68 69 73 3b 69 66 28 21 31 3d 3d 3d 74 2e 6f 70 74 69 6f 6e 73 2e 73 77 69 70 65 7c 7c 22 6f 6e 74 6f 75 63 68 65 6e 64 22 69 6e 20 64 6f 63 75 6d 65 6e 74 26 26 21 31 3d 3d 3d 74 2e 6f 70 74 69 6f 6e 73 2e 73 77 69 70 65 29 72 65 74 75 72 6e 20 5f 72 5f 28 29 3b 69 66 28 21 31 3d 3d 3d 74 2e 6f 70 74 69 6f Data Ascii: t.startX!==i.touchObject.curX&&(i.slideHandler(i.currentSlide),i.touchObject={});_r_()},s.prototype.swipeHandler=function(e){_i_("ec2:e1bbc1a7");var t=this;if(!1===t.options.swipe\|\|"ontouchend"in document&&!1===t.options.swipe)return _r_();if(!1===t.optio
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 69 29 7b 5f 69 5f 28 22 65 63 32 3a 34 37 37 63 38 31 37 64 22 29 3b 76 61 72 20 6e 3d 74 68 69 73 3b 69 66 28 21 74 68 69 73 2e 76 69 65 77 73 29 72 65 74 75 72 6e 20 5f 72 5f 28 29 3b 69 66 28 74 68 69 73 2e 24 65 6c 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 22 66 65 65 64 62 61 63 6b 2d 6c 6f 6f 70 2d 2d 68 69 64 64 65 6e 22 29 2c 28 69 3d 69 7c 7c 74 68 69 73 2e 63 6f 6e 66 69 67 2e 64 65 66 61 75 6c 74 56 69 65 77 29 3d 3d 3d 74 68 69 73 2e 63 75 72 72 65 6e 74 56 69 65 77 29 72 65 74 75 72 6e 20 5f 72 5f 28 29 3b 4f 62 6a 65 63 74 2e 6b 65 79 73 28 74 68 69 73 2e 76 69 65 77 73 29 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 65 63 32 3a 39 36 34 64 34 64 62 62 22 29 3b 76 61 72 20 74 3d 74 68 Data Ascii: function(i){_i_("ec2:477c817d");var n=this;if(!this.views)return _r_();if(this.$el.removeClass("feedback-loop--hidden"),(i=i\|\|this.config.defaultView)===this.currentView)return _r_();Object.keys(this.views).forEach(function(e){_i_("ec2:964d4dbb");var t=th
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 61 6d 65 22 2c 22 2f 70 72 69 76 61 74 65 2f 72 65 76 69 65 77 5f 61 64 6a 5f 70 6f 6f 72 2f 6e 61 6d 65 22 2c 22 2f 70 72 69 76 61 74 65 2f 72 65 76 69 65 77 5f 61 64 6a 5f 64 69 73 61 70 70 6f 69 6e 74 69 6e 67 2f 6e 61 6d 65 22 2c 22 2f 70 72 69 76 61 74 65 2f 72 65 76 69 65 77 5f 61 64 6a 5f 61 76 65 72 61 67 65 5f 70 61 73 73 61 62 6c 65 2f 6e 61 6d 65 22 2c 22 2f 70 72 69 76 61 74 65 2f 72 65 76 69 65 77 5f 61 64 6a 5f 70 6c 65 61 73 61 6e 74 2f 6e 61 6d 65 22 2c 22 2f 70 72 69 76 61 74 65 2f 72 65 76 69 65 77 5f 61 64 6a 5f 67 6f 6f 64 2f 6e 61 6d 65 22 2c 22 2f 70 72 69 76 61 74 65 2f 72 65 76 69 65 77 5f 61 64 6a 5f 76 65 72 79 5f 67 6f 6f 64 2f 6e 61 6d 65 22 2c 22 2f 70 72 69 76 61 74 65 2f 72 65 76 69 65 77 5f 61 64 6a 5f 66 61 62 75 6c 6f 75 Data Ascii: ame","/private/review_adj_poor/name","/private/review_adj_disappointing/name","/private/review_adj_average_passable/name","/private/review_adj_pleasant/name","/private/review_adj_good/name","/private/review_adj_very_good/name","/private/review_adj_fabulou

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49728	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:32 UTC	620	OUT	GET /static/js/searchbox_cloudfront_sd/2ef4e9ae9240f4bd123bc5c51eed3c306e710ecb.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:32 UTC	809	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 247198 Connection: close Server: nginx Date: Thu, 01 Feb 2024 08:45:21 GMT Last-Modified: Fri, 17 Nov 2023 14:07:08 GMT ETag: "6557738c-3c59e" Expires: Sat, 02 Mar 2024 08:45:21 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 14e4300e15854895259e6944bb121ec8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: wyeJvJs-rI3yp6rRergWOMoD1XL-DcTkJVwIu11BXQphVbv_MDJNPg== Age: 640211
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 3b 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 65 6e 61 62 6c 65 5f 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 26 26 28 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 2e 73 65 61 72 63 68 62 6f 78 3d 7b 6c 6f 61 64 65 64 3a 21 30 2c 72 75 6e 3a 21 31 7d 29 2c 42 2e 64 65 66 69 6e 65 28 22 63 61 72 65 74 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 34 61 62 3a 35 30 61 35 64 36 61 61 22 29 3b 72 65 74 75 72 6e 20 5f 72 5f 28 7b 67 65 74 50 6f 73 69 74 69 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 69 Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.searchbox={loaded:!0,run:!1}),B.define("caret",function(){_i_("4ab:50a5d6aa");return _r_({getPosition:function(e){var t;i
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 62 65 20 61 20 73 74 72 69 6e 67 22 29 3b 69 66 28 22 22 3d 3d 3d 28 65 3d 65 2e 74 72 69 6d 28 29 29 29 72 65 74 75 72 6e 20 5f 72 5f 28 73 29 3b 72 65 74 75 72 6e 20 65 2e 73 70 6c 69 74 28 2f 5c 73 2b 2f 29 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 34 61 62 3a 37 37 64 31 32 66 64 38 22 29 3b 76 61 72 20 74 2c 69 3d 65 2c 61 3d 21 30 2c 6e 3d 65 2e 69 6e 64 65 78 4f 66 28 22 3a 22 29 3b 2d 31 21 3d 3d 6e 26 26 28 69 3d 65 2e 73 75 62 73 74 72 28 30 2c 6e 29 2c 28 61 3d 65 2e 73 75 62 73 74 72 28 6e 2b 31 29 29 7c 7c 28 61 3d 30 29 2c 74 3d 61 2c 5f 69 5f 28 22 34 61 62 3a 63 66 38 39 33 61 37 61 22 29 2c 5f 72 5f 28 21 69 73 4e 61 4e 28 70 61 72 73 65 46 6c 6f 61 74 28 74 29 29 26 26 69 73 46 69 6e 69 74 65 28 74 29 Data Ascii: be a string");if(""===(e=e.trim()))return _r_(s);return e.split(/\s+/).forEach(function(e){_i_("4ab:77d12fd8");var t,i=e,a=!0,n=e.indexOf(":");-1!==n&&(i=e.substr(0,n),(a=e.substr(n+1))\|\|(a=0),t=a,_i_("4ab:cf893a7a"),_r_(!isNaN(parseFloat(t))&&isFinite(t)
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 65 66 74 22 29 3b 72 65 74 75 72 6e 20 5f 72 5f 28 65 29 7d 2c 5f 70 6c 61 63 65 54 6f 6f 6c 74 69 70 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 34 61 62 3a 65 65 66 64 31 63 62 35 22 29 3b 76 61 72 20 65 3d 74 68 69 73 2e 5f 61 63 63 6f 75 6e 74 46 6f 72 52 54 4c 28 74 68 69 73 2e 70 6f 73 69 74 69 6f 6e 29 2c 74 3d 74 68 69 73 2e 64 69 6d 65 6e 73 69 6f 6e 3b 74 68 69 73 2e 5f 61 63 63 6f 75 6e 74 46 6f 72 52 54 4c 28 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 70 6c 61 63 65 6d 65 6e 74 29 3d 3d 3d 65 3f 74 68 69 73 5b 65 5d 3d 74 68 69 73 2e 65 6c 4f 66 66 73 65 74 5b 65 5d 2d 74 68 69 73 2e 24 74 69 70 5b 74 5d 28 29 3a 74 68 69 73 5b 65 5d 3d 74 68 69 73 2e 65 6c 4f 66 66 73 65 74 5b 65 5d 2b 74 68 69 73 2e 24 65 6c 5b 74 5d 28 29 2c 5f 72 5f 28 Data Ascii: eft");return _r_(e)},_placeTooltip:function(){_i_("4ab:eefd1cb5");var e=this._accountForRTL(this.position),t=this.dimension;this._accountForRTL(this.options.placement)===e?this[e]=this.elOffset[e]-this.$tip[t]():this[e]=this.elOffset[e]+this.$el[t](),_r_(
2024-02-08 18:35:33 UTC	14808	IN	Data Raw: 28 22 2d 76 69 73 69 62 6c 65 22 29 29 2c 5f 72 5f 28 29 7d 2c 68 69 64 65 4c 6f 61 64 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 34 61 62 3a 35 37 61 33 61 30 62 30 22 29 2c 74 68 69 73 2e 73 68 6f 75 6c 64 53 68 6f 77 4c 6f 61 64 69 6e 67 53 74 61 74 65 26 26 74 68 69 73 2e 24 6c 6f 61 64 69 6e 67 2e 72 65 6d 6f 76 65 43 6c 61 73 73 28 22 2d 76 69 73 69 62 6c 65 22 29 2c 5f 72 5f 28 29 7d 2c 6d 6f 64 65 6c 49 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 34 61 62 3a 31 63 30 63 30 65 65 35 22 29 3b 76 61 72 20 65 3d 7b 73 73 3a 74 68 69 73 2e 69 6e 70 75 74 2e 76 61 6c 75 65 7d 3b 74 68 69 73 2e 64 65 73 74 69 6e 61 74 69 6f 6e 4d 6f 64 65 6c 2e 69 6e 69 74 28 65 29 2c 5f 72 5f 28 29 7d 2c 6d 6f 64 65 6c 43 68 61 6e 67 65 Data Ascii: ("-visible")),_r_()},hideLoading:function(){_i_("4ab:57a3a0b0"),this.shouldShowLoadingState&&this.$loading.removeClass("-visible"),_r_()},modelInit:function(){_i_("4ab:1c0c0ee5");var e={ss:this.input.value};this.destinationModel.init(e),_r_()},modelChange
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 61 67 28 22 6f 6e 5f 63 6c 69 63 6b 5f 73 75 67 67 65 73 74 69 6f 6e 73 5f 61 6e 79 77 68 65 72 65 22 29 26 26 28 74 2e 61 6e 79 77 68 65 72 65 3d 21 30 29 2c 73 2e 62 5f 61 63 5f 73 65 61 72 63 68 5f 68 69 73 74 6f 72 79 26 26 74 68 69 73 2e 6d 6f 64 65 6c 2e 67 65 74 46 6c 61 67 28 22 6f 6e 5f 63 6c 69 63 6b 5f 73 75 67 67 65 73 74 69 6f 6e 73 22 29 26 26 28 74 2e 73 65 61 72 63 68 48 69 73 74 6f 72 79 3d 21 30 29 2c 74 68 69 73 2e 6d 6f 64 65 6c 2e 75 73 65 28 22 67 72 6f 75 70 22 29 2c 74 68 69 73 2e 6d 6f 64 65 6c 2e 6f 6e 28 22 69 6e 69 74 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 34 61 62 3a 34 36 64 36 39 39 38 39 22 29 2c 22 67 72 6f 75 70 22 3d 3d 3d 65 2e 67 72 6f 75 70 26 26 74 68 69 73 2e 66 65 74 63 68 53 75 67 67 65 73 74 69 Data Ascii: ag("on_click_suggestions_anywhere")&&(t.anywhere=!0),s.b_ac_search_history&&this.model.getFlag("on_click_suggestions")&&(t.searchHistory=!0),this.model.use("group"),this.model.on("init",function(e){_i_("4ab:46d69989"),"group"===e.group&&this.fetchSuggesti
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 6c 61 73 2e 64 6f 6e 65 28 61 29 2c 5f 72 5f 28 29 7d 28 42 2e 61 74 6c 61 73 2e 72 65 71 75 69 72 65 28 22 61 74 6c 61 73 2d 70 6c 61 63 65 73 22 29 29 2c 5f 72 5f 28 29 7d 29 2c 5f 72 5f 28 29 7d 29 2c 5f 72 5f 28 29 7d 2c 73 65 61 72 63 68 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 69 29 7b 69 66 28 5f 69 5f 28 22 34 61 62 3a 64 38 37 34 61 37 37 39 22 29 2c 21 74 7c 7c 21 74 2e 73 73 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 69 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 73 65 72 76 69 63 65 2d 61 74 6c 61 73 2d 69 6e 76 61 6c 69 64 2d 61 72 67 75 6d 65 6e 74 73 22 29 3b 69 66 28 74 2e 73 73 2e 6c 65 6e 67 74 68 3c 32 29 72 65 74 75 72 6e 20 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 34 61 Data Ascii: las.done(a),_r_()}(B.atlas.require("atlas-places")),_r_()}),_r_()}),_r_()},search:function(t,i){if(_i_("4ab:d874a779"),!t\|\|!t.ss\|\|"function"!=typeof i)throw new Error("service-atlas-invalid-arguments");if(t.ss.length<2)return setTimeout(function(){_i_("4a
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 22 2c 74 68 69 73 2e 69 6e 70 75 74 46 6f 63 75 73 2e 62 69 6e 64 28 74 68 69 73 29 29 2c 74 68 69 73 2e 24 69 6e 70 75 74 73 2e 6f 6e 65 28 22 66 6f 63 75 73 22 2c 74 68 69 73 2e 69 6e 70 75 74 46 6f 63 75 73 54 72 61 63 6b 2e 62 69 6e 64 28 74 68 69 73 29 29 2c 74 68 69 73 2e 24 69 6e 70 75 74 73 2e 6f 6e 28 22 62 6c 75 72 22 2c 74 68 69 73 2e 69 6e 70 75 74 42 6c 75 72 2e 62 69 6e 64 28 74 68 69 73 29 29 2c 74 68 69 73 2e 24 69 6e 70 75 74 73 2e 6f 6e 28 22 6b 65 79 64 6f 77 6e 22 2c 74 68 69 73 2e 69 6e 70 75 74 4b 65 79 44 6f 77 6e 2e 62 69 6e 64 28 74 68 69 73 29 29 2c 74 68 69 73 2e 24 69 6e 70 75 74 73 2e 6f 6e 28 22 6b 65 79 75 70 22 2c 74 68 69 73 2e 69 6e 70 75 74 4b 65 79 55 70 2e 62 69 6e 64 28 74 68 69 73 29 29 2c 74 68 69 73 2e 24 69 6e 70 Data Ascii: ",this.inputFocus.bind(this)),this.$inputs.one("focus",this.inputFocusTrack.bind(this)),this.$inputs.on("blur",this.inputBlur.bind(this)),this.$inputs.on("keydown",this.inputKeyDown.bind(this)),this.$inputs.on("keyup",this.inputKeyUp.bind(this)),this.$inp
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 6f 6e 74 68 2c 64 61 79 3a 61 2e 64 61 79 7d 2c 73 3d 7b 65 64 69 74 69 6e 67 3a 21 30 7d 3b 72 65 74 75 72 6e 20 6e 5b 74 5d 3d 69 2c 74 68 69 73 2e 5f 64 61 74 61 2e 65 64 69 74 69 6e 67 3d 21 30 2c 74 68 69 73 2e 5f 64 61 74 61 5b 22 65 64 69 74 69 6e 67 5f 22 2b 65 5d 3d 6c 2e 63 72 65 61 74 65 28 6e 29 2c 73 5b 65 5d 3d 21 30 2c 74 68 69 73 2e 65 6d 69 74 28 22 63 68 61 6e 67 65 22 2c 73 29 2c 5f 72 5f 28 21 30 29 7d 2c 61 64 6a 75 73 74 45 64 69 74 69 6e 67 46 72 61 67 6d 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 2c 61 29 7b 69 66 28 5f 69 5f 28 22 34 61 62 3a 30 38 30 62 66 39 30 64 22 29 2c 22 63 68 65 63 6b 69 6e 22 21 3d 3d 65 26 26 22 63 68 65 63 6b 6f 75 74 22 21 3d 3d 65 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 Data Ascii: onth,day:a.day},s={editing:!0};return n[t]=i,this._data.editing=!0,this._data["editing_"+e]=l.create(n),s[e]=!0,this.emit("change",s),_r_(!0)},adjustEditingFragment:function(e,t,i,a){if(_i_("4ab:080bf90d"),"checkin"!==e&&"checkout"!==e)throw new TypeError
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 20 20 20 20 22 2c 22 5c 6e 20 20 20 20 3c 2f 64 69 76 3e 5c 6e 20 20 20 20 22 2c 27 5c 6e 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 75 69 2d 73 74 65 70 70 65 72 5f 5f 77 72 61 70 70 65 72 20 73 62 2d 67 72 6f 75 70 5f 5f 73 74 65 70 70 65 72 2d 61 31 31 79 22 3e 5c 6e 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 5c 6e 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 22 5c 6e 20 20 20 20 20 20 20 20 20 20 74 79 70 65 3d 22 6e 75 6d 62 65 72 22 5c 6e 20 20 20 20 20 20 20 20 20 20 63 6c 61 73 73 3d 22 62 75 69 2d 73 74 65 70 70 65 72 5f 5f 69 6e 70 75 74 22 5c 6e 20 20 20 20 20 20 20 20 20 20 64 61 74 61 2d 62 75 69 2d 72 65 66 3d 22 69 6e 70 75 74 2d 73 74 65 70 70 65 72 2d 66 69 65 6c 64 22 5c 6e 20 20 Data Ascii: ","\n </div>\n ",'\n <div class="bui-stepper__wrapper sb-group__stepper-a11y">\n <input\n style="display: none"\n type="number"\n class="bui-stepper__input"\n data-bui-ref="input-stepper-field"\n
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 34 36 5d 29 29 26 26 70 2e 4d 4a 28 69 2b 22 22 3d 3d 22 22 29 26 26 28 65 2b 3d 6d 5b 31 37 32 5d 29 2c 65 2b 3d 6d 5b 31 37 33 5d 2c 70 2e 4d 44 28 67 5b 34 36 5d 29 3f 65 2b 3d 6d 5b 31 37 34 5d 3a 65 2b 3d 6d 5b 31 37 35 5d 2c 65 2b 3d 6d 5b 31 37 36 5d 2c 70 2e 4d 44 28 67 5b 34 36 5d 29 3f 65 2b 3d 5b 6d 5b 31 37 37 5d 2c 70 2e 4d 45 28 6d 5b 31 37 38 5d 2c 70 2e 4d 42 2c 70 2e 4d 4e 2c 6e 75 6c 6c 29 2c 6d 5b 39 37 5d 5d 2e 6a 6f 69 6e 28 22 22 29 3a 70 2e 4d 44 28 67 5b 34 33 5d 29 3f 65 2b 3d 5b 6d 5b 31 37 37 5d 2c 70 2e 4d 45 28 6d 5b 31 37 39 5d 2c 70 2e 4d 42 2c 70 2e 4d 4e 2c 6e 75 6c 6c 29 2c 6d 5b 39 37 5d 5d 2e 6a 6f 69 6e 28 22 22 29 3a 70 2e 4d 44 28 67 5b 37 5d 29 26 26 28 65 2b 3d 5b 6d 5b 31 37 37 5d 2c 70 2e 4d 45 28 6d 5b 31 38 30 Data Ascii: 46]))&&p.MJ(i+""=="")&&(e+=m[172]),e+=m[173],p.MD(g[46])?e+=m[174]:e+=m[175],e+=m[176],p.MD(g[46])?e+=[m[177],p.ME(m[178],p.MB,p.MN,null),m[97]].join(""):p.MD(g[43])?e+=[m[177],p.ME(m[179],p.MB,p.MN,null),m[97]].join(""):p.MD(g[7])&&(e+=[m[177],p.ME(m[180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49719	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:32 UTC	615	OUT	GET /static/css/xp-index-sb_cloudfront_sd.iq_ltr/5b5ab8ab66a5ce3092875d0725122439c4f2dfdd.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:32 UTC	794	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 76199 Connection: close Server: nginx Date: Tue, 30 Jan 2024 14:49:05 GMT Last-Modified: Tue, 30 Jan 2024 07:07:17 GMT ETag: "65b8a025-129a7" Expires: Thu, 29 Feb 2024 14:49:05 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 b0c7b942a33f0f4451718aee53f7840c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: EnLzxZBU_PC12In9uDER4RE8Sj4Du8ah-gIctEWCvB5LOUq1BbC6kQ== Age: 791187
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 2e 62 62 74 6f 6f 6c 2d 6e 6f 74 69 66 69 63 61 74 69 6f 6e 7b 63 6c 65 61 72 3a 62 6f 74 68 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 36 65 36 65 36 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 66 61 66 63 66 66 7d 2e 62 62 74 6f 6f 6c 2d 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2d 2d 74 6f 70 2d 6d 65 6e 75 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 65 62 66 33 66 66 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 31 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 29 3b Data Ascii: .bbtool-notification{clear:both;position:relative;background-color:#e6e6e6;border-bottom:1px solid #fafcff}.bbtool-notification--top-menu{background-color:var(--bui_color_white);border-bottom:1px solid #ebf3ff;-webkit-box-shadow:0 1px 2px rgba(0,0,0,0.1);
2024-02-08 18:35:32 UTC	16384	IN	Data Raw: 74 69 6f 6e 3a 72 69 67 68 74 7d 2e 74 6f 6f 6c 74 69 70 2d 72 69 67 68 74 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 31 70 78 7d 2e 74 6f 6f 6c 74 69 70 2d 72 69 67 68 74 20 2e 74 6f 6f 6c 74 69 70 2d 61 72 72 6f 77 7b 72 69 67 68 74 3a 61 75 74 6f 3b 6c 65 66 74 3a 30 3b 77 69 64 74 68 3a 31 32 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 6c 65 66 74 7d 2e 74 6f 6f 6c 74 69 70 2d 61 6c 69 67 6e 2d 72 69 67 68 74 20 2e 74 6f 6f 6c 74 69 70 2d 61 72 72 6f 77 7b 72 69 67 68 74 3a 33 35 70 78 3b 6c 65 66 74 3a 61 75 74 6f 3b 77 69 64 74 68 3a 32 30 70 78 7d 2e 74 6f 6f 6c 74 69 70 2d 61 6c 69 Data Ascii: tion:right}.tooltip-right{margin-right:0;padding-right:0;margin-left:5px;padding-left:11px}.tooltip-right .tooltip-arrow{right:auto;left:0;width:12px;background-position:left}.tooltip-align-right .tooltip-arrow{right:35px;left:auto;width:20px}.tooltip-ali
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 62 6f 78 2d 2d 70 61 69 6e 74 65 64 2e 2d 73 6d 61 6c 6c 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 36 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 36 70 78 7d 2e 73 62 2d 73 65 61 72 63 68 62 6f 78 2e 2d 73 6d 61 6c 6c 20 2e 73 62 2d 73 65 61 72 63 68 62 6f 78 5f 5f 6c 61 62 65 6c 2e 2d 6d 61 69 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 7d 2e 73 62 2d 73 65 61 72 63 68 62 6f 78 20 2e 62 2d 66 6f 72 6d 5f 5f 62 6f 6f 6b 65 72 2d 74 79 70 65 2d 2d 68 6f 74 65 6c 2c 2e 73 62 2d 73 65 61 72 63 68 62 6f 78 20 2e 62 2d 66 6f 72 6d 5f 5f 62 6f 6f 6b 65 72 2d 74 79 70 65 2d 2d 69 6e 64 65 78 2c 2e 73 62 2d 73 65 61 72 63 68 62 6f 78 20 2e 62 2d 66 6f 72 6d 5f 5f 62 6f 6f 6b 65 72 2d 74 79 70 65 2d 2d 70 72 6f 66 69 6c 65 2c 2e 73 62 2d 73 65 61 72 63 Data Ascii: box--painted.-small{padding-left:6px;padding-right:6px}.sb-searchbox.-small .sb-searchbox__label.-main{font-size:16px}.sb-searchbox .b-form__booker-type--hotel,.sb-searchbox .b-form__booker-type--index,.sb-searchbox .b-form__booker-type--profile,.sb-searc
2024-02-08 18:35:33 UTC	14808	IN	Data Raw: 6f 6c 64 65 72 2d 74 65 78 74 7b 68 65 69 67 68 74 3a 32 34 70 78 7d 2e 64 65 73 74 69 6e 61 74 69 6f 6e 2d 74 79 70 65 5f 5f 77 72 61 70 70 65 72 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 38 70 78 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 73 62 2d 61 75 74 6f 63 6f 6d 70 6c 65 74 65 5f 5f 62 61 64 67 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 38 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 38 70 78 7d 2e 73 62 2d 61 75 74 6f 63 6f 6d 70 6c 65 74 65 5f 5f 69 74 65 6d 2d 2d 74 61 62 62 65 64 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 38 30 70 78 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 Data Ascii: older-text{height:24px}.destination-type__wrapper{display:inline-block;margin:0 0 0 8px;display:none}.sb-autocomplete__badge{font-size:12px;line-height:18px;font-weight:700;margin:0 0 0 8px}.sb-autocomplete__item--tabbed{padding-left:80px!important;backgr
2024-02-08 18:35:33 UTC	12239	IN	Data Raw: 62 75 69 2d 75 2d 73 72 2d 6f 6e 6c 79 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 73 62 2d 67 72 6f 75 70 5f 5f 73 74 65 70 70 65 72 2d 61 31 31 79 20 2e 62 75 69 2d 62 75 74 74 6f 6e 3a 66 6f 63 75 73 20 7e 20 2e 62 75 69 2d 75 2d 73 72 2d 6f 6e 6c 79 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 6e 6f 4a 53 20 2e 78 70 5f 5f 67 75 65 73 74 73 5f 5f 69 6e 70 75 74 73 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6c 65 66 74 3a 2d 39 39 39 65 6d 3b 72 69 67 68 74 3a 61 75 74 6f 7d 2e 6e 6f 4a 53 20 23 78 70 5f 5f 67 75 65 73 74 73 5f 5f 69 6e 70 75 74 3a 63 68 65 63 6b 65 64 2b 2e 78 70 5f 5f 67 75 65 73 74 73 5f 5f 69 6e 70 75 74 73 7b 6c 65 66 74 3a 61 75 74 6f 3b 72 69 67 68 74 3a 30 7d 2e 78 70 5f 5f 66 69 65 6c 64 73 65 74 7b 63 6f 6c Data Ascii: bui-u-sr-only{display:none}.sb-group__stepper-a11y .bui-button:focus ~ .bui-u-sr-only{display:block}.noJS .xp__guests__inputs{position:absolute;left:-999em;right:auto}.noJS #xp__guests__input:checked+.xp__guests__inputs{left:auto;right:0}.xp__fieldset{col

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49731	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:33 UTC	575	OUT	GET /psb/capla/static/css/dc32f6b7.745c5004.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:33 UTC	619	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 4522 Connection: close Last-Modified: Tue, 06 Feb 2024 05:14:55 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: LPL3VwKSk2Z15oseyd5JjAABdBGKcNi1 Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 12:50:03 GMT ETag: "65c942cfa2287ad1959f9b9eca30ff42" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 f4c38e024a95b76a27c9f3dc9ff2eda6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: PuTfnrU3Jpijn_QhQTBBhyQEmTxGjwOLegJKGFmtXeBBL-HnT9CGMQ== Age: 20730 Vary: Origin
2024-02-08 18:35:33 UTC	3198	IN	Data Raw: 2e 61 66 30 36 39 30 33 31 66 66 7b 6d 61 72 67 69 6e 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 33 78 29 2a 2d 31 29 3b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 7d 2e 61 66 30 36 39 30 33 31 66 66 20 73 76 67 7b 68 65 69 67 68 74 3a 31 30 30 25 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 61 38 37 38 38 61 62 62 61 65 7b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 65 78 74 2d 74 6f 70 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 7d 2e 64 32 63 30 30 39 34 64 61 39 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 66 6f 72 65 67 72 6f 75 6e 64 5f 61 6c 74 29 7d 2e 66 64 37 34 30 63 34 63 Data Ascii: .af069031ff{margin:calc(var(--bui_spacing_3x)*-1);padding:var(--bui_spacing_2x)}.af069031ff svg{height:100%!important}.a8788abbae{vertical-align:text-top;margin-inline-start:var(--bui_spacing_2x)}.d2c0094da9{color:var(--bui_color_foreground_alt)}.fd740c4c
2024-02-08 18:35:33 UTC	1324	IN	Data Raw: 23 66 66 66 7d 2e 77 65 62 2d 73 68 65 6c 6c 2d 68 65 61 64 65 72 2d 6d 66 65 20 61 3a 61 63 74 69 76 65 2c 2e 77 65 62 2d 73 68 65 6c 6c 2d 68 65 61 64 65 72 2d 6d 66 65 20 61 3a 68 6f 76 65 72 2c 2e 77 65 62 2d 73 68 65 6c 6c 2d 68 65 61 64 65 72 2d 6d 66 65 20 61 3a 6c 69 6e 6b 2c 2e 77 65 62 2d 73 68 65 6c 6c 2d 68 65 61 64 65 72 2d 6d 66 65 20 61 3a 76 69 73 69 74 65 64 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 7d 5b 64 61 74 61 2d 74 65 73 74 69 64 3d 68 65 61 64 65 72 2d 6d 6f 62 69 6c 65 2d 6d 65 6e 75 2d 6d 6f 64 61 6c 5d 20 61 3a 61 63 74 69 76 65 2c 5b 64 61 74 61 2d 74 65 73 74 69 64 3d 68 65 61 64 65 72 2d 6d 6f 62 69 6c 65 2d 6d 65 6e 75 2d 6d 6f 64 61 6c 5d 20 61 3a 68 6f 76 65 72 2c 5b 64 61 74 61 2d 74 65 73 74 69 64 3d 68 65 61 64 Data Ascii: #fff}.web-shell-header-mfe a:active,.web-shell-header-mfe a:hover,.web-shell-header-mfe a:link,.web-shell-header-mfe a:visited{font-weight:500}[data-testid=header-mobile-menu-modal] a:active,[data-testid=header-mobile-menu-modal] a:hover,[data-testid=head

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49732	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:33 UTC	628	OUT	GET /static/js/error_catcher_bec_cloudfront_sd/0acd2ada6c74d5dec978a04ea837952bdf050cd2.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:33 UTC	806	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 6155 Connection: close Server: nginx Date: Mon, 29 Jan 2024 09:50:44 GMT Last-Modified: Wed, 21 Dec 2022 14:29:30 GMT ETag: "63a3184a-180b" Expires: Wed, 28 Feb 2024 09:50:44 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 4a91a321d4c2ab7334c6f285093956ae.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: XIXfwblZZSNCjzFzhb9GDq1ncPiL4UWRCAYy5C6yPHCTYKr0C6fmlw== Age: 895488
2024-02-08 18:35:33 UTC	6155	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 6c 2c 5f 2c 66 29 7b 76 61 72 20 73 2c 75 3d 5b 5d 2c 6f 3d 21 21 67 28 29 3b 66 75 6e 63 74 69 6f 6e 20 67 28 29 7b 76 61 72 20 65 3b 69 66 28 6c 2e 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 29 74 72 79 7b 65 3d 6e 65 77 20 6c 2e 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 7d 63 61 74 63 68 28 65 29 7b 72 65 74 75 72 6e 21 31 7d 65 6c 73 65 20 66 6f 72 28 76 61 72 20 72 3d 6e 65 77 20 41 72 72 61 79 28 22 4d 73 78 6d 6c 32 2e 58 4d 4c 48 54 54 50 2e 35 2e 30 22 2c 22 4d 73 78 6d 6c 32 2e 58 4d 4c 48 54 54 50 2e 34 2e 30 22 2c 22 4d 73 78 6d 6c 32 2e 58 4d 4c 48 54 54 50 2e 33 2e 30 22 2c 22 4d 73 78 6d 6c 32 2e 58 4d 4c 48 54 54 50 22 2c 22 4d 69 63 72 6f 73 6f 66 74 2e 58 4d 4c 48 54 54 50 22 29 2c 74 3d 30 3b 74 3c 72 2e 6c Data Ascii: !function(l,_,f){var s,u=[],o=!!g();function g(){var e;if(l.XMLHttpRequest)try{e=new l.XMLHttpRequest}catch(e){return!1}else for(var r=new Array("Msxml2.XMLHTTP.5.0","Msxml2.XMLHTTP.4.0","Msxml2.XMLHTTP.3.0","Msxml2.XMLHTTP","Microsoft.XMLHTTP"),t=0;t<r.l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49733	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:33 UTC	687	OUT	GET /xdata/images/xphoto/720x217/308526620.jpeg?k=0663a1420ea98a013af0eda32bb4d11258521a39c5b8a5a4e2777ee5661dee55&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:33 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Tue, 06 Feb 2024 13:36:48 GMT ETag: "cf49f2767391bbeca534ff6153c75f4f4a46d9e6" Content-Language: 25671 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 787da2b9a155d00032c7d0d9a8c2a7dc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: aCXmKMGc9DOH1y5ftzOTtB4TE6LayCCdfSYGqDsjtb05CovmHOxUKg== Age: 190725
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 36 34 34 37 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d9 02 d0 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 6447JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:35:33 UTC	9295	IN	Data Raw: a4 33 4d 0f d9 c1 31 4a c9 b9 89 cb 00 78 3f 96 2a e3 aa 25 26 f4 38 f9 23 2c 37 30 18 a8 f0 dd 8e 30 38 15 db 0b 1b 61 c7 d9 e3 fc a9 93 69 96 f3 c4 62 58 d1 18 f0 ac 38 20 d5 72 b4 3e 46 73 4a b2 20 50 93 fc a1 40 19 cf 24 55 09 d4 dd ce 89 23 b2 39 5c 8c 8e 08 ed 51 5d 5e df 43 13 b4 30 6c 58 58 30 c9 f4 fd 6b 5a d1 85 cf d9 e7 65 12 cd 32 ee 51 90 14 26 e1 9e 4f a7 b7 ad 79 8d d4 4b 5d 4d 19 0c 31 5b a4 51 47 77 71 89 10 f0 14 75 1d b3 df 9a b7 24 c6 38 8b 20 62 0e 0f 1d 4f d2 91 a5 b3 b4 bb 91 8a 46 d3 37 07 7b 06 2a a3 b8 a4 93 57 8e de d7 c9 46 8f 2d 83 e6 11 96 00 f1 df da b2 49 de e8 b5 4e 0d 6b 22 34 f3 2e e1 13 ca ca b9 6e 99 c6 31 4f 12 6d 8c b7 9c fb 4b 91 f3 75 3c 62 b3 d6 f6 dc 73 04 c2 6d ca 14 26 e2 31 83 c9 20 e0 77 06 b4 34 e4 8a e6 67 Data Ascii: 3M1Jx?%&8#,7008aibX8 r>FsJ P@$U#9\Q]^C0lXX0kZe2Q&OyK]M1[QGwqu$8 bOF7{WF-INk"4.n1OmKu<bsm&1 w4g
2024-02-08 18:35:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49734	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:33 UTC	575	OUT	GET /psb/capla/static/css/18cad957.d04abce3.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:33 UTC	617	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 351 Connection: close Last-Modified: Wed, 07 Feb 2024 13:29:37 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: LNB3Jra7CTHht52DLd.hx4J3goWQnSIq Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 15:58:52 GMT ETag: "e073be315b762e550e327c95965fbadd" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 9546eb427ef2137803aed00cad4fc426.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: gEoIJd_UKHqeibDB78cRzpHYNYhm54tgAQtQPz4j_tNLtG0C9CJ9Kw== Age: 9402 Vary: Origin
2024-02-08 18:35:33 UTC	351	IN	Data Raw: 2e 61 34 38 61 39 39 31 66 61 36 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 66 36 31 32 62 34 62 62 34 32 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 76 61 72 28 2d 2d 62 75 69 5f 73 68 61 64 6f 77 5f 31 30 30 29 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 66 36 61 33 33 39 37 30 66 63 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 36 78 29 7d 2e 65 32 31 64 35 64 62 65 61 36 7b 6d 61 72 67 69 6e 3a 30 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 33 78 29 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 0a 2f 2a 23 20 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 Data Ascii: .a48a991fa6{display:none}.f612b4bb42{border-radius:var(--bui_spacing_2x);box-shadow:var(--bui_shadow_100);overflow:hidden}.f6a33970fc{margin-bottom:var(--bui_spacing_6x)}.e21d5dbea6{margin:0 var(--bui_spacing_3x) var(--bui_spacing_4x)}/*# sourceMappingUR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49735	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:33 UTC	567	OUT	GET /psb/capla/static/css/client.38ffee15.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:33 UTC	621	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 194527 Connection: close Date: Thu, 08 Feb 2024 12:50:07 GMT Last-Modified: Thu, 08 Feb 2024 12:34:07 GMT ETag: "c9009dc966b4c139ffffe886598ac0c0" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: eIF2AzqToVz8ZJUSLOnoWnohwEtsxZAT Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 9546eb427ef2137803aed00cad4fc426.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: H8_fRX_nJ85K_a5Bma2qDxZT9N7JwDzg5I_hbXoS0iUSH6rjSzRVVQ== Age: 20727 Vary: Origin
2024-02-08 18:35:33 UTC	15763	IN	Data Raw: 3a 72 6f 6f 74 2c 5b 64 61 74 61 2d 62 75 69 2d 74 68 65 6d 65 3d 74 72 61 76 65 6c 6c 65 72 2d 6c 69 67 68 74 5d 7b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 3a 23 38 36 38 36 38 36 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 5f 61 6c 74 3a 23 65 37 65 37 65 37 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 62 6f 72 64 65 72 3a 23 30 30 36 63 65 34 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 5f 64 69 73 61 62 6c 65 64 3a 23 64 39 64 39 64 39 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 62 6f 72 64 65 72 3a 23 64 34 31 31 31 65 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 6f 6e 73 74 72 75 63 74 69 76 65 5f 62 6f 72 64 65 72 3a 23 30 30 38 32 33 34 3b 2d 2d 62 75 69 5f 63 6f 6c Data Ascii: :root,[data-bui-theme=traveller-light]{--bui_color_border:#868686;--bui_color_border_alt:#e7e7e7;--bui_color_action_border:#006ce4;--bui_color_border_disabled:#d9d9d9;--bui_color_destructive_border:#d4111e;--bui_color_constructive_border:#008234;--bui_col
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 73 74 65 6d 2c 53 65 67 6f 65 20 55 49 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 32 5f 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 32 5f 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 32 5f 6c 69 6e 65 2d 68 65 69 67 68 74 3a 36 34 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 32 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 41 76 65 6e 69 72 20 4e 65 78 74 22 2c 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 53 65 67 6f 65 20 55 49 2c 52 6f 62 6f 74 6f 2c Data Ascii: stem,Segoe UI,Roboto,Helvetica,Arial,sans-serif;--bui_font_display_2_font-size:56px;--bui_font_display_2_font-weight:700;--bui_font_display_2_line-height:64px;--bui_font_display_2_font-family:"Avenir Next",BlinkMacSystemFont,-apple-system,Segoe UI,Roboto,
2024-02-08 18:35:33 UTC	3031	IN	Data Raw: 61 62 73 6f 6c 75 74 65 3b 69 6e 73 65 74 2d 62 6c 6f 63 6b 2d 73 74 61 72 74 3a 35 30 25 3b 6c 65 66 74 3a 35 30 25 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 2d 35 30 25 29 7d 2e 62 38 34 33 38 32 61 31 37 64 7b 63 75 72 73 6f 72 3a 64 65 66 61 75 6c 74 7d 2e 62 38 34 33 38 32 61 31 37 64 3e 2e 64 34 36 36 31 36 66 32 34 64 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 62 38 34 33 38 32 61 31 37 64 3e 2e 65 34 61 64 63 65 39 32 64 66 2c 2e 62 38 34 33 38 32 61 31 37 64 3e 2e 65 65 64 62 61 39 65 38 38 61 7b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 2e 61 34 63 31 38 30 35 38 38 37 5b 64 69 73 61 62 6c 65 64 5d 2c 2e 61 34 63 31 38 30 35 38 38 37 5b 64 69 73 61 62 6c 65 64 5d 3a 61 63 74 69 76 65 2c 2e 61 Data Ascii: absolute;inset-block-start:50%;left:50%;transform:translate(-50%,-50%)}.b84382a17d{cursor:default}.b84382a17d>.d46616f24d{display:block}.b84382a17d>.e4adce92df,.b84382a17d>.eedba9e88a{visibility:hidden}.a4c1805887[disabled],.a4c1805887[disabled]:active,.a
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 65 6c 65 76 61 74 69 6f 6e 5f 6f 6e 65 29 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 66 6f 72 65 67 72 6f 75 6e 64 29 7d 2e 66 33 37 38 32 35 32 30 35 33 3a 62 65 66 6f 72 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 62 6f 72 64 65 72 29 7d 2e 66 33 37 38 32 35 32 30 35 33 2e 63 39 62 33 36 62 36 63 63 37 2c 2e 66 33 37 38 32 35 32 30 35 33 3a 61 63 74 69 76 65 2c 2e 66 33 37 38 32 35 32 30 35 33 3a 66 6f 63 75 73 2c 2e 66 33 37 38 32 35 32 30 Data Ascii: :var(--bui_color_background_elevation_one);color:var(--bui_color_destructive_foreground)}.f378252053:before{background-color:transparent;border-color:var(--bui_color_destructive_border)}.f378252053.c9b36b6cc7,.f378252053:active,.f378252053:focus,.f3782520
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 2d 2d 62 75 69 5f 73 74 61 63 6b 5f 67 61 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 7d 2e 64 32 31 66 39 34 61 61 33 63 3e 2a 7b 2d 2d 62 75 69 5f 73 74 61 63 6b 5f 67 61 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 33 78 29 7d 2e 64 37 38 64 66 66 31 39 61 30 3e 2a 7b 2d 2d 62 75 69 5f 73 74 61 63 6b 5f 67 61 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 2e 66 36 36 66 39 31 36 36 32 36 3e 2a 7b 2d 2d 62 75 69 5f 73 74 61 63 6b 5f 67 61 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 36 78 29 7d 2e 65 63 34 30 64 63 39 62 62 66 3e 2a 7b 2d 2d 62 75 69 5f 73 74 61 63 6b 5f 67 61 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 38 78 29 7d 7d 40 6d 65 64 69 61 20 28 Data Ascii: --bui_stack_gap:var(--bui_spacing_2x)}.d21f94aa3c>{--bui_stack_gap:var(--bui_spacing_3x)}.d78dff19a0>{--bui_stack_gap:var(--bui_spacing_4x)}.f66f916626>{--bui_stack_gap:var(--bui_spacing_6x)}.ec40dc9bbf>{--bui_stack_gap:var(--bui_spacing_8x)}}@media (
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 65 69 67 68 74 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 68 65 61 64 6c 69 6e 65 5f 33 5f 6c 69 6e 65 2d 68 65 69 67 68 74 29 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 68 65 61 64 6c 69 6e 65 5f 33 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 29 7d 2e 65 31 65 65 62 62 36 61 31 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 31 5f 66 6f 6e 74 2d 73 69 7a 65 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 31 5f 66 6f 6e 74 2d 77 65 69 67 68 74 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 31 5f 6c 69 6e 65 Data Ascii: eight);line-height:var(--bui_font_headline_3_line-height);font-family:var(--bui_font_headline_3_font-family)}.e1eebb6a1e{font-size:var(--bui_font_strong_1_font-size);font-weight:var(--bui_font_strong_1_font-weight);line-height:var(--bui_font_strong_1_line
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 6f 6e 73 74 72 75 63 74 69 76 65 5f 62 61 63 6b 67 72 6f 75 6e 64 29 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 6f 6e 5f 63 6f 6e 73 74 72 75 63 74 69 76 65 5f 62 61 63 6b 67 72 6f 75 6e 64 29 7d 2e 65 66 34 65 35 30 39 66 65 30 7b 63 6f 6c 6f 72 3a 63 75 72 72 65 6e 74 63 6f 6c 6f 72 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 2e 65 66 34 65 35 30 39 66 65 30 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 22 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 69 6e 73 65 74 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 63 75 72 72 65 6e 74 63 6f 6c 6f 72 3b 6f 70 61 63 69 74 79 Data Ascii: ar(--bui_color_constructive_background);color:var(--bui_color_on_constructive_background)}.ef4e509fe0{color:currentcolor;background:transparent}.ef4e509fe0:before{content:"";border-radius:50%;position:absolute;inset:0;background-color:currentcolor;opacity
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 29 2a 2d 31 29 7d 2e 62 63 66 34 30 30 33 34 63 31 7b 6d 61 72 67 69 6e 2d 62 6c 6f 63 6b 2d 65 6e 64 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 2e 66 63 34 39 34 30 38 66 65 61 7b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 3a 30 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 77 72 61 70 3a 6e 6f 77 72 61 70 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 66 6c 65 78 2d 73 74 61 72 74 3b 77 69 64 74 68 3a 31 30 30 25 3b 6f 76 65 72 66 6c 6f 77 2d 78 3a 73 63 72 6f 6c 6c 3b 73 63 72 6f 6c 6c 2d 62 65 68 61 76 69 6f 72 3a 73 6d 6f 6f 74 68 3b 2d 77 65 62 6b 69 74 2d 6f 76 65 72 66 6c 6f 77 2d 73 63 72 6f 6c 6c 69 6e 67 3a 74 6f 75 63 68 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 66 61 63 65 2d 76 69 Data Ascii: )*-1)}.bcf40034c1{margin-block-end:var(--bui_spacing_4x)}.fc49408fea{list-style:none;margin:0;display:flex;flex-wrap:nowrap;justify-content:flex-start;width:100%;overflow-x:scroll;scroll-behavior:smooth;-webkit-overflow-scrolling:touch;-webkit-backface-vi
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 32 65 37 38 7b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 33 33 2e 33 33 33 33 33 33 33 33 33 33 25 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 61 39 37 64 32 34 66 66 66 38 7b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 34 31 2e 36 36 36 36 36 36 36 36 36 37 25 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 63 66 35 33 34 39 32 38 66 33 7b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 35 30 25 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 65 66 35 65 66 65 33 37 37 37 7b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 35 30 25 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 64 65 39 33 31 32 36 30 36 34 7b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 35 38 2e 33 33 33 33 33 33 33 33 33 33 25 21 69 6d 70 6f 72 74 61 6e 74 Data Ascii: 2e78{margin-inline-start:33.3333333333%!important}.a97d24fff8{margin-inline-start:41.6666666667%!important}.cf534928f3{margin-inline-start:50%!important}.ef5efe3777{margin-inline-start:50%!important}.de93126064{margin-inline-start:58.3333333333%!important
2024-02-08 18:35:33 UTC	16384	IN	Data Raw: 61 72 28 2d 2d 62 75 69 5f 61 6e 69 6d 61 74 69 6f 6e 5f 70 72 65 73 73 29 3b 74 72 61 6e 73 69 74 69 6f 6e 2d 70 72 6f 70 65 72 74 79 3a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 2c 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 2c 74 72 61 6e 73 66 6f 72 6d 7d 2e 63 39 30 37 63 36 37 64 32 30 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 22 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 68 65 69 67 68 74 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 20 2b 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 68 61 6c 66 29 29 3b 77 69 64 74 68 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 20 2b 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 68 61 6c 66 29 29 3b Data Ascii: ar(--bui_animation_press);transition-property:background-color,border-color,transform}.c907c67d20:before{content:"";position:absolute;height:calc(var(--bui_spacing_2x) + var(--bui_spacing_half));width:calc(var(--bui_spacing_2x) + var(--bui_spacing_half));

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49736	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:33 UTC	575	OUT	GET /psb/capla/static/css/7bcb015e.5b709f3d.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:33 UTC	619	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 2861 Connection: close Date: Thu, 08 Feb 2024 13:16:36 GMT Last-Modified: Thu, 08 Feb 2024 11:37:53 GMT ETag: "8b761ecf11f6b807d0d765ee8cd5851e" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: .wxzOg8QkFu.xibWr3CgHbjp4QG_aTPI Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 e6c353101750d150139bda8d95719802.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Jqc_JBUPAkh7ptikmrO7giMmOTp9hVS9te_qnem5tsy7h3wASnKeeg== Age: 19138 Vary: Origin
2024-02-08 18:35:33 UTC	2861	IN	Data Raw: 2e 62 63 34 65 32 63 34 36 37 61 7b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 61 6e 74 69 61 6c 69 61 73 65 64 3b 2d 6d 6f 7a 2d 6f 73 78 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 67 72 61 79 73 63 61 6c 65 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 36 78 29 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 62 38 65 39 32 30 65 30 38 38 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 66 6c 65 78 2d 65 6e 64 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 32 33 30 70 78 3b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d Data Ascii: .bc4e2c467a{-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;margin-bottom:var(--bui_spacing_6x);position:relative}.b8e920e088{text-decoration:none;text-align:center;display:flex;justify-content:flex-end;min-height:230px;padding:var(--

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49737	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:33 UTC	575	OUT	GET /psb/capla/static/css/eb60141d.cad86b29.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:33 UTC	618	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 1501 Connection: close Date: Thu, 08 Feb 2024 16:07:20 GMT Last-Modified: Thu, 08 Feb 2024 14:53:51 GMT ETag: "2980ea90c3f4c27d77bffbd1527870a7" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: sAJOuwpsDtZfgppaREh03xaE5gNkW8K5 Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 7db19e3781edb64ef4f7023d2c25783e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: QSyK21c81bGT7Q9y7IApvXnflpnrJZCNOwavnEDwZCcJviGA2X2DBw== Age: 8894 Vary: Origin
2024-02-08 18:35:33 UTC	1501	IN	Data Raw: 2e 66 33 39 35 65 35 32 32 62 64 7b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 7d 2e 66 62 30 65 38 34 39 31 66 32 7b 6d 61 72 67 69 6e 2d 62 6c 6f 63 6b 2d 65 6e 64 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 2e 61 66 30 63 32 31 32 32 66 61 7b 6d 61 72 67 69 6e 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 20 30 7d 2e 64 34 31 32 38 30 32 36 35 32 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 3b 62 Data Ascii: .f395e522bd{width:100%;height:100%;display:flex;flex-direction:row}.fb0e8491f2{margin-block-end:var(--bui_spacing_4x)}.af0c2122fa{margin:var(--bui_spacing_4x) 0}.d412802652{height:100%;width:100%;position:relative;border:1px solid var(--bui_color_white);b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49738	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:33 UTC	575	OUT	GET /psb/capla/static/css/c6a78acb.bffda4a9.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:33 UTC	595	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 853 Connection: close Date: Thu, 08 Feb 2024 11:43:56 GMT Last-Modified: Thu, 08 Feb 2024 11:37:53 GMT ETag: "6f3e8bb7938a05e927b3ca4454f98fa8" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: b5qwU9Uw68HNRDgalzg4bB9gCMOFsuHv Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 ea0f86c249e022d5015ce79f54e723d0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: cLFLwxui5eD0WDRYaJuOdThzOX2rG1qwdzGPdzPDzsmKV4XuUYsOYg== Age: 24698 Vary: Origin
2024-02-08 18:35:33 UTC	853	IN	Data Raw: 2e 63 37 37 39 36 33 36 65 65 66 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 72 61 6e 64 5f 70 72 69 6d 61 72 79 5f 62 61 63 6b 67 72 6f 75 6e 64 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 3b 6d 61 72 67 69 6e 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 36 78 29 20 30 3b 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 61 6e 74 69 61 6c 69 61 73 65 64 3b 2d 6d 6f 7a 2d 6f 73 78 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 67 72 61 79 73 63 61 6c 65 7d 2e 66 66 37 35 33 37 36 66 32 33 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6d 61 72 67 69 6e 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e Data Ascii: .c779636eef{background-color:var(--bui_color_brand_primary_background);border-radius:var(--bui_spacing_2x);margin:var(--bui_spacing_6x) 0;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.ff75376f23{display:flex;margin:var(--bui_spacin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49739	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:33 UTC	575	OUT	GET /psb/capla/static/css/f50a2dfc.837540b6.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:33 UTC	619	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 1298 Connection: close Date: Thu, 08 Feb 2024 11:43:56 GMT Last-Modified: Thu, 08 Feb 2024 11:37:53 GMT ETag: "fdb620d16ddcb3d874c0d96880365b4d" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: gKQ3dko_aeSe7flBYen.8nJ6TCgcueOK Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 ea0f86c249e022d5015ce79f54e723d0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: D0Or4IoHIuw-IDzqYe3xGg0y2KFQ31rrwl9gIpk6lf5i5--GNKqa7A== Age: 24698 Vary: Origin
2024-02-08 18:35:33 UTC	1298	IN	Data Raw: 2e 65 33 65 35 34 30 36 37 65 38 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 72 61 6e 64 5f 67 65 6e 69 75 73 5f 70 72 69 6d 61 72 79 5f 62 61 63 6b 67 72 6f 75 6e 64 29 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 66 6f 72 65 67 72 6f 75 6e 64 5f 69 6e 76 65 72 74 65 64 29 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 63 61 6c 63 28 31 35 31 70 78 20 2d 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 38 78 29 29 7d 2e 65 33 65 35 34 30 36 37 65 38 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 22 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 30 3b 7a 2d 69 6e 64 Data Ascii: .e3e54067e8{position:relative;background-color:var(--bui_color_brand_genius_primary_background);color:var(--bui_color_foreground_inverted);padding-right:calc(151px - var(--bui_spacing_8x))}.e3e54067e8:before{content:"";position:absolute;top:0;left:0;z-ind

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49740	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:33 UTC	575	OUT	GET /psb/capla/static/css/a6a21c13.8939445f.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:33 UTC	595	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 314 Connection: close Date: Thu, 08 Feb 2024 11:43:56 GMT Last-Modified: Thu, 08 Feb 2024 11:37:53 GMT ETag: "e262f92e286a4c74280bd4b3fdee8cbb" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 7G8nAXI18cFrDtj.jVsLGUJVDX12qJHu Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 f588325f7617672d954c4267c8bee1ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: FDKxzOJFPn6SaXJ-VTKUe-CPH4JaO3aI3T9tXfGZiXxcYjD1WRpswg== Age: 24698 Vary: Origin
2024-02-08 18:35:33 UTC	314	IN	Data Raw: 2e 62 32 63 61 39 37 35 36 37 30 7b 6d 61 72 67 69 6e 3a 30 7d 2e 66 61 65 31 34 30 30 62 65 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 7d 2e 61 34 31 38 37 31 63 65 33 38 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 3b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 7d 2e 65 65 35 37 34 62 33 34 66 61 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 0a 2f 2a 23 20 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 3d 68 74 74 70 73 3a 2f 2f 69 73 74 61 74 69 63 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 69 6e 74 65 72 6e 61 Data Ascii: .b2ca975670{margin:0}.fae1400be2{font-size:14px}.a41871ce38{margin-top:var(--bui_spacing_2x);padding:var(--bui_spacing_4x);padding-top:0;width:100%;box-sizing:border-box}.ee574b34fa{font-weight:700}/*# sourceMappingURL=https://istatic.booking.com/interna

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49742	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:33 UTC	575	OUT	GET /psb/capla/static/css/f5d0e2e7.a54d85eb.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:34 UTC	618	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 4344 Connection: close Date: Thu, 08 Feb 2024 16:07:20 GMT Last-Modified: Thu, 08 Feb 2024 14:53:51 GMT ETag: "88d8b9631fe60984baabd22260a86e6e" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 45SgOdslZ5ni1p_3JE_2CMeJEvzIw3pO Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 ea0f86c249e022d5015ce79f54e723d0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: dBQmOSgLtNZHwKzpzNxVIzm2eSnzGXRXlqSYssw-PTOC5hWfu2icZw== Age: 8895 Vary: Origin
2024-02-08 18:35:34 UTC	4344	IN	Data Raw: 3a 72 6f 6f 74 7b 2d 2d 67 6e 73 76 5f 62 72 61 6e 64 2d 73 65 63 6f 6e 64 61 72 79 2d 63 6f 6c 6f 72 5f 77 65 62 3a 23 66 65 62 62 30 32 3b 2d 2d 67 6e 73 76 5f 6c 70 2d 63 61 6d 70 61 69 67 6e 2d 63 61 72 64 2d 68 65 69 67 68 74 5f 6d 64 6f 74 3a 31 37 36 70 78 3b 2d 2d 67 6e 73 76 5f 6c 70 2d 63 61 6d 70 61 69 67 6e 2d 63 61 72 64 2d 68 65 69 67 68 74 5f 77 77 77 3a 32 30 38 70 78 7d 2e 66 34 32 30 66 36 62 62 66 32 3a 6c 61 73 74 2d 63 68 69 6c 64 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 66 34 32 30 66 36 62 62 66 32 2c 2e 66 34 32 30 66 36 62 62 66 32 3a 6f 6e 6c 79 2d 63 68 69 6c 64 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 7d 2e 65 65 61 35 31 33 66 66 66 30 7b 64 69 73 Data Ascii: :root{--gnsv_brand-secondary-color_web:#febb02;--gnsv_lp-campaign-card-height_mdot:176px;--gnsv_lp-campaign-card-height_www:208px}.f420f6bbf2:last-child{margin-bottom:0}.f420f6bbf2,.f420f6bbf2:only-child{margin-bottom:var(--bui_spacing_1x)}.eea513fff0{dis

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49741	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:33 UTC	452	OUT	GET /xdata/images/xphoto/720x217/308526620.jpeg?k=0663a1420ea98a013af0eda32bb4d11258521a39c5b8a5a4e2777ee5661dee55&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:34 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Tue, 06 Feb 2024 13:36:48 GMT ETag: "cf49f2767391bbeca534ff6153c75f4f4a46d9e6" Content-Language: 25671 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 45893c5ff2aa24fa7dce9573a0274642.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: pecizWFmCQwROd04pU4Hw33_pE9RR581K-GbtLF9CI2pdpLeHQbx4w== Age: 190726
2024-02-08 18:35:34 UTC	16384	IN	Data Raw: 36 34 34 37 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d9 02 d0 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 6447JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:35:34 UTC	9295	IN	Data Raw: a4 33 4d 0f d9 c1 31 4a c9 b9 89 cb 00 78 3f 96 2a e3 aa 25 26 f4 38 f9 23 2c 37 30 18 a8 f0 dd 8e 30 38 15 db 0b 1b 61 c7 d9 e3 fc a9 93 69 96 f3 c4 62 58 d1 18 f0 ac 38 20 d5 72 b4 3e 46 73 4a b2 20 50 93 fc a1 40 19 cf 24 55 09 d4 dd ce 89 23 b2 39 5c 8c 8e 08 ed 51 5d 5e df 43 13 b4 30 6c 58 58 30 c9 f4 fd 6b 5a d1 85 cf d9 e7 65 12 cd 32 ee 51 90 14 26 e1 9e 4f a7 b7 ad 79 8d d4 4b 5d 4d 19 0c 31 5b a4 51 47 77 71 89 10 f0 14 75 1d b3 df 9a b7 24 c6 38 8b 20 62 0e 0f 1d 4f d2 91 a5 b3 b4 bb 91 8a 46 d3 37 07 7b 06 2a a3 b8 a4 93 57 8e de d7 c9 46 8f 2d 83 e6 11 96 00 f1 df da b2 49 de e8 b5 4e 0d 6b 22 34 f3 2e e1 13 ca ca b9 6e 99 c6 31 4f 12 6d 8c b7 9c fb 4b 91 f3 75 3c 62 b3 d6 f6 dc 73 04 c2 6d ca 14 26 e2 31 83 c9 20 e0 77 06 b4 34 e4 8a e6 67 Data Ascii: 3M1Jx?%&8#,7008aibX8 r>FsJ P@$U#9\Q]^C0lXX0kZe2Q&OyK]M1[QGwqu$8 bOF7{WF-INk"4.n1OmKu<bsm&1 w4g
2024-02-08 18:35:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49743	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:34 UTC	575	OUT	GET /psb/capla/static/css/43e47265.9fb0fb7a.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:34 UTC	617	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 374 Connection: close Last-Modified: Wed, 07 Feb 2024 14:34:00 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: wAwfK5sRNLu2zKmxkwgBaOsL1bPkNbzw Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 15:51:46 GMT ETag: "f1d67c93f1232808b430d12e5d784b19" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 76f3fedc86826a7b266250e33ee41082.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: dL-NDtPY-mgrNi93L8yR3AMbNTXP_opCFEWuwtNEHnYntqiBa1hTnA== Age: 9829 Vary: Origin
2024-02-08 18:35:34 UTC	374	IN	Data Raw: 2e 66 63 32 66 32 63 30 64 61 38 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 64 38 34 30 35 34 31 62 61 34 7b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 7d 2e 61 65 39 35 33 36 62 65 35 64 7b 6d 61 78 2d 77 69 64 74 68 3a 39 31 38 70 78 7d 2e 66 35 32 32 61 38 64 34 34 62 7b 70 61 64 64 69 6e 67 3a 30 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 20 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 38 78 29 20 2b 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 29 7d 2e 64 63 36 32 35 34 34 34 65 66 7b 77 68 69 74 65 2d 73 70 61 63 65 3a 70 72 65 2d 6c 69 Data Ascii: .fc2f2c0da8{width:100%;display:block}.d840541ba4{padding:var(--bui_spacing_1x)}.ae9536be5d{max-width:918px}.f522a8d44b{padding:0 var(--bui_spacing_1x) var(--bui_spacing_1x) calc(var(--bui_spacing_8x) + var(--bui_spacing_1x))}.dc625444ef{white-space:pre-li

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49744	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:34 UTC	575	OUT	GET /psb/capla/static/css/d2a738da.079c3b4c.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:34 UTC	618	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 3930 Connection: close Date: Thu, 08 Feb 2024 16:07:20 GMT Last-Modified: Thu, 08 Feb 2024 14:53:51 GMT ETag: "1a7c523a95596c5b0b122ad8d8e3b553" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: y6hnIHqnWmWPq9JqZ4Ue_o6YIF6Bl_1N Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 76f3fedc86826a7b266250e33ee41082.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: xqrmtZUbDmbkwCOXIFDuhgzFtHQoyVXHDmDkeAzqKEEB-OlsHeMeng== Age: 8895 Vary: Origin
2024-02-08 18:35:34 UTC	3930	IN	Data Raw: 2e 62 34 65 33 39 61 62 32 61 62 7b 77 69 64 74 68 3a 31 30 30 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 62 34 65 33 39 61 62 32 61 62 2e 61 61 33 36 31 61 37 64 32 33 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 72 61 6e 64 5f 70 72 69 6d 61 72 79 5f 62 61 63 6b 67 72 6f 75 6e 64 29 7d 2e 62 34 65 33 39 61 62 32 61 62 2e 63 36 38 66 31 33 30 62 65 31 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 7d 2e 62 65 32 30 33 31 35 30 31 66 7b 6d 61 78 2d 77 69 64 74 68 3a 31 31 31 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 33 37 35 70 78 3b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 Data Ascii: .b4e39ab2ab{width:100%;position:relative}.b4e39ab2ab.aa361a7d23{background:var(--bui_color_brand_primary_background)}.b4e39ab2ab.c68f130be1{background:var(--bui_color_white)}.be2031501f{max-width:1110px;min-height:375px;margin:0 auto;box-sizing:border-box

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49745	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:34 UTC	575	OUT	GET /psb/capla/static/css/1baf5a63.539e3a8f.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:34 UTC	618	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 2065 Connection: close Last-Modified: Wed, 07 Feb 2024 14:34:00 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: rLvv0U9nlmkSiLeo7hrzKiAd5aAgVI7z Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 15:58:52 GMT ETag: "e66324ef6e0246820fb69426fdb7b8ad" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 d125bf8405e840aa51a88ae3d8d91fb2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: JR4GGWjE5YYmxguKWSBy82NmQEmvutU9Rdyuei7OSPp71hh8meM-WA== Age: 9403 Vary: Origin
2024-02-08 18:35:34 UTC	2065	IN	Data Raw: 2e 61 35 32 39 37 33 39 64 65 35 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 73 74 72 65 74 63 68 3b 62 6f 72 64 65 72 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 77 69 64 74 68 5f 31 30 30 29 20 73 6f 6c 69 64 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 5f 61 6c 74 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 72 61 64 69 75 73 5f 32 30 30 29 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 66 65 Data Ascii: .a529739de5{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch;border:var(--bui_border_width_100) solid;border-color:var(--bui_color_border_alt);border-radius:var(--bui_border_radius_200);overflow:hidden}.fe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49746	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:34 UTC	575	OUT	GET /psb/capla/static/css/4e596c2c.3a2fb681.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:34 UTC	618	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 1713 Connection: close Date: Thu, 08 Feb 2024 16:07:21 GMT Last-Modified: Thu, 08 Feb 2024 14:53:51 GMT ETag: "51be0c43cc481b13fe70d3ba27e2ffd9" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: SFV4Wl1bGgrYBAvh1g48Ac217jtyPkYJ Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 145bb9cba9e12350510f02ee9ab6ca22.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: cqcBIXeBl7u5tMW1uP-pVukev7Kv_jfJ3CdsCulEg7zqi6G5Zmt1eg== Age: 8894 Vary: Origin
2024-02-08 18:35:34 UTC	1713	IN	Data Raw: 2e 63 31 66 34 65 66 34 64 38 33 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 7d 2e 61 38 64 31 66 33 39 38 34 35 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 2e 66 37 34 32 61 31 30 30 66 30 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 33 78 29 7d 2e 64 35 33 37 36 37 37 32 65 62 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 7d 2e 61 38 37 62 65 38 32 36 38 62 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f Data Ascii: .c1f4ef4d83{margin-top:var(--bui_spacing_1x);margin-bottom:var(--bui_spacing_2x)}.a8d1f39845{margin-bottom:var(--bui_spacing_4x)}.f742a100f0{margin-bottom:var(--bui_spacing_3x)}.d5376772eb{margin-bottom:var(--bui_spacing_2x)}.a87be8268b{text-decoration:no

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49747	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:34 UTC	575	OUT	GET /psb/capla/static/css/21928fd5.c540d700.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:34 UTC	618	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 3186 Connection: close Last-Modified: Wed, 07 Feb 2024 14:34:00 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: _SrqE28ZraaLhD96dpZqwbwZKMpM61Pu Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 15:58:52 GMT ETag: "c4aa6cc0b7d7b70cd0b7409f2336e955" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 25d9b5959eaa82bb18ee3f35e6bf34b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: MzSQjJUPcGgTK8USqcSFqI1ke6j7TOtVOV39lbcgGrSsnXpgNRsTcg== Age: 9403 Vary: Origin
2024-02-08 18:35:34 UTC	3186	IN	Data Raw: 2e 63 30 34 30 38 63 31 38 34 33 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 72 61 64 69 75 73 5f 32 30 30 29 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 6d 61 73 6b 2d 69 6d 61 67 65 3a 6e 6f 6e 65 3b 2d 77 65 62 6b 69 74 2d 6d 61 73 6b 2d 69 6d 61 67 65 3a 2d 77 65 62 6b 69 74 2d 72 61 64 69 61 6c 2d 67 72 61 64 69 65 6e 74 28 23 66 66 66 2c 23 30 30 30 29 7d 2e 63 30 34 30 38 63 31 38 34 33 20 2e 66 38 37 37 37 32 62 62 37 34 7b 6f 70 61 63 69 74 79 3a 30 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 6f 70 61 63 69 74 79 20 2e 31 35 73 20 65 61 73 65 2d 6f 75 74 7d Data Ascii: .c0408c1843{display:flex;flex-direction:column;height:100%;border-radius:var(--bui_border_radius_200);overflow:hidden;mask-image:none;-webkit-mask-image:-webkit-radial-gradient(#fff,#000)}.c0408c1843 .f87772bb74{opacity:0;transition:opacity .15s ease-out}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49748	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:34 UTC	575	OUT	GET /psb/capla/static/css/8207c303.9807c216.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:34 UTC	619	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 15351 Connection: close Last-Modified: Tue, 06 Feb 2024 13:23:57 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 3Aq0HWxV0p8h6ESJKVPV8DXmNO.YjYjx Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 15:58:52 GMT ETag: "0ec216456dfbf94c83cc1323acb4cb9d" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 25d9b5959eaa82bb18ee3f35e6bf34b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 2pevw4waqUuFB7ga1JIKs1nI7NohdPJkP0xv5IjoBn8Tn4viIcnJSQ== Age: 9403 Vary: Origin
2024-02-08 18:35:34 UTC	15351	IN	Data Raw: 2e 63 39 61 37 37 39 30 63 33 31 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 63 65 6e 74 5f 62 61 63 6b 67 72 6f 75 6e 64 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 72 61 64 69 75 73 5f 32 30 30 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 76 61 72 28 2d 2d 62 75 69 5f 73 68 61 64 6f 77 5f 31 30 30 29 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 3b 6d 61 72 67 69 6e 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 36 78 29 20 30 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 2e 65 32 32 62 37 38 32 35 32 31 7b 62 6f 78 2d 73 69 7a Data Ascii: .c9a7790c31{background-color:var(--bui_color_accent_background);border-radius:var(--bui_border_radius_200);box-shadow:var(--bui_shadow_100);display:flex;padding:var(--bui_spacing_1x);margin:var(--bui_spacing_6x) 0 var(--bui_spacing_4x)}.e22b782521{box-siz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49749	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:34 UTC	575	OUT	GET /psb/capla/static/css/3d066b0d.a994f040.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:34 UTC	618	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 5762 Connection: close Last-Modified: Wed, 07 Feb 2024 14:34:00 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: Y7dC8d4Tl.EmB8Hda9Z10saqG6J_ILjf Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 15:58:52 GMT ETag: "054c06419579fbe2660760d03e545650" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 45893c5ff2aa24fa7dce9573a0274642.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: rM5mpqkTZ7tdlO7fm43G5I_gsfnO_6DCeOCpSUbVryWEUP6oeqivOg== Age: 9403 Vary: Origin
2024-02-08 18:35:34 UTC	5762	IN	Data Raw: 2e 62 38 32 35 32 38 63 39 31 37 7b 66 6c 65 78 3a 31 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 61 66 34 63 31 36 34 33 34 35 2c 2e 63 31 61 33 36 65 39 33 33 63 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 7d 2e 63 39 34 33 63 63 30 35 36 65 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 2e 65 31 31 62 61 66 61 64 38 36 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 2e 65 31 31 62 61 66 61 64 38 36 3a 6c 61 73 74 2d 63 68 69 6c 64 7b 6d 61 72 Data Ascii: .b82528c917{flex:1;display:flex;flex-direction:column;justify-content:center}.af4c164345,.c1a36e933c{margin-bottom:var(--bui_spacing_1x)}.c943cc056e{margin-top:var(--bui_spacing_4x)}.e11bafad86{margin-right:var(--bui_spacing_4x)}.e11bafad86:last-child{mar

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49750	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:34 UTC	575	OUT	GET /psb/capla/static/css/445be7a9.b944bd98.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:34 UTC	618	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 2065 Connection: close Last-Modified: Wed, 07 Feb 2024 14:34:00 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: D8tbqBnnQzsmPNpgLlB1pYxweLZ4jfVQ Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 15:58:52 GMT ETag: "9f91bb862449cb9e9205f6f0a89b9eca" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 25d9b5959eaa82bb18ee3f35e6bf34b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: AEdFwQxOngWDq429YRX8Itk82pwEVHJ53KRiCyBniLLtPxmaCnCcYA== Age: 9403 Vary: Origin
2024-02-08 18:35:34 UTC	2065	IN	Data Raw: 2e 61 35 32 39 37 33 39 64 65 35 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 73 74 72 65 74 63 68 3b 62 6f 72 64 65 72 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 77 69 64 74 68 5f 31 30 30 29 20 73 6f 6c 69 64 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 5f 61 6c 74 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 72 61 64 69 75 73 5f 32 30 30 29 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 66 65 Data Ascii: .a529739de5{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch;border:var(--bui_border_width_100) solid;border-color:var(--bui_color_border_alt);border-radius:var(--bui_border_radius_200);overflow:hidden}.fe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49751	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:34 UTC	575	OUT	GET /psb/capla/static/css/53a8d0d3.b1818b84.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:34 UTC	619	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 1198 Connection: close Date: Thu, 08 Feb 2024 11:43:56 GMT Last-Modified: Thu, 08 Feb 2024 11:37:52 GMT ETag: "f820477c322829e348f318a453e432a5" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: BiPU5vSMYzP0dcXjFNJqaYKjd8Wn7Ys7 Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 a1a074529ccb9ea97acd7d95c506f336.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: nYmWL7Wvv8txu3VdthbjqIPRQ4nmwFgeNU2_A4Pos1KTk_znyF54vg== Age: 24699 Vary: Origin
2024-02-08 18:35:34 UTC	1198	IN	Data Raw: 2e 61 38 37 62 65 38 32 36 38 62 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 73 74 72 65 74 63 68 7d 2e 61 38 37 62 65 38 32 36 38 62 3a 6c 69 6e 6b 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 66 6f 72 65 67 72 6f 75 6e 64 5f 61 6c 74 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 7d 2e 62 30 62 63 66 66 62 35 64 63 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 72 61 64 69 75 73 5f 32 30 30 29 7d 2e 63 33 61 34 64 33 33 36 39 66 7b 6d 61 72 67 69 6e Data Ascii: .a87be8268b{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch}.a87be8268b:link{color:var(--bui_color_foreground_alt);font-weight:500}.b0bcffb5dc{border-radius:var(--bui_border_radius_200)}.c3a4d3369f{margin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49752	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:34 UTC	575	OUT	GET /psb/capla/static/css/cfbdd235.7a595d50.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:34 UTC	618	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 2479 Connection: close Last-Modified: Wed, 07 Feb 2024 14:34:00 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: b4ZmCJxSFsgSaixlCnSgPozOUwHV32pe Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 15:58:52 GMT ETag: "f22efe190d4cdfd20e43049d1c12a165" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 e268ddb03ed9480c5c602c27323a81ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: wUTaIocsTOulRq_45Omny9tpXDKpj4dVnh3nFaWLsmqTrzcPTIV6MQ== Age: 9402 Vary: Origin
2024-02-08 18:35:34 UTC	2479	IN	Data Raw: 2e 61 35 32 39 37 33 39 64 65 35 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 31 30 30 25 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 73 74 72 65 74 63 68 3b 62 6f 72 64 65 72 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 77 69 64 74 68 5f 31 30 30 29 20 73 6f 6c 69 64 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 5f 61 6c 74 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 72 61 64 69 75 73 5f 32 30 30 29 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 66 65 Data Ascii: .a529739de5{text-decoration:none;display:flex;flex-direction:column;height:100%;width:100%;align-items:stretch;border:var(--bui_border_width_100) solid;border-color:var(--bui_color_border_alt);border-radius:var(--bui_border_radius_200);overflow:hidden}.fe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49753	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:34 UTC	579	OUT	GET /libs/privacy-consent/releases/2.1.49/customer/cookie-banner.min.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:34 UTC	808	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 10673 Connection: close Server: nginx Date: Thu, 11 Jan 2024 14:09:53 GMT Last-Modified: Tue, 12 Dec 2023 09:10:15 GMT ETag: "65782377-29b1" Expires: Sat, 10 Feb 2024 14:09:53 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 a01680a1fee7e35f1738191420d98822.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: E4OZiNP71JUiUg6ER8mOj1-Q-mLAg-M--CT2sto23nLTJPv37Yg06Q== Age: 2435141
2024-02-08 18:35:34 UTC	10673	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 2c 65 2c 63 3d 21 31 2c 70 3d 7b 61 6e 61 6c 79 74 69 63 61 6c 3a 22 43 30 30 30 32 25 33 41 31 22 2c 6d 61 72 6b 65 74 69 6e 67 3a 22 43 30 30 30 34 25 33 41 31 22 7d 2c 69 3d 22 25 32 43 22 2c 61 3d 22 62 6b 6e 67 5f 77 76 70 63 22 2c 74 3d 28 2d 31 3c 28 6e 3d 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 3f 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3a 22 22 29 2e 69 6e 64 65 78 4f 66 28 22 2f 22 29 3f 6e 2e 73 70 6c 69 74 28 22 2f 22 29 5b 32 5d 3a 6e 2e 73 70 6c 69 74 28 22 2f 22 29 5b 30 5d 29 2e 73 70 6c 69 74 28 22 3a 22 29 5b 30 5d 2e 73 70 6c 69 74 28 22 3f 22 29 5b 30 5d 2c 6f 3d 2f 62 6f 6f 6b 69 6e 67 5c 2e 63 6e 2f 2e 74 65 73 74 28 6c 6f 63 61 74 69 Data Ascii: !function(){var n,e,c=!1,p={analytical:"C0002%3A1",marketing:"C0004%3A1"},i="%2C",a="bkng_wvpc",t=(-1<(n=window&&window.location?window.location.href:"").indexOf("/")?n.split("/")[2]:n.split("/")[0]).split(":")[0].split("?")[0],o=/booking\.cn/.test(locati

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49754	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:34 UTC	621	OUT	GET /static/js/genius_vip_cloudfront_sd/aae975495cc56436f4f59463b9ea4e594bdb102a.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:35 UTC	805	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 3448 Connection: close Server: nginx Date: Sat, 03 Feb 2024 10:41:25 GMT Last-Modified: Wed, 01 Nov 2023 08:40:16 GMT ETag: "65420ef0-d78" Expires: Mon, 04 Mar 2024 10:41:25 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 61bbe72b71f7b857c695c31fdeb7b3a6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: aIB1-iZctlURBiRsEuuPJPdH-cJDm1F_0KvCjpCsgoh9DAL1jE3XeA== Age: 460450
2024-02-08 18:35:35 UTC	3448	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 72 65 74 75 72 6e 20 5f 7d 3b 42 2e 64 65 66 69 6e 65 28 22 77 69 74 68 2d 63 61 70 6c 61 22 2c 66 75 6e 63 74 69 6f 6e 28 5f 2c 69 2c 65 29 7b 5f 69 5f 28 22 65 64 64 3a 63 61 62 62 32 34 66 36 22 29 3b 76 61 72 20 6e 3d 5f 28 22 70 72 6f 6d 69 73 65 22 29 2c 74 3d 7b 7d 2c 72 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 64 28 5f 29 7b 72 65 74 75 72 6e 20 5f 69 5f 28 22 65 64 64 3a 34 64 33 35 30 35 39 33 22 29 2c 5f 72 5f 28 5f 2e 73 6c 69 63 65 28 30 2c 2d 38 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 69 29 7b 72 65 74 75 72 6e 20 5f 69 5f 28 22 65 64 64 3a 64 63 65 63 66 66 34 39 22 29 2c Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(_){return _};B.define("with-capla",function(_,i,e){_i_("edd:cabb24f6");var n=_("promise"),t={},r={};function d(_){return _i_("edd:4d350593"),_r_(_.slice(0,-8))}function a(i){return _i_("edd:dcecff49"),

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49755	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:35 UTC	621	OUT	GET /static/js/sp-on-maps_cloudfront_sd/d30eef4dc5202875d4c3301b8a0e8ff09f9a0e28.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:35 UTC	807	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 9646 Connection: close Server: nginx Date: Thu, 25 Jan 2024 10:20:28 GMT Last-Modified: Thu, 19 May 2022 11:44:13 GMT ETag: "62862d8d-25ae" Expires: Sat, 24 Feb 2024 10:20:28 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 45893c5ff2aa24fa7dce9573a0274642.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 2DD03vG7oO-lu4Ni6lpZClIU7uS5HAuGpCuMrSrqIuUexzVBzXh4lA== Age: 1239307
2024-02-08 18:35:35 UTC	9646	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 3b 42 2e 64 65 66 69 6e 65 28 22 75 74 69 6c 73 2f 62 69 6e 64 2d 61 6c 6c 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 5f 69 5f 28 22 66 65 33 3a 63 61 32 30 64 35 36 32 22 29 2c 6e 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 20 69 6e 20 5f 69 5f 28 22 66 65 33 3a 66 65 37 32 33 37 31 31 22 29 2c 65 29 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 5b 74 5d 26 26 28 65 5b 74 5d 3d 65 5b 74 5d 2e 62 69 6e 64 28 65 29 29 3b 72 65 74 75 72 6e 20 5f 72 5f 28 65 29 7d 2c 5f 72 5f 28 29 7d 29 2c 42 Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};B.define("utils/bind-all",function(e,t,n){_i_("fe3:ca20d562"),n.exports=function(e){for(var t in _i_("fe3:fe723711"),e)"function"==typeof e[t]&&(e[t]=e[t].bind(e));return _r_(e)},_r_()}),B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49756	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:35 UTC	614	OUT	GET /static/js/raf_cloudfront_sd/92b3daaabd4371c78818992ce9342e212f673b31.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:35 UTC	809	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 124312 Connection: close Server: nginx Date: Thu, 01 Feb 2024 09:21:18 GMT Last-Modified: Fri, 22 Sep 2023 15:01:10 GMT ETag: "650dac36-1e598" Expires: Sat, 02 Mar 2024 09:21:18 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 d125bf8405e840aa51a88ae3d8d91fb2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: FCEhg4e3P_XMifrx1KuWdth9HDC8dMm-uLhbwW2zMj-1xyLV_ZU8Ug== Age: 638057
2024-02-08 18:35:35 UTC	16384	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 3b 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 65 6e 61 62 6c 65 5f 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 26 26 28 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 2e 72 61 66 3d 7b 6c 6f 61 64 65 64 3a 21 30 2c 72 75 6e 3a 21 31 7d 29 2c 42 2e 64 65 66 69 6e 65 28 22 63 6f 6d 70 6f 6e 65 6e 74 2f 72 65 66 65 72 72 61 6c 2f 66 6c 6f 61 74 65 72 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 69 29 7b 5f 69 5f 28 22 34 34 64 3a 34 33 39 63 62 37 64 64 22 29 3b 76 61 72 20 72 3d 65 28 22 63 6f 6d 70 6f 6e 65 6e 74 22 29 2c 61 3d Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.raf={loaded:!0,run:!1}),B.define("component/referral/floater",function(e,n,i){_i_("44d:439cb7dd");var r=e("component"),a=
2024-02-08 18:35:35 UTC	16384	IN	Data Raw: 72 22 29 2b 22 3c 2f 61 3e 3c 2f 70 3e 22 2c 66 65 5f 73 65 6c 66 5f 72 65 66 65 72 72 61 6c 3a 21 21 73 2e 72 65 66 65 72 72 61 6c 5f 64 61 74 61 2e 66 65 5f 73 65 6c 66 5f 72 65 66 65 72 72 61 6c 2c 62 5f 73 69 74 65 5f 74 79 70 65 3a 73 2e 62 5f 73 69 74 65 5f 74 79 70 65 2c 66 65 5f 72 61 66 5f 64 65 73 6b 74 6f 70 5f 66 72 69 65 6e 64 5f 6c 61 6e 64 69 6e 67 5f 62 61 6e 6e 65 72 5f 6d 69 6e 69 6d 75 6d 5f 73 70 65 6e 64 3a 63 2e 74 72 61 6e 73 6c 61 74 69 6f 6e 73 28 22 72 61 66 5f 64 65 73 6b 74 6f 70 5f 66 72 69 65 6e 64 5f 6c 61 6e 64 69 6e 67 5f 62 61 6e 6e 65 72 5f 6d 69 6e 69 6d 75 6d 5f 73 70 65 6e 64 22 2c 6e 75 6c 6c 2c 7b 6d 69 6e 69 6d 75 6d 5f 73 70 65 6e 64 3a 73 2e 72 65 66 65 72 72 61 6c 5f 64 61 74 61 2e 62 5f 72 61 66 5f 6d 69 6e 5f Data Ascii: r")+"</a></p>",fe_self_referral:!!s.referral_data.fe_self_referral,b_site_type:s.b_site_type,fe_raf_desktop_friend_landing_banner_minimum_spend:c.translations("raf_desktop_friend_landing_banner_minimum_spend",null,{minimum_spend:s.referral_data.b_raf_min_
2024-02-08 18:35:36 UTC	16384	IN	Data Raw: 5d 2c 28 65 2e 75 6e 73 68 69 66 74 28 7b 6e 61 6d 65 3a 5f 5b 31 32 5d 2c 73 69 7a 65 3a 5f 5b 31 33 5d 7d 29 2c 61 3d 72 2e 48 45 4c 50 45 52 28 22 69 63 6f 6e 22 2c 65 5b 30 5d 29 2c 65 2e 73 68 69 66 74 28 29 2c 61 29 2c 5f 5b 31 34 5d 5d 2e 6a 6f 69 6e 28 22 22 29 29 2c 69 3d 5f 72 5f 28 6e 29 2c 69 2b 3d 5f 5b 31 35 5d 2c 5f 72 5f 28 69 29 7d 29 7d 28 29 29 2c 69 2e 65 78 70 6f 72 74 73 3d 72 2e 65 78 74 65 6e 64 28 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 34 34 64 3a 31 36 61 39 63 36 35 62 22 29 3b 76 61 72 20 65 3d 42 2e 6a 73 74 6d 70 6c 28 22 69 6e 76 61 6c 69 64 5f 6c 69 6e 6b 5f 63 61 72 64 22 29 2c 6e 3d 7b 62 5f 72 61 66 5f 6c 69 5f 69 6e 3a 74 68 69 73 2e 24 65 6c 2e 64 61 74 61 28 22 72 61 66 2d 6c 69 2d 69 6e 22 Data Ascii: ],(e.unshift({name:_[12],size:_[13]}),a=r.HELPER("icon",e[0]),e.shift(),a),_[14]].join("")),i=_r_(n),i+=_[15],_r_(i)})}()),i.exports=r.extend({init:function(){_i_("44d:16a9c65b");var e=B.jstmpl("invalid_link_card"),n={b_raf_li_in:this.$el.data("raf-li-in"
2024-02-08 18:35:36 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 27 2c 27 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 63 6c 61 73 73 3d 22 62 75 69 2d 62 75 74 74 6f 6e 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 62 75 69 2d 62 75 74 74 6f 6e 5f 5f 74 65 78 74 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 27 2c 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 73 70 61 6e 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 22 2c 27 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 75 69 2d 67 72 6f 75 70 5f 5f 69 74 65 6d 22 3e Data Ascii: <a href="','" target="_blank" class="bui-button">\n <span class="bui-button__text">\n ',"\n </span>\n </a>\n ",'\n <div class="bui-group__item">
2024-02-08 18:35:36 UTC	16384	IN	Data Raw: 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 75 69 2d 67 72 6f 75 70 5f 5f 69 74 65 6d 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 63 6c 61 73 73 3d 22 62 75 69 2d 62 75 74 74 6f 6e 20 62 75 69 2d 62 75 74 74 6f 6e 2d 2d 70 72 69 6d 61 72 79 22 20 64 61 74 61 2d 62 75 69 2d 72 65 66 3d 22 6d 6f 64 61 6c 2d 63 6c 6f 73 65 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 62 75 69 2d 62 75 74 74 6f 6e 5f 5f 74 65 78 74 22 3e 27 2c 22 3c 2f 73 70 61 6e 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 62 75 74 74 6f 6e 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <div class="bui-group__item">\n <button type="button" class="bui-button bui-button--primary" data-bui-ref="modal-close">\n <span class="bui-button__text">',"</span>\n </button>\n
2024-02-08 18:35:36 UTC	16384	IN	Data Raw: 6f 4f 70 65 6e 41 6e 64 44 69 73 6d 69 73 73 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 34 34 64 3a 34 31 35 32 35 33 30 37 22 29 2c 74 68 69 73 2e 6d 6f 64 61 6c 2e 6f 70 65 6e 28 29 2c 74 68 69 73 2e 73 65 74 53 74 61 74 65 28 7b 73 68 6f 75 6c 64 5f 6d 6f 64 61 6c 5f 61 75 74 6f 5f 6f 70 65 6e 3a 21 31 7d 29 2c 5f 28 22 72 65 77 61 72 64 73 5f 70 72 6f 6d 6f 5f 62 61 6e 6e 65 72 5f 6d 6f 64 61 6c 5f 61 75 74 6f 5f 6f 70 65 6e 22 29 2c 5f 72 5f 28 29 7d 2c 6f 70 65 6e 4d 6f 64 61 6c 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 34 34 64 3a 39 39 33 35 65 65 32 37 22 29 2c 74 68 69 73 2e 6d 6f 64 61 6c 2e 6f 70 65 6e 28 29 2c 74 68 69 73 2e 73 65 74 53 74 61 74 65 28 7b 73 68 6f 75 6c 64 5f 6d 6f 64 61 6c 5f 61 75 74 6f 5f 6f 70 65 6e 3a 21 Data Ascii: oOpenAndDismiss:function(){_i_("44d:41525307"),this.modal.open(),this.setState({should_modal_auto_open:!1}),_("rewards_promo_banner_modal_auto_open"),_r_()},openModal:function(){_i_("44d:9935ee27"),this.modal.open(),this.setState({should_modal_auto_open:!
2024-02-08 18:35:36 UTC	16384	IN	Data Raw: 66 65 72 2d 69 73 2d 61 63 74 69 76 65 22 2c 27 22 3e 5c 6e 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 75 69 2d 63 61 72 64 5f 5f 63 6f 6e 74 65 6e 74 22 3e 5c 6e 20 20 20 20 20 20 20 20 3c 68 65 61 64 65 72 20 63 6c 61 73 73 3d 22 62 75 69 2d 63 61 72 64 5f 5f 68 65 61 64 65 72 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 63 6c 61 73 73 3d 22 62 75 69 2d 63 61 72 64 5f 5f 74 69 74 6c 65 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 27 2c 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 2c 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 2c 27 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 68 32 3e 5c 6e 20 20 20 20 20 20 20 20 3c 2f 68 65 61 64 65 72 3e 5c 6e 20 20 20 20 20 20 20 20 Data Ascii: fer-is-active",'">\n <div class="bui-card__content">\n <header class="bui-card__header">\n <h2 class="bui-card__title">\n ',"\n ","\n ",'\n </h2>\n </header>\n
2024-02-08 18:35:36 UTC	9409	IN	Data Raw: 69 6e 67 2e 6a 73 74 6d 70 6c 28 22 65 72 72 6f 72 5f 6d 73 67 73 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 34 34 64 3a 61 62 32 39 33 61 61 30 22 29 3b 76 61 72 20 61 3d 5b 22 2f 70 72 69 76 61 74 65 2f 77 77 77 5f 70 72 6f 6d 6f 5f 63 6f 64 65 5f 62 73 33 5f 65 72 72 6f 72 5f 69 6e 76 61 6c 69 64 2f 6e 61 6d 65 22 2c 22 5c 6e 22 2c 22 2f 70 72 69 76 61 74 65 2f 77 77 77 5f 70 72 6f 6d 6f 5f 63 6f 64 65 5f 62 73 33 5f 65 72 72 6f 72 5f 61 6c 72 65 61 64 79 5f 75 73 65 64 2f 6e 61 6d 65 22 2c 22 2f 70 72 69 76 61 74 65 2f 77 77 77 5f 70 72 6f 6d 6f 5f 63 6f 64 65 5f 62 73 33 5f 65 72 72 6f 72 5f 75 6e 6b 6e 6f 77 6e 2f 6e 61 6d 65 22 2c 22 2f 70 72 69 76 61 74 65 2f 72 65 77 61 72 64 73 5f 72 65 64 65 65 6d 5f 65 6e 74 65 72 5f 65 6d 61 69 6c Data Ascii: ing.jstmpl("error_msgs",function(){_i_("44d:ab293aa0");var a=["/private/www_promo_code_bs3_error_invalid/name","\n","/private/www_promo_code_bs3_error_already_used/name","/private/www_promo_code_bs3_error_unknown/name","/private/rewards_redeem_enter_email
2024-02-08 18:35:36 UTC	215	IN	Data Raw: 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 2c 7b 69 64 3a 22 72 65 77 61 72 64 73 2d 66 65 65 64 62 61 63 6b 2d 6d 6f 64 61 6c 22 7d 29 2c 74 68 69 73 2e 6d 6f 64 61 6c 26 26 74 68 69 73 2e 6d 6f 64 61 6c 2e 6d 6f 75 6e 74 28 29 2c 74 68 69 73 2e 6d 6f 64 61 6c 26 26 74 68 69 73 2e 6d 6f 64 61 6c 2e 6f 70 65 6e 28 29 2c 5f 72 5f 28 29 7d 7d 29 2c 5f 72 5f 28 29 7d 29 2c 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 65 6e 61 62 6c 65 5f 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 26 26 28 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 2e 72 61 66 2e 72 75 6e 3d 21 30 29 3b Data Ascii: ument.createElement("div"),{id:"rewards-feedback-modal"}),this.modal&&this.modal.mount(),this.modal&&this.modal.open(),_r_()}}),_r_()}),booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.raf.run=!0);

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49757	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:35 UTC	628	OUT	GET /static/js/crossorigin_check_cloudfront_sd/2454015045ef79168d452ff4e7f30bdadff0aa81.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:35 UTC	779	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 95 Connection: close Server: nginx Date: Mon, 29 Jan 2024 09:12:55 GMT Last-Modified: Wed, 10 Apr 2019 11:21:38 GMT ETag: "5cadd1c2-5f" Expires: Wed, 28 Feb 2024 09:12:55 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 b0c7b942a33f0f4451718aee53f7840c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Af49NvmjZd8_rq3Y3GG5nGmooFVWEfryuh7Q-7bDnhvF0Fb0erE0wA== Age: 897760
2024-02-08 18:35:35 UTC	95	IN	Data Raw: 77 69 6e 64 6f 77 2e 62 5f 63 72 6f 73 73 6f 72 69 67 69 6e 5f 73 75 70 70 6f 72 74 3d 31 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 62 5f 63 6f 72 73 5f 63 68 65 63 6b 26 26 77 69 6e 64 6f 77 2e 62 5f 63 6f 72 73 5f 63 68 65 63 6b 28 21 30 29 3b Data Ascii: window.b_crossorigin_support=1,"function"==typeof window.b_cors_check&&window.b_cors_check(!0);

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49759	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:35 UTC	657	OUT	GET /static/img/tfl/group_logos/logo_booking/27c8d1832de6a3123b6ee45b59ae2f81b0d9d0d0.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:35 UTC	769	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1628 Connection: close Server: nginx Date: Sun, 28 Jan 2024 18:31:27 GMT Last-Modified: Wed, 10 Apr 2019 11:21:55 GMT ETag: "5cadd1d3-65c" Expires: Tue, 27 Feb 2024 18:31:27 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 f4c38e024a95b76a27c9f3dc9ff2eda6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: sLVBijBpmpI1VmAaF1i8waBgGrYH8hP3DQPxwg5L5KiEZbDcY94TTQ== Age: 950648
2024-02-08 18:35:35 UTC	1628	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 5b 00 00 00 1a 08 06 00 00 00 d8 32 20 50 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 06 62 4b 47 44 00 00 00 00 00 00 f9 43 bb 7f 00 00 05 b0 49 44 41 54 68 de ed d9 7d 6c 5f 65 15 07 f0 4f 3b 9c 1a e7 84 a1 88 a6 2a c2 4c e6 f6 53 27 be 47 2f 6e a2 cb 32 32 9d 62 64 be b4 73 fb 8d 28 64 b2 78 8d 98 b8 28 4a 88 e0 1f de d4 21 11 c6 aa bc cf 45 02 9b 0e 25 2c c2 e0 32 03 03 75 63 65 44 7c 19 93 1f 63 c8 d8 98 a8 98 ce 75 fe f1 9c 5f 7b 5b 5b 5c 4c 6d 33 ec 37 b9 f9 9d e7 9c e7 3e 2f df e7 3c e7 9c db b6 1c 3e 7c d8 38 46 07 ad 63 bd 80 ff 27 8c 93 3d 8a 18 Data Ascii: PNGIHDR[2 PgAMAa cHRMz&u0`:pQ<bKGDCIDATh}l_eO;*LS'G/n22bds(dx(J!E%,2uceD\|cu_{[[\Lm37>/<>\|8Fc'=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49758	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:35 UTC	627	OUT	GET /static/js/lazy_load_images_cloudfront_sd/77204d4da4aa41b08b1a4062c8e66e4629550994.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:35 UTC	807	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 5619 Connection: close Server: nginx Date: Wed, 17 Jan 2024 20:20:42 GMT Last-Modified: Tue, 04 Feb 2020 10:19:57 GMT ETag: "5e39454d-15f3" Expires: Fri, 16 Feb 2024 20:20:42 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 34411558fb3a23efdbbaaddb8a12b574.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: PkcWdsznMPLg0N8miL6aNrODk0drUOkWubTiiB-o9mLgtJnw7x998Q== Age: 1894493
2024-02-08 18:35:35 UTC	5619	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 49 6d 61 67 65 4c 61 7a 79 4c 6f 61 64 65 72 28 29 7b 5f 69 5f 28 22 37 39 36 3a 61 33 63 34 65 32 30 38 22 29 2c 74 68 69 73 2e 68 69 67 68 52 65 73 51 75 65 75 65 3d 5b 5d 2c 74 68 69 73 2e 73 68 6f 75 6c 64 4c 6f 61 64 48 69 67 68 52 65 73 3d 21 31 2c 74 68 69 73 2e 76 69 65 77 50 6f 72 74 45 78 74 65 6e 64 65 64 48 65 69 67 68 74 3d 6e 75 6c 6c 2c 74 68 69 73 2e 69 73 57 61 74 63 68 69 6e 67 46 6f 72 4e 65 77 49 6d 61 67 65 73 3d 21 31 2c 74 68 69 73 2e 73 75 70 70 6f 72 74 73 49 6e 74 65 72 73 65 63 74 69 6f 6e 4f 62 73 65 72 Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};function ImageLazyLoader(){_i_("796:a3c4e208"),this.highResQueue=[],this.shouldLoadHighRes=!1,this.viewPortExtendedHeight=null,this.isWatchingForNewImages=!1,this.supportsIntersectionObser

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49761	104.18.131.236	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:36 UTC	544	OUT	GET /scripttemplates/otSDKStub.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:36 UTC	815	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:35:36 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Content-MD5: dulN1EiikhiO8GlkrdtHlg== Last-Modified: Tue, 06 Feb 2024 07:09:06 GMT x-ms-request-id: b39da2f1-501e-0040-7e72-593ebb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 23531 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8525f930093b4588-ATL
2024-02-08 18:35:36 UTC	554	IN	Data Raw: 35 32 36 63 0d 0a 76 61 72 20 4f 6e 65 54 72 75 73 74 53 74 75 62 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 61 2c 6f 2c 70 3d 6e 65 77 20 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 43 6f 6f 6b 69 65 4e 61 6d 65 3d 22 4f 70 74 61 6e 6f 6e 43 6f 6e 73 65 6e 74 22 2c 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 48 74 6d 6c 47 72 6f 75 70 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 48 6f 73 74 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 67 65 6e 56 65 6e 64 6f 72 73 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 76 65 6e 64 6f 72 73 53 65 72 76 69 63 65 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 49 41 42 43 6f 6f 6b 69 65 56 61 6c 75 65 3d 22 22 2c 74 68 69 73 2e 6f 6e 65 54 72 75 73 74 49 41 42 Data Ascii: 526cvar OneTrustStub=function(t){"use strict";var a,o,p=new function(){this.optanonCookieName="OptanonConsent",this.optanonHtmlGroupData=[],this.optanonHostData=[],this.genVendorsData=[],this.vendorsServiceData=[],this.IABCookieValue="",this.oneTrustIAB
2024-02-08 18:35:36 UTC	1369	IN	Data Raw: 48 52 22 2c 22 4c 49 22 2c 22 4e 4f 22 2c 22 49 53 22 5d 2c 74 68 69 73 2e 73 74 75 62 46 69 6c 65 4e 61 6d 65 3d 22 6f 74 53 44 4b 53 74 75 62 22 2c 74 68 69 73 2e 44 41 54 41 46 49 4c 45 41 54 54 52 49 42 55 54 45 3d 22 64 61 74 61 2d 64 6f 6d 61 69 6e 2d 73 63 72 69 70 74 22 2c 74 68 69 73 2e 62 61 6e 6e 65 72 53 63 72 69 70 74 4e 61 6d 65 3d 22 6f 74 42 61 6e 6e 65 72 53 64 6b 2e 6a 73 22 2c 74 68 69 73 2e 6d 6f 62 69 6c 65 4f 6e 6c 69 6e 65 55 52 4c 3d 5b 5d 2c 74 68 69 73 2e 69 73 4d 69 67 72 61 74 65 64 55 52 4c 3d 21 31 2c 74 68 69 73 2e 6d 69 67 72 61 74 65 64 43 43 54 49 44 3d 22 5b 5b 4f 6c 64 43 43 54 49 44 5d 5d 22 2c 74 68 69 73 2e 6d 69 67 72 61 74 65 64 44 6f 6d 61 69 6e 49 64 3d 22 5b 5b 4e 65 77 44 6f 6d 61 69 6e 49 64 5d 5d 22 2c 74 68 Data Ascii: HR","LI","NO","IS"],this.stubFileName="otSDKStub",this.DATAFILEATTRIBUTE="data-domain-script",this.bannerScriptName="otBannerSdk.js",this.mobileOnlineURL=[],this.isMigratedURL=!1,this.migratedCCTID="[[OldCCTID]]",this.migratedDomainId="[[NewDomainId]]",th
2024-02-08 18:35:36 UTC	1369	IN	Data Raw: 68 69 73 2e 63 61 6d 65 6c 69 7a 65 28 61 5b 30 5d 29 5d 3d 61 5b 31 5d 2e 74 72 69 6d 28 29 7d 72 65 74 75 72 6e 20 65 7d 2c 65 29 3b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 74 68 69 73 2e 69 6d 70 6c 65 6d 65 6e 74 54 68 65 50 6f 6c 79 66 69 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 2c 6f 3d 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 3b 72 65 74 75 72 6e 20 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 22 73 74 79 6c 65 22 21 3d 3d 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 26 26 6f 2e 61 70 70 6c 79 28 74 68 69 73 2c 5b 74 2c 65 5d 29 2c 22 73 74 79 6c 65 Data Ascii: his.camelize(a[0])]=a[1].trim()}return e},e);function e(){var t=this;this.implementThePolyfill=function(){var a=t,o=Element.prototype.setAttribute;return Element.prototype.setAttribute=function(t,e){if("style"!==t.toLowerCase()&&o.apply(this,[t,e]),"style
2024-02-08 18:35:36 UTC	1369	IN	Data Raw: 6f 76 65 47 70 70 41 70 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 64 65 6c 65 74 65 20 73 2e 77 69 6e 2e 5f 5f 67 70 70 3b 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 69 66 72 61 6d 65 5b 6e 61 6d 65 3d 22 2b 73 2e 4c 4f 43 41 54 4f 52 5f 4e 41 4d 45 2b 22 5d 22 29 5b 30 5d 3b 74 26 26 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 29 7d 2c 74 68 69 73 2e 65 78 65 63 75 74 65 47 70 70 41 70 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 65 3d 30 3b 65 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 74 5b 65 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 65 5d 3b 76 61 72 20 69 3d 6e 75 6c 6c 3d 3d 28 69 3d 73 2e 77 69 6e 29 3f Data Ascii: oveGppApi=function(){delete s.win.__gpp;var t=document.querySelectorAll("iframe[name="+s.LOCATOR_NAME+"]")[0];t&&t.parentElement.removeChild(t)},this.executeGppApi=function(){for(var t=[],e=0;e<arguments.length;e++)t[e]=arguments[e];var i=null==(i=s.win)?
2024-02-08 18:35:36 UTC	1369	IN	Data Raw: 6e 61 6d 65 3d 74 2c 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 69 74 6c 65 22 2c 22 47 50 50 20 4c 6f 63 61 74 6f 72 22 29 2c 69 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 29 3a 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 73 2e 61 64 64 46 72 61 6d 65 28 74 29 7d 2c 35 29 29 2c 21 6e 7d 2c 74 68 69 73 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 69 2c 6e 3d 73 2e 77 69 6e 2e 5f 5f 67 70 70 3b 72 65 74 75 72 6e 20 6e 2e 65 76 65 6e 74 73 3d 6e 2e 65 76 65 6e 74 73 7c 7c 5b 5d 2c 6e 75 6c 6c 21 3d 28 69 3d 6e 29 26 26 69 2e 6c 61 73 74 49 64 7c 7c 28 6e 2e 6c 61 73 74 49 64 3d 30 29 2c 6e 2e 6c 61 73 74 49 64 2b 2b 2c 6e 2e 65 76 65 6e 74 73 2e 70 Data Ascii: name=t,e.setAttribute("title","GPP Locator"),i.body.appendChild(e)):setTimeout(function(){s.addFrame(t)},5)),!n},this.addEventListener=function(t,e){var i,n=s.win.__gpp;return n.events=n.events\|\|[],null!=(i=n)&&i.lastId\|\|(n.lastId=0),n.lastId++,n.events.p
2024-02-08 18:35:36 UTC	1369	IN	Data Raw: 63 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6e 6f 6e 63 65 3d 70 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2e 6e 6f 6e 63 65 7c 7c 70 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 6e 6f 6e 63 65 22 29 7c 7c 6e 75 6c 6c 7d 2c 68 2e 70 72 6f 74 6f 74 79 70 65 2e 66 65 74 63 68 42 61 6e 6e 65 72 53 44 4b 44 65 70 65 6e 64 65 6e 63 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 73 65 74 44 6f 6d 61 69 6e 44 61 74 61 46 69 6c 65 55 52 4c 28 29 2c 74 68 69 73 2e 63 72 6f 73 73 4f 72 69 67 69 6e 3d 70 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 63 72 6f 73 73 6f 72 69 67 69 6e 22 29 7c 7c 6e 75 6c 6c 2c 74 68 69 73 2e 70 72 Data Ascii: ce=function(){this.nonce=p.stubScriptElement.nonce\|\|p.stubScriptElement.getAttribute("nonce")\|\|null},h.prototype.fetchBannerSDKDependency=function(){this.setDomainDataFileURL(),this.crossOrigin=p.stubScriptElement.getAttribute("crossorigin")\|\|null,this.pr
2024-02-08 18:35:36 UTC	1369	IN	Data Raw: 70 6f 6e 73 65 2c 74 68 69 73 2e 73 65 74 47 65 6f 4c 6f 63 61 74 69 6f 6e 28 69 2e 63 6f 75 6e 74 72 79 43 6f 64 65 2c 69 2e 73 74 61 74 65 43 6f 64 65 29 2c 74 68 69 73 2e 61 64 64 42 61 6e 6e 65 72 53 44 4b 53 63 72 69 70 74 28 74 29 29 3a 28 69 3d 74 68 69 73 2e 72 65 61 64 43 6f 6f 6b 69 65 50 61 72 61 6d 28 70 2e 6f 70 74 61 6e 6f 6e 43 6f 6f 6b 69 65 4e 61 6d 65 2c 70 2e 67 65 6f 6c 6f 63 61 74 69 6f 6e 43 6f 6f 6b 69 65 73 50 61 72 61 6d 29 29 7c 7c 74 2e 53 6b 69 70 47 65 6f 6c 6f 63 61 74 69 6f 6e 3f 28 65 3d 69 2e 73 70 6c 69 74 28 22 3b 22 29 5b 30 5d 2c 69 3d 69 2e 73 70 6c 69 74 28 22 3b 22 29 5b 31 5d 2c 74 68 69 73 2e 73 65 74 47 65 6f 4c 6f 63 61 74 69 6f 6e 28 65 2c 69 29 2c 74 68 69 73 2e 61 64 64 42 61 6e 6e 65 72 53 44 4b 53 63 72 69 Data Ascii: ponse,this.setGeoLocation(i.countryCode,i.stateCode),this.addBannerSDKScript(t)):(i=this.readCookieParam(p.optanonCookieName,p.geolocationCookiesParam))\|\|t.SkipGeolocation?(e=i.split(";")[0],i=i.split(";")[1],this.setGeoLocation(e,i),this.addBannerSDKScri
2024-02-08 18:35:36 UTC	1369	IN	Data Raw: 65 29 7b 70 2e 75 73 65 72 4c 6f 63 61 74 69 6f 6e 3d 7b 63 6f 75 6e 74 72 79 3a 74 2c 73 74 61 74 65 3a 65 3d 76 6f 69 64 20 30 3d 3d 3d 65 3f 22 22 3a 65 7d 7d 2c 68 2e 70 72 6f 74 6f 74 79 70 65 2e 6f 74 46 65 74 63 68 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 69 2c 65 2c 6e 2c 61 29 7b 76 6f 69 64 20 30 3d 3d 3d 65 26 26 28 65 3d 21 31 29 2c 76 6f 69 64 20 30 3d 3d 3d 6e 26 26 28 6e 3d 6e 75 6c 6c 29 3b 76 61 72 20 6f 3d 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 26 26 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 6f 74 50 72 65 76 69 65 77 44 61 74 61 22 29 3b 69 66 28 6e 65 77 20 52 65 67 45 78 70 28 22 5e 66 69 6c 65 3a 2f 2f 22 2c 22 69 22 29 2e 74 65 73 74 28 74 29 29 74 68 69 73 2e 6f Data Ascii: e){p.userLocation={country:t,state:e=void 0===e?"":e}},h.prototype.otFetch=function(t,i,e,n,a){void 0===e&&(e=!1),void 0===n&&(n=null);var o=window.sessionStorage&&window.sessionStorage.getItem("otPreviewData");if(new RegExp("^file://","i").test(t))this.o
2024-02-08 18:35:36 UTC	1369	IN	Data Raw: 6f 6e 2c 6f 3d 74 2e 52 75 6c 65 53 65 74 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 21 30 3d 3d 3d 74 2e 44 65 66 61 75 6c 74 7d 29 3b 69 66 28 21 61 2e 63 6f 75 6e 74 72 79 26 26 21 61 2e 73 74 61 74 65 29 72 65 74 75 72 6e 20 6f 26 26 30 3c 6f 2e 6c 65 6e 67 74 68 3f 6f 5b 30 5d 3a 6e 75 6c 6c 3b 66 6f 72 28 76 61 72 20 73 3d 61 2e 73 74 61 74 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 72 3d 61 2e 63 6f 75 6e 74 72 79 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 75 3d 30 3b 75 3c 74 2e 52 75 6c 65 53 65 74 2e 6c 65 6e 67 74 68 3b 75 2b 2b 29 69 66 28 21 30 3d 3d 3d 74 2e 52 75 6c 65 53 65 74 5b 75 5d 2e 47 6c 6f 62 61 6c 29 6e 3d 74 2e 52 75 6c 65 53 65 74 5b 75 5d 3b 65 6c 73 65 7b 76 61 72 20 6c 3d 74 2e 52 75 Data Ascii: on,o=t.RuleSet.filter(function(t){return!0===t.Default});if(!a.country&&!a.state)return o&&0<o.length?o[0]:null;for(var s=a.state.toLowerCase(),r=a.country.toLowerCase(),u=0;u<t.RuleSet.length;u++)if(!0===t.RuleSet[u].Global)n=t.RuleSet[u];else{var l=t.Ru
2024-02-08 18:35:36 UTC	1369	IN	Data Raw: 74 43 6f 6f 6b 69 65 28 70 2e 6f 6e 65 54 72 75 73 74 49 41 42 43 6f 6f 6b 69 65 4e 61 6d 65 29 29 3a 70 2e 69 73 53 74 75 62 52 65 61 64 79 3d 21 31 7d 2c 68 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 69 64 61 74 65 49 41 42 47 44 50 52 41 70 70 6c 69 65 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 74 68 69 73 2e 72 65 61 64 43 6f 6f 6b 69 65 50 61 72 61 6d 28 70 2e 6f 70 74 61 6e 6f 6e 43 6f 6f 6b 69 65 4e 61 6d 65 2c 70 2e 67 65 6f 6c 6f 63 61 74 69 6f 6e 43 6f 6f 6b 69 65 73 50 61 72 61 6d 29 2e 73 70 6c 69 74 28 22 3b 22 29 5b 30 5d 3b 74 3f 74 68 69 73 2e 69 73 42 6f 6f 6c 65 61 6e 28 74 29 3f 70 2e 6f 6e 65 54 72 75 73 74 49 41 42 67 64 70 72 41 70 70 6c 69 65 73 47 6c 6f 62 61 6c 6c 79 3d 22 74 72 75 65 22 3d 3d 3d 74 3a 70 2e 6f 6e 65 Data Ascii: tCookie(p.oneTrustIABCookieName)):p.isStubReady=!1},h.prototype.validateIABGDPRApplied=function(){var t=this.readCookieParam(p.optanonCookieName,p.geolocationCookiesParam).split(";")[0];t?this.isBoolean(t)?p.oneTrustIABgdprAppliesGlobally="true"===t:p.one

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49771	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:37 UTC	659	OUT	GET /static/img/tfl/group_logos/logo_priceline/f80e129541f2a952d470df2447373390f3dd4e44.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:37 UTC	769	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1591 Connection: close Server: nginx Date: Sun, 28 Jan 2024 18:31:28 GMT Last-Modified: Wed, 10 Apr 2019 11:21:55 GMT ETag: "5cadd1d3-637" Expires: Tue, 27 Feb 2024 18:31:28 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 6e0f9dce97fcb3c9b684592a289e4e72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 6V77KgB--T1kH7umdTz8dF95NYGlXdMdo32Y8iupYNNrv06ZF730_g== Age: 950649
2024-02-08 18:35:37 UTC	1591	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 5b 00 00 00 1a 08 03 00 00 00 ef ec d0 62 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 02 2e 50 4c 54 45 ff ff ff 00 00 00 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 Data Ascii: PNGIHDR[bgAMAa cHRMz&u0`:pQ<.PLTE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49774	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:37 UTC	655	OUT	GET /static/img/tfl/group_logos/logo_kayak/83ef7122074473a6566094e957ff834badb58ce6.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:37 UTC	769	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1154 Connection: close Server: nginx Date: Sun, 28 Jan 2024 18:31:28 GMT Last-Modified: Wed, 10 Apr 2019 11:21:55 GMT ETag: "5cadd1d3-482" Expires: Tue, 27 Feb 2024 18:31:28 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 086e2cd5d94fa729de58c51b5666e0e4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: JhTuQTQ8e7YRkg06WDqrWEi1-L5X4aatZO1sIjtv4r4a9tvdWTAOeQ== Age: 950649
2024-02-08 18:35:37 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 4f 00 00 00 1a 08 06 00 00 00 f6 77 01 c2 00 00 04 49 49 44 41 54 78 01 ed 98 03 b0 ed 3a 18 85 73 6c 9f 67 db b6 79 6d df 7b 6c 6c 3d db b6 6d db b6 6d db b6 cd ef b5 b3 66 5e f6 41 b3 31 7a 68 67 fe 69 3a c9 ca ca 5a 4d fe a4 35 40 18 59 46 9a 0d c3 08 cd 0b cd 0b cd 0b cd 0b cd eb af fa c0 8b 6f b3 88 03 bc 68 55 39 ab 98 e0 c5 dd ff 42 ee 73 bd 68 f2 e2 1c df 3c b2 8c 93 bc 88 91 3d 7e 96 17 af fe 0b b9 ef f2 62 8a 17 27 18 b9 a9 0a e2 35 d0 6c 60 aa 81 56 a3 e7 e9 7a a6 a7 14 62 35 c9 9d 1c ee 45 d7 a0 8e 85 e9 c8 17 c6 8f ee 92 c1 38 85 06 f0 a8 17 10 a9 f6 a2 06 66 0a 43 5b 0e 6c 53 03 8d 7a a6 49 63 49 8b bb cd 58 ee de 72 88 3a b9 87 ea ee 2e d6 78 a7 59 dd 83 fa b8 11 f0 7d 2b 1b 68 5e 47 Data Ascii: PNGIHDROwIIDATx:slgym{ll=mmf^A1zhgi:ZM5@YFohU9Bsh<=~b'5l`Vzb5E8fC[lSzIcIXr:.xY}+h^G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49772	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:37 UTC	2620	OUT	GET /js_tracking?ver=2&stype=1&ref_action=index&lang=en-us&pid=e4de82b919b800e4&aid=304142&sid=5171fc655664ddf74ab763a094523fb7&ete=&etg=&etcg=cCHObKdPHMfFdHMEKdbfZRLRMLFSZaTaTaET\|1&ets=cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6 X-Booking-CSRF: M1fFZQAAAAA=ow_iJm02C23yTbeZTjDwFw3ODjezY3bK5FHdo-YoJdT7GCkrsQ32GPbbWguo4KloItJB_vA0z9Y_xRO57ct8Amr5W_XGX_7GZSpQGGcZ9tRZ2sLvFoX1OvJhoh8lHbncqueaPtPA9hz8Y_-xROuXkd4r2dhb8qRB-XM9-fcVbZ1TIOfkTWMBhv8vt5DNEpcahji4EEgpTuAdyxqG sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: e4de82b919b800e4 X-Booking-Info: X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhDMSfLvcMG2VHcbU0a02MOY%2FoE3Pj42bdhHH9WLLA1HPYkJysgulFoMrtOulTRBzpAAVSg2Ic64ufepnGAfylJXnqeKJvDEAHVmYnj3dbGB7ygVV2JkX124%2BEixWTdIqcGu5Kd0Dv6tKmcPbpsN1xr5; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone
2024-02-08 18:35:38 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:38 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=e79b82bd7cbe0565&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejJ5snAFftyG5sN4j-5MHTBM-BoY6D6kgpI x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 4a91a321d4c2ab7334c6f285093956ae.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: cqNfbuzmaVMpPpiTG61U2JDKA547u6q9cp2IoPlumWlPZDqNHkkiBQ==
2024-02-08 18:35:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49775	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:37 UTC	655	OUT	GET /static/img/tfl/group_logos/logo_agoda/1c9191b6a3651bf030e41e99a153b64f449845ed.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:37 UTC	769	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 2146 Connection: close Server: nginx Date: Sun, 28 Jan 2024 18:31:28 GMT Last-Modified: Thu, 12 Mar 2020 10:15:57 GMT ETag: "5e6a0bdd-862" Expires: Tue, 27 Feb 2024 18:31:28 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 fcb94596db202c75ac0e559b3183be72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: FX4jcjhVP1smDrLkMbak9BBxZd_KoVVzEtsl4lNveuIgTVE4qMxJBA== Age: 950649
2024-02-08 18:35:37 UTC	2146	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 46 00 00 00 1a 08 06 00 00 00 0a 62 2a 08 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 f7 49 44 41 54 78 01 ed 59 0d 70 54 d5 15 3e f7 be f7 96 b0 09 91 90 84 1a 13 65 19 a5 ad 96 66 00 2b 28 54 c9 4c 06 04 4b 69 5a 0b f9 d9 8d 04 d3 80 60 d5 da b1 63 3b 76 20 99 b6 d8 b1 d3 b1 83 75 c4 88 4d 82 bb 9b 68 a6 94 aa 80 18 a7 a4 02 05 44 4a eb 0f 52 51 a0 0a 2d 3f 21 46 6c 42 d8 7d ef de 7e 77 cd 8b 2f 9b b7 ce db 19 98 11 c7 33 73 f7 fe 7d ef dc 73 bf 7b ee b9 f7 bd 65 74 91 4b 79 79 f9 95 ba ae af 3b 76 ec d8 cc ce ce 4e 93 ce 93 70 ba c8 85 1b c6 04 49 34 3d 10 08 e8 74 1e e5 a2 27 e6 42 Data Ascii: PNGIHDRFb*pHYssRGBgAMAaIDATxYpT>ef+(TLKiZ`c;v uMhDJRQ-?!FlB}~w/3s}s{etKyy;vNpI4=t'B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49773	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:37 UTC	660	OUT	GET /static/img/tfl/group_logos/logo_rentalcars/6bc5ec89d870111592a378bbe7a2086f0b01abc4.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:37 UTC	769	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 3221 Connection: close Server: nginx Date: Sun, 28 Jan 2024 18:03:21 GMT Last-Modified: Wed, 10 Apr 2019 11:21:55 GMT ETag: "5cadd1d3-c95" Expires: Tue, 27 Feb 2024 18:03:21 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 45893c5ff2aa24fa7dce9573a0274642.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 6xwH-uXwibkkDvXTrcq7HOPVTFejj9fRWPVROYnOKuRJQBH0pXO-Sg== Age: 952335
2024-02-08 18:35:37 UTC	3221	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 6d 00 00 00 1a 08 06 00 00 00 bd df d2 2f 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 0c 4f 49 44 41 54 68 05 ed 58 09 70 55 d5 19 3e db bd f7 bd 97 97 10 96 08 28 2a 20 2e 54 dc 06 c8 c2 b8 a0 ad 56 a7 d8 ba 94 5a ac 15 6d ad 4e 6b 88 84 22 ee ed 43 45 a7 15 4d 7c 11 bb 28 2d 4b ad 1d 1d f7 3a ad 58 ad e8 08 01 8c 58 64 b1 18 50 89 28 45 08 42 c8 7b f7 de b3 f5 3b 2f 09 26 a2 33 a5 33 b5 33 ed 3b 90 f7 ce 3b e7 3f ff f9 ff ef 5f ef 25 a4 38 8a 08 14 11 28 22 50 44 a0 88 40 11 81 22 02 45 04 8a 08 fc ab 08 d0 cf 23 ac ba 37 1e 4b 19 3f 9f 51 32 d8 5a 1b 82 ee e5 3d 3b ff fe d4 ba cc b1 f1 e7 9d 29 ae 7f 31 08 7c 86 d1 2c 85 c1 6e e6 5c dc c4 93 2c a0 dd 14 1a a6 d2 52 3d 2f 55 3c b5 a5 be e4 c3 2f Data Ascii: PNGIHDRm/sRGBOIDAThXpU>(* .TVZmNk"CEM\|(-K:XXdP(EB{;/&333;;?_%8("PD@"E#7K?Q2Z=;)1\|,n\,R=/U</

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49776	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:37 UTC	593	OUT	GET /psb/capla/static/js/remoteEntry.4935f89c.client.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:37 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 28814 Connection: close Date: Thu, 08 Feb 2024 08:33:00 GMT Last-Modified: Sun, 04 Feb 2024 06:12:25 GMT ETag: "a687e666ee59c8527c21313adba1bf8f" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: vN7OnMe.ojdXDDTQ9pmibMWIDd5xf9ld Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 34411558fb3a23efdbbaaddb8a12b574.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: ustTJjSgOm8ChkdPt0HboDEKqJLohSN5xYDGwKJB9sk5D7ypuouEwg== Age: 36158 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:37 UTC	15698	IN	Data Raw: 76 61 72 20 62 57 65 62 53 68 65 6c 6c 43 6f 6d 70 6f 6e 65 6e 74 73 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 7b 22 34 65 64 62 62 63 38 61 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 76 61 72 20 63 3d 7b 22 2e 2f 41 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 46 6f 6f 74 65 72 22 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 65 28 22 38 31 64 61 35 66 33 32 22 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 28 22 39 32 39 62 62 36 61 31 22 29 7d 7d 29 29 7d 2c 22 2e 2f 41 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 48 65 61 64 65 72 22 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 65 28 Data Ascii: var bWebShellComponents;!function(){"use strict";var e={"4edbbc8a":function(e,n,t){var c={"./AccommodationFooter":function(){return t.e("81da5f32").then((function(){return function(){return t("929bb6a1")}}))},"./AccommodationHeader":function(){return t.e(
2024-02-08 18:35:37 UTC	13116	IN	Data Raw: 3d 3d 71 7c 7c 76 6f 69 64 20 30 3d 3d 3d 71 7c 7c 71 2e 73 65 61 72 63 68 50 61 72 61 6d 73 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 4c 28 6e 29 26 26 4e 2e 61 70 70 65 6e 64 28 6e 2c 65 29 7d 29 29 29 3b 72 2e 65 74 53 65 72 69 61 6c 69 7a 65 64 53 74 61 74 65 26 26 24 2e 61 70 70 65 6e 64 28 67 2c 72 2e 65 74 53 65 72 69 61 6c 69 7a 65 64 53 74 61 74 65 29 3b 48 26 26 4e 2e 61 70 70 65 6e 64 28 22 73 65 73 22 2c 48 29 3b 72 65 74 75 72 6e 20 4e 2e 73 65 74 28 22 6e 61 6d 65 73 70 61 63 65 22 2c 6c 2e 73 6c 69 63 65 28 2d 6f 29 29 2c 7b 75 72 6c 3a 74 2b 22 3f 22 2b 4e 2e 74 6f 53 74 72 69 6e 67 28 29 2c 68 65 61 64 65 72 73 3a 24 7d 7d 28 65 2c 6e 29 3b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 5f 5f 63 61 70 6c 61 46 65 Data Ascii: ==q\|\|void 0===q\|\|q.searchParams.forEach((function(e,n){L(n)&&N.append(n,e)})));r.etSerializedState&&$.append(g,r.etSerializedState);H&&N.append("ses",H);return N.set("namespace",l.slice(-o)),{url:t+"?"+N.toString(),headers:$}}(e,n);return window.__caplaFe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49762	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:37 UTC	659	OUT	GET /static/img/tfl/group_logos/logo_opentable/a4b50503eda6c15773d6e61c238230eb42fb050d.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:37 UTC	769	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 2344 Connection: close Server: nginx Date: Sun, 28 Jan 2024 18:31:28 GMT Last-Modified: Wed, 10 Apr 2019 11:21:55 GMT ETag: "5cadd1d3-928" Expires: Tue, 27 Feb 2024 18:31:28 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 5988b4ae4648c0fec3c60a3cca580092.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Lgg8_YuPcoXQjpNWgm5kfNv87r2KKn6Oi9biZU-k4xSiLjO9QE2x2w== Age: 950648
2024-02-08 18:35:37 UTC	2344	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 5f 00 00 00 1a 08 06 00 00 00 d1 d9 80 2a 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 08 e2 49 44 41 54 68 05 ed 58 0d 6c 14 c7 15 9e 99 dd db bb 60 c7 7f 18 8a 00 e3 bb b3 8d 4b 0f 27 6d dd c4 e0 24 c4 b5 09 a8 54 69 d3 46 95 d3 54 a4 4a 4b aa 34 41 aa 22 51 5a 94 d2 d2 a4 6d 1a aa d2 8a a6 b4 a9 42 d3 94 a8 aa 84 92 42 d2 10 a5 d4 89 15 2c 88 9d 98 56 16 16 f1 0f 77 36 38 14 c2 bf 7f ce ec ed ee 4c bf 77 3e 1f dc fa 0c 3e 47 8a 50 72 23 cd ed cc 7b 6f de cc 7c ef cd 7b 33 c7 58 b6 64 11 c8 22 90 45 e0 43 45 80 7f d0 d9 c2 b5 f5 a5 4a b1 5a a5 44 48 31 39 5b 32 6e 41 69 bf 10 da 3b e6 85 58 5b a8 b3 79 f8 83 ce f1 51 1d 3f 6d f0 df ad 69 b8 c1 10 7c 9d 64 ec 4e 83 f3 02 ce 52 55 c5 14 38 8c 75 e1 Data Ascii: PNGIHDR_*sRGBIDAThXl`K'm$TiFTJK4A"QZmBB,Vw68Lw>>GPr#{o\|{3Xd"ECEJZDH19[2nAi;X[yQ?mi\|dNRU8u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49770	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:37 UTC	602	OUT	GET /design-assets/assets/v3.81.0/fonts-brand/BookingRegular.woff HTTP/1.1 Host: t-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://cf.bstatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:37 UTC	586	IN	HTTP/1.1 200 OK Content-Type: font/woff Content-Length: 40120 Connection: close Last-Modified: Tue, 25 Jul 2023 15:38:06 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 09:25:10 GMT ETag: "f2953af89807609f49b87237180bb450" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6f067a3fd6e721a7db2a2901701a65d8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: _Tg2lUGb0bTlzxn9TOoxbFo_c8AXgxEq2VeSUqgDTTppdA6LMgTw-g== Age: 36961 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:37 UTC	15798	IN	Data Raw: 77 4f 46 46 00 01 00 00 00 00 9c b8 00 11 00 00 00 01 d3 e0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 44 45 46 00 00 7b 5c 00 00 00 f9 00 00 01 78 5c e2 5d 09 47 50 4f 53 00 00 7c 58 00 00 1a e2 00 00 e6 82 7e 96 43 32 47 53 55 42 00 00 97 3c 00 00 05 7a 00 00 0d de d3 00 a2 14 4f 53 2f 32 00 00 01 f8 00 00 00 5a 00 00 00 60 69 82 40 b5 63 6d 61 70 00 00 07 78 00 00 03 eb 00 00 05 6c 61 d8 44 c6 63 76 74 20 00 00 11 3c 00 00 00 bb 00 00 0b f2 23 9c 16 c9 66 70 67 6d 00 00 0b 64 00 00 03 ab 00 00 06 d7 0a 30 87 36 67 61 73 70 00 00 7b 50 00 00 00 0c 00 00 00 0c 00 07 00 1b 67 6c 79 66 00 00 16 dc 00 00 63 8f 00 00 b0 00 bd e1 67 9c 68 65 61 64 00 00 01 80 00 00 00 36 00 00 00 36 1d ce ec 55 68 68 65 61 00 00 01 b8 00 00 00 Data Ascii: wOFFGDEF{\x\]GPOS\|X~C2GSUB<zOS/2Z`i@cmapxlaDcvt <#fpgmd06gasp{Pglyfcghead66Uhhea
2024-02-08 18:35:37 UTC	16384	IN	Data Raw: 7c 11 79 52 00 19 00 ef ae 4c bd d1 72 54 0a 3b 8a 91 f3 28 a6 e9 3a 95 52 a9 c9 ce ab f6 a8 28 95 e2 88 9a 3b 51 ef 51 53 6a 2d 8d 20 f8 0c 40 d4 19 e0 02 d0 13 2a fe 21 1d ec 5b 7b a4 a1 2a fc d4 e9 36 84 44 4a da 35 1a eb ca 26 e3 0d 7e 6f 6b c4 d2 95 fb 60 b7 37 e0 6a f0 d8 fd cd f8 40 53 3c d9 d2 92 b2 d9 9d 9e ba 70 e0 f0 d7 6e a0 75 4e 78 e2 a2 09 30 ad 07 4c af 04 4c 6b 90 89 e8 77 f9 11 84 94 70 19 99 b5 47 58 1a f1 55 3e 58 79 95 00 f0 2c 5f ec e4 f0 5c 70 2c 02 cd 68 4b 28 1e 6f 6c 4a c4 f1 45 8b 63 91 d1 e0 c2 38 34 ed a9 28 4c 44 24 0c 5c a1 b9 b8 fe 04 97 77 b5 a3 38 e8 57 53 34 bc d7 11 73 34 04 f7 fa fc 3e 07 bc 94 c6 bd 22 4a b9 97 cf 88 57 8a 36 a7 c3 5c 03 66 f6 6c 97 b0 92 56 e3 f2 6a 89 0a 92 06 b6 3a 46 c5 97 9d 77 e7 54 e1 5f ce db Data Ascii: \|yRLrT;(:R(;QQSj- @![{6DJ5&~ok`7j@S<pnuNx0LLkwpGXU>Xy,_\p,hK(olJEc84(LD$\w8WS4s4>"JW6\flVj:FwT_
2024-02-08 18:35:38 UTC	7938	IN	Data Raw: 2d b3 1d 65 6d bb ac 31 24 e9 1e 52 f9 24 bf e7 e6 7b 81 c0 9e ab 7b 86 58 7f 41 7a c2 eb 15 05 83 78 9b 6d b2 b8 65 b3 82 98 7b f6 51 ec 1e 3a 51 ae 43 24 e1 be 9d e0 78 dc ae 27 5a dc 45 52 3c 5d d9 0f 61 3d 05 05 8e 6b 56 ab 00 47 c4 6b e0 0a af 5f ad 3a 18 21 21 ed 71 b5 22 dc a1 4d bf ae c7 d7 cd e9 b2 d9 92 5b 9e 7d 3f aa ef 2b 0a 4e 3f 70 2e 12 a2 3c 7a 8c 32 2c e0 6b ac ce 6f 27 e2 78 1e 37 42 81 f9 0e 03 af 3d c6 3c 4a 89 16 f4 af 61 87 a4 c6 65 c7 be 84 c9 b3 63 f9 1d 59 42 12 af 38 66 7c 97 e6 09 e3 0f a4 9f e9 ed 51 08 78 62 c5 96 c5 88 1c 42 3f 22 93 ff 1a fe d6 cb 5d 41 fb 04 f1 2a ae 6d ef 28 3b 7d 14 c7 bf 06 f1 9f 3b 88 c5 13 fb 0a 6e bf 15 3c 23 88 72 4f 59 c3 d4 b2 3e 22 46 9c e0 0f 0e fe d0 21 4a 38 c8 de 75 cd de 3f b4 c7 c6 9e 88 33 Data Ascii: -em1$R${{XAzxme{Q:QC$x'ZER<]a=kVGk_:!!q"M[}?+N?p.<z2,ko'x7B=<JaecYB8f\|QxbB?"]A*m(;};n<#rOY>"F!J8u?3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49766	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:37 UTC	604	OUT	GET /design-assets/assets/v3.81.0/fonts-brand/BookingExtraBold.woff HTTP/1.1 Host: t-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://cf.bstatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:37 UTC	586	IN	HTTP/1.1 200 OK Content-Type: font/woff Content-Length: 40640 Connection: close Last-Modified: Tue, 25 Jul 2023 15:38:05 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 09:25:10 GMT ETag: "44bb644882b70aa9444e491e812d4a4b" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 ea0f86c249e022d5015ce79f54e723d0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: EHYto3TwZ50Zvj4OJR3Z8I8JZheQ-NY_PlLydu3EWdozcXmnG2NMTA== Age: 37444 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:37 UTC	15798	IN	Data Raw: 77 4f 46 46 00 01 00 00 00 00 9e c0 00 11 00 00 00 01 d9 34 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 44 45 46 00 00 7c e8 00 00 00 f9 00 00 01 78 5c e2 5d 09 47 50 4f 53 00 00 7d e4 00 00 1b 5e 00 00 e9 c4 79 9e b5 e7 47 53 55 42 00 00 99 44 00 00 05 7a 00 00 0d de d3 00 a2 14 4f 53 2f 32 00 00 01 f8 00 00 00 59 00 00 00 60 6b 12 44 dd 63 6d 61 70 00 00 07 68 00 00 03 eb 00 00 05 6c 61 d8 44 c6 63 76 74 20 00 00 11 24 00 00 00 ca 00 00 0b f2 24 cf 19 87 66 70 67 6d 00 00 0b 54 00 00 03 ab 00 00 06 d7 0a 30 87 36 67 61 73 70 00 00 7c dc 00 00 00 0c 00 00 00 0c 00 07 00 1b 67 6c 79 66 00 00 16 dc 00 00 65 19 00 00 b2 26 be 20 e9 9e 68 65 61 64 00 00 01 80 00 00 00 36 00 00 00 36 1d c9 ec 3c 68 68 65 61 00 00 01 b8 00 00 00 Data Ascii: wOFF4GDEF\|x\]GPOS}^yGSUBDzOS/2Y`kDcmaphlaDcvt $$fpgmT06gasp\|glyfe& head66<hhea
2024-02-08 18:35:37 UTC	16384	IN	Data Raw: 68 19 95 56 2b 68 e0 0f 2b 91 5e 6f 37 59 0d 57 98 e4 d8 44 50 07 b8 29 47 cf c2 20 af 7e 5d f4 5f c2 36 0c da 15 5b 69 1b d0 26 80 ff e1 24 db 06 d9 f1 05 c6 db 9a 9a 8e 19 b7 2a 3b a7 77 2a b3 57 2f c7 75 e7 e1 95 78 f8 b2 cb b2 0f bc 7a d3 4d af fe 7d f1 e2 bf d3 58 69 84 c8 76 f2 09 52 a0 b3 08 f1 cf eb c8 db 30 04 ce e5 3e 0b 6f b2 df bf 23 7d 7e 85 fd fe a2 f4 b9 9c 7d 7e 09 c1 5b 09 9f 83 9d c4 89 a7 dc e1 bd de 5d 2e 85 53 63 03 9d 06 e6 f8 a4 3a 0d fc 7b 2f 5f af 61 42 db 2e ea 35 18 86 71 7e 4c 84 af 01 37 2f 6f f6 d7 ba 23 36 9b 2f b4 62 c5 29 7c de a9 45 95 8d 8d 95 f1 c6 46 50 78 a6 8d 54 a9 b4 17 29 23 01 25 53 78 b2 bb 89 7e f4 23 52 9f 8c c5 93 c9 78 2c 89 48 8e 43 4a 21 b5 d5 b9 11 a5 8d 91 36 91 b2 f7 16 03 59 5f 44 15 a5 64 69 93 7f 0a Data Ascii: hV+h+^o7YWDP)G ~]_6[i&$;wW/uxzM}XivR0>o#}~}~[].Sc:{/_aB.5q~L7/o#6/b)\|EFPxT)#%Sx~#Rx,HCJ!6Y_Ddi
2024-02-08 18:35:38 UTC	8458	IN	Data Raw: 36 af bc 2d a8 60 8b 2a da 79 2d d8 92 4a b6 ac b2 ad a8 62 ab aa da 9a 6a 36 52 64 57 b4 8a 40 75 d5 ed 9a d6 c1 3f 68 66 3e 68 00 00 00 78 da 34 88 03 68 26 70 1c 86 9f f7 77 36 c3 d9 b6 d2 d9 b6 6d db be ec 43 ba 99 69 5e 5a 5a 98 17 66 23 cc 4c 5f 5a fa f4 9f 7a 7b f5 20 60 3c 9b 39 c5 c8 03 87 4e 5c 60 f6 fd af ef 5e 30 fb f1 bb 87 cf 99 fd e2 ee 87 57 cc 66 24 40 20 80 01 c2 9e 3f 7c f7 8a c9 2f ef be 7b ce 4c 40 00 18 72 1e c1 d8 e6 ec 9e 3d 18 63 9d c7 6b 29 e2 1c 23 81 a5 64 0e 28 86 44 0a 9d d2 29 26 03 47 06 5e b6 b3 93 63 43 e9 3c 4c 1a 69 a6 17 0f 7e 8d d4 78 4d 45 2c 65 24 a3 99 cc 53 7e f1 87 30 62 89 23 9e 32 2a e9 a0 93 2e 7a 35 42 4b b4 42 ab b5 4f 07 74 49 57 74 53 1f 15 aa 70 c5 ca 67 73 6d 95 ad b7 6d b6 df 6e 60 24 03 1e c6 23 7a 01 Data Ascii: 6-`y-Jbj6RdW@u?hf>hx4h&pw6mCi^ZZf#L_Zz{ `<9N\`^0Wf$@ ?\|/{L@r=ck)#d(D)&G^cC<Li~xME,e$S~0b#2.z5BKBOtIWtSpgsmmn`$#z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49767	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:37 UTC	601	OUT	GET /design-assets/assets/v3.81.0/fonts-brand/BookingMedium.woff HTTP/1.1 Host: t-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://cf.bstatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:37 UTC	586	IN	HTTP/1.1 200 OK Content-Type: font/woff Content-Length: 41884 Connection: close Last-Modified: Tue, 25 Jul 2023 15:38:06 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 10:42:53 GMT ETag: "8f40a0d11ef71ccb75e5fc05a4bc3247" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 e268ddb03ed9480c5c602c27323a81ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Y4N6tGWO6_GSc-RlAPg7SwRElcxEkqTj4-Rvp6pxGM6L4McS0Uvgww== Age: 28396 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:37 UTC	15798	IN	Data Raw: 77 4f 46 46 00 01 00 00 00 00 a3 9c 00 11 00 00 00 01 d6 90 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 44 45 46 00 00 7c 90 00 00 00 f9 00 00 01 78 5c e2 5d 09 47 50 4f 53 00 00 7d 8c 00 00 20 93 00 00 e9 f0 87 52 ae 5f 47 53 55 42 00 00 9e 20 00 00 05 7a 00 00 0d de d3 00 a2 14 4f 53 2f 32 00 00 01 f8 00 00 00 5b 00 00 00 60 69 e6 41 c3 63 6d 61 70 00 00 07 88 00 00 03 eb 00 00 05 6c 61 d8 44 c6 63 76 74 20 00 00 11 48 00 00 00 bd 00 00 0b f2 23 1e 15 19 66 70 67 6d 00 00 0b 74 00 00 03 ab 00 00 06 d7 0a 30 87 36 67 61 73 70 00 00 7c 84 00 00 00 0c 00 00 00 0c 00 07 00 1b 67 6c 79 66 00 00 16 ec 00 00 64 b3 00 00 af 42 1b 2b 57 4c 68 65 61 64 00 00 01 80 00 00 00 36 00 00 00 36 1d d5 ec 4e 68 68 65 61 00 00 01 b8 00 00 00 Data Ascii: wOFFGDEF\|x\]GPOS} R_GSUB zOS/2[`iAcmaplaDcvt H#fpgmt06gasp\|glyfdB+WLhead66Nhhea
2024-02-08 18:35:37 UTC	16384	IN	Data Raw: 75 10 4e 5c c3 ca 03 03 03 c9 e9 a4 b7 d5 ec 83 b6 4a f4 d2 a5 1f 24 81 b3 09 b3 1b 38 eb 6d 80 4b e0 6b 30 58 c5 57 9d 6a 52 57 26 87 e8 aa d9 7c 1d 8b 99 4d 59 11 68 4c e5 6a a3 68 3b 75 d5 b4 51 a3 b3 45 9e 40 dd ff 07 da ae a3 27 3e 11 73 c5 81 1e 3b eb 0c 5d b8 f0 ca da eb d0 51 bd 4c c2 12 91 b2 64 0b d8 c7 72 b6 ff 17 ab f2 ff 0e eb eb 31 2e c7 df 4d 3a bf 39 18 7b e8 a1 eb f1 55 f3 d1 f8 b0 52 d7 cc 47 e3 14 57 7c 08 ef 14 de 0a 8b e5 ac 76 c7 05 95 5c 6e 42 de 0b 18 31 3a 6a 96 7d 7a dd 39 83 89 41 9b 5d a2 c4 d5 cb ac f0 12 0d 16 32 ce ea 84 b3 9c 8f f8 53 5b b1 38 26 8c 7b 20 de 33 90 b6 46 f4 5e 6f 32 5e 9b 1b ee 1b 9a 72 d4 d5 d4 39 ac ae 30 5e 0b 36 a5 e3 f1 76 b5 ca e2 f0 7a db c2 dd dd cf 9e 96 68 6b 38 93 c5 2f 60 77 1c b0 53 22 8e 5a 73 Data Ascii: uN\J$8mKk0XWjRW&\|MYhLjh;uQE@'>s;]QLdr1.M:9{URGW\|v\nB1:j}z9A]2S[8&{ 3F^o2^r90^6vzhk8/`wS"Zs
2024-02-08 18:35:38 UTC	9702	IN	Data Raw: 9d b9 fc 72 10 50 99 de 4c a7 ec d8 f1 53 67 d2 78 c5 be ed 1b 69 bc 66 fb aa 0d 34 de b8 6c e7 66 1a 53 16 c0 39 0c 10 b6 61 d5 f6 cd 54 df b4 6c fb 06 ea 02 02 c0 10 46 19 2a fe fa 15 bd 11 a3 22 46 65 8d 45 cc a7 2c d0 91 27 61 6f 72 8b 5f 7e ef 10 c1 a3 40 c2 df 2b be f0 2b 6c 44 c1 19 51 20 49 6a ae e6 64 a8 ac 2a ab a1 ff 6e ab ce ea 89 e8 48 59 ca 53 9d 75 1c e6 28 a7 b8 c8 25 2e f3 92 37 fc 27 82 48 a2 88 51 19 b5 51 07 7f 7e b4 c6 6a b6 e6 6a 91 76 e9 a4 4e eb a2 1e e8 95 b2 ad a9 75 b2 ee d6 c3 fa d9 18 5b 88 71 d5 25 12 47 65 44 8c cb 40 ba e0 9e 20 e2 5c 4a 70 02 a6 89 54 d0 1a 46 22 ff ec 8f 74 91 da 94 f1 b5 b9 96 d1 ce b7 a1 a1 ad c3 ac 1c 75 ad 35 dd 91 75 a7 35 65 ac 3d 3d ac 83 bf fb d2 23 b4 36 c1 e9 12 51 9e 2c 74 ef 31 3b 4a 75 3b ce Data Ascii: rPLSgxif4lfS9aTlF"FeE,'aor_~@++lDQ IjdnHYSu(%.7'HQQ~jjvNu[q%GeD@ \JpTF"tu5u5e==#6Q,t1;Ju;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49768	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:37 UTC	599	OUT	GET /design-assets/assets/v3.81.0/fonts-brand/BookingBold.woff HTTP/1.1 Host: t-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://cf.bstatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:37 UTC	586	IN	HTTP/1.1 200 OK Content-Type: font/woff Content-Length: 41976 Connection: close Last-Modified: Tue, 25 Jul 2023 15:38:06 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 11:00:31 GMT ETag: "b2ca1822b16a92e0a0111c994cfe4b8a" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 76f3fedc86826a7b266250e33ee41082.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: QisAtiePMKbVmyulL_d8WmB1z5Tl-Gk4ePxNd09PrjDs4aVxT5_Rkw== Age: 27480 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:37 UTC	15798	IN	Data Raw: 77 4f 46 46 00 01 00 00 00 00 a3 f8 00 11 00 00 00 01 d6 c4 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 44 45 46 00 00 7c d0 00 00 00 f9 00 00 01 78 5c e2 5d 09 47 50 4f 53 00 00 7d cc 00 00 20 af 00 00 e9 fc 82 6d c9 90 47 53 55 42 00 00 9e 7c 00 00 05 7a 00 00 0d de d3 00 a2 14 4f 53 2f 32 00 00 01 f8 00 00 00 5a 00 00 00 60 6a ae 43 b1 63 6d 61 70 00 00 07 84 00 00 03 eb 00 00 05 6c 61 d8 44 c6 63 76 74 20 00 00 11 08 00 00 00 c3 00 00 0b f2 21 ed 13 bd 66 70 67 6d 00 00 0b 70 00 00 03 ab 00 00 06 d7 0a 30 87 36 67 61 73 70 00 00 7c c4 00 00 00 0c 00 00 00 0c 00 07 00 1b 67 6c 79 66 00 00 16 b0 00 00 65 2f 00 00 af ca c8 eb 7a ef 68 65 61 64 00 00 01 80 00 00 00 36 00 00 00 36 1d cf ec 4a 68 68 65 61 00 00 01 b8 00 00 00 Data Ascii: wOFFGDEF\|x\]GPOS} mGSUB\|zOS/2Z`jCcmaplaDcvt !fpgmp06gasp\|glyfe/zhead66Jhhea
2024-02-08 18:35:37 UTC	16384	IN	Data Raw: 17 63 46 04 33 56 3f 82 19 51 19 3f 7e e1 ce cf 01 62 ff 39 5e 8e 6c 7a 3c dd 08 b8 18 95 76 ef fe fd 57 f0 ba 2b 04 87 9e f5 f5 cb 71 e0 6c ae 60 91 93 2c 0a a1 28 6a 21 15 92 f4 89 d8 91 b0 ac 76 a4 46 e4 f2 16 9d 76 6c 92 b1 32 a5 ba a8 90 62 23 35 a2 a3 ab bc b7 2c d7 5e 07 5e 95 c3 cd c4 52 b4 bb 88 55 82 b9 11 d3 c4 07 f8 37 99 cd a6 27 9b 3c ad e6 b0 c5 e6 06 06 7e a1 71 7d ba b5 9e 63 67 e0 d0 a1 57 ae f4 93 3d 4c 81 45 66 aa 95 d3 ca 70 80 10 42 29 aa 78 7b 03 5f e9 8a 5c f0 d4 a5 72 8e 08 fa 1f 52 f6 3f 27 ec 06 62 d2 eb 52 64 3e 0c 2a bb ef 96 5b fe fe ca 87 10 51 35 39 fc c4 20 8a 97 61 82 7b 18 45 73 96 ba 91 5a 91 db 57 74 fd 37 b0 fe 2f 71 5e ee 6c df c8 fd 8d 9c e3 ad 74 eb bc b5 67 ce dc 88 af a8 b0 21 42 fc 70 65 84 f3 c3 01 57 33 de 83 Data Ascii: cF3V?Q?~b9^lz<vW+ql`,(j!vFvl2b#5,^^RU7'<~q}cgW=LEfpB)x{_\rR?'bRd>*[Q59 a{EsZWt7/q^ltg!BpeW3
2024-02-08 18:35:38 UTC	9794	IN	Data Raw: 6a 36 52 64 57 b4 8a 40 75 d5 ed 9a d6 c1 3f 68 66 3e 68 00 00 00 78 da 3c 8d 33 80 58 01 10 44 df 6c 6c db b6 8d 26 76 9a d8 b6 6d d6 41 17 b3 0c eb 34 b1 6d 27 67 37 67 e3 df 1e d7 9c 41 40 75 fa 33 9d 8a 63 c7 4f 9d 49 f3 15 fb b6 6f a4 f9 9a ed ab 36 d0 7c e3 b2 9d 9b 69 4e 45 80 20 c0 00 61 1b 56 6d df 4c ed 4d cb b6 6f a0 21 20 00 0c b9 57 a0 6a 58 58 fc 5e 8c aa ee d5 35 16 31 9f 8a 40 57 de 14 eb 5d ee 11 e6 fa 80 18 9e 15 4f bc e3 13 7f 3c ba fa b4 2c c6 94 4f d2 d4 5a ad c9 51 45 55 57 53 af 3b aa bb fa 22 ba 52 91 ca d4 66 1d 87 39 c9 39 ae 72 8d eb 7c e4 0b d1 c4 10 4b 1c 09 aa a0 0e ea e2 f7 a3 35 56 b3 35 57 8b b4 4b 67 75 5e 57 f5 44 9f 94 6f 2d ad 9b f5 b6 3e 36 c8 c6 d8 42 8c 9b 41 0e 49 54 47 24 04 f9 48 57 82 97 88 a4 20 03 8f 80 69 22 Data Ascii: j6RdW@u?hf>hx<3XDll&vmA4m'g7gA@u3cOIo6\|iNE aVmLMo! WjXX^51@W]O<,OZQEUWS;"Rf99r\|K5V5WKgu^WDo->6BAITG$HW i"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49763	18.238.55.22	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:37 UTC	686	OUT	GET /xdata/images/xphoto/500x500/184698944.png?k=6bb1bf3c13db4a7ba3c22a2d1f1051f793c525a78104703b4dec3eb12101f545&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:37 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/png Transfer-Encoding: chunked Connection: close Server: nginx Date: Sun, 21 Jan 2024 13:30:27 GMT ETag: "faf4c565c493f3bc0e80e65cd746519a6611b1b3" Content-Language: 39328 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 f26a1d19b20e4cf5dd8998779bc5b1fc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P4 X-Amz-Cf-Id: 4RY5YGxNAHGHEQnuqRWmhxPhcgsl8OXQdnwj_aw4ktuMutwTHLpGuA== Age: 1573510
2024-02-08 18:35:37 UTC	15835	IN	Data Raw: 39 35 64 61 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 f4 00 00 01 f4 08 06 00 00 00 cb d6 df 8a 00 00 80 00 49 44 41 54 78 da ec 9d 07 58 dc 56 d6 86 67 06 b7 74 a7 6c 36 75 93 4d db dd 6c fa 66 d3 7b f2 a7 6e b2 e9 71 b2 29 4e dc d2 9d 38 76 e2 6e dc 7b ef 06 83 31 cd 14 63 63 9b 6a 30 a6 83 01 37 dc 01 e3 de 0d 98 36 7d ce 7f cf 95 04 33 cc 80 c1 bd 7c ef f3 9c 47 1a e9 ea 4a 33 d2 e8 3b e7 dc ab 2b 9d 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 95daPNGIHDRIDATxXVgtl6uMlf{nq)N8vn{1ccj076}3\|GJ3;+
2024-02-08 18:35:37 UTC	16384	IN	Data Raw: dc ad 65 1e 05 7d d2 fc 34 b9 2f de 8f 26 e8 ff fe af bb a0 ff b7 db ec ba 8c 44 e4 ea 6a 4a de 52 4b 5d 06 bb ff 3e 2c c8 69 45 46 1a b7 bc 82 d2 4b ed 32 cb 13 b9 7c a3 c7 6c 4c d8 8a 22 99 42 d6 be 73 e9 81 1a e1 04 b9 ff 1f 7a 8e 5a 24 9b 83 12 8b 6c 52 cc 37 1d 74 d0 cb 5f 4d 77 2b f7 d0 7f 46 d0 ea bd 0e f9 3b 69 75 4e 08 48 f5 f8 5b 6f d9 75 4c fe ae 87 55 c7 71 4f 05 67 84 ec 2e ce ee a1 6a d7 f3 c6 99 8c 5d 65 36 8f d7 d7 e7 3d 02 a4 a0 73 ea 9d 9b 59 76 89 fa fe f7 5b a0 5b b9 bf 3c dd 57 a6 d8 b9 7f 8c 16 a5 fb 44 66 bb 95 e3 df 6b 61 fa 2e 99 d5 d2 8e 8d cf d1 8e 32 87 dc 66 e3 41 65 ca c7 7f a0 d2 5d d0 9f ff 74 a2 5b 9d ff f7 e5 14 59 9e eb e4 a9 96 5d e3 ff c5 21 e1 08 3b 9a d9 a1 ae 6a d9 6b 64 af de a5 7c 34 ed a3 23 85 53 e8 96 c7 5d ef Data Ascii: e}4/&DjJRK]>,iEFK2\|lL"BszZ$lR7t_Mw+F;iuNH[ouLUqOg.j]e6=sYv[[<WDfka.2fAe]t[Y]!;jkd\|4#S]
2024-02-08 18:35:38 UTC	6151	IN	Data Raw: cb 43 17 94 c8 90 f9 78 66 7d a9 bc 96 b8 c7 48 da 2b d7 bd 1b 5a 42 d4 9e c8 b1 8e 7d de 7e b3 d4 fd 37 7e 90 67 d6 5f 1e b9 e3 db 8f 90 58 79 4c 5a 1c 4f 22 2b d5 48 7b a3 ee 5f a0 eb 71 48 8b a7 ae f0 bd 9a b2 d2 ff 64 52 b6 af 86 46 da b5 12 56 94 fc 2e 35 5b 7e cb 6f 43 42 7e 04 dc d4 7e f1 45 0f 7f b2 f1 ca db bb ae ba b1 f5 f8 c3 37 3e 39 74 db 23 4f 0e d9 dc f0 bf 53 8b 9b dd d3 b3 60 c4 73 a3 76 0d 53 41 66 34 4a dc bd f4 89 c1 9b f7 bd 36 66 ff 3e 8d ee 8f a8 08 fd 6f 8f 2b 2a 47 1a 1f 02 6d a2 d1 7f dd 4f f4 0b 74 30 84 b8 5e 85 ba 45 5e 18 b5 43 f4 1a 79 4e 25 8b 63 0d 86 6d 35 99 01 48 b2 b1 46 2c 88 8c 9b a7 ec 36 52 86 40 9f 53 e1 36 18 b6 45 af d1 6d bd 1e 15 88 ff f4 59 67 a2 64 5c 5b ef 93 8d 2a e5 1d 52 7b c0 7a a9 3d 70 bd 8b a2 b7 1b Data Ascii: Cxf}H+ZB}~7~g_XyLZO"+H{_qHdRFV.5[~oCB~~E7>9t#OS`svSAf4J6f>o+GmOt0^E^CyN%cm5HF,6R@S6EmYgd\[R{z=p
2024-02-08 18:35:38 UTC	973	IN	Data Raw: 33 63 36 0d 0a 8f 71 6d e4 99 5e e7 b9 48 5f 79 46 64 be 3f 35 72 bc 64 56 69 a7 95 82 ba 87 53 23 ae d1 d7 39 9f ff 30 42 08 21 e4 14 90 d4 88 aa 2a f4 8b 24 ab fa 3f 65 7a 44 0b 99 1a d1 51 b7 33 55 d4 8b 02 99 11 eb 55 d2 45 2a e5 52 99 12 11 50 d1 06 54 de e5 ba 5e ae e7 60 09 e1 9b 6d 95 b5 5d 4e 30 c7 02 2a 67 7f 79 ba 0a 7b 5c 44 b1 0a 7e 83 ee ff 5c c6 54 49 0c 4c 88 e8 19 98 50 e5 35 c9 8c b8 5b cf bb 96 d1 37 21 84 10 f2 5d 49 3f 2e e2 02 19 1b 71 bd ca fc 56 ff b8 88 07 55 f0 0d fc 63 ab 3e 25 93 23 9e f6 8f ac fa 04 96 a5 c9 ba 4f f7 cb b8 aa 0f aa ac 6f 29 c9 8a f8 b3 56 0e ae 46 85 81 7f 41 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 Data Ascii: 3c6qm^H_yFd?5rdViS#90B!$?ezDQ3UUERPT^`m]N0*gy{\D~\TILP5[7!]I?.qVUc>%#Oo)VFAB!B!B!B!B!B!B!B!B!B!B
2024-02-08 18:35:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49769	18.238.55.22	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:37 UTC	687	OUT	GET /xdata/images/xphoto/714x300/293799350.jpeg?k=8a6f4e24c37096fbdcd3c3d30c9f3dcea15ce35751448466decf791918012a64&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:37 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sat, 27 Jan 2024 21:14:33 GMT ETag: "b14ea5c8653ac9e8b816fbb24a798227360e9785" Content-Language: 30612 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 abda8496f94099119c2f392e63054efa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P4 X-Amz-Cf-Id: umv5PSF7pwM1wN74SO9ZDCZWQOAGcHdQ4hY4bPnM3lwaOGCdW_PEsQ== Age: 1027264
2024-02-08 18:35:37 UTC	16384	IN	Data Raw: 37 37 39 34 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 01 2c 02 ca 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 7794JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222,"}!1AQa"q
2024-02-08 18:35:37 UTC	14236	IN	Data Raw: ad 6e e9 56 69 62 a0 5e 4f 1a 5b c0 e2 69 5e 3e 72 0a e5 47 ae 48 22 8b 77 25 5e e7 a5 e8 d7 49 6b a3 c0 16 46 e9 8c 0f bc ed fc ea b9 d2 75 5d 42 fe 59 2e 16 28 21 04 14 8c b6 7f 13 8e ff 00 8d 59 f0 c4 d6 d2 59 45 a8 4d 0b 0d f9 31 c6 07 11 af f8 d2 6a de 26 06 e6 68 2d 23 0b c8 52 db c7 7f 61 cd 34 cd 6c ba 1a e3 49 49 6d 96 49 dd 9d 93 18 2a 76 f1 55 75 0b 4b 0d 5a d1 6e 66 b5 86 69 6d 9c db b9 74 0c 46 3a 75 fc 0f e3 57 0d ec 83 4f 65 0e 17 09 d9 70 3a 7a 9a e3 74 2d 66 48 bc 4b ad e9 37 2e 4a 5d 44 2e a1 27 fb c1 46 7f 41 fa 56 75 13 56 97 62 93 5b 77 23 bf d0 b4 26 61 e6 e9 d0 8c f7 4c a1 fd 2b 12 7f 0b 68 d7 13 18 a1 7b 9b 62 7e eb 07 de a7 f3 ae a6 f8 c7 3c 0c 06 37 0e 45 72 e2 ed e2 9d d5 cf cb da b4 bb 21 a4 64 5f 7c 3f b8 00 b5 a5 fc 53 0f ee Data Ascii: nVib^O[i^>rGH"w%^IkFu]BY.(!YYEM1j&h-#Ra4lIImI*vUuKZnfimtF:uWOep:zt-fHK7.J]D.'FAVuVb[w#&aL+h{b~<7Er!d_\|?S
2024-02-08 18:35:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49779	13.32.208.75	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	528	OUT	OPTIONS /privacy-consents/implicit HTTP/1.1 Host: account.booking.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type Origin: https://www.booking.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:38 UTC	2794	IN	HTTP/1.1 204 No Content Connection: close server: envoy date: Thu, 08 Feb 2024 18:35:38 GMT access-control-allow-credentials: true access-control-allow-headers: content-type access-control-allow-methods: POST access-control-allow-origin: https://www.booking.com access-control-max-age: 1728000 set-cookie: bkng_sso_session=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:38 GMT; secure; HttpOnly set-cookie: bkng_sso_ses=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:38 GMT; secure; HttpOnly set-cookie: bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiIzYTdiM2MyMy01ZmM4LTQ4NTktOTZkOC1mZmMxMDA3MTIxYTkiLCJzZXNzaW9ucyI6W119fQ; domain=account.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:38 GMT; SameSite=Lax; secure; HttpOnly content-security-policy: frame-ancestors https://.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=e52c82bd01b10598&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMJ4KxJTAfD3k6vpGGyphNZUfy-f31chCZb8612iO9R_UYhDOKZTX9f9H49t8PnK2N6xuOIDHFf7buORMsz0fvAgxs9QyLVbP_W9v2_keBPOs content-security-policy-report-only: base-uri 'none'; connect-src saa.booking.com secure.booking.com reports.booking.com privacyportal-eu.onetrust.com geolocation.onetrust.com cdn.cookielaw.org www.google-analytics.com .perimeterx.net .pxchk.net .px-cdn.net .px-client.net .px-cloud.net 'self' 'report-sample'; default-src .bstatic.com bstatic.com 'self'; frame-src https://www.youtube.com/embed/Vv4w5SmRkss .bstatic.com https://www.google.com bstatic.com www.booking.com secure.booking.com paymentcomponent.booking.com 'self'; img-src 'self' data: www.booking.com graph.facebook.com cdn.cookielaw.org account.booking.com .bstatic.com bstatic.com .static.booking.cn www.google-analytics.com www.google.com stats.g.doubleclick.net .px-cloud.net .perimeterx.net www.gstatic.com; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=213&pid=e52c82bd01b10598&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMJ4KxJTAfD3k6vpGGyphNZUfy-f31chCZb8612iO9R_UYhDOKZTX9f9H49t8PnK2N6xuOIDHFf7buORMsz0fvAgxs9QyLVbP_W9v2_keBPOs; script-src saa.booking.com .bstatic.com bstatic.com .static.booking.cn www.google.com www.google-analytics.com cdn.cookielaw.org geolocation.onetrust.com 'self' 'nonce-hh6cU4bQBjMQ947' 'report-sample'; style-src .bstatic.com bstatic.com .static.booking.cn 'self' 'unsafe-inline' x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 93db32d5347403a3ab35b40dbb40e860.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD66-C1 X-Amz-Cf-Id: _A9OlzCxzh3xfgHMyQJNq1j0j0Xy7yG08VZt4IPM8AKzSQMM_wJUOw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49778	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	2496	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1028 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3 X-Booking-AID: 304142 X-Booking-Pageview-Id: e4de82b919b800e4 X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,1912460\|1,1856870\|1,1912460\|7,1912460\|6,1908890\|1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7 sec-ch-ua-platform: "Windows" X-Booking-Language-Code: en-us X-Booking-CSRF: M1fFZQAAAAA=ow_iJm02C23yTbeZTjDwFw3ODjezY3bK5FHdo-YoJdT7GCkrsQ32GPbbWguo4KloItJB_vA0z9Y_xRO57ct8Amr5W_XGX_7GZSpQGGcZ9tRZ2sLvFoX1OvJhoh8lHbncqueaPtPA9hz8Y_-xROuXkd4r2dhb8qRB-XM9-fcVbZ1TIOfkTWMBhv8vt5DNEpcahji4EEgpTuAdyxqG sec-ch-ua-mobile: ?0 X-Partner-Channel-Id: 3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Accept: application/json, text/javascript, /; q=0.01 X-Booking-SiteType-Id: 1 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhDMSfLvcMG2VHcbU0a02MOY%2FoE3Pj42bdhHH9WLLA1HPYkJysgulFoMrtOulTRBzpAAVSg2Ic64ufepnGAfylJXnqeKJvDEAHVmYnj3dbGB7ygVV2JkX124%2BEixWTdIqcGu5Kd0Dv6tKmcPbpsN1xr5; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1
2024-02-08 18:35:38 UTC	1028	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 63 33 36 30 5f 74 65 73 74 2e 69 6e 64 65 78 5f 70 61 67 65 5f 6a 73 5f 68 65 61 6c 74 68 63 68 65 63 6b 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 31 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 47 6c 6f 72 79 20 74 6f 20 43 33 36 30 20 66 72 6f 6d 20 6a 73 21 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 22 2c 22 70 61 67 65 5f 74 69 74 6c 65 22 3a 22 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 7c 20 4f 66 66 69 63 69 61 6c 20 73 69 74 65 20 7c Data Ascii: {"events":[{"action_name":"c360_test.index_page_js_healthcheck","action_version":"1.1.0","content":{"message":"Glory to C360 from js!"},"context":{"page":{"page_referrer":"","page_url":"https://www.booking.com/","page_title":"Booking.com \| Official site \|
2024-02-08 18:35:38 UTC	1173	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 61 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:38 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLalZib7103qG%2BF6jNX4nY1OEBjrxAz9Ob8DEQBWTSqeRvOh6i7KV3uDpo7lfSd6A33jZhjYHawln8E0aqfSwxomTxD7gRkwilYph1WF73PdYDrYV%2FBds8KeGhbWuYLP5WRjHVQWXCaBnPp2c6UP9oiZIrDu36czsM%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:38 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=a6c182bd140a00fb&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqstVzieH7rEl9dBob6gBE3FsznbjqfP9u50 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 9546eb427ef2137803aed00cad4fc426.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: C1JLGz7BVs2o_0Dbmc5aRjipGDnrkKerI_rDuGxKX_PPlj9FOl5iXQ==
2024-02-08 18:35:38 UTC	61	IN	Data Raw: 5b 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d 2c 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d 5d Data Ascii: [{"status":1,"content":"Sent"},{"content":"Sent","status":1}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49781	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	712	OUT	GET /static/fonts/booking-iconset-original/29bca18dce5a8e111855e31314a9b1d750ea9beb.woff2 HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://cf.bstatic.com/static/css/gprof_icons_cloudfront_sd.iq_ltr/f2fce41920df3c9225af5c680c3a8127d2caaceb.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:38 UTC	796	IN	HTTP/1.1 200 OK Content-Type: text/plain Content-Length: 92724 Connection: close Server: nginx Date: Wed, 31 Jan 2024 05:07:12 GMT Last-Modified: Wed, 10 Apr 2019 11:21:49 GMT ETag: "5cadd1cd-16a34" Expires: Fri, 01 Mar 2024 05:07:12 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 f4c38e024a95b76a27c9f3dc9ff2eda6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: JXjB9vH300ldSKilqFSmjSR7CKzjujxFe_iUV7tiBOc-YQt6KdbQ8w== Age: 739706
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 01 6a 34 00 0f 00 00 00 03 25 c0 00 01 69 d4 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3f 46 46 54 4d 1c 1a 5a 1b 20 1c de 0a 06 60 00 85 76 11 08 0a 8b 8f 4c 88 d5 69 0b 92 10 00 01 36 02 24 03 92 0c 04 20 05 83 7b 07 aa 5f 5b c6 7e 72 c3 62 70 bb 07 25 74 1b 02 d4 9f 62 6a ce f5 bb 2f 18 c7 26 71 db 9a 03 5f 9a 21 77 a0 62 ba cd 07 79 1c c0 90 7e 7f 64 ff ff ff f9 49 23 c6 b6 1d ba dd ff 83 10 d8 ab 6a 14 15 49 6c 71 4a 0a 54 6a 2b 94 2a e3 94 9c 63 42 89 84 cb c5 65 56 cb cb d2 42 e1 23 5c b7 eb 67 bf 4d 1d d3 d9 ad 37 f4 3b e6 c7 d8 1e a8 fc 7c 85 55 a1 14 ca 91 e4 d8 9c fc 16 be 36 be 2d bd 97 0e d5 bd a1 36 14 94 55 39 a1 e0 bb 95 e5 07 15 cb 47 9b a9 d0 84 ef 41 5d eb 62 d1 d5 77 91 b0 98 9d Data Ascii: wOF2j4%i?FFTMZ `vLi6$ {_[~rbp%tbj/&q_!wby~dI#jIlqJTj+*cBeVB#\gM7;\|U6-6U9GA]bw
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: 3a 55 26 56 4f 68 cd 39 c0 0c 32 1b ec df 48 b1 64 ab 62 14 d9 37 4c 11 14 ee b0 0a 8b f5 0e 65 b8 a7 6d 3e 69 8c 12 3e 1d d6 48 8a ca 8b 93 bf fb e2 19 31 4d e6 aa ea 06 b8 32 d0 b4 49 73 67 a6 21 12 b0 e0 53 9d 9d bd 95 94 ff 2a eb d6 96 93 96 4e ff 0e 03 90 92 3d d4 30 7c b2 63 3b 52 84 63 9b 7a 56 6f fc c9 80 f5 dc 0c ab 11 5a 73 96 ae 1a dc 52 15 2d e1 3a 13 36 63 1e 8f ac 54 26 c7 a8 86 32 40 91 d0 14 02 a6 a3 26 eb 79 21 84 33 1d 01 8d 50 11 57 0d f8 0b 1d 4e 8c 72 11 db 1c 33 55 d5 81 d9 80 7c 8a e2 e6 2f 12 a5 80 9b 83 02 d5 18 49 ca 4b bb 04 ec f5 e0 a9 a0 16 20 fc 5e c6 b8 e7 9d 65 41 c8 6f 80 4c 82 42 a4 9a 12 8a d4 e8 fa ae 66 ab d3 bf 51 28 79 97 fd 6a 57 cd 18 09 47 fc fc 57 50 22 c6 80 58 fb 5e 2e 17 ae 8d 02 6d a2 74 f2 f5 9e 6c 00 d8 49 Data Ascii: :U&VOh92Hdb7Lem>i>H1M2Isg!S*N=0\|c;RczVoZsR-:6cT&2@&y!3PWNr3U\|/IK ^eAoLBfQ(yjWGWP"X^.mtlI
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: e6 dd 4c 9f eb 86 6a 72 33 96 04 84 51 90 b1 28 24 13 16 7e a9 37 2e ed d2 ae 4b 85 de 99 e4 f2 33 27 47 39 c5 c3 f1 e2 8a d7 59 a3 9a 07 9c b0 07 ac 5b ee c4 9e 7a 5b 42 17 e8 dc 63 83 f9 a7 ca 55 26 62 c2 ec 80 05 bf 12 ac cc 80 51 f2 90 7e 6f 8d 03 fd 30 f1 de dc 72 0f 14 81 8c 93 e5 ab 21 05 cc 3c cf 37 75 84 8a 69 17 4b be 49 f9 60 f2 66 22 ac d1 91 46 1f 0a 5c 32 7f 8a 36 e2 57 99 60 3f 10 b7 07 c5 14 8e 7f 70 6d d4 80 f7 3f 11 c9 d0 4f ff 3c e5 ee fc 65 44 e9 b9 2d e0 70 0a e6 40 1b 30 02 80 88 e9 c0 4a c4 13 d3 80 d4 ab 2d 79 a1 1f a0 87 c2 b8 07 f9 8a 0f c4 82 0a 78 8d 0b 05 72 76 b4 2c d9 f3 68 09 bf 08 7d 0b 3a 66 ec bd 10 e0 dc 76 80 85 5e 0c 87 4f 6c a6 c0 5c 31 d1 0a e4 58 7c 3e 8c 5e 96 8a b5 56 54 89 07 48 55 c8 c2 d1 fa 24 42 42 40 1f 7a Data Ascii: Ljr3Q($~7.K3'G9Y[z[BcU&bQ~o0r!<7uiKI`f"F\26W`?pm?O<eD-p@0J-yxrv,h}:fv^Ol\1X\|>^VTHU$BB@z
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: eb 78 ba 3c b7 cd 5f 91 6f b3 06 f9 15 a4 d9 79 71 58 16 13 8e 30 54 bd 89 b8 fe dd 1c f8 00 23 0f fd 1b 8e 21 6c 7d 98 b6 72 37 8d 47 7b 9e c9 ca ce 69 6b e5 db ec fc c9 23 95 88 b7 ac ab 29 70 61 22 06 e8 b1 4c 3f 1d 48 f7 33 63 8f 2a 42 8a 5d 17 01 1d bd a6 0a ba 8c c7 a2 95 8c cf d2 a4 ff 8d 7f 1e d3 7c ba 62 eb c3 fb 4d cc 68 4b 1b 11 9e 31 5c 27 cb 91 86 88 dd a1 d0 bc 9a cd 0c df 6e 0c f3 bf 38 66 83 f0 49 41 28 58 15 dd 5f 2b b5 02 2f 0b cb d5 68 75 cd 9b dd cf 17 bf 3c 95 dc 9e 1f ef e1 d4 ee 86 6a 90 46 73 34 e8 28 f8 b8 9d 4b f3 52 d5 54 2f cd 9c c3 61 71 39 12 4e 8e 99 a6 f3 ea a3 a3 41 fd 4a 02 ee 8c e2 87 de c8 09 23 89 89 c0 dc 08 7e 25 3a 01 3a d0 b6 db e9 11 8f 51 5f f5 2f 65 9e 0e 9c b1 90 f9 2b e0 c5 d7 f4 b1 a0 a9 0c 97 35 0a 58 59 aa Data Ascii: x<_oyqX0T#!l}r7G{ik#)pa"L?H3c*B]\|bMhK1\'n8fIA(X_+/hu<jFs4(KRT/aq9NAJ#~%::Q_/e+5XY
2024-02-08 18:35:38 UTC	4820	IN	Data Raw: a6 41 65 b7 34 ad d2 0a 75 38 0b d2 40 06 a1 04 3c b4 6d 87 36 16 a6 80 9f 22 82 cf 77 c2 cf 5a 5a 5f d0 70 8e a1 d5 17 1e f7 b7 02 65 f1 36 f2 7d 10 24 e9 7a 0f 96 eb 78 ef b7 5e 43 8e 0a 19 fc 0f 82 f0 03 9f d1 68 97 be 5a f6 9e a9 e0 6f d7 65 06 fc 23 9f 71 3e 69 7c ce 9e cb 91 de a3 1c 78 d6 31 c6 a9 d8 a4 90 ce b5 34 4f 51 61 fc 0a 25 02 84 80 56 0a 5c b5 16 c4 17 99 0f 4b 43 f8 50 87 6e 7c 20 84 2f 3e 3e 48 08 5a 4e 97 b0 e0 bd ae 5c b3 b8 de 4e 13 47 d7 4a 5f 2e 4a e5 f4 38 b9 74 71 83 ad 3b 2e ce 2d 7d d1 d8 c5 45 1b 67 c7 7e 50 f3 e5 e5 8e 71 3d f9 ba fc 5c 4d d3 78 db e4 f6 71 d4 c4 7e ae 57 cc 62 87 b8 bf 64 41 0e 02 01 a5 04 28 02 97 d5 fd 39 9a 60 b7 b6 7b 24 ff 34 24 63 fa 75 00 84 38 d0 73 0e 10 e1 24 90 4f b0 24 ca 6c 8c 32 1a e4 ac 59 68 Data Ascii: Ae4u8@<m6"wZZ_pe6}$zx^ChZoe#q>i\|x14OQa%V\KCPn\| />>HZN\NGJ_.J8tq;.-}Eg~Pq=\Mxq~WbdA(9`{$4$cu8s$O$l2Yh
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: 39 7a 7d 77 6e 2e f0 9a 53 3f fd 60 5e 97 80 47 2e 26 f5 38 dc c9 f9 07 3a 1a bf 38 91 7f 9d a0 63 fe b5 46 f6 bd 2d 92 f6 db 3d 17 87 c3 ea ad 53 05 ba 9c 58 ad 22 79 af d6 0e eb be 50 10 43 8e cf 71 6a c7 77 45 a0 08 61 bc 8c ce d7 5e 1d 70 0a 5d 6b fa 60 c5 61 19 d8 d7 56 39 44 fa f1 55 f5 23 34 5d e2 22 20 61 da ae 34 ae e1 8e d8 be b0 24 27 2a 2a 1a 1c 13 ab 8e 70 72 ec 22 df f8 ea c2 71 63 9d 70 d1 8a ca 6a bf 72 e1 b6 75 d4 e6 6f 57 d9 8f a4 2d d8 74 12 66 be 53 20 df c0 c8 c8 bc 3e c8 32 b1 70 1f 3a fa a0 f7 66 50 5e 24 de 4a 1a 9a 34 fc 89 ae ad 85 d7 bd ab 98 35 91 53 e8 69 ac b6 fe 10 b3 40 4b 0a 0a b4 d7 87 d3 52 bf 1b d0 a3 6f 37 36 54 14 00 63 04 e8 1d db 51 d2 5b 6a d7 5f 1b cc 48 fa ae 8f 92 5b 45 c4 ed 9e 6b d6 f1 53 ff d5 3c 57 87 c5 9d Data Ascii: 9z}wn.S?`^G.&8:8cF-=SX"yPCqjwEa^p]k`aV9DU#4]" a4$'**pr"qcpjruoW-tfS >2p:fP^$J45Si@KRo76TcQ[j_H[EkS<W
2024-02-08 18:35:38 UTC	5984	IN	Data Raw: 2b 28 02 67 78 7b 89 da ad d6 dc 07 8f 3e b4 eb a1 f5 cf d7 e7 bb 8d a8 0b 96 fe fe 87 42 7e b7 68 0b 88 f4 dd c5 22 7d 47 ce 75 29 e3 bf bc 18 b3 4c b0 51 60 36 5f 7c 1e 52 46 52 92 54 0e 07 59 45 56 15 56 dc 6c f7 96 38 89 8f 7e e3 0d a5 96 22 91 29 76 0f db f7 e5 8f 49 8f 53 87 a9 6a 8d 1a ad c6 34 38 62 c3 67 cc 0e fd a0 e1 75 75 6b e3 13 67 a7 49 1a 33 bb 5b 2b b5 12 00 23 74 2f 91 5f c2 2b 19 2a 8d e5 95 f2 eb d5 bd 8c 32 42 61 09 22 3a 62 80 17 ac 50 be 46 65 70 a5 d4 d7 23 e5 45 42 d5 17 7c d3 bd d6 c4 6d 97 60 29 d4 09 a7 b8 65 2b ba 6c d0 5d 6c e5 aa 20 d1 c6 b4 a4 68 a1 8f 32 d1 11 8c 51 f4 1e 8f 3b 20 a8 e1 24 0c ec 46 95 37 ae f3 f4 ee 2e 16 6c 4a 39 64 52 6c 2c d1 c8 56 da 69 33 b8 72 2a 07 47 d3 b4 55 df 55 a0 ce 52 94 5f 77 5e 4a 72 72 b2 Data Ascii: +(gx{>B~h"}Gu)LQ`6_\|RFRTYEVVl8~")vISj48bguukgI3[+#t/_+2Ba":bPFep#EB\|m`)e+l]l h2Q; $F7.lJ9dRl,Vi3rGUUR_w^Jrr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49783	104.18.131.236	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	631	OUT	GET /consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/3ea94870-d4b1-483a-b1d2-faf1d982bb31.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:38 UTC	902	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:35:38 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8525f93c5fe94529-ATL CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 20429 Cache-Control: public, max-age=86400 Expires: Fri, 09 Feb 2024 18:35:38 GMT Last-Modified: Fri, 02 Feb 2024 12:54:10 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: E7bVHy0X9zWXnIXDZNC6oQ== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: c0b00fb9-301e-0034-38d7-550a4b000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-02-08 18:35:38 UTC	467	IN	Data Raw: 31 61 30 35 0d 0a 7b 22 43 6f 6f 6b 69 65 53 50 41 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 53 61 6d 65 53 69 74 65 4e 6f 6e 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 56 32 43 53 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 4d 75 6c 74 69 56 61 72 69 61 6e 74 54 65 73 74 69 6e 67 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 55 73 65 56 32 22 3a 74 72 75 65 2c 22 4d 6f 62 69 6c 65 53 44 4b 22 3a 66 61 6c 73 65 2c 22 53 6b 69 70 47 65 6f 6c 6f 63 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 53 63 72 69 70 74 54 79 70 65 22 3a 22 50 52 4f 44 55 43 54 49 4f 4e 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 32 30 32 33 31 30 2e 32 2e 30 22 2c 22 4f 70 74 61 6e 6f 6e 44 61 74 61 4a 53 4f 4e 22 3a 22 33 65 61 39 Data Ascii: 1a05{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202310.2.0","OptanonDataJSON":"3ea9
2024-02-08 18:35:38 UTC	1369	IN	Data Raw: 74 22 3a 5b 7b 22 49 64 22 3a 22 39 37 37 38 66 34 61 62 2d 36 62 34 61 2d 34 65 30 33 2d 62 64 66 38 2d 38 36 61 35 63 30 33 37 63 34 62 66 22 2c 22 4e 61 6d 65 22 3a 22 55 53 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 75 73 22 5d 2c 22 53 74 61 74 65 73 22 3a 7b 7d 2c 22 4c 61 6e 67 75 61 67 65 53 77 69 74 63 68 65 72 50 6c 61 63 65 68 6f 6c 64 65 72 22 3a 7b 22 6e 6f 22 3a 22 6e 6f 22 2c 22 68 69 22 3a 22 68 69 22 2c 22 64 65 22 3a 22 64 65 22 2c 22 72 75 22 3a 22 72 75 22 2c 22 66 69 22 3a 22 66 69 22 2c 22 65 6e 2d 55 53 22 3a 22 65 6e 2d 55 53 22 2c 22 62 67 22 3a 22 62 67 22 2c 22 6c 74 22 3a 22 6c 74 22 2c 22 6c 76 22 3a 22 6c 76 22 2c 22 68 72 22 3a 22 68 72 22 2c 22 66 72 22 3a 22 66 72 22 2c 22 68 75 22 3a 22 68 75 22 2c 22 64 65 66 61 75 Data Ascii: t":[{"Id":"9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf","Name":"US","Countries":["us"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","en-US":"en-US","bg":"bg","lt":"lt","lv":"lv","hr":"hr","fr":"fr","hu":"hu","defau
2024-02-08 18:35:38 UTC	1369	IN	Data Raw: 2d 48 61 6e 74 22 2c 22 75 6b 22 3a 22 75 6b 22 2c 22 73 6b 22 3a 22 73 6b 22 2c 22 73 6c 22 3a 22 73 6c 22 2c 22 69 64 22 3a 22 69 64 22 2c 22 63 61 22 3a 22 63 61 22 2c 22 73 72 22 3a 22 73 72 22 2c 22 73 76 22 3a 22 73 76 22 2c 22 6b 6f 22 3a 22 6b 6f 22 2c 22 70 74 2d 42 52 22 3a 22 70 74 2d 42 52 22 2c 22 6d 73 22 3a 22 6d 73 22 2c 22 65 6c 22 3a 22 65 6c 22 2c 22 69 73 22 3a 22 69 73 22 2c 22 69 74 22 3a 22 69 74 22 2c 22 65 73 2d 4d 58 22 3a 22 65 73 2d 4d 58 22 2c 22 65 73 22 3a 22 65 73 22 2c 22 7a 68 22 3a 22 7a 68 22 2c 22 65 74 22 3a 22 65 74 22 2c 22 63 73 22 3a 22 63 73 22 2c 22 61 72 22 3a 22 61 72 22 2c 22 70 74 2d 50 54 22 3a 22 70 74 2d 50 54 22 2c 22 76 69 22 3a 22 76 69 22 2c 22 74 68 22 3a 22 74 68 22 2c 22 65 73 2d 41 52 22 3a 22 65 Data Ascii: -Hant","uk":"uk","sk":"sk","sl":"sl","id":"id","ca":"ca","sr":"sr","sv":"sv","ko":"ko","pt-BR":"pt-BR","ms":"ms","el":"el","is":"is","it":"it","es-MX":"es-MX","es":"es","zh":"zh","et":"et","cs":"cs","ar":"ar","pt-PT":"pt-PT","vi":"vi","th":"th","es-AR":"e
2024-02-08 18:35:38 UTC	1369	IN	Data Raw: 63 61 22 2c 22 73 72 22 2c 22 63 63 22 2c 22 73 73 22 2c 22 63 64 22 2c 22 73 74 22 2c 22 63 66 22 2c 22 73 76 22 2c 22 63 67 22 2c 22 73 78 22 2c 22 63 68 22 2c 22 63 69 22 2c 22 73 79 22 2c 22 73 7a 22 2c 22 63 6b 22 2c 22 63 6c 22 2c 22 63 6d 22 2c 22 63 6f 22 2c 22 63 72 22 2c 22 74 63 22 2c 22 74 64 22 2c 22 74 66 22 2c 22 63 75 22 2c 22 74 67 22 2c 22 63 76 22 2c 22 63 77 22 2c 22 74 68 22 2c 22 63 78 22 2c 22 74 6a 22 2c 22 74 6b 22 2c 22 74 6c 22 2c 22 74 6d 22 2c 22 74 6e 22 2c 22 74 6f 22 2c 22 74 72 22 2c 22 74 74 22 2c 22 74 76 22 2c 22 74 77 22 2c 22 64 6a 22 2c 22 74 7a 22 2c 22 64 6d 22 2c 22 64 6f 22 2c 22 75 61 22 2c 22 75 67 22 2c 22 64 7a 22 2c 22 75 6d 22 2c 22 65 63 22 2c 22 65 67 22 2c 22 65 68 22 2c 22 75 79 22 2c 22 75 7a 22 2c 22 Data Ascii: ca","sr","cc","ss","cd","st","cf","sv","cg","sx","ch","ci","sy","sz","ck","cl","cm","co","cr","tc","td","tf","cu","tg","cv","cw","th","cx","tj","tk","tl","tm","tn","to","tr","tt","tv","tw","dj","tz","dm","do","ua","ug","dz","um","ec","eg","eh","uy","uz","
2024-02-08 18:35:38 UTC	1369	IN	Data Raw: 74 22 3a 74 72 75 65 2c 22 47 6c 6f 62 61 6c 22 3a 74 72 75 65 2c 22 54 79 70 65 22 3a 22 47 44 50 52 22 2c 22 55 73 65 47 6f 6f 67 6c 65 56 65 6e 64 6f 72 73 22 3a 66 61 6c 73 65 2c 22 56 61 72 69 61 6e 74 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 54 65 73 74 45 6e 64 54 69 6d 65 22 3a 6e 75 6c 6c 2c 22 56 61 72 69 61 6e 74 73 22 3a 5b 5d 2c 22 54 65 6d 70 6c 61 74 65 4e 61 6d 65 22 3a 22 43 75 73 74 6f 6d 65 72 20 2d 20 41 63 63 65 70 74 2f 44 65 63 6c 69 6e 65 22 2c 22 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 47 43 45 6e 61 62 6c 65 22 3a 66 61 6c 73 65 2c 22 49 73 47 50 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 7d 5d 2c 22 49 61 62 44 61 74 61 22 3a 7b 22 63 6f 6f 6b 69 65 56 65 72 73 69 6f 6e 22 3a 22 31 22 2c 22 63 72 65 61 74 65 64 Data Ascii: t":true,"Global":true,"Type":"GDPR","UseGoogleVendors":false,"VariantEnabled":false,"TestEndTime":null,"Variants":[],"TemplateName":"Customer - Accept/Decline","Conditions":[],"GCEnable":false,"IsGPPEnabled":false}],"IabData":{"cookieVersion":"1","created
2024-02-08 18:35:38 UTC	726	IN	Data Raw: 65 73 22 3a 7b 22 43 6f 6f 6b 69 65 56 32 42 61 6e 6e 65 72 46 6f 63 75 73 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 50 43 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 41 73 73 69 67 6e 54 65 6d 70 6c 61 74 65 52 75 6c 65 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6f 6c 6f 63 61 74 69 6f 6e 4a 73 6f 6e 41 70 69 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 43 4d 44 4d 41 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 54 43 46 32 31 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 52 65 6d 6f 76 65 53 65 74 74 69 6e 67 73 49 63 6f 6e 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 42 61 6e 6e 65 72 4c 6f 67 6f 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6e 65 72 61 6c 56 65 6e 64 6f 72 73 22 3a 74 72 75 65 2c 22 43 6f Data Ascii: es":{"CookieV2BannerFocus":true,"CookieV2GPC":true,"CookieV2AssignTemplateRule":true,"CookieV2GeolocationJsonApi":true,"CookieV2GCMDMA":true,"CookieV2TCF21":true,"CookieV2RemoveSettingsIcon":true,"CookieV2BannerLogo":true,"CookieV2GeneralVendors":true,"Co
2024-02-08 18:35:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49792	18.64.236.43	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	422	OUT	GET /static/img/tfl/group_logos/logo_booking/27c8d1832de6a3123b6ee45b59ae2f81b0d9d0d0.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:38 UTC	769	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1628 Connection: close Server: nginx Date: Sun, 28 Jan 2024 18:31:27 GMT Last-Modified: Wed, 10 Apr 2019 11:21:55 GMT Expires: Tue, 27 Feb 2024 18:31:27 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "5cadd1d3-65c" X-Cache: Hit from cloudfront Via: 1.1 39ac2cca33a0d68e57fdcb8db4ab221a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: L9w7ejOHXRDX7XOfHtJwXAYHPBAfzr9F6k4POld9lOOQEvo1K1DQ8w== Age: 950651
2024-02-08 18:35:38 UTC	1628	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 5b 00 00 00 1a 08 06 00 00 00 d8 32 20 50 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 06 62 4b 47 44 00 00 00 00 00 00 f9 43 bb 7f 00 00 05 b0 49 44 41 54 68 de ed d9 7d 6c 5f 65 15 07 f0 4f 3b 9c 1a e7 84 a1 88 a6 2a c2 4c e6 f6 53 27 be 47 2f 6e a2 cb 32 32 9d 62 64 be b4 73 fb 8d 28 64 b2 78 8d 98 b8 28 4a 88 e0 1f de d4 21 11 c6 aa bc cf 45 02 9b 0e 25 2c c2 e0 32 03 03 75 63 65 44 7c 19 93 1f 63 c8 d8 98 a8 98 ce 75 fe f1 9c 5f 7b 5b 5b 5c 4c 6d 33 ec 37 b9 f9 9d e7 9c e7 3e 2f df e7 3c e7 9c db b6 1c 3e 7c d8 38 46 07 ad 63 bd 80 ff 27 8c 93 3d 8a 18 Data Ascii: PNGIHDR[2 PgAMAa cHRMz&u0`:pQ<bKGDCIDATh}l_eO;*LS'G/n22bds(dx(J!E%,2uceD\|cu_{[[\Lm37>/<>\|8Fc'=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49782	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	2852	OUT	GET /js_tracking?ver=2&stype=1&ref_action=index&lang=en-us&pid=e4de82b919b800e4&aid=304142&sid=5171fc655664ddf74ab763a094523fb7&ete=&etg=&etcg=&ets=cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3 X-Booking-CSRF: M1fFZQAAAAA=ow_iJm02C23yTbeZTjDwFw3ODjezY3bK5FHdo-YoJdT7GCkrsQ32GPbbWguo4KloItJB_vA0z9Y_xRO57ct8Amr5W_XGX_7GZSpQGGcZ9tRZ2sLvFoX1OvJhoh8lHbncqueaPtPA9hz8Y_-xROuXkd4r2dhb8qRB-XM9-fcVbZ1TIOfkTWMBhv8vt5DNEpcahji4EEgpTuAdyxqG sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: e4de82b919b800e4 X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,1912460\|1,1856870\|1,1912460\|7,1912460\|6,1908890\|1 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhDMSfLvcMG2VHcbU0a02MOY%2FoE3Pj42bdhHH9WLLA1HPYkJysgulFoMrtOulTRBzpAAVSg2Ic64ufepnGAfylJXnqeKJvDEAHVmYnj3dbGB7ygVV2JkX124%2BEixWTdIqcGu5Kd0Dv6tKmcPbpsN1xr5; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1
2024-02-08 18:35:38 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:38 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=761082bd9b3200e4&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejJzUFIY32bq8WwNl50VRJsnHcp20rwmOhM x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 5988b4ae4648c0fec3c60a3cca580092.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: e97sL5OxAXXQbkaqxuq1U4lzOiqM3vaTWMXg9lqL-L04epsfz4yvCA==
2024-02-08 18:35:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49788	64.233.177.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	814	OUT	GET /gsi/client HTTP/1.1 Host: accounts.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:38 UTC	1138	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Expires: Thu, 08 Feb 2024 18:35:38 GMT Date: Thu, 08 Feb 2024 18:35:38 GMT Cache-Control: private, max-age=1800 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1" Report-To: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]} Cross-Origin-Resource-Policy: cross-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Content-Security-Policy: script-src 'report-sample' 'nonce-c5xDbTI6nmgrkbIYBFMDLg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:38 UTC	114	IN	Data Raw: 38 30 30 30 0d 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 67 73 69 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 67 73 69 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a Data Ascii: 8000"use strict";this.default_gsi=this.default_gsi\|\|{};(function(_){var window=this;try{_._F_toggles_initializ
2024-02-08 18:35:38 UTC	1252	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 37 34 32 34 30 30 2c 20 5d 29 3b 0a 76 61 72 20 61 61 2c 62 61 2c 63 61 2c 64 61 2c 74 2c 65 61 2c 66 61 2c 68 61 2c 6a 61 3b 61 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 Data Ascii: e=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x742400, ]);var aa,ba,ca,da,t,ea,fa,ha,ja;aa=function(a){var b=0;return function(){return b<a.length?{done:!1,v
2024-02-08 18:35:38 UTC	1252	IN	Data Raw: 72 61 74 6f 72 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 29 72 65 74 75 72 6e 20 61 3b 61 3d 53 79 6d 62 6f 6c 28 22 63 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 22 41 72 72 61 79 20 49 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 43 6c 61 6d 70 65 64 41 72 72 61 79 20 49 6e 74 31 36 41 72 72 61 79 20 55 69 6e 74 31 36 41 72 72 61 79 20 49 6e 74 33 32 41 72 72 61 79 20 55 69 6e 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 36 34 41 72 72 61 79 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 63 3d 30 3b 63 3c 62 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 64 61 5b 62 5b 63 5d 5d 3b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 64 26 26 22 66 75 6e 63 74 69 6f 6e 22 Data Ascii: rator",function(a){if(a)return a;a=Symbol("c");for(var b="Array Int8Array Uint8Array Uint8ClampedArray Int16Array Uint16Array Int32Array Uint32Array Float32Array Float64Array".split(" "),c=0;c<b.length;c++){var d=da[b[c]];"function"===typeof d&&"function"
2024-02-08 18:35:38 UTC	1252	IN	Data Raw: 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 65 60 22 2b 61 29 3b 72 65 74 75 72 6e 20 61 7d 3a 6e 75 6c 6c 7d 5f 2e 6e 61 3d 6a 61 3b 74 28 22 52 65 66 6c 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 5f 2e 6e 61 3f 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 74 72 79 7b 72 65 74 75 72 6e 28 30 2c 5f 2e 6e 61 29 28 62 2c 63 29 2c 21 30 7d 63 61 74 63 68 28 64 29 7b 72 65 74 75 72 6e 21 31 7d 7d 3a 6e 75 6c 6c 7d 29 3b 0a 74 28 22 50 72 6f 6d 69 73 65 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 29 7b 74 68 69 73 2e 67 3d 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 63 28 67 29 7b 72 65 74 75 72 6e 20 67 20 69 6e 73 74 61 6e 63 65 6f 66 20 65 3f 67 Data Ascii: new TypeError("e`"+a);return a}:null}_.na=ja;t("Reflect.setPrototypeOf",function(a){return a?a:_.na?function(b,c){try{return(0,_.na)(b,c),!0}catch(d){return!1}}:null});t("Promise",function(a){function b(){this.g=null}function c(g){return g instanceof e?g
2024-02-08 18:35:38 UTC	1252	IN	Data Raw: 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 68 3f 74 68 69 73 2e 4d 28 68 2c 67 29 3a 74 68 69 73 2e 6d 28 67 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6c 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 74 68 69 73 2e 76 28 32 2c 67 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 74 68 69 73 2e 76 28 31 2c 67 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 76 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 68 29 7b 69 66 28 30 21 3d 74 68 69 73 2e 67 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 67 60 22 2b 67 2b 22 60 22 2b 68 2b 22 60 22 2b 74 68 69 73 2e 67 29 3b 74 68 69 73 2e 67 3d 67 3b 74 68 69 73 2e 69 3d 68 3b 32 3d 3d 3d 74 68 69 73 2e 67 26 26 74 68 69 73 2e 48 28 29 3b 74 68 69 73 2e 42 28 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 Data Ascii: nction"==typeof h?this.M(h,g):this.m(g)};e.prototype.l=function(g){this.v(2,g)};e.prototype.m=function(g){this.v(1,g)};e.prototype.v=function(g,h){if(0!=this.g)throw Error("g`"+g+"`"+h+"`"+this.g);this.g=g;this.i=h;2===this.g&&this.H();this.B()};e.prototy
2024-02-08 18:35:38 UTC	1252	IN	Data Raw: 74 63 68 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 74 68 65 6e 28 76 6f 69 64 20 30 2c 67 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 68 62 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 68 29 7b 66 75 6e 63 74 69 6f 6e 20 6b 28 29 7b 73 77 69 74 63 68 28 6d 2e 67 29 7b 63 61 73 65 20 31 3a 67 28 6d 2e 69 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 32 3a 68 28 6d 2e 69 29 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 74 68 72 6f 77 20 45 72 72 6f 72 28 22 68 60 22 2b 6d 2e 67 29 3b 7d 7d 76 61 72 20 6d 3d 74 68 69 73 3b 6e 75 6c 6c 3d 3d 74 68 69 73 2e 68 3f 66 2e 68 28 6b 29 3a 0a 74 68 69 73 2e 68 2e 70 75 73 68 28 6b 29 3b 74 68 69 73 2e 6f 3d 21 30 7d 3b 65 2e 72 65 73 6f 6c 76 65 3d 63 3b 65 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 Data Ascii: tch=function(g){return this.then(void 0,g)};e.prototype.hb=function(g,h){function k(){switch(m.g){case 1:g(m.i);break;case 2:h(m.i);break;default:throw Error("h`"+m.g);}}var m=this;null==this.h?f.h(k):this.h.push(k);this.o=!0};e.resolve=c;e.reject=functi
2024-02-08 18:35:38 UTC	1252	IN	Data Raw: 64 20 30 7d 72 65 74 75 72 6e 20 62 7d 7d 29 3b 0a 74 28 22 57 65 61 6b 4d 61 70 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 63 28 6b 29 7b 76 61 72 20 6d 3d 74 79 70 65 6f 66 20 6b 3b 72 65 74 75 72 6e 22 6f 62 6a 65 63 74 22 3d 3d 3d 6d 26 26 6e 75 6c 6c 21 3d 3d 6b 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 6d 7d 66 75 6e 63 74 69 6f 6e 20 64 28 6b 29 7b 69 66 28 21 66 61 28 6b 2c 66 29 29 7b 76 61 72 20 6d 3d 6e 65 77 20 62 3b 62 61 28 6b 2c 66 2c 7b 76 61 6c 75 65 3a 6d 7d 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 65 28 6b 29 7b 76 61 72 20 6d 3d 4f 62 6a 65 63 74 5b 6b 5d 3b 6d 26 26 28 4f 62 6a 65 63 74 5b 6b 5d 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 69 66 28 6e 20 69 6e 73 74 61 6e 63 Data Ascii: d 0}return b}});t("WeakMap",function(a){function b(){}function c(k){var m=typeof k;return"object"===m&&null!==k\|\|"function"===m}function d(k){if(!fa(k,f)){var m=new b;ba(k,f,{value:m})}}function e(k){var m=Object[k];m&&(Object[k]=function(n){if(n instanc
2024-02-08 18:35:38 UTC	1252	IN	Data Raw: 31 3b 74 72 79 7b 76 61 72 20 68 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 6b 3d 6e 65 77 20 61 28 5f 2e 75 28 5b 5b 68 2c 22 73 22 5d 5d 29 29 3b 69 66 28 22 73 22 21 3d 6b 2e 67 65 74 28 68 29 7c 7c 31 21 3d 6b 2e 73 69 7a 65 7c 7c 6b 2e 67 65 74 28 7b 78 3a 34 7d 29 7c 7c 6b 2e 73 65 74 28 7b 78 3a 34 7d 2c 22 74 22 29 21 3d 6b 7c 7c 32 21 3d 6b 2e 73 69 7a 65 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 6d 3d 6b 2e 65 6e 74 72 69 65 73 28 29 2c 6e 3d 6d 2e 6e 65 78 74 28 29 3b 69 66 28 6e 2e 64 6f 6e 65 7c 7c 6e 2e 76 61 6c 75 65 5b 30 5d 21 3d 68 7c 7c 22 73 22 21 3d 6e 2e 76 61 6c 75 65 5b 31 5d 29 72 65 74 75 72 6e 21 31 3b 6e 3d 6d 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 6e 2e 64 6f 6e 65 7c 7c 34 21 3d 6e 2e 76 61 6c 75 65 5b Data Ascii: 1;try{var h=Object.seal({x:4}),k=new a(_.u([[h,"s"]]));if("s"!=k.get(h)\|\|1!=k.size\|\|k.get({x:4})\|\|k.set({x:4},"t")!=k\|\|2!=k.size)return!1;var m=k.entries(),n=m.next();if(n.done\|\|n.value[0]!=h\|\|"s"!=n.value[1])return!1;n=m.next();return n.done\|\|4!=n.value[
2024-02-08 18:35:38 UTC	1252	IN	Data Raw: 65 79 7d 29 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 68 2e 76 61 6c 75 65 7d 29 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6f 72 45 61 63 68 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 6b 29 7b 66 6f 72 28 76 61 72 20 6d 3d 74 68 69 73 2e 65 6e 74 72 69 65 73 28 29 2c 0a 6e 3b 21 28 6e 3d 6d 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6e 3d 6e 2e 76 61 6c 75 65 2c 68 2e 63 61 6c 6c 28 6b 2c 6e 5b 31 5d 2c 6e 5b 30 5d 2c 74 68 69 73 29 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 63 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 3b 76 61 72 20 64 3d 66 75 Data Ascii: ey})};c.prototype.values=function(){return e(this,function(h){return h.value})};c.prototype.forEach=function(h,k){for(var m=this.entries(),n;!(n=m.next()).done;)n=n.value,h.call(k,n[1],n[0],this)};c.prototype[Symbol.iterator]=c.prototype.entries;var d=fu
2024-02-08 18:35:38 UTC	1252	IN	Data Raw: 7b 76 61 6c 75 65 3a 62 28 66 2c 61 5b 66 5d 29 2c 64 6f 6e 65 3a 21 31 7d 7d 64 3d 21 30 3b 72 65 74 75 72 6e 7b 64 6f 6e 65 3a 21 30 2c 76 61 6c 75 65 3a 76 6f 69 64 20 30 7d 7d 7d 3b 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 7d 3b 72 65 74 75 72 6e 20 65 7d 3b 74 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 70 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 20 63 7d 29 7d 7d 29 3b 74 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 6b 65 79 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 Data Ascii: {value:b(f,a[f]),done:!1}}d=!0;return{done:!0,value:void 0}}};e[Symbol.iterator]=function(){return e};return e};t("Array.prototype.values",function(a){return a?a:function(){return pa(this,function(b,c){return c})}});t("Array.prototype.keys",function(a){re

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49795	18.64.236.43	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	424	OUT	GET /static/img/tfl/group_logos/logo_opentable/a4b50503eda6c15773d6e61c238230eb42fb050d.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:38 UTC	769	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 2344 Connection: close Server: nginx Date: Sun, 28 Jan 2024 18:31:28 GMT Last-Modified: Wed, 10 Apr 2019 11:21:55 GMT Expires: Tue, 27 Feb 2024 18:31:28 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "5cadd1d3-928" X-Cache: Hit from cloudfront Via: 1.1 b340a44dae03e8ff13e054502e49abe2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: sd1nxjpXKgQ2nH8gGtp_AFykDdG4PKxFV4ayCHg62-X6OgxmFPQbbw== Age: 950649
2024-02-08 18:35:38 UTC	2344	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 5f 00 00 00 1a 08 06 00 00 00 d1 d9 80 2a 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 08 e2 49 44 41 54 68 05 ed 58 0d 6c 14 c7 15 9e 99 dd db bb 60 c7 7f 18 8a 00 e3 bb b3 8d 4b 0f 27 6d dd c4 e0 24 c4 b5 09 a8 54 69 d3 46 95 d3 54 a4 4a 4b aa 34 41 aa 22 51 5a 94 d2 d2 a4 6d 1a aa d2 8a a6 b4 a9 42 d3 94 a8 aa 84 92 42 d2 10 a5 d4 89 15 2c 88 9d 98 56 16 16 f1 0f 77 36 38 14 c2 bf 7f ce ec ed ee 4c bf 77 3e 1f dc fa 0c 3e 47 8a 50 72 23 cd ed cc 7b 6f de cc 7c ef cd 7b 33 c7 58 b6 64 11 c8 22 90 45 e0 43 45 80 7f d0 d9 c2 b5 f5 a5 4a b1 5a a5 44 48 31 39 5b 32 6e 41 69 bf 10 da 3b e6 85 58 5b a8 b3 79 f8 83 ce f1 51 1d 3f 6d f0 df ad 69 b8 c1 10 7c 9d 64 ec 4e 83 f3 02 ce 52 55 c5 14 38 8c 75 e1 Data Ascii: PNGIHDR_*sRGBIDAThXl`K'm$TiFTJK4A"QZmBB,Vw68Lw>>GPr#{o\|{3Xd"ECEJZDH19[2nAi;X[yQ?mi\|dNRU8u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49786	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	589	OUT	GET /psb/capla/static/js/dc32f6b7.30f8c5b3.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:38 UTC	687	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 348177 Connection: close Last-Modified: Mon, 05 Feb 2024 15:23:39 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: kwmxGOZCrEK2EBJ4MVb4AX5VF50VP2A2 Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 13:33:16 GMT ETag: "800be105a38a4f7fa6da493375b0ea49" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 fcb94596db202c75ac0e559b3183be72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: CJmJrU00XYQALecIfpaCjYRcgoHUHAywYUAW8V2r9u2WpK2sRSd9ww== Age: 20837 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:38 UTC	15697	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 64 63 33 32 66 36 62 37 2e 33 30 66 38 63 35 62 33 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 77 65 62 2d 73 68 65 6c 6c 2d 63 6f 6d 70 6f 6e 65 6e 74 73 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 77 65 62 2d 73 68 65 6c 6c 2d 63 6f 6d 70 6f 6e 65 6e 74 73 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 64 63 33 32 66 36 62 37 22 5d 2c 7b 64 30 39 38 39 32 33 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 22 75 73 65 20 73 74 72 69 Data Ascii: /! For license information please see dc32f6b7.30f8c5b3.chunk.js.LICENSE.txt /(self["b-web-shell-components__LOADABLE_LOADED_CHUNKS__"]=self["b-web-shell-components__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["dc32f6b7"],{d0989236:function(e,n,t){"use stri
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: 6d 31 2e 35 20 30 61 36 20 36 20 30 20 31 20 30 2d 31 32 20 30 20 36 20 36 20 30 20 30 20 30 20 31 32 20 30 7a 6d 31 2e 34 34 35 20 31 30 2e 35 39 37 63 2d 34 2e 30 38 36 2d 34 2e 31 31 31 2d 31 30 2e 37 33 32 2d 34 2e 31 33 32 2d 31 34 2e 38 34 34 2d 2e 30 34 36 6c 2d 2e 30 34 36 2e 30 34 36 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 31 2e 30 36 34 20 31 2e 30 35 38 6c 2e 30 34 2d 2e 30 34 61 38 2e 39 39 36 20 38 2e 39 39 36 20 30 20 30 20 31 20 31 32 2e 37 32 32 2e 30 34 2e 37 35 2e 37 35 20 30 20 30 20 30 20 31 2e 30 36 34 2d 31 2e 30 35 38 7a 4d 32 32 2e 35 20 31 32 63 30 20 35 2e 37 39 39 2d 34 2e 37 30 31 20 31 30 2e 35 2d 31 30 2e 35 20 31 30 2e 35 53 31 2e 35 20 31 37 2e 37 39 39 20 31 2e 35 20 31 32 20 36 2e 32 30 31 20 31 2e 35 20 31 32 20 31 2e Data Ascii: m1.5 0a6 6 0 1 0-12 0 6 6 0 0 0 12 0zm1.445 10.597c-4.086-4.111-10.732-4.132-14.844-.046l-.046.046a.75.75 0 0 0 1.064 1.058l.04-.04a8.996 8.996 0 0 1 12.722.04.75.75 0 0 0 1.064-1.058zM22.5 12c0 5.799-4.701 10.5-10.5 10.5S1.5 17.799 1.5 12 6.201 1.5 12 1.
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: 68 65 61 64 65 72 2d 6d 6f 62 69 6c 65 2d 70 72 6f 66 69 6c 65 2d 6d 6f 64 61 6c 22 7d 2c 63 6c 6f 73 65 41 74 74 72 69 62 75 74 65 73 3a 7b 22 64 61 74 61 2d 74 65 73 74 69 64 22 3a 22 68 65 61 64 65 72 2d 6d 6f 62 69 6c 65 2d 70 72 6f 66 69 6c 65 2d 6d 6f 64 61 6c 2d 63 6c 6f 73 65 22 7d 7d 7d 29 2c 5b 5d 29 2c 4e 3d 28 30 2c 69 2e 75 73 65 4d 65 6d 6f 29 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 7b 61 74 74 72 69 62 75 74 65 73 3a 7b 22 64 61 74 61 2d 74 65 73 74 69 64 22 3a 22 68 65 61 64 65 72 2d 70 72 6f 66 69 6c 65 2d 6d 65 6e 75 22 7d 7d 7d 29 2c 5b 5d 29 3b 72 65 74 75 72 6e 20 74 3f 61 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 61 28 29 2e 46 72 61 67 6d 65 6e 74 2c 6e 75 6c 6c 2c 68 28 7b 6f 6e 43 6c 69 63 6b 3a 66 75 6e Data Ascii: header-mobile-profile-modal"},closeAttributes:{"data-testid":"header-mobile-profile-modal-close"}}}),[]),N=(0,i.useMemo)((function(){return{attributes:{"data-testid":"header-profile-menu"}}}),[]);return t?a().createElement(a().Fragment,null,h({onClick:fun
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 62 2c 6e 75 6c 6c 29 29 7d 76 61 72 20 49 65 3d 74 28 22 32 38 64 62 64 31 33 32 22 29 2c 41 65 3d 74 28 22 31 64 35 62 37 61 34 38 22 29 2c 50 65 3d 22 61 66 30 36 39 30 33 31 66 66 22 3b 76 61 72 20 77 65 3d 28 30 2c 69 2e 6d 65 6d 6f 29 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 6f 6e 73 74 7b 74 72 61 6e 73 6c 61 74 65 3a 6e 7d 3d 28 30 2c 73 2e 75 73 65 54 72 61 6e 73 6c 61 74 69 6f 6e 73 29 28 29 3b 72 65 74 75 72 6e 20 61 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 53 2e 41 63 74 69 6f 6e 61 62 6c 65 2c 28 30 2c 5f 2e 5a 29 28 7b 63 6c 61 73 73 4e 61 6d 65 3a 50 65 2c 61 74 74 72 69 62 75 74 65 73 3a 7b 22 61 72 69 61 2d 6c 61 62 65 6c 22 3a 6e 28 22 6d 6f 62 69 6c 65 5f 68 65 61 64 65 72 5f 69 63 6f Data Ascii: reateElement(b,null))}var Ie=t("28dbd132"),Ae=t("1d5b7a48"),Pe="af069031ff";var we=(0,i.memo)((function(e){const{translate:n}=(0,s.useTranslations)();return a().createElement(S.Actionable,(0,_.Z)({className:Pe,attributes:{"aria-label":n("mobile_header_ico
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: 2e 37 35 20 34 2e 35 2e 37 34 2d 2e 36 32 37 48 31 32 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 30 20 31 2e 35 68 31 2e 35 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 2e 37 34 2d 2e 36 32 37 6c 2e 37 35 2d 34 2e 35 2d 2e 37 34 2e 36 32 37 68 31 2e 35 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 2e 37 35 2d 2e 37 35 76 2d 2e 37 35 41 34 2e 35 20 34 2e 35 20 30 20 30 20 30 20 31 32 20 31 32 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 30 20 31 2e 35 7a 22 7d 29 29 7d 3b 76 61 72 20 75 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 76 67 22 2c 7b 78 6d 6c 6e 73 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 2c 76 69 65 77 42 6f 78 3a 22 30 20 30 20 32 34 20 32 Data Ascii: .75 4.5.74-.627H12a.75.75 0 0 0 0 1.5h1.5a.75.75 0 0 0 .74-.627l.75-4.5-.74.627h1.5a.75.75 0 0 0 .75-.75v-.75A4.5 4.5 0 0 0 12 12a.75.75 0 0 0 0 1.5z"}))};var un=function(){return i.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 2
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: 70 68 6f 74 6f 2d 6d 6f 64 61 6c 2d 67 72 69 64 2d 69 6d 61 67 65 22 2c 50 69 3d 22 62 68 2d 70 68 6f 74 6f 2d 67 72 69 64 2d 74 68 75 6d 62 2d 6d 6f 72 65 22 2c 77 69 3d 22 62 68 2d 70 68 6f 74 6f 2d 67 72 69 64 2d 74 68 75 6d 62 2d 6d 6f 72 65 2d 69 6e 6e 65 72 22 2c 4f 69 3d 22 62 68 2d 70 68 6f 74 6f 2d 67 72 69 64 2d 74 68 75 6d 62 2d 6d 6f 72 65 2d 69 6e 6e 65 72 2d 32 22 2c 4c 69 3d 22 77 6c 2d 65 6e 74 72 79 70 6f 69 6e 74 22 2c 44 69 3d 27 66 6f 72 6d 5b 69 64 3d 22 68 70 72 74 2d 66 6f 72 6d 22 5d 27 2c 52 69 3d 22 5b 64 61 74 61 2d 63 69 74 79 2d 74 61 78 2d 76 61 6c 75 65 5d 22 2c 78 69 3d 22 5b 64 61 74 61 2d 76 61 74 2d 76 61 6c 75 65 5d 22 2c 4d 69 3d 22 5b 64 61 74 61 2d 70 61 79 6d 65 6e 74 2d 6d 65 74 68 6f 64 5d 22 3b 76 61 72 20 42 69 Data Ascii: photo-modal-grid-image",Pi="bh-photo-grid-thumb-more",wi="bh-photo-grid-thumb-more-inner",Oi="bh-photo-grid-thumb-more-inner-2",Li="wl-entrypoint",Di='form[id="hprt-form"]',Ri="[data-city-tax-value]",xi="[data-vat-value]",Mi="[data-payment-method]";var Bi
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: 64 20 30 2c 64 65 73 74 5f 6e 61 6d 65 3a 76 6f 69 64 20 30 2c 61 64 75 6c 74 73 3a 76 6f 69 64 20 30 2c 62 6f 6f 6b 5f 77 69 6e 64 6f 77 3a 76 6f 69 64 20 30 2c 63 68 69 6c 64 72 65 6e 3a 76 6f 69 64 20 30 2c 63 69 74 79 5f 6e 61 6d 65 3a 76 6f 69 64 20 30 2c 63 6f 75 6e 74 72 79 5f 6e 61 6d 65 3a 76 6f 69 64 20 30 2c 64 61 74 65 5f 69 6e 3a 76 6f 69 64 20 30 2c 64 61 74 65 5f 6f 75 74 3a 76 6f 69 64 20 30 2c 64 65 73 74 5f 63 63 3a 76 6f 69 64 20 30 2c 64 65 73 74 5f 75 66 69 3a 76 6f 69 64 20 30 2c 6e 69 67 68 74 73 3a 76 6f 69 64 20 30 2c 72 6f 6f 6d 73 3a 76 6f 69 64 20 30 2c 74 72 61 76 65 6c 6c 69 6e 67 5f 66 6f 72 5f 77 6f 72 6b 3a 76 6f 69 64 20 30 2c 74 6f 74 61 6c 5f 73 65 61 72 63 68 5f 70 61 67 65 73 3a 76 6f 69 64 20 30 2c 70 65 72 63 65 6e Data Ascii: d 0,dest_name:void 0,adults:void 0,book_window:void 0,children:void 0,city_name:void 0,country_name:void 0,date_in:void 0,date_out:void 0,dest_cc:void 0,dest_ufi:void 0,nights:void 0,rooms:void 0,travelling_for_work:void 0,total_search_pages:void 0,percen
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: 65 6e 74 4c 69 73 74 65 6e 65 72 28 74 2c 69 29 7d 63 61 74 63 68 28 72 29 7b 4e 69 28 72 2e 74 6f 53 74 72 69 6e 67 28 29 29 2c 4e 69 28 57 6e 29 7d 65 6c 73 65 20 4e 69 28 53 74 29 7d 65 6c 73 65 20 4e 69 28 60 24 7b 7a 6e 7d 3a 20 68 61 6e 64 6c 65 72 20 66 75 6e 63 60 29 3b 65 6c 73 65 20 4e 69 28 60 24 7b 7a 6e 7d 3a 20 68 61 6e 64 6c 65 72 20 66 75 6e 63 20 74 79 70 65 60 29 3b 65 6c 73 65 20 4e 69 28 60 24 7b 7a 6e 7d 3a 20 65 6c 65 6d 65 6e 74 20 69 64 65 6e 74 69 66 69 65 72 60 29 3b 65 6c 73 65 20 4e 69 28 60 24 7b 7a 6e 7d 3a 20 65 6c 65 6d 65 6e 74 20 69 64 65 6e 74 69 66 69 65 72 20 74 79 70 65 60 29 3b 65 6c 73 65 20 4e 69 28 59 6e 29 7d 66 75 6e 63 74 69 6f 6e 20 54 72 28 29 7b 50 61 28 29 3d 3d 3d 73 61 2e 53 45 41 52 43 48 3f 46 72 28 62 Data Ascii: entListener(t,i)}catch(r){Ni(r.toString()),Ni(Wn)}else Ni(St)}else Ni(`${zn}: handler func`);else Ni(`${zn}: handler func type`);else Ni(`${zn}: element identifier`);else Ni(`${zn}: element identifier type`);else Ni(Yn)}function Tr(){Pa()===sa.SEARCH?Fr(b
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: 43 22 3d 3d 3d 73 3f 7b 66 6f 6e 74 53 74 79 6c 65 3a 22 69 74 61 6c 69 63 22 7d 3a 7b 7d 29 2c 22 42 4f 4c 44 22 3d 3d 3d 73 3f 7b 66 6f 6e 74 57 65 69 67 68 74 3a 22 62 6f 6c 64 22 7d 3a 7b 7d 29 7d 29 2c 5b 6f 2c 64 2c 73 5d 29 2c 6d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 6e 2c 74 2c 69 2c 61 3d 28 30 2c 53 2e 75 73 65 56 69 65 77 70 6f 72 74 29 28 29 2c 72 3d 61 2e 69 73 53 6d 61 6c 6c 2c 6c 3d 61 2e 69 73 4d 65 64 69 75 6d 2c 6f 3d 61 2e 69 73 4c 61 72 67 65 3b 72 65 74 75 72 6e 20 72 3f 65 2e 73 6d 61 6c 6c 3a 6c 3f 6e 75 6c 6c 21 3d 3d 28 6e 3d 65 2e 6d 65 64 69 75 6d 29 26 26 76 6f 69 64 20 30 21 3d 3d 6e 3f 6e 3a 65 2e 73 6d 61 6c 6c 3a 6f 26 26 6e 75 6c 6c 21 3d 3d 28 69 3d 6e 75 6c 6c 21 3d 3d 28 74 3d 65 2e 6c 61 72 67 65 29 26 26 Data Ascii: C"===s?{fontStyle:"italic"}:{}),"BOLD"===s?{fontWeight:"bold"}:{})}),[o,d,s]),m=function(e){var n,t,i,a=(0,S.useViewport)(),r=a.isSmall,l=a.isMedium,o=a.isLarge;return r?e.small:l?null!==(n=e.medium)&&void 0!==n?n:e.small:o&&null!==(i=null!==(t=e.large)&&
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: 75 72 20 6c 61 6e 67 75 61 67 65 22 2c 65 2e 4c 6f 67 6f 3d 22 4c 6f 67 6f 22 2c 65 2e 43 53 3d 22 43 6f 6e 74 61 63 74 20 43 75 73 74 6f 6d 65 72 20 53 65 72 76 69 63 65 22 2c 65 2e 4d 45 53 53 41 47 49 4e 47 3d 22 4f 70 65 6e 20 4d 65 73 73 61 67 69 6e 67 22 2c 65 2e 50 72 6f 66 69 6c 65 3d 22 50 72 6f 66 69 6c 65 20 4d 65 6e 75 22 2c 65 2e 53 6f 63 69 61 6c 3d 22 46 6f 6c 6c 6f 77 20 55 73 20 6f 6e 20 57 65 63 68 61 74 22 2c 65 2e 4c 69 73 74 50 72 6f 70 65 72 74 79 3d 22 4c 69 73 74 20 59 6f 75 72 20 50 72 6f 70 65 72 74 79 22 2c 65 2e 4e 6f 74 69 66 69 63 61 74 69 6f 6e 3d 22 4e 6f 74 69 66 69 63 61 74 69 6f 6e 22 2c 65 2e 53 69 67 6e 49 6e 3d 22 53 69 67 6e 20 49 6e 22 2c 65 2e 53 69 67 6e 55 70 3d 22 53 69 67 6e 20 55 70 22 2c 65 7d 28 7b 7d 29 2c Data Ascii: ur language",e.Logo="Logo",e.CS="Contact Customer Service",e.MESSAGING="Open Messaging",e.Profile="Profile Menu",e.Social="Follow Us on Wechat",e.ListProperty="List Your Property",e.Notification="Notification",e.SignIn="Sign In",e.SignUp="Sign Up",e}({}),

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49789	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	593	OUT	GET /psb/capla/static/js/remoteEntry.f0866eea.client.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:38 UTC	685	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 19965 Connection: close Last-Modified: Thu, 14 Dec 2023 12:49:05 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 0Gkt0CnTnvxOJEfeuYQEpbPR8W9fMbME Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 18:35:38 GMT ETag: "d78c34e2dbec204465921f484c1997f8" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 d48a409d6a3222e2cc9a060d30206d3c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 5cdgd8fpouUEBAebBrXgLFK9yCtzRjhuRCcuh_BG-XHIMgGPklsiBQ== Age: 8891 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:38 UTC	15699	IN	Data Raw: 76 61 72 20 62 57 65 62 63 6f 72 65 50 65 72 73 6f 6e 61 6c 69 73 61 74 69 6f 6e 43 6f 6d 70 6f 6e 65 6e 74 53 65 72 76 69 63 65 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 7b 63 63 34 63 33 37 34 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 76 61 72 20 72 3d 7b 22 2e 2f 48 6f 6d 65 73 47 75 65 73 74 73 4c 6f 76 65 43 61 72 6f 75 73 65 6c 22 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 65 28 22 62 66 39 65 62 37 61 33 22 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 28 22 33 30 30 65 37 66 64 63 22 29 7d 7d 29 29 7d 2c 22 2e 2f 52 65 63 65 6e 74 6c 79 56 69 65 77 65 64 50 72 6f 70 65 72 74 Data Ascii: var bWebcorePersonalisationComponentService;!function(){"use strict";var e={cc4c374e:function(e,n,t){var r={"./HomesGuestsLoveCarousel":function(){return t.e("bf9eb7a3").then((function(){return function(){return t("300e7fdc")}}))},"./RecentlyViewedPropert
2024-02-08 18:35:38 UTC	4266	IN	Data Raw: 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 65 28 22 63 63 34 30 32 30 64 39 22 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 28 22 39 64 35 39 66 31 65 66 22 29 7d 7d 29 29 7d 29 29 7d 2c 63 65 64 63 61 62 66 39 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 64 28 22 64 65 66 61 75 6c 74 22 2c 22 40 61 70 6f 6c 6c 6f 2f 63 6c 69 65 6e 74 22 2c 5b 2c 5b 34 2c 30 2c 30 2c 30 5d 2c 30 2c 5b 30 2c 30 2c 30 2c 30 5d 2c 32 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 65 28 22 38 33 31 35 32 63 38 39 22 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 28 Data Ascii: ion(){return t.e("cc4020d9").then((function(){return function(){return t("9d59f1ef")}}))}))},cedcabf9:function(){return d("default","@apollo/client",[,[4,0,0,0],0,[0,0,0,0],2],(function(){return t.e("83152c89").then((function(){return function(){return t(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49785	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	593	OUT	GET /psb/capla/static/js/remoteEntry.aaaa260d.client.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:38 UTC	685	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 17086 Connection: close Date: Thu, 08 Feb 2024 15:50:18 GMT Last-Modified: Mon, 05 Feb 2024 14:27:21 GMT ETag: "fae183a6686e6cb57c05a81d2c6fce0c" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: jLSOnuzFZcI2GjSNJNE9QuAjvfis491G Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 f588325f7617672d954c4267c8bee1ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: IatuSNLCk8yB4AhIVwjD_CgIAOaoxk7_yKgyIEwgXsP2aAjXd0LVLA== Age: 9921 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:38 UTC	15699	IN	Data Raw: 76 61 72 20 62 4e 61 74 69 76 65 44 69 73 70 6c 61 79 41 64 73 4e 64 69 73 70 6c 61 79 41 64 43 6f 6d 70 6f 6e 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 7b 22 35 39 62 34 65 65 30 36 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 76 61 72 20 72 3d 7b 22 2e 2f 49 6e 64 65 78 50 72 69 6d 61 72 79 41 64 22 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 65 28 22 31 38 63 61 64 39 35 37 22 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 28 22 65 32 39 31 32 65 64 61 22 29 7d 7d 29 29 7d 2c 22 2e 2f 49 6e 64 65 78 53 65 63 6f 6e 64 61 72 79 41 64 22 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 Data Ascii: var bNativeDisplayAdsNdisplayAdComponent;!function(){"use strict";var e={"59b4ee06":function(e,n,t){var r={"./IndexPrimaryAd":function(){return t.e("18cad957").then((function(){return function(){return t("e2912eda")}}))},"./IndexSecondaryAd":function(){re
2024-02-08 18:35:38 UTC	1387	IN	Data Raw: 28 69 29 7d 7d 2c 63 2e 68 72 65 66 3d 6e 2c 74 3f 74 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 63 2c 74 2e 6e 65 78 74 53 69 62 6c 69 6e 67 29 3a 64 6f 63 75 6d 65 6e 74 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 63 29 7d 28 65 2c 63 2c 6e 75 6c 6c 2c 6e 2c 72 29 7d 29 29 7d 2c 6e 3d 7b 22 36 31 32 32 65 61 31 38 22 3a 30 7d 3b 74 2e 66 2e 6d 69 6e 69 43 73 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 6e 5b 74 5d 3f 72 2e 70 75 73 68 28 6e 5b 74 5d 29 3a 30 21 3d 3d 6e 5b 74 5d 26 26 7b 22 31 38 63 61 64 39 35 37 22 3a 31 2c 22 38 30 36 37 64 37 65 34 22 3a 31 2c 61 63 64 63 63 61 61 63 3a 31 7d 5b 74 5d 26 26 72 2e 70 75 73 68 28 6e 5b 74 5d 3d 65 28 74 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: (i)}},c.href=n,t?t.parentNode.insertBefore(c,t.nextSibling):document.head.appendChild(c)}(e,c,null,n,r)}))},n={"6122ea18":0};t.f.miniCss=function(t,r){n[t]?r.push(n[t]):0!==n[t]&&{"18cad957":1,"8067d7e4":1,acdccaac:1}[t]&&r.push(n[t]=e(t).then((function()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49784	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	610	OUT	GET /static/css/fonticons_clean/base64/woff/5d61b8a7156073e5e3e9741f65dda44ae3eef7d2.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:38 UTC	795	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 226735 Connection: close Server: nginx Date: Thu, 01 Feb 2024 17:28:24 GMT Last-Modified: Wed, 10 Apr 2019 11:21:48 GMT ETag: "5cadd1cc-375af" Expires: Sat, 02 Mar 2024 17:28:24 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 086e2cd5d94fa729de58c51b5666e0e4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: XqX-8Gt7DUaOfiMMSdtOcxO5MR5ryYyUcCPITQGcarrfzYG99eIkUQ== Age: 608834
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 62 6f 6f 6b 69 6e 67 2d 69 63 6f 6e 73 65 74 27 3b 0a 20 20 20 20 73 72 63 3a 20 75 72 6c 28 64 61 74 61 3a 61 70 70 6c 69 63 61 74 69 6f 6e 2f 66 6f 6e 74 2d 77 6f 66 66 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3b 62 61 73 65 36 34 2c 64 30 39 47 52 67 41 42 41 41 41 41 41 70 65 34 41 41 77 41 41 41 41 43 6c 32 67 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 42 48 55 31 56 43 41 41 41 42 48 41 41 41 4b 4e 77 41 41 43 6a 63 4e 51 77 38 53 55 39 54 4c 7a 49 41 41 43 6e 34 41 41 41 41 59 41 41 41 41 47 41 50 45 67 65 37 59 32 31 68 63 41 41 41 4b 6c 67 41 41 41 48 4d 41 41 41 42 7a 4e 66 46 48 6c 68 6e 59 58 4e 77 41 Data Ascii: @font-face { font-family: 'booking-iconset'; src: url(data:application/font-woff;charset=utf-8;base64,d09GRgABAAAAApe4AAwAAAACl2gAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAABHU1VCAAABHAAAKNwAACjcNQw8SU9TLzIAACn4AAAAYAAAAGAPEge7Y21hcAAAKlgAAAHMAAABzNfFHlhnYXNwA
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: 34 42 42 77 34 42 46 79 4d 2b 41 54 63 2b 41 54 63 2b 41 54 63 2b 41 54 4d 79 46 68 63 65 41 52 63 65 41 52 63 65 41 52 55 55 42 67 63 4f 41 51 63 56 48 67 45 58 48 67 45 56 46 41 59 45 31 77 39 46 4a 50 78 53 4a 45 55 50 44 52 51 50 42 77 63 50 46 41 30 50 52 53 51 42 57 41 4a 57 4a 45 55 50 44 52 51 50 42 77 63 50 46 41 33 39 53 31 6c 57 58 49 56 36 58 6b 6c 4e 57 6e 69 48 58 51 47 33 42 78 49 4d 44 42 6f 51 44 79 41 52 46 53 51 51 44 78 6f 4b 43 78 41 46 42 51 59 42 54 67 45 4c 43 77 77 69 46 78 4d 68 44 51 30 4e 42 67 55 47 44 67 6b 49 46 41 73 4c 46 77 77 4b 45 77 6b 4b 45 51 63 49 44 41 55 45 42 51 73 4b 43 68 73 51 43 68 49 49 42 77 30 45 42 51 67 43 41 77 49 42 54 67 45 47 42 67 59 51 43 67 6f 59 44 67 38 67 45 67 34 62 44 67 30 59 43 77 73 52 42 Data Ascii: 4BBw4BFyM+ATc+ATc+ATc+ATMyFhceARceARceARUUBgcOAQcVHgEXHgEVFAYE1w9FJPxSJEUPDRQPBwcPFA0PRSQBWAJWJEUPDRQPBwcPFA39S1lWXIV6XklNWniHXQG3BxIMDBoQDyARFSQQDxoKCxAFBQYBTgELCwwiFxMhDQ0NBgUGDgkIFAsLFwwKEwkKEQcIDAUEBQsKChsQChIIBw0EBQgCAwIBTgEGBgYQCgoYDg8gEg4bDg0YCwsRB
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: 6f 53 4b 52 67 42 49 79 73 72 4c 6a 41 59 4c 78 67 44 4d 67 73 4c 4e 43 6f 70 44 67 63 57 4a 78 49 43 54 67 38 51 4a 68 41 51 47 2f 45 6d 61 58 56 33 4e 44 51 2b 45 68 6f 6d 4a 57 70 31 64 7a 51 7a 50 78 49 62 2f 72 67 77 54 7a 51 58 43 51 67 7a 53 6c 73 78 4d 45 38 30 46 77 67 4a 4d 30 70 62 4d 51 46 59 4d 52 73 32 47 77 67 74 43 51 73 30 4b 69 6f 4f 43 42 55 6d 45 51 6c 45 44 52 41 6e 45 42 41 61 50 41 4d 42 41 77 45 34 43 77 73 43 45 78 4d 7a 54 67 38 6d 46 51 49 69 4b 69 73 75 4d 77 45 5a 4e 42 6b 32 43 77 77 30 4b 53 6f 4e 43 42 63 71 45 77 4e 4b 44 78 41 6d 44 78 41 62 50 67 49 42 41 77 51 31 43 67 73 44 45 78 49 7a 54 68 45 6e 46 67 55 42 41 53 4d 72 4b 79 31 4a 4e 44 38 53 47 79 55 6d 61 58 56 33 4e 44 51 2b 45 78 73 6d 4a 57 6c 31 65 41 46 73 43 Data Ascii: oSKRgBIysrLjAYLxgDMgsLNCopDgcWJxICTg8QJhAQG/EmaXV3NDQ+EhomJWp1dzQzPxIb/rgwTzQXCQgzSlsxME80FwgJM0pbMQFYMRs2GwgtCQs0KioOCBUmEQlEDRAnEBAaPAMBAwE4CwsCExMzTg8mFQIiKisuMwEZNBk2Cww0KSoNCBcqEwNKDxAmDxAbPgIBAwQ1CgsDExIzThEnFgUBASMrKy1JND8SGyUmaXV3NDQ+ExsmJWl1eAFsC
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: 49 4d 45 44 39 49 53 42 6f 51 4a 42 55 65 53 69 73 56 4a 42 41 5a 53 55 67 2f 45 51 7a 39 48 6a 49 44 43 68 41 58 45 43 77 77 46 67 51 42 51 77 4d 49 42 51 4d 48 41 30 5a 47 48 41 45 4e 43 41 6b 4c 41 52 70 41 51 41 59 42 31 42 41 58 45 51 6b 44 4e 41 51 58 4d 43 30 42 4c 55 6c 58 4c 77 34 42 43 51 5a 78 42 67 6b 4a 42 6e 45 47 43 51 4e 52 67 77 59 59 43 42 48 2b 39 51 6b 47 43 67 63 4a 43 51 63 4b 42 67 6b 44 58 78 30 69 49 68 31 48 65 31 52 76 52 43 41 47 46 43 4d 4f 44 77 63 58 44 53 4d 54 42 69 46 45 62 31 52 37 42 53 4a 4c 55 46 41 6e 47 32 64 6d 54 50 35 4c 42 41 4d 44 41 6a 36 71 6e 58 45 46 43 51 73 42 44 51 67 43 61 5a 57 68 4f 51 59 52 65 79 5a 52 54 30 77 69 54 57 5a 6e 47 67 41 41 42 51 41 4b 2f 38 41 46 46 67 50 41 41 42 6b 41 4c 67 41 36 41 Data Ascii: IMED9ISBoQJBUeSisVJBAZSUg/EQz9HjIDChAXECwwFgQBQwMIBQMHA0ZGHAENCAkLARpAQAYB1BAXEQkDNAQXMC0BLUlXLw4BCQZxBgkJBnEGCQNRgwYYCBH+9QkGCgcJCQcKBgkDXx0iIh1He1RvRCAGFCMODwcXDSMTBiFEb1R7BSJLUFAnG2dmTP5LBAMDAj6qnXEFCQsBDQgCaZWhOQYReyZRT0wiTWZnGgAABQAK/8AFFgPAABkALgA6A
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: 34 43 50 77 45 2b 41 54 63 2b 41 54 63 2b 41 54 55 32 4e 44 63 31 4e 44 59 31 4e 43 59 6e 41 51 34 42 49 79 49 75 41 69 63 75 41 53 63 75 41 54 55 30 4e 6a 38 42 4e 44 59 33 50 67 45 2f 41 52 63 78 46 77 45 33 42 78 51 47 46 51 34 42 44 77 45 42 4e 7a 34 42 4d 7a 49 65 41 68 63 65 41 52 63 65 41 52 55 55 42 67 63 6e 49 78 63 7a 4d 6a 59 39 41 54 51 6d 49 79 45 69 42 68 30 42 46 42 59 7a 49 53 63 6a 41 7a 6b 42 41 51 55 49 41 52 35 7a 56 53 59 4a 42 67 51 46 41 67 4d 43 4b 57 68 61 49 77 49 42 43 51 59 42 4d 67 45 42 42 67 63 42 41 69 70 6f 58 53 51 4a 42 77 59 4a 4b 32 78 56 4a 77 49 49 42 77 59 44 42 51 63 48 42 51 4d 46 42 77 63 73 42 41 51 48 42 77 51 45 42 51 63 48 73 41 51 58 58 34 4f 66 56 6c 61 66 67 6d 41 58 41 77 4d 45 41 67 49 42 41 51 45 42 41 Data Ascii: 4CPwE+ATc+ATc+ATU2NDc1NDY1NCYnAQ4BIyIuAicuAScuATU0Nj8BNDY3PgE/ARcxFwE3BxQGFQ4BDwEBNz4BMzIeAhceARceARUUBgcnIxczMjY9ATQmIyEiBh0BFBYzIScjAzkBAQUIAR5zVSYJBgQFAgMCKWhaIwIBCQYBMgEBBgcBAipoXSQJBwYJK2xVJwIIBwYDBQcHBQMFBwcsBAQHBwQEBQcHsAQXX4OfVlafgmAXAwMEAgIBAQEBA
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: 38 2f 4c 41 4d 71 4c 44 39 56 41 77 67 49 41 77 4d 49 43 41 50 38 67 43 55 62 47 69 59 6d 47 68 73 6c 71 67 4b 41 2f 59 41 41 41 67 41 46 2f 38 41 43 65 77 50 41 41 42 4d 41 48 77 41 41 41 54 51 75 41 69 4d 69 44 67 49 56 46 42 59 58 4d 51 6b 42 4d 54 34 42 42 53 49 6d 4e 54 51 32 4d 7a 49 57 46 52 51 47 41 6e 73 78 56 6e 4e 42 51 58 4e 57 4d 52 59 55 41 52 45 42 45 52 51 57 2f 73 56 42 58 56 31 42 51 56 31 64 41 6f 56 42 63 31 55 79 4d 6c 56 7a 51 53 74 51 49 2f 33 5a 41 69 63 6a 55 48 4e 64 51 55 46 63 58 45 46 42 58 51 41 41 41 41 41 44 41 41 48 2f 77 41 4f 6f 41 38 41 41 4f 41 42 45 41 46 67 41 41 41 45 6e 4c 67 45 6a 49 67 59 50 41 51 34 42 46 78 4d 65 41 54 73 42 45 52 63 7a 4e 7a 55 6a 4e 54 4d 31 49 7a 55 7a 4e 53 4d 31 4d 7a 55 6a 4e 54 4d 31 49 Data Ascii: 8/LAMqLD9VAwgIAwMICAP8gCUbGiYmGhslqgKA/YAAAgAF/8ACewPAABMAHwAAATQuAiMiDgIVFBYXMQkBMT4BBSImNTQ2MzIWFRQGAnsxVnNBQXNWMRYUAREBERQW/sVBXV1BQV1dAoVBc1UyMlVzQStQI/3ZAicjUHNdQUFcXEFBXQAAAAADAAH/wAOoA8AAOABEAFgAAAEnLgEjIgYPAQ4BFxMeATsBERczNzUjNTM1IzUzNSM1MzUjNTM1I
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: 49 5a 47 42 49 43 41 67 49 74 55 44 73 6a 49 7a 74 51 4c 51 49 43 41 52 45 59 41 71 51 36 4b 66 7a 47 4b 54 6f 36 4b 51 4d 36 4b 54 70 64 4b 42 77 63 4b 43 67 63 48 43 68 45 48 43 67 6f 48 42 77 6f 4b 42 7a 39 47 69 70 4a 59 6a 67 34 59 55 6b 72 4b 30 6c 68 4f 44 68 69 53 53 6f 41 41 41 59 41 41 50 2f 41 41 32 41 44 77 41 41 77 41 47 49 41 6c 41 43 76 41 4d 41 41 39 41 41 41 41 53 34 42 4a 79 34 42 4e 54 77 42 4d 54 41 47 4d 54 41 30 4d 54 41 55 46 51 34 42 42 77 34 42 42 77 59 57 46 78 34 42 4e 7a 34 42 4e 77 34 42 42 7a 4d 75 41 53 63 65 41 52 63 57 4e 6a 63 2b 41 51 45 75 41 53 63 75 41 53 63 30 4d 44 45 34 41 54 45 34 41 54 45 34 41 52 55 55 42 67 63 4f 41 51 63 47 46 68 63 57 4d 6a 63 30 4e 6a 63 4f 41 51 63 7a 4c 67 45 6e 48 67 45 58 46 6a 49 33 50 Data Ascii: IZGBICAgItUDsjIztQLQICAREYAqQ6KfzGKTo6KQM6KTpdKBwcKCgcHChEHCgoHBwoKBz9GipJYjg4YUkrK0lhODhiSSoAAAYAAP/AA2ADwAAwAGIAlACvAMAA9AAAAS4BJy4BNTwBMTAGMTA0MTAUFQ4BBw4BBwYWFx4BNz4BNw4BBzMuASceARcWNjc+AQEuAScuASc0MDE4ATE4ATE4ARUUBgcOAQcGFhcWMjc0NjcOAQczLgEnHgEXFjI3P
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: 59 67 4c 57 44 38 77 43 67 34 4f 43 67 44 51 43 67 34 4f 41 48 38 62 67 4f 53 44 53 41 74 4c 53 41 67 4c 69 34 67 41 37 4d 34 4b 50 31 2f 4b 44 67 34 4b 41 4b 42 4b 44 6a 39 48 67 4a 41 41 41 49 41 41 2f 2f 41 43 4e 34 44 77 41 41 70 41 44 67 41 41 41 45 44 44 67 45 6a 49 53 49 6d 4a 77 4d 6d 4e 6a 63 2b 41 7a 63 2b 41 54 4d 36 41 7a 45 77 4f 67 49 7a 4d 68 59 58 48 67 4d 58 48 67 45 48 4a 51 4d 68 41 79 45 79 46 68 38 42 49 54 63 2b 41 54 4d 68 43 4e 35 41 43 6c 4d 77 2b 4c 38 77 55 77 70 41 43 69 63 73 45 46 68 72 62 43 51 59 51 42 38 52 75 39 53 72 71 74 53 38 45 53 49 38 47 43 52 74 62 46 6f 52 4b 53 6b 4f 2f 76 50 6f 2b 77 2f 6f 41 5a 55 48 45 51 4e 62 41 71 74 62 41 78 45 48 41 5a 55 42 68 2f 36 69 4c 54 77 38 4c 51 46 65 4c 45 77 73 45 31 68 71 61 Data Ascii: YgLWD8wCg4OCgDQCg4OAH8bgOSDSAtLSAgLi4gA7M4KP1/KDg4KAKBKDj9HgJAAAIAA//ACN4DwAApADgAAAEDDgEjISImJwMmNjc+Azc+ATM6AzEwOgIzMhYXHgMXHgEHJQMhAyEyFh8BITc+ATMhCN5AClMw+L8wUwpACicsEFhrbCQYQB8Ru9SrqtS8ESI8GCRtbFoRKSkO/vPo+w/oAZUHEQNbAqtbAxEHAZUBh/6iLTw8LQFeLEwsE1hqa
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: 4d 41 74 41 46 6f 41 57 63 42 61 4c 52 52 6f 71 4b 69 55 67 6b 4e 46 79 64 48 42 44 56 70 61 47 6b 30 42 54 59 31 47 77 73 4b 55 61 47 6a 70 46 4d 46 55 61 48 2b 77 50 37 41 2f 73 47 68 6f 51 46 41 41 55 41 42 51 4b 42 64 62 64 72 59 32 47 78 73 31 39 66 5a 62 52 6b 59 42 77 73 6c 4f 43 34 30 42 77 4d 59 47 51 4d 54 57 4c 43 76 72 6c 68 59 73 4b 36 76 41 41 41 41 41 51 41 41 2f 38 4d 44 2f 51 50 41 41 43 59 41 41 41 45 52 46 41 59 72 41 52 45 7a 4e 53 4d 31 4e 44 59 37 41 54 55 6a 49 67 34 43 48 51 45 6a 46 54 4d 52 49 53 49 6d 4e 52 45 30 4e 6a 4d 68 4d 68 59 56 41 2f 31 4b 4e 73 43 48 68 77 30 55 5a 6e 49 73 53 7a 67 67 65 33 76 2b 66 54 56 4c 53 7a 55 43 2f 54 5a 4b 41 30 4c 39 41 54 52 4d 41 58 43 66 55 78 41 55 74 43 49 38 55 43 39 4f 6e 2f 36 51 54 Data Ascii: MAtAFoAWcBaLRRoqKiUgkNFydHBDVpaGk0BTY1GwsKUaGjpFMFUaH+wP7A/sGhoQFAAUABQKBdbdrY2Gxs19fZbRkYBwslOC40BwMYGQMTWLCvrlhYsK6vAAAAAQAA/8MD/QPAACYAAAERFAYrAREzNSM1NDY7ATUjIg4CHQEjFTMRISImNRE0NjMhMhYVA/1KNsCHhw0UZnIsSzgge3v+fTVLSzUC/TZKA0L9ATRMAXCfUxAUtCI8UC9On/6QT
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: 34 65 4b 79 73 65 48 69 76 62 4b 68 34 66 4b 69 6f 66 48 69 72 63 4b 78 34 65 4b 79 73 65 48 69 73 44 74 78 34 72 4b 78 34 65 4b 79 73 65 32 78 34 71 4b 68 34 66 4b 69 6f 66 41 41 41 41 41 41 45 41 41 50 2b 36 42 6d 30 44 75 67 41 46 41 41 41 58 43 51 45 33 43 51 48 4b 41 6d 77 43 62 63 72 38 79 66 7a 4b 52 67 4a 77 2f 5a 44 4a 41 7a 66 38 79 51 41 42 41 41 44 2f 75 67 5a 74 41 37 6f 41 42 51 41 41 43 51 49 48 43 51 45 46 6f 2f 32 54 2f 5a 54 4b 41 7a 59 44 4e 77 4f 36 2f 5a 41 43 63 4d 72 38 79 67 4d 32 41 41 41 41 41 41 67 41 41 50 2f 47 41 2f 30 44 77 41 41 59 41 43 45 41 4e 51 41 2f 41 46 51 41 58 51 42 37 41 49 38 41 41 43 55 6a 49 67 59 64 41 53 4d 69 42 68 55 55 46 6a 73 42 46 52 51 57 4f 77 45 79 4e 6a 30 42 4e 43 59 46 49 52 55 68 4d 6a 59 31 4e Data Ascii: 4eKyseHivbKh4fKiofHircKx4eKyseHisDtx4rKx4eKyse2x4qKh4fKiofAAAAAAEAAP+6Bm0DugAFAAAXCQE3CQHKAmwCbcr8yfzKRgJw/ZDJAzf8yQABAAD/ugZtA7oABQAACQIHCQEFo/2T/ZTKAzYDNwO6/ZACcMr8ygM2AAAAAAgAAP/GA/0DwAAYACEANQA/AFQAXQB7AI8AACUjIgYdASMiBhUUFjsBFRQWOwEyNj0BNCYFIRUhMjY1N

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49797	18.64.236.43	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	420	OUT	GET /static/img/tfl/group_logos/logo_agoda/1c9191b6a3651bf030e41e99a153b64f449845ed.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:38 UTC	769	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 2146 Connection: close Server: nginx Date: Sun, 28 Jan 2024 18:31:28 GMT Last-Modified: Thu, 12 Mar 2020 10:15:57 GMT Expires: Tue, 27 Feb 2024 18:31:28 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "5e6a0bdd-862" X-Cache: Hit from cloudfront Via: 1.1 711d3c800952edc1dd6cabc0c877aa5a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: Mnn2oj5y9dDXQFD-tUMOXHP-YOlLEqGLRCf6nc1-ushw4kIYzKr6aQ== Age: 950650
2024-02-08 18:35:38 UTC	2146	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 46 00 00 00 1a 08 06 00 00 00 0a 62 2a 08 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 f7 49 44 41 54 78 01 ed 59 0d 70 54 d5 15 3e f7 be f7 96 b0 09 91 90 84 1a 13 65 19 a5 ad 96 66 00 2b 28 54 c9 4c 06 04 4b 69 5a 0b f9 d9 8d 04 d3 80 60 d5 da b1 63 3b 76 20 99 b6 d8 b1 d3 b1 83 75 c4 88 4d 82 bb 9b 68 a6 94 aa 80 18 a7 a4 02 05 44 4a eb 0f 52 51 a0 0a 2d 3f 21 46 6c 42 d8 7d ef de 7e 77 cd 8b 2f 9b b7 ce db 19 98 11 c7 33 73 f7 fe 7d ef dc 73 bf 7b ee b9 f7 bd 65 74 91 4b 79 79 f9 95 ba ae af 3b 76 ec d8 cc ce ce 4e 93 ce 93 70 ba c8 85 1b c6 04 49 34 3d 10 08 e8 74 1e e5 a2 27 e6 42 Data Ascii: PNGIHDRFb*pHYssRGBgAMAaIDATxYpT>ef+(TLKiZ`c;v uMhDJRQ-?!FlB}~w/3s}s{etKyy;vNpI4=t'B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	49794	18.64.236.43	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	420	OUT	GET /static/img/tfl/group_logos/logo_kayak/83ef7122074473a6566094e957ff834badb58ce6.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:38 UTC	769	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1154 Connection: close Server: nginx Date: Sun, 28 Jan 2024 18:31:28 GMT Last-Modified: Wed, 10 Apr 2019 11:21:55 GMT Expires: Tue, 27 Feb 2024 18:31:28 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "5cadd1d3-482" X-Cache: Hit from cloudfront Via: 1.1 711d3c800952edc1dd6cabc0c877aa5a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: WsSCORKTl7JcLbTCg71pQDrP_gzku_u7ZPLZCRBvNGYALl2W7GP8CQ== Age: 950650
2024-02-08 18:35:38 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 4f 00 00 00 1a 08 06 00 00 00 f6 77 01 c2 00 00 04 49 49 44 41 54 78 01 ed 98 03 b0 ed 3a 18 85 73 6c 9f 67 db b6 79 6d df 7b 6c 6c 3d db b6 6d db b6 6d db b6 cd ef b5 b3 66 5e f6 41 b3 31 7a 68 67 fe 69 3a c9 ca ca 5a 4d fe a4 35 40 18 59 46 9a 0d c3 08 cd 0b cd 0b cd 0b cd 0b cd eb af fa c0 8b 6f b3 88 03 bc 68 55 39 ab 98 e0 c5 dd ff 42 ee 73 bd 68 f2 e2 1c df 3c b2 8c 93 bc 88 91 3d 7e 96 17 af fe 0b b9 ef f2 62 8a 17 27 18 b9 a9 0a e2 35 d0 6c 60 aa 81 56 a3 e7 e9 7a a6 a7 14 62 35 c9 9d 1c ee 45 d7 a0 8e 85 e9 c8 17 c6 8f ee 92 c1 38 85 06 f0 a8 17 10 a9 f6 a2 06 66 0a 43 5b 0e 6c 53 03 8d 7a a6 49 63 49 8b bb cd 58 ee de 72 88 3a b9 87 ea ee 2e d6 78 a7 59 dd 83 fa b8 11 f0 7d 2b 1b 68 5e 47 Data Ascii: PNGIHDROwIIDATx:slgym{ll=mmf^A1zhgi:ZM5@YFohU9Bsh<=~b'5l`Vzb5E8fC[lSzIcIXr:.xY}+h^G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49791	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	589	OUT	GET /psb/capla/static/js/18cad957.fe671709.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:38 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 35756 Connection: close Date: Thu, 08 Feb 2024 15:38:50 GMT Last-Modified: Wed, 07 Feb 2024 05:13:46 GMT ETag: "aa2bb103c873e34c4bb7315d28b65588" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: tGQahjhYS22IOhyEY_rkTqMdS5PWDiNB Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 7699e4f17e72e42cba0c247c650005d2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: SgpFhFdDZ0yi-LH-PBEkqlK9mOUYwNdWeXN922Zi7X-t7ORn0oQOSg== Age: 10609 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:38 UTC	15698	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 31 38 63 61 64 39 35 37 2e 66 65 36 37 31 37 30 39 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 6e 61 74 69 76 65 2d 64 69 73 70 6c 61 79 2d 61 64 73 2d 6e 64 69 73 70 6c 61 79 2d 61 64 2d 63 6f 6d 70 6f 6e 65 6e 74 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 6e 61 74 69 76 65 2d 64 69 73 70 6c 61 79 2d 61 64 73 2d 6e 64 69 73 70 6c 61 79 2d 61 64 2d 63 6f 6d 70 6f 6e 65 6e 74 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 31 38 63 61 64 39 Data Ascii: /! For license information please see 18cad957.fe671709.chunk.js.LICENSE.txt /(self["b-native-display-ads-ndisplay-ad-component__LOADABLE_LOADED_CHUNKS__"]=self["b-native-display-ads-ndisplay-ad-component__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["18cad9
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: 60 6e 64 69 73 70 6c 61 79 5f 61 64 5f 69 64 3d 24 7b 74 7d 60 2c 60 61 66 66 69 6c 69 61 74 65 5f 69 64 3d 24 7b 69 7d 60 2c 60 72 65 6e 64 65 72 65 64 5f 61 64 5f 70 61 67 65 76 69 65 77 5f 69 64 3d 24 7b 61 7d 60 2c 60 72 65 6e 64 65 72 65 64 5f 61 64 5f 73 69 74 65 74 79 70 65 3d 24 7b 63 7d 60 2c 60 72 65 6e 64 65 72 65 64 5f 61 64 5f 76 65 72 74 69 63 61 6c 3d 24 7b 6e 7d 60 2c 60 72 65 6e 64 65 72 65 64 5f 61 64 5f 70 6f 73 69 74 69 6f 6e 3d 24 7b 28 30 2c 68 2e 41 29 28 72 29 7d 60 2c 60 72 65 6e 64 65 72 65 64 5f 61 64 5f 70 61 67 65 6e 61 6d 65 3d 24 7b 6f 7d 60 2c 22 75 72 6c 3d 22 5d 2e 6a 6f 69 6e 28 22 26 22 29 3b 72 65 74 75 72 6e 60 24 7b 79 2e 4c 6f 7d 3f 24 7b 73 7d 60 7d 3b 76 61 72 20 53 3d 28 65 2c 74 29 3d 3e 7b 63 6c 61 73 73 20 6e Data Ascii: `ndisplay_ad_id=${t}`,`affiliate_id=${i}`,`rendered_ad_pageview_id=${a}`,`rendered_ad_sitetype=${c}`,`rendered_ad_vertical=${n}`,`rendered_ad_position=${(0,h.A)(r)}`,`rendered_ad_pagename=${o}`,"url="].join("&");return`${y.Lo}?${s}`};var S=(e,t)=>{class n
2024-02-08 18:35:38 UTC	3096	IN	Data Raw: 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 2e 63 61 6c 6c 28 65 29 7d 7d 2c 64 66 62 62 38 37 61 31 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 65 28 74 28 6e 29 29 7d 7d 7d 2c 22 37 35 34 65 35 33 65 65 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 6e 28 22 66 64 34 36 38 63 64 63 22 29 2c 61 3d 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 26 26 73 65 6c 66 2e 4f 62 6a 65 63 74 3d 3d 3d 4f 62 6a 65 63 74 26 26 73 65 6c 66 2c 6f 3d 72 7c 7c 61 7c 7c 46 75 6e 63 74 69 6f 6e 28 22 72 65 74 75 72 6e 20 74 68 69 73 Data Ascii: exports=function(e){return t.call(e)}},dfbb87a1:function(e){e.exports=function(e,t){return function(n){return e(t(n))}}},"754e53ee":function(e,t,n){var r=n("fd468cdc"),a="object"==typeof self&&self&&self.Object===Object&&self,o=r\|\|a\|\|Function("return this
2024-02-08 18:35:38 UTC	578	IN	Data Raw: 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 72 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 74 20 69 6e 20 65 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 7b 76 61 6c 75 65 3a 6e 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 65 5b 74 5d 3d 6e 2c 65 7d 6e 2e 64 28 74 2c 7b 5a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 7d 29 7d 2c 22 33 64 30 35 34 65 38 31 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 72 28 29 7b 72 65 74 75 72 6e 20 72 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 3f 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 2e 62 69 6e Data Ascii: strict";function r(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}n.d(t,{Z:function(){return r}})},"3d054e81":function(e,t,n){"use strict";function r(){return r=Object.assign?Object.assign.bin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49796	18.64.236.43	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	425	OUT	GET /static/img/tfl/group_logos/logo_rentalcars/6bc5ec89d870111592a378bbe7a2086f0b01abc4.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:38 UTC	769	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 3221 Connection: close Server: nginx Date: Sun, 28 Jan 2024 18:03:21 GMT Last-Modified: Wed, 10 Apr 2019 11:21:55 GMT Expires: Tue, 27 Feb 2024 18:03:21 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "5cadd1d3-c95" X-Cache: Hit from cloudfront Via: 1.1 b340a44dae03e8ff13e054502e49abe2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: k-HTZTkLEeChgYi0S9EXfQMSDJ8gJnlUM8WsSHOHdEmbMzylb-zvsA== Age: 952336
2024-02-08 18:35:38 UTC	3221	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 6d 00 00 00 1a 08 06 00 00 00 bd df d2 2f 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 0c 4f 49 44 41 54 68 05 ed 58 09 70 55 d5 19 3e db bd f7 bd 97 97 10 96 08 28 2a 20 2e 54 dc 06 c8 c2 b8 a0 ad 56 a7 d8 ba 94 5a ac 15 6d ad 4e 6b 88 84 22 ee ed 43 45 a7 15 4d 7c 11 bb 28 2d 4b ad 1d 1d f7 3a ad 58 ad e8 08 01 8c 58 64 b1 18 50 89 28 45 08 42 c8 7b f7 de b3 f5 3b 2f 09 26 a2 33 a5 33 b5 33 ed 3b 90 f7 ce 3b e7 3f ff f9 ff ef 5f ef 25 a4 38 8a 08 14 11 28 22 50 44 a0 88 40 11 81 22 02 45 04 8a 08 fc ab 08 d0 cf 23 ac ba 37 1e 4b 19 3f 9f 51 32 d8 5a 1b 82 ee e5 3d 3b ff fe d4 ba cc b1 f1 e7 9d 29 ae 7f 31 08 7c 86 d1 2c 85 c1 6e e6 5c dc c4 93 2c a0 dd 14 1a a6 d2 52 3d 2f 55 3c b5 a5 be e4 c3 2f Data Ascii: PNGIHDRm/sRGBOIDAThXpU>(* .TVZmNk"CEM\|(-K:XXdP(EB{;/&333;;?_%8("PD@"E#7K?Q2Z=;)1\|,n\,R=/U</

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49798	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	452	OUT	GET /xdata/images/xphoto/714x300/293799350.jpeg?k=8a6f4e24c37096fbdcd3c3d30c9f3dcea15ce35751448466decf791918012a64&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:38 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sat, 27 Jan 2024 21:14:33 GMT ETag: "b14ea5c8653ac9e8b816fbb24a798227360e9785" Content-Language: 30612 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 8415794d557292780ff382a8c5bd6058.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: pRGcyO0jdp7tdCZX14I0q-AUZHDrTvhhhOuOZGXUWzVDJc8mCramXw== Age: 1027265
2024-02-08 18:35:38 UTC	15834	IN	Data Raw: 37 37 39 34 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 01 2c 02 ca 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 7794JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222,"}!1AQa"q
2024-02-08 18:35:38 UTC	14786	IN	Data Raw: 09 89 56 cf 5c e4 52 01 aa 83 18 df f8 01 4b c0 ec 49 c7 ad 4d 2c 70 06 cc 52 3b 0e fb 86 2a 78 a5 84 34 63 ec ea d8 18 39 3d 69 01 51 5b 18 ed f4 ab 29 3c c1 58 23 3e 08 c1 fa 55 bb 55 95 a5 73 05 be f3 d9 02 ee 02 a6 7b eb d0 8c 86 15 54 3c 71 08 03 f9 52 03 2f 79 e9 8c d4 a1 58 ae 70 40 3e 8b 53 33 b3 31 dc 54 36 39 e3 15 37 db 2f 1a 01 6e 66 26 21 c8 14 84 31 ad e7 89 14 bc 4e a0 f4 e2 a4 5b 69 5c 85 11 39 63 d1 42 f2 7f 0a 56 b9 9e 45 08 d2 b1 03 b1 a9 e0 96 fe 26 df 1b 48 99 e0 3f 22 90 10 fd 92 75 ce eb 79 80 1c 92 50 d7 6f a1 69 b2 58 f8 65 6f 91 71 34 d2 ef 27 b8 45 ff 00 39 ac ad 22 5d 62 f2 f1 20 96 79 16 dc 0f de b4 9c 00 9d fa d7 55 6b a9 da b3 cb 03 46 de 52 fc b1 b8 3c 1f fe b5 6b 08 f5 2a 29 5c e0 bc 4d 7f b6 e5 e4 b5 0c 93 6d 28 fb 47 0f Data Ascii: V\RKIM,pR;x4c9=iQ[)<X#>UUs{T<qR/yXp@>S31T697/nf&!1N[i\9cBVE&H?"uyPoiXeoq4'E9"]b yUkFR<k)\Mm(G
2024-02-08 18:35:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49793	18.64.236.43	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	424	OUT	GET /static/img/tfl/group_logos/logo_priceline/f80e129541f2a952d470df2447373390f3dd4e44.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:38 UTC	769	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 1591 Connection: close Server: nginx Date: Sun, 28 Jan 2024 18:31:28 GMT Last-Modified: Wed, 10 Apr 2019 11:21:55 GMT Expires: Tue, 27 Feb 2024 18:31:28 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "5cadd1d3-637" X-Cache: Hit from cloudfront Via: 1.1 2d92895b53b29a36f51f181a2ba9c2aa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: lzvr76TrRmgzZBhpI-cRCKsDoegekAPyJLV4NsMNTLgcPagmoF1FGA== Age: 950650
2024-02-08 18:35:38 UTC	1591	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 5b 00 00 00 1a 08 03 00 00 00 ef ec d0 62 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 02 2e 50 4c 54 45 ff ff ff 00 00 00 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 95 d4 00 Data Ascii: PNGIHDR[bgAMAa cHRMz&u0`:pQ<.PLTE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49799	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	451	OUT	GET /xdata/images/xphoto/500x500/184698944.png?k=6bb1bf3c13db4a7ba3c22a2d1f1051f793c525a78104703b4dec3eb12101f545&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:38 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/png Transfer-Encoding: chunked Connection: close Server: nginx Date: Sun, 21 Jan 2024 13:30:27 GMT ETag: "faf4c565c493f3bc0e80e65cd746519a6611b1b3" Content-Language: 39328 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 31113f2f23c4ce8a8af1d88a37137806.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 8AcjGV3qVtm1SwZVKd8wbcbWRSZhOPygJhfi5noElP7T-6zIMpQqmA== Age: 1573511
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: 39 39 61 30 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 f4 00 00 01 f4 08 06 00 00 00 cb d6 df 8a 00 00 80 00 49 44 41 54 78 da ec 9d 07 58 dc 56 d6 86 67 06 b7 74 a7 6c 36 75 93 4d db dd 6c fa 66 d3 7b f2 a7 6e b2 e9 71 b2 29 4e dc d2 9d 38 76 e2 6e dc 7b ef 06 83 31 cd 14 63 63 9b 6a 30 a6 83 01 37 dc 01 e3 de 0d 98 36 7d ce 7f cf 95 04 33 cc 80 c1 bd 7c ef f3 9c 47 1a e9 ea 4a 33 d2 e8 3b e7 dc ab 2b 9d 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 99a0PNGIHDRIDATxXVgtl6uMlf{nq)N8vn{1ccj076}3\|GJ3;+
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: db 74 3d 9d c7 84 9c d2 3a e1 d6 44 9b 7f 6b ee 3c 99 b1 c3 46 89 db 6c b4 6e bf 5d 9e 53 7e e6 9b cf e3 84 e0 1c 8f 82 1e 95 7b 88 0a f6 28 cf 88 2f da 68 a5 80 6c cf 11 7a ef e9 69 54 b8 df 21 05 86 f7 c5 c2 f1 e8 7b 63 dd ca 3d ff d5 2c 8a dd 62 a3 c8 42 2b 0d 8e ad a0 99 19 35 f4 c5 a0 a5 1e 05 3d b4 a0 96 7a 44 1c a1 48 f9 6a 5e 1b 4d 8d de e2 51 d0 c7 2f 2e a2 04 f1 9d 58 a0 37 89 7d af 2a 35 d2 9f 3c 9c e7 6e 83 17 c9 63 8b 17 65 f9 bb 24 6e b3 d3 b3 5f cc 74 2b f7 cf 37 86 d3 92 4d 36 da 7e 94 5f 8d 6a 97 6d f9 3d a7 67 ba 95 e3 6b 34 32 bf 5c be 89 90 85 71 9d f8 fe cb 8b ec 14 2f 8e b5 e4 a8 43 9e d7 62 31 e5 75 7c 6c 9b e5 ef e2 90 1d 57 b7 1e b2 d3 5d 2f 0e 70 cf 60 fc 32 4f 9e 1b 76 3a f8 85 49 7c 7e b8 c3 a3 5b 06 e3 a9 3e 72 78 65 5e cf c3 Data Ascii: t=:Dk<Fln]S~{(/hlziT!{c=,bB+5=zDHj^MQ/.X7}*5<nce$n_t+7M6~_jm=gk42\q/Cb1u\|lW]/p`2Ov:I\|~[>rxe^
2024-02-08 18:35:38 UTC	6568	IN	Data Raw: f5 53 ab 62 59 3f 35 b5 ea c3 5d 36 5e a9 5f f4 ff 50 29 d6 aa 33 68 63 ed 97 53 77 df f5 f0 80 8d 2f 3c 3b 6a 47 ab 06 71 bb 3a d7 8e d9 de 57 9d 37 44 00 00 19 5b 49 44 41 54 eb a5 a4 7d 09 b5 07 6e fc fc ae 9e f9 0b 1a 8e d8 be e3 de 5e f9 9b 54 a4 07 1e e8 53 78 b4 5e cc c6 a3 0d 86 6f f5 3f 16 bb 39 00 11 43 b8 f5 06 d9 28 19 72 85 70 3d c9 de db 13 51 72 a1 39 06 a1 42 fe 90 b2 de 47 fe a3 e7 40 de 88 c2 21 75 ec 47 1f 02 d3 b1 4c 65 fe 90 6e df df d7 8a 1b d7 35 4a d8 a9 b2 ce 95 ba 7a 2e ae c5 b4 98 77 f5 c0 13 9d f2 4c d4 8e eb 71 1e ae f7 a2 f0 3b ba e5 05 a3 f2 db 9c e8 bd de dd e1 52 af 19 9d 73 4c 2f ef 9a 9d 73 8d e0 6f eb 50 20 35 db 17 9a e8 1d 13 7a 20 ca 3d 1b 33 76 9d ea 83 2d 50 ae 7f 7f b1 fc ba d1 54 b9 ea b1 54 95 6d 42 50 bc 97 3d Data Ascii: SbY?5]6^_P)3hcSw/<;jGq:W7D[IDAT}n^TSx^o?9C(rp=Qr9BG@!uGLen5Jz.wLq;RsL/soP 5z =3v-PTTmBP=
2024-02-08 18:35:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49800	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	1327	OUT	GET /logo?ver=1&sid=5171fc655664ddf74ab763a094523fb7&t=17074173311 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhDMSfLvcMG2VHcbU0a02MOY%2FoE3Pj42bdhHH9WLLA1HPYkJysgulFoMrtOulTRBzpAAVSg2Ic64ufepnGAfylJXnqeKJvDEAHVmYnj3dbGB7ygVV2JkX124%2BEixWTdIqcGu5Kd0Dv6tKmcPbpsN1xr5; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1
2024-02-08 18:35:38 UTC	780	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:38 GMT vary: User-Agent, Accept-Encoding set-cookie: BJS=-; domain=booking.com; expires=Fri, 09-Feb-2024 18:35:38 GMT; Secure; HTTPOnly strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=6fb182bdfec201c1&e=UmFuZG9tSVYkc2RlIyh9YbpBYTW1tHKzwEINTpRerHvT-lCl2pYr4Nk17cR-cExz x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 b0c7b942a33f0f4451718aee53f7840c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: jahk8tm-Z4P4orVqCQUi07jpXVVWYqB8OB6LxJREpcrDuk4jsbMbbA==
2024-02-08 18:35:38 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49801	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	1672	OUT	GET /js_tracking?ver=2&stype=1&ref_action=index&lang=en-us&pid=e4de82b919b800e4&aid=304142&sid=5171fc655664ddf74ab763a094523fb7&ete=&etg=&etcg=cCHObKdPHMfFdHMEKdbfZRLRMLFSZaTaTaET\|1&ets=cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhDMSfLvcMG2VHcbU0a02MOY%2FoE3Pj42bdhHH9WLLA1HPYkJysgulFoMrtOulTRBzpAAVSg2Ic64ufepnGAfylJXnqeKJvDEAHVmYnj3dbGB7ygVV2JkX124%2BEixWTdIqcGu5Kd0Dv6tKmcPbpsN1xr5; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1
2024-02-08 18:35:38 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:38 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=c88582bded1d027c&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejLbeB7R2wTd868xmMYgk-vvbJy_UFUlE58 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 76f3fedc86826a7b266250e33ee41082.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: mPwzgxjupf5Fu3GnfpG7IAD-xZ7-fR4i3QY_KFeRL9u0nUhiK-cTAw==
2024-02-08 18:35:38 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49802	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	593	OUT	GET /psb/capla/static/js/remoteEntry.b27ba5a8.client.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:38 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 18713 Connection: close Last-Modified: Wed, 31 Jan 2024 09:12:04 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: cWYT5t77uyDCeux.df5Emd93zyAJ0DTP Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 13:29:30 GMT ETag: "df9d5129505bebc7422f4d1ccaeed019" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6f067a3fd6e721a7db2a2901701a65d8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: _X6UqAJ43B-N_S1ewE41ITn0R6m0j7c6GwCqqfr1OfW5vTGpeo25dw== Age: 18369 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:38 UTC	15990	IN	Data Raw: 76 61 72 20 62 47 65 6e 69 75 73 56 69 70 57 65 62 43 6f 6d 70 6f 6e 65 6e 74 53 65 72 76 69 63 65 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 7b 63 65 37 36 30 33 65 62 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 76 61 72 20 72 3d 7b 22 2e 2f 47 65 6e 69 75 73 56 69 70 4d 6c 70 4f 6e 62 6f 61 72 64 69 6e 67 53 68 65 65 74 22 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 65 28 22 38 64 37 64 31 32 37 38 22 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 28 22 37 63 65 34 34 37 34 37 22 29 7d 7d 29 29 7d 2c 22 2e 2f 47 65 6e 69 75 73 56 69 70 50 72 69 63 65 4d 61 74 63 68 42 6f 6f 6b 69 6e 67 44 Data Ascii: var bGeniusVipWebComponentService;!function(){"use strict";var e={ce7603eb:function(e,n,t){var r={"./GeniusVipMlpOnboardingSheet":function(){return t.e("8d7d1278").then((function(){return function(){return t("7ce44747")}}))},"./GeniusVipPriceMatchBookingD
2024-02-08 18:35:38 UTC	2723	IN	Data Raw: 22 35 62 31 30 63 63 63 39 22 3a 5b 22 30 37 63 39 37 38 39 64 22 5d 2c 22 38 38 39 66 31 30 38 34 22 3a 5b 22 61 62 61 62 31 61 66 65 22 2c 22 65 61 64 37 31 65 62 30 22 5d 2c 22 31 34 65 30 30 32 65 65 22 3a 5b 22 65 61 64 37 31 65 62 30 22 5d 2c 62 64 35 31 38 30 30 30 3a 5b 22 65 32 37 32 65 34 37 64 22 5d 2c 22 31 31 64 66 37 37 33 34 22 3a 5b 22 36 39 32 32 38 38 66 31 22 5d 2c 22 32 34 61 36 62 34 33 65 22 3a 5b 22 61 62 61 62 31 61 66 65 22 5d 7d 3b 74 2e 66 2e 63 6f 6e 73 75 6d 65 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 74 2e 6f 28 62 2c 65 29 26 26 62 5b 65 5d 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 74 2e 6f 28 73 2c 65 29 29 72 65 74 75 72 6e 20 6e 2e 70 75 73 68 28 73 5b 65 5d 29 3b 76 61 72 20 72 3d Data Ascii: "5b10ccc9":["07c9789d"],"889f1084":["abab1afe","ead71eb0"],"14e002ee":["ead71eb0"],bd518000:["e272e47d"],"11df7734":["692288f1"],"24a6b43e":["abab1afe"]};t.f.consumes=function(e,n){t.o(b,e)&&b[e].forEach((function(e){if(t.o(s,e))return n.push(s[e]);var r=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49804	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	581	OUT	GET /psb/capla/static/js/client.1b521280.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:38 UTC	688	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 1041930 Connection: close Date: Thu, 08 Feb 2024 11:31:02 GMT Last-Modified: Fri, 02 Feb 2024 09:14:51 GMT ETag: "0019423cf697e3596b6f4129d1ce5b92" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: DesIc2PxPC5iVCDSCI2RpwYTP0wLoXR2 Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6e0f9dce97fcb3c9b684592a289e4e72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: OzIyUOcc9D1N0_OC4ycB_1IueBfLya1hJYzrkn4_W50LEQydCQKEHw== Age: 25477 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:38 UTC	15696	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 63 6c 69 65 6e 74 2e 31 62 35 32 31 32 38 30 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 22 38 35 34 62 36 63 61 31 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 74 68 69 73 26 26 74 68 69 73 2e 5f 5f 63 72 65 61 74 65 42 69 6e 64 69 6e 67 7c 7c 28 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 76 6f 69 64 20 30 3d 3d 3d 72 26 26 28 72 3d 6e 29 3b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 Data Ascii: /! For license information please see client.1b521280.js.LICENSE.txt /!function(){var e={"854b6ca1":function(e,t,n){"use strict";var r=this&&this.__createBinding\|\|(Object.create?function(e,t,n,r){void 0===r&&(r=n);var o=Object.getOwnPropertyDescriptor(
2024-02-08 18:35:38 UTC	16384	IN	Data Raw: 2e 31 38 39 2d 32 2e 33 37 38 20 31 31 2e 33 37 33 2d 35 2e 38 38 33 2e 38 33 2d 2e 39 32 2e 38 33 2d 32 2e 33 31 34 2e 30 30 32 2d 33 2e 32 33 32 61 32 31 2e 33 33 33 20 32 31 2e 33 33 33 20 30 20 30 20 30 2d 33 2e 31 38 39 2d 32 2e 38 36 2e 37 35 2e 37 35 20 30 20 30 20 30 2d 2e 38 38 34 20 31 2e 32 31 20 31 39 2e 38 31 36 20 31 39 2e 38 31 36 20 30 20 30 20 31 20 32 2e 39 36 32 20 32 2e 36 35 37 63 2e 33 31 2e 33 34 34 2e 33 31 2e 38 37 32 2d 2e 30 30 33 20 31 2e 32 31 39 2d 32 2e 39 32 20 33 2e 32 31 32 2d 36 2e 38 34 38 20 35 2e 34 34 36 2d 31 30 2e 32 35 34 20 35 2e 33 39 61 39 2e 32 37 32 20 39 2e 32 37 32 20 30 20 30 20 31 2d 32 2e 38 32 37 2d 2e 34 31 36 2e 37 35 2e 37 35 20 30 20 30 20 30 2d 2e 34 34 34 20 31 2e 34 33 32 7a 6d 35 2e 38 35 32 2d Data Ascii: .189-2.378 11.373-5.883.83-.92.83-2.314.002-3.232a21.333 21.333 0 0 0-3.189-2.86.75.75 0 0 0-.884 1.21 19.816 19.816 0 0 1 2.962 2.657c.31.344.31.872-.003 1.219-2.92 3.212-6.848 5.446-10.254 5.39a9.272 9.272 0 0 1-2.827-.416.75.75 0 0 0-.444 1.432zm5.852-
2024-02-08 18:35:39 UTC	16384	IN	Data Raw: 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 3b 76 61 72 20 61 3d 6f 28 6e 28 22 36 63 63 31 65 31 30 38 22 29 29 3b 74 2e 64 65 66 61 75 6c 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 21 3d 3d 74 79 70 65 6f 66 20 6e 29 7b 76 61 72 20 6f 3d 28 30 2c 61 2e 64 65 66 61 75 6c 74 29 28 74 2c 6e 29 3b 72 65 74 75 72 6e 20 6f 3f 65 5b 6f 5d 3a 6e 75 6c 6c 7d 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 6e 29 2e 72 65 64 75 63 65 28 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 69 29 7b 76 61 72 20 75 3d 28 30 2c 61 2e 64 65 66 61 75 6c 74 29 28 74 2c 6e 5b 69 5d 2c 7b 76 69 65 77 70 6f 72 74 3a 69 7d 29 3b 72 65 74 75 72 6e 20 75 3f 72 28 72 28 5b 5d 2c 6f Data Ascii: Property(t,"__esModule",{value:!0});var a=o(n("6cc1e108"));t.default=function(e,t,n){if("object"!==typeof n){var o=(0,a.default)(t,n);return o?e[o]:null}return Object.keys(n).reduce((function(o,i){var u=(0,a.default)(t,n[i],{viewport:i});return u?r(r([],o
2024-02-08 18:35:39 UTC	16384	IN	Data Raw: 75 72 6e 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 26 26 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 6f 66 66 73 65 74 57 69 64 74 68 3c 6f 2e 64 65 66 61 75 6c 74 2e 4d 45 44 49 55 4d 7d 7d 2c 22 35 32 37 32 62 63 36 30 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 3b 74 2e 64 65 66 61 75 6c 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 77 69 6e 64 6f 77 2e 72 65 71 75 65 73 74 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 3b 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 28 65 29 Data Ascii: urn document.documentElement&&document.documentElement.offsetWidth<o.default.MEDIUM}},"5272bc60":function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0});t.default=function(e){var t=window.requestAnimationFrame;t((function(){return t(e)
2024-02-08 18:35:39 UTC	16384	IN	Data Raw: 63 36 22 2c 22 72 6f 6f 74 2d 2d 63 6f 6c 6f 72 2d 77 68 69 74 65 22 3a 22 61 61 30 32 62 62 35 64 64 32 22 2c 22 72 6f 6f 74 2d 2d 63 6f 6c 6f 72 2d 61 63 74 69 6f 6e 22 3a 22 62 33 65 66 34 30 30 35 39 30 22 2c 22 72 6f 6f 74 2d 2d 63 6f 6c 6f 72 2d 64 65 73 74 72 75 63 74 69 76 65 22 3a 22 65 64 62 61 66 34 37 61 30 35 22 2c 22 72 6f 6f 74 2d 2d 63 6f 6c 6f 72 2d 63 61 6c 6c 6f 75 74 22 3a 22 62 32 64 37 31 63 65 31 38 64 22 2c 22 72 6f 6f 74 2d 2d 63 6f 6c 6f 72 2d 61 63 63 65 6e 74 22 3a 22 65 34 31 30 39 35 34 64 34 62 22 2c 22 72 6f 6f 74 2d 2d 63 6f 6c 6f 72 2d 63 6f 6e 73 74 72 75 63 74 69 76 65 22 3a 22 61 32 32 39 62 34 61 35 32 35 22 2c 22 72 6f 6f 74 2d 2d 63 6f 6c 6f 72 2d 6e 65 75 74 72 61 6c 22 3a 22 66 36 34 65 62 35 64 31 32 32 22 2c 22 Data Ascii: c6","root--color-white":"aa02bb5dd2","root--color-action":"b3ef400590","root--color-destructive":"edbaf47a05","root--color-callout":"b2d71ce18d","root--color-accent":"e410954d4b","root--color-constructive":"a229b4a525","root--color-neutral":"f64eb5d122","
2024-02-08 18:35:39 UTC	16384	IN	Data Raw: 72 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 74 79 70 65 3d 3d 3d 47 3f 6f 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 48 2c 6e 75 6c 6c 2c 65 29 3a 65 3a 6e 75 6c 6c 7d 29 29 29 7d 3b 48 2e 64 69 73 70 6c 61 79 4e 61 6d 65 3d 22 53 74 61 63 6b 2e 49 74 65 6d 22 2c 47 2e 49 74 65 6d 3d 48 3b 76 61 72 20 51 2c 57 3d 47 2c 4b 3d 7b 72 6f 6f 74 3a 22 65 39 35 38 38 63 65 33 37 64 22 2c 63 6f 6e 74 61 69 6e 65 72 3a 22 64 32 37 34 34 37 62 38 34 65 22 2c 22 74 6f 70 2d 63 6f 6e 74 65 6e 74 22 3a 22 63 64 66 36 63 65 64 30 66 34 22 2c 22 74 6f 70 2d 63 6f 6e 74 65 6e 74 2d 2d 66 69 6c 6c 22 3a 22 66 35 39 38 39 39 31 63 65 32 22 2c 63 6f 6e 74 65 6e 74 3a 22 61 34 65 39 66 35 63 32 36 30 22 2c 22 63 6f 6e 74 61 69 6e 65 Data Ascii: r,(function(e){return e?e.type===G?o().createElement(H,null,e):e:null})))};H.displayName="Stack.Item",G.Item=H;var Q,W=G,K={root:"e9588ce37d",container:"d27447b84e","top-content":"cdf6ced0f4","top-content--fill":"f598991ce2",content:"a4e9f5c260","containe
2024-02-08 18:35:39 UTC	16384	IN	Data Raw: 61 72 69 61 6e 74 2d 63 61 6c 6c 6f 75 74 22 3a 22 64 30 63 37 35 31 66 35 34 39 22 2c 22 72 6f 6f 74 2d 2d 76 61 72 69 61 6e 74 2d 61 63 63 65 6e 74 22 3a 22 64 38 64 31 66 32 61 36 32 39 22 2c 22 72 6f 6f 74 2d 2d 76 61 72 69 61 6e 74 2d 63 6f 6e 73 74 72 75 63 74 69 76 65 22 3a 22 64 31 38 62 34 61 36 30 32 36 22 2c 22 72 6f 6f 74 2d 2d 76 61 72 69 61 6e 74 2d 62 72 61 6e 64 2d 70 72 69 6d 61 72 79 22 3a 22 61 30 38 37 38 66 33 35 61 30 22 2c 22 72 6f 6f 74 2d 2d 76 61 72 69 61 6e 74 2d 62 72 61 6e 64 2d 67 65 6e 69 75 73 2d 70 72 69 6d 61 72 79 22 3a 22 63 38 66 31 37 66 37 64 62 64 22 2c 22 72 6f 6f 74 2d 2d 76 61 72 69 61 6e 74 2d 6f 75 74 6c 69 6e 65 22 3a 22 64 35 31 36 62 31 64 37 33 65 22 2c 22 72 6f 6f 74 2d 2d 76 61 72 69 61 6e 74 2d 6d 65 64 Data Ascii: ariant-callout":"d0c751f549","root--variant-accent":"d8d1f2a629","root--variant-constructive":"d18b4a6026","root--variant-brand-primary":"a0878f35a0","root--variant-brand-genius-primary":"c8f17f7dbd","root--variant-outline":"d516b1d73e","root--variant-med
2024-02-08 18:35:39 UTC	16384	IN	Data Raw: 61 73 73 4e 61 6d 65 3a 54 2c 6f 6e 43 6c 69 63 6b 3a 68 2c 6f 6e 4d 6f 75 73 65 45 6e 74 65 72 3a 64 2c 6f 6e 4d 6f 75 73 65 4c 65 61 76 65 3a 70 2c 6f 6e 46 6f 63 75 73 3a 64 2c 6f 6e 42 6c 75 72 3a 70 2c 6f 6e 4b 65 79 44 6f 77 6e 3a 6e 2c 22 64 61 74 61 2d 64 61 74 65 22 3a 77 2c 22 61 72 69 61 2d 63 68 65 63 6b 65 64 22 3a 6d 7c 7c 76 2c 72 6f 6c 65 3a 22 63 68 65 63 6b 62 6f 78 22 2c 22 61 72 69 61 2d 6c 61 62 65 6c 22 3a 5b 4f 2c 6e 75 6c 6c 3d 3d 3d 4e 7c 7c 76 6f 69 64 20 30 3d 3d 3d 4e 3f 76 6f 69 64 20 30 3a 4e 2e 61 72 69 61 4c 61 62 65 6c 2c 5f 5d 2e 66 69 6c 74 65 72 28 42 6f 6f 6c 65 61 6e 29 2e 6a 6f 69 6e 28 22 2c 20 22 29 7d 2c 6f 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 70 61 6e 22 2c 6e 75 6c 6c 2c 63 3f 63 28 74 29 3a Data Ascii: assName:T,onClick:h,onMouseEnter:d,onMouseLeave:p,onFocus:d,onBlur:p,onKeyDown:n,"data-date":w,"aria-checked":m\|\|v,role:"checkbox","aria-label":[O,null===N\|\|void 0===N?void 0:N.ariaLabel,_].filter(Boolean).join(", ")},o().createElement("span",null,c?c(t):
2024-02-08 18:35:39 UTC	16384	IN	Data Raw: 3d 3d 69 2e 73 74 61 72 74 47 68 6f 73 74 73 43 6f 75 6e 74 26 26 78 28 68 2b 72 2e 73 74 61 72 74 47 68 6f 73 74 73 43 6f 75 6e 74 2c 7b 69 6e 73 74 61 6e 74 3a 21 30 7d 29 7d 29 2c 5b 72 2c 73 2c 69 2c 68 5d 29 2c 6f 28 29 2e 75 73 65 45 66 66 65 63 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 73 7c 7c 78 28 68 2c 7b 69 6e 73 74 61 6e 74 3a 21 30 7d 29 7d 29 2c 5b 73 2c 68 5d 29 3b 76 61 72 20 43 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 54 28 29 3b 65 26 26 78 28 65 2e 69 6e 64 65 78 2b 31 29 7d 2c 49 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 54 28 29 3b 65 26 26 78 28 65 2e 69 6e 64 65 78 2d 31 29 7d 3b 72 65 74 75 72 6e 20 6f 28 29 2e 75 73 65 49 6d 70 65 72 61 74 69 76 65 48 61 6e 64 6c 65 28 74 2c 28 66 75 6e 63 74 69 6f 6e 28 Data Ascii: ==i.startGhostsCount&&x(h+r.startGhostsCount,{instant:!0})}),[r,s,i,h]),o().useEffect((function(){s\|\|x(h,{instant:!0})}),[s,h]);var C=function(){var e=T();e&&x(e.index+1)},I=function(){var e=T();e&&x(e.index-1)};return o().useImperativeHandle(t,(function(
2024-02-08 18:35:39 UTC	16384	IN	Data Raw: 74 29 7b 76 61 72 20 6e 3d 65 2e 64 65 66 61 75 6c 74 41 63 74 69 76 65 2c 72 3d 65 2e 6f 6e 43 6c 6f 73 65 2c 61 3d 65 2e 6f 6e 4f 70 65 6e 2c 69 3d 6f 28 29 2e 75 73 65 53 74 61 74 65 28 6e 7c 7c 21 31 29 2c 75 3d 69 5b 30 5d 2c 63 3d 69 5b 31 5d 3b 72 65 74 75 72 6e 20 6f 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 78 72 2c 43 72 28 7b 7d 2c 65 2c 7b 72 65 66 3a 74 2c 64 65 66 61 75 6c 74 41 63 74 69 76 65 3a 76 6f 69 64 20 30 2c 61 63 74 69 76 65 3a 75 2c 6f 6e 43 6c 6f 73 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 63 28 21 31 29 2c 72 26 26 72 28 29 7d 2c 6f 6e 4f 70 65 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 63 28 21 30 29 2c 61 26 26 61 28 29 7d 7d 29 29 7d 29 29 2c 41 72 3d 7b 72 6f 6f 74 3a 22 66 34 31 39 61 39 33 66 31 32 22 2c 22 72 6f 6f 74 Data Ascii: t){var n=e.defaultActive,r=e.onClose,a=e.onOpen,i=o().useState(n\|\|!1),u=i[0],c=i[1];return o().createElement(xr,Cr({},e,{ref:t,defaultActive:void 0,active:u,onClose:function(){c(!1),r&&r()},onOpen:function(){c(!0),a&&a()}}))})),Ar={root:"f419a93f12","root

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49803	13.32.208.75	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	1329	OUT	POST /privacy-consents/implicit HTTP/1.1 Host: account.booking.com Connection: keep-alive Content-Length: 56 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/json;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhDMSfLvcMG2VHcbU0a02MOY%2FoE3Pj42bdhHH9WLLA1HPYkJysgulFoMrtOulTRBzpAAVSg2Ic64ufepnGAfylJXnqeKJvDEAHVmYnj3dbGB7ygVV2JkX124%2BEixWTdIqcGu5Kd0Dv6tKmcPbpsN1xr5; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1
2024-02-08 18:35:38 UTC	56	OUT	Data Raw: 7b 22 63 6c 69 65 6e 74 5f 74 79 70 65 22 3a 22 77 65 62 22 2c 22 63 6c 69 65 6e 74 5f 69 64 22 3a 22 76 4f 31 4b 62 6c 6b 37 78 58 39 74 55 6e 32 63 70 5a 4c 53 22 7d Data Ascii: {"client_type":"web","client_id":"vO1Kblk7xX9tUn2cpZLS"}
2024-02-08 18:35:39 UTC	3328	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: envoy date: Thu, 08 Feb 2024 18:35:39 GMT access-control-allow-credentials: true access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range access-control-allow-methods: POST access-control-allow-origin: https://www.booking.com access-control-max-age: 1728000 content-security-policy: base-uri 'none'; frame-ancestors https://.booking.com https://.booking.cn; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=block&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMJ4KxJTAfD3k6vpGGyphNZUfy-f31chCZHPTonodp_KimHZLP-kkm31nZp_X7YOBYWt1U6tx6H7l-zqUOrlWbt5ujwRz9qqpTpEgzpeavCOQ; script-src 'report-sample' 'nonce-6IvHzybJmQbvYoJ' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com content-security-policy-report-only: connect-src 'self' .perimeterx.net .px-cdn.net .px-client.net .px-cloud.net .pxchk.net .token.awswaf.com cdn.cookielaw.org geolocation.onetrust.com privacyportal-eu.onetrust.com saa.booking.com secure.booking.com www.google-analytics.com; default-src 'self' .bstatic.com bstatic.com; frame-src .booking.com .bstatic.com bstatic.com paymentcomponent.booking.com secure.booking.com www.booking.com; img-src 'self' data: .bstatic.com .perimeterx.net .px-cloud.net .static.booking.cn account.booking.com bstatic.com cdn.cookielaw.org graph.facebook.com stats.g.doubleclick.net www.booking.com www.google-analytics.com www.google.com www.gstatic.com; report-uri https://nellie.booking.com/csp-report-uri?type=report&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMJ4KxJTAfD3k6vpGGyphNZUfy-f31chCZHPTonodp_KimHZLP-kkm31nZp_X7YOBYWt1U6tx6H7l-zqUOrlWbt5ujwRz9qqpTpEgzpeavCOQ; script-src 'report-sample' 'nonce-6IvHzybJmQbvYoJ' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com; style-src 'self' 'unsafe-inline' .bstatic.com *.static.booking.cn bstatic.com set-cookie: bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJlNTJkY2Q1MS02OTliLTQ1ZTgtODA3MC03Y2M5MWE1NzM1NmIiLCJzZXNzaW9ucyI6W119fQ; domain=account.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:39 GMT; SameSite=Lax; secure; HttpOnly set-cookie: bkng_sso_ses=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:39 GMT; secure; HttpOnly set-cookie: bkng_sso_session=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:39 GMT; secure; HttpOnly x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 076da3643179565aba2eda873738d6b6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD66-C1 X-Amz-Cf-Id: -aXTYnSgW4bvRByX7ftsF_fddc1MDaUTwvt31QQd8YXL4as_LwyLmQ==
2024-02-08 18:35:39 UTC	59	IN	Data Raw: 33 35 0d 0a 7b 22 63 6f 6e 73 65 6e 74 5f 69 64 22 3a 22 65 35 32 64 63 64 35 31 2d 36 39 39 62 2d 34 35 65 38 2d 38 30 37 30 2d 37 63 63 39 31 61 35 37 33 35 36 62 22 7d 0d 0a Data Ascii: 35{"consent_id":"e52dcd51-699b-45e8-8070-7cc91a57356b"}
2024-02-08 18:35:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49805	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	589	OUT	GET /psb/capla/static/js/4a89d2db.6c0ec4b3.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:38 UTC	684	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 375 Connection: close Last-Modified: Wed, 07 Feb 2024 05:15:19 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 9di50fL8JQhTrzdM_SzIninZxtneOruI Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 08:11:57 GMT ETag: "71d148d7e362a60e9a0c56222e4c1c42" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 4a9f56098c7d51e12b8d2ac77b6f1bcc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: l8tNT8Xejmq3k5RGmk8srkNWzxWK32Edy6hiCl8rsxPrfYqkyqceQA== Age: 37422 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:38 UTC	375	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 34 61 38 39 64 32 64 62 22 5d 2c 7b 66 65 39 30 35 66 37 62 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 5f 2c 62 29 7b 62 2e 72 28 5f 29 3b 76 61 72 20 64 3d 62 28 22 35 34 30 61 64 63 64 38 22 29 3b 28 30 2c 64 2e 73 65 72 76 65 29 28 28 28 29 3d 3e 62 2e 65 28 22 30 61 30 39 38 32 38 34 22 29 2e 74 68 65 6e 28 62 2e 62 69 6e 64 28 62 2c 22 36 34 62 37 37 38 61 64 22 29 Data Ascii: "use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["4a89d2db"],{fe905f7b:function(e,_,b){b.r(_);var d=b("540adcd8");(0,d.serve)((()=>b.e("0a098284").then(b.bind(b,"64b778ad")

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	49807	104.18.130.236	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	427	OUT	GET /consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/3ea94870-d4b1-483a-b1d2-faf1d982bb31.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:39 UTC	902	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:35:38 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8525f9408dd0244b-ATL CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 19762 Cache-Control: public, max-age=86400 Expires: Fri, 09 Feb 2024 18:35:38 GMT Last-Modified: Fri, 02 Feb 2024 12:54:10 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: E7bVHy0X9zWXnIXDZNC6oQ== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 17818d63-801e-0021-03d7-551df8000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-02-08 18:35:39 UTC	467	IN	Data Raw: 31 61 30 35 0d 0a 7b 22 43 6f 6f 6b 69 65 53 50 41 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 53 61 6d 65 53 69 74 65 4e 6f 6e 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 56 32 43 53 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 4d 75 6c 74 69 56 61 72 69 61 6e 74 54 65 73 74 69 6e 67 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 55 73 65 56 32 22 3a 74 72 75 65 2c 22 4d 6f 62 69 6c 65 53 44 4b 22 3a 66 61 6c 73 65 2c 22 53 6b 69 70 47 65 6f 6c 6f 63 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 53 63 72 69 70 74 54 79 70 65 22 3a 22 50 52 4f 44 55 43 54 49 4f 4e 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 32 30 32 33 31 30 2e 32 2e 30 22 2c 22 4f 70 74 61 6e 6f 6e 44 61 74 61 4a 53 4f 4e 22 3a 22 33 65 61 39 Data Ascii: 1a05{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202310.2.0","OptanonDataJSON":"3ea9
2024-02-08 18:35:39 UTC	1369	IN	Data Raw: 74 22 3a 5b 7b 22 49 64 22 3a 22 39 37 37 38 66 34 61 62 2d 36 62 34 61 2d 34 65 30 33 2d 62 64 66 38 2d 38 36 61 35 63 30 33 37 63 34 62 66 22 2c 22 4e 61 6d 65 22 3a 22 55 53 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 75 73 22 5d 2c 22 53 74 61 74 65 73 22 3a 7b 7d 2c 22 4c 61 6e 67 75 61 67 65 53 77 69 74 63 68 65 72 50 6c 61 63 65 68 6f 6c 64 65 72 22 3a 7b 22 6e 6f 22 3a 22 6e 6f 22 2c 22 68 69 22 3a 22 68 69 22 2c 22 64 65 22 3a 22 64 65 22 2c 22 72 75 22 3a 22 72 75 22 2c 22 66 69 22 3a 22 66 69 22 2c 22 65 6e 2d 55 53 22 3a 22 65 6e 2d 55 53 22 2c 22 62 67 22 3a 22 62 67 22 2c 22 6c 74 22 3a 22 6c 74 22 2c 22 6c 76 22 3a 22 6c 76 22 2c 22 68 72 22 3a 22 68 72 22 2c 22 66 72 22 3a 22 66 72 22 2c 22 68 75 22 3a 22 68 75 22 2c 22 64 65 66 61 75 Data Ascii: t":[{"Id":"9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf","Name":"US","Countries":["us"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","en-US":"en-US","bg":"bg","lt":"lt","lv":"lv","hr":"hr","fr":"fr","hu":"hu","defau
2024-02-08 18:35:39 UTC	1369	IN	Data Raw: 2d 48 61 6e 74 22 2c 22 75 6b 22 3a 22 75 6b 22 2c 22 73 6b 22 3a 22 73 6b 22 2c 22 73 6c 22 3a 22 73 6c 22 2c 22 69 64 22 3a 22 69 64 22 2c 22 63 61 22 3a 22 63 61 22 2c 22 73 72 22 3a 22 73 72 22 2c 22 73 76 22 3a 22 73 76 22 2c 22 6b 6f 22 3a 22 6b 6f 22 2c 22 70 74 2d 42 52 22 3a 22 70 74 2d 42 52 22 2c 22 6d 73 22 3a 22 6d 73 22 2c 22 65 6c 22 3a 22 65 6c 22 2c 22 69 73 22 3a 22 69 73 22 2c 22 69 74 22 3a 22 69 74 22 2c 22 65 73 2d 4d 58 22 3a 22 65 73 2d 4d 58 22 2c 22 65 73 22 3a 22 65 73 22 2c 22 7a 68 22 3a 22 7a 68 22 2c 22 65 74 22 3a 22 65 74 22 2c 22 63 73 22 3a 22 63 73 22 2c 22 61 72 22 3a 22 61 72 22 2c 22 70 74 2d 50 54 22 3a 22 70 74 2d 50 54 22 2c 22 76 69 22 3a 22 76 69 22 2c 22 74 68 22 3a 22 74 68 22 2c 22 65 73 2d 41 52 22 3a 22 65 Data Ascii: -Hant","uk":"uk","sk":"sk","sl":"sl","id":"id","ca":"ca","sr":"sr","sv":"sv","ko":"ko","pt-BR":"pt-BR","ms":"ms","el":"el","is":"is","it":"it","es-MX":"es-MX","es":"es","zh":"zh","et":"et","cs":"cs","ar":"ar","pt-PT":"pt-PT","vi":"vi","th":"th","es-AR":"e
2024-02-08 18:35:39 UTC	1369	IN	Data Raw: 63 61 22 2c 22 73 72 22 2c 22 63 63 22 2c 22 73 73 22 2c 22 63 64 22 2c 22 73 74 22 2c 22 63 66 22 2c 22 73 76 22 2c 22 63 67 22 2c 22 73 78 22 2c 22 63 68 22 2c 22 63 69 22 2c 22 73 79 22 2c 22 73 7a 22 2c 22 63 6b 22 2c 22 63 6c 22 2c 22 63 6d 22 2c 22 63 6f 22 2c 22 63 72 22 2c 22 74 63 22 2c 22 74 64 22 2c 22 74 66 22 2c 22 63 75 22 2c 22 74 67 22 2c 22 63 76 22 2c 22 63 77 22 2c 22 74 68 22 2c 22 63 78 22 2c 22 74 6a 22 2c 22 74 6b 22 2c 22 74 6c 22 2c 22 74 6d 22 2c 22 74 6e 22 2c 22 74 6f 22 2c 22 74 72 22 2c 22 74 74 22 2c 22 74 76 22 2c 22 74 77 22 2c 22 64 6a 22 2c 22 74 7a 22 2c 22 64 6d 22 2c 22 64 6f 22 2c 22 75 61 22 2c 22 75 67 22 2c 22 64 7a 22 2c 22 75 6d 22 2c 22 65 63 22 2c 22 65 67 22 2c 22 65 68 22 2c 22 75 79 22 2c 22 75 7a 22 2c 22 Data Ascii: ca","sr","cc","ss","cd","st","cf","sv","cg","sx","ch","ci","sy","sz","ck","cl","cm","co","cr","tc","td","tf","cu","tg","cv","cw","th","cx","tj","tk","tl","tm","tn","to","tr","tt","tv","tw","dj","tz","dm","do","ua","ug","dz","um","ec","eg","eh","uy","uz","
2024-02-08 18:35:39 UTC	1369	IN	Data Raw: 74 22 3a 74 72 75 65 2c 22 47 6c 6f 62 61 6c 22 3a 74 72 75 65 2c 22 54 79 70 65 22 3a 22 47 44 50 52 22 2c 22 55 73 65 47 6f 6f 67 6c 65 56 65 6e 64 6f 72 73 22 3a 66 61 6c 73 65 2c 22 56 61 72 69 61 6e 74 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 54 65 73 74 45 6e 64 54 69 6d 65 22 3a 6e 75 6c 6c 2c 22 56 61 72 69 61 6e 74 73 22 3a 5b 5d 2c 22 54 65 6d 70 6c 61 74 65 4e 61 6d 65 22 3a 22 43 75 73 74 6f 6d 65 72 20 2d 20 41 63 63 65 70 74 2f 44 65 63 6c 69 6e 65 22 2c 22 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 47 43 45 6e 61 62 6c 65 22 3a 66 61 6c 73 65 2c 22 49 73 47 50 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 7d 5d 2c 22 49 61 62 44 61 74 61 22 3a 7b 22 63 6f 6f 6b 69 65 56 65 72 73 69 6f 6e 22 3a 22 31 22 2c 22 63 72 65 61 74 65 64 Data Ascii: t":true,"Global":true,"Type":"GDPR","UseGoogleVendors":false,"VariantEnabled":false,"TestEndTime":null,"Variants":[],"TemplateName":"Customer - Accept/Decline","Conditions":[],"GCEnable":false,"IsGPPEnabled":false}],"IabData":{"cookieVersion":"1","created
2024-02-08 18:35:39 UTC	726	IN	Data Raw: 65 73 22 3a 7b 22 43 6f 6f 6b 69 65 56 32 42 61 6e 6e 65 72 46 6f 63 75 73 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 50 43 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 41 73 73 69 67 6e 54 65 6d 70 6c 61 74 65 52 75 6c 65 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6f 6c 6f 63 61 74 69 6f 6e 4a 73 6f 6e 41 70 69 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 43 4d 44 4d 41 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 54 43 46 32 31 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 52 65 6d 6f 76 65 53 65 74 74 69 6e 67 73 49 63 6f 6e 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 42 61 6e 6e 65 72 4c 6f 67 6f 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6e 65 72 61 6c 56 65 6e 64 6f 72 73 22 3a 74 72 75 65 2c 22 43 6f Data Ascii: es":{"CookieV2BannerFocus":true,"CookieV2GPC":true,"CookieV2AssignTemplateRule":true,"CookieV2GeolocationJsonApi":true,"CookieV2GCMDMA":true,"CookieV2TCF21":true,"CookieV2RemoveSettingsIcon":true,"CookieV2BannerLogo":true,"CookieV2GeneralVendors":true,"Co
2024-02-08 18:35:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	49806	172.64.155.119	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	597	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:39 UTC	370	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:35:38 GMT Content-Type: application/json Content-Length: 68 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8525f9407b68b042-ATL
2024-02-08 18:35:39 UTC	68	IN	Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 47 41 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 47 65 6f 72 67 69 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d Data Ascii: {"country":"US","state":"GA","stateName":"Georgia","continent":"NA"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	49808	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	1057	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLalZib7103qG%2BF6jNX4nY1OEBjrxAz9Ob8DEQBWTSqeRvOh6i7KV3uDpo7lfSd6A33jZhjYHawln8E0aqfSwxomTxD7gRkwilYph1WF73PdYDrYV%2FBds8KeGhbWuYLP5WRjHVQWXCaBnPp2c6UP9oiZIrDu36czsM%3D
2024-02-08 18:35:39 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:39 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=c1ce82bd5e3f0034&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqstBGV_9Tsx3EalWsL-EYWozAEPJLSy8-jc x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 7eeed291abf48890d3f36565208941a8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: dVMk9xqPuyRVHeNrZnWJM5urKVVP-MmIOsIg64n7p3p7gUhXBeeLVQ==
2024-02-08 18:35:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	49809	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	589	OUT	GET /psb/capla/static/js/0a098284.df965884.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:39 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 39708 Connection: close Date: Thu, 08 Feb 2024 15:48:39 GMT Last-Modified: Thu, 08 Feb 2024 06:30:47 GMT ETag: "47bb1a597dd42cabf5425fe918f725b5" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 66kT4AfYW6XFbY2uR01i.yN9iev4sCir Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 34411558fb3a23efdbbaaddb8a12b574.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 4GJYdvBM4hytt6BrA8RJKrIeWvgZlD9zIV2YnfpwaPkJigwBGmdVMw== Age: 10020 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:39 UTC	15698	IN	Data Raw: 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 30 61 30 39 38 32 38 34 22 5d 2c 7b 22 31 38 31 65 61 63 63 38 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 2e 64 28 6e 2c 7b 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 7d 29 3b 76 61 72 20 72 3d 74 28 22 39 33 39 36 30 34 31 31 22 29 2c 73 3d 74 2e 6e 28 72 29 2c 6f 3d 74 28 22 36 65 65 38 38 63 35 34 22 29 2c 69 3d 74 28 22 64 Data Ascii: (self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["0a098284"],{"181eacc8":function(e,n,t){"use strict";t.d(n,{d:function(){return a}});var r=t("93960411"),s=t.n(r),o=t("6ee88c54"),i=t("d
2024-02-08 18:35:39 UTC	16384	IN	Data Raw: 72 65 73 6f 6c 76 65 64 5b 6e 5d 3d 21 31 2c 74 68 69 73 2e 69 6d 70 6f 72 74 41 73 79 6e 63 28 65 29 2e 74 68 65 6e 28 28 65 3d 3e 28 74 68 69 73 2e 72 65 73 6f 6c 76 65 64 5b 6e 5d 3d 21 30 2c 65 29 29 29 7d 2c 72 65 71 75 69 72 65 53 79 6e 63 28 65 29 7b 63 6f 6e 73 74 20 6e 3d 74 68 69 73 2e 72 65 73 6f 6c 76 65 28 65 29 3b 72 65 74 75 72 6e 20 74 28 6e 29 7d 2c 72 65 73 6f 6c 76 65 28 29 7b 72 65 74 75 72 6e 22 61 31 61 31 61 64 64 62 22 7d 7d 29 2c 5b 6d 5d 3a 28 30 2c 72 2e 6c 6f 61 64 61 62 6c 65 29 28 7b 72 65 73 6f 6c 76 65 64 3a 7b 7d 2c 63 68 75 6e 6b 4e 61 6d 65 28 29 7b 72 65 74 75 72 6e 22 63 6f 6d 70 6f 6e 65 6e 74 73 2d 55 6e 69 71 75 65 53 74 61 79 73 50 72 6f 70 65 72 74 69 65 73 22 7d 2c 69 73 52 65 61 64 79 28 65 29 7b 63 6f 6e 73 74 Data Ascii: resolved[n]=!1,this.importAsync(e).then((e=>(this.resolved[n]=!0,e)))},requireSync(e){const n=this.resolve(e);return t(n)},resolve(){return"a1a1addb"}}),[m]:(0,r.loadable)({resolved:{},chunkName(){return"components-UniqueStaysProperties"},isReady(e){const
2024-02-08 18:35:39 UTC	7626	IN	Data Raw: 6f 66 20 55 52 49 45 72 72 6f 72 3f 6e 65 77 20 55 52 49 45 72 72 6f 72 28 27 50 61 74 68 6e 61 6d 65 20 22 27 2b 73 2e 70 61 74 68 6e 61 6d 65 2b 27 22 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 64 65 63 6f 64 65 64 2e 20 54 68 69 73 20 69 73 20 6c 69 6b 65 6c 79 20 63 61 75 73 65 64 20 62 79 20 61 6e 20 69 6e 76 61 6c 69 64 20 70 65 72 63 65 6e 74 2d 65 6e 63 6f 64 69 6e 67 2e 27 29 3a 6f 7d 72 65 74 75 72 6e 20 74 26 26 28 73 2e 6b 65 79 3d 74 29 2c 72 3f 73 2e 70 61 74 68 6e 61 6d 65 3f 22 2f 22 21 3d 3d 73 2e 70 61 74 68 6e 61 6d 65 2e 63 68 61 72 41 74 28 30 29 26 26 28 73 2e 70 61 74 68 6e 61 6d 65 3d 64 28 73 2e 70 61 74 68 6e 61 6d 65 2c 72 2e 70 61 74 68 6e 61 6d 65 29 29 3a 73 2e 70 61 74 68 6e 61 6d 65 3d 72 2e 70 61 74 68 6e 61 6d 65 3a 73 2e Data Ascii: of URIError?new URIError('Pathname "'+s.pathname+'" could not be decoded. This is likely caused by an invalid percent-encoding.'):o}return t&&(s.key=t),r?s.pathname?"/"!==s.pathname.charAt(0)&&(s.pathname=d(s.pathname,r.pathname)):s.pathname=r.pathname:s.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	49810	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:38 UTC	1576	OUT	GET /js_tracking?ver=2&stype=1&ref_action=index&lang=en-us&pid=e4de82b919b800e4&aid=304142&sid=5171fc655664ddf74ab763a094523fb7&ete=&etg=&etcg=&ets=cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLalZib7103qG%2BF6jNX4nY1OEBjrxAz9Ob8DEQBWTSqeRvOh6i7KV3uDpo7lfSd6A33jZhjYHawln8E0aqfSwxomTxD7gRkwilYph1WF73PdYDrYV%2FBds8KeGhbWuYLP5WRjHVQWXCaBnPp2c6UP9oiZIrDu36czsM%3D
2024-02-08 18:35:39 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:39 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=0df682bda558038b&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejKYqbhyMGn0_f4JsKg2hOjACv0GkMBDbUk x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 145bb9cba9e12350510f02ee9ab6ca22.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: fVwHXwfzHPIn9fJcXNzhWcyfVLqoJjgvwWLKdA8DB0VnkVfFmqrYpQ==
2024-02-08 18:35:39 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49812	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:39 UTC	589	OUT	GET /psb/capla/static/js/7bcb015e.cf9d45ea.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:39 UTC	685	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 15916 Connection: close Date: Thu, 08 Feb 2024 16:07:29 GMT Last-Modified: Thu, 08 Feb 2024 14:53:52 GMT ETag: "762dbdde80c9b4faddafa20df78215de" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: zc90J05kqhlmzNDNZXeMr8lu3QU56RZ9 Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 3f95374273631adbfd8e0d0a9f6d7b64.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: WrGaCVcZCohUgSo1eWrGub9a1xikaX2Uw2GNkua8QlhI_ZTR_Twi-g== Age: 8891 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:39 UTC	15699	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 37 62 63 62 30 31 35 65 22 5d 2c 7b 61 66 31 65 32 62 33 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 5a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 7d 29 3b 76 61 72 20 61 3d 6e 28 22 36 65 65 38 38 63 35 34 22 29 2c 72 3d 6e 28 22 64 63 36 64 32 38 66 66 22 29 3b 63 6f 6e 73 74 20 69 3d 28 29 3d 3e 7b 63 6f 6e 73 Data Ascii: "use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["7bcb015e"],{af1e2b38:function(e,t,n){n.d(t,{Z:function(){return i}});var a=n("6ee88c54"),r=n("dc6d28ff");const i=()=>{cons
2024-02-08 18:35:39 UTC	217	IN	Data Raw: 29 7d 7d 3b 74 2e 5a 3d 6f 7d 2c 22 35 35 37 65 63 64 38 36 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 65 2e 65 78 70 6f 72 74 73 3d 6e 2e 70 2b 22 73 74 61 74 69 63 2f 6d 65 64 69 61 2f 62 68 5f 61 77 5f 63 70 67 5f 6d 61 69 6e 5f 69 6d 61 67 65 2e 62 34 33 34 37 36 32 32 2e 70 6e 67 22 7d 7d 5d 29 3b 0a 2f 2f 23 20 73 6f 75 72 63 65 4d 61 70 70 69 6e 67 55 52 4c 3d 68 74 74 70 73 3a 2f 2f 69 73 74 61 74 69 63 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 69 6e 74 65 72 6e 61 6c 2d 73 74 61 74 69 63 2f 63 61 70 6c 61 2f 73 74 61 74 69 63 2f 6a 73 2f 37 62 63 62 30 31 35 65 2e 63 66 39 64 34 35 65 61 2e 63 68 75 6e 6b 2e 6a 73 2e 6d 61 70 Data Ascii: )}};t.Z=o},"557ecd86":function(e,t,n){e.exports=n.p+"static/media/bh_aw_cpg_main_image.b4347622.png"}}]);//# sourceMappingURL=https://istatic.booking.com/internal-static/capla/static/js/7bcb015e.cf9d45ea.chunk.js.map

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49813	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:39 UTC	589	OUT	GET /psb/capla/static/js/eb60141d.05ae682b.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:39 UTC	687	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 216272 Connection: close Date: Wed, 07 Feb 2024 21:51:37 GMT Last-Modified: Mon, 05 Feb 2024 10:15:49 GMT ETag: "8bd695624a0284c0c75e95e6cf849e19" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: GxdC2HoWy3SKzPu2JnW5Pb.Aec0Emv2p Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 d48a409d6a3222e2cc9a060d30206d3c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: q4ZwR2yKQQ8on8KeDG0z8jYZXX7AqbUUJ3Uupa_tavxw9rnmabjh4w== Age: 74643 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:39 UTC	15697	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 65 62 36 30 31 34 31 64 2e 30 35 61 65 36 38 32 62 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 65 62 36 30 31 34 31 64 22 5d 2c 7b 61 36 63 39 31 62 39 37 3a 66 75 6e 63 74 69 6f 6e 28 41 2c 67 2c 6e 29 7b 76 61 72 20 65 3d 7b 22 2e 2f 61 64 2e 70 6e 67 22 Data Ascii: /! For license information please see eb60141d.05ae682b.chunk.js.LICENSE.txt /(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["eb60141d"],{a6c91b97:function(A,g,n){var e={"./ad.png"
2024-02-08 18:35:39 UTC	16384	IN	Data Raw: 3a 6e 75 6c 6c 2c 63 6f 70 79 3a 28 30 2c 74 2e 74 29 28 22 72 65 76 69 65 77 5f 61 64 6a 5f 65 78 63 65 70 74 69 6f 6e 61 6c 22 29 7d 5d 3b 66 6f 72 28 63 6f 6e 73 74 20 6e 20 6f 66 20 67 29 69 66 28 21 28 6e 2e 66 72 6f 6d 26 26 6e 2e 66 72 6f 6d 3e 41 29 26 26 21 28 6e 2e 74 6f 26 26 6e 2e 74 6f 3c 3d 41 29 29 72 65 74 75 72 6e 7b 72 61 74 69 6e 67 41 64 6a 65 63 74 69 76 65 3a 6e 2e 63 6f 70 79 7d 3b 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 73 63 6f 72 65 20 72 61 6e 67 65 20 69 73 20 6d 69 73 73 65 64 22 29 7d 2c 63 3d 28 29 3d 3e 7b 63 6f 6e 73 74 20 41 3d 28 30 2c 65 2e 67 65 74 52 65 71 75 65 73 74 43 6f 6e 74 65 78 74 29 28 29 2e 67 65 74 42 50 6c 61 74 66 6f 72 6d 45 6e 76 69 72 6f 6e 6d 65 6e 74 28 29 3b 72 65 74 75 72 6e 20 41 26 26 Data Ascii: :null,copy:(0,t.t)("review_adj_exceptional")}];for(const n of g)if(!(n.from&&n.from>A)&&!(n.to&&n.to<=A))return{ratingAdjective:n.copy};throw new Error("score range is missed")},c=()=>{const A=(0,e.getRequestContext)().getBPlatformEnvironment();return A&&
2024-02-08 18:35:39 UTC	16384	IN	Data Raw: 36 36 68 52 70 4e 49 43 46 71 47 65 72 70 77 35 42 6b 64 43 52 53 6e 4c 78 31 64 43 45 31 71 4f 49 38 45 76 61 7a 31 45 4c 42 42 51 78 51 6d 72 2f 31 54 4a 63 45 35 4f 67 47 41 79 70 56 64 4d 33 68 52 67 4d 69 6e 69 6d 46 48 4e 57 41 55 47 78 6e 6d 6b 42 33 32 79 43 41 70 2f 4d 73 43 67 69 7a 43 4e 69 68 46 6b 2b 45 59 52 35 50 48 2f 32 42 66 5a 78 52 4e 46 62 48 44 57 6c 41 41 41 41 41 45 6c 46 54 6b 53 75 51 6d 43 43 22 7d 2c 61 33 66 34 33 33 65 37 3a 66 75 6e 63 74 69 6f 6e 28 41 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 41 2e 65 78 70 6f 72 74 73 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 42 67 41 41 41 41 59 43 41 4d 41 41 41 44 58 71 63 33 4b Data Ascii: 66hRpNICFqGerpw5BkdCRSnLx1dCE1qOI8Evaz1ELBBQxQmr/1TJcE5OgGAypVdM3hRgMinimFHNWAUGxnmkB32yCAp/MsCgizCNihFk+EYR5PH/2BfZxRNFbHDWlAAAAAElFTkSuQmCC"},a3f433e7:function(A){"use strict";A.exports="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABgAAAAYCAMAAADXqc3K
2024-02-08 18:35:39 UTC	16384	IN	Data Raw: 2f 38 42 37 39 38 42 76 2b 37 79 66 6b 35 4f 50 35 37 45 6e 30 34 4d 76 33 36 47 2f 34 36 30 54 39 37 52 54 30 37 54 44 67 34 4e 2f 32 36 44 62 31 36 43 72 32 35 68 37 30 35 68 6e 74 35 78 66 74 34 43 62 33 33 68 6e 73 33 69 4c 75 31 32 6e 71 33 68 6a 73 33 52 66 6c 78 38 66 4d 7a 4d 7a 6d 31 68 50 49 79 4d 6a 4d 78 73 62 6e 76 72 2f 67 76 72 2f 65 7a 78 6a 41 77 4c 2f 67 74 62 62 69 78 52 6e 4c 76 68 76 69 74 52 66 67 70 61 58 48 75 68 71 31 72 36 37 66 6e 59 69 6b 70 4b 54 65 6c 78 71 75 6f 68 44 4c 68 6f 6e 4a 67 78 69 73 67 49 48 62 63 6e 58 67 65 68 32 47 68 6f 58 5a 62 47 2f 65 62 52 31 2b 66 6e 32 4b 67 78 6a 66 58 47 48 67 58 79 48 50 59 68 35 36 64 43 31 77 63 47 2b 56 61 68 4f 62 57 46 6e 53 52 6b 76 53 52 79 46 67 59 47 43 70 54 45 35 70 59 67 Data Ascii: /8B798Bv+7yfk5OP57En04Mv36G/460T97RT07TDg4N/26Db16Cr25h705hnt5xft4Cb33hns3iLu12nq3hjs3Rflx8fMzMzm1hPIyMjMxsbnvr/gvr/ezxjAwL/gtbbixRnLvhvitRfgpaXHuhq1r67fnYikpKTelxquohDLhonJgxisgIHbcnXgeh2GhoXZbG/ebR1+fn2KgxjfXGHgXyHPYh56dC1wcG+VahObWFnSRkvSRyFgYGCpTE5pYg
2024-02-08 18:35:39 UTC	16384	IN	Data Raw: 67 54 46 44 67 53 45 7a 66 52 45 6a 6a 51 6b 66 63 50 30 54 61 4f 7a 2f 67 4e 6a 76 58 4e 7a 72 67 4d 7a 66 57 4e 44 6a 55 4c 7a 50 66 4b 69 2f 66 4a 79 76 53 4b 7a 44 65 49 79 6a 52 4a 69 76 51 49 79 66 64 48 79 50 4e 48 79 4e 57 43 65 42 35 41 41 41 41 42 58 52 53 54 6c 4d 41 45 53 49 7a 52 4a 54 64 52 48 77 41 41 41 43 64 53 55 52 42 56 42 67 5a 72 63 47 78 55 73 4a 51 41 45 54 52 75 2f 73 32 59 52 77 52 43 77 64 61 2f 76 2b 37 4b 43 30 56 43 79 4c 76 47 59 6f 4d 6b 61 52 78 78 6e 50 67 33 77 69 78 70 6b 6e 48 79 73 33 51 4d 58 65 4b 36 67 63 33 35 32 64 6d 58 68 54 63 79 71 58 48 72 2f 56 7a 78 2b 51 4b 51 66 6b 61 68 70 33 77 78 6b 79 61 43 58 4c 58 2b 67 41 71 54 4a 6f 49 38 74 62 56 30 4c 34 4c 6b 79 71 43 75 6a 42 36 33 78 2b 34 4d 38 45 4a 6f 37 Data Ascii: gTFDgSEzfREjjQkfcP0TaOz/gNjvXNzrgMzfWNDjULzPfKi/fJyvSKzDeIyjRJivQIyfdHyPNHyNWCeB5AAAABXRSTlMAESIzRJTdRHwAAACdSURBVBgZrcGxUsJQAETRu/s2YRwRCwda/v+7KC0VCyLvGYoMkaRxxnPg3wixpknHys3QMXeK6gc352dmXhTcyqXHr/Vzx+QKQfkahp3wxkyaCXLX+gAqTJoI8tbV0L4LkyqCujB63x+4M8EJo7
2024-02-08 18:35:39 UTC	16384	IN	Data Raw: 77 4a 69 30 62 4a 4a 47 44 4a 46 46 6f 78 46 71 73 6f 6c 75 59 41 35 49 6f 79 69 6c 42 42 67 48 6c 63 66 6b 6c 4f 51 57 59 45 6d 55 67 49 71 63 49 4b 46 46 61 57 49 59 42 43 6b 76 42 45 6c 67 41 53 4b 49 43 4b 32 42 69 59 47 52 6d 77 51 4b 59 47 58 48 48 49 4d 6b 41 41 46 30 56 64 31 54 52 70 47 59 54 41 41 41 41 41 45 6c 46 54 6b 53 75 51 6d 43 43 22 7d 2c 22 36 32 61 36 61 30 36 39 22 3a 66 75 6e 63 74 69 6f 6e 28 41 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 41 2e 65 78 70 6f 72 74 73 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 42 67 41 41 41 41 59 43 41 4d 41 41 41 44 58 71 63 33 4b 41 41 41 42 73 31 42 4d 56 45 58 2f 2f 2f 38 41 41 41 41 41 41 41 Data Ascii: wJi0bJJGDJFFoxFqsoluYA5IoyilBBgHlcfklOQWYEmUgIqcIKFFaWIYBCkvBElgASKICK2BiYGRmwQKYGXHHIMkAAF0Vd1TRpGYTAAAAAElFTkSuQmCC"},"62a6a069":function(A){"use strict";A.exports="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABgAAAAYCAMAAADXqc3KAAABs1BMVEX///8AAAAAAA
2024-02-08 18:35:39 UTC	16384	IN	Data Raw: 22 37 35 66 61 34 38 35 33 22 3a 66 75 6e 63 74 69 6f 6e 28 41 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 41 2e 65 78 70 6f 72 74 73 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 42 67 41 41 41 41 59 43 41 4d 41 41 41 44 58 71 63 33 4b 41 41 41 43 46 6c 42 4d 56 45 58 2f 2f 2f 38 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 44 2f 2f 72 62 34 2f 4e 6a 2f 2b 72 2f 2f 2f 34 37 36 2f 4c 50 36 2b 4d 54 2f 2b 5a 4c 38 39 36 6a 2f 2b 59 58 2f 2f 7a 2f 2f 2b 58 50 77 39 63 6a 6d 39 65 50 31 39 62 54 73 39 4e 6a 2f 2b 48 72 2f 2b 6b 72 72 38 38 37 2f 39 32 48 2f 39 6d 6e 2f 39 56 33 2f 39 31 44 68 38 4e 6a 6e 38 4c 7a 2f 2b 42 33 39 38 45 2f 2f 39 68 4c 2f 38 54 Data Ascii: "75fa4853":function(A){"use strict";A.exports="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABgAAAAYCAMAAADXqc3KAAACFlBMVEX///8AAAAAAAAAAAAAAAD//rb4/Nj/+r///476/LP6+MT/+ZL896j/+YX//z//+XPw9cjm9eP19bTs9Nj/+Hr/+krr887/92H/9mn/9V3/91Dh8Njn8Lz/+B398E//9hL/8T
2024-02-08 18:35:39 UTC	16384	IN	Data Raw: 77 74 70 53 73 75 74 6a 6d 74 56 72 77 71 5a 61 71 74 74 61 6c 74 4e 54 75 70 5a 61 68 72 73 76 6f 6f 6e 53 64 72 64 48 74 6e 4a 62 6e 6d 6f 44 34 6b 35 50 75 6c 4a 65 56 70 38 33 73 6c 48 62 75 6a 70 47 56 6f 38 57 48 6f 39 47 52 6f 4d 4f 4e 6e 38 6e 31 68 34 6e 71 68 34 4c 73 68 49 64 38 6d 38 76 73 66 34 50 6f 66 6e 68 39 6b 38 4c 72 65 58 35 37 6b 63 44 65 66 7a 72 70 64 48 6e 72 64 48 6e 6a 64 6d 31 34 6a 73 44 77 63 58 4c 66 66 45 44 6f 63 6e 50 68 63 6c 2f 6f 62 58 46 70 69 38 4c 68 62 31 39 77 68 37 78 73 68 4c 70 72 67 37 6c 6f 67 63 54 6c 59 32 39 6d 66 73 50 6e 58 32 50 6e 58 47 4e 69 66 4c 5a 61 66 4c 72 6b 57 46 7a 66 57 6c 4a 62 64 62 7a 6d 55 6c 31 61 64 4c 48 6c 55 46 58 69 55 46 56 54 62 36 37 6c 53 31 44 67 54 46 48 65 52 30 78 50 61 4b Data Ascii: wtpSsutjmtVrwqZaqttaltNTupZahrsvoonSdrdHtnJbnmoD4k5PulJeVp83slHbujpGVo8WHo9GRoMONn8n1h4nqh4LshId8m8vsf4Pofnh9k8LreX57kcDefzrpdHnrdHnjdm14jsDwcXLffEDocnPhcl/obXFpi8Lhb19wh7xshLprg7logcTlY29mfsPnX2PnXGNifLZafLrkWFzfWlJbdbzmUl1adLHlUFXiUFVTb67lS1DgTFHeR0xPaK
2024-02-08 18:35:39 UTC	16384	IN	Data Raw: 7a 6a 66 4c 7a 52 59 55 56 48 55 4c 6a 4d 79 55 70 76 65 4b 69 39 66 54 78 54 65 4a 69 76 52 4b 6a 42 4e 55 68 70 4c 53 31 6a 64 49 69 6a 50 49 79 63 70 53 5a 58 63 48 69 4d 68 53 70 54 63 48 43 4c 4d 48 69 4d 65 51 70 51 66 51 59 34 62 51 4a 49 59 50 5a 45 61 50 49 73 52 4f 49 34 4e 4e 49 77 50 4d 6f 55 49 4d 49 6f 4b 4c 6f 46 6b 70 38 46 54 41 41 41 41 42 58 52 53 54 6c 4d 41 45 53 49 7a 52 4a 54 64 52 48 77 41 41 41 44 7a 53 55 52 42 56 42 67 5a 42 63 47 78 54 68 52 52 46 41 44 51 38 39 36 39 79 38 77 77 59 51 75 44 55 68 41 78 4d 62 48 68 41 34 68 66 34 72 66 61 53 63 63 66 55 46 42 6f 51 67 46 5a 54 44 59 55 69 37 4d 4d 7a 44 37 50 41 51 41 41 41 41 41 41 41 41 41 41 51 46 45 41 41 45 41 72 35 63 63 43 66 67 4b 75 67 46 39 5a 6c 6c 76 77 43 72 67 48 Data Ascii: zjfLzRYUVHULjMyUpveKi9fTxTeJivRKjBNUhpLS1jdIijPIycpSZXcHiMhSpTcHCLMHiMeQpQfQY4bQJIYPZEaPIsROI4NNIwPMoUIMIoKLoFkp8FTAAAABXRSTlMAESIzRJTdRHwAAADzSURBVBgZBcGxThRRFADQ8969y8wwYQuDUhAxMbHhA4hf4rfaSccfUFBoQgFZTDYUi7MMzD7PAQAAAAAAAAAAQFEAAEAr5ccCfgKugF9ZllvwCrgH
2024-02-08 18:35:39 UTC	16384	IN	Data Raw: 67 41 41 41 42 67 41 41 41 41 59 43 41 4d 41 41 41 44 58 71 63 33 4b 41 41 41 42 67 31 42 4d 56 45 58 2f 2f 2f 38 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 44 31 39 50 54 77 37 75 37 37 36 65 6e 39 39 68 33 35 34 65 48 6d 35 65 58 38 38 52 37 37 36 78 6a 37 36 78 54 37 36 68 37 72 35 68 58 35 33 78 6e 74 34 43 6a 73 33 69 54 74 30 31 2f 70 32 78 65 37 79 64 54 30 76 33 58 6d 79 52 6a 6d 77 6d 48 4f 76 36 69 50 30 4c 47 55 7a 61 2b 4e 79 61 75 74 76 61 6e 61 75 6b 33 79 73 68 70 34 78 71 46 2b 77 71 44 65 73 45 4f 44 77 5a 2f 79 71 79 4e 35 77 4a 74 75 77 35 70 74 76 5a 54 6b 6d 70 6c 6a 76 70 50 30 6d 6a 35 71 75 5a 43 51 72 5a 47 2f 6d 6f 33 78 69 34 36 77 6f 46 74 51 74 6f 58 33 68 49 70 5a 73 6f 52 58 72 34 4b 31 6b 6f 4c 73 67 6f 5a 67 71 34 48 76 Data Ascii: gAAABgAAAAYCAMAAADXqc3KAAABg1BMVEX///8AAAAAAAAAAAAAAAD19PTw7u776en99h354eHm5eX88R776xj76xT76h7r5hX53xnt4Cjs3iTt01/p2xe7ydT0v3XmyRjmwmHOv6iP0LGUza+Nyautvanauk3yshp4xqF+wqDesEODwZ/yqyN5wJtuw5ptvZTkmpljvpP0mj5quZCQrZG/mo3xi46woFtQtoX3hIpZsoRXr4K1koLsgoZgq4Hv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49814	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:39 UTC	1178	OUT	GET /logo?ver=1&sid=5171fc655664ddf74ab763a094523fb7&t=17074173311 HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLalZib7103qG%2BF6jNX4nY1OEBjrxAz9Ob8DEQBWTSqeRvOh6i7KV3uDpo7lfSd6A33jZhjYHawln8E0aqfSwxomTxD7gRkwilYph1WF73PdYDrYV%2FBds8KeGhbWuYLP5WRjHVQWXCaBnPp2c6UP9oiZIrDu36czsM%3D; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-
2024-02-08 18:35:39 UTC	780	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:39 GMT vary: User-Agent, Accept-Encoding set-cookie: BJS=-; domain=booking.com; expires=Fri, 09-Feb-2024 18:35:39 GMT; Secure; HTTPOnly strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=4e6f82bddc3c0066&e=UmFuZG9tSVYkc2RlIyh9YbpBYTW1tHKz-g1XlB_y0bcPgfH5KT6F5ieWQG0vQfWf x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 4a9f56098c7d51e12b8d2ac77b6f1bcc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 8bHWFCsowyFAInH6Zd3QcLgCXJJ8VbeMYpEEBX2c9GyHmdu8v60y4A==
2024-02-08 18:35:39 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49815	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:39 UTC	589	OUT	GET /psb/capla/static/js/c6a78acb.9b7b7bd0.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:39 UTC	681	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 10721 Connection: close Last-Modified: Mon, 05 Feb 2024 15:24:29 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: MhNiwsmIU72b8BK_eNSaw361wvLE7iAR Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 18:35:40 GMT ETag: "449f8abd0585d68506a1e46ad4a8bbad" Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront Via: 1.1 34411558fb3a23efdbbaaddb8a12b574.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: LD-cBbtz1GmFX60rhQ9r7wS7dV-cMA5XjWI-ZK0Wf9HPuDvuPlf1bQ== Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:39 UTC	10721	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 63 36 61 37 38 61 63 62 22 5d 2c 7b 22 30 37 33 39 30 64 64 62 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 41 29 7b 41 2e 72 28 74 29 2c 41 2e 64 28 74 2c 7b 64 65 66 61 75 6c 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 52 7d 7d 29 3b 76 61 72 20 6e 2c 61 2c 45 3d 41 28 22 65 61 64 37 31 65 62 30 22 29 2c 6c 3d 41 2e 6e 28 45 29 2c 69 3d 41 28 22 Data Ascii: "use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["c6a78acb"],{"07390ddb":function(e,t,A){A.r(t),A.d(t,{default:function(){return R}});var n,a,E=A("ead71eb0"),l=A.n(E),i=A("

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49816	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:39 UTC	589	OUT	GET /psb/capla/static/js/f50a2dfc.854e46ce.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:39 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 22573 Connection: close Date: Thu, 08 Feb 2024 11:31:02 GMT Last-Modified: Thu, 08 Feb 2024 10:31:47 GMT ETag: "16cef59d8ed8d631e974161b3405d558" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: cG2AdJvzFJaivaHGwS_vd7j4ON5X64Sy Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 d48a409d6a3222e2cc9a060d30206d3c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: RWhnWpVuPkIRUxl8p8qe8n1ZGzRbbFkz-4a5qgyAWnB7G6_h_FKGnQ== Age: 25478 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:39 UTC	15698	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 66 35 30 61 32 64 66 63 22 5d 2c 7b 22 32 32 62 30 66 33 37 63 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 69 3d 6e 28 22 33 36 37 39 34 36 38 65 22 29 3b 74 2e 5a 3d 69 2e 5a 7d 2c 22 34 33 62 65 64 64 38 34 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 70 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 Data Ascii: "use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["f50a2dfc"],{"22b0f37c":function(e,t,n){var i=n("3679468e");t.Z=i.Z},"43bedd84":function(e,t,n){n.d(t,{p:function(){return
2024-02-08 18:35:39 UTC	6875	IN	Data Raw: 3a 74 2c 74 69 74 6c 65 3a 22 67 65 78 5f 6d 5f 66 75 73 69 6f 6e 5f 69 6e 64 65 78 5f 62 61 6e 6e 65 72 5f 68 65 61 64 65 72 22 2c 73 75 62 74 69 74 6c 65 3a 22 67 65 78 5f 6d 5f 66 75 73 69 6f 6e 5f 69 6e 64 65 78 5f 62 61 6e 6e 65 72 5f 73 75 62 68 65 61 64 65 72 22 2c 69 6d 61 67 65 5f 75 72 6c 3a 5b 22 67 65 6e 69 75 73 5f 6c 6f 67 6f 22 5d 2c 69 6d 61 67 65 5f 64 65 73 69 67 6e 3a 5b 22 69 63 6f 6e 22 5d 2c 62 61 6e 6e 65 72 5f 61 63 74 69 6f 6e 3a 5b 7b 61 63 74 69 6f 6e 5f 69 6e 64 65 78 3a 30 2c 61 63 74 69 6f 6e 5f 75 72 6c 3a 65 2c 61 63 74 69 6f 6e 5f 74 65 78 74 3a 22 67 65 78 5f 6d 5f 66 75 73 69 6f 6e 5f 69 6e 64 65 78 5f 62 61 6e 6e 65 72 5f 63 74 61 22 2c 61 63 74 69 6f 6e 5f 74 79 70 65 3a 22 43 54 41 5f 72 65 64 69 72 65 63 74 22 7d 5d Data Ascii: :t,title:"gex_m_fusion_index_banner_header",subtitle:"gex_m_fusion_index_banner_subheader",image_url:["genius_logo"],image_design:["icon"],banner_action:[{action_index:0,action_url:e,action_text:"gex_m_fusion_index_banner_cta",action_type:"CTA_redirect"}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49817	104.18.131.236	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:39 UTC	557	OUT	GET /scripttemplates/202310.2.0/otBannerSdk.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:39 UTC	815	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:35:39 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Content-MD5: 3zwKFeg02sA5dMnkMN3c/A== Last-Modified: Tue, 05 Dec 2023 03:37:34 GMT x-ms-request-id: 9da7b195-801e-001e-0647-27d55b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 33154 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8525f9441fba2439-ATL
2024-02-08 18:35:39 UTC	554	IN	Data Raw: 37 63 36 66 0d 0a 2f 2a 2a 20 0a 20 2a 20 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 0a 20 2a 20 76 32 30 32 33 31 30 2e 32 2e 30 0a 20 2a 20 62 79 20 4f 6e 65 54 72 75 73 74 20 4c 4c 43 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 32 33 20 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 44 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 44 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 28 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 5b 5d 7d 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 74 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6f 20 69 6e Data Ascii: 7c6f/** * onetrust-banner-sdk * v202310.2.0 * by OneTrust LLC * Copyright 2023 */!function(){"use strict";var D=function(e,t){return(D=Object.setPrototypeOf\|\|({__proto__:[]}instanceof Array?function(e,t){e.__proto__=t}:function(e,t){for(var o in
2024-02-08 18:35:39 UTC	1369	IN	Data Raw: 6f 74 79 70 65 2c 6e 65 77 20 6f 29 7d 76 61 72 20 48 2c 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 28 46 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6f 3d 31 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6f 3c 6e 3b 6f 2b 2b 29 66 6f 72 28 76 61 72 20 72 20 69 6e 20 74 3d 61 72 67 75 6d 65 6e 74 73 5b 6f 5d 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 72 29 26 26 28 65 5b 72 5d 3d 74 5b 72 5d 29 3b 72 65 74 75 72 6e 20 65 7d 29 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 52 28 65 2c 73 2c 61 2c 6c 29 7b 72 65 74 75 72 6e 20 6e 65 Data Ascii: otype,new o)}var H,F=function(){return(F=Object.assign\|\|function(e){for(var t,o=1,n=arguments.length;o<n;o++)for(var r in t=arguments[o])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e}).apply(this,arguments)};function R(e,s,a,l){return ne
2024-02-08 18:35:39 UTC	1369	IN	Data Raw: 6c 2e 6c 61 62 65 6c 3c 61 5b 32 5d 29 29 7b 61 5b 32 5d 26 26 6c 2e 6f 70 73 2e 70 6f 70 28 29 2c 6c 2e 74 72 79 73 2e 70 6f 70 28 29 3b 63 6f 6e 74 69 6e 75 65 7d 6c 2e 6c 61 62 65 6c 3d 61 5b 32 5d 2c 6c 2e 6f 70 73 2e 70 75 73 68 28 74 29 7d 7d 74 3d 72 2e 63 61 6c 6c 28 6e 2c 6c 29 7d 63 61 74 63 68 28 65 29 7b 74 3d 5b 36 2c 65 5d 2c 73 3d 30 7d 66 69 6e 61 6c 6c 79 7b 69 3d 61 3d 30 7d 69 66 28 35 26 74 5b 30 5d 29 74 68 72 6f 77 20 74 5b 31 5d 3b 72 65 74 75 72 6e 7b 76 61 6c 75 65 3a 74 5b 30 5d 3f 74 5b 31 5d 3a 76 6f 69 64 20 30 2c 64 6f 6e 65 3a 21 30 7d 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 71 28 29 7b 66 6f 72 28 76 61 72 20 65 3d 30 2c 74 3d 30 2c 6f 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 74 3c 6f 3b 74 2b 2b 29 65 2b 3d 61 72 Data Ascii: l.label<a[2])){a[2]&&l.ops.pop(),l.trys.pop();continue}l.label=a[2],l.ops.push(t)}}t=r.call(n,l)}catch(e){t=[6,e],s=0}finally{i=a=0}if(5&t[0])throw t[1];return{value:t[0]?t[1]:void 0,done:!0}}}}function q(){for(var e=0,t=0,o=arguments.length;t<o;t++)e+=ar
2024-02-08 18:35:39 UTC	1369	IN	Data Raw: 63 65 6f 66 20 4b 29 72 65 74 75 72 6e 20 74 2e 5f 73 74 61 74 65 3d 33 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 76 6f 69 64 20 58 28 74 29 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6f 29 72 65 74 75 72 6e 20 76 6f 69 64 20 24 28 28 6e 3d 6f 2c 72 3d 65 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 61 70 70 6c 79 28 72 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2c 74 29 7d 74 2e 5f 73 74 61 74 65 3d 31 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 58 28 74 29 7d 63 61 74 63 68 28 65 29 7b 59 28 74 2c 65 29 7d 76 61 72 20 6e 2c 72 7d 66 75 6e 63 74 69 6f 6e 20 59 28 65 2c 74 29 7b 65 2e 5f 73 74 61 74 65 3d 32 2c 65 2e 5f 76 61 6c 75 65 3d 74 2c 58 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 58 28 65 29 7b 32 3d 3d 3d 65 2e 5f 73 74 61 74 65 26 26 30 3d 3d Data Ascii: ceof K)return t._state=3,t._value=e,void X(t);if("function"==typeof o)return void $((n=o,r=e,function(){n.apply(r,arguments)}),t)}t._state=1,t._value=e,X(t)}catch(e){Y(t,e)}var n,r}function Y(e,t){e._state=2,e._value=t,X(e)}function X(e){2===e._state&&0==
2024-02-08 18:35:39 UTC	1369	IN	Data Raw: 65 74 75 72 6e 20 76 6f 69 64 20 6e 2e 63 61 6c 6c 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 28 6f 2c 65 29 7d 2c 69 29 7d 73 5b 6f 5d 3d 65 2c 30 3d 3d 2d 2d 61 26 26 72 28 73 29 7d 63 61 74 63 68 28 65 29 7b 69 28 65 29 7d 7d 28 65 2c 73 5b 65 5d 29 7d 29 7d 2c 4b 2e 72 65 73 6f 6c 76 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 4b 3f 74 3a 6e 65 77 20 4b 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 28 74 29 7d 29 7d 2c 4b 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 4b 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 28 6f 29 7d 29 7d 2c 4b 2e 72 61 63 65 3d 66 75 6e 63 Data Ascii: eturn void n.call(e,function(e){t(o,e)},i)}s[o]=e,0==--a&&r(s)}catch(e){i(e)}}(e,s[e])})},K.resolve=function(t){return t&&"object"==typeof t&&t.constructor===K?t:new K(function(e){e(t)})},K.reject=function(o){return new K(function(e,t){t(o)})},K.race=func
2024-02-08 18:35:39 UTC	1369	IN	Data Raw: 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 7d 2c 5a 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 69 74 45 6e 64 73 57 69 74 68 50 6f 6c 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 64 73 57 69 74 68 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2c 22 65 6e 64 73 57 69 74 68 22 2c 7b 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 74 3e 74 68 69 73 2e 6c 65 6e 67 74 68 29 26 26 28 74 3d 74 68 69 73 2e 6c 65 6e 67 74 68 29 2c 74 68 69 73 2e 73 75 62 73 74 72 69 6e 67 28 74 2d 65 2e 6c 65 6e 67 74 68 2c 74 29 3d 3d 3d 65 7d 2c 77 72 69 74 61 62 6c 65 Data Ascii: e:!0,configurable:!0})},Z.prototype.initEndsWithPoly=function(){String.prototype.endsWith\|\|Object.defineProperty(String.prototype,"endsWith",{value:function(e,t){return(void 0===t\|\|t>this.length)&&(t=this.length),this.substring(t-e.length,t)===e},writable
2024-02-08 18:35:39 UTC	1369	IN	Data Raw: 2e 69 6e 69 74 41 72 72 61 79 46 69 6c 6c 50 6f 6c 79 66 69 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6c 6c 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2c 22 66 69 6c 6c 22 2c 7b 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 6e 75 6c 6c 3d 3d 74 68 69 73 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 74 68 69 73 20 69 73 20 6e 75 6c 6c 20 6f 72 20 6e 6f 74 20 64 65 66 69 6e 65 64 22 29 3b 66 6f 72 28 76 61 72 20 74 3d 4f 62 6a 65 63 74 28 74 68 69 73 29 2c 6f 3d 74 2e 6c 65 6e 67 74 68 3e 3e 3e 30 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3e 3e 30 2c 72 3d 6e 3c 30 3f 4d 61 74 68 2e 6d 61 78 Data Ascii: .initArrayFillPolyfill=function(){Array.prototype.fill\|\|Object.defineProperty(Array.prototype,"fill",{value:function(e){if(null==this)throw new TypeError("this is null or not defined");for(var t=Object(this),o=t.length>>>0,n=arguments[1]>>0,r=n<0?Math.max
2024-02-08 18:35:39 UTC	1369	IN	Data Raw: 65 5b 65 2e 43 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 69 6e 67 42 75 74 74 6f 6e 3d 36 5d 3d 22 43 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 69 6e 67 42 75 74 74 6f 6e 22 2c 28 65 3d 74 65 3d 74 65 7c 7c 7b 7d 29 5b 65 2e 42 61 6e 6e 65 72 3d 31 5d 3d 22 42 61 6e 6e 65 72 22 2c 65 5b 65 2e 50 43 3d 32 5d 3d 22 50 43 22 2c 65 5b 65 2e 41 50 49 3d 33 5d 3d 22 41 50 49 22 2c 28 65 3d 6f 65 3d 6f 65 7c 7c 7b 7d 29 2e 41 63 63 65 70 74 41 6c 6c 3d 22 41 63 63 65 70 74 41 6c 6c 22 2c 65 2e 52 65 6a 65 63 74 41 6c 6c 3d 22 52 65 6a 65 63 74 41 6c 6c 22 2c 65 2e 55 70 64 61 74 65 43 6f 6e 73 65 6e 74 3d 22 55 70 64 61 74 65 43 6f 6e 73 65 6e 74 22 2c 28 65 3d 6e 65 3d 6e 65 7c 7c 7b 7d 29 5b 65 2e 50 75 72 70 6f 73 65 3d 31 Data Ascii: e[e.ContinueWithoutAcceptingButton=6]="ContinueWithoutAcceptingButton",(e=te=te\|\|{})[e.Banner=1]="Banner",e[e.PC=2]="PC",e[e.API=3]="API",(e=oe=oe\|\|{}).AcceptAll="AcceptAll",e.RejectAll="RejectAll",e.UpdateConsent="UpdateConsent",(e=ne=ne\|\|{})[e.Purpose=1
2024-02-08 18:35:39 UTC	1369	IN	Data Raw: 6c 22 5d 3d 35 5d 3d 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 52 65 6a 65 63 74 20 41 6c 6c 22 2c 65 5b 65 5b 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 43 6f 6e 66 69 72 6d 22 5d 3d 36 5d 3d 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 43 6f 6e 66 69 72 6d 22 2c 65 5b 65 5b 22 47 50 43 20 76 61 6c 75 65 20 63 68 61 6e 67 65 64 22 5d 3d 37 5d 3d 22 47 50 43 20 76 61 6c 75 65 20 63 68 61 6e 67 65 64 22 2c 28 65 3d 67 65 3d 67 65 7c 7c 7b 7d 29 2e 41 63 74 69 76 65 3d 22 31 22 2c 65 2e 49 6e 41 63 74 69 76 65 3d 22 30 22 2c 28 65 3d 43 65 3d 43 65 7c 7c 7b 7d 29 2e 48 6f 73 74 3d 22 48 6f 73 74 22 2c 65 2e 47 65 6e 56 65 6e 64 6f 72 3d 22 47 65 6e 56 65 6e 22 2c 28 65 3d 79 65 3d 79 65 7c 7c 7b 7d Data Ascii: l"]=5]="Preference Center - Reject All",e[e["Preference Center - Confirm"]=6]="Preference Center - Confirm",e[e["GPC value changed"]=7]="GPC value changed",(e=ge=ge\|\|{}).Active="1",e.InActive="0",(e=Ce=Ce\|\|{}).Host="Host",e.GenVendor="GenVen",(e=ye=ye\|\|{}
2024-02-08 18:35:39 UTC	1369	IN	Data Raw: 7c 7b 7d 29 2e 67 72 61 6e 74 65 64 3d 22 67 72 61 6e 74 65 64 22 2c 65 2e 64 65 6e 69 65 64 3d 22 64 65 6e 69 65 64 22 2c 28 65 3d 4c 65 3d 4c 65 7c 7c 7b 7d 29 2e 4f 42 4a 45 43 54 5f 54 4f 5f 4c 49 3d 22 4f 62 6a 65 63 74 54 6f 4c 49 22 2c 65 2e 4c 49 5f 41 43 54 49 56 45 5f 49 46 5f 4c 45 47 41 4c 5f 42 41 53 49 53 3d 22 4c 49 41 63 74 69 76 65 49 66 4c 65 67 61 6c 42 61 73 69 73 22 2c 28 65 3d 5f 65 3d 5f 65 7c 7c 7b 7d 29 2e 63 6f 6f 6b 69 65 73 3d 22 63 6f 6f 6b 69 65 73 22 2c 65 2e 76 65 6e 64 6f 72 73 3d 22 76 65 6e 64 6f 72 73 22 2c 28 65 3d 56 65 3d 56 65 7c 7c 7b 7d 29 2e 47 44 50 52 3d 22 47 44 50 52 22 2c 65 2e 43 43 50 41 3d 22 43 43 50 41 22 2c 65 2e 49 41 42 32 3d 22 49 41 42 32 22 2c 65 2e 49 41 42 32 56 32 3d 22 49 41 42 32 56 32 22 2c Data Ascii: \|{}).granted="granted",e.denied="denied",(e=Le=Le\|\|{}).OBJECT_TO_LI="ObjectToLI",e.LI_ACTIVE_IF_LEGAL_BASIS="LIActiveIfLegalBasis",(e=_e=_e\|\|{}).cookies="cookies",e.vendors="vendors",(e=Ve=Ve\|\|{}).GDPR="GDPR",e.CCPA="CCPA",e.IAB2="IAB2",e.IAB2V2="IAB2V2",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49818	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:39 UTC	589	OUT	GET /psb/capla/static/js/a6a21c13.ad9f14d9.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:39 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 25872 Connection: close Date: Thu, 08 Feb 2024 13:16:37 GMT Last-Modified: Thu, 08 Feb 2024 11:37:54 GMT ETag: "16323cfbc6f714b70bb4777cc3449e90" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: kqN2G1a.LgAUJYnNTKfAE6M57bfozxMp Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 fcb94596db202c75ac0e559b3183be72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: CX70TholPhwNQNekSqxgese20veFGbs8UV3Rg_EU3im4J9jmB9TbZQ== Age: 19143 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:39 UTC	15698	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 61 36 61 32 31 63 31 33 22 5d 2c 7b 22 33 34 38 32 37 63 36 34 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 64 28 74 2c 7b 4d 36 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 2c 74 30 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 7d 29 3b 76 61 72 20 69 3d 6e 28 22 65 61 64 37 31 65 62 30 22 29 3b 6c 65 74 20 61 3d Data Ascii: "use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["a6a21c13"],{"34827c64":function(e,t,n){n.d(t,{M6:function(){return a},t0:function(){return r}});var i=n("ead71eb0");let a=
2024-02-08 18:35:39 UTC	10174	IN	Data Raw: 34 35 35 34 20 33 2e 30 35 30 31 33 30 33 20 34 2e 30 32 32 37 34 38 34 20 30 20 37 2e 30 35 38 39 37 33 35 2d 31 2e 37 33 37 36 37 30 34 20 39 2e 31 31 32 30 30 38 32 2d 35 2e 32 31 33 30 31 30 37 2e 32 32 36 36 33 33 37 2d 2e 33 36 38 32 39 32 34 2e 31 32 36 36 34 38 33 2d 2e 36 32 32 37 34 39 31 2d 2e 32 39 33 32 39 30 35 2d 2e 37 36 33 33 36 39 36 6c 2d 33 2e 36 32 39 34 37 32 33 2d 31 2e 35 32 36 37 33 39 32 63 2d 2e 33 36 36 36 31 33 33 2d 2e 31 36 37 34 30 35 38 2d 2e 36 33 33 32 34 31 33 2d 2e 31 32 37 32 32 38 34 2d 2e 38 30 33 32 31 36 36 2e 31 32 37 32 32 38 33 2d 31 2e 30 31 33 31 38 35 38 20 31 2e 35 38 33 36 35 36 39 2d 32 2e 34 37 32 39 37 33 35 20 32 2e 33 37 33 38 31 31 34 2d 34 2e 33 38 36 30 32 38 38 20 32 2e 33 37 33 38 31 31 34 2d 31 Data Ascii: 4554 3.0501303 4.0227484 0 7.0589735-1.7376704 9.1120082-5.2130107.2266337-.3682924.1266483-.6227491-.2932905-.7633696l-3.6294723-1.5267392c-.3666133-.1674058-.6332413-.1272284-.8032166.1272283-1.0131858 1.5836569-2.4729735 2.3738114-4.3860288 2.3738114-1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	49819	104.18.32.137	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:39 UTC	380	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:39 UTC	249	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:35:39 GMT Content-Type: text/javascript Content-Length: 79 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8525f944d8b544ee-ATL
2024-02-08 18:35:39 UTC	79	IN	Data Raw: 6a 73 6f 6e 46 65 65 64 28 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 47 41 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 47 65 6f 72 67 69 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d 29 3b Data Ascii: jsonFeed({"country":"US","state":"GA","stateName":"Georgia","continent":"NA"});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	49821	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:39 UTC	589	OUT	GET /psb/capla/static/js/f5d0e2e7.5cd38fd6.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:39 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 65226 Connection: close Last-Modified: Wed, 07 Feb 2024 09:32:56 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 6HKmc0VuwQiz3hwVRPEGNwP114NmNjqR Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 11:43:31 GMT ETag: "2a4be84facf3e21bb4a9ebb12a10a92e" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6f067a3fd6e721a7db2a2901701a65d8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: w-adKO8tir-HlGC-PkyLr1TU4WEMCFemskNI9tTKhEgYYOD342AaAQ== Age: 24729 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:39 UTC	15698	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 66 35 64 30 65 32 65 37 2e 35 63 64 33 38 66 64 36 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 66 35 64 30 65 32 65 37 22 5d 2c 7b 61 66 31 65 32 62 33 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 Data Ascii: /! For license information please see f5d0e2e7.5cd38fd6.chunk.js.LICENSE.txt /(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["f5d0e2e7"],{af1e2b38:function(e,t,n){"use strict";n.d(
2024-02-08 18:35:39 UTC	16384	IN	Data Raw: 2e 42 4f 4f 4b 49 4e 47 5f 50 52 4f 43 45 53 53 5f 32 3d 22 42 4f 4f 4b 49 4e 47 5f 50 52 4f 43 45 53 53 5f 32 22 2c 65 2e 43 4f 4e 46 49 52 4d 41 54 49 4f 4e 5f 50 41 47 45 3d 22 43 4f 4e 46 49 52 4d 41 54 49 4f 4e 5f 50 41 47 45 22 2c 65 2e 49 4e 44 45 58 3d 22 49 4e 44 45 58 22 2c 65 2e 4c 41 4e 44 49 4e 47 5f 50 41 47 45 3d 22 4c 41 4e 44 49 4e 47 5f 50 41 47 45 22 2c 65 2e 50 52 4f 50 45 52 54 59 5f 50 41 47 45 3d 22 50 52 4f 50 45 52 54 59 5f 50 41 47 45 22 2c 65 2e 52 4f 4f 4d 5f 44 45 54 41 49 4c 3d 22 52 4f 4f 4d 5f 44 45 54 41 49 4c 22 2c 65 2e 53 45 41 52 43 48 5f 52 45 53 55 4c 54 53 3d 22 53 45 41 52 43 48 5f 52 45 53 55 4c 54 53 22 2c 65 2e 57 41 4c 4c 45 54 3d 22 57 41 4c 4c 45 54 22 2c 65 7d 28 7b 7d 29 3b 76 61 72 20 49 3d 6e 28 22 61 62 Data Ascii: .BOOKING_PROCESS_2="BOOKING_PROCESS_2",e.CONFIRMATION_PAGE="CONFIRMATION_PAGE",e.INDEX="INDEX",e.LANDING_PAGE="LANDING_PAGE",e.PROPERTY_PAGE="PROPERTY_PAGE",e.ROOM_DETAIL="ROOM_DETAIL",e.SEARCH_RESULTS="SEARCH_RESULTS",e.WALLET="WALLET",e}({});var I=n("ab
2024-02-08 18:35:39 UTC	16384	IN	Data Raw: 6c 65 61 72 49 6e 74 65 72 76 61 6c 28 65 29 7d 7d 29 29 2c 69 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 6c 2c 73 74 79 6c 65 3a 7b 77 69 64 74 68 3a 60 24 7b 73 7d 70 78 60 7d 7d 2c 6d 3c 32 3f 74 3a 69 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 69 28 29 2e 46 72 61 67 6d 65 6e 74 2c 6e 75 6c 6c 2c 69 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 62 65 2e 73 6c 69 64 65 72 43 6f 6e 74 61 69 6e 65 72 2c 72 65 66 3a 4e 2c 73 74 79 6c 65 3a 62 7d 2c 69 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 61 65 28 29 28 62 65 2e 69 6e 6e 65 72 57 72 61 70 70 65 72 2c 64 26 26 62 65 2e 67 Data Ascii: learInterval(e)}})),i().createElement("div",{className:l,style:{width:`${s}px`}},m<2?t:i().createElement(i().Fragment,null,i().createElement("div",{className:be.sliderContainer,ref:N,style:b},i().createElement("div",{className:ae()(be.innerWrapper,d&&be.g
2024-02-08 18:35:39 UTC	16384	IN	Data Raw: 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 6c 65 6e 67 74 68 29 3b 72 65 74 75 72 6e 20 69 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 66 65 2e 64 66 2c 7b 74 72 69 67 67 65 72 4f 6e 63 65 3a 21 30 2c 6f 6e 43 68 61 6e 67 65 3a 65 3d 3e 7b 65 26 26 52 65 28 72 2c 6f 2c 22 76 69 65 77 22 2c 6c 29 7d 7d 2c 69 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 73 2e 42 6f 78 2c 7b 70 61 64 64 69 6e 67 3a 61 3f 34 3a 36 2c 63 6c 61 73 73 4e 61 6d 65 3a 61 65 28 29 28 61 26 26 77 65 2e 65 78 74 72 61 50 61 64 64 69 6e 67 2c 61 26 26 75 26 26 77 65 2e 64 6f 75 62 6c 65 45 78 74 72 61 50 61 64 64 69 6e 67 29 7d 2c 69 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 73 2e 53 74 61 63 6b 2c 7b 67 61 70 3a 36 2c 61 6c 69 67 6e 49 74 65 6d Data Ascii: void 0===t?void 0:t.length);return i().createElement(fe.df,{triggerOnce:!0,onChange:e=>{e&&Re(r,o,"view",l)}},i().createElement(s.Box,{padding:a?4:6,className:ae()(a&&we.extraPadding,a&&u&&we.doubleExtraPadding)},i().createElement(s.Stack,{gap:6,alignItem
2024-02-08 18:35:39 UTC	376	IN	Data Raw: 28 6e 29 3b 65 6c 73 65 20 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 6e 29 26 26 6e 2e 6c 65 6e 67 74 68 29 7b 76 61 72 20 6f 3d 69 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 6e 29 3b 6f 26 26 65 2e 70 75 73 68 28 6f 29 7d 65 6c 73 65 20 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 3d 72 29 66 6f 72 28 76 61 72 20 73 20 69 6e 20 6e 29 61 2e 63 61 6c 6c 28 6e 2c 73 29 26 26 6e 5b 73 5d 26 26 65 2e 70 75 73 68 28 73 29 7d 7d 72 65 74 75 72 6e 20 65 2e 6a 6f 69 6e 28 22 20 22 29 7d 65 2e 65 78 70 6f 72 74 73 3f 28 69 2e 64 65 66 61 75 6c 74 3d 69 2c 65 2e 65 78 70 6f 72 74 73 3d 69 29 3a 76 6f 69 64 20 30 3d 3d 3d 28 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 2e 61 70 70 6c 79 28 74 2c 5b 5d 29 29 7c 7c 28 65 2e 65 78 70 6f 72 74 73 3d 6e Data Ascii: (n);else if(Array.isArray(n)&&n.length){var o=i.apply(null,n);o&&e.push(o)}else if("object"===r)for(var s in n)a.call(n,s)&&n[s]&&e.push(s)}}return e.join(" ")}e.exports?(i.default=i,e.exports=i):void 0===(n=function(){return i}.apply(t,[]))\|\|(e.exports=n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	49822	3.161.150.72	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:39 UTC	1342	OUT	GET /privacy-consents/implicit HTTP/1.1 Host: account.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLalZib7103qG%2BF6jNX4nY1OEBjrxAz9Ob8DEQBWTSqeRvOh6i7KV3uDpo7lfSd6A33jZhjYHawln8E0aqfSwxomTxD7gRkwilYph1WF73PdYDrYV%2FBds8KeGhbWuYLP5WRjHVQWXCaBnPp2c6UP9oiZIrDu36czsM%3D; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; lastSeen=0; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJlNTJkY2Q1MS02OTliLTQ1ZTgtODA3MC03Y2M5MWE1NzM1NmIiLCJzZXNzaW9ucyI6W119fQ; bkng_sso_ses=e30; bkng_sso_session=e30
2024-02-08 18:35:39 UTC	2081	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: envoy date: Thu, 08 Feb 2024 18:35:39 GMT allow: POST, OPTIONS content-security-policy: frame-ancestors https://.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=142982bd01a7072f&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgShR9GX5SBfS4aI2tW2n5tOKAGiBz8eZ5qV-73Xb9dZCZuJQnbh2iDjOY1jMWjgVGA content-security-policy-report-only: base-uri 'none'; connect-src saa.booking.com secure.booking.com reports.booking.com privacyportal-eu.onetrust.com geolocation.onetrust.com cdn.cookielaw.org www.google-analytics.com .perimeterx.net .pxchk.net .px-cdn.net .px-client.net .px-cloud.net 'self' 'report-sample'; default-src .bstatic.com bstatic.com 'self'; frame-src https://www.youtube.com/embed/Vv4w5SmRkss .bstatic.com https://www.google.com bstatic.com www.booking.com secure.booking.com paymentcomponent.booking.com 'self'; img-src 'self' data: www.booking.com graph.facebook.com cdn.cookielaw.org account.booking.com .bstatic.com bstatic.com .static.booking.cn www.google-analytics.com www.google.com stats.g.doubleclick.net .px-cloud.net .perimeterx.net www.gstatic.com; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=213&pid=142982bd01a7072f&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgShR9GX5SBfS4aI2tW2n5tOKAGiBz8eZ5qV-73Xb9dZCZuJQnbh2iDjOY1jMWjgVGA; script-src saa.booking.com .bstatic.com bstatic.com .static.booking.cn www.google.com www.google-analytics.com cdn.cookielaw.org geolocation.onetrust.com 'self' 'nonce-t8gvTmiyCoxMeXr' 'report-sample'; style-src .bstatic.com bstatic.com .static.booking.cn 'self' 'unsafe-inline' x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Error from cloudfront Via: 1.1 5dd68152ee799c561e43fe80e1410678.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P5 X-Amz-Cf-Id: Pc5hMO46orTFGPbP_miDTpClKFCDfTnmyV4SstjehxI8uyrQGO8pSw==
2024-02-08 18:35:39 UTC	1638	IN	Data Raw: 36 35 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 2d 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 Data Ascii: 65f<!DOCTYPE html><html lang="en"><head><title>405 - Method Not Allowed</title><meta http-equiv="content-type" content="text/html; charset=utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta http-equiv="X-UA-Compat
2024-02-08 18:35:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	49824	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:39 UTC	589	OUT	GET /psb/capla/static/js/43e47265.79cb7ba8.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:39 UTC	687	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 123288 Connection: close Last-Modified: Mon, 05 Feb 2024 05:12:41 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 1SU53qvAzoG0jf.uBCltf1c9qVmTlcuE Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 13:16:37 GMT ETag: "7fce55aa3d0f49d490812a57bddd13c4" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 31113f2f23c4ce8a8af1d88a37137806.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 0-RAKW0rpqh8bAo2tpwqgku9CSJyYZSr8ZY6aX-Zm__wEXvdBddvbQ== Age: 19143 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:39 UTC	16384	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 34 33 65 34 37 32 36 35 22 5d 2c 7b 64 30 39 38 39 32 33 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 69 29 7b 69 2e 64 28 6e 2c 7b 42 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 7d 29 3b 76 61 72 20 74 3d 69 28 22 64 63 36 64 32 38 66 66 22 29 3b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 63 6f 6e 73 74 20 65 3d 28 30 2c 74 2e 67 65 74 52 65 71 75 Data Ascii: "use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["43e47265"],{d0989236:function(e,n,i){i.d(n,{B:function(){return a}});var t=i("dc6d28ff");function a(){const e=(0,t.getRequ
2024-02-08 18:35:39 UTC	16384	IN	Data Raw: 43 4c 49 43 4b 45 44 3d 22 61 73 73 69 73 74 61 6e 74 5f 63 6c 69 63 6b 65 64 22 2c 65 2e 43 55 52 52 45 4e 43 59 5f 50 49 43 4b 45 52 5f 4f 50 45 4e 3d 22 63 75 72 72 65 6e 63 79 2d 70 69 63 6b 65 72 5f 6f 70 65 6e 22 2c 65 2e 43 55 52 52 45 4e 43 59 5f 50 49 43 4b 45 52 5f 43 4c 4f 53 45 3d 22 63 75 72 72 65 6e 63 79 2d 70 69 63 6b 65 72 5f 63 6c 6f 73 65 22 7d 28 61 7c 7c 28 61 3d 7b 7d 29 29 3b 63 6f 6e 73 74 20 4f 3d 65 3d 3e 22 70 72 6f 64 22 3d 3d 3d 65 2e 67 65 74 42 50 6c 61 74 66 6f 72 6d 45 6e 76 69 72 6f 6e 6d 65 6e 74 28 29 2c 50 3d 65 3d 3e 21 4f 28 65 29 3b 76 61 72 20 44 3d 69 28 22 30 31 37 37 32 35 62 33 22 29 2c 62 3d 69 28 22 64 30 39 38 39 32 33 36 22 29 3b 6c 65 74 20 4d 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 Data Ascii: CLICKED="assistant_clicked",e.CURRENCY_PICKER_OPEN="currency-picker_open",e.CURRENCY_PICKER_CLOSE="currency-picker_close"}(a\|\|(a={}));const O=e=>"prod"===e.getBPlatformEnvironment(),P=e=>!O(e);var D=i("017725b3"),b=i("d0989236");let M=function(e){return e
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 76 61 6c 75 65 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 5d 7d 7d 5d 7d 7d 2c 7b 6b 69 6e 64 3a 22 49 6e 6c 69 6e 65 46 72 61 67 6d 65 6e 74 22 2c 74 79 70 65 43 6f 6e 64 69 74 69 6f 6e 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 64 54 79 70 65 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 44 69 72 65 63 74 4c 69 6e 6b 4c 61 6e 64 69 6e 67 22 7d 7d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 Data Ascii: ,{kind:"Field",name:{kind:"Name",value:"value"},arguments:[],directives:[]}]}}]}},{kind:"InlineFragment",typeCondition:{kind:"NamedType",name:{kind:"Name",value:"DirectLinkLanding"}},directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"Field
2024-02-08 18:35:40 UTC	14808	IN	Data Raw: 28 75 2e 65 78 70 60 48 4d 62 4f 48 4e 46 50 42 4a 59 49 59 4b 63 50 4e 53 4e 48 52 55 65 42 4f 46 4f 60 2c 34 29 2c 78 28 69 3f 4d 2e 43 6f 6c 6c 61 70 73 65 3a 4d 2e 45 78 70 61 6e 64 2c 65 29 2c 7b 2e 2e 2e 6e 2c 5b 65 5d 3a 21 6e 5b 65 5d 7d 7d 29 29 7d 29 28 6e 29 7d 29 29 29 7d 29 29 29 29 3a 6e 75 6c 6c 7d 3b 76 61 72 20 43 65 3d 69 28 22 65 33 32 65 63 65 65 37 22 29 2c 41 65 3d 69 2e 6e 28 43 65 29 2c 52 65 3d 69 28 22 32 37 66 65 30 35 32 38 22 29 3b 76 61 72 20 4c 65 3d 28 29 3d 3e 7b 63 6f 6e 73 74 20 65 3d 28 30 2c 6c 2e 69 73 46 65 61 74 75 72 65 52 75 6e 6e 69 6e 67 29 28 6c 2e 66 65 61 74 75 72 65 60 59 54 54 48 62 58 4e 4c 52 5a 52 45 65 43 46 5a 41 63 62 52 62 52 4f 66 4c 4d 65 49 61 44 4a 64 44 42 4b 43 60 29 2c 6e 3d 28 30 2c 52 65 2e Data Ascii: (u.exp`HMbOHNFPBJYIYKcPNSNHRUeBOFO`,4),x(i?M.Collapse:M.Expand,e),{...n,[e]:!n[e]}}))})(n)})))})))):null};var Ce=i("e32ecee7"),Ae=i.n(Ce),Re=i("27fe0528");var Le=()=>{const e=(0,l.isFeatureRunning)(l.feature`YTTHbXNLRZREeCFZAcbRbROfLMeIaDJdDBKC`),n=(0,Re.
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 63 61 6d 70 61 69 67 6e 45 6e 64 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 5d 7d 7d 5d 7d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 73 69 67 6e 61 74 75 72 65 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 62 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 Data Ascii: e:{kind:"Name",value:"campaignEnd"},arguments:[],directives:[]}]}}]}},{kind:"Field",name:{kind:"Name",value:"signature"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"backgroundImage"},arguments:[],directives:[],selectionSet:{kind:"Se
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 65 3a 22 63 74 61 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 72 61 67 6d 65 6e 74 53 70 72 65 61 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 53 65 63 6f 6e 64 61 72 79 42 61 6e 6e 65 72 43 54 41 46 72 61 67 6d 65 6e 74 22 7d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 5d 7d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 69 6d 61 67 65 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 Data Ascii: e:"cta"},arguments:[],directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"FragmentSpread",name:{kind:"Name",value:"SecondaryBannerCTAFragment"},directives:[]}]}},{kind:"Field",name:{kind:"Name",value:"image"},arguments:[],directives:[],sele
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 66 69 6c 74 65 72 73 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 6e 61 6d 65 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 76 61 6c 75 65 22 Data Ascii: irectives:[]},{kind:"Field",name:{kind:"Name",value:"filters"},arguments:[],directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"Field",name:{kind:"Name",value:"name"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"value"
2024-02-08 18:35:40 UTC	10176	IN	Data Raw: 37 2c 74 6f 3a 38 2c 63 6f 70 79 3a 28 30 2c 61 2e 74 29 28 22 72 65 76 69 65 77 5f 61 64 6a 5f 67 6f 6f 64 22 29 7d 2c 7b 66 72 6f 6d 3a 38 2c 74 6f 3a 38 2e 36 2c 63 6f 70 79 3a 28 30 2c 61 2e 74 29 28 22 72 65 76 69 65 77 5f 61 64 6a 5f 76 65 72 79 5f 67 6f 6f 64 22 29 7d 2c 7b 66 72 6f 6d 3a 38 2e 36 2c 74 6f 3a 39 2c 63 6f 70 79 3a 28 30 2c 61 2e 74 29 28 22 72 65 76 69 65 77 5f 61 64 6a 5f 66 61 62 75 6c 6f 75 73 22 29 7d 2c 7b 66 72 6f 6d 3a 39 2c 74 6f 3a 39 2e 35 2c 63 6f 70 79 3a 28 30 2c 61 2e 74 29 28 22 72 65 76 69 65 77 5f 61 64 6a 5f 73 75 70 65 72 62 22 29 7d 2c 7b 66 72 6f 6d 3a 39 2e 35 2c 74 6f 3a 6e 75 6c 6c 2c 63 6f 70 79 3a 28 30 2c 61 2e 74 29 28 22 72 65 76 69 65 77 5f 61 64 6a 5f 65 78 63 65 70 74 69 6f 6e 61 6c 22 29 7d 5d 3b 66 Data Ascii: 7,to:8,copy:(0,a.t)("review_adj_good")},{from:8,to:8.6,copy:(0,a.t)("review_adj_very_good")},{from:8.6,to:9,copy:(0,a.t)("review_adj_fabulous")},{from:9,to:9.5,copy:(0,a.t)("review_adj_superb")},{from:9.5,to:null,copy:(0,a.t)("review_adj_exceptional")}];f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49825	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:39 UTC	589	OUT	GET /psb/capla/static/js/d2a738da.35cba7bb.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:40 UTC	687	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 155082 Connection: close Last-Modified: Tue, 06 Feb 2024 10:33:56 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: psEU8QZUmatvf68kU4tSuAW8A3BMuh.z Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 12:32:55 GMT ETag: "1aa264da71f354aad6dce94f5a3374d9" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6f067a3fd6e721a7db2a2901701a65d8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: f4iiekX7RJcwyCWBoK9GgkSGaeOvibMvV4nwNkj3kSS4y7YXY-Kgqg== Age: 21765 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:40 UTC	15697	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 64 32 61 37 33 38 64 61 2e 33 35 63 62 61 37 62 62 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 64 32 61 37 33 38 64 61 22 5d 2c 7b 62 36 65 61 34 66 65 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 2e 64 28 Data Ascii: /! For license information please see d2a738da.35cba7bb.chunk.js.LICENSE.txt /(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["d2a738da"],{b6ea4fe7:function(e,n,t){"use strict";t.d(
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 39 65 31 31 32 31 39 36 33 22 2c 6b 3d 22 61 31 61 61 63 35 31 66 32 34 22 2c 67 3d 22 63 33 35 35 32 34 36 65 35 36 22 2c 5f 3d 22 65 34 35 36 38 35 31 31 33 38 22 2c 4e 3d 74 28 22 38 31 34 30 63 33 64 31 22 29 2c 53 3d 74 28 22 39 62 33 37 61 31 32 61 22 29 2c 45 3d 74 28 22 66 63 39 35 33 30 64 37 22 29 2c 70 3d 74 28 22 61 35 62 36 65 31 35 32 22 29 3b 63 6f 6e 73 74 20 66 3d 65 3d 3e 7b 6c 65 74 7b 62 61 6e 6e 65 72 49 64 3a 6e 2c 63 61 70 74 69 6f 6e 3a 74 2c 74 69 74 6c 65 46 69 72 73 74 4c 69 6e 65 3a 69 2c 74 69 74 6c 65 53 65 63 6f 6e 64 4c 69 6e 65 3a 61 2c 73 75 62 74 69 74 6c 65 3a 64 2c 63 74 61 3a 76 2c 62 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 3a 53 2c 63 6f 6e 74 61 69 6e 65 72 43 6c 61 73 73 4e 61 6d 65 3a 45 2c 63 6f 6c 6f 72 53 63 Data Ascii: 9e1121963",k="a1aac51f24",g="c355246e56",_="e456851138",N=t("8140c3d1"),S=t("9b37a12a"),E=t("fc9530d7"),p=t("a5b6e152");const f=e=>{let{bannerId:n,caption:t,titleFirstLine:i,titleSecondLine:a,subtitle:d,cta:v,backgroundImage:S,containerClassName:E,colorSc
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 42 67 22 3a 72 65 74 75 72 6e 28 28 65 2c 6e 29 3d 3e 7b 63 6f 6e 73 74 7b 63 61 70 74 69 6f 6e 3a 74 2c 74 69 74 6c 65 46 69 72 73 74 4c 69 6e 65 3a 69 2c 74 69 74 6c 65 53 65 63 6f 6e 64 4c 69 6e 65 3a 61 2c 73 75 62 74 69 74 6c 65 3a 72 2c 63 6f 6c 6f 72 53 63 68 65 6d 65 3a 64 2c 63 74 61 3a 6f 7d 3d 6e 3b 72 65 74 75 72 6e 7b 74 79 70 65 3a 22 73 6f 6c 69 64 22 2c 62 61 6e 6e 65 72 49 64 3a 65 2c 63 61 70 74 69 6f 6e 3a 4c 28 74 29 2c 74 69 74 6c 65 46 69 72 73 74 4c 69 6e 65 3a 69 2c 74 69 74 6c 65 53 65 63 6f 6e 64 4c 69 6e 65 3a 61 7c 7c 76 6f 69 64 20 30 2c 73 75 62 74 69 74 6c 65 3a 72 7c 7c 76 6f 69 64 20 30 2c 63 74 61 3a 52 28 6f 29 2c 63 6f 6c 6f 72 53 63 68 65 6d 65 3a 64 7d 7d 29 28 72 2c 61 29 3b 63 61 73 65 22 44 65 73 6b 74 6f 70 48 65 Data Ascii: Bg":return((e,n)=>{const{caption:t,titleFirstLine:i,titleSecondLine:a,subtitle:r,colorScheme:d,cta:o}=n;return{type:"solid",bannerId:e,caption:L(t),titleFirstLine:i,titleSecondLine:a\|\|void 0,subtitle:r\|\|void 0,cta:R(o),colorScheme:d}})(r,a);case"DesktopHe
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 63 61 70 74 69 6f 6e 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 49 6e 6c 69 6e 65 46 72 61 67 6d 65 6e 74 22 2c 74 79 70 65 43 6f 6e 64 69 74 69 6f 6e 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 64 54 79 70 65 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 48 65 72 6f 54 65 78 74 43 61 70 74 69 6f 6e 22 7d 7d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 Data Ascii: ,name:{kind:"Name",value:"caption"},arguments:[],directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"InlineFragment",typeCondition:{kind:"NamedType",name:{kind:"Name",value:"HeroTextCaption"}},directives:[],selectionSet:{kind:"SelectionSet"
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 43 61 70 74 69 6f 6e 22 7d 7d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 74 65 78 74 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 5d 7d 7d 2c 7b 6b 69 6e 64 3a 22 49 6e 6c 69 6e 65 46 72 61 67 6d 65 6e 74 22 2c 74 79 70 65 43 6f 6e 64 69 74 69 6f 6e 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 64 54 79 70 65 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 53 65 63 6f 6e 64 61 72 79 42 61 6e 6e 65 72 43 6f 75 6e 74 64 6f 77 6e 43 61 70 Data Ascii: Caption"}},directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"Field",name:{kind:"Name",value:"text"},arguments:[],directives:[]}]}},{kind:"InlineFragment",typeCondition:{kind:"NamedType",name:{kind:"Name",value:"SecondaryBannerCountdownCap
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 75 72 6c 50 61 74 68 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 71 75 65 72 79 50 61 72 61 6d 73 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 Data Ascii: ,directives:[]},{kind:"Field",name:{kind:"Name",value:"urlPath"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"queryParams"},arguments:[],directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"Field",name:{kind:"Name",valu
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 2e 2e 2e 47 6c 6f 62 61 6c 41 6c 65 72 74 73 4d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 5c 6e 20 20 20 20 20 20 20 20 7d 5c 6e 20 20 20 20 20 20 7d 5c 6e 20 20 20 20 7d 5c 6e 20 20 7d 5c 6e 20 20 5c 6e 20 20 5c 6e 20 20 5c 6e 20 20 5c 6e 22 2c 6e 61 6d 65 3a 22 47 72 61 70 68 51 4c 20 72 65 71 75 65 73 74 22 2c 6c 6f 63 61 74 69 6f 6e 4f 66 66 73 65 74 3a 7b 6c 69 6e 65 3a 31 2c 63 6f 6c 75 6d 6e 3a 31 7d 7d 7d 7d 3b 76 61 72 20 76 3d 74 28 22 32 62 62 33 36 38 35 62 22 29 2c 6b 3d 74 28 22 34 39 33 33 61 33 65 37 22 29 2c 67 3d 74 28 22 30 32 65 66 38 32 62 61 22 29 2c 5f 3d 74 28 22 30 34 66 63 66 34 66 39 22 29 3b 63 6f 6e 73 74 20 4e 3d 28 29 3d 3e 67 2e 47 63 3f 5b 5f 2e 4a 2e 47 4c 4f 42 41 4c 5f 41 4c 45 52 54 53 2c 5f Data Ascii: ...GlobalAlertsMerchComponents\n }\n }\n }\n }\n \n \n \n \n",name:"GraphQL request",locationOffset:{line:1,column:1}}}};var v=t("2bb3685b"),k=t("4933a3e7"),g=t("02ef82ba"),_=t("04fcf4f9");const N=()=>g.Gc?[_.J.GLOBAL_ALERTS,_
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 28 69 2e 70 61 67 65 3d 7b 70 61 67 65 5f 72 65 66 65 72 72 65 72 3a 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 2c 70 61 67 65 5f 75 72 6c 3a 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2c 70 61 67 65 5f 74 69 74 6c 65 3a 64 6f 63 75 6d 65 6e 74 2e 74 69 74 6c 65 7d 2c 69 2e 77 65 62 3d 7b 62 72 6f 77 73 65 72 5f 6c 61 6e 67 75 61 67 65 3a 77 69 6e 64 6f 77 2e 6e 61 76 69 67 61 74 6f 72 2e 6c 61 6e 67 75 61 67 65 7d 29 3b 63 6f 6e 73 74 20 61 3d 7b 74 72 61 63 6b 65 72 5f 6e 61 6d 65 3a 22 43 33 36 30 52 65 61 63 74 54 72 61 63 6b 65 72 22 2c 74 72 61 63 6b 65 72 5f 74 79 70 65 3a 22 43 6c 69 65 6e 74 22 2c 74 72 61 63 6b 65 72 5f 76 65 72 73 69 6f 6e 3a 22 30 2e 31 2e 30 22 7d 3b 72 65 74 75 Data Ascii: peof window&&(i.page={page_referrer:document.referrer,page_url:window.location.href,page_title:document.title},i.web={browser_language:window.navigator.language});const a={tracker_name:"C360ReactTracker",tracker_type:"Client",tracker_version:"0.1.0"};retu
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 28 29 7b 63 6f 6e 73 74 20 65 3d 6b 6e 2c 6e 3d 71 6e 28 62 6e 2e 54 52 41 56 45 4c 4c 49 4e 47 5f 46 4f 52 5f 57 4f 52 4b 29 3b 72 65 74 75 72 6e 20 4c 6e 28 6e 29 26 26 6e 21 3d 3d 67 6e 3f 6e 3a 28 55 65 28 73 65 29 2c 65 29 7d 28 29 29 3d 3d 3d 4f 6e 2e 42 55 53 49 4e 45 53 53 3f 53 6e 3a 45 6e 7d 66 75 6e 63 74 69 6f 6e 20 4e 74 28 29 7b 63 6f 6e 73 74 20 65 3d 71 6e 28 62 6e 2e 48 4f 54 45 4c 5f 43 4c 41 53 53 29 3b 72 65 74 75 72 6e 20 4c 6e 28 65 29 26 26 65 21 3d 3d 67 6e 3f 65 3a 28 55 65 28 75 65 29 2c 6b 6e 29 7d 66 75 6e 63 74 69 6f 6e 20 53 74 28 29 7b 63 6f 6e 73 74 20 65 3d 71 6e 28 62 6e 2e 48 4f 54 45 4c 5f 49 44 29 3b 72 65 74 75 72 6e 20 4c 6e 28 65 29 26 26 65 21 3d 3d 67 6e 7c 7c 55 65 28 6d 65 29 2c 65 7d 66 75 6e 63 74 69 6f 6e 20 Data Ascii: (){const e=kn,n=qn(bn.TRAVELLING_FOR_WORK);return Ln(n)&&n!==gn?n:(Ue(se),e)}())===On.BUSINESS?Sn:En}function Nt(){const e=qn(bn.HOTEL_CLASS);return Ln(e)&&e!==gn?e:(Ue(ue),kn)}function St(){const e=qn(bn.HOTEL_ID);return Ln(e)&&e!==gn\|\|Ue(me),e}function
2024-02-08 18:35:40 UTC	8313	IN	Data Raw: 44 45 54 41 49 4c 53 5d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 7a 6e 28 29 21 3d 3d 79 6e 2e 50 52 4f 50 45 52 54 59 29 72 65 74 75 72 6e 20 4d 65 28 79 29 2c 7b 65 76 65 6e 74 3a 6e 6e 2e 4e 4f 5f 4f 50 2c 74 73 6d 70 3a 70 6e 28 29 7d 3b 63 6f 6e 73 74 7b 73 74 61 74 65 3a 6e 7d 3d 65 3b 69 66 28 21 4c 6e 28 6e 29 29 72 65 74 75 72 6e 20 4d 65 28 60 24 7b 46 7d 20 70 72 6f 63 65 73 73 53 65 61 72 63 68 43 68 61 6e 67 65 44 65 74 61 69 6c 73 54 53 60 29 2c 7b 65 76 65 6e 74 3a 6e 6e 2e 4e 4f 5f 4f 50 2c 74 73 6d 70 3a 70 6e 28 29 7d 3b 63 6f 6e 73 74 7b 64 61 74 65 3a 74 2c 6f 63 63 75 70 61 6e 63 79 3a 69 7d 3d 6e 3b 6c 65 74 20 61 3d 6b 6e 2c 72 3d 6b 6e 2c 64 3d 6b 6e 2c 6f 3d 6b 6e 2c 6c 3d 6b 6e 2c 73 3d 6b 6e 2c 63 3d 6b 6e 2c 75 3d 6b 6e Data Ascii: DETAILS]:function(e){if(zn()!==yn.PROPERTY)return Me(y),{event:nn.NO_OP,tsmp:pn()};const{state:n}=e;if(!Ln(n))return Me(`${F} processSearchChangeDetailsTS`),{event:nn.NO_OP,tsmp:pn()};const{date:t,occupancy:i}=n;let a=kn,r=kn,d=kn,o=kn,l=kn,s=kn,c=kn,u=kn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	49826	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:39 UTC	589	OUT	GET /psb/capla/static/js/1baf5a63.d24b4ba9.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:40 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 83384 Connection: close Date: Thu, 08 Feb 2024 13:52:56 GMT Last-Modified: Mon, 05 Feb 2024 10:15:48 GMT ETag: "83471831394c7500698de10f9ea84aef" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: wh_1G0O1iiSKVXYIf482VPbMabQkhROS Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 25d9b5959eaa82bb18ee3f35e6bf34b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: UYMh_33ifD_4bXemP8WEwVo_11NaCWaHA-ANOTHEJZQkZOs9h82fDg== Age: 16964 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:40 UTC	15698	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 31 62 61 66 35 61 36 33 2e 64 32 34 62 34 62 61 39 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 31 62 61 66 35 61 36 33 22 5d 2c 7b 62 63 61 31 31 34 31 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 Data Ascii: /! For license information please see 1baf5a63.d24b4ba9.chunk.js.LICENSE.txt /(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["1baf5a63"],{bca1141e:function(e,t,n){"use strict";var
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 2d 32 2e 32 35 68 2d 31 35 41 32 2e 32 35 20 32 2e 32 35 20 30 20 30 20 30 20 32 2e 32 35 20 34 2e 35 76 36 2e 37 35 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 31 2e 35 20 30 56 34 2e 35 61 2e 37 35 2e 37 35 20 30 20 30 20 31 20 2e 37 35 2d 2e 37 35 68 31 35 61 2e 37 35 2e 37 35 20 30 20 30 20 31 20 2e 37 35 2e 37 35 76 36 2e 37 35 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 31 2e 35 20 30 7a 6d 2d 31 33 2e 32 35 2d 33 68 37 61 2e 32 35 2e 32 35 20 30 20 30 20 31 20 2e 32 35 2e 32 35 76 32 2e 37 35 6c 2e 37 35 2d 2e 37 35 68 2d 39 6c 2e 37 35 2e 37 35 56 38 2e 35 61 2e 32 35 2e 32 35 20 30 20 30 20 31 20 2e 32 35 2d 2e 32 35 7a 6d 30 2d 31 2e 35 41 31 2e 37 35 20 31 2e 37 35 20 30 20 30 20 30 20 36 2e 37 35 20 38 2e 35 76 32 2e 37 35 63 30 20 2e 34 31 34 2e Data Ascii: -2.25h-15A2.25 2.25 0 0 0 2.25 4.5v6.75a.75.75 0 0 0 1.5 0V4.5a.75.75 0 0 1 .75-.75h15a.75.75 0 0 1 .75.75v6.75a.75.75 0 0 0 1.5 0zm-13.25-3h7a.25.25 0 0 1 .25.25v2.75l.75-.75h-9l.75.75V8.5a.25.25 0 0 1 .25-.25zm0-1.5A1.75 1.75 0 0 0 6.75 8.5v2.75c0 .414.
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 72 65 74 75 72 6e 20 6d 7d 2c 63 62 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 52 7d 2c 63 63 58 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 44 7d 2c 65 4f 4d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 45 7d 2c 6a 76 69 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 41 7d 2c 6d 56 54 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 73 7d 2c 6e 4e 33 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 2c 70 5a 78 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 68 7d 2c 73 61 5f 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 7d 2c 73 6d 4f 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4e 7d 2c 76 41 77 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 Data Ascii: return m},cbr:function(){return R},ccX:function(){return D},eOM:function(){return E},jvi:function(){return A},mVT:function(){return s},nN3:function(){return o},pZx:function(){return h},sa_:function(){return l},smO:function(){return N},vAw:function(){retur
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 5f 69 64 22 2c 53 74 72 69 6e 67 28 74 2e 64 74 73 6c 49 64 29 29 2c 61 2e 73 65 74 28 22 64 74 73 6c 5f 74 79 70 65 22 2c 74 2e 64 74 73 6c 54 79 70 65 29 29 2c 22 75 63 66 61 63 22 69 6e 20 74 26 26 74 2e 75 63 66 61 63 26 26 61 2e 73 65 74 28 22 75 63 66 61 63 22 2c 74 2e 75 63 66 61 63 29 2c 22 75 63 66 67 66 66 22 69 6e 20 74 26 26 74 2e 75 63 66 67 66 66 26 26 61 2e 73 65 74 28 22 75 63 66 67 66 66 22 2c 74 2e 75 63 66 67 66 66 29 3b 63 6f 6e 73 74 20 6c 3d 22 69 73 4e 61 74 69 76 65 41 64 22 69 6e 20 74 26 26 74 2e 69 73 4e 61 74 69 76 65 41 64 2c 75 3d 22 6e 61 74 69 76 65 41 64 49 64 22 69 6e 20 74 26 26 74 2e 6e 61 74 69 76 65 41 64 49 64 2c 64 3d 22 6e 61 74 69 76 65 41 64 73 43 70 63 22 69 6e 20 74 26 26 74 2e 6e 61 74 69 76 65 41 64 73 43 70 Data Ascii: _id",String(t.dtslId)),a.set("dtsl_type",t.dtslType)),"ucfac"in t&&t.ucfac&&a.set("ucfac",t.ucfac),"ucfgff"in t&&t.ucfgff&&a.set("ucfgff",t.ucfgff);const l="isNativeAd"in t&&t.isNativeAd,u="nativeAdId"in t&&t.nativeAdId,d="nativeAdsCpc"in t&&t.nativeAdsCp
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 2c 46 49 4c 54 45 52 5f 42 45 41 43 48 5f 41 43 43 45 53 53 5f 46 41 43 49 4c 49 54 59 3a 22 42 65 61 63 68 41 63 63 65 73 73 46 61 63 69 6c 69 74 79 46 69 6c 74 65 72 22 2c 46 49 4c 54 45 52 5f 53 55 53 54 41 49 4e 41 42 4c 45 5f 50 52 4f 50 45 52 54 59 3a 22 53 75 73 74 61 69 6e 61 62 6c 65 50 72 6f 70 65 72 74 79 46 69 6c 74 65 72 22 2c 46 49 4c 54 45 52 5f 53 55 53 54 41 49 4e 41 42 4c 45 5f 4c 45 56 45 4c 5f 50 52 4f 50 45 52 54 59 3a 22 53 75 73 74 61 69 6e 61 62 6c 65 50 72 6f 70 65 72 74 79 4c 65 76 65 6c 46 69 6c 74 65 72 22 2c 46 49 4c 54 45 52 5f 54 48 41 49 5f 50 41 53 53 3a 22 74 68 61 69 5f 70 61 73 73 22 2c 46 49 4c 54 45 52 5f 55 4e 49 54 5f 43 4f 4e 46 49 47 3a 22 75 6e 69 74 5f 63 6f 6e 66 69 67 5f 67 72 6f 75 70 65 64 22 2c 46 49 4c 54 Data Ascii: ,FILTER_BEACH_ACCESS_FACILITY:"BeachAccessFacilityFilter",FILTER_SUSTAINABLE_PROPERTY:"SustainablePropertyFilter",FILTER_SUSTAINABLE_LEVEL_PROPERTY:"SustainablePropertyLevelFilter",FILTER_THAI_PASS:"thai_pass",FILTER_UNIT_CONFIG:"unit_config_grouped",FILT
2024-02-08 18:35:40 UTC	2150	IN	Data Raw: 69 73 2e 69 6e 69 74 28 29 2c 45 26 26 21 30 21 3d 3d 45 26 26 28 74 68 69 73 2e 24 4c 3d 74 68 69 73 2e 6c 6f 63 61 6c 65 28 45 29 2e 24 4c 29 2c 64 26 26 6e 21 3d 3d 74 68 69 73 2e 66 6f 72 6d 61 74 28 73 29 26 26 28 74 68 69 73 2e 24 64 3d 6e 65 77 20 44 61 74 65 28 22 22 29 29 7d 65 6c 73 65 20 69 66 28 73 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 66 6f 72 28 76 61 72 20 5f 3d 73 2e 6c 65 6e 67 74 68 2c 66 3d 31 3b 66 3c 3d 5f 3b 66 2b 3d 31 29 7b 6f 5b 31 5d 3d 73 5b 66 2d 31 5d 3b 76 61 72 20 6d 3d 72 2e 61 70 70 6c 79 28 74 68 69 73 2c 6f 29 3b 69 66 28 6d 2e 69 73 56 61 6c 69 64 28 29 29 7b 74 68 69 73 2e 24 64 3d 6d 2e 24 64 2c 74 68 69 73 2e 24 4c 3d 6d 2e 24 4c 2c 74 68 69 73 2e 69 6e 69 74 28 29 3b 62 72 65 61 6b 7d 66 3d 3d 3d 5f Data Ascii: is.init(),E&&!0!==E&&(this.$L=this.locale(E).$L),d&&n!==this.format(s)&&(this.$d=new Date(""))}else if(s instanceof Array)for(var _=s.length,f=1;f<=_;f+=1){o[1]=s[f-1];var m=r.apply(this,o);if(m.isValid()){this.$d=m.$d,this.$L=m.$L,this.init();break}f===_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	49827	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:39 UTC	589	OUT	GET /psb/capla/static/js/4e596c2c.d3513b52.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:40 UTC	687	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 870116 Connection: close Date: Thu, 08 Feb 2024 14:47:07 GMT Last-Modified: Thu, 08 Feb 2024 14:16:47 GMT ETag: "cbed6c40f80b88278fe92b7987f24d10" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: N9Nsx4DgMqmKhaYxp1E50bp1h3vfmgas Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 f4c38e024a95b76a27c9f3dc9ff2eda6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: S-8hFlHSMPNwJCOP-hjEgMW8_dXBc_ueGn5L1C-8AgHibov5Dg4S2w== Age: 13714 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 34 65 35 39 36 63 32 63 22 2c 22 36 34 63 61 33 36 36 39 22 2c 22 62 38 63 63 34 35 32 64 22 2c 22 35 65 61 63 66 35 30 64 22 2c 22 63 35 38 64 39 34 35 35 22 5d 2c 7b 22 35 31 61 33 38 38 63 33 22 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 65 2c 74 29 7b 76 61 72 20 6e 3d 74 28 22 36 65 38 62 34 30 37 32 22 29 3b 65 2e 5a 3d 6e 2e 5a 7d 2c 22 34 34 66 30 61 36 66 38 22 Data Ascii: "use strict";(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["4e596c2c","64ca3669","b8cc452d","5eacf50d","c58d9455"],{"51a388c3":function(a,e,t){var n=t("6e8b4072");e.Z=n.Z},"44f0a6f8"
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 6f 78 3a 22 30 20 30 20 31 32 38 20 31 32 38 22 7d 2c 6e 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 38 37 2e 33 33 20 36 36 2e 32 32 63 2e 30 36 2d 2e 31 2e 31 31 2d 2e 32 2e 31 36 2d 2e 33 2e 30 37 37 2d 2e 31 32 35 2e 31 34 33 2d 2e 32 35 35 2e 32 2d 2e 33 39 2e 30 35 34 2d 2e 31 33 33 2e 30 39 37 2d 2e 32 37 2e 31 33 2d 2e 34 31 2e 30 34 2d 2e 31 31 32 2e 30 37 33 2d 2e 32 32 35 2e 31 2d 2e 33 34 2e 31 2d 2e 35 31 35 2e 31 2d 31 2e 30 34 35 20 30 2d 31 2e 35 36 61 33 2e 33 35 32 20 33 2e 33 35 32 20 30 20 30 20 30 2d 2e 31 2d 2e 33 34 20 32 2e 38 30 32 20 32 2e 38 30 32 20 30 20 30 20 30 2d 2e 31 33 2d 2e 34 31 20 32 2e 38 36 38 20 32 2e 38 36 38 20 30 20 30 20 30 2d 2e 32 2d 2e 33 39 63 30 2d 2e 31 2d 2e 31 2d 2e Data Ascii: ox:"0 0 128 128"},n.createElement("path",{d:"M87.33 66.22c.06-.1.11-.2.16-.3.077-.125.143-.255.2-.39.054-.133.097-.27.13-.41.04-.112.073-.225.1-.34.1-.515.1-1.045 0-1.56a3.352 3.352 0 0 0-.1-.34 2.802 2.802 0 0 0-.13-.41 2.868 2.868 0 0 0-.2-.39c0-.1-.1-.
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 74 75 72 6e 20 6e 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 76 67 22 2c 7b 78 6d 6c 6e 73 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 2c 76 69 65 77 42 6f 78 3a 22 30 20 30 20 32 34 20 32 34 22 7d 2c 6e 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 31 33 2e 33 34 38 20 31 35 2e 30 34 37 6c 32 2e 35 34 35 2d 32 2e 35 34 35 2d 2e 37 32 34 2e 31 39 34 20 31 2e 37 35 32 2e 34 37 61 32 2e 33 32 32 20 32 2e 33 32 32 20 30 20 30 20 30 20 32 2e 38 34 33 2d 32 2e 38 34 31 6c 2d 2e 34 37 2d 31 2e 37 35 33 2d 2e 31 39 35 2e 37 32 34 2e 37 38 34 2d 2e 37 38 34 2d 2e 37 32 34 2e 31 39 34 20 31 2e 37 35 32 2e 34 37 61 32 2e 33 32 31 20 32 2e 33 32 31 20 30 20 30 20 30 20 32 2e 38 34 Data Ascii: turn n.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},n.createElement("path",{d:"M13.348 15.047l2.545-2.545-.724.194 1.752.47a2.322 2.322 0 0 0 2.843-2.841l-.47-1.753-.195.724.784-.784-.724.194 1.752.47a2.321 2.321 0 0 0 2.84
2024-02-08 18:35:40 UTC	14808	IN	Data Raw: 32 20 30 20 30 20 31 2d 32 20 32 7a 22 7d 29 29 7d 7d 2c 22 32 36 39 64 31 61 64 61 22 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 65 2c 74 29 7b 76 61 72 20 6e 3d 74 28 22 65 61 64 37 31 65 62 30 22 29 3b 65 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 76 67 22 2c 7b 78 6d 6c 6e 73 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 2c 76 69 65 77 42 6f 78 3a 22 30 20 30 20 32 34 20 32 34 22 7d 2c 6e 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 31 35 2e 36 32 20 36 2e 34 35 61 33 2e 31 34 20 33 2e 31 34 20 30 20 31 20 30 2d 33 2e 31 33 2d 33 2e 31 34 20 33 2e 31 35 20 33 2e 31 35 20 30 20 30 20 30 20 33 2e 31 33 20 33 2e Data Ascii: 2 0 0 1-2 2z"}))}},"269d1ada":function(a,e,t){var n=t("ead71eb0");e.Z=function(){return n.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},n.createElement("path",{d:"M15.62 6.45a3.14 3.14 0 1 0-3.13-3.14 3.15 3.15 0 0 0 3.13 3.
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 2e 31 34 20 39 2e 36 36 38 20 31 37 2e 31 30 36 20 39 2e 34 34 20 31 37 20 39 2e 32 34 20 43 20 31 36 2e 39 31 36 20 39 2e 30 33 36 20 31 36 2e 37 37 33 20 38 2e 38 36 32 20 31 36 2e 35 39 20 38 2e 37 34 20 43 20 31 36 2e 34 31 34 20 38 2e 36 32 36 20 31 36 2e 32 31 20 38 2e 35 36 20 31 36 20 38 2e 35 35 20 63 20 2d 30 2e 32 39 37 20 30 20 2d 30 2e 35 38 31 20 30 2e 31 31 39 20 2d 30 2e 37 39 20 30 2e 33 33 20 7a 22 7d 29 29 7d 7d 2c 22 30 38 64 35 32 39 35 63 22 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 65 2c 74 29 7b 74 2e 72 28 65 29 3b 76 61 72 20 6e 3d 74 28 22 65 61 64 37 31 65 62 30 22 29 3b 65 2e 64 65 66 61 75 6c 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 76 67 22 2c 7b 78 6d 6c 6e Data Ascii: .14 9.668 17.106 9.44 17 9.24 C 16.916 9.036 16.773 8.862 16.59 8.74 C 16.414 8.626 16.21 8.56 16 8.55 c -0.297 0 -0.581 0.119 -0.79 0.33 z"}))}},"08d5295c":function(a,e,t){t.r(e);var n=t("ead71eb0");e.default=function(){return n.createElement("svg",{xmln
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 28 29 7b 72 65 74 75 72 6e 20 67 6e 7d 2c 44 6f 74 73 48 6f 72 69 7a 6f 6e 74 61 6c 4f 75 74 6c 69 6e 65 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 6e 7d 2c 44 6f 74 73 56 65 72 74 69 63 61 6c 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4d 6e 2e 5a 7d 2c 44 6f 77 6e 6c 6f 61 64 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 70 6e 7d 2c 44 6f 77 6e 6c 6f 61 64 49 6d 61 67 65 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 41 6e 7d 2c 44 72 61 67 6f 6e 66 6c 79 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 46 75 7d 2c 44 72 65 73 73 65 72 57 61 72 64 72 6f 62 65 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 64 6e 7d Data Ascii: (){return gn},DotsHorizontalOutlineIcon:function(){return fn},DotsVerticalIcon:function(){return Mn.Z},DownloadIcon:function(){return pn},DownloadImageIcon:function(){return An},DragonflyIcon:function(){return Fu},DresserWardrobeIcon:function(){return dn}
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 74 65 72 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 44 68 7d 2c 54 68 65 72 6d 6f 6d 65 74 65 72 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4e 68 7d 2c 54 68 75 6d 62 73 44 6f 77 6e 46 69 6c 6c 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4f 68 7d 2c 54 68 75 6d 62 73 44 6f 77 6e 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 57 68 7d 2c 54 68 75 6d 62 73 55 70 46 69 6c 6c 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 47 68 7d 2c 54 68 75 6d 62 73 55 70 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6a 68 7d 2c 54 69 63 6b 65 74 43 6c 6f 63 6b 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 52 Data Ascii: terIcon:function(){return Dh},ThermometerIcon:function(){return Nh},ThumbsDownFillIcon:function(){return Oh},ThumbsDownIcon:function(){return Wh},ThumbsUpFillIcon:function(){return Gh},ThumbsUpIcon:function(){return jh},TicketClockIcon:function(){return R
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 76 67 22 2c 7b 78 6d 6c 6e 73 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 2c 76 69 65 77 42 6f 78 3a 22 30 20 30 20 32 34 20 32 34 22 7d 2c 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 36 2e 33 37 33 20 31 31 2e 32 35 76 2d 33 2e 39 63 2e 30 32 2d 2e 33 33 33 2e 33 33 38 2d 2e 36 32 2e 37 31 32 2d 2e 36 30 31 2e 34 35 2d 2e 30 31 39 2e 37 36 38 2e 32 36 37 2e 37 39 2e 36 34 6c 2d 2e 30 30 32 20 33 2e 38 35 37 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 31 2e 35 20 30 76 2d 33 2e 39 63 2d 2e 30 37 2d 31 2e 32 34 2d 31 2e 30 39 31 2d 32 2e 31 35 36 2d 32 2e 32 38 38 2d 32 2e 30 39 Data Ascii: ction(){return r.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},r.createElement("path",{d:"M6.373 11.25v-3.9c.02-.333.338-.62.712-.601.45-.019.768.267.79.64l-.002 3.857a.75.75 0 0 0 1.5 0v-3.9c-.07-1.24-1.091-2.156-2.288-2.09
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 76 67 22 2c 7b 78 6d 6c 6e 73 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 2c 76 69 65 77 42 6f 78 3a 22 30 20 30 20 32 34 20 32 34 22 2c 22 64 61 74 61 2d 72 74 6c 2d 66 6c 69 70 22 3a 22 74 72 75 65 22 7d 2c 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 32 33 2e 32 35 20 31 31 2e 32 34 37 68 2d 31 38 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 30 20 31 2e 35 68 31 38 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 30 2d 31 2e 35 7a 6d 2d 31 33 2e 37 32 20 33 2e 39 37 6c 2d 33 2e 37 35 2d 33 2e 37 35 76 31 2e 30 36 6c 33 2e 37 35 2d 33 2e 37 35 61 2e 37 35 2e 37 35 20 30 20 30 20 30 2d 31 Data Ascii: tion(){return r.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24","data-rtl-flip":"true"},r.createElement("path",{d:"M23.25 11.247h-18a.75.75 0 0 0 0 1.5h18a.75.75 0 0 0 0-1.5zm-13.72 3.97l-3.75-3.75v1.06l3.75-3.75a.75.75 0 0 0-1
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 31 2e 35 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 2e 37 35 2d 2e 37 35 56 31 38 61 2e 37 35 2e 37 35 20 30 20 30 20 30 2d 2e 34 32 37 2d 2e 36 37 37 20 38 2e 35 31 20 38 2e 35 31 20 30 20 30 20 30 2d 33 2e 32 39 2d 2e 38 32 32 20 38 2e 35 34 20 38 2e 35 34 20 30 20 30 20 30 2d 33 2e 33 35 36 2e 38 32 32 41 2e 37 35 2e 37 35 20 30 20 30 20 30 20 31 32 20 31 38 76 35 2e 32 35 63 30 20 2e 34 31 34 2e 33 33 36 2e 37 35 2e 37 35 2e 37 35 68 36 7a 4d 39 20 31 34 2e 32 35 76 33 61 32 2e 32 35 20 32 2e 32 35 20 30 20 30 20 30 20 32 2e 32 35 20 32 2e 32 35 68 31 2e 35 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 30 2d 31 2e 35 68 2d 31 2e 35 61 2e 37 35 2e 37 35 20 30 20 30 20 31 2d 2e 37 35 2d 2e 37 35 76 2d 33 61 2e 37 35 2e 37 35 20 30 20 30 20 30 2d 31 2e 35 20 Data Ascii: 1.5a.75.75 0 0 0 .75-.75V18a.75.75 0 0 0-.427-.677 8.51 8.51 0 0 0-3.29-.822 8.54 8.54 0 0 0-3.356.822A.75.75 0 0 0 12 18v5.25c0 .414.336.75.75.75h6zM9 14.25v3a2.25 2.25 0 0 0 2.25 2.25h1.5a.75.75 0 0 0 0-1.5h-1.5a.75.75 0 0 1-.75-.75v-3a.75.75 0 0 0-1.5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	49829	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:40 UTC	589	OUT	GET /psb/capla/static/js/21928fd5.cc39b346.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:40 UTC	687	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 171478 Connection: close Date: Wed, 07 Feb 2024 18:47:07 GMT Last-Modified: Mon, 05 Feb 2024 10:15:48 GMT ETag: "32f6cb6519036a5cb6d7245e1f3f4a10" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 7a98ctKrCWxMZvJTJoQpOhig1fq1QPGC Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 a01680a1fee7e35f1738191420d98822.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: whMB1F2b3xuslbZoe_yyBRNwN6Oh7YmHkUpWvlY0NPaAwMWnwVtZ9w== Age: 85713 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:40 UTC	15697	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 32 31 39 32 38 66 64 35 2e 63 63 33 39 62 33 34 36 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 32 31 39 32 38 66 64 35 22 5d 2c 7b 62 63 61 31 31 34 31 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 69 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 Data Ascii: /! For license information please see 21928fd5.cc39b346.chunk.js.LICENSE.txt /(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["21928fd5"],{bca1141e:function(e,n,i){"use strict";var
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 35 36 20 31 2e 32 35 20 31 2e 32 35 56 31 38 6c 2e 37 35 2d 2e 37 35 48 2e 37 35 6c 2e 37 35 2e 37 35 76 2d 34 2e 37 35 63 30 2d 2e 36 39 2e 35 36 2d 31 2e 32 35 20 31 2e 32 35 2d 31 2e 32 35 7a 6d 30 2d 31 2e 35 41 32 2e 37 35 20 32 2e 37 35 20 30 20 30 20 30 20 30 20 31 33 2e 32 35 56 31 38 63 30 20 2e 34 31 34 2e 33 33 36 2e 37 35 2e 37 35 2e 37 35 68 32 32 2e 35 41 2e 37 35 2e 37 35 20 30 20 30 20 30 20 32 34 20 31 38 76 2d 34 2e 37 35 61 32 2e 37 35 20 32 2e 37 35 20 30 20 30 20 30 2d 32 2e 37 35 2d 32 2e 37 35 48 32 2e 37 35 7a 4d 30 20 31 38 76 33 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 31 2e 35 20 30 76 2d 33 41 2e 37 35 2e 37 35 20 30 20 30 20 30 20 30 20 31 38 7a 6d 32 32 2e 35 20 30 76 33 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 31 2e 35 20 Data Ascii: 56 1.25 1.25V18l.75-.75H.75l.75.75v-4.75c0-.69.56-1.25 1.25-1.25zm0-1.5A2.75 2.75 0 0 0 0 13.25V18c0 .414.336.75.75.75h22.5A.75.75 0 0 0 24 18v-4.75a2.75 2.75 0 0 0-2.75-2.75H2.75zM0 18v3a.75.75 0 0 0 1.5 0v-3A.75.75 0 0 0 0 18zm22.5 0v3a.75.75 0 0 0 1.5
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 29 2c 6d 3d 69 28 22 39 37 35 66 34 62 38 35 22 29 2c 75 3d 69 28 22 36 33 35 36 63 34 61 38 22 29 2c 6b 3d 69 28 22 36 32 32 39 64 38 39 38 22 29 2c 76 3d 69 28 22 61 62 61 62 31 61 66 65 22 29 3b 76 61 72 20 67 3d 65 3d 3e 7b 63 6f 6e 73 74 20 6e 3d 28 30 2c 64 2e 75 73 65 49 31 38 6e 29 28 29 3b 72 65 74 75 72 6e 28 30 2c 72 2e 75 73 65 4d 65 6d 6f 29 28 28 28 29 3d 3e 7b 6c 65 74 20 69 2c 74 3b 72 65 74 75 72 6e 20 65 3c 33 3f 28 69 3d 6e 2e 74 72 61 6e 73 28 28 30 2c 76 2e 74 29 28 22 61 31 31 79 5f 61 64 6a 65 63 74 69 76 65 5f 72 61 74 69 6e 67 22 2c 7b 76 61 72 69 61 62 6c 65 73 3a 7b 72 61 74 69 6e 67 5f 61 64 6a 65 63 74 69 76 65 3a 22 31 22 7d 7d 29 29 2c 74 3d 6e 2e 74 72 61 6e 73 28 28 30 2c 76 2e 74 29 28 22 72 65 76 69 65 77 5f 61 64 6a 5f Data Ascii: ),m=i("975f4b85"),u=i("6356c4a8"),k=i("6229d898"),v=i("abab1afe");var g=e=>{const n=(0,d.useI18n)();return(0,r.useMemo)((()=>{let i,t;return e<3?(i=n.trans((0,v.t)("a11y_adjective_rating",{variables:{rating_adjective:"1"}})),t=n.trans((0,v.t)("review_adj_
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 6f 64 3a 6b 2c 64 71 73 3a 7b 2e 2e 2e 6b 7d 7d 3b 63 6f 6e 73 74 20 67 3d 7b 63 61 6d 70 61 69 67 6e 49 64 3a 22 54 4f 44 4f 22 2c 63 61 6d 70 61 69 67 6e 4e 61 6d 65 3a 63 2e 5f 2e 42 6f 6f 6b 69 6e 67 48 6f 6d 65 73 4d 64 6f 74 2c 6f 70 65 6e 43 61 72 64 4c 69 6e 6b 49 6e 4e 65 77 54 61 62 3a 21 30 2c 6f 6e 43 61 72 64 43 6c 69 63 6b 3a 28 29 3d 3e 7b 28 30 2c 6f 2e 74 72 61 63 6b 43 75 73 74 6f 6d 47 6f 61 6c 29 28 6f 2e 65 78 70 60 63 43 48 4f 62 43 63 45 49 5a 45 48 62 44 4e 51 47 47 46 56 49 5a 64 52 4a 4f 4f 49 42 42 4f 60 2c 31 29 7d 7d 3b 76 61 72 20 4e 3d 7b 70 72 6f 64 3a 67 2c 64 71 73 3a 7b 2e 2e 2e 67 7d 7d 3b 63 6f 6e 73 74 20 53 3d 7b 67 65 74 20 63 61 6d 70 61 69 67 6e 49 64 28 29 7b 72 65 74 75 72 6e 28 30 2c 6f 2e 74 72 61 63 6b 45 78 Data Ascii: od:k,dqs:{...k}};const g={campaignId:"TODO",campaignName:c._.BookingHomesMdot,openCardLinkInNewTab:!0,onCardClick:()=>{(0,o.trackCustomGoal)(o.exp`cCHObCcEIZEHbDNQGGFVIZdRJOOIBBO`,1)}};var N={prod:g,dqs:{...g}};const S={get campaignId(){return(0,o.trackEx
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 75 72 6c 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 7b 6b 69 6e 64 3a 22 41 72 67 75 6d 65 6e 74 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 77 69 64 74 68 22 7d 2c 76 61 6c 75 65 3a 7b 6b 69 6e 64 3a 22 56 61 72 69 61 62 6c 65 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 69 6d 61 67 65 57 69 64 74 68 22 7d 7d 7d 2c 7b 6b 69 6e 64 3a 22 41 72 67 75 6d 65 6e 74 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 68 65 69 67 68 74 22 7d 2c 76 61 6c 75 65 3a 7b 6b 69 6e 64 3a 22 56 61 72 69 61 62 6c 65 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 Data Ascii: :"Field",name:{kind:"Name",value:"url"},arguments:[{kind:"Argument",name:{kind:"Name",value:"width"},value:{kind:"Variable",name:{kind:"Name",value:"imageWidth"}}},{kind:"Argument",name:{kind:"Name",value:"height"},value:{kind:"Variable",name:{kind:"Name"
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 72 61 67 6d 65 6e 74 53 70 72 65 61 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 49 63 6f 6e 22 7d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 5d 7d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 62 61 64 67 65 73 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 Data Ascii: electionSet",selections:[{kind:"FragmentSpread",name:{kind:"Name",value:"Icon"},directives:[]}]}},{kind:"Field",name:{kind:"Name",value:"badges"},arguments:[],directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"Field",name:{kind:"Name",valu
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 61 72 69 61 4c 61 62 65 6c 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 74 65 78 74 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 74 61 72 67 65 74 4c 61 6e 64 Data Ascii: ves:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"Field",name:{kind:"Name",value:"ariaLabel"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"text"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"targetLand
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 75 72 6c 3a 20 75 72 6c 28 77 69 64 74 68 3a 20 39 30 30 2c 20 68 65 69 67 68 74 3a 20 39 30 30 29 5c 6e 20 20 20 20 20 20 20 20 20 20 61 6c 74 5c 6e 20 20 20 20 20 20 20 20 7d 5c 6e 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 53 63 68 65 6d 65 5c 6e 20 20 20 20 20 20 7d 5c 6e 20 20 20 20 20 20 2e 2e 2e 20 6f 6e 20 4d 64 6f 74 48 65 72 6f 49 6d 61 67 65 46 75 6c 6c 41 6c 69 67 6e 42 6f 74 74 6f 6d 20 7b 5c 6e 20 20 20 20 20 20 20 20 74 69 74 6c 65 46 69 72 73 74 4c 69 6e 65 5c 6e 20 20 20 20 20 20 20 20 63 74 61 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 2e 2e 2e 48 65 72 6f 43 54 41 46 72 61 67 6d 65 6e 74 5c 6e 20 20 20 20 20 20 20 20 7d 5c 6e 20 20 20 20 20 20 20 20 63 61 70 74 69 6f 6e 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 2e 2e 2e 20 6f 6e 20 48 65 72 Data Ascii: url: url(width: 900, height: 900)\n alt\n }\n colorScheme\n }\n ... on MdotHeroImageFullAlignBottom {\n titleFirstLine\n cta {\n ...HeroCTAFragment\n }\n caption {\n ... on Her
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 61 6d 65 64 54 79 70 65 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 53 65 63 6f 6e 64 61 72 79 42 61 6e 6e 65 72 54 65 78 74 43 61 70 74 69 6f 6e 22 7d 7d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 74 65 78 74 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 5d 7d 7d 2c 7b 6b 69 6e 64 3a 22 49 6e 6c 69 6e 65 46 72 61 67 6d 65 6e 74 22 2c 74 79 70 65 43 6f 6e 64 69 74 69 6f 6e 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 64 54 79 70 65 Data Ascii: amedType",name:{kind:"Name",value:"SecondaryBannerTextCaption"}},directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"Field",name:{kind:"Name",value:"text"},arguments:[],directives:[]}]}},{kind:"InlineFragment",typeCondition:{kind:"NamedType
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 6e 67 22 7d 7d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 72 6f 6c 65 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 75 72 6c 50 61 74 68 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a Data Ascii: ng"}},directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"Field",name:{kind:"Name",value:"role"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"urlPath"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	49830	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:40 UTC	589	OUT	GET /psb/capla/static/js/8207c303.4d6b40b0.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:40 UTC	687	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 539441 Connection: close Last-Modified: Mon, 05 Feb 2024 08:13:59 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: JWcW9sK6ond8IxVmIUdpxtN4s_rfxz11 Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 13:52:36 GMT ETag: "ec732ec4c890554c3e9288e5b5f07021" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 5988b4ae4648c0fec3c60a3cca580092.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: LPRHSphZG3m9notNaH9EC-CbPiiOUc4Ugi289wUNpsFY3_3hS-akBw== Age: 16985 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 38 32 30 37 63 33 30 33 2e 34 64 36 62 34 30 62 30 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 38 32 30 37 63 33 30 33 22 5d 2c 7b 64 30 39 38 39 32 33 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 2e 64 28 Data Ascii: /! For license information please see 8207c303.4d6b40b0.chunk.js.LICENSE.txt /(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["8207c303"],{d0989236:function(e,n,t){"use strict";t.d(
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 65 34 38 39 22 2c 74 69 74 6c 65 53 6d 61 6c 6c 53 70 61 63 69 6e 67 3a 22 63 38 63 34 35 62 35 39 30 63 22 2c 69 74 65 6d 3a 22 62 65 31 34 64 66 38 62 66 62 22 2c 73 65 63 6f 6e 64 61 72 79 4f 70 74 69 6f 6e 73 43 6f 6e 74 61 69 6e 65 72 3a 22 63 63 37 61 32 61 35 33 32 31 22 2c 69 74 65 6d 42 75 74 74 6f 6e 41 63 74 69 76 65 3a 22 61 32 35 36 62 63 62 39 30 33 22 2c 72 65 73 75 6c 74 3a 22 62 66 63 38 39 66 32 31 30 36 22 2c 72 65 73 75 6c 74 49 63 6f 6e 3a 22 66 65 61 37 35 66 65 62 33 30 22 2c 72 65 73 75 6c 74 49 6d 61 67 65 3a 22 65 33 66 30 64 62 62 61 38 38 22 2c 72 65 73 75 6c 74 54 65 78 74 3a 22 66 62 62 66 63 35 33 33 34 63 22 7d 2c 6b 3d 74 28 22 31 34 32 34 64 30 33 33 22 29 3b 66 75 6e 63 74 69 6f 6e 20 67 28 65 29 7b 72 65 74 75 72 6e 20 Data Ascii: e489",titleSmallSpacing:"c8c45b590c",item:"be14df8bfb",secondaryOptionsContainer:"cc7a2a5321",itemButtonActive:"a256bcb903",result:"bfc89f2106",resultIcon:"fea75feb30",resultImage:"e3f0dbba88",resultText:"fbbfc5334c"},k=t("1424d033");function g(e){return
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 2c 76 69 65 77 42 6f 78 3a 22 30 20 30 20 32 34 20 32 34 22 7d 2c 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 31 36 2e 35 20 36 61 34 2e 35 20 34 2e 35 20 30 20 31 20 31 2d 39 20 30 20 34 2e 35 20 34 2e 35 20 30 20 30 20 31 20 39 20 30 7a 4d 31 38 20 36 41 36 20 36 20 30 20 31 20 30 20 36 20 36 61 36 20 36 20 30 20 30 20 30 20 31 32 20 30 7a 4d 33 20 32 33 2e 32 35 61 39 20 39 20 30 20 31 20 31 20 31 38 20 30 20 2e 37 35 2e 37 35 20 30 20 30 20 30 20 31 2e 35 20 30 63 30 2d 35 2e 37 39 39 2d 34 2e 37 30 31 2d 31 30 2e 35 2d 31 30 2e 35 2d 31 30 2e 35 53 31 2e 35 20 31 37 2e 34 35 31 20 31 2e 35 20 32 33 2e 32 35 61 2e 37 35 2e 37 35 20 30 20 30 Data Ascii: p://www.w3.org/2000/svg",viewBox:"0 0 24 24"},i.createElement("path",{d:"M16.5 6a4.5 4.5 0 1 1-9 0 4.5 4.5 0 0 1 9 0zM18 6A6 6 0 1 0 6 6a6 6 0 0 0 12 0zM3 23.25a9 9 0 1 1 18 0 .75.75 0 0 0 1.5 0c0-5.799-4.701-10.5-10.5-10.5S1.5 17.451 1.5 23.25a.75.75 0 0
2024-02-08 18:35:40 UTC	14808	IN	Data Raw: 6c 6c 3d 3d 3d 73 7c 7c 76 6f 69 64 20 30 3d 3d 3d 73 7c 7c 73 28 75 29 29 2c 74 28 7b 74 79 70 65 3a 61 2e 45 2e 46 4f 52 4d 5f 53 55 42 4d 49 54 54 45 44 2c 70 61 79 6c 6f 61 64 3a 75 7d 29 2c 6e 75 6c 6c 3d 3d 3d 64 7c 7c 76 6f 69 64 20 30 3d 3d 3d 64 7c 7c 64 28 7b 65 76 65 6e 74 3a 69 2c 65 72 72 6f 72 73 3a 75 2c 61 64 64 48 69 64 64 65 6e 46 69 65 6c 64 73 41 6e 64 53 75 62 6d 69 74 54 68 65 46 6f 72 6d 41 66 74 65 72 3a 65 3d 3e 7b 6e 75 6c 6c 3d 3d 3d 69 7c 7c 76 6f 69 64 20 30 3d 3d 3d 69 7c 7c 69 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 2c 74 28 7b 74 79 70 65 3a 61 2e 45 2e 48 49 44 44 45 4e 5f 46 49 45 4c 44 53 5f 43 48 41 4e 47 45 44 2c 70 61 79 6c 6f 61 64 3a 65 7d 29 2c 6f 28 28 6e 75 6c 6c 3d 3d 3d 69 7c 7c 76 6f 69 64 20 30 3d Data Ascii: ll===s\|\|void 0===s\|\|s(u)),t({type:a.E.FORM_SUBMITTED,payload:u}),null===d\|\|void 0===d\|\|d({event:i,errors:u,addHiddenFieldsAndSubmitTheFormAfter:e=>{null===i\|\|void 0===i\|\|i.preventDefault(),t({type:a.E.HIDDEN_FIELDS_CHANGED,payload:e}),o((null===i\|\|void 0=
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 65 20 69 64 20 76 61 6c 75 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 20 69 6e 20 77 69 6e 64 6f 77 2e 62 6f 6f 6b 69 6e 67 20 6f 62 6a 65 63 74 22 2c 7a 3d 22 75 66 69 20 69 64 20 76 61 6c 75 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 20 69 6e 20 77 69 6e 64 6f 77 2e 62 6f 6f 6b 69 6e 67 20 6f 62 6a 65 63 74 22 2c 6a 3d 22 75 73 65 72 5f 69 64 20 76 61 6c 75 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 20 69 6e 20 77 69 6e 64 6f 77 2e 62 6f 6f 6b 69 6e 67 20 6f 62 6a 65 63 74 22 2c 58 3d 22 67 65 6e 69 75 73 20 6c 65 76 65 6c 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 20 69 6e 20 77 69 6e 64 6f 77 2e 62 6f 6f 6b 69 6e 67 20 6f 62 6a 65 63 74 22 2c 51 3d 22 75 73 65 72 20 6c 6f 67 67 65 64 20 69 6e 20 64 61 74 61 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 20 69 6e 20 Data Ascii: e id value is not found in window.booking object",z="ufi id value is not found in window.booking object",j="user_id value is not found in window.booking object",X="genius level is not found in window.booking object",Q="user logged in data is not found in
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 6b 67 3a 22 4b 79 72 67 79 7a 73 74 61 6e 22 2c 6b 68 3a 22 43 61 6d 62 6f 64 69 61 22 2c 6b 69 3a 22 4b 69 72 69 62 61 74 69 22 2c 6b 6d 3a 22 43 6f 6d 6f 72 6f 73 22 2c 6b 6e 3a 22 53 61 69 6e 74 20 4b 69 74 74 73 20 61 6e 64 20 4e 65 76 69 73 22 2c 6b 70 3a 22 4e 6f 72 74 68 20 4b 6f 72 65 61 22 2c 6b 72 3a 22 53 6f 75 74 68 20 4b 6f 72 65 61 22 2c 6b 77 3a 22 4b 75 77 61 69 74 22 2c 6b 79 3a 22 43 61 79 6d 61 6e 20 49 73 6c 61 6e 64 73 22 2c 6b 7a 3a 22 4b 61 7a 61 6b 68 73 74 61 6e 22 2c 6c 61 3a 22 4c 61 6f 73 22 2c 6c 62 3a 22 4c 65 62 61 6e 6f 6e 22 2c 6c 63 3a 22 53 61 69 6e 74 20 4c 75 63 69 61 22 2c 6c 69 3a 22 4c 69 65 63 68 74 65 6e 73 74 65 69 6e 22 2c 6c 6b 3a 22 53 72 69 20 4c 61 6e 6b 61 22 2c 6c 72 3a 22 4c 69 62 65 72 69 61 22 2c 6c 73 Data Ascii: kg:"Kyrgyzstan",kh:"Cambodia",ki:"Kiribati",km:"Comoros",kn:"Saint Kitts and Nevis",kp:"North Korea",kr:"South Korea",kw:"Kuwait",ky:"Cayman Islands",kz:"Kazakhstan",la:"Laos",lb:"Lebanon",lc:"Saint Lucia",li:"Liechtenstein",lk:"Sri Lanka",lr:"Liberia",ls
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 6e 74 49 6e 66 6f 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 72 6f 6f 6d 52 65 73 65 72 76 61 74 69 6f 6e 73 5b 30 5d 29 26 26 28 63 3d 6e 75 6c 6c 3d 3d 3d 28 69 3d 6e 75 6c 6c 3d 3d 3d 65 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 72 6f 6f 6d 43 6f 75 6e 74 49 6e 66 6f 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 69 3f 76 6f 69 64 20 30 3a 69 2e 72 6f 6f 6d 52 65 73 65 72 76 61 74 69 6f 6e 73 5b 30 5d 2e 72 6f 6f 6d 52 65 73 65 72 76 61 74 69 6f 6e 49 64 29 2c 61 3d 5a 6e 28 22 74 74 76 22 29 7c 7c 6f 7c 7c 75 2c 7b 65 76 65 6e 74 3a 6e 6e 2e 50 55 52 43 48 41 53 45 2c 74 73 6d 70 3a 53 6e 28 29 2c 5f 63 6c 65 61 72 3a 21 30 2c 72 69 64 3a 63 7c 7c 5f 74 28 29 7c 7c 5a 6e 28 22 72 69 64 22 29 2c 74 74 76 3a 61 2c Data Ascii: ntInfo)\|\|void 0===t?void 0:t.roomReservations[0])&&(c=null===(i=null===e\|\|void 0===e?void 0:e.roomCountInfo)\|\|void 0===i?void 0:i.roomReservations[0].roomReservationId),a=Zn("ttv")\|\|o\|\|u,{event:nn.PURCHASE,tsmp:Sn(),_clear:!0,rid:c\|\|_t()\|\|Zn("rid"),ttv:a,
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 61 72 69 61 62 6c 65 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 64 65 73 74 69 6e 61 74 69 6f 6e 22 7d 7d 2c 74 79 70 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 64 54 79 70 65 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 53 65 61 72 63 68 44 65 73 74 69 6e 61 74 69 6f 6e 49 6e 70 75 74 22 7d 7d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 56 61 72 69 61 62 6c 65 44 65 66 69 6e 69 74 69 6f 6e 22 2c 76 61 72 69 61 62 6c 65 3a 7b 6b 69 6e 64 3a 22 56 61 72 69 61 62 6c 65 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 74 72 61 76 65 6c 50 75 72 70 6f 73 65 22 7d 7d 2c 74 79 70 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 64 54 79 70 65 22 Data Ascii: ariable",name:{kind:"Name",value:"destination"}},type:{kind:"NamedType",name:{kind:"Name",value:"SearchDestinationInput"}},directives:[]},{kind:"VariableDefinition",variable:{kind:"Variable",name:{kind:"Name",value:"travelPurpose"}},type:{kind:"NamedType"
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 72 61 67 6d 65 6e 74 53 70 72 65 61 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 53 75 73 74 61 69 6e 61 62 69 6c 69 74 79 50 72 61 63 74 69 63 65 73 46 69 65 6c 64 73 22 7d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 5d 7d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 74 72 69 70 54 79 70 65 73 48 6f 74 65 6c 50 61 67 65 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 Data Ascii: },arguments:[],directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"FragmentSpread",name:{kind:"Name",value:"SustainabilityPracticesFields"},directives:[]}]}},{kind:"Field",name:{kind:"Name",value:"tripTypesHotelPage"},arguments:[],directive
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 7d 7d 7d 5d 7d 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 66 72 6f 6d 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 66 6f 72 6d 61 74 74 65 64 44 61 74 65 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 5d Data Ascii: }}}]}],selectionSet:{kind:"SelectionSet",selections:[{kind:"Field",name:{kind:"Name",value:"from"},arguments:[],directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"Field",name:{kind:"Name",value:"formattedDate"},arguments:[],directives:[]}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	49832	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:40 UTC	1006	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-116109-18&cid=421694156.1707417338&jid=1238114313&_u=aGBAgAIJAAAAAGgMIAC~&z=2006954226 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:40 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:40 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:40 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	49833	104.18.131.236	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:40 UTC	637	OUT	GET /consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf/en-us.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:40 UTC	902	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:35:40 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8525f949ce746733-ATL CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 20430 Cache-Control: public, max-age=86400 Expires: Fri, 09 Feb 2024 18:35:40 GMT Last-Modified: Fri, 02 Feb 2024 12:54:41 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: SwZTy4V7mJNhsDn8Sf3xRg== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: ea58ea6e-001e-0072-7dd7-553ecc000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-02-08 18:35:40 UTC	467	IN	Data Raw: 37 63 31 38 0d 0a 7b 22 44 6f 6d 61 69 6e 44 61 74 61 22 3a 7b 22 70 63 6c 69 66 65 53 70 61 6e 59 72 22 3a 22 59 65 61 72 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 59 72 73 22 3a 22 59 65 61 72 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 53 65 63 73 22 3a 22 41 20 66 65 77 20 73 65 63 6f 6e 64 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 22 3a 22 57 65 65 6b 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 73 22 3a 22 57 65 65 6b 73 22 2c 22 70 63 63 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 54 65 78 74 22 3a 22 43 6f 6e 74 69 6e 75 65 20 77 69 74 68 6f 75 74 20 41 63 63 65 70 74 69 6e 67 22 2c 22 70 63 63 6c 6f 73 65 42 75 74 74 6f 6e 54 79 70 65 22 3a 22 49 63 6f 6e 22 2c 22 4d 61 69 6e 54 65 78 74 22 3a 22 4d 61 6e 61 67 65 20 79 6f 75 72 Data Ascii: 7c18{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","pccloseButtonType":"Icon","MainText":"Manage your
2024-02-08 18:35:40 UTC	1369	IN	Data Raw: 6b 69 65 73 54 65 78 74 22 3a 22 59 6f 75 72 20 50 72 69 76 61 63 79 22 2c 22 43 6f 6e 66 69 72 6d 54 65 78 74 22 3a 22 41 6c 6c 6f 77 20 41 6c 6c 22 2c 22 41 6c 6c 6f 77 41 6c 6c 54 65 78 74 22 3a 22 53 61 76 65 20 53 65 74 74 69 6e 67 73 22 2c 22 43 6f 6f 6b 69 65 73 55 73 65 64 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 75 73 65 64 22 2c 22 43 6f 6f 6b 69 65 73 44 65 73 63 54 65 78 74 22 3a 22 44 65 73 63 72 69 70 74 69 6f 6e 22 2c 22 41 62 6f 75 74 4c 69 6e 6b 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 67 65 6e 65 72 61 6c 2e 68 74 6d 6c 3f 74 6d 70 6c 3d 64 6f 63 73 2f 70 72 69 76 61 63 79 2d 70 6f 6c 69 63 79 22 2c 22 41 63 74 69 76 65 54 65 78 74 22 3a 22 41 63 74 69 76 65 22 2c 22 41 6c 77 61 79 73 41 63 74 Data Ascii: kiesText":"Your Privacy","ConfirmText":"Allow All","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","CookiesDescText":"Description","AboutLink":"https://www.booking.com/general.html?tmpl=docs/privacy-policy","ActiveText":"Active","AlwaysAct
2024-02-08 18:35:40 UTC	1369	IN	Data Raw: 6c 73 65 2c 22 48 61 73 53 63 72 69 70 74 41 72 63 68 69 76 65 22 3a 66 61 6c 73 65 2c 22 42 61 6e 6e 65 72 50 6f 73 69 74 69 6f 6e 22 3a 22 62 6f 74 74 6f 6d 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 50 6f 73 69 74 69 6f 6e 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 43 6f 6e 66 69 72 6d 54 65 78 74 22 3a 22 43 6f 6e 66 69 72 6d 20 4d 79 20 43 68 6f 69 63 65 73 22 2c 22 56 65 6e 64 6f 72 4c 69 73 74 54 65 78 74 22 3a 22 4c 69 73 74 20 6f 66 20 49 41 42 20 56 65 6e 64 6f 72 73 22 2c 22 54 68 69 72 64 50 61 72 74 79 43 6f 6f 6b 69 65 4c 69 73 74 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 77 65 20 75 73 65 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 4d 61 6e 61 67 65 50 72 65 66 65 72 Data Ascii: lse,"HasScriptArchive":false,"BannerPosition":"bottom","PreferenceCenterPosition":"default","PreferenceCenterConfirmText":"Confirm My Choices","VendorListText":"List of IAB Vendors","ThirdPartyCookieListText":"Cookies we use","PreferenceCenterManagePrefer
2024-02-08 18:35:40 UTC	1369	IN	Data Raw: 74 20 73 65 61 72 63 68 65 73 2c 20 61 6e 64 20 6f 74 68 65 72 20 70 72 65 66 65 72 65 6e 63 65 73 2e 20 54 68 65 73 65 20 74 65 63 68 6e 69 63 61 6c 20 63 6f 6f 6b 69 65 73 20 6d 75 73 74 20 62 65 20 65 6e 61 62 6c 65 64 20 74 6f 20 75 73 65 20 6f 75 72 20 73 69 74 65 20 61 6e 64 20 73 65 72 76 69 63 65 73 2e 22 2c 22 47 72 6f 75 70 44 65 73 63 72 69 70 74 69 6f 6e 4f 54 54 22 3a 22 46 75 6e 63 74 69 6f 6e 61 6c 20 63 6f 6f 6b 69 65 73 20 65 6e 61 62 6c 65 20 6f 75 72 20 77 65 62 73 69 74 65 20 74 6f 20 77 6f 72 6b 20 70 72 6f 70 65 72 6c 79 2c 20 73 6f 20 79 6f 75 20 63 61 6e 20 63 72 65 61 74 65 20 61 6e 20 61 63 63 6f 75 6e 74 2c 20 73 69 67 6e 20 69 6e 2c 20 61 6e 64 20 6d 61 6e 61 67 65 20 62 6f 6f 6b 69 6e 67 73 2e 20 54 68 65 79 20 61 6c 73 6f 20 Data Ascii: t searches, and other preferences. These technical cookies must be enabled to use our site and services.","GroupDescriptionOTT":"Functional cookies enable our website to work properly, so you can create an account, sign in, and manage bookings. They also
2024-02-08 18:35:40 UTC	1369	IN	Data Raw: 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 69 73 20 63 6f 6f 6b 69 65 20 73 65 72 76 65 73 20 61 20 73 70 65 63 69 66 69 63 20 77 65 62 20 62 72 6f 77 73 69 6e 67 20 75 73 65 20 63 61 73 65 2e 20 49 74 20 61 6c 6c 65 76 69 61 74 65 73 20 74 68 65 20 70 72 6f 62 6c 65 6d 20 6f 66 20 73 6f 6d 65 20 62 72 6f 77 73 65 72 73 20 64 72 6f 70 70 69 6e 67 20 74 68 65 20 70 6f 73 74 20 62 6f 64 79 20 77 68 65 6e 20 73 68 6f 77 69 6e 67 20 61 6e 20 69 6e 74 65 72 73 74 69 74 69 61 6c 20 70 61 67 65 20 28 74 6f 20 66 6f 72 63 65 20 74 68 65 20 6c 6f 61 64 20 6f 66 20 49 6d 70 65 72 76 61 20 4a 61 76 61 53 63 72 69 70 74 29 20 6f 6e 20 61 20 50 4f 53 54 20 72 65 71 75 65 73 74 2e 20 54 68 69 73 20 69 73 20 64 6f 6e 65 20 Data Ascii: "Length":"0","description":"This cookie serves a specific web browsing use case. It alleviates the problem of some browsers dropping the post body when showing an interstitial page (to force the load of Imperva JavaScript) on a POST request. This is done
2024-02-08 18:35:40 UTC	1369	IN	Data Raw: 22 62 6b 6e 67 5f 66 72 6f 6e 74 65 6e 64 5f 73 65 73 65 5f 65 78 70 22 2c 22 48 6f 73 74 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 32 39 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 69 73 20 63 6f 6f 6b 69 65 20 69 73 20 75 73 65 64 20 61 73 20 61 6e 20 65 78 70 65 72 69 6d 65 6e 74 20 74 6f 20 68 65 6c 70 20 75 73 20 64 65 74 65 72 6d 69 6e 65 20 61 6e 64 20 6d 69 74 69 67 61 74 65 20 74 68 65 20 62 75 73 69 6e 65 73 73 20 69 6d 70 61 63 74 20 6f 66 20 74 68 65 20 6d 69 67 72 61 74 69 6f 6e 20 6f 66 20 6f 75 72 20 69 6e 74 65 72 6e 61 6c 20 64 61 74 61 20 73 74 6f 72 61 67 65 2e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 Data Ascii: "bkng_frontend_sese_exp","Host":"booking.com","IsSession":false,"Length":"29","description":"This cookie is used as an experiment to help us determine and mitigate the business impact of the migration of our internal data storage.","DurationType":1,"categ
2024-02-08 18:35:40 UTC	1369	IN	Data Raw: 62 65 2d 36 34 36 32 32 36 66 30 39 65 39 30 22 2c 22 4e 61 6d 65 22 3a 22 5f 64 63 5f 67 74 6d 5f 55 41 2d 78 78 78 78 78 78 78 78 22 2c 22 48 6f 73 74 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 69 73 20 63 6f 6f 6b 69 65 20 69 73 20 61 73 73 6f 63 69 61 74 65 64 20 77 69 74 68 20 73 69 74 65 73 20 75 73 69 6e 67 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e 61 67 65 72 20 74 6f 20 6c 6f 61 64 20 6f 74 68 65 72 20 73 63 72 69 70 74 73 20 61 6e 64 20 63 6f 64 65 20 69 6e 74 6f 20 61 20 70 61 67 65 2e 20 20 57 68 65 72 65 20 69 74 20 69 73 20 75 73 65 64 20 69 74 20 6d 61 79 20 62 65 20 72 65 67 61 72 64 65 64 Data Ascii: be-646226f09e90","Name":"_dc_gtm_UA-xxxxxxxx","Host":"booking.com","IsSession":false,"Length":"0","description":"This cookie is associated with sites using Google Tag Manager to load other scripts and code into a page. Where it is used it may be regarded
2024-02-08 18:35:40 UTC	1369	IN	Data Raw: 73 2e 20 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 64 39 62 39 38 63 38 39 2d 31 31 36 32 2d 34 66 35 61 2d 62 63 66 35 2d 63 38 37 61 64 33 36 66 36 61 30 30 22 2c 22 4e 61 6d 65 22 3a 22 36 62 64 66 61 63 35 33 63 62 66 62 36 34 38 62 37 65 62 65 37 61 31 66 65 31 62 39 33 66 34 64 22 2c 22 48 6f 73 74 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 33 36 35 33 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 73 65 73 20 45 2d 48 41 57 4b 20 74 6f 20 70 65 72 66 6f 72 6d 20 72 69 73 6b 20 63 68 65 63 6b 73 20 69 6e 20 Data Ascii: s. ","DurationType":1,"category":null,"isThirdParty":false},{"id":"d9b98c89-1162-4f5a-bcf5-c87ad36f6a00","Name":"6bdfac53cbfb648b7ebe7a1fe1b93f4d","Host":"booking.com","IsSession":false,"Length":"3653","description":"Uses E-HAWK to perform risk checks in
2024-02-08 18:35:40 UTC	1369	IN	Data Raw: 20 65 61 63 68 20 63 61 74 65 67 6f 72 79 2c 20 64 61 74 65 20 77 68 65 6e 20 69 74 20 77 61 73 20 67 69 76 65 6e 2c 20 63 6f 75 6e 74 72 79 20 61 6e 64 20 72 65 67 75 6c 61 74 69 6f 6e 2e 20 54 68 69 73 20 65 6e 61 62 6c 65 73 20 73 69 74 65 20 6f 77 6e 65 72 73 20 74 6f 20 72 65 73 70 65 63 74 20 75 73 65 72 20 63 6f 6e 73 65 6e 74 73 20 64 75 72 69 6e 67 20 70 72 6f 63 65 73 73 69 6e 67 20 6f 66 20 68 69 73 20 72 65 71 75 65 73 74 73 2e 20 54 68 65 20 63 6f 6f 6b 69 65 20 68 61 73 20 61 20 6e 6f 72 6d 61 6c 20 6c 69 66 65 73 70 61 6e 20 6f 66 20 6f 6e 65 20 79 65 61 72 2c 20 73 6f 20 74 68 61 74 20 72 65 74 75 72 6e 69 6e 67 20 76 69 73 69 74 6f 72 73 20 74 6f 20 74 68 65 20 73 69 74 65 20 77 69 6c 6c 20 68 61 76 65 20 74 68 65 69 72 20 70 72 65 66 65 Data Ascii: each category, date when it was given, country and regulation. This enables site owners to respect user consents during processing of his requests. The cookie has a normal lifespan of one year, so that returning visitors to the site will have their prefe
2024-02-08 18:35:40 UTC	1369	IN	Data Raw: 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 69 73 20 63 6f 6f 6b 69 65 20 69 73 20 63 72 65 61 74 65 64 20 61 6e 64 20 75 73 65 64 20 62 79 20 50 65 72 69 6d 65 74 65 72 58 2f 48 75 6d 61 6e 2c 20 61 20 42 6f 74 20 6d 69 74 69 67 61 74 69 6f 6e 20 73 6f 6c 75 74 69 6f 6e 2c 20 74 6f 20 66 6c 61 67 20 66 65 61 74 75 72 65 73 20 66 6f 72 20 62 72 6f 77 73 65 72 20 64 65 74 65 63 74 69 6f 6e 20 61 6e 64 20 64 69 73 74 69 6e 67 75 69 73 68 69 6e 67 20 77 68 65 74 68 65 72 20 69 74 20 69 73 20 61 20 72 65 61 6c 20 75 73 65 72 20 6f 72 20 6d 61 6c 69 63 69 6f 75 73 20 62 6f 74 2e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 Data Ascii: n":false,"Length":"0","description":"This cookie is created and used by PerimeterX/Human, a Bot mitigation solution, to flag features for browser detection and distinguishing whether it is a real user or malicious bot.","DurationType":1,"category":null,"i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	49834	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:40 UTC	3072	OUT	GET /js_tracking?ver=2&stype=1&ref_action=index&lang=en-us&pid=e4de82b919b800e4&aid=304142&sid=5171fc655664ddf74ab763a094523fb7&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|1&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3 X-Booking-CSRF: M1fFZQAAAAA=ow_iJm02C23yTbeZTjDwFw3ODjezY3bK5FHdo-YoJdT7GCkrsQ32GPbbWguo4KloItJB_vA0z9Y_xRO57ct8Amr5W_XGX_7GZSpQGGcZ9tRZ2sLvFoX1OvJhoh8lHbncqueaPtPA9hz8Y_-xROuXkd4r2dhb8qRB-XM9-fcVbZ1TIOfkTWMBhv8vt5DNEpcahji4EEgpTuAdyxqG sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: e4de82b919b800e4 X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,1912460\|1,1856870\|1,1912460\|7,1912460\|6,1908890\|1 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLalZib7103qG%2BF6jNX4nY1OEBjrxAz9Ob8DEQBWTSqeRvOh6i7KV3uDpo7lfSd6A33jZhjYHawln8E0aqfSwxomTxD7gRkwilYph1WF73PdYDrYV%2FBds8KeGhbWuYLP5WRjHVQWXCaBnPp2c6UP9oiZIrDu36czsM%3D; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; lastSeen=0; bkng_sso_ses=e30; bkng_sso_session=e30; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482; _gat=1
2024-02-08 18:35:40 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:40 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=10e282bee1fe01d0&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejIeMIPXQQRxbXHDzrOMgLPWCZrvqqge_a4 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 14e4300e15854895259e6944bb121ec8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: m8LX0U57RP-ZjT-f6_hwQB6k_m7Hu_fxkPehdiz-VBy19TwxJfWVAA==
2024-02-08 18:35:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	49835	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:40 UTC	589	OUT	GET /psb/capla/static/js/3d066b0d.6a5d1f73.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:40 UTC	687	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 132016 Connection: close Last-Modified: Tue, 06 Feb 2024 05:16:14 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: dEnmDEtw.I4qhNxITUcP6I6qsZhacRX8 Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 11:31:03 GMT ETag: "b9431959d1fba61458d500bc4cba3939" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 14e4300e15854895259e6944bb121ec8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: uhQIWCJXr24D1D_7qkXz__IZoLKAY2nb8jrSR7R2eP8nCmeers30sw== Age: 25478 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:40 UTC	15697	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 33 64 30 36 36 62 30 64 2e 36 61 35 64 31 66 37 33 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 33 64 30 36 36 62 30 64 22 5d 2c 7b 64 37 37 34 35 38 38 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 69 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 69 2e 64 28 Data Ascii: /! For license information please see 3d066b0d.6a5d1f73.chunk.js.LICENSE.txt /(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["3d066b0d"],{d7745882:function(e,n,i){"use strict";i.d(
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 7d 2c 78 73 48 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 46 7d 2c 7a 35 4b 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6b 7d 2c 7a 72 54 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 54 7d 2c 7a 78 33 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 43 7d 7d 29 3b 6c 65 74 20 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 41 43 43 4f 4d 4d 4f 44 41 54 49 4f 4e 5f 46 41 43 49 4c 49 54 49 45 53 3d 22 41 43 43 4f 4d 4d 4f 44 41 54 49 4f 4e 5f 46 41 43 49 4c 49 54 49 45 53 22 2c 65 2e 41 44 44 49 54 49 4f 4e 41 4c 5f 44 45 53 43 52 49 50 54 49 4f 4e 3d 22 41 44 44 49 54 49 4f 4e 41 4c 5f 44 45 53 43 52 49 50 54 49 4f 4e 22 2c 65 2e 41 53 53 4f 43 49 41 54 45 44 5f 52 45 53 45 52 56 41 54 49 Data Ascii: },xsH:function(){return F},z5K:function(){return k},zrT:function(){return T},zx3:function(){return C}});let t=function(e){return e.ACCOMMODATION_FACILITIES="ACCOMMODATION_FACILITIES",e.ADDITIONAL_DESCRIPTION="ADDITIONAL_DESCRIPTION",e.ASSOCIATED_RESERVATI
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 73 2e 53 68 65 65 74 43 6f 6e 74 61 69 6e 65 72 2c 7b 61 63 74 69 76 65 3a 69 2c 70 6f 73 69 74 69 6f 6e 3a 22 63 65 6e 74 65 72 22 2c 73 69 7a 65 3a 64 7c 7c 37 32 30 2c 63 6c 6f 73 65 41 72 69 61 4c 61 62 65 6c 3a 6c 2e 74 72 61 6e 73 28 28 30 2c 50 2e 74 29 28 22 61 31 31 79 5f 63 74 61 5f 63 6c 6f 73 65 22 29 29 2c 6f 6e 43 6c 6f 73 65 54 72 69 67 67 65 72 3a 74 2c 74 69 74 6c 65 3a 72 7d 2c 61 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 2c 7b 22 64 61 74 61 2d 74 65 73 74 69 64 22 3a 22 70 72 6f 6d 6f 74 69 6f 6e 61 6c 2d 62 61 6e 6e 65 72 2d 6d 6f 64 61 6c 2d 63 6f 6e 74 61 69 6e 65 72 22 7d 2c 6e 29 29 7d 3b 63 6f 6e 73 74 20 48 65 3d 65 3d 3e 7b 6c 65 74 7b 75 72 6c 3a 6e 2c 69 73 54 Data Ascii: createElement(s.SheetContainer,{active:i,position:"center",size:d\|\|720,closeAriaLabel:l.trans((0,P.t)("a11y_cta_close")),onCloseTrigger:t,title:r},a().createElement("div",{"data-testid":"promotional-banner-modal-container"},n))};const He=e=>{let{url:n,isT
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 65 22 2c 76 61 6c 75 65 3a 22 74 65 78 74 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 74 61 72 67 65 74 4c 61 6e 64 69 6e 67 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 72 61 67 6d 65 6e 74 53 70 72 65 61 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 43 54 41 54 61 72 67 65 74 4c 61 6e 64 69 6e 67 46 72 61 67 6d 65 6e 74 22 7d 2c 64 69 72 65 63 74 69 Data Ascii: e",value:"text"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"targetLanding"},arguments:[],directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"FragmentSpread",name:{kind:"Name",value:"CTATargetLandingFragment"},directi
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 63 74 61 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 2e 2e 2e 48 65 72 6f 43 54 41 46 72 61 67 6d 65 6e 74 5c 6e 20 20 20 20 20 20 20 20 7d 5c 6e 20 20 20 20 20 20 20 20 63 61 70 74 69 6f 6e 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 2e 2e 2e 20 6f 6e 20 48 65 72 6f 54 65 78 74 43 61 70 74 69 6f 6e 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 5c 6e 20 20 20 20 20 20 20 20 20 20 7d 5c 6e 20 20 20 20 20 20 20 20 20 20 2e 2e 2e 20 6f 6e 20 48 65 72 6f 43 6f 75 6e 74 64 6f 77 6e 43 61 70 74 69 6f 6e 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 63 61 6d 70 61 69 67 6e 45 6e 64 5c 6e 20 20 20 20 20 20 20 20 20 20 7d 5c 6e 20 20 20 20 20 20 20 20 7d 5c 6e 20 20 20 20 20 20 20 20 73 69 67 6e 61 74 75 72 65 5c 6e 20 20 20 20 20 Data Ascii: cta {\n ...HeroCTAFragment\n }\n caption {\n ... on HeroTextCaption {\n text\n }\n ... on HeroCountdownCaption {\n campaignEnd\n }\n }\n signature\n
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 65 3a 22 74 65 78 74 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 5d 7d 7d 2c 7b 6b 69 6e 64 3a 22 49 6e 6c 69 6e 65 46 72 61 67 6d 65 6e 74 22 2c 74 79 70 65 43 6f 6e 64 69 74 69 6f 6e 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 64 54 79 70 65 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 53 65 63 6f 6e 64 61 72 79 42 61 6e 6e 65 72 43 6f 75 6e 74 64 6f 77 6e 43 61 70 74 69 6f 6e 22 7d 7d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 Data Ascii: e:"text"},arguments:[],directives:[]}]}},{kind:"InlineFragment",typeCondition:{kind:"NamedType",name:{kind:"Name",value:"SecondaryBannerCountdownCaption"}},directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"Field",name:{kind:"Name",value:"
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 75 72 6c 50 61 74 68 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 71 75 65 72 79 50 61 72 61 6d 73 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 6e 61 6d 65 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d Data Ascii: ind:"Name",value:"urlPath"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"queryParams"},arguments:[],directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"Field",name:{kind:"Name",value:"name"},arguments:[],directives:[]}
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 74 20 7b 5c 6e 20 20 20 20 20 20 75 73 65 72 20 7b 5c 6e 20 20 20 20 20 20 20 20 68 61 73 55 70 63 6f 6d 69 6e 67 42 6f 6f 6b 69 6e 67 5c 6e 20 20 20 20 20 20 20 20 68 61 73 4f 6e 67 6f 69 6e 67 42 6f 6f 6b 69 6e 67 5c 6e 20 20 20 20 20 20 7d 5c 6e 20 20 20 20 7d 5c 6e 20 20 7d 5c 6e 22 2c 6e 61 6d 65 3a 22 47 72 61 70 68 51 4c 20 72 65 71 75 65 73 74 22 2c 6c 6f 63 61 74 69 6f 6e 4f 66 66 73 65 74 3a 7b 6c 69 6e 65 3a 31 2c 63 6f 6c 75 6d 6e 3a 31 7d 7d 7d 7d 3b 76 61 72 20 76 3d 69 28 22 32 62 62 33 36 38 35 62 22 29 2c 67 3d 69 28 22 34 39 33 33 61 33 65 37 22 29 2c 4e 3d 69 28 22 35 64 62 38 39 32 30 64 22 29 3b 66 75 6e 63 74 69 6f 6e 20 70 28 29 7b 76 61 72 20 65 2c 6e 3b 63 6f 6e 73 74 20 69 3d 28 30 2c 74 2e 67 65 74 52 65 71 75 65 73 74 43 6f 6e Data Ascii: t {\n user {\n hasUpcomingBooking\n hasOngoingBooking\n }\n }\n }\n",name:"GraphQL request",locationOffset:{line:1,column:1}}}};var v=i("2bb3685b"),g=i("4933a3e7"),N=i("5db8920d");function p(){var e,n;const i=(0,t.getRequestCon
2024-02-08 18:35:40 UTC	1631	IN	Data Raw: 20 65 2e 76 69 65 77 5f 73 72 5f 62 61 6e 6e 65 72 3d 22 76 69 65 77 5f 73 72 5f 62 61 6e 6e 65 72 22 2c 65 2e 76 69 65 77 5f 62 64 5f 62 61 6e 6e 65 72 3d 22 76 69 65 77 5f 62 64 5f 62 61 6e 6e 65 72 22 2c 65 2e 76 69 65 77 5f 67 65 6e 69 75 73 5f 76 69 70 5f 65 6e 74 72 61 6e 63 65 3d 22 76 69 65 77 5f 67 65 6e 69 75 73 5f 76 69 70 5f 65 6e 74 72 61 6e 63 65 22 2c 65 2e 63 6c 69 63 6b 5f 67 65 6e 69 75 73 5f 76 69 70 5f 65 6e 74 72 61 6e 63 65 3d 22 63 6c 69 63 6b 5f 67 65 6e 69 75 73 5f 76 69 70 5f 65 6e 74 72 61 6e 63 65 22 2c 65 2e 63 6c 69 63 6b 5f 73 72 5f 62 61 6e 6e 65 72 5f 74 6f 5f 62 73 3d 22 63 6c 69 63 6b 5f 73 72 5f 62 61 6e 6e 65 72 5f 74 6f 5f 62 73 22 2c 65 2e 63 6c 69 63 6b 5f 62 64 5f 62 61 6e 6e 65 72 5f 74 6f 5f 6c 70 3d 22 63 6c 69 Data Ascii: e.view_sr_banner="view_sr_banner",e.view_bd_banner="view_bd_banner",e.view_genius_vip_entrance="view_genius_vip_entrance",e.click_genius_vip_entrance="click_genius_vip_entrance",e.click_sr_banner_to_bs="click_sr_banner_to_bs",e.click_bd_banner_to_lp="cli

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	49836	3.161.193.117	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:40 UTC	550	OUT	OPTIONS /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type,x-booking-api-version Origin: https://www.booking.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:40 UTC	803	IN	HTTP/1.1 200 OK Content-Type: text/plain Content-Length: 13 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:40 GMT vary: Origin access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true access-control-max-age: 1800 access-control-allow-methods: GET,POST access-control-allow-headers: Accept,Accept-Encoding,Accept-Language,Connection,Content-Length,Content-Type,Host,Origin,Referer,User-Agent,X-Booking-API-Version,X-Booking-CSRF allow: POST,OPTIONS strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 027a05b705768a1d8e70b3e27a18b12e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P8 X-Amz-Cf-Id: nG-QDdSM1P7Q7RmOWOfUUc8gdXaJeNoo8zYeJrvorMFNf0WtT-Ou-w==
2024-02-08 18:35:40 UTC	13	IN	Data Raw: 50 4f 53 54 2c 20 4f 50 54 49 4f 4e 53 Data Ascii: POST, OPTIONS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	49837	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:40 UTC	589	OUT	GET /psb/capla/static/js/445be7a9.e9bb815f.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:40 UTC	685	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 83382 Connection: close Last-Modified: Mon, 05 Feb 2024 10:15:48 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: PUubFuzDTygANLR7L9k_zZJKEa4c0GWZ Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 18:32:48 GMT ETag: "725edc238b6be7ab351e6686b8b2b8e8" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 ea0f86c249e022d5015ce79f54e723d0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: FVJbnqMYhuqoYENS6--2hU2hrVupe-kPSkxAtzITPJxLEHDa68PzgQ== Age: 1237 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:40 UTC	15699	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 34 34 35 62 65 37 61 39 2e 65 39 62 62 38 31 35 66 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 34 34 35 62 65 37 61 39 22 5d 2c 7b 62 63 61 31 31 34 31 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 Data Ascii: /! For license information please see 445be7a9.e9bb815f.chunk.js.LICENSE.txt /(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["445be7a9"],{bca1141e:function(e,t,n){"use strict";var
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 32 2e 32 35 68 2d 31 35 41 32 2e 32 35 20 32 2e 32 35 20 30 20 30 20 30 20 32 2e 32 35 20 34 2e 35 76 36 2e 37 35 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 31 2e 35 20 30 56 34 2e 35 61 2e 37 35 2e 37 35 20 30 20 30 20 31 20 2e 37 35 2d 2e 37 35 68 31 35 61 2e 37 35 2e 37 35 20 30 20 30 20 31 20 2e 37 35 2e 37 35 76 36 2e 37 35 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 31 2e 35 20 30 7a 6d 2d 31 33 2e 32 35 2d 33 68 37 61 2e 32 35 2e 32 35 20 30 20 30 20 31 20 2e 32 35 2e 32 35 76 32 2e 37 35 6c 2e 37 35 2d 2e 37 35 68 2d 39 6c 2e 37 35 2e 37 35 56 38 2e 35 61 2e 32 35 2e 32 35 20 30 20 30 20 31 20 2e 32 35 2d 2e 32 35 7a 6d 30 2d 31 2e 35 41 31 2e 37 35 20 31 2e 37 35 20 30 20 30 20 30 20 36 2e 37 35 20 38 2e 35 76 32 2e 37 35 63 30 20 2e 34 31 34 2e 33 Data Ascii: 2.25h-15A2.25 2.25 0 0 0 2.25 4.5v6.75a.75.75 0 0 0 1.5 0V4.5a.75.75 0 0 1 .75-.75h15a.75.75 0 0 1 .75.75v6.75a.75.75 0 0 0 1.5 0zm-13.25-3h7a.25.25 0 0 1 .25.25v2.75l.75-.75h-9l.75.75V8.5a.25.25 0 0 1 .25-.25zm0-1.5A1.75 1.75 0 0 0 6.75 8.5v2.75c0 .414.3
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 65 74 75 72 6e 20 6d 7d 2c 63 62 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 52 7d 2c 63 63 58 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 44 7d 2c 65 4f 4d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 45 7d 2c 6a 76 69 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 41 7d 2c 6d 56 54 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 73 7d 2c 6e 4e 33 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 2c 70 5a 78 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 68 7d 2c 73 61 5f 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 7d 2c 73 6d 4f 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4e 7d 2c 76 41 77 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e Data Ascii: eturn m},cbr:function(){return R},ccX:function(){return D},eOM:function(){return E},jvi:function(){return A},mVT:function(){return s},nN3:function(){return o},pZx:function(){return h},sa_:function(){return l},smO:function(){return N},vAw:function(){return
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 22 2c 53 74 72 69 6e 67 28 74 2e 64 74 73 6c 49 64 29 29 2c 61 2e 73 65 74 28 22 64 74 73 6c 5f 74 79 70 65 22 2c 74 2e 64 74 73 6c 54 79 70 65 29 29 2c 22 75 63 66 61 63 22 69 6e 20 74 26 26 74 2e 75 63 66 61 63 26 26 61 2e 73 65 74 28 22 75 63 66 61 63 22 2c 74 2e 75 63 66 61 63 29 2c 22 75 63 66 67 66 66 22 69 6e 20 74 26 26 74 2e 75 63 66 67 66 66 26 26 61 2e 73 65 74 28 22 75 63 66 67 66 66 22 2c 74 2e 75 63 66 67 66 66 29 3b 63 6f 6e 73 74 20 6c 3d 22 69 73 4e 61 74 69 76 65 41 64 22 69 6e 20 74 26 26 74 2e 69 73 4e 61 74 69 76 65 41 64 2c 75 3d 22 6e 61 74 69 76 65 41 64 49 64 22 69 6e 20 74 26 26 74 2e 6e 61 74 69 76 65 41 64 49 64 2c 64 3d 22 6e 61 74 69 76 65 41 64 73 43 70 63 22 69 6e 20 74 26 26 74 2e 6e 61 74 69 76 65 41 64 73 43 70 63 2c 45 Data Ascii: ",String(t.dtslId)),a.set("dtsl_type",t.dtslType)),"ucfac"in t&&t.ucfac&&a.set("ucfac",t.ucfac),"ucfgff"in t&&t.ucfgff&&a.set("ucfgff",t.ucfgff);const l="isNativeAd"in t&&t.isNativeAd,u="nativeAdId"in t&&t.nativeAdId,d="nativeAdsCpc"in t&&t.nativeAdsCpc,E
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 4c 54 45 52 5f 42 45 41 43 48 5f 41 43 43 45 53 53 5f 46 41 43 49 4c 49 54 59 3a 22 42 65 61 63 68 41 63 63 65 73 73 46 61 63 69 6c 69 74 79 46 69 6c 74 65 72 22 2c 46 49 4c 54 45 52 5f 53 55 53 54 41 49 4e 41 42 4c 45 5f 50 52 4f 50 45 52 54 59 3a 22 53 75 73 74 61 69 6e 61 62 6c 65 50 72 6f 70 65 72 74 79 46 69 6c 74 65 72 22 2c 46 49 4c 54 45 52 5f 53 55 53 54 41 49 4e 41 42 4c 45 5f 4c 45 56 45 4c 5f 50 52 4f 50 45 52 54 59 3a 22 53 75 73 74 61 69 6e 61 62 6c 65 50 72 6f 70 65 72 74 79 4c 65 76 65 6c 46 69 6c 74 65 72 22 2c 46 49 4c 54 45 52 5f 54 48 41 49 5f 50 41 53 53 3a 22 74 68 61 69 5f 70 61 73 73 22 2c 46 49 4c 54 45 52 5f 55 4e 49 54 5f 43 4f 4e 46 49 47 3a 22 75 6e 69 74 5f 63 6f 6e 66 69 67 5f 67 72 6f 75 70 65 64 22 2c 46 49 4c 54 45 52 5f Data Ascii: LTER_BEACH_ACCESS_FACILITY:"BeachAccessFacilityFilter",FILTER_SUSTAINABLE_PROPERTY:"SustainablePropertyFilter",FILTER_SUSTAINABLE_LEVEL_PROPERTY:"SustainablePropertyLevelFilter",FILTER_THAI_PASS:"thai_pass",FILTER_UNIT_CONFIG:"unit_config_grouped",FILTER_
2024-02-08 18:35:40 UTC	2147	IN	Data Raw: 69 6e 69 74 28 29 2c 45 26 26 21 30 21 3d 3d 45 26 26 28 74 68 69 73 2e 24 4c 3d 74 68 69 73 2e 6c 6f 63 61 6c 65 28 45 29 2e 24 4c 29 2c 64 26 26 6e 21 3d 3d 74 68 69 73 2e 66 6f 72 6d 61 74 28 73 29 26 26 28 74 68 69 73 2e 24 64 3d 6e 65 77 20 44 61 74 65 28 22 22 29 29 7d 65 6c 73 65 20 69 66 28 73 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 66 6f 72 28 76 61 72 20 5f 3d 73 2e 6c 65 6e 67 74 68 2c 66 3d 31 3b 66 3c 3d 5f 3b 66 2b 3d 31 29 7b 6f 5b 31 5d 3d 73 5b 66 2d 31 5d 3b 76 61 72 20 6d 3d 72 2e 61 70 70 6c 79 28 74 68 69 73 2c 6f 29 3b 69 66 28 6d 2e 69 73 56 61 6c 69 64 28 29 29 7b 74 68 69 73 2e 24 64 3d 6d 2e 24 64 2c 74 68 69 73 2e 24 4c 3d 6d 2e 24 4c 2c 74 68 69 73 2e 69 6e 69 74 28 29 3b 62 72 65 61 6b 7d 66 3d 3d 3d 5f 26 26 28 Data Ascii: init(),E&&!0!==E&&(this.$L=this.locale(E).$L),d&&n!==this.format(s)&&(this.$d=new Date(""))}else if(s instanceof Array)for(var _=s.length,f=1;f<=_;f+=1){o[1]=s[f-1];var m=r.apply(this,o);if(m.isValid()){this.$d=m.$d,this.$L=m.$L,this.init();break}f===_&&(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	49838	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:40 UTC	589	OUT	GET /psb/capla/static/js/53a8d0d3.8742f23d.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:40 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 40169 Connection: close Last-Modified: Mon, 05 Feb 2024 10:15:48 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: HCfdw5GR0sSmOw8dc_.eMZFpYZHVfbcA Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 11:19:02 GMT ETag: "199d642c5b6c7f31e39c1a73f70eaddb" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 9546eb427ef2137803aed00cad4fc426.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: wuHDT0zSRsXj5CGFtKuJlzSgn2M52mpxUYfeIt9ls-n8dQiXAm0u9Q== Age: 26199 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:40 UTC	15698	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 35 33 61 38 64 30 64 33 2e 38 37 34 32 66 32 33 64 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 35 33 61 38 64 30 64 33 22 5d 2c 7b 22 35 31 61 33 38 38 63 33 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 Data Ascii: /! For license information please see 53a8d0d3.8742f23d.chunk.js.LICENSE.txt /(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["53a8d0d3"],{"51a388c3":function(e,t,n){"use strict";va
2024-02-08 18:35:40 UTC	16384	IN	Data Raw: 38 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 5f 5f 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 7d 2c 75 49 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4e 7d 7d 29 3b 76 61 72 20 72 3d 6e 28 22 65 61 64 37 31 65 62 30 22 29 2c 61 3d 6e 2e 6e 28 72 29 2c 69 3d 6e 28 22 35 38 66 66 31 33 37 35 22 29 2c 45 3d 6e 28 22 38 31 34 62 64 39 64 33 22 29 2c 5f 3d 6e 28 22 30 37 38 38 64 61 38 33 22 29 2c 63 3d 6e 28 22 61 37 30 64 36 62 38 65 22 29 2c 6f 3d 6e 28 22 33 33 37 64 63 38 33 61 22 29 2c 75 3d 6e 28 22 62 63 61 34 62 32 37 37 22 29 2c 49 3d 6e 28 22 31 63 30 66 63 66 32 62 22 29 2c 41 3d 6e 28 22 31 34 32 34 64 30 33 33 22 29 2c 54 3d 6e 28 22 61 62 65 31 Data Ascii: 8":function(e,t,n){"use strict";n.d(t,{__:function(){return l},uI:function(){return N}});var r=n("ead71eb0"),a=n.n(r),i=n("58ff1375"),E=n("814bd9d3"),_=n("0788da83"),c=n("a70d6b8e"),o=n("337dc83a"),u=n("bca4b277"),I=n("1c0fcf2b"),A=n("1424d033"),T=n("abe1
2024-02-08 18:35:40 UTC	8087	IN	Data Raw: 6c 76 65 28 29 7b 72 65 74 75 72 6e 22 33 62 32 36 35 62 30 37 22 7d 7d 29 7d 2c 22 32 33 62 31 63 32 61 65 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 22 31 39 65 37 66 37 62 66 22 29 3b 74 2e 5a 3d 72 2e 5a 7d 2c 63 31 32 33 62 62 33 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 42 53 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 7d 2c 45 30 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 2c 6a 5f 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 7d 2c 6e 62 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 45 7d 2c 77 37 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 Data Ascii: lve(){return"3b265b07"}})},"23b1c2ae":function(e,t,n){"use strict";var r=n("19e7f7bf");t.Z=r.Z},c123bb32:function(e,t,n){"use strict";n.d(t,{BS:function(){return u},E0:function(){return i},j_:function(){return _},nb:function(){return E},w7:function(){retu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	49840	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:40 UTC	771	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-116109-18&cid=421694156.1707417338&jid=1238114313&_u=aGBAgAIJAAAAAGgMIAC~&z=2006954226 HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:40 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:40 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:40 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	49841	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:40 UTC	589	OUT	GET /psb/capla/static/js/cfbdd235.02b9cad2.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:41 UTC	686	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 84714 Connection: close Last-Modified: Mon, 05 Feb 2024 10:15:49 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: gV1e9GWoSzLiRrHJc_HQ9T4DRxfQUYee Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 13:52:36 GMT ETag: "570a26cffe5c8621685e1e4fbdc430e1" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 9546eb427ef2137803aed00cad4fc426.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: -IqZGtRblsHje_FgVtMLJWOdHiTFSdkZmBZBgABil1gHL4EOUFwtjw== Age: 16986 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:35:41 UTC	15698	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 63 66 62 64 64 32 33 35 2e 30 32 62 39 63 61 64 32 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 69 6e 64 65 78 2d 6c 70 2d 77 65 62 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 63 66 62 64 64 32 33 35 22 5d 2c 7b 62 63 61 31 31 34 31 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 Data Ascii: /! For license information please see cfbdd235.02b9cad2.chunk.js.LICENSE.txt /(self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-index-lp-web-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["cfbdd235"],{bca1141e:function(e,t,n){"use strict";var
2024-02-08 18:35:41 UTC	16384	IN	Data Raw: 2d 32 2e 32 35 68 2d 31 35 41 32 2e 32 35 20 32 2e 32 35 20 30 20 30 20 30 20 32 2e 32 35 20 34 2e 35 76 36 2e 37 35 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 31 2e 35 20 30 56 34 2e 35 61 2e 37 35 2e 37 35 20 30 20 30 20 31 20 2e 37 35 2d 2e 37 35 68 31 35 61 2e 37 35 2e 37 35 20 30 20 30 20 31 20 2e 37 35 2e 37 35 76 36 2e 37 35 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 31 2e 35 20 30 7a 6d 2d 31 33 2e 32 35 2d 33 68 37 61 2e 32 35 2e 32 35 20 30 20 30 20 31 20 2e 32 35 2e 32 35 76 32 2e 37 35 6c 2e 37 35 2d 2e 37 35 68 2d 39 6c 2e 37 35 2e 37 35 56 38 2e 35 61 2e 32 35 2e 32 35 20 30 20 30 20 31 20 2e 32 35 2d 2e 32 35 7a 6d 30 2d 31 2e 35 41 31 2e 37 35 20 31 2e 37 35 20 30 20 30 20 30 20 36 2e 37 35 20 38 2e 35 76 32 2e 37 35 63 30 20 2e 34 31 34 2e Data Ascii: -2.25h-15A2.25 2.25 0 0 0 2.25 4.5v6.75a.75.75 0 0 0 1.5 0V4.5a.75.75 0 0 1 .75-.75h15a.75.75 0 0 1 .75.75v6.75a.75.75 0 0 0 1.5 0zm-13.25-3h7a.25.25 0 0 1 .25.25v2.75l.75-.75h-9l.75.75V8.5a.25.25 0 0 1 .25-.25zm0-1.5A1.75 1.75 0 0 0 6.75 8.5v2.75c0 .414.
2024-02-08 18:35:41 UTC	16384	IN	Data Raw: 72 65 74 75 72 6e 20 6d 7d 2c 63 62 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 52 7d 2c 63 63 58 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 44 7d 2c 65 4f 4d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 45 7d 2c 6a 76 69 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 41 7d 2c 6d 56 54 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 73 7d 2c 6e 4e 33 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 2c 70 5a 78 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 68 7d 2c 73 61 5f 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 7d 2c 73 6d 4f 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4e 7d 2c 76 41 77 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 Data Ascii: return m},cbr:function(){return R},ccX:function(){return D},eOM:function(){return E},jvi:function(){return A},mVT:function(){return s},nN3:function(){return o},pZx:function(){return h},sa_:function(){return l},smO:function(){return N},vAw:function(){retur
2024-02-08 18:35:41 UTC	16384	IN	Data Raw: 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 73 2e 6e 62 43 68 69 6c 64 72 65 6e 26 26 28 61 2e 73 65 74 28 22 67 72 6f 75 70 5f 63 68 69 6c 64 72 65 6e 22 2c 53 74 72 69 6e 67 28 73 2e 6e 62 43 68 69 6c 64 72 65 6e 29 29 2c 6e 75 6c 6c 21 3d 3d 6e 26 26 76 6f 69 64 20 30 21 3d 3d 6e 26 26 6e 2e 73 6b 69 70 4e 6f 6e 4d 61 70 50 61 72 61 6d 73 7c 7c 61 2e 73 65 74 28 22 72 65 71 5f 63 68 69 6c 64 72 65 6e 22 2c 53 74 72 69 6e 67 28 73 2e 6e 62 43 68 69 6c 64 72 65 6e 29 29 29 2c 6e 75 6c 6c 21 3d 3d 6e 26 26 76 6f 69 64 20 30 21 3d 3d 6e 26 26 6e 2e 73 6b 69 70 4e 6f 6e 4d 61 70 50 61 72 61 6d 73 7c 7c 73 2e 63 68 69 6c 64 72 65 6e 41 67 65 73 26 26 73 2e 63 68 69 6c 64 72 65 6e 41 67 65 73 2e 66 6f 72 45 61 63 68 28 28 65 3d 3e 7b 61 2e 61 70 70 65 Data Ascii: efined"!==typeof s.nbChildren&&(a.set("group_children",String(s.nbChildren)),null!==n&&void 0!==n&&n.skipNonMapParams\|\|a.set("req_children",String(s.nbChildren))),null!==n&&void 0!==n&&n.skipNonMapParams\|\|s.childrenAges&&s.childrenAges.forEach((e=>{a.appe
2024-02-08 18:35:41 UTC	16384	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 7d 29 3b 63 6f 6e 73 74 20 72 3d 22 6e 66 6c 74 22 2c 69 3d 22 3b 22 2c 61 3d 7b 46 49 4c 54 45 52 5f 43 4c 41 53 53 3a 22 63 6c 61 73 73 22 2c 46 49 4c 54 45 52 5f 48 4f 54 45 4c 5f 54 59 50 45 3a 22 68 74 5f 69 64 22 2c 46 49 4c 54 45 52 5f 32 34 48 52 5f 52 45 43 45 50 54 49 4f 4e 3a 22 68 72 5f 32 34 22 2c 46 49 4c 54 45 52 5f 46 41 43 49 4c 49 54 49 45 53 3a 22 68 6f 74 65 6c 66 61 63 69 6c 69 74 79 22 2c 46 49 4c 54 45 52 5f 52 4f 4f 4d 5f 46 41 43 49 4c 49 54 49 45 53 3a 22 72 6f 6f 6d 66 61 63 69 6c 69 74 79 22 2c 46 49 4c 54 45 52 5f 44 49 53 54 52 49 43 54 3a 22 64 69 22 2c 46 49 4c 54 45 52 5f 43 48 41 49 4e 53 3a 22 63 68 61 69 6e 63 6f 64 65 22 2c 46 49 4c 54 45 52 5f 43 48 41 49 Data Ascii: :function(){return r}});const r="nflt",i=";",a={FILTER_CLASS:"class",FILTER_HOTEL_TYPE:"ht_id",FILTER_24HR_RECEPTION:"hr_24",FILTER_FACILITIES:"hotelfacility",FILTER_ROOM_FACILITIES:"roomfacility",FILTER_DISTRICT:"di",FILTER_CHAINS:"chaincode",FILTER_CHAI
2024-02-08 18:35:41 UTC	3480	IN	Data Raw: 32 7c 7c 6e 7d 5d 2c 4d 4d 4d 4d 3a 5b 69 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 73 28 22 6d 6f 6e 74 68 73 22 29 2e 69 6e 64 65 78 4f 66 28 65 29 2b 31 3b 69 66 28 74 3c 31 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 3b 74 68 69 73 2e 6d 6f 6e 74 68 3d 74 25 31 32 7c 7c 74 7d 5d 2c 59 3a 5b 2f 5b 2b 2d 5d 3f 5c 64 2b 2f 2c 61 28 22 79 65 61 72 22 29 5d 2c 59 59 3a 5b 6e 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 3d 2b 65 2c 74 68 69 73 2e 79 65 61 72 3d 65 2b 28 65 3e 36 38 3f 31 39 30 30 3a 32 65 33 29 7d 5d 2c 59 59 59 59 3a 5b 2f 5c 64 7b 34 7d 2f 2c 61 28 22 79 65 61 72 22 29 5d 2c 5a 3a 6f 2c 5a 5a 3a 6f 7d 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 72 29 7b 74 72 79 7b 76 61 72 20 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b Data Ascii: 2\|\|n}],MMMM:[i,function(e){var t=s("months").indexOf(e)+1;if(t<1)throw new Error;this.month=t%12\|\|t}],Y:[/[+-]?\d+/,a("year")],YY:[n,function(e){e=+e,this.year=e+(e>68?1900:2e3)}],YYYY:[/\d{4}/,a("year")],Z:o,ZZ:o},l=function(e,n,r){try{var i=function(e){

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	49842	104.18.130.236	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:40 UTC	433	OUT	GET /consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf/en-us.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:41 UTC	902	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:35:41 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8525f94decf5b033-ATL CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 14408 Cache-Control: public, max-age=86400 Expires: Fri, 09 Feb 2024 18:35:41 GMT Last-Modified: Fri, 02 Feb 2024 12:54:41 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: SwZTy4V7mJNhsDn8Sf3xRg== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 37275edb-701e-008c-3ad7-55518d000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-02-08 18:35:41 UTC	467	IN	Data Raw: 31 63 61 39 0d 0a 7b 22 44 6f 6d 61 69 6e 44 61 74 61 22 3a 7b 22 70 63 6c 69 66 65 53 70 61 6e 59 72 22 3a 22 59 65 61 72 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 59 72 73 22 3a 22 59 65 61 72 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 53 65 63 73 22 3a 22 41 20 66 65 77 20 73 65 63 6f 6e 64 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 22 3a 22 57 65 65 6b 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 73 22 3a 22 57 65 65 6b 73 22 2c 22 70 63 63 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 54 65 78 74 22 3a 22 43 6f 6e 74 69 6e 75 65 20 77 69 74 68 6f 75 74 20 41 63 63 65 70 74 69 6e 67 22 2c 22 70 63 63 6c 6f 73 65 42 75 74 74 6f 6e 54 79 70 65 22 3a 22 49 63 6f 6e 22 2c 22 4d 61 69 6e 54 65 78 74 22 3a 22 4d 61 6e 61 67 65 20 79 6f 75 72 Data Ascii: 1ca9{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","pccloseButtonType":"Icon","MainText":"Manage your
2024-02-08 18:35:41 UTC	1369	IN	Data Raw: 6b 69 65 73 54 65 78 74 22 3a 22 59 6f 75 72 20 50 72 69 76 61 63 79 22 2c 22 43 6f 6e 66 69 72 6d 54 65 78 74 22 3a 22 41 6c 6c 6f 77 20 41 6c 6c 22 2c 22 41 6c 6c 6f 77 41 6c 6c 54 65 78 74 22 3a 22 53 61 76 65 20 53 65 74 74 69 6e 67 73 22 2c 22 43 6f 6f 6b 69 65 73 55 73 65 64 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 75 73 65 64 22 2c 22 43 6f 6f 6b 69 65 73 44 65 73 63 54 65 78 74 22 3a 22 44 65 73 63 72 69 70 74 69 6f 6e 22 2c 22 41 62 6f 75 74 4c 69 6e 6b 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 67 65 6e 65 72 61 6c 2e 68 74 6d 6c 3f 74 6d 70 6c 3d 64 6f 63 73 2f 70 72 69 76 61 63 79 2d 70 6f 6c 69 63 79 22 2c 22 41 63 74 69 76 65 54 65 78 74 22 3a 22 41 63 74 69 76 65 22 2c 22 41 6c 77 61 79 73 41 63 74 Data Ascii: kiesText":"Your Privacy","ConfirmText":"Allow All","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","CookiesDescText":"Description","AboutLink":"https://www.booking.com/general.html?tmpl=docs/privacy-policy","ActiveText":"Active","AlwaysAct
2024-02-08 18:35:41 UTC	1369	IN	Data Raw: 6c 73 65 2c 22 48 61 73 53 63 72 69 70 74 41 72 63 68 69 76 65 22 3a 66 61 6c 73 65 2c 22 42 61 6e 6e 65 72 50 6f 73 69 74 69 6f 6e 22 3a 22 62 6f 74 74 6f 6d 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 50 6f 73 69 74 69 6f 6e 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 43 6f 6e 66 69 72 6d 54 65 78 74 22 3a 22 43 6f 6e 66 69 72 6d 20 4d 79 20 43 68 6f 69 63 65 73 22 2c 22 56 65 6e 64 6f 72 4c 69 73 74 54 65 78 74 22 3a 22 4c 69 73 74 20 6f 66 20 49 41 42 20 56 65 6e 64 6f 72 73 22 2c 22 54 68 69 72 64 50 61 72 74 79 43 6f 6f 6b 69 65 4c 69 73 74 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 77 65 20 75 73 65 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 4d 61 6e 61 67 65 50 72 65 66 65 72 Data Ascii: lse,"HasScriptArchive":false,"BannerPosition":"bottom","PreferenceCenterPosition":"default","PreferenceCenterConfirmText":"Confirm My Choices","VendorListText":"List of IAB Vendors","ThirdPartyCookieListText":"Cookies we use","PreferenceCenterManagePrefer
2024-02-08 18:35:41 UTC	1369	IN	Data Raw: 74 20 73 65 61 72 63 68 65 73 2c 20 61 6e 64 20 6f 74 68 65 72 20 70 72 65 66 65 72 65 6e 63 65 73 2e 20 54 68 65 73 65 20 74 65 63 68 6e 69 63 61 6c 20 63 6f 6f 6b 69 65 73 20 6d 75 73 74 20 62 65 20 65 6e 61 62 6c 65 64 20 74 6f 20 75 73 65 20 6f 75 72 20 73 69 74 65 20 61 6e 64 20 73 65 72 76 69 63 65 73 2e 22 2c 22 47 72 6f 75 70 44 65 73 63 72 69 70 74 69 6f 6e 4f 54 54 22 3a 22 46 75 6e 63 74 69 6f 6e 61 6c 20 63 6f 6f 6b 69 65 73 20 65 6e 61 62 6c 65 20 6f 75 72 20 77 65 62 73 69 74 65 20 74 6f 20 77 6f 72 6b 20 70 72 6f 70 65 72 6c 79 2c 20 73 6f 20 79 6f 75 20 63 61 6e 20 63 72 65 61 74 65 20 61 6e 20 61 63 63 6f 75 6e 74 2c 20 73 69 67 6e 20 69 6e 2c 20 61 6e 64 20 6d 61 6e 61 67 65 20 62 6f 6f 6b 69 6e 67 73 2e 20 54 68 65 79 20 61 6c 73 6f 20 Data Ascii: t searches, and other preferences. These technical cookies must be enabled to use our site and services.","GroupDescriptionOTT":"Functional cookies enable our website to work properly, so you can create an account, sign in, and manage bookings. They also
2024-02-08 18:35:41 UTC	1369	IN	Data Raw: 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 69 73 20 63 6f 6f 6b 69 65 20 73 65 72 76 65 73 20 61 20 73 70 65 63 69 66 69 63 20 77 65 62 20 62 72 6f 77 73 69 6e 67 20 75 73 65 20 63 61 73 65 2e 20 49 74 20 61 6c 6c 65 76 69 61 74 65 73 20 74 68 65 20 70 72 6f 62 6c 65 6d 20 6f 66 20 73 6f 6d 65 20 62 72 6f 77 73 65 72 73 20 64 72 6f 70 70 69 6e 67 20 74 68 65 20 70 6f 73 74 20 62 6f 64 79 20 77 68 65 6e 20 73 68 6f 77 69 6e 67 20 61 6e 20 69 6e 74 65 72 73 74 69 74 69 61 6c 20 70 61 67 65 20 28 74 6f 20 66 6f 72 63 65 20 74 68 65 20 6c 6f 61 64 20 6f 66 20 49 6d 70 65 72 76 61 20 4a 61 76 61 53 63 72 69 70 74 29 20 6f 6e 20 61 20 50 4f 53 54 20 72 65 71 75 65 73 74 2e 20 54 68 69 73 20 69 73 20 64 6f 6e 65 20 Data Ascii: "Length":"0","description":"This cookie serves a specific web browsing use case. It alleviates the problem of some browsers dropping the post body when showing an interstitial page (to force the load of Imperva JavaScript) on a POST request. This is done
2024-02-08 18:35:41 UTC	1369	IN	Data Raw: 22 62 6b 6e 67 5f 66 72 6f 6e 74 65 6e 64 5f 73 65 73 65 5f 65 78 70 22 2c 22 48 6f 73 74 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 32 39 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 69 73 20 63 6f 6f 6b 69 65 20 69 73 20 75 73 65 64 20 61 73 20 61 6e 20 65 78 70 65 72 69 6d 65 6e 74 20 74 6f 20 68 65 6c 70 20 75 73 20 64 65 74 65 72 6d 69 6e 65 20 61 6e 64 20 6d 69 74 69 67 61 74 65 20 74 68 65 20 62 75 73 69 6e 65 73 73 20 69 6d 70 61 63 74 20 6f 66 20 74 68 65 20 6d 69 67 72 61 74 69 6f 6e 20 6f 66 20 6f 75 72 20 69 6e 74 65 72 6e 61 6c 20 64 61 74 61 20 73 74 6f 72 61 67 65 2e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 Data Ascii: "bkng_frontend_sese_exp","Host":"booking.com","IsSession":false,"Length":"29","description":"This cookie is used as an experiment to help us determine and mitigate the business impact of the migration of our internal data storage.","DurationType":1,"categ
2024-02-08 18:35:41 UTC	33	IN	Data Raw: 62 65 2d 36 34 36 32 32 36 66 30 39 65 39 30 22 2c 22 4e 61 6d 65 22 3a 22 5f 64 63 5f 67 74 0d 0a Data Ascii: be-646226f09e90","Name":"_dc_gt
2024-02-08 18:35:41 UTC	1369	IN	Data Raw: 37 66 66 39 0d 0a 6d 5f 55 41 2d 78 78 78 78 78 78 78 78 22 2c 22 48 6f 73 74 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 69 73 20 63 6f 6f 6b 69 65 20 69 73 20 61 73 73 6f 63 69 61 74 65 64 20 77 69 74 68 20 73 69 74 65 73 20 75 73 69 6e 67 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e 61 67 65 72 20 74 6f 20 6c 6f 61 64 20 6f 74 68 65 72 20 73 63 72 69 70 74 73 20 61 6e 64 20 63 6f 64 65 20 69 6e 74 6f 20 61 20 70 61 67 65 2e 20 20 57 68 65 72 65 20 69 74 20 69 73 20 75 73 65 64 20 69 74 20 6d 61 79 20 62 65 20 72 65 67 61 72 64 65 64 20 61 73 20 53 74 72 69 63 74 6c 79 20 4e 65 63 65 73 73 61 72 79 20 61 73 Data Ascii: 7ff9m_UA-xxxxxxxx","Host":"booking.com","IsSession":false,"Length":"0","description":"This cookie is associated with sites using Google Tag Manager to load other scripts and code into a page. Where it is used it may be regarded as Strictly Necessary as
2024-02-08 18:35:41 UTC	1369	IN	Data Raw: 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 64 39 62 39 38 63 38 39 2d 31 31 36 32 2d 34 66 35 61 2d 62 63 66 35 2d 63 38 37 61 64 33 36 66 36 61 30 30 22 2c 22 4e 61 6d 65 22 3a 22 36 62 64 66 61 63 35 33 63 62 66 62 36 34 38 62 37 65 62 65 37 61 31 66 65 31 62 39 33 66 34 64 22 2c 22 48 6f 73 74 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 33 36 35 33 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 73 65 73 20 45 2d 48 41 57 4b 20 74 6f 20 70 65 72 66 6f 72 6d 20 72 69 73 6b 20 63 68 65 63 6b 73 20 69 6e 20 72 65 61 6c 2d 74 69 6d 65 20 67 69 76 69 6e 67 20 64 65 74 61 69 6c 65 64 Data Ascii: tegory":null,"isThirdParty":false},{"id":"d9b98c89-1162-4f5a-bcf5-c87ad36f6a00","Name":"6bdfac53cbfb648b7ebe7a1fe1b93f4d","Host":"booking.com","IsSession":false,"Length":"3653","description":"Uses E-HAWK to perform risk checks in real-time giving detailed
2024-02-08 18:35:41 UTC	1369	IN	Data Raw: 20 69 74 20 77 61 73 20 67 69 76 65 6e 2c 20 63 6f 75 6e 74 72 79 20 61 6e 64 20 72 65 67 75 6c 61 74 69 6f 6e 2e 20 54 68 69 73 20 65 6e 61 62 6c 65 73 20 73 69 74 65 20 6f 77 6e 65 72 73 20 74 6f 20 72 65 73 70 65 63 74 20 75 73 65 72 20 63 6f 6e 73 65 6e 74 73 20 64 75 72 69 6e 67 20 70 72 6f 63 65 73 73 69 6e 67 20 6f 66 20 68 69 73 20 72 65 71 75 65 73 74 73 2e 20 54 68 65 20 63 6f 6f 6b 69 65 20 68 61 73 20 61 20 6e 6f 72 6d 61 6c 20 6c 69 66 65 73 70 61 6e 20 6f 66 20 6f 6e 65 20 79 65 61 72 2c 20 73 6f 20 74 68 61 74 20 72 65 74 75 72 6e 69 6e 67 20 76 69 73 69 74 6f 72 73 20 74 6f 20 74 68 65 20 73 69 74 65 20 77 69 6c 6c 20 68 61 76 65 20 74 68 65 69 72 20 70 72 65 66 65 72 65 6e 63 65 73 20 72 65 6d 65 6d 62 65 72 65 64 2e 20 49 74 20 63 6f 6e Data Ascii: it was given, country and regulation. This enables site owners to respect user consents during processing of his requests. The cookie has a normal lifespan of one year, so that returning visitors to the site will have their preferences remembered. It con

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	49843	104.18.131.236	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:40 UTC	597	OUT	GET /scripttemplates/202310.2.0/assets/otCommonStyles.css HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:41 UTC	826	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:35:41 GMT Content-Type: text/css Content-Length: 21778 Connection: close Content-MD5: c7xAZ9MSGAobGaTYg/Qtag== Last-Modified: Tue, 05 Dec 2023 03:37:38 GMT ETag: 0x8DBF543876E798E x-ms-request-id: 9b919782-101e-008a-6b83-276232000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 30742 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8525f94e0bf607e2-ATL
2024-02-08 18:35:41 UTC	543	IN	Data Raw: 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 7b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 74 72 75 73 74 2d 76 65 6e 64 6f 72 73 2d 6c 69 73 74 2d 68 61 6e 64 6c 65 72 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 63 6f 6c 6f 72 3a 23 31 66 39 36 64 62 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 Data Ascii: #onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .one
2024-02-08 18:35:41 UTC	1369	IN	Data Raw: 6b 20 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 7b 6f 75 74 6c 69 6e 65 2d 6f 66 66 73 65 74 3a 31 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 62 6e 72 2d 77 2d 6c 6f 67 6f 20 2e 6f 74 2d 62 6e 72 2d 6c 6f 67 6f 7b 68 65 69 67 68 74 3a 36 34 70 78 3b 77 69 64 74 68 3a 36 34 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 74 63 66 32 2d 76 65 6e 64 6f 72 2d 63 6f 75 6e 74 2e 6f 74 2d 74 65 78 74 2d 62 6f 6c 64 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 Data Ascii: k #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk.ot-bnr-w-logo .ot-bnr-logo{height:64px;width:64px}#onetrust-banner-sdk .ot-tcf2-vendor-count.ot-text-bold{font-weight:bold}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-ic
2024-02-08 18:35:41 UTC	1369	IN	Data Raw: 79 6e 63 2d 6e 74 66 79 20 62 75 74 74 6f 6e 20 2a 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 61 5b 64 61 74 61 2d 70 61 72 65 6e 74 2d 69 64 5d 20 2a 7b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 68 69 64 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 68 69 64 65 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 6f 74 2d 68 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 62 75 74 74 6f 6e 2e 6f 74 2d 6c 69 6e 6b 2d 62 74 6e 3a 68 6f 76 65 72 2c 23 6f Data Ascii: ync-ntfy button ,#ot-sync-ntfy a[data-parent-id] {font-size:inherit;font-weight:inherit;color:inherit}#onetrust-banner-sdk .ot-hide,#onetrust-pc-sdk .ot-hide,#ot-sync-ntfy .ot-hide{display:none !important}#onetrust-banner-sdk button.ot-link-btn:hover,#o
2024-02-08 18:35:41 UTC	1369	IN	Data Raw: 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 63 65 6e 74 65 72 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 70 63 2d 6c 6f 67 6f 20 69 6d 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 70 63 2d 6c 6f 67 6f 20 69 6d 67 7b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 73 63 72 Data Ascii: ackground-position:center;background-size:contain;background-repeat:no-repeat;display:inline-flex;justify-content:center;align-items:center}#onetrust-pc-sdk .pc-logo img,#onetrust-pc-sdk .ot-pc-logo img{max-height:100%;max-width:100%}#onetrust-pc-sdk .scr
2024-02-08 18:35:41 UTC	1369	IN	Data Raw: 6e 65 74 72 75 73 74 2d 66 61 64 65 2d 69 6e 7b 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 31 7d 7d 2e 6f 74 2d 63 6f 6f 6b 69 65 2d 6c 61 62 65 6c 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 34 32 36 70 78 29 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 38 39 36 70 78 29 61 6e 64 20 28 6f 72 69 65 6e 74 61 74 69 6f 6e 3a 20 6c 61 6e 64 73 63 61 70 65 29 7b 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 35 65 6d 7d 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 2d 69 6e 70 Data Ascii: netrust-fade-in{0%{opacity:0}100%{opacity:1}}.ot-cookie-label{text-decoration:underline}@media only screen and (min-width: 426px)and (max-width: 896px)and (orientation: landscape){#onetrust-pc-sdk p{font-size:.75em}}#onetrust-banner-sdk .banner-option-inp
2024-02-08 18:35:41 UTC	1369	IN	Data Raw: 61 79 3a 69 6e 6c 69 6e 65 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 7b 68 65 69 67 68 74 3a 32 30 70 78 3b 77 69 64 74 68 3a 33 30 70 78 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 30 2e 35 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 20 70 61 74 68 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 20 70 61 74 68 7b 66 69 6c 6c 3a 23 33 32 61 65 Data Ascii: ay:inline;margin-right:5px}#onetrust-banner-sdk .ot-optout-signal svg,#onetrust-pc-sdk .ot-optout-signal svg{height:20px;width:30px;transform:scale(0.5)}#onetrust-banner-sdk .ot-optout-signal svg path,#onetrust-pc-sdk .ot-optout-signal svg path{fill:#32ae
2024-02-08 18:35:41 UTC	1369	IN	Data Raw: 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 74 6f 67 67 6c 65 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 74 2d 63 6f 6e 74 65 6e 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 74 2d 70 63 2d 63 6f 6e 74 65 6e 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 64 69 76 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 73 70 61 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 31 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 32 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 33 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 34 2c Data Ascii: #onetrust-banner-sdk .ot-toggle,#onetrust-banner-sdk #ot-content,#onetrust-banner-sdk #ot-pc-content,#onetrust-banner-sdk .checkbox,#onetrust-pc-sdk div,#onetrust-pc-sdk span,#onetrust-pc-sdk h1,#onetrust-pc-sdk h2,#onetrust-pc-sdk h3,#onetrust-pc-sdk h4,
2024-02-08 18:35:41 UTC	1369	IN	Data Raw: 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 64 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 62 6f 64 79 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 74 6f 67 67 6c 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 23 6f 74 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 23 6f 74 2d 70 63 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 63 68 65 63 6b 62 6f 78 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 64 69 76 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 Data Ascii: sdk-cookie-policy td,#ot-sdk-cookie-policy tbody,#ot-sdk-cookie-policy .ot-main-content,#ot-sdk-cookie-policy .ot-toggle,#ot-sdk-cookie-policy #ot-content,#ot-sdk-cookie-policy #ot-pc-content,#ot-sdk-cookie-policy .checkbox,#ot-sync-ntfy div,#ot-sync-ntfy
2024-02-08 18:35:41 UTC	1369	IN	Data Raw: 65 72 2d 73 64 6b 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c Data Ascii: er-sdk label:after,#onetrust-banner-sdk .checkbox:after,#onetrust-banner-sdk .checkbox:before,#onetrust-pc-sdk label:before,#onetrust-pc-sdk label:after,#onetrust-pc-sdk .checkbox:after,#onetrust-pc-sdk .checkbox:before,#ot-sdk-cookie-policy label:before,
2024-02-08 18:35:41 UTC	1369	IN	Data Raw: 6b 2d 63 6f 6c 75 6d 6e 73 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 34 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 3a 66 69 72 73 74 Data Ascii: k-columns,#onetrust-pc-sdk .ot-sdk-column,#onetrust-pc-sdk .ot-sdk-columns,#ot-sdk-cookie-policy .ot-sdk-column,#ot-sdk-cookie-policy .ot-sdk-columns{margin-left:4%}#onetrust-banner-sdk .ot-sdk-column:first-child,#onetrust-banner-sdk .ot-sdk-columns:first

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	49844	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:40 UTC	679	OUT	GET /xdata/images/city/540x270/977409.jpg?k=82c14f9e6cea94829ee0528a3aa4324111d3482e9f095194500746fa7ca2769e&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:41 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sat, 03 Feb 2024 19:39:05 GMT ETag: "31b0d260ff6e000fcccf49ad3395df5ff48cff85" Content-Language: 35918 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 086e2cd5d94fa729de58c51b5666e0e4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: SMXSvru-4kx9uFXVLkbyrBaHFL8LJAcSH8zb6zeyR7YR1K4vpRyDuA== Age: 428195
2024-02-08 18:35:41 UTC	15835	IN	Data Raw: 38 63 34 65 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 01 0e 02 1c 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 8c4eJFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:35:41 UTC	16384	IN	Data Raw: 8d 46 f5 5b ec f8 d3 ed bb c8 dc ca c3 fa 7e 1c d6 05 b7 d9 a4 8d ae 21 62 cc d9 dd 34 bc b7 d7 9f eb 5e 55 7c 74 a4 bd dd 8e fa 58 4b 2b d8 d6 ba d6 af 6e c1 f2 00 b4 80 ff 00 1b f2 ed f4 1d bf 5a c9 b2 9a d6 e1 a6 92 17 67 95 18 ab bc bf 7f 3f 43 cf e7 54 f4 9b cb e6 49 d6 ea 26 66 57 21 25 90 e3 70 fc 3b 7d 29 d0 59 c1 6d 3c f3 c4 87 cc 98 ee 72 49 23 f0 15 78 6c b3 13 8a 6d 25 f3 e8 46 2f 1f 85 c1 a6 aa 4a f2 ec 86 d9 c9 7b f6 bb b5 b8 52 f0 87 cc 52 bb 7f 2c 76 c5 59 25 77 96 c6 e6 3d 58 8f e9 41 25 b9 34 98 af a9 c2 64 98 7a 2f 9e a7 bd 2f c3 ee 3e 5f 1b c4 38 9a d7 8d 1f 72 2f b6 e0 4e e3 92 73 4d a7 62 97 15 ec a4 92 b2 3c 1b b9 3b b2 3e f4 6d 39 a7 ed e6 97 6d 3b 89 46 e4 5b 73 4d 2b 8a b1 8a 42 94 5c 39 08 28 c5 48 57 14 84 63 93 45 d0 b9 59 1e Data Ascii: F[~!b4^U\|tXK+nZg?CTI&fW!%p;})Ym<rI#xlm%F/J{RR,vY%w=XA%4dz//>_8r/NsMb<;>m9m;F[sM+B\9(HWcEY
2024-02-08 18:35:41 UTC	3707	IN	Data Raw: cf f7 87 61 fa d7 17 ac ea d1 dd c9 3b 61 54 c8 0e d5 1e bd a9 52 93 84 93 3b 5b e7 85 99 b1 e1 8b ab 7b 2b 99 2e ae 1d e4 36 e8 45 b1 ce 55 49 eb c7 af 4f a5 5f b5 d5 5a fb 54 81 50 48 cc a4 bc 8e cd 9e b5 ca da 86 10 45 6e bd 4f bf 52 6b ae d1 ad 52 d6 0c 60 89 49 cb 93 5d 94 a2 ea d5 e6 30 94 94 21 62 86 b7 a5 88 b5 a9 6f 14 6d 8e ee 20 ac 47 f7 87 07 f4 c5 73 52 da 35 95 a6 8f 14 52 06 96 36 94 6e 55 cb 30 13 90 31 e9 cf e8 6b d0 b5 9b 77 bb d1 6e 12 1f f5 ca 85 a3 38 cf 20 55 0f 0c f8 26 ee fe c7 c3 da 9c f7 31 a2 c0 85 c8 20 ee 39 72 e0 e7 d7 26 ba 31 89 b9 23 8e 8c 54 6e 45 a5 9b 68 2f f5 d7 9c 18 ae 6e 6d e3 f2 a2 2c 49 04 82 58 7e 55 9d 0d dc 93 e9 b6 fa 73 32 bc 22 e3 cd 42 dc 11 f3 31 23 df ef 0f a5 74 5a 97 83 35 98 f5 b9 6f e2 58 e6 80 c2 10 Data Ascii: a;aTR;[{+.6EUIO_ZTPHEnORkR`I]0!bom GsR5R6nU01kwn8 U&1 9r&1#TnEh/nm,IX~Us2"B1#tZ5oX
2024-02-08 18:35:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	49845	3.161.193.117	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:40 UTC	650	OUT	POST /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive Content-Length: 86 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-API-Version: 1 Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:40 UTC	86	OUT	Data Raw: 7b 22 70 69 64 22 3a 22 65 34 64 65 38 32 62 39 31 39 62 38 30 30 65 34 22 2c 22 72 65 66 41 63 74 69 6f 6e 22 3a 22 69 6e 64 65 78 22 2c 22 73 69 74 65 54 79 70 65 22 3a 22 31 22 2c 22 63 6c 73 22 3a 31 2e 30 32 32 37 36 38 39 34 37 34 38 30 38 37 37 32 7d Data Ascii: {"pid":"e4de82b919b800e4","refAction":"index","siteType":"1","cls":1.0227689474808772}
2024-02-08 18:35:41 UTC	525	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:41 GMT vary: Origin, Accept-Encoding access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 b56cd7ba25707bdf7c3062c025a7fd62.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P8 X-Amz-Cf-Id: ZeWi_dhLN5Q14a_h3demzTK9m9sWDthE745m7ZmJZPesDwgrWaKMFQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	49846	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:41 UTC	2052	OUT	GET /js_tracking?ver=2&stype=1&ref_action=index&lang=en-us&pid=e4de82b919b800e4&aid=304142&sid=5171fc655664ddf74ab763a094523fb7&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|1&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLalZib7103qG%2BF6jNX4nY1OEBjrxAz9Ob8DEQBWTSqeRvOh6i7KV3uDpo7lfSd6A33jZhjYHawln8E0aqfSwxomTxD7gRkwilYph1WF73PdYDrYV%2FBds8KeGhbWuYLP5WRjHVQWXCaBnPp2c6UP9oiZIrDu36czsM%3D; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; lastSeen=0; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A39+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F
2024-02-08 18:35:41 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:41 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=e19b82be41ed006a&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejLH1whdU5saEPIeuLaAbaXZ-PvVhQP6Iqk x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 086e2cd5d94fa729de58c51b5666e0e4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: eI_GOkE3yFeLtVsWRMHY0g27ObGIC2Bj15BJu0-kHySaX8GB59123g==
2024-02-08 18:35:41 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	49847	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:41 UTC	679	OUT	GET /xdata/images/city/540x270/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:41 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sat, 03 Feb 2024 19:39:05 GMT ETag: "c950df25a838ffedb4483511736514fb4e39a488" Content-Language: 31567 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 09aa283795aaafe63cbd7c2cbac2c306.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: EK-P26oBZ4A2TbvhPb2oXdcIZVmwQ_vnm7OSFI8cL01bdg8-gAWp0w== Age: 428196
2024-02-08 18:35:41 UTC	16384	IN	Data Raw: 37 62 34 66 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 01 0e 02 1c 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 7b4fJFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:35:41 UTC	15191	IN	Data Raw: 66 bd 13 77 f1 fa ff 00 4a e1 09 03 cb cb 8c e3 ba 73 d4 fb 55 d3 57 46 55 a4 93 20 be 6b 8b 8d 39 d6 d2 e2 28 a4 1b 8e 63 5c 16 e3 ee 8c f7 3e a2 b8 77 96 69 a4 18 5c c9 80 0e 07 27 1c 7e 75 df f9 8b e5 e4 b3 10 49 fb f1 54 6d 14 02 e1 ee 44 33 19 46 41 91 62 1e bd 8d 67 57 0f ed 1a 91 be 1b 1d ec 93 8b 47 27 a0 69 d1 ea 17 12 09 5c 27 97 c9 53 d5 ba ff 00 85 6f 6b 9a 4d bd c4 10 0b 38 62 81 b7 62 4d 9b 88 65 e3 9e 73 c8 fe b4 d8 34 e8 ad f5 bf b6 c7 34 d1 f9 a0 e6 36 4e 49 3c 1c fe 3c d6 9c 92 34 89 fb b1 71 d4 e7 cb 1b 7d 29 43 0b 17 1f 79 6a 55 4c 7d 45 51 38 3d 3b 19 0d e1 5b 47 6c 5b ea 6d 1b 20 e9 71 01 51 9f 62 bb aa a3 f8 3f 57 44 06 de 38 6e 54 f3 98 65 56 27 f0 ce 7f 4a e8 65 8e 4c ca 77 4e 33 d3 e7 ce 39 1d 05 34 a1 de 81 e3 2d f2 e3 2f 2e df Data Ascii: fwJsUWFU k9(c\>wi\'~uITmD3FAbgWG'i\'SokM8bbMes446NI<<4q})CyjUL}EQ8=;[Gl[m qQb?WD8nTeV'JeLwN394-/.
2024-02-08 18:35:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	49849	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:41 UTC	679	OUT	GET /xdata/images/city/354x266/977416.jpg?k=ea06e0b572ff052f4fe4fcf35ac3616e8d1b7300f0402756c460a4e9c19e54ed&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:41 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sat, 03 Feb 2024 19:39:05 GMT ETag: "bb5ebde20c647408502d26e652a675498270cf47" Content-Language: 20782 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 fcb94596db202c75ac0e559b3183be72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: rfsIXti3cVPub-yoY4iNMXfR2nYeMyEP7vBOEx28kOL1GHzVKNcyDg== Age: 428196
2024-02-08 18:35:41 UTC	15835	IN	Data Raw: 35 31 32 65 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 01 0a 01 62 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 512eJFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222b"}!1AQa"q
2024-02-08 18:35:41 UTC	4955	IN	Data Raw: a0 04 12 c4 fd 32 31 fa 56 87 86 90 c9 a3 e9 e0 9f bb e7 28 1d 3a 9c 67 f5 ae 2b 55 98 10 77 64 fc de b5 85 2f 8a 46 d5 74 48 ce 8d 83 3b 80 01 3d c7 4c 55 93 70 ef b0 3e e6 c6 00 1d aa 08 22 01 8b 16 27 7f 6c 74 e6 9e a1 0f 19 53 8f c2 b7 31 3a ff 00 13 cc 27 d0 59 e4 fe f2 71 9e 9c 57 28 97 29 25 b4 36 6e cd 1a 6f 21 98 f3 80 4d 77 8d 69 6b a8 68 8a 8d 70 18 48 a3 6a 42 72 41 03 92 7b 0f c6 bc d0 ca 49 ea 8c 3d f1 53 45 e9 61 d4 5a dc e8 ed 6e 20 82 46 86 09 58 c6 42 7c b8 c6 e2 09 19 fe 55 3c 13 0b b4 df 28 1b c0 e7 03 8c d6 05 8c c5 2f a2 c4 40 ee 20 77 ad 3b 16 d9 13 ed 66 27 2d bb 68 07 9c 56 ad 19 16 f3 11 3c a3 8c 72 18 8e 2a ff 00 86 ed 2d af 35 db 74 62 64 8a 69 40 91 5b 8d dd f9 cd 54 8e 46 f3 95 0b 29 04 91 8d a7 3c 01 fe 35 af e1 95 59 75 dd Data Ascii: 21V(:g+Uwd/FtH;=LUp>"'ltS1:'YqW()%6no!MwikhpHjBrA{I=SEaZn FXB\|U<(/@ w;f'-hV<r*-5tbdi@[TF)<5Yu
2024-02-08 18:35:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	49850	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:41 UTC	679	OUT	GET /xdata/images/city/354x266/619763.jpg?k=3bfc62a779df5b92694287e9fc0b82d795f93700ddf8887d66f3191ee745dcc5&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:41 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Mon, 05 Feb 2024 08:52:45 GMT ETag: "60cb60de2e4d7b779152862736284e0d5e0787ea" Content-Language: 27416 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 c1bfc7dbcf7f9782aa3be590b7ce3d6a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: -fH-7BiXJhH1TuO-KbkMDE0jl6gcyUWTLBudJG4XxIBqJQGCPSFWhw== Age: 294176
2024-02-08 18:35:41 UTC	16384	IN	Data Raw: 36 62 31 38 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 01 0a 01 62 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 6b18JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222b"}!1AQa"q
2024-02-08 18:35:41 UTC	11040	IN	Data Raw: 1d a2 8b a2 39 55 dd d7 fc f1 4a 9e 1a 13 bc 63 27 a9 4e b4 a3 ab 46 fa 5c 69 91 eb b3 ad c5 c4 12 86 45 59 14 ce c0 46 40 51 d0 0e 0e 09 e7 3d 70 69 97 b6 b0 5b 5c 5a da 09 cc f0 81 cb 09 db 32 21 39 dc 47 3b b8 c7 5c e3 35 ce 47 a4 69 b7 13 cb 2b 93 24 93 e5 5d e4 20 f2 79 c9 c1 1c 64 0a b1 37 86 ed 26 9a 09 05 c4 72 b5 b2 61 43 4b b0 47 18 07 a7 5e 99 aa 96 05 45 f3 39 3d 04 b1 77 7b 1d 06 a5 a5 2d a5 bc f7 71 c9 33 a4 ec 8e 85 ae b9 8c 7f 12 a9 3f 74 67 38 c6 38 23 d2 9f a4 e9 d1 4f 25 95 f7 98 ed 6d 01 74 9e 22 ea 54 90 a4 82 31 fe d1 db d7 b7 bd 73 52 a7 86 bf b1 20 b2 1a 96 a3 01 2c 25 61 10 0c ab 26 30 76 e4 e7 1d 3d 2a 58 d5 6d 25 94 db 6b b7 06 2b a8 8a 2a c8 1d b8 62 98 6d bc 85 6c 95 e9 eb f5 ac de 0e a4 63 6e 66 af e4 53 c4 c6 5b 6a 6a cd 6c Data Ascii: 9UJc'NF\iEYF@Q=pi[\Z2!9G;\5Gi+$] yd7&raCKG^E9=w{-q3?tg88#O%mt"T1sR ,%a&0v=Xm%k+bmlcnfS[jjl
2024-02-08 18:35:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	49852	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:41 UTC	679	OUT	GET /xdata/images/city/354x266/977346.jpg?k=0afb2125e3ce4648cf017d8dc1c2c73ce97eea5d441e17b3cc2106b2c5816029&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:41 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sat, 03 Feb 2024 19:39:05 GMT ETag: "de717e26f8c1eef4971368108bcf6186ffb9e0ba" Content-Language: 13198 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 e268ddb03ed9480c5c602c27323a81ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Vk983CORz2VNjGbs7yRfn_tP9iXZtz6zYNKC6Sui3VjlHnd3kIorUg== Age: 428196
2024-02-08 18:35:41 UTC	13206	IN	Data Raw: 33 33 38 65 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 01 0a 01 62 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 338eJFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222b"}!1AQa"q
2024-02-08 18:35:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	49853	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:41 UTC	575	OUT	GET /psb/capla/static/css/b9a82cb8.c62928a4.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:41 UTC	618	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 374 Connection: close Last-Modified: Tue, 06 Feb 2024 05:14:54 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: ZWcBtyq5.ToLH0XKRcMymv7pEUycHruY Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 12:31:11 GMT ETag: "d4cb397172a601054d15e416b713f8b5" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 31341771a4bfa40d7b1f61883ffb56c6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: wYjmuz-aHyqqz3qGfkv8vUUB9XOULh7UrsrOFOwP4qPB6LObxR39DQ== Age: 21871 Vary: Origin
2024-02-08 18:35:41 UTC	374	IN	Data Raw: 2e 66 63 32 66 32 63 30 64 61 38 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 64 38 34 30 35 34 31 62 61 34 7b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 7d 2e 61 65 39 35 33 36 62 65 35 64 7b 6d 61 78 2d 77 69 64 74 68 3a 39 31 38 70 78 7d 2e 66 35 32 32 61 38 64 34 34 62 7b 70 61 64 64 69 6e 67 3a 30 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 20 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 38 78 29 20 2b 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 29 7d 2e 64 63 36 32 35 34 34 34 65 66 7b 77 68 69 74 65 2d 73 70 61 63 65 3a 70 72 65 2d 6c 69 Data Ascii: .fc2f2c0da8{width:100%;display:block}.d840541ba4{padding:var(--bui_spacing_1x)}.ae9536be5d{max-width:918px}.f522a8d44b{padding:0 var(--bui_spacing_1x) var(--bui_spacing_1x) calc(var(--bui_spacing_8x) + var(--bui_spacing_1x))}.dc625444ef{white-space:pre-li

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	49854	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:41 UTC	676	OUT	GET /psb/capla/static/css/7bcb015e.5b709f3d.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "8b761ecf11f6b807d0d765ee8cd5851e" If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
2024-02-08 18:35:41 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:41 GMT ETag: "8b761ecf11f6b807d0d765ee8cd5851e" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: .wxzOg8QkFu.xibWr3CgHbjp4QG_aTPI Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6f067a3fd6e721a7db2a2901701a65d8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: QsB8418oPSzHXNAJTvIrVxR8XU-i9RPA3VZ-vD1Bo98M9P1AV0Pq-w== Age: 19146 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	49855	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:41 UTC	676	OUT	GET /psb/capla/static/css/eb60141d.cad86b29.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "2980ea90c3f4c27d77bffbd1527870a7" If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
2024-02-08 18:35:41 UTC	514	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:41 GMT ETag: "2980ea90c3f4c27d77bffbd1527870a7" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: sAJOuwpsDtZfgppaREh03xaE5gNkW8K5 Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 61bbe72b71f7b857c695c31fdeb7b3a6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Y7K6vUkf0BPINjfO7KCRWS36h-7J3rv_nqR5GnZm-E7lCvzcFgyK4w== Age: 8902 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	49856	3.162.125.32	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:41 UTC	613	OUT	OPTIONS /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=BXAbRIVE HTTP/1.1 Host: accommodations.booking.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-booking-et-serialized-state Origin: https://www.booking.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:42 UTC	684	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:41 GMT x-frame-options: SAMEORIGIN x-content-type-options: nosniff access-control-allow-credentials: true access-control-allow-methods: HEAD,OPTIONS,GET,POST access-control-allow-headers: x-booking-et-serialized-state vary: Origin access-control-allow-origin: https://www.booking.com strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 216cc93d387142758c190b0491dc538c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P3 X-Amz-Cf-Id: nc8HuZ9gCt-ECfM3uPl6ES0Zjg6ygz2YuqLV0AyiiGbwG3N1FlUEDQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	49857	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:41 UTC	676	OUT	GET /psb/capla/static/css/c6a78acb.bffda4a9.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "6f3e8bb7938a05e927b3ca4454f98fa8" If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
2024-02-08 18:35:41 UTC	492	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:41 GMT ETag: "6f3e8bb7938a05e927b3ca4454f98fa8" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: b5qwU9Uw68HNRDgalzg4bB9gCMOFsuHv Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 5988b4ae4648c0fec3c60a3cca580092.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: gLbnHHp0CGrZH0LXJTD9b5NVV3M0Anzqs6w_jmIvgbTusNi_gVtDYA== Age: 24706 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	49859	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:41 UTC	676	OUT	GET /psb/capla/static/css/f50a2dfc.837540b6.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "fdb620d16ddcb3d874c0d96880365b4d" If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
2024-02-08 18:35:41 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:41 GMT ETag: "fdb620d16ddcb3d874c0d96880365b4d" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: gKQ3dko_aeSe7flBYen.8nJ6TCgcueOK Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 7db19e3781edb64ef4f7023d2c25783e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: UmqI-SFvaQn0s4xDmjgVcDIQiGX2e3UFZyKzOtIGB4YCHlgQfDYT9A== Age: 24706 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	49858	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:41 UTC	676	OUT	GET /psb/capla/static/css/a6a21c13.8939445f.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "e262f92e286a4c74280bd4b3fdee8cbb" If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
2024-02-08 18:35:41 UTC	492	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:41 GMT ETag: "e262f92e286a4c74280bd4b3fdee8cbb" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 7G8nAXI18cFrDtj.jVsLGUJVDX12qJHu Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 4a9f56098c7d51e12b8d2ac77b6f1bcc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: RhO5lENiq81unuR9V_a3_dJFZ7ZrbuB-DLUtIIXKqE7VtWFxb45a8A== Age: 24706 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	49863	18.64.236.43	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:41 UTC	444	OUT	GET /xdata/images/city/540x270/977409.jpg?k=82c14f9e6cea94829ee0528a3aa4324111d3482e9f095194500746fa7ca2769e&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:41 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sat, 03 Feb 2024 19:39:05 GMT ETag: "31b0d260ff6e000fcccf49ad3395df5ff48cff85" Content-Language: 35918 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 dfd828b2c103ff2899b6b2f2946f1e2e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: tLqdR0g4VuaI2ZGA35Y7qvgLJ2dmuUYcxIzjSsqPp4Y5VV41nYdIvQ== Age: 428195
2024-02-08 18:35:41 UTC	16384	IN	Data Raw: 37 37 63 34 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 01 0e 02 1c 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 77c4JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:35:42 UTC	14284	IN	Data Raw: 4f 24 fa ff 00 9f 7a 86 df 45 92 db 17 32 3a 09 17 f8 3d 8f bf e3 52 20 f2 ee ce 77 92 46 41 66 c8 1e b5 cd 8c 7c ef 43 d1 c2 c3 96 3a 9c ee b4 cc 75 bf 29 2d d5 ce dd db 88 ee 06 3f ce 4d 36 0b 57 6d 35 d9 11 84 92 2b 1d a1 86 07 00 7e 54 ba cc 2f 3e b1 22 c5 21 8a 47 8b 1b bb 63 da b4 74 fd 2a 78 74 e8 51 a6 2e c2 45 e7 38 f9 33 93 59 d0 b4 63 72 ea 2b e8 67 4c 76 45 6d 19 75 49 06 49 e7 e9 d3 f2 a9 fc 43 1b 9d 08 da 47 70 56 53 1f df c6 4f ca 32 7f c3 f1 ab b7 3a 3c 62 ed 2e 39 2e 1b 81 db 6f 5f e9 fa d7 1d e2 cd 6d 1e f5 ed 54 ed 54 61 19 6d c0 0e 0e 5b df ae 07 e1 5c b8 b9 73 d5 8c 7a 23 7c 34 1a 8b 92 dc e5 ac f4 38 ed ef ad f4 df b6 dc 38 69 15 de 35 1b 54 8c 67 27 15 b8 96 77 e7 c7 93 cc c8 e4 5b 2e e5 51 d9 76 f0 17 d7 3d 31 58 da 7d fd e7 f6 95 Data Ascii: O$zE2:=R wFAf\|C:u)-?M6Wm5+~T/>"!Gct*xtQ.E83Ycr+gLvEmuIICGpVSO2:<b.9.o_mTTam[\sz#\|488i5Tg'w[.Qv=1X}
2024-02-08 18:35:42 UTC	5266	IN	Data Raw: 31 34 38 61 0d 0a 9e 23 95 5d 95 f5 54 de 86 76 f8 c4 85 37 0d c0 64 8a 64 33 c5 39 61 1b 64 af 5a e6 f5 3f 11 c1 00 76 8c b7 9a dc 06 c5 26 89 ae da 03 e6 4f 3a a3 33 61 b8 c9 63 f4 ed 58 43 1a e5 3b 3d 8d 27 82 4a 1a 6e 76 36 68 0d ca 64 64 7a 53 35 cd a3 c3 ba 83 95 ce 2c a5 cf e4 6a d5 8c 4d 34 51 dd c6 09 84 91 86 a8 b5 18 84 fa 55 c4 24 64 49 6b 22 90 3b e7 35 c9 98 34 ea a6 bb 7e a7 5e 5f 17 1a 6d 3e e7 cd 0f 33 6c 38 63 86 24 6d c9 e9 f8 57 61 f0 a8 84 f1 c5 ba a8 38 68 9d 4f 3e d9 fe 95 c8 5c 44 20 f3 14 10 48 62 bb 4e 7a fa d7 5f f0 a4 83 e3 78 8b 0c 30 85 c8 c7 e1 fd 2b 29 7c 3a 1b 2f 88 f7 54 c6 d5 1f ec 37 f5 ac 7b 87 13 6a 20 85 c6 22 2b f9 35 6a ab 7c ab fe eb 7f 2a a1 6d 6a 6e 75 6f 2c 1c 12 8e 47 1e e2 a3 08 f9 6b 45 8f 14 b9 a8 c9 0d 48 Data Ascii: 148a#]Tv7dd39adZ?v&O:3acXC;='Jnv6hddzS5,jM4QU$dIk";54~^_m>3l8c$mWa8hO>\D HbNz_x0+)\|:/T7{j "+5j\|*mjnuo,GkEH
2024-02-08 18:35:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	49862	18.64.236.43	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:41 UTC	444	OUT	GET /xdata/images/city/540x270/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:41 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sat, 03 Feb 2024 19:39:05 GMT ETag: "c950df25a838ffedb4483511736514fb4e39a488" Content-Language: 31567 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 2085ab9d73b5dc26e367fd24649672c2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: my44s7BWUfvBn7cLTZvQIYgyytYAxxlzy12PLDHc8VcAB8j8cmLoGA== Age: 428196
2024-02-08 18:35:41 UTC	15835	IN	Data Raw: 37 30 36 38 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 01 0e 02 1c 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 7068JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:35:42 UTC	12949	IN	Data Raw: 3c 4f a6 b2 6b 3a 6c e9 73 c9 99 77 a1 38 53 82 4e 4f e7 f9 0a eb 34 e9 66 97 4e 81 e7 8c 45 31 4f de 20 18 01 bb e3 db 35 cf f8 9e d6 76 0d 77 f6 71 20 8a 26 6c 09 08 ce 0f 4c 77 c8 a7 52 9c 54 6f 6f 31 46 46 37 8b 10 5e ea 91 d8 d9 e3 cd 55 08 3e 6e 18 e3 21 08 f4 38 03 f1 35 e3 ba bf 87 5a 3d d7 96 71 9f 28 4d e5 80 c7 0c ad 8c e0 8f c6 bb 17 93 53 99 ef 2f 98 ba 4d 24 c5 87 5f dd b8 19 53 f8 63 8a ad 75 69 2e af e1 87 f1 14 7f 2d f4 77 6c 2e 22 41 c1 04 fc a7 e9 c1 1f 85 79 14 9c a7 29 cd 2d 6f 7f 91 ac ac ac 8e 12 ce 37 92 6d d2 c5 f2 2e 23 e7 df 3f e1 d6 ba eb af 04 cf 6f 34 77 36 d6 f2 6c 77 65 44 d9 fd de 9b be a4 7f 3a a2 18 22 c2 44 0c 2e a7 9d 23 48 49 f9 5d 73 f9 f1 82 0f d3 de bd a3 45 57 d4 ad 6d ee 23 dd 19 81 51 0a 6e 0c 07 be 7b e5 4f eb Data Ascii: <Ok:lsw8SNO4fNE1O 5vwq &lLwRToo1FF7^U>n!85Z=q(MS/M$_Scui.-wl."Ay)-o7m.#?o4w6lweD:"D.#HI]sEWm#Qn{O
2024-02-08 18:35:42 UTC	2798	IN	Data Raw: 61 65 37 0d 0a 81 72 1b 86 c6 47 1f 98 fd 6b 96 59 e4 57 2c 23 7c fb 8a 22 92 7f b6 79 c8 84 16 38 24 9c 71 58 aa 26 f2 aa 9a 24 47 1f 6a 1b d5 44 48 41 60 d8 38 5c fb fd 6a fc da a4 e2 e6 49 2d c4 7e 42 06 48 c8 03 e5 53 c0 35 57 fb 3e ea e6 f9 0f d9 cb 0c 8d e5 48 fc 78 ad 7b 9b 7b db 47 6f b3 e9 ab 34 24 74 31 1c 1e 3f a1 ab 7c 8f 56 cc 95 ca 36 5a a5 c5 bc 77 20 cb bd b0 38 63 9c e7 af 3d 7b 53 74 36 8a eb 58 55 95 8a 34 a1 80 db f2 82 7a 81 fa 54 17 96 77 fe 71 9f ec 89 0a e3 03 0c 06 ef c3 35 9f e4 5e 24 a1 d2 22 ac a7 70 2a 7a 1f ce 8e 48 bb d9 8b 99 ab 1d 1c ba d5 bd a5 f6 c5 b5 41 11 90 17 60 3e f6 3a 74 e8 47 f5 35 7b 43 b9 88 cb 36 e4 0b fb c2 c8 e0 e1 4b 74 c0 ee 6b 93 91 2e a6 f9 99 41 66 20 b6 17 fc fb 56 96 90 9a 9d bd dc 2f 15 bb b4 5e 70 Data Ascii: ae7rGkYW,#\|"y8$qX&$GjDHA`8\jI-~BHS5W>Hx{{Go4$t1?\|V6Zw 8c={St6XU4zTwq5^$"p*zHA`>:tG5{C6Ktk.Af V/^p
2024-02-08 18:35:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	49864	18.64.236.43	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:41 UTC	444	OUT	GET /xdata/images/city/354x266/977346.jpg?k=0afb2125e3ce4648cf017d8dc1c2c73ce97eea5d441e17b3cc2106b2c5816029&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:41 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sat, 03 Feb 2024 19:39:05 GMT ETag: "de717e26f8c1eef4971368108bcf6186ffb9e0ba" Content-Language: 13198 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 8a47e4aac22d4ea9e135eed10a1bbf52.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: GewwKwqpBeRC4a7xJRsO9f99IN-DdAJ01tI5hf3kdrmROMEQpbSn4g== Age: 428196
2024-02-08 18:35:41 UTC	13206	IN	Data Raw: 33 33 38 65 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 01 0a 01 62 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 338eJFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222b"}!1AQa"q
2024-02-08 18:35:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	49865	18.64.236.43	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:41 UTC	444	OUT	GET /xdata/images/city/354x266/619763.jpg?k=3bfc62a779df5b92694287e9fc0b82d795f93700ddf8887d66f3191ee745dcc5&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:41 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Mon, 05 Feb 2024 08:52:45 GMT ETag: "60cb60de2e4d7b779152862736284e0d5e0787ea" Content-Language: 27416 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 5976fe1222a45812dfd5003b003d8b56.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: oGwKeaxWPLxf3taxZTNVm6MA6FpZuOURTTCX3_rvTUo-o2ZEyH4P5w== Age: 294176
2024-02-08 18:35:42 UTC	16384	IN	Data Raw: 36 62 31 38 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 01 0a 01 62 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 6b18JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222b"}!1AQa"q
2024-02-08 18:35:42 UTC	11040	IN	Data Raw: 1d a2 8b a2 39 55 dd d7 fc f1 4a 9e 1a 13 bc 63 27 a9 4e b4 a3 ab 46 fa 5c 69 91 eb b3 ad c5 c4 12 86 45 59 14 ce c0 46 40 51 d0 0e 0e 09 e7 3d 70 69 97 b6 b0 5b 5c 5a da 09 cc f0 81 cb 09 db 32 21 39 dc 47 3b b8 c7 5c e3 35 ce 47 a4 69 b7 13 cb 2b 93 24 93 e5 5d e4 20 f2 79 c9 c1 1c 64 0a b1 37 86 ed 26 9a 09 05 c4 72 b5 b2 61 43 4b b0 47 18 07 a7 5e 99 aa 96 05 45 f3 39 3d 04 b1 77 7b 1d 06 a5 a5 2d a5 bc f7 71 c9 33 a4 ec 8e 85 ae b9 8c 7f 12 a9 3f 74 67 38 c6 38 23 d2 9f a4 e9 d1 4f 25 95 f7 98 ed 6d 01 74 9e 22 ea 54 90 a4 82 31 fe d1 db d7 b7 bd 73 52 a7 86 bf b1 20 b2 1a 96 a3 01 2c 25 61 10 0c ab 26 30 76 e4 e7 1d 3d 2a 58 d5 6d 25 94 db 6b b7 06 2b a8 8a 2a c8 1d b8 62 98 6d bc 85 6c 95 e9 eb f5 ac de 0e a4 63 6e 66 af e4 53 c4 c6 5b 6a 6a cd 6c Data Ascii: 9UJc'NF\iEYF@Q=pi[\Z2!9G;\5Gi+$] yd7&raCKG^E9=w{-q3?tg88#O%mt"T1sR ,%a&0v=Xm%k+bmlcnfS[jjl
2024-02-08 18:35:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	49866	18.64.236.43	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:41 UTC	444	OUT	GET /xdata/images/city/354x266/977416.jpg?k=ea06e0b572ff052f4fe4fcf35ac3616e8d1b7300f0402756c460a4e9c19e54ed&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:42 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sat, 03 Feb 2024 19:39:05 GMT ETag: "bb5ebde20c647408502d26e652a675498270cf47" Content-Language: 20782 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 190f65eebc0c7e2a61e00850eb7dae6a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: _4BqUTjcbL5B2yRSnxbGHXqZHTkACY_saWFJPIZcJYMJ0CGPaa3dIw== Age: 428196
2024-02-08 18:35:42 UTC	15835	IN	Data Raw: 34 61 65 65 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 01 0a 01 62 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 4aeeJFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222b"}!1AQa"q
2024-02-08 18:35:42 UTC	3355	IN	Data Raw: a0 04 12 c4 fd 32 31 fa 56 87 86 90 c9 a3 e9 e0 9f bb e7 28 1d 3a 9c 67 f5 ae 2b 55 98 10 77 64 fc de b5 85 2f 8a 46 d5 74 48 ce 8d 83 3b 80 01 3d c7 4c 55 93 70 ef b0 3e e6 c6 00 1d aa 08 22 01 8b 16 27 7f 6c 74 e6 9e a1 0f 19 53 8f c2 b7 31 3a ff 00 13 cc 27 d0 59 e4 fe f2 71 9e 9c 57 28 97 29 25 b4 36 6e cd 1a 6f 21 98 f3 80 4d 77 8d 69 6b a8 68 8a 8d 70 18 48 a3 6a 42 72 41 03 92 7b 0f c6 bc d0 ca 49 ea 8c 3d f1 53 45 e9 61 d4 5a dc e8 ed 6e 20 82 46 86 09 58 c6 42 7c b8 c6 e2 09 19 fe 55 3c 13 0b b4 df 28 1b c0 e7 03 8c d6 05 8c c5 2f a2 c4 40 ee 20 77 ad 3b 16 d9 13 ed 66 27 2d bb 68 07 9c 56 ad 19 16 f3 11 3c a3 8c 72 18 8e 2a ff 00 86 ed 2d af 35 db 74 62 64 8a 69 40 91 5b 8d dd f9 cd 54 8e 46 f3 95 0b 29 04 91 8d a7 3c 01 fe 35 af e1 95 59 75 dd Data Ascii: 21V(:g+Uwd/FtH;=LUp>"'ltS1:'YqW()%6no!MwikhpHjBrA{I=SEaZn FXB\|U<(/@ w;f'-hV<r*-5tbdi@[TF)<5Yu
2024-02-08 18:35:42 UTC	1607	IN	Data Raw: 36 34 30 0d 0a 81 18 3f 4a cb 96 79 03 6e 8d d9 18 37 51 c7 6a b5 ae a0 d5 b4 3a 39 ae b4 d8 92 5b 56 84 3c d0 ae 7c ce 08 63 c6 7d fb d4 36 2c 64 91 e6 17 06 d9 49 c0 2b 1b 11 d0 7a 0a c1 82 79 67 9e 35 b8 76 91 30 72 09 cf 18 cf f4 ae 8a c3 50 82 2b 76 85 27 9e 13 d0 34 64 10 bf 36 73 8c 8e 78 aa 95 88 57 46 da e9 f1 6a 9a 84 ef 69 7b 1c d2 91 e6 80 81 c3 60 7b 10 39 c7 6f 7a e6 75 eb 90 90 f9 71 b6 e0 a4 60 ff 00 9f c3 f5 ae ba d3 52 c3 cf 24 57 b0 cc ee a8 23 89 e3 d8 4f 38 60 4f 3c 9e 6b 86 d7 0c 4f 71 28 43 f2 2b e0 63 a5 44 77 b1 56 d2 e2 e9 93 35 cc ab 12 b8 42 4f de 1c 60 f3 e9 53 7f 60 98 a2 96 59 94 ca 7a ab 47 b9 42 f0 4f 39 1f 4a cc 89 8c 5b 88 0a c4 1e 32 31 fa 55 a5 d4 27 47 40 14 aa 03 bb 6c 6c 50 02 78 e3 1d 2b 44 ec 43 4d ad 4d c9 6c a2 Data Ascii: 640?Jyn7Qj:9[V<\|c}6,dI+zyg5v0rP+v'4d6sxWFji{`{9ozuq`R$W#O8`O<kOq(C+cDwV5BO`S`YzGBO9J[21U'G@llPx+DCMMl
2024-02-08 18:35:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	49861	104.18.130.236	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:41 UTC	393	OUT	GET /scripttemplates/202310.2.0/assets/otCommonStyles.css HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:42 UTC	825	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:35:42 GMT Content-Type: text/css Content-Length: 21778 Connection: close Content-MD5: c7xAZ9MSGAobGaTYg/Qtag== Last-Modified: Tue, 05 Dec 2023 03:37:38 GMT ETag: 0x8DBF543876E798E x-ms-request-id: 1e506ba7-601e-004b-465f-27c5d0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 7878 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8525f9537be106e6-ATL
2024-02-08 18:35:42 UTC	544	IN	Data Raw: 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 7b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 74 72 75 73 74 2d 76 65 6e 64 6f 72 73 2d 6c 69 73 74 2d 68 61 6e 64 6c 65 72 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 63 6f 6c 6f 72 3a 23 31 66 39 36 64 62 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 Data Ascii: #onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .one
2024-02-08 18:35:42 UTC	1369	IN	Data Raw: 20 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 7b 6f 75 74 6c 69 6e 65 2d 6f 66 66 73 65 74 3a 31 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 62 6e 72 2d 77 2d 6c 6f 67 6f 20 2e 6f 74 2d 62 6e 72 2d 6c 6f 67 6f 7b 68 65 69 67 68 74 3a 36 34 70 78 3b 77 69 64 74 68 3a 36 34 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 74 63 66 32 2d 76 65 6e 64 6f 72 2d 63 6f 75 6e 74 2e 6f 74 2d 74 65 78 74 2d 62 6f 6c 64 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f Data Ascii: #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk.ot-bnr-w-logo .ot-bnr-logo{height:64px;width:64px}#onetrust-banner-sdk .ot-tcf2-vendor-count.ot-text-bold{font-weight:bold}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-ico
2024-02-08 18:35:42 UTC	1369	IN	Data Raw: 6e 63 2d 6e 74 66 79 20 62 75 74 74 6f 6e 20 2a 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 61 5b 64 61 74 61 2d 70 61 72 65 6e 74 2d 69 64 5d 20 2a 7b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 68 69 64 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 68 69 64 65 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 6f 74 2d 68 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 62 75 74 74 6f 6e 2e 6f 74 2d 6c 69 6e 6b 2d 62 74 6e 3a 68 6f 76 65 72 2c 23 6f 6e Data Ascii: nc-ntfy button ,#ot-sync-ntfy a[data-parent-id] {font-size:inherit;font-weight:inherit;color:inherit}#onetrust-banner-sdk .ot-hide,#onetrust-pc-sdk .ot-hide,#ot-sync-ntfy .ot-hide{display:none !important}#onetrust-banner-sdk button.ot-link-btn:hover,#on
2024-02-08 18:35:42 UTC	1369	IN	Data Raw: 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 63 65 6e 74 65 72 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 70 63 2d 6c 6f 67 6f 20 69 6d 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 70 63 2d 6c 6f 67 6f 20 69 6d 67 7b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 73 63 72 65 Data Ascii: ckground-position:center;background-size:contain;background-repeat:no-repeat;display:inline-flex;justify-content:center;align-items:center}#onetrust-pc-sdk .pc-logo img,#onetrust-pc-sdk .ot-pc-logo img{max-height:100%;max-width:100%}#onetrust-pc-sdk .scre
2024-02-08 18:35:42 UTC	1369	IN	Data Raw: 65 74 72 75 73 74 2d 66 61 64 65 2d 69 6e 7b 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 31 7d 7d 2e 6f 74 2d 63 6f 6f 6b 69 65 2d 6c 61 62 65 6c 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 34 32 36 70 78 29 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 38 39 36 70 78 29 61 6e 64 20 28 6f 72 69 65 6e 74 61 74 69 6f 6e 3a 20 6c 61 6e 64 73 63 61 70 65 29 7b 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 35 65 6d 7d 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 2d 69 6e 70 75 Data Ascii: etrust-fade-in{0%{opacity:0}100%{opacity:1}}.ot-cookie-label{text-decoration:underline}@media only screen and (min-width: 426px)and (max-width: 896px)and (orientation: landscape){#onetrust-pc-sdk p{font-size:.75em}}#onetrust-banner-sdk .banner-option-inpu
2024-02-08 18:35:42 UTC	1369	IN	Data Raw: 79 3a 69 6e 6c 69 6e 65 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 7b 68 65 69 67 68 74 3a 32 30 70 78 3b 77 69 64 74 68 3a 33 30 70 78 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 30 2e 35 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 20 70 61 74 68 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 20 70 61 74 68 7b 66 69 6c 6c 3a 23 33 32 61 65 38 Data Ascii: y:inline;margin-right:5px}#onetrust-banner-sdk .ot-optout-signal svg,#onetrust-pc-sdk .ot-optout-signal svg{height:20px;width:30px;transform:scale(0.5)}#onetrust-banner-sdk .ot-optout-signal svg path,#onetrust-pc-sdk .ot-optout-signal svg path{fill:#32ae8
2024-02-08 18:35:42 UTC	1369	IN	Data Raw: 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 74 6f 67 67 6c 65 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 74 2d 63 6f 6e 74 65 6e 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 74 2d 70 63 2d 63 6f 6e 74 65 6e 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 64 69 76 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 73 70 61 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 31 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 32 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 33 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 34 2c 23 Data Ascii: onetrust-banner-sdk .ot-toggle,#onetrust-banner-sdk #ot-content,#onetrust-banner-sdk #ot-pc-content,#onetrust-banner-sdk .checkbox,#onetrust-pc-sdk div,#onetrust-pc-sdk span,#onetrust-pc-sdk h1,#onetrust-pc-sdk h2,#onetrust-pc-sdk h3,#onetrust-pc-sdk h4,#
2024-02-08 18:35:42 UTC	1369	IN	Data Raw: 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 64 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 62 6f 64 79 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 6d 61 69 6e 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 74 6f 67 67 6c 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 23 6f 74 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 23 6f 74 2d 70 63 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 63 68 65 63 6b 62 6f 78 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 64 69 76 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 Data Ascii: dk-cookie-policy td,#ot-sdk-cookie-policy tbody,#ot-sdk-cookie-policy .ot-main-content,#ot-sdk-cookie-policy .ot-toggle,#ot-sdk-cookie-policy #ot-content,#ot-sdk-cookie-policy #ot-pc-content,#ot-sdk-cookie-policy .checkbox,#ot-sync-ntfy div,#ot-sync-ntfy
2024-02-08 18:35:42 UTC	1369	IN	Data Raw: 72 2d 73 64 6b 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c 23 Data Ascii: r-sdk label:after,#onetrust-banner-sdk .checkbox:after,#onetrust-banner-sdk .checkbox:before,#onetrust-pc-sdk label:before,#onetrust-pc-sdk label:after,#onetrust-pc-sdk .checkbox:after,#onetrust-pc-sdk .checkbox:before,#ot-sdk-cookie-policy label:before,#
2024-02-08 18:35:42 UTC	1369	IN	Data Raw: 2d 63 6f 6c 75 6d 6e 73 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 34 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 3a 66 69 72 73 74 2d Data Ascii: -columns,#onetrust-pc-sdk .ot-sdk-column,#onetrust-pc-sdk .ot-sdk-columns,#ot-sdk-cookie-policy .ot-sdk-column,#ot-sdk-cookie-policy .ot-sdk-columns{margin-left:4%}#onetrust-banner-sdk .ot-sdk-column:first-child,#onetrust-banner-sdk .ot-sdk-columns:first-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	49868	3.161.193.117	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:41 UTC	1206	OUT	GET /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLalZib7103qG%2BF6jNX4nY1OEBjrxAz9Ob8DEQBWTSqeRvOh6i7KV3uDpo7lfSd6A33jZhjYHawln8E0aqfSwxomTxD7gRkwilYph1WF73PdYDrYV%2FBds8KeGhbWuYLP5WRjHVQWXCaBnPp2c6UP9oiZIrDu36czsM%3D; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; lastSeen=0; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1
2024-02-08 18:35:42 UTC	513	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html;charset=iso-8859-1 Content-Length: 411 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:42 GMT cache-control: must-revalidate,no-cache,no-store strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 564323c34e674762078ff4073ae6fa4e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P8 X-Amz-Cf-Id: GNkmnyn4nCcuBlnw30cFbPhT1t6d_SSa-9sw8XiO-l72MTVG_QMFOw==
2024-02-08 18:35:42 UTC	411	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 2f 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 32 3e 48 54 54 50 20 45 52 52 4f 52 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 32 3e 0a 3c 74 61 62 6c 65 3e 0a 3c 74 72 3e 3c 74 68 3e 55 52 49 3a 3c 2f 74 68 3e 3c 74 64 3e 2f 77 65 62 2d 76 69 74 61 6c 73 2f 73 65 6e 64 2d 76 69 74 61 6c 73 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/><title>Error 405 Method Not Allowed</title></head><body><h2>HTTP ERROR 405 Method Not Allowed</h2><table><tr><th>URI:</th><td>/web-vitals/send-vitals</td></tr><tr>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	49870	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:42 UTC	676	OUT	GET /psb/capla/static/css/f5d0e2e7.a54d85eb.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "88d8b9631fe60984baabd22260a86e6e" If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
2024-02-08 18:35:42 UTC	514	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:42 GMT ETag: "88d8b9631fe60984baabd22260a86e6e" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 45SgOdslZ5ni1p_3JE_2CMeJEvzIw3pO Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 c625b1bdde545acdeb26c9f6ad3a8c6e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: efu2r8Dj2DDHNQsD5xRv3SaSlOx9BO5xAoEMKCLUBTr8AuiE-qE71g== Age: 8903 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	49869	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:42 UTC	676	OUT	GET /psb/capla/static/css/43e47265.9fb0fb7a.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "f1d67c93f1232808b430d12e5d784b19" If-Modified-Since: Wed, 07 Feb 2024 14:34:00 GMT
2024-02-08 18:35:42 UTC	514	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:42 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: wAwfK5sRNLu2zKmxkwgBaOsL1bPkNbzw Server: AmazonS3 ETag: "f1d67c93f1232808b430d12e5d784b19" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 4a91a321d4c2ab7334c6f285093956ae.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: JDhGCfRf-FFKHnTTXXMXzKTt0rP4WAXSXCDKDpt1I_hTylVEPP39nA== Age: 9837 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	49871	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:42 UTC	676	OUT	GET /psb/capla/static/css/d2a738da.079c3b4c.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "1a7c523a95596c5b0b122ad8d8e3b553" If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
2024-02-08 18:35:42 UTC	514	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:42 GMT ETag: "1a7c523a95596c5b0b122ad8d8e3b553" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: y6hnIHqnWmWPq9JqZ4Ue_o6YIF6Bl_1N Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 76f3fedc86826a7b266250e33ee41082.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: sEPJ5sHCUValwk14P_v159m0Z9IJieZ1BDtiG0OHZg9UnIfgOX6blA== Age: 8903 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.5	49873	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:42 UTC	676	OUT	GET /psb/capla/static/css/1baf5a63.539e3a8f.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "e66324ef6e0246820fb69426fdb7b8ad" If-Modified-Since: Wed, 07 Feb 2024 14:34:00 GMT
2024-02-08 18:35:42 UTC	514	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:42 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: rLvv0U9nlmkSiLeo7hrzKiAd5aAgVI7z Server: AmazonS3 ETag: "e66324ef6e0246820fb69426fdb7b8ad" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6f067a3fd6e721a7db2a2901701a65d8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Xr6hWy55GtokI809czPFlfFK_WVO0rYOzyo_QjmOYViGZt4qyBhSKw== Age: 9411 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	49872	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:42 UTC	676	OUT	GET /psb/capla/static/css/21928fd5.c540d700.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "c4aa6cc0b7d7b70cd0b7409f2336e955" If-Modified-Since: Wed, 07 Feb 2024 14:34:00 GMT
2024-02-08 18:35:42 UTC	514	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:42 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: _SrqE28ZraaLhD96dpZqwbwZKMpM61Pu Server: AmazonS3 ETag: "c4aa6cc0b7d7b70cd0b7409f2336e955" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 7699e4f17e72e42cba0c247c650005d2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 8pWWn2U3W3aQCAht2ftrrmo0osnVjo8PrGWnNvEf02O2wr8xNxcPJA== Age: 9411 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	49874	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:42 UTC	676	OUT	GET /psb/capla/static/css/3d066b0d.a994f040.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "054c06419579fbe2660760d03e545650" If-Modified-Since: Wed, 07 Feb 2024 14:34:00 GMT
2024-02-08 18:35:42 UTC	514	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:42 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: Y7dC8d4Tl.EmB8Hda9Z10saqG6J_ILjf Server: AmazonS3 ETag: "054c06419579fbe2660760d03e545650" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 086e2cd5d94fa729de58c51b5666e0e4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: j1NgeF6GSuIbqgoTEFKig2ZB5bhfg6N-WK57EMzc-pr-KA2eyMbGFw== Age: 9411 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.5	49877	3.162.125.32	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:42 UTC	1589	OUT	GET /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=BXAbRIVE HTTP/1.1 Host: accommodations.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json x-booking-et-serialized-state: EFB4182z3JoJxbpLmYz6l9XMO8uwQw5vy57VA6rLJax-JW2gEd2Ycalwc-8XMLrKv sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLalZib7103qG%2BF6jNX4nY1OEBjrxAz9Ob8DEQBWTSqeRvOh6i7KV3uDpo7lfSd6A33jZhjYHawln8E0aqfSwxomTxD7gRkwilYph1WF73PdYDrYV%2FBds8KeGhbWuYLP5WRjHVQWXCaBnPp2c6UP9oiZIrDu36czsM%3D; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; lastSeen=0; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1
2024-02-08 18:35:42 UTC	650	IN	HTTP/1.1 200 OK Content-Type: application/json Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:42 GMT x-frame-options: SAMEORIGIN x-content-type-options: nosniff access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com vary: Accept-Encoding referrer-policy: no-referrer strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 05f4e6c9553ff5b6620e13adbd08b064.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P3 X-Amz-Cf-Id: kONHalUUWwmWMg7o1aYDnHBjCh4eQ1hXa1ovD9JMl2l8FBC8sImnGQ==
2024-02-08 18:35:42 UTC	6435	IN	Data Raw: 31 39 31 62 0d 0a 7b 22 63 68 75 6e 6b 73 22 3a 5b 22 62 39 61 38 32 63 62 38 22 5d 2c 22 65 78 70 65 72 69 6d 65 6e 74 54 61 67 73 22 3a 7b 22 59 54 54 48 62 58 65 65 56 65 43 46 5a 41 63 62 52 62 52 4f 66 4c 4d 54 65 43 59 48 44 52 46 63 4f 22 3a 31 2c 22 48 4d 62 4f 48 4e 46 50 42 4a 59 49 59 4b 63 50 4e 53 4e 48 52 55 65 42 4f 46 4f 22 3a 31 7d 2c 22 66 65 61 74 75 72 65 4e 61 6d 65 73 22 3a 7b 22 49 65 5a 58 58 44 4e 46 56 46 4b 4f 55 59 4c 4c 46 4a 59 62 43 63 65 4d 4e 50 56 62 50 53 55 61 62 53 63 63 45 54 4b 65 22 3a 66 61 6c 73 65 2c 22 45 42 44 49 62 49 62 58 44 65 42 47 47 54 63 5a 4a 46 66 48 62 65 4d 50 45 54 22 3a 74 72 75 65 2c 22 49 65 50 46 62 4a 4d 46 56 46 4b 4f 55 59 4c 4c 48 4e 4f 56 52 65 22 3a 74 72 75 65 7d 2c 22 73 65 6f 45 78 70 Data Ascii: 191b{"chunks":["b9a82cb8"],"experimentTags":{"YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO":1,"HMbOHNFPBJYIYKcPNSNHRUeBOFO":1},"featureNames":{"IeZXXDNFVFKOUYLLFJYbCceMNPVbPSUabSccETKe":false,"EBDIbIbXDeBGGTcZJFfHbeMPET":true,"IePFbJMFVFKOUYLLHNOVRe":true},"seoExp
2024-02-08 18:35:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	49880	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:42 UTC	3034	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 497 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3 X-Booking-AID: 304142 X-Booking-Pageview-Id: e4de82b919b800e4 X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,1912460\|1,1856870\|1,1912460\|7,1912460\|6,1908890\|1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7 sec-ch-ua-platform: "Windows" X-Booking-Language-Code: en-us X-Booking-CSRF: M1fFZQAAAAA=ow_iJm02C23yTbeZTjDwFw3ODjezY3bK5FHdo-YoJdT7GCkrsQ32GPbbWguo4KloItJB_vA0z9Y_xRO57ct8Amr5W_XGX_7GZSpQGGcZ9tRZ2sLvFoX1OvJhoh8lHbncqueaPtPA9hz8Y_-xROuXkd4r2dhb8qRB-XM9-fcVbZ1TIOfkTWMBhv8vt5DNEpcahji4EEgpTuAdyxqG sec-ch-ua-mobile: ?0 X-Partner-Channel-Id: 3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Accept: application/json, text/javascript, /; q=0.01 X-Booking-SiteType-Id: 1 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLalZib7103qG%2BF6jNX4nY1OEBjrxAz9Ob8DEQBWTSqeRvOh6i7KV3uDpo7lfSd6A33jZhjYHawln8E0aqfSwxomTxD7gRkwilYph1WF73PdYDrYV%2FBds8KeGhbWuYLP5WRjHVQWXCaBnPp2c6UP9oiZIrDu36czsM%3D; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; lastSeen=0; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1
2024-02-08 18:35:42 UTC	497	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 70 72 69 76 61 63 79 5f 63 6f 6e 73 65 6e 74 2e 63 6f 6f 6b 69 65 5f 63 6f 6e 73 65 6e 74 5f 6c 6f 61 64 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 6c 6f 61 64 5f 64 75 72 61 74 69 6f 6e 22 3a 31 37 30 35 37 30 39 39 32 33 32 33 31 2c 22 64 69 73 70 6c 61 79 65 64 22 3a 66 61 6c 73 65 2c 22 6e 65 74 77 6f 72 6b 5f 69 6e 66 6f 72 6d 61 74 69 6f 6e 22 3a 7b 22 65 66 66 65 63 74 69 76 65 5f 74 79 70 65 22 3a 22 34 67 22 7d 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f Data Ascii: {"events":[{"action_name":"privacy_consent.cookie_consent_loaded","action_version":"1.0.0","content":{"load_duration":1705709923231,"displayed":false,"network_information":{"effective_type":"4g"}},"context":{"page":{"page_referrer":"","page_url":"https://
2024-02-08 18:35:42 UTC	1179	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 31 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:42 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBnYyLv%2F3rWI%2F2bePxxk2XFhPOKX7DXTroWPOGIe%2FZow1mdV9fpLjCZpCnqq4p6iMnpP9EpkYDRBvZ8y1Nr09ooyfDWYFtO1TDow0eLqIfN3R57GuM%2FiEXeNLeHGI5xRs50EKrz4llVsAb7PkITjdjzTUb%2FnrB03fY%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:42 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=1b7d82bf878f04a0&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqst4o4fWHeXrgH_UdpyAL8Nbys_9ySEFz10 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 ea0f86c249e022d5015ce79f54e723d0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: CMOrysnB6VI9tcNmZ5Omt6tAdKtSb8yL2FtZ0JZAdrw4Gq7VF6SIPQ==
2024-02-08 18:35:42 UTC	31	IN	Data Raw: 5b 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d 5d Data Ascii: [{"status":1,"content":"Sent"}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.5	49881	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:42 UTC	676	OUT	GET /psb/capla/static/css/445be7a9.b944bd98.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "9f91bb862449cb9e9205f6f0a89b9eca" If-Modified-Since: Wed, 07 Feb 2024 14:34:00 GMT
2024-02-08 18:35:42 UTC	514	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:42 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: D8tbqBnnQzsmPNpgLlB1pYxweLZ4jfVQ Server: AmazonS3 ETag: "9f91bb862449cb9e9205f6f0a89b9eca" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 31113f2f23c4ce8a8af1d88a37137806.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: X_tQP0ulEBb4eBVc49cD9KB3QwSxml50l-buNFwURN_BnA8kdWri0A== Age: 9411 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	49882	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:42 UTC	676	OUT	GET /psb/capla/static/css/53a8d0d3.b1818b84.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "f820477c322829e348f318a453e432a5" If-Modified-Since: Thu, 08 Feb 2024 11:37:52 GMT
2024-02-08 18:35:42 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:42 GMT ETag: "f820477c322829e348f318a453e432a5" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: BiPU5vSMYzP0dcXjFNJqaYKjd8Wn7Ys7 Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 4a9f56098c7d51e12b8d2ac77b6f1bcc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: B5y4bFZv-IqLsHlKPCsWg_B2fidH-tX5upNsh-cweZGuEpA0xM8LqA== Age: 24707 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.5	49883	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:42 UTC	676	OUT	GET /psb/capla/static/css/cfbdd235.7a595d50.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "f22efe190d4cdfd20e43049d1c12a165" If-Modified-Since: Wed, 07 Feb 2024 14:34:00 GMT
2024-02-08 18:35:42 UTC	514	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:42 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: b4ZmCJxSFsgSaixlCnSgPozOUwHV32pe Server: AmazonS3 ETag: "f22efe190d4cdfd20e43049d1c12a165" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 31341771a4bfa40d7b1f61883ffb56c6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 3JHwtBBkVSZA4jMUkvv-1p7aQMlPtDOXVnIBauKyVqCzM4jOlyBQvw== Age: 9410 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
150	192.168.2.5	49886	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:42 UTC	676	OUT	GET /psb/capla/static/css/dc32f6b7.745c5004.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "65c942cfa2287ad1959f9b9eca30ff42" If-Modified-Since: Tue, 06 Feb 2024 05:14:55 GMT
2024-02-08 18:35:43 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:43 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: LPL3VwKSk2Z15oseyd5JjAABdBGKcNi1 Server: AmazonS3 ETag: "65c942cfa2287ad1959f9b9eca30ff42" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 14e4300e15854895259e6944bb121ec8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: fsbbgi2kFftJrT1L1saKDV-_qQ8Ek1y5zBCSgnYdxbxKy8vF4ju3YA== Age: 20740 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
151	192.168.2.5	49885	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:42 UTC	559	OUT	GET /psb/capla/static/js/b9a82cb8.5aa6563f.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:43 UTC	634	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 57682 Connection: close Last-Modified: Mon, 05 Feb 2024 05:12:49 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 6D5vzIl5cDfTbjho1Kxxg_04xeqUXV_H Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 13:52:37 GMT ETag: "5b8eeb30ae5a8b3bb0f20b42d67f1042" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 c625b1bdde545acdeb26c9f6ad3a8c6e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 0ScxIAdVNvgbAXr8Q8_od0Z_pllxAyWEqiC3ZXSA6KEPJYWyjJJlig== Age: 16986 Vary: Origin
2024-02-08 18:35:43 UTC	15750	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 5b 22 62 2d 77 65 62 2d 73 68 65 6c 6c 2d 63 6f 6d 70 6f 6e 65 6e 74 73 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 77 65 62 2d 73 68 65 6c 6c 2d 63 6f 6d 70 6f 6e 65 6e 74 73 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 62 39 61 38 32 63 62 38 22 5d 2c 7b 64 30 39 38 39 32 33 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 69 29 7b 69 2e 64 28 6e 2c 7b 42 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 7d 29 3b 76 61 72 20 74 3d 69 28 22 64 63 36 64 32 38 66 66 22 29 3b 66 75 6e 63 74 69 6f 6e 20 61 28 29 7b 63 6f 6e 73 74 20 65 3d 28 30 2c 74 Data Ascii: "use strict";(self["b-web-shell-components__LOADABLE_LOADED_CHUNKS__"]=self["b-web-shell-components__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["b9a82cb8"],{d0989236:function(e,n,i){i.d(n,{B:function(){return a}});var t=i("dc6d28ff");function a(){const e=(0,t
2024-02-08 18:35:43 UTC	16384	IN	Data Raw: 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 6e 61 6d 65 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 76 61 6c 75 65 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 5d 7d 7d 5d 7d 7d 2c 7b 6b 69 6e 64 3a 22 49 6e 6c 69 6e 65 46 72 61 67 6d 65 6e 74 22 2c 74 79 70 65 43 6f 6e 64 69 74 69 6f 6e 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 64 54 79 70 65 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 4c 6f 67 69 6e 4c 61 6e 64 69 6e 67 22 7d 7d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c Data Ascii: ,name:{kind:"Name",value:"name"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"value"},arguments:[],directives:[]}]}}]}},{kind:"InlineFragment",typeCondition:{kind:"NamedType",name:{kind:"Name",value:"LoginLanding"}},directives:[],sel
2024-02-08 18:35:43 UTC	16384	IN	Data Raw: 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 63 26 26 28 49 2e 73 65 74 28 22 6c 61 74 69 74 75 64 65 22 2c 53 74 72 69 6e 67 28 6f 29 29 2c 49 2e 73 65 74 28 22 6c 6f 6e 67 69 74 75 64 65 22 2c 53 74 72 69 6e 67 28 63 29 29 29 2c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 75 29 7b 63 6f 6e 73 74 20 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 3d 3d 3d 71 3f 57 3a 65 3d 3d 3d 58 3f 24 3a 76 6f 69 64 20 30 7d 28 70 61 72 73 65 49 6e 74 28 53 74 72 69 6e 67 28 75 29 2c 31 30 29 29 3b 65 26 26 49 2e 73 65 74 28 59 2c 65 29 7d 72 65 74 75 72 6e 20 67 26 26 49 2e 73 65 74 28 4b 2e 6d 54 2c 67 29 2c 6d 26 26 49 2e 73 65 74 28 22 6f 72 64 65 72 22 2c 6d 29 2c 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f Data Ascii: efined"!==typeof c&&(I.set("latitude",String(o)),I.set("longitude",String(c))),"undefined"!==typeof u){const e=function(e){return e===q?W:e===X?$:void 0}(parseInt(String(u),10));e&&I.set(Y,e)}return g&&I.set(K.mT,g),m&&I.set("order",m),"undefined"!==typeo
2024-02-08 18:35:43 UTC	9164	IN	Data Raw: 22 2c 65 78 70 61 6e 64 65 64 3a 65 2e 65 78 70 61 6e 64 65 64 2c 74 68 65 6d 65 3a 22 6e 6f 72 6d 61 6c 22 3d 3d 3d 65 2e 73 65 76 65 72 69 74 79 3f 22 4e 6f 72 6d 61 6c 22 3a 22 43 61 6c 6c 6f 75 74 22 7d 29 29 29 2c 70 61 67 65 5f 72 65 67 69 6f 6e 3a 65 2c 76 65 72 74 69 63 61 6c 3a 22 41 42 55 22 7d 2c 6d 2e 4b 43 2e 47 4c 4f 42 41 4c 5f 41 4c 45 52 54 29 29 7d 29 2c 5b 5d 29 7d 2c 52 3d 65 3d 3e 7b 6c 2e 73 65 6e 64 45 76 65 6e 74 28 46 28 22 76 69 65 77 65 64 22 2c 7b 63 61 6d 70 61 69 67 6e 5f 69 64 3a 65 7d 2c 6d 2e 4b 43 2e 47 4c 4f 42 41 4c 5f 41 4c 45 52 54 29 29 7d 2c 50 3d 28 65 2c 6e 2c 69 29 3d 3e 7b 6c 2e 73 65 6e 64 45 76 65 6e 74 28 46 28 22 63 6c 69 63 6b 65 64 22 2c 7b 63 61 6d 70 61 69 67 6e 5f 69 64 3a 6e 2c 61 63 74 69 6f 6e 3a 7b Data Ascii: ",expanded:e.expanded,theme:"normal"===e.severity?"Normal":"Callout"}))),page_region:e,vertical:"ABU"},m.KC.GLOBAL_ALERT))}),[])},R=e=>{l.sendEvent(F("viewed",{campaign_id:e},m.KC.GLOBAL_ALERT))},P=(e,n,i)=>{l.sendEvent(F("clicked",{campaign_id:n,action:{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
152	192.168.2.5	49887	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:43 UTC	3049	OUT	POST /sendlayoutevents HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 116 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3 X-Booking-AID: 304142 X-Booking-Pageview-Id: e4de82b919b800e4 X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,1912460\|1,1856870\|1,1912460\|7,1912460\|6,1908890\|1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7 sec-ch-ua-platform: "Windows" X-Booking-Language-Code: en-us X-Booking-CSRF: M1fFZQAAAAA=ow_iJm02C23yTbeZTjDwFw3ODjezY3bK5FHdo-YoJdT7GCkrsQ32GPbbWguo4KloItJB_vA0z9Y_xRO57ct8Amr5W_XGX_7GZSpQGGcZ9tRZ2sLvFoX1OvJhoh8lHbncqueaPtPA9hz8Y_-xROuXkd4r2dhb8qRB-XM9-fcVbZ1TIOfkTWMBhv8vt5DNEpcahji4EEgpTuAdyxqG sec-ch-ua-mobile: ?0 X-Partner-Channel-Id: 3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Accept: application/json, text/javascript, /; q=0.01 X-Booking-SiteType-Id: 1 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLalZib7103qG%2BF6jNX4nY1OEBjrxAz9Ob8DEQBWTSqeRvOh6i7KV3uDpo7lfSd6A33jZhjYHawln8E0aqfSwxomTxD7gRkwilYph1WF73PdYDrYV%2FBds8KeGhbWuYLP5WRjHVQWXCaBnPp2c6UP9oiZIrDu36czsM%3D; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=1707417341870
2024-02-08 18:35:43 UTC	116	OUT	Data Raw: 6c 61 79 6f 75 74 3d 33 34 25 32 43 36 25 32 43 32 25 32 43 39 25 32 43 37 25 32 43 35 25 32 43 32 37 25 32 43 31 25 32 43 34 34 25 32 43 33 25 32 43 34 30 25 32 43 34 25 32 43 31 30 25 32 43 33 32 25 32 43 33 36 25 32 43 31 39 26 61 63 74 69 6f 6e 3d 76 69 65 77 26 77 69 64 67 65 74 3d 35 26 68 61 73 5f 6f 70 65 6e 5f 62 6f 6f 6b 69 6e 67 73 3d Data Ascii: layout=34%2C6%2C2%2C9%2C7%2C5%2C27%2C1%2C44%2C3%2C40%2C4%2C10%2C32%2C36%2C19&action=view&widget=5&has_open_bookings=
2024-02-08 18:35:43 UTC	1181	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 14 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:43 GMT vary: User-Agent, Accept-Encoding access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhAD4WLlocJITBMa3rDvM%2FTul1zrgyV20Oep4%2ByzvFe9TEP4%2FCO7SWdV4nDvU%2BPb6T8tysYngKSx198oV9JBFKQ14%2FRJ75raZDQGoIW6X8k3KrgZ8J43VSKpt36%2FaOYflD1Q6oFd0cBFlEO2ZPIWEaSdI7bMOXiUsqw%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:43 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=b5da82bf0bc5027a&e=UmFuZG9tSVYkc2RlIyh9YReXsVhv1rQKB4Zv_9za_ve3EbHo0ZhYQzxG5hzciO25QfWhGql5QrM x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 a01680a1fee7e35f1738191420d98822.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: QLFzRFzP4aCro5RXlgxXInzIErxpgJ5Sfr9Kk6nEpWnT1utHsVC6kg==
2024-02-08 18:35:43 UTC	14	IN	Data Raw: 5b 7b 22 73 74 61 74 75 73 22 3a 31 7d 5d Data Ascii: [{"status":1}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
153	192.168.2.5	49888	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:43 UTC	3049	OUT	POST /sendlayoutevents HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 117 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3 X-Booking-AID: 304142 X-Booking-Pageview-Id: e4de82b919b800e4 X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,1912460\|1,1856870\|1,1912460\|7,1912460\|6,1908890\|1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7 sec-ch-ua-platform: "Windows" X-Booking-Language-Code: en-us X-Booking-CSRF: M1fFZQAAAAA=ow_iJm02C23yTbeZTjDwFw3ODjezY3bK5FHdo-YoJdT7GCkrsQ32GPbbWguo4KloItJB_vA0z9Y_xRO57ct8Amr5W_XGX_7GZSpQGGcZ9tRZ2sLvFoX1OvJhoh8lHbncqueaPtPA9hz8Y_-xROuXkd4r2dhb8qRB-XM9-fcVbZ1TIOfkTWMBhv8vt5DNEpcahji4EEgpTuAdyxqG sec-ch-ua-mobile: ?0 X-Partner-Channel-Id: 3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Accept: application/json, text/javascript, /; q=0.01 X-Booking-SiteType-Id: 1 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLalZib7103qG%2BF6jNX4nY1OEBjrxAz9Ob8DEQBWTSqeRvOh6i7KV3uDpo7lfSd6A33jZhjYHawln8E0aqfSwxomTxD7gRkwilYph1WF73PdYDrYV%2FBds8KeGhbWuYLP5WRjHVQWXCaBnPp2c6UP9oiZIrDu36czsM%3D; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=1707417341870
2024-02-08 18:35:43 UTC	117	OUT	Data Raw: 6c 61 79 6f 75 74 3d 33 34 25 32 43 36 25 32 43 32 25 32 43 39 25 32 43 37 25 32 43 35 25 32 43 32 37 25 32 43 31 25 32 43 34 34 25 32 43 33 25 32 43 34 30 25 32 43 34 25 32 43 31 30 25 32 43 33 32 25 32 43 33 36 25 32 43 31 39 26 61 63 74 69 6f 6e 3d 76 69 65 77 26 77 69 64 67 65 74 3d 32 37 26 68 61 73 5f 6f 70 65 6e 5f 62 6f 6f 6b 69 6e 67 73 3d Data Ascii: layout=34%2C6%2C2%2C9%2C7%2C5%2C27%2C1%2C44%2C3%2C40%2C4%2C10%2C32%2C36%2C19&action=view&widget=27&has_open_bookings=
2024-02-08 18:35:43 UTC	1175	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 14 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:43 GMT vary: User-Agent, Accept-Encoding access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhpKwPY%2FUk76tBS33xVpKNV6JtWYo7SaTViUsnITg1flrvWg7P4T%2B5JyTzp02tarJHIB7akWPOIS8Gb6DzpGnB%2BuZxDFdiFouKGl6zyOZDWMjLlFfPC012317DrtNXNvYIwkfCA6NLpjWTjPsp9GQHY4%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:43 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=7b3d82bf62ad0138&e=UmFuZG9tSVYkc2RlIyh9YReXsVhv1rQKB4Zv_9za_vf2d1zViKXK8PdPSKwLRpuSAhCFpHq7CU0 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 c1bfc7dbcf7f9782aa3be590b7ce3d6a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Ib0GNb4hpDqYdSb5RKtgQuFlnILc1atKwETLAJnSS29ta9vpY4BsIA==
2024-02-08 18:35:43 UTC	14	IN	Data Raw: 5b 7b 22 73 74 61 74 75 73 22 3a 31 7d 5d Data Ascii: [{"status":1}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
154	192.168.2.5	49889	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:43 UTC	3049	OUT	POST /sendlayoutevents HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 116 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3 X-Booking-AID: 304142 X-Booking-Pageview-Id: e4de82b919b800e4 X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,1912460\|1,1856870\|1,1912460\|7,1912460\|6,1908890\|1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7 sec-ch-ua-platform: "Windows" X-Booking-Language-Code: en-us X-Booking-CSRF: M1fFZQAAAAA=ow_iJm02C23yTbeZTjDwFw3ODjezY3bK5FHdo-YoJdT7GCkrsQ32GPbbWguo4KloItJB_vA0z9Y_xRO57ct8Amr5W_XGX_7GZSpQGGcZ9tRZ2sLvFoX1OvJhoh8lHbncqueaPtPA9hz8Y_-xROuXkd4r2dhb8qRB-XM9-fcVbZ1TIOfkTWMBhv8vt5DNEpcahji4EEgpTuAdyxqG sec-ch-ua-mobile: ?0 X-Partner-Channel-Id: 3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Accept: application/json, text/javascript, /; q=0.01 X-Booking-SiteType-Id: 1 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLalZib7103qG%2BF6jNX4nY1OEBjrxAz9Ob8DEQBWTSqeRvOh6i7KV3uDpo7lfSd6A33jZhjYHawln8E0aqfSwxomTxD7gRkwilYph1WF73PdYDrYV%2FBds8KeGhbWuYLP5WRjHVQWXCaBnPp2c6UP9oiZIrDu36czsM%3D; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=1707417341870
2024-02-08 18:35:43 UTC	116	OUT	Data Raw: 6c 61 79 6f 75 74 3d 33 34 25 32 43 36 25 32 43 32 25 32 43 39 25 32 43 37 25 32 43 35 25 32 43 32 37 25 32 43 31 25 32 43 34 34 25 32 43 33 25 32 43 34 30 25 32 43 34 25 32 43 31 30 25 32 43 33 32 25 32 43 33 36 25 32 43 31 39 26 61 63 74 69 6f 6e 3d 76 69 65 77 26 77 69 64 67 65 74 3d 31 26 68 61 73 5f 6f 70 65 6e 5f 62 6f 6f 6b 69 6e 67 73 3d Data Ascii: layout=34%2C6%2C2%2C9%2C7%2C5%2C27%2C1%2C44%2C3%2C40%2C4%2C10%2C32%2C36%2C19&action=view&widget=1&has_open_bookings=
2024-02-08 18:35:43 UTC	1173	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 14 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:43 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhDg4Qtxlbd%2BOuI1r9PGynYiwn1ENyMLE1Te6RJIDQ4sahMQQxHdV1Hm4qErvfmXU833avJHd8ArYjp7jxg9jBwnqrgrgVkNBOOLD1CXsaX7vsy1uU2THKpnez9W3IKUKjzvh9YipHPLAsV9%2B3P2VsEdEDL0QoW6oaw%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:43 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=000082bf0a1a01af&e=UmFuZG9tSVYkc2RlIyh9YReXsVhv1rQKB4Zv_9za_vfe2q-QyefqVd98mdkQJ7U-xlIu_8WP_ww x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 31341771a4bfa40d7b1f61883ffb56c6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: V9k7qDg50d-NW_-CJOqDIEG6eRoGwusU95mrF7lwrgAsDR3OD7MFNg==
2024-02-08 18:35:43 UTC	14	IN	Data Raw: 5b 7b 22 73 74 61 74 75 73 22 3a 31 7d 5d Data Ascii: [{"status":1}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
155	192.168.2.5	49890	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:43 UTC	676	OUT	GET /psb/capla/static/css/4e596c2c.3a2fb681.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "51be0c43cc481b13fe70d3ba27e2ffd9" If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
2024-02-08 18:35:43 UTC	560	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 16:07:21 GMT Last-Modified: Thu, 08 Feb 2024 14:53:51 GMT ETag: "51be0c43cc481b13fe70d3ba27e2ffd9" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: SFV4Wl1bGgrYBAvh1g48Ac217jtyPkYJ Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 d48a409d6a3222e2cc9a060d30206d3c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: qR8muBPZJ2LxJ3xjDOLYz0p7ItXXjc7R9POVG0gCnJKZsxfat8maCA== Age: 8903 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
156	192.168.2.5	49891	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:43 UTC	1600	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=1707417341870; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBnYyLv%2F3rWI%2F2bePxxk2XFhPOKX7DXTroWPOGIe%2FZow1mdV9fpLjCZpCnqq4p6iMnpP9EpkYDRBvZ8y1Nr09ooyfDWYFtO1TDow0eLqIfN3R57GuM%2FiEXeNLeHGI5xRs50EKrz4llVsAb7PkITjdjzTUb%2FnrB03fY%3D
2024-02-08 18:35:43 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:43 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=f25c82bf531d00d6&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsu884y8TMTbLXY_qTSwJb_Moh9GAhbPpcc x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 a01680a1fee7e35f1738191420d98822.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: K92mttY1YD0iY0KHwZsUqK4HlZ3-8BJ6FIpbOdr_-xkk_MuJpbT5MQ==
2024-02-08 18:35:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
157	192.168.2.5	49893	3.162.125.41	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:43 UTC	1293	OUT	GET /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=BXAbRIVE HTTP/1.1 Host: accommodations.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; lastSeen=1707417341870; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBnYyLv%2F3rWI%2F2bePxxk2XFhPOKX7DXTroWPOGIe%2FZow1mdV9fpLjCZpCnqq4p6iMnpP9EpkYDRBvZ8y1Nr09ooyfDWYFtO1TDow0eLqIfN3R57GuM%2FiEXeNLeHGI5xRs50EKrz4llVsAb7PkITjdjzTUb%2FnrB03fY%3D
2024-02-08 18:35:43 UTC	556	IN	HTTP/1.1 200 OK Content-Type: application/json Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:43 GMT x-frame-options: SAMEORIGIN x-content-type-options: nosniff vary: Accept-Encoding referrer-policy: no-referrer strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 0a2ddb6f9b0df10d973faa154be16dba.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P3 X-Amz-Cf-Id: Mq7tIFzRjEegzf6B972ogO24fGp9jeXVtxG4QheK5sVjdE6icFgLxg==
2024-02-08 18:35:43 UTC	6435	IN	Data Raw: 31 39 31 62 0d 0a 7b 22 63 68 75 6e 6b 73 22 3a 5b 22 62 39 61 38 32 63 62 38 22 5d 2c 22 65 78 70 65 72 69 6d 65 6e 74 54 61 67 73 22 3a 7b 22 59 54 54 48 62 58 65 65 56 65 43 46 5a 41 63 62 52 62 52 4f 66 4c 4d 54 65 43 59 48 44 52 46 63 4f 22 3a 31 2c 22 48 4d 62 4f 48 4e 46 50 42 4a 59 49 59 4b 63 50 4e 53 4e 48 52 55 65 42 4f 46 4f 22 3a 31 7d 2c 22 66 65 61 74 75 72 65 4e 61 6d 65 73 22 3a 7b 22 49 65 5a 58 58 44 4e 46 56 46 4b 4f 55 59 4c 4c 46 4a 59 62 43 63 65 4d 4e 50 56 62 50 53 55 61 62 53 63 63 45 54 4b 65 22 3a 66 61 6c 73 65 2c 22 45 42 44 49 62 49 62 58 44 65 42 47 47 54 63 5a 4a 46 66 48 62 65 4d 50 45 54 22 3a 74 72 75 65 2c 22 49 65 50 46 62 4a 4d 46 56 46 4b 4f 55 59 4c 4c 48 4e 4f 56 52 65 22 3a 74 72 75 65 7d 2c 22 73 65 6f 45 78 70 Data Ascii: 191b{"chunks":["b9a82cb8"],"experimentTags":{"YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO":1,"HMbOHNFPBJYIYKcPNSNHRUeBOFO":1},"featureNames":{"IeZXXDNFVFKOUYLLFJYbCceMNPVbPSUabSccETKe":false,"EBDIbIbXDeBGGTcZJFfHbeMPET":true,"IePFbJMFVFKOUYLLHNOVRe":true},"seoExp
2024-02-08 18:35:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
158	192.168.2.5	49895	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:43 UTC	1605	OUT	GET /sendlayoutevents HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=1707417341870; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhAD4WLlocJITBMa3rDvM%2FTul1zrgyV20Oep4%2ByzvFe9TEP4%2FCO7SWdV4nDvU%2BPb6T8tysYngKSx198oV9JBFKQ14%2FRJ75raZDQGoIW6X8k3KrgZ8J43VSKpt36%2FaOYflD1Q6oFd0cBFlEO2ZPIWEaSdI7bMOXiUsqw%3D
2024-02-08 18:35:44 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:44 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=f69682c04748002a&e=UmFuZG9tSVYkc2RlIyh9YReXsVhv1rQKB4Zv_9za_vfrTdWE9Vvwk8zHtrxrUK5AkZCN53ND8sc x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 f588325f7617672d954c4267c8bee1ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: u932iNtFVAIG_SRq3YaKSyp8VCWeGZHD2Y154AmWoxnfNIB74U7J_g==
2024-02-08 18:35:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
159	192.168.2.5	49896	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:44 UTC	2332	OUT	POST /js_tracking?ver=2&stype=1&ref_action=index&lang=en-us&pid=e4de82b919b800e4&aid=304142&sid=5171fc655664ddf74ab763a094523fb7&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w&etgwv=js_onload_resource_transfer_size\|3922&_=1707417343016 HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhAD4WLlocJITBMa3rDvM%2FTul1zrgyV20Oep4%2ByzvFe9TEP4%2FCO7SWdV4nDvU%2BPb6T8tysYngKSx198oV9JBFKQ14%2FRJ75raZDQGoIW6X8k3KrgZ8J43VSKpt36%2FaOYflD1Q6oFd0cBFlEO2ZPIWEaSdI7bMOXiUsqw%3D; lastSeen=0
2024-02-08 18:35:44 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:44 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=5dde82c0a05c0319&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejIS1G2t7-UaoD0OzHfCCSNSC_vpCPsJZbA x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 309e9e958e8d35f7e17ae8ac267b7dea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: zPo5VPmNezM9pyJNIkurqVI5upHcZ_HYxXPEhnJJFbMRAnWIHTzy-w==
2024-02-08 18:35:44 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
160	192.168.2.5	49897	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:44 UTC	2334	OUT	POST /js_tracking?ver=2&stype=1&ref_action=index&lang=en-us&pid=e4de82b919b800e4&aid=304142&sid=5171fc655664ddf74ab763a094523fb7&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w&etgwv=js_onload_resource_transfer_size%7C3922&_=1707417343017 HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhAD4WLlocJITBMa3rDvM%2FTul1zrgyV20Oep4%2ByzvFe9TEP4%2FCO7SWdV4nDvU%2BPb6T8tysYngKSx198oV9JBFKQ14%2FRJ75raZDQGoIW6X8k3KrgZ8J43VSKpt36%2FaOYflD1Q6oFd0cBFlEO2ZPIWEaSdI7bMOXiUsqw%3D; lastSeen=0
2024-02-08 18:35:44 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:44 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=467a82c013f600e4&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejK2X4Q8sMPfS8Y8XCNEA1MKeYJZS3WxHjw x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 8415794d557292780ff382a8c5bd6058.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: NqmGwhwrOy6Sm33a89omTmju2JJhr5Hpc9s7f1AlxlGisKfqITm-fg==
2024-02-08 18:35:44 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
161	192.168.2.5	49898	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:44 UTC	912	OUT	GET /recaptcha/api.js?render=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&onload=onLoadRecaptchaV3Callback&_=1707417334976 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:44 UTC	528	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Thu, 08 Feb 2024 18:35:44 GMT Date: Thu, 08 Feb 2024 18:35:44 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:44 UTC	724	IN	Data Raw: 35 32 63 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 52c/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2024-02-08 18:35:44 UTC	607	IN	Data Raw: 69 4f 69 4a 6f 64 48 52 77 63 7a 6f 76 4c 32 64 76 62 32 64 73 5a 53 35 6a 62 32 30 36 4e 44 51 7a 49 69 77 69 5a 6d 56 68 64 48 56 79 5a 53 49 36 49 6b 52 70 63 32 46 69 62 47 56 55 61 47 6c 79 5a 46 42 68 63 6e 52 35 55 33 52 76 63 6d 46 6e 5a 56 42 68 63 6e 52 70 64 47 6c 76 62 6d 6c 75 5a 79 49 73 49 6d 56 34 63 47 6c 79 65 53 49 36 4d 54 63 79 4e 54 51 77 4e 7a 6b 35 4f 53 77 69 61 58 4e 54 64 57 4a 6b 62 32 31 68 61 57 34 69 4f 6e 52 79 64 57 55 73 49 6d 6c 7a 56 47 68 70 63 6d 52 51 59 58 4a 30 65 53 49 36 64 48 4a 31 5a 58 30 3d 27 3b 64 2e 68 65 61 64 2e 70 72 65 70 65 6e 64 28 6d 29 3b 70 6f 2e 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 78 35 57 Data Ascii: iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/x5W
2024-02-08 18:35:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
162	192.168.2.5	49901	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:44 UTC	588	OUT	GET /static/css/print/0cc4ce4b7108d42a9f293fc9b654f749d84ba4eb.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:44 UTC	792	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 5036 Connection: close Server: nginx Date: Thu, 01 Feb 2024 16:31:12 GMT Last-Modified: Wed, 10 Apr 2019 11:21:34 GMT ETag: "5cadd1be-13ac" Expires: Sat, 02 Mar 2024 16:31:12 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 34411558fb3a23efdbbaaddb8a12b574.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: rRaW8a8GPe8gxtQpJMuqaoXvCib3KW_o_NH1EWnnRSO8_l0tdVQ2oQ== Age: 612272
2024-02-08 18:35:44 UTC	5036	IN	Data Raw: 2e 6c 6f 67 6f 6c 69 6e 6b 2c 23 62 61 6e 6e 65 72 5f 74 65 78 74 2c 23 74 61 67 6c 69 6e 65 2c 23 62 32 35 6e 65 77 4e 61 6d 65 2c 23 74 61 62 73 2c 2e 68 65 6c 70 2c 2e 68 65 6c 70 53 6d 61 6c 6c 2c 2e 62 72 6f 77 73 65 2c 2e 62 75 74 2c 23 6d 6f 72 65 44 65 73 74 69 6e 61 74 69 6f 6e 73 2c 23 72 73 73 46 6f 72 6d 49 6e 63 2c 2e 70 6c 61 63 65 68 6f 6c 64 65 72 2c 2e 6e 6f 50 72 69 6e 74 2c 2e 70 6f 70 75 70 2c 2e 63 61 6c 65 6e 64 65 72 2c 2e 73 65 61 72 63 68 20 68 34 2c 23 73 6f 72 74 41 6e 64 44 65 73 74 2c 62 75 74 74 6f 6e 2c 2e 73 63 6f 72 65 42 61 72 49 6d 67 2c 2e 70 72 65 76 6e 65 78 74 62 61 72 2c 64 69 76 2e 74 6f 70 2c 2e 68 6f 74 65 6c 6e 61 76 32 2c 2e 73 6d 61 6c 6c 49 6d 67 41 72 65 61 20 70 2c 2e 63 75 72 43 6f 6e 76 2c 23 63 75 72 72 Data Ascii: .logolink,#banner_text,#tagline,#b25newName,#tabs,.help,.helpSmall,.browse,.but,#moreDestinations,#rssFormInc,.placeholder,.noPrint,.popup,.calender,.search h4,#sortAndDest,button,.scoreBarImg,.prevnextbar,div.top,.hotelnav2,.smallImgArea p,.curConv,#curr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
163	192.168.2.5	49899	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:44 UTC	753	OUT	GET /static/css/searchresults_cloudfront_sd.iq_ltr/a80f32e7f9693f304c247b0f22b0f109a5fd7dd6.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:44 UTC	796	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 359630 Connection: close Server: nginx Date: Wed, 24 Jan 2024 15:29:43 GMT Last-Modified: Tue, 23 Jan 2024 12:08:23 GMT ETag: "65afac37-57cce" Expires: Fri, 23 Feb 2024 15:29:43 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 ea0f86c249e022d5015ce79f54e723d0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Hye_Ii3yRw_0LrT_JZiubfygq8TS2EfHZzswaHbxnZm3e6J0Dt8H4Q== Age: 1307161
2024-02-08 18:35:44 UTC	15588	IN	Data Raw: 2e 68 6f 74 65 6c 6c 69 73 74 7b 63 6c 65 61 72 3a 6c 65 66 74 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 23 62 6f 64 79 63 6f 6e 73 74 72 61 69 6e 74 2d 69 6e 6e 65 72 7b 6d 69 6e 2d 77 69 64 74 68 3a 39 38 30 70 78 7d 23 62 6f 64 79 63 6f 6e 73 74 72 61 69 6e 74 2e 62 6f 64 79 63 6f 6e 73 74 72 61 69 6e 74 2d 2d 66 75 6c 6c 2d 77 69 64 74 68 7b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 7d 2e 74 5f 6d 5f 76 69 65 77 70 6f 72 74 20 23 62 6f 64 79 63 6f 6e 73 74 72 61 69 6e 74 2d 69 6e 6e 65 72 7b 6d 69 6e 2d 77 69 64 74 68 3a 69 6e 68 65 72 69 74 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 6d 6f 72 65 5f 72 6f 6f 6d 73 5f 6c 69 6e 6b 7b 66 6f 6e 74 2d 73 69 7a 65 3a 38 38 25 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 21 69 6d 70 6f 72 74 61 Data Ascii: .hotellist{clear:left;position:relative}#bodyconstraint-inner{min-width:980px}#bodyconstraint.bodyconstraint--full-width{max-width:none}.t_m_viewport #bodyconstraint-inner{min-width:inherit!important}.more_rooms_link{font-size:88%;font-weight:bold!importa
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 70 3a 77 72 61 70 3b 66 6c 65 78 2d 77 72 61 70 3a 77 72 61 70 3b 68 65 69 67 68 74 3a 32 38 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 30 7d 2e 6e 6f 4a 53 20 23 73 6f 72 74 5f 62 79 20 2e 73 6f 72 74 5f 6f 70 74 69 6f 6e 5f 6c 69 73 74 2c 23 73 6f 72 74 5f 62 79 2e 6e 6f 2d 66 6c 65 78 62 6f 78 20 2e 73 6f 72 74 5f 6f 70 74 69 6f 6e 5f 6c 69 73 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 61 75 74 6f 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 70 78 7d 23 73 6f 72 74 5f 62 79 20 2e 73 6f 72 74 5f 63 61 74 65 67 6f 72 79 7b 62 6f 72 64 65 72 2d 72 69 67 68 74 3a 31 70 78 20 73 6f 6c 69 64 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 3b 62 6f 72 64 Data Ascii: p:wrap;flex-wrap:wrap;height:28px;font-size:0}.noJS #sort_by .sort_option_list,#sort_by.no-flexbox .sort_option_list{display:block;height:auto;margin-top:-1px}#sort_by .sort_category{border-right:1px solid;border-bottom:1px solid;border-top:1px solid;bord
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 61 33 30 30 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 31 70 78 7d 2e 73 72 2d 62 61 64 67 65 73 5f 5f 72 6f 77 7b 6d 61 72 67 69 6e 3a 38 70 78 20 30 20 2d 38 70 78 20 30 21 69 6d 70 6f 72 74 61 6e 74 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 34 70 78 7d 2e 73 72 2d 62 61 64 67 65 73 5f 5f 72 6f 77 3e 64 69 76 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 6f 70 7d 2e 73 72 2d 62 61 64 67 65 73 5f 5f 72 6f 77 20 2e 73 72 2d 70 72 6f 70 65 72 74 79 2d 68 69 67 68 6c 69 67 68 74 73 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 38 70 78 7d 2e 68 6f 74 65 6c 6c 69 73 74 20 2e 73 72 5f 69 74 65 6d 20 68 33 2e 73 72 2d 68 6f 74 65 6c 5f 5f 74 69 74 6c Data Ascii: a30000;font-size:11px}.sr-badges__row{margin:8px 0 -8px 0!important;line-height:24px}.sr-badges__row>div{display:inline-block;vertical-align:top}.sr-badges__row .sr-property-highlights{display:block;padding-bottom:8px}.hotellist .sr_item h3.sr-hotel__titl
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 62 2c 23 65 64 65 64 65 64 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 72 65 70 65 61 74 2d 78 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 64 34 64 34 64 34 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 33 70 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 2c 30 2e 37 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 2c 30 2e 37 29 3b 63 6f 6c 6f 72 3a 23 38 33 38 33 38 33 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 70 61 64 64 69 6e 67 3a 37 70 78 20 31 32 70 Data Ascii: b,#ededed);background-repeat:repeat-x;border:1px solid #d4d4d4;border-radius:3px;-webkit-box-shadow:0 1px 0 rgba(255,255,255,0.7);box-shadow:0 1px 0 rgba(255,255,255,0.7);color:#838383;display:inline-block;font-size:13px;font-weight:normal;padding:7px 12p
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 73 68 61 64 6f 77 3a 30 20 30 20 39 70 78 20 23 30 30 37 31 63 32 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 33 35 38 30 7d 74 6f 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 33 70 78 20 23 61 61 61 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 33 70 78 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 37 31 63 32 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 62 6c 75 65 50 75 6c 73 65 7b 66 72 6f 6d 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 33 70 78 20 23 61 61 61 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 33 70 78 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 37 31 63 32 7d 35 30 25 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 Data Ascii: shadow:0 0 9px #0071c2;background-color:#003580}to{-webkit-box-shadow:0 0 3px #aaa;box-shadow:0 0 3px #aaa;background-color:#0071c2}}@keyframes bluePulse{from{-webkit-box-shadow:0 0 3px #aaa;box-shadow:0 0 3px #aaa;background-color:#0071c2}50%{-webkit-box
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 6f 6d 73 20 2e 72 6f 6f 6d 4e 61 6d 65 2e 72 6f 6f 6d 4e 61 6d 65 5f 66 6c 65 78 2e 2d 2d 65 78 74 65 6e 64 65 64 7b 6d 61 78 2d 77 69 64 74 68 3a 33 35 30 70 78 7d 2e 68 6f 74 65 6c 6c 69 73 74 20 2e 66 65 61 74 75 72 65 64 52 6f 6f 6d 73 20 2e 72 6f 6f 6d 4e 61 6d 65 2e 72 6f 6f 6d 4e 61 6d 65 5f 66 6c 65 78 2e 2d 2d 77 69 64 65 72 7b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 7d 2e 72 6f 6f 6d 50 72 69 63 65 5f 66 6c 65 78 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 66 6c 65 78 3a 31 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 67 72 6f 77 3a 31 3b 2d 6d 73 2d 66 6c 65 78 2d 70 6f 73 69 74 69 76 65 3a 31 3b 66 6c 65 78 2d 67 72 6f 77 3a 31 7d 2e 68 6f 74 65 6c 6c 69 73 74 20 2e 66 65 61 74 75 72 65 64 52 6f 6f 6d 73 2e 73 72 5f 72 74 5f 77 69 64 65 72 5f 75 72 Data Ascii: oms .roomName.roomName_flex.--extended{max-width:350px}.hotellist .featuredRooms .roomName.roomName_flex.--wider{max-width:none}.roomPrice_flex{-webkit-box-flex:1;-webkit-flex-grow:1;-ms-flex-positive:1;flex-grow:1}.hotellist .featuredRooms.sr_rt_wider_ur
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 3b 6c 65 66 74 3a 30 7d 2e 73 72 5f 63 69 74 79 5f 67 75 69 64 65 5f 62 61 6e 6e 65 72 5f 69 6d 61 67 65 7b 77 69 64 74 68 3a 31 30 30 25 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 2d 77 65 62 6b 69 74 2d 67 72 61 64 69 65 6e 74 28 6c 65 66 74 20 74 6f 70 2c 6c 65 66 74 20 62 6f 74 74 6f 6d 2c 63 6f 6c 6f 72 2d 73 74 6f 70 28 30 25 2c 72 67 62 61 28 30 2c 32 37 2c 36 35 2c 30 2e 36 35 29 29 2c 63 6f 6c 6f 72 2d 73 74 6f 70 28 31 30 30 25 2c 72 67 62 61 28 30 2c 32 37 2c 36 35 2c 30 29 29 29 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 2d 77 65 62 6b 69 74 2d 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 70 2c 72 67 62 61 28 30 2c 32 37 2c 36 35 2c 30 2e 36 35 29 20 30 2c 72 67 62 Data Ascii: ;left:0}.sr_city_guide_banner_image{width:100%;background-repeat:no-repeat;background:-webkit-gradient(left top,left bottom,color-stop(0%,rgba(0,27,65,0.65)),color-stop(100%,rgba(0,27,65,0)));background:-webkit-linear-gradient(top,rgba(0,27,65,0.65) 0,rgb
2024-02-08 18:35:44 UTC	14028	IN	Data Raw: 2d 72 61 64 69 75 73 3a 34 70 78 7d 2e 62 77 61 6c 6c 65 74 2d 77 61 6c 6c 65 74 2d 6c 61 62 65 6c 2d 62 6c 6f 63 6b 2d 2d 64 61 72 6b 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 33 35 38 30 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 7d 2e 62 73 33 2d 70 61 79 2d 6e 6f 77 2d 77 61 6c 6c 65 74 2d 62 6c 6f 63 6b 2d 2d 77 61 6c 6c 65 74 2d 69 63 6f 6e 7b 6d 61 72 67 69 6e 3a 30 20 34 70 78 20 30 20 34 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 33 65 6d 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 70 78 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 6f 74 74 6f 6d 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 7d 2e 72 6f 6f 6d 5f 64 Data Ascii: -radius:4px}.bwallet-wallet-label-block--dark{background-color:#003580;color:var(--bui_color_white)}.bs3-pay-now-wallet-block--wallet-icon{margin:0 4px 0 4px;font-size:1.3em;display:inline-block;line-height:15px;vertical-align:bottom;margin-left:0}.room_d
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 21 69 6d 70 6f 72 74 61 6e 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 21 69 6d 70 6f 72 74 61 6e 74 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 38 70 78 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 70 72 63 6f 2d 66 2d 66 6f 6e 74 2d 64 69 73 70 6c 61 79 5f 6f 6e 65 5f 6e 6f 72 6d 61 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 21 69 6d 70 6f 72 74 61 6e 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 21 69 6d 70 6f 72 74 61 6e 74 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 38 70 78 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 70 72 63 6f 2d 66 2d 74 65 78 74 2d 6c 69 6e 65 2d 74 68 72 6f 75 67 68 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6c 69 6e 65 2d 74 68 72 6f 75 67 68 7d 2e 70 72 63 6f 2d 6c 74 72 2d 72 69 Data Ascii: font-size:20px!important;font-weight:700!important;line-height:28px!important}.prco-f-font-display_one_normal{font-size:20px!important;font-weight:400!important;line-height:28px!important}.prco-f-text-line-through{text-decoration:line-through}.prco-ltr-ri
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 61 66 63 66 66 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 68 6f 74 65 6c 2d 6e 65 77 6c 69 73 74 5f 5f 77 72 61 70 70 65 72 20 2e 63 6f 6d 70 61 6e 79 2d 66 61 76 6f 72 69 74 65 2d 62 61 64 67 65 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 7d 40 2d 77 65 62 6b 69 74 2d 6b 65 79 66 72 61 6d 65 73 20 66 61 76 6f 72 69 74 65 48 6f 74 65 6c 53 61 76 69 6e 67 7b 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 3b 74 72 61 Data Ascii: ground-color:#fafcff;text-align:center;padding:15px;font-size:14px;font-weight:700;margin-top:10px;overflow:hidden}.hotel-newlist__wrapper .company-favorite-badge{margin-top:10px}@-webkit-keyframes favoriteHotelSaving{0%{-webkit-transform:rotate(0deg);tra

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
164	192.168.2.5	49900	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:44 UTC	744	OUT	GET /static/js/searchresults_cloudfront_sd/cede9dd040e94f8940ffa9b1176616cd398b0973.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:44 UTC	809	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 198848 Connection: close Server: nginx Date: Tue, 30 Jan 2024 12:56:04 GMT Last-Modified: Tue, 30 Jan 2024 07:07:17 GMT ETag: "65b8a025-308c0" Expires: Thu, 29 Feb 2024 12:56:04 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 f4c38e024a95b76a27c9f3dc9ff2eda6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: dO9YvxYwKqWbnmk1TplJT9aS_x4PxhpAzna59I_BJ4eNizuvjrbh4w== Age: 797980
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 3b 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 65 6e 61 62 6c 65 5f 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 26 26 28 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 2e 73 65 61 72 63 68 72 65 73 75 6c 74 73 3d 7b 6c 6f 61 64 65 64 3a 21 30 2c 72 75 6e 3a 21 31 7d 29 2c 42 2e 64 65 66 69 6e 65 28 22 63 6f 6d 70 6f 6e 65 6e 74 2f 64 69 73 6d 69 73 73 69 62 6c 65 2d 69 74 65 6d 2f 62 6c 6f 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 5f 69 5f 28 22 63 62 39 3a 31 64 36 65 33 38 66 30 22 29 3b 76 61 72 20 6e 3d 65 Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.searchresults={loaded:!0,run:!1}),B.define("component/dismissible-item/block",function(e,t,i){_i_("cb9:1d6e38f0");var n=e
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 2e 61 75 74 6f 43 6c 6f 73 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 63 62 39 3a 63 35 64 62 61 31 64 38 22 29 2c 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 63 62 39 3a 31 63 34 31 64 38 35 66 22 29 2c 24 65 6c 2e 66 61 64 65 4f 75 74 28 32 30 30 29 2c 5f 72 5f 28 29 7d 2c 33 65 33 29 2c 5f 72 5f 28 29 7d 2c 65 2e 72 65 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 63 62 39 3a 39 61 30 35 32 31 62 36 22 29 2c 74 68 69 73 2e 75 70 64 61 74 65 4d 6f 64 65 6c 28 74 68 69 73 2e 63 75 72 72 65 6e 74 56 69 65 77 2c 21 30 29 2c 5f 72 5f 28 29 7d 2c 65 2e 63 6c 6f 73 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 63 62 39 3a 65 37 31 39 39 32 38 34 22 29 2c 74 68 69 73 2e 24 65 6c 2e 68 69 64 Data Ascii: .autoClose=function(){_i_("cb9:c5dba1d8"),setTimeout(function(){_i_("cb9:1c41d85f"),$el.fadeOut(200),_r_()},3e3),_r_()},e.reset=function(){_i_("cb9:9a0521b6"),this.updateModel(this.currentView,!0),_r_()},e.close=function(){_i_("cb9:e7199284"),this.$el.hid
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 56 61 6c 75 65 28 22 6a 73 5f 6c 6f 63 61 74 69 6f 6e 5f 77 65 62 5f 73 72 5f 6d 61 70 5f 6f 70 65 6e 22 2c 31 29 2c 72 2e 67 6f 61 6c 57 69 74 68 56 61 6c 75 65 28 22 6a 73 5f 6c 6f 63 61 74 69 6f 6e 5f 77 65 62 5f 73 72 5f 6d 61 70 5f 6f 70 65 6e 5f 63 6f 75 6e 74 22 2c 31 29 2c 5f 72 5f 28 5f 2e 66 65 5f 6c 6f 63 61 74 69 6f 6e 5f 77 77 77 5f 73 72 5f 63 61 70 6c 61 5f 6d 61 70 3f 62 2e 69 6e 69 74 28 65 29 3a 66 2e 69 6e 69 74 28 65 29 29 7d 66 75 6e 63 74 69 6f 6e 20 4a 28 29 7b 5f 69 5f 28 22 63 62 39 3a 64 33 66 64 65 64 65 64 22 29 2c 68 3d 21 31 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 63 62 39 3a 31 61 62 32 61 63 38 34 22 29 2c 75 2e 63 73 73 28 22 6f 76 65 72 66 6c 6f 77 22 2c 22 61 75 74 6f 22 29 2c 76 2e 68 69 64 65 28 29 2c 4d 2e Data Ascii: Value("js_location_web_sr_map_open",1),r.goalWithValue("js_location_web_sr_map_open_count",1),_r_(_.fe_location_www_sr_capla_map?b.init(e):f.init(e))}function J(){_i_("cb9:d3fdeded"),h=!1,function(){_i_("cb9:1ab2ac84"),u.css("overflow","auto"),v.hide(),M.
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 7d 29 2c 75 3d 6f 2e 48 45 4c 50 45 52 28 22 69 63 6f 6e 22 2c 61 5b 30 5d 29 2c 61 2e 73 68 69 66 74 28 29 2c 75 29 2c 66 5b 31 36 31 5d 5d 2e 6a 6f 69 6e 28 22 22 29 3a 6e 2b 3d 5b 66 5b 31 36 32 5d 2c 6f 2e 46 2e 65 6e 74 69 74 69 65 73 28 6f 2e 4d 43 28 62 5b 31 30 35 5d 29 29 2c 66 5b 31 36 33 5d 5d 2e 6a 6f 69 6e 28 22 22 29 2c 6e 2b 3d 66 5b 31 37 5d 29 2c 6e 2b 3d 66 5b 31 36 34 5d 29 2c 6e 2b 3d 66 5b 31 36 35 5d 2c 65 3d 5f 72 5f 28 6e 29 2c 61 3d 6f 2e 53 56 28 69 29 2c 65 2b 3d 66 5b 31 36 36 5d 2c 65 2b 3d 66 5b 35 30 5d 2c 6f 2e 4d 4e 28 22 66 65 5f 68 69 67 68 5f 72 65 73 5f 69 6d 61 67 65 5f 73 72 63 22 2c 22 22 29 2c 65 2b 3d 66 5b 35 30 5d 2c 6f 2e 4d 4e 28 22 66 65 5f 6c 6f 77 5f 72 65 73 5f 69 6d 61 67 65 5f 73 72 63 22 2c 22 22 29 2c Data Ascii: }),u=o.HELPER("icon",a[0]),a.shift(),u),f[161]].join(""):n+=[f[162],o.F.entities(o.MC(b[105])),f[163]].join(""),n+=f[17]),n+=f[164]),n+=f[165],e=_r_(n),a=o.SV(i),e+=f[166],e+=f[50],o.MN("fe_high_res_image_src",""),e+=f[50],o.MN("fe_low_res_image_src",""),
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 5b 66 5b 32 39 5d 2c 28 61 2e 75 6e 73 68 69 66 74 28 7b 69 6e 5f 6d 6f 6e 74 68 3a 6f 2e 4d 43 28 62 5b 31 34 5d 29 2c 74 65 6d 70 65 72 61 74 75 72 65 3a 6f 2e 4d 42 28 62 5b 31 35 5d 29 7d 29 2c 75 3d 6f 2e 4d 45 28 66 5b 33 30 5d 2c 6f 2e 4d 42 2c 6f 2e 4d 4e 2c 6e 75 6c 6c 29 2c 61 2e 73 68 69 66 74 28 29 2c 75 29 2c 66 5b 32 31 5d 5d 2e 6a 6f 69 6e 28 22 22 29 29 2c 65 2b 3d 66 5b 31 31 5d 29 2c 65 2b 3d 66 5b 32 32 5d 2c 6f 2e 4d 4e 28 22 66 65 5f 71 75 69 7a 5f 6d 6f 6e 74 68 5f 79 65 61 72 5f 70 61 72 61 6d 73 22 2c 22 22 29 2c 65 2b 3d 66 5b 32 38 5d 2c 6f 2e 4d 4e 28 22 66 65 5f 64 61 74 61 5f 61 72 67 73 22 2c 6f 2e 4d 42 28 62 5b 31 36 5d 29 2b 22 64 61 74 61 2d 63 69 74 79 5f 69 64 3d 27 22 2b 6f 2e 4d 42 28 62 5b 31 33 5d 29 2b 22 27 20 64 Data Ascii: [f[29],(a.unshift({in_month:o.MC(b[14]),temperature:o.MB(b[15])}),u=o.ME(f[30],o.MB,o.MN,null),a.shift(),u),f[21]].join("")),e+=f[11]),e+=f[22],o.MN("fe_quiz_month_year_params",""),e+=f[28],o.MN("fe_data_args",o.MB(b[16])+"data-city_id='"+o.MB(b[13])+"' d
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 62 5f 62 65 61 63 68 5f 69 6e 66 6f 72 6d 61 74 69 6f 6e 2e 62 65 61 63 68 65 73 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 63 62 39 3a 36 65 61 37 36 38 39 30 22 29 3b 76 61 72 20 74 2c 69 3d 65 2e 63 65 6e 74 65 72 2e 73 70 6c 69 74 28 22 2c 22 29 3b 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 2e 68 65 72 6f 5f 69 6d 61 67 65 29 26 26 65 2e 68 65 72 6f 5f 69 6d 61 67 65 2e 6c 65 6e 67 74 68 26 26 65 2e 68 65 72 6f 5f 69 6d 61 67 65 5b 30 5d 26 26 65 2e 68 65 72 6f 5f 69 6d 61 67 65 5b 30 5d 5b 22 36 30 30 78 34 30 30 22 5d 3f 74 3d 65 2e 68 65 72 6f 5f 69 6d 61 67 65 5b 30 5d 5b 22 36 30 30 78 34 30 30 22 5d 3a 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 65 2e 64 65 73 74 69 6e 61 74 69 6f 6e 5f 69 6d 61 67 65 73 29 26 Data Ascii: b_beach_information.beaches.forEach(function(e){_i_("cb9:6ea76890");var t,i=e.center.split(",");Array.isArray(e.hero_image)&&e.hero_image.length&&e.hero_image[0]&&e.hero_image[0]["600x400"]?t=e.hero_image[0]["600x400"]:Array.isArray(e.destination_images)&
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 6c 65 6e 67 74 68 3a 4e 75 6d 62 65 72 28 69 29 29 2c 5f 72 5f 28 65 29 7d 2c 7b 7d 29 3b 65 2e 70 75 62 6c 69 73 68 28 5f 2c 7b 68 6f 74 65 6c 49 64 57 69 73 68 4c 69 73 74 43 6f 75 6e 74 4d 61 70 3a 69 7d 29 2c 5f 72 5f 28 29 7d 2c 75 70 64 61 74 65 4d 61 70 43 6f 6e 66 69 67 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 5f 69 5f 28 22 63 62 39 3a 66 65 30 63 39 64 35 33 22 29 3b 76 61 72 20 6e 3d 74 68 69 73 2e 67 65 74 57 69 73 68 4c 69 73 74 44 61 74 61 28 69 29 2c 5f 3d 65 2e 69 64 73 7c 7c 5b 5d 2c 72 3d 65 2e 69 73 4c 69 6b 65 64 2c 61 3d 65 2e 6d 61 72 6b 65 72 49 64 3b 72 3f 6e 5b 61 5d 3f 5f 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 63 62 39 3a 37 33 35 32 62 34 64 39 22 29 2c 2d 31 3d 3d 3d 6e 5b 61 5d Data Ascii: length:Number(i)),_r_(e)},{});e.publish(_,{hotelIdWishListCountMap:i}),_r_()},updateMapConfig:function(e,t,i){_i_("cb9:fe0c9d53");var n=this.getWishListData(i),_=e.ids\|\|[],r=e.isLiked,a=e.markerId;r?n[a]?_.forEach(function(e){_i_("cb9:7352b4d9"),-1===n[a]
2024-02-08 18:35:44 UTC	12817	IN	Data Raw: 65 29 7d 66 75 6e 63 74 69 6f 6e 20 5f 28 65 29 7b 72 65 74 75 72 6e 20 5f 69 5f 28 22 63 62 39 3a 33 63 64 61 64 62 64 38 22 29 2c 65 2b 3d 68 5b 31 31 37 5d 2c 6c 2e 4d 4a 28 6c 2e 4d 42 28 70 5b 33 36 5d 29 3c 3d 30 29 26 26 28 65 2b 3d 68 5b 31 31 38 5d 29 2c 65 2b 3d 68 5b 31 31 39 5d 2c 6c 2e 4d 4a 28 6c 2e 4d 42 28 70 5b 33 36 5d 29 3c 3d 30 29 26 26 28 65 2b 3d 6c 2e 4d 45 28 68 5b 31 32 30 5d 2c 6c 2e 4d 42 2c 6c 2e 4d 4e 2c 6e 75 6c 6c 29 29 2c 65 2b 3d 68 5b 31 32 31 5d 2c 6c 2e 4d 4a 28 6c 2e 4d 42 28 70 5b 33 36 5d 29 3c 3d 30 29 26 26 28 65 2b 3d 6c 2e 4d 45 28 68 5b 31 32 30 5d 2c 6c 2e 4d 42 2c 6c 2e 4d 4e 2c 6e 75 6c 6c 29 29 2c 65 2b 3d 68 5b 31 32 32 5d 2c 28 6c 2e 4d 4a 28 6c 2e 4d 42 28 70 5b 33 36 5d 29 3c 3d 30 29 7c 7c 6c 2e 4d 4a Data Ascii: e)}function _(e){return _i_("cb9:3cdadbd8"),e+=h[117],l.MJ(l.MB(p[36])<=0)&&(e+=h[118]),e+=h[119],l.MJ(l.MB(p[36])<=0)&&(e+=l.ME(h[120],l.MB,l.MN,null)),e+=h[121],l.MJ(l.MB(p[36])<=0)&&(e+=l.ME(h[120],l.MB,l.MN,null)),e+=h[122],(l.MJ(l.MB(p[36])<=0)\|\|l.MJ
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 29 2c 5f 72 5f 28 29 7d 7d 2c 5f 72 5f 28 29 7d 29 2c 42 2e 64 65 66 69 6e 65 28 22 63 6f 6d 70 6f 6e 65 6e 74 2f 77 69 73 68 6c 69 73 74 2f 74 72 61 63 6b 69 6e 67 22 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 69 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 5f 69 5f 28 22 63 62 39 3a 37 61 32 66 32 32 34 62 22 29 3b 76 61 72 20 5f 2c 6e 3d 65 28 22 73 65 72 76 65 72 2d 64 61 74 61 22 29 2c 6f 3d 6e 2e 62 5f 73 69 74 65 5f 74 79 70 65 2c 72 3d 6e 2e 62 5f 61 63 74 69 6f 6e 2c 73 3d 7b 77 77 77 3a 5b 7b 6e 61 6d 65 3a 22 64 65 73 6b 74 6f 70 5f 77 69 73 68 6c 69 73 74 5f 65 6e 74 72 79 5f 70 6f 69 6e 74 5f 72 65 66 61 63 74 6f 72 69 6e 67 22 2c 68 61 73 68 3a 22 45 55 58 50 4e 4d 48 66 4c 65 62 62 4d 48 53 57 65 64 4e 44 65 51 66 59 55 58 56 61 4b 42 49 65 Data Ascii: ),_r_()}},_r_()}),B.define("component/wishlist/tracking",function(e,t,i){"use strict";_i_("cb9:7a2f224b");var _,n=e("server-data"),o=n.b_site_type,r=n.b_action,s={www:[{name:"desktop_wishlist_entry_point_refactoring",hash:"EUXPNMHfLebbMHSWedNDeQfYUXVaKBIe
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 6f 61 73 74 2e 63 61 6c 6c 28 74 68 69 73 29 3b 65 6c 73 65 7b 69 66 28 74 68 69 73 2e 73 65 74 53 74 61 74 65 28 7b 63 6f 6d 70 6f 6e 65 6e 74 5f 69 64 3a 22 50 6f 70 6f 76 65 72 22 7d 29 2c 21 28 65 3d 77 69 6e 64 6f 77 2e 42 55 49 2e 63 72 65 61 74 65 49 6e 73 74 61 6e 63 65 28 22 50 6f 70 6f 76 65 72 22 2c 74 68 69 73 2e 65 6c 2c 7b 6f 6e 41 66 74 65 72 4f 70 65 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 63 62 39 3a 65 39 37 61 37 30 35 63 22 29 3b 76 61 72 20 65 3d 74 68 69 73 3b 64 28 74 68 69 73 2e 63 6f 6e 74 61 69 6e 65 72 29 2e 6f 6e 28 22 6d 6f 75 73 65 65 6e 74 65 72 2e 68 69 64 65 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 63 62 39 3a 36 30 64 33 35 66 39 36 22 29 2c 53 2e 73 74 61 67 65 28 22 70 6f 70 6f 76 65 72 4d 6f Data Ascii: oast.call(this);else{if(this.setState({component_id:"Popover"}),!(e=window.BUI.createInstance("Popover",this.el,{onAfterOpen:function(){_i_("cb9:e97a705c");var e=this;d(this.container).on("mouseenter.hide",function(){_i_("cb9:60d35f96"),S.stage("popoverMo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
165	192.168.2.5	49903	142.250.9.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:44 UTC	385	OUT	GET /gsi/fedcm.json HTTP/1.1 Host: accounts.google.com Connection: keep-alive Accept: application/json Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: webidentity User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:44 UTC	1088	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Expires: Thu, 08 Feb 2024 18:35:44 GMT Date: Thu, 08 Feb 2024 18:35:44 GMT Cache-Control: private, max-age=3600 Content-Security-Policy: script-src 'report-sample' 'nonce-oIlKfO1vJqEb_hBmC-Ph-Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1" Report-To: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]} Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:44 UTC	164	IN	Data Raw: 33 66 64 0d 0a 7b 22 69 64 74 6f 6b 65 6e 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 69 73 73 75 65 22 2c 20 22 69 64 5f 74 6f 6b 65 6e 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 69 73 73 75 65 22 2c 20 22 69 64 5f 61 73 73 65 72 74 69 6f 6e 5f 65 6e 64 70 6f 69 6e 74 22 Data Ascii: 3fd{"idtoken_endpoint": "https://accounts.google.com/gsi/fedcm/issue", "id_token_endpoint": "https://accounts.google.com/gsi/fedcm/issue", "id_assertion_endpoint"
2024-02-08 18:35:44 UTC	864	IN	Data Raw: 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 69 73 73 75 65 22 2c 20 22 61 63 63 6f 75 6e 74 73 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 6c 69 73 74 61 63 63 6f 75 6e 74 73 22 2c 20 22 63 6c 69 65 6e 74 5f 6d 65 74 61 64 61 74 61 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 63 6c 69 65 6e 74 6d 65 74 61 64 61 74 61 22 2c 20 22 63 6c 69 65 6e 74 5f 69 64 5f 6d 65 74 61 64 61 74 61 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 Data Ascii: : "https://accounts.google.com/gsi/fedcm/issue", "accounts_endpoint": "https://accounts.google.com/gsi/fedcm/listaccounts", "client_metadata_endpoint": "https://accounts.google.com/gsi/fedcm/clientmetadata", "client_id_metadata_endpoint": "https://account
2024-02-08 18:35:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
166	192.168.2.5	49908	64.233.177.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:44 UTC	827	OUT	GET /gsi/style HTTP/1.1 Host: accounts.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:44 UTC	1125	IN	HTTP/1.1 200 OK Content-Type: text/css; charset=utf-8 Expires: Thu, 08 Feb 2024 18:35:44 GMT Date: Thu, 08 Feb 2024 18:35:44 GMT Cache-Control: private, max-age=86400 Report-To: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]} Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1" Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Content-Security-Policy: script-src 'report-sample' 'nonce-W1u4yCVQKxdLo54Q8ksBHA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Cross-Origin-Resource-Policy: cross-origin Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:44 UTC	127	IN	Data Raw: 32 31 35 0d 0a 23 63 72 65 64 65 6e 74 69 61 6c 5f 70 69 63 6b 65 72 5f 63 6f 6e 74 61 69 6e 65 72 7b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 33 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 72 69 67 68 74 3a 32 30 70 78 3b 74 6f 70 3a 32 30 70 78 3b 77 69 64 74 68 3a 33 39 31 70 78 3b 7a 2d 69 6e 64 65 78 3a 39 39 39 39 7d 23 63 72 65 64 65 6e 74 Data Ascii: 215#credential_picker_container{border:none;height:330px;position:fixed;right:20px;top:20px;width:391px;z-index:9999}#credent
2024-02-08 18:35:44 UTC	413	IN	Data Raw: 69 61 6c 5f 70 69 63 6b 65 72 5f 63 6f 6e 74 61 69 6e 65 72 20 69 66 72 61 6d 65 7b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 77 69 64 74 68 3a 33 39 31 70 78 3b 68 65 69 67 68 74 3a 33 33 30 70 78 7d 23 67 5f 61 31 31 79 5f 61 6e 6e 6f 75 6e 63 65 6d 65 6e 74 7b 68 65 69 67 68 74 3a 31 70 78 3b 6c 65 66 74 3a 2d 31 30 30 30 30 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 61 75 74 6f 3b 77 69 64 74 68 3a 31 70 78 7d 2e 4c 35 46 6f 36 63 2d 73 4d 35 4d 4e 62 7b 62 6f 72 64 65 72 3a 30 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6c 65 66 74 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 74 6f 70 3a 30 7d 2e 4c 35 46 6f 36 63 2d 62 46 31 75 55 62 7b 2d 77 65 62 6b 69 74 Data Ascii: ial_picker_container iframe{border:none;width:391px;height:330px}#g_a11y_announcement{height:1px;left:-10000px;overflow:hidden;position:absolute;top:auto;width:1px}.L5Fo6c-sM5MNb{border:0;display:block;left:0;position:relative;top:0}.L5Fo6c-bF1uUb{-webkit
2024-02-08 18:35:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
167	192.168.2.5	49906	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:44 UTC	736	OUT	GET /static/js/atlas_cloudfront_sd/7aaea4329a86dd9e6dc4d51a92fef5573f6f9c09.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:44 UTC	809	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 120436 Connection: close Server: nginx Date: Thu, 01 Feb 2024 08:54:31 GMT Last-Modified: Thu, 26 Oct 2023 09:29:15 GMT ETag: "653a316b-1d674" Expires: Sat, 02 Mar 2024 08:54:31 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 25d9b5959eaa82bb18ee3f35e6bf34b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: kwnQpn9ZQmrSgRTteEnF8DpIPAFnmiB3D-1ztZEWZvwV2mNzMsxp0A== Age: 639672
2024-02-08 18:35:44 UTC	15575	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 3b 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 65 6e 61 62 6c 65 5f 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 26 26 28 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 2e 61 74 6c 61 73 3d 7b 6c 6f 61 64 65 64 3a 21 30 2c 72 75 6e 3a 21 31 7d 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 5f 69 5f 28 22 64 30 62 3a 33 35 35 37 63 30 37 61 22 29 3b 76 61 72 20 74 3d 22 41 74 6c 61 73 2f 22 3b 66 75 6e 63 74 69 6f 6e 20 69 28 65 29 7b 72 65 74 75 72 6e 20 5f 69 5f 28 22 64 30 62 3a 32 31 32 32 33 32 Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.atlas={loaded:!0,run:!1}),function(){"use strict";_i_("d0b:3557c07a");var t="Atlas/";function i(e){return _i_("d0b:212232
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 77 2e 74 6f 53 74 72 69 6e 67 28 29 2c 22 2c 22 2c 22 4e 45 3a 22 2c 74 68 69 73 2e 6e 65 2e 74 6f 53 74 72 69 6e 67 28 29 5d 2e 6a 6f 69 6e 28 22 20 22 29 29 7d 7d 2c 5f 72 5f 28 6f 29 7d 29 2c 42 2e 61 74 6c 61 73 2e 64 65 66 69 6e 65 28 22 67 65 6f 2e 6c 61 74 4c 6e 67 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 29 7b 76 61 72 20 72 3b 5f 69 5f 28 22 64 30 62 3a 61 31 61 39 33 62 65 35 22 29 2c 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 30 3c 65 2e 69 6e 64 65 78 4f 66 28 22 2c 22 29 3f 28 72 3d 65 2e 73 70 6c 69 74 28 22 2c 22 29 2c 74 68 69 73 2e 6c 61 74 3d 2b 72 5b 30 5d 2c 74 68 69 73 2e 6c 6e 67 3d 2b 72 5b 31 5d 29 3a 22 6f 62 6a 65 63 74 22 3d 3d 74 79 Data Ascii: w.toString(),",","NE:",this.ne.toString()].join(" "))}},_r_(o)}),B.atlas.define("geo.latLng",function(){"use strict";function e(e,t){var r;_i_("d0b:a1a93be5"),"string"==typeof e&&0<e.indexOf(",")?(r=e.split(","),this.lat=+r[0],this.lng=+r[1]):"object"==ty
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 2c 5f 72 5f 28 7b 69 6e 69 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 64 30 62 3a 34 61 39 33 63 34 64 30 22 29 3b 76 61 72 20 72 3d 74 68 69 73 3b 69 66 28 22 64 65 66 61 75 6c 74 22 21 3d 3d 74 68 69 73 2e 67 65 74 28 22 69 64 22 29 29 72 65 74 75 72 6e 20 5f 72 5f 28 29 3b 65 2e 65 61 63 68 28 69 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 5f 69 5f 28 22 64 30 62 3a 31 36 66 33 66 30 35 33 22 29 2c 74 2e 63 6f 6e 64 69 74 69 6f 6e 26 26 72 2e 6f 6e 28 74 2e 65 76 74 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 64 30 62 3a 65 65 37 62 31 66 64 66 22 29 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 5f 69 5f 28 22 64 30 62 3a 38 64 35 37 32 34 34 36 22 29 2c 74 2e 66 69 6c 74 65 72 26 26 21 74 2e 66 69 6c 74 65 72 2e 61 70 70 6c Data Ascii: ,_r_({init:function(){_i_("d0b:4a93c4d0");var r=this;if("default"!==this.get("id"))return _r_();e.each(i,function(e,t){_i_("d0b:16f3f053"),t.condition&&r.on(t.evt,function(){_i_("d0b:ee7b1fdf"),function(e,t){if(_i_("d0b:8d572446"),t.filter&&!t.filter.appl
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 72 65 74 75 72 6e 20 5f 69 5f 28 22 64 30 62 3a 35 62 66 38 30 61 38 33 22 29 2c 5f 72 5f 28 7b 73 65 74 4f 66 66 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 5f 69 5f 28 22 64 30 62 3a 38 63 32 64 37 32 38 31 22 29 3b 76 61 72 20 72 3d 6e 65 77 20 69 28 65 2c 74 29 3b 74 68 69 73 2e 73 65 74 28 22 6f 66 66 73 65 74 22 2c 72 29 2c 74 68 69 73 2e 74 72 69 67 67 65 72 28 22 6f 66 66 73 65 74 2d 63 68 61 6e 67 65 22 2c 72 29 2c 5f 72 5f 28 29 7d 7d 29 7d 29 2c 42 2e 61 74 6c 61 73 2e 64 65 66 69 6e 65 28 22 6f 70 74 69 6f 6e 73 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 72 65 74 75 72 6e 20 5f 69 5f 28 22 64 30 62 3a 31 31 31 33 35 34 36 65 22 29 2c 5f 72 5f 28 7b 63 6f 6e 66 69 67 5a 6f 6f 6d 43 6f 6e 74 72 6f 6c Data Ascii: return _i_("d0b:5bf80a83"),_r_({setOffset:function(e,t){_i_("d0b:8c2d7281");var r=new i(e,t);this.set("offset",r),this.trigger("offset-change",r),_r_()}})}),B.atlas.define("options",function(){"use strict";return _i_("d0b:1113546e"),_r_({configZoomControl
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 4f 70 65 6e 26 26 74 68 69 73 2e 73 65 74 50 6f 73 69 74 69 6f 6e 28 29 3a 28 74 68 69 73 2e 24 64 6f 6d 4e 6f 64 65 3d 6c 28 27 3c 64 69 76 20 63 6c 61 73 73 3d 22 27 2b 61 2b 27 22 2f 3e 27 29 2c 74 68 69 73 2e 24 64 6f 6d 4e 6f 64 65 2e 61 70 70 65 6e 64 54 6f 28 72 29 2e 62 69 6e 64 28 22 6d 6f 75 73 65 6d 6f 76 65 22 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 64 30 62 3a 32 61 64 34 35 38 65 35 22 29 2c 65 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 28 29 2c 5f 72 5f 28 29 7d 29 2e 6f 6e 28 22 63 6c 69 63 6b 22 2c 65 2e 63 6c 6f 73 65 53 65 6c 65 63 74 6f 72 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 64 30 62 3a 36 31 31 30 64 32 30 36 22 29 2c 65 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 28 29 2c 74 2e 63 6c 6f 73 65 Data Ascii: Open&&this.setPosition():(this.$domNode=l('<div class="'+a+'"/>'),this.$domNode.appendTo(r).bind("mousemove",function(e){_i_("d0b:2ad458e5"),e.stopPropagation(),_r_()}).on("click",e.closeSelector,function(e){_i_("d0b:6110d206"),e.stopPropagation(),t.close
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 22 61 74 6c 61 73 22 29 2c 72 3d 74 68 69 73 2e 67 65 74 28 22 69 64 22 29 3b 74 2e 67 65 74 50 6c 61 63 65 44 65 74 61 69 6c 73 28 7b 70 6c 61 63 65 49 64 3a 72 7d 2c 65 2c 74 68 69 73 29 2c 5f 72 5f 28 29 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 4d 61 72 6b 65 72 43 6f 6e 66 69 67 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 5f 69 5f 28 22 64 30 62 3a 31 34 38 65 35 64 36 37 22 29 3b 76 61 72 20 74 2c 72 3d 74 68 69 73 2e 67 65 74 28 22 63 6f 6f 72 64 69 6e 61 74 65 73 22 29 3b 72 65 74 75 72 6e 20 74 3d 7b 62 5f 69 64 3a 74 68 69 73 2e 67 65 74 28 22 69 64 22 29 2c 62 5f 6c 61 74 69 74 75 64 65 3a 72 2e 6c 61 74 2c 62 5f 6c 6f 6e 67 69 74 75 64 65 3a 72 2e 6c 6e 67 2c 64 61 74 61 3a 74 68 69 73 2e 67 65 74 28 22 64 61 74 61 22 29 7d 2c 6f 2e 65 78 Data Ascii: "atlas"),r=this.get("id");t.getPlaceDetails({placeId:r},e,this),_r_()},e.prototype.getMarkerConfig=function(e){_i_("d0b:148e5d67");var t,r=this.get("coordinates");return t={b_id:this.get("id"),b_latitude:r.lat,b_longitude:r.lng,data:this.get("data")},o.ex
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 65 32 62 63 22 29 2c 74 68 69 73 2e 5f 72 65 61 64 79 3d 21 31 2c 65 2e 6c 61 74 4c 6e 67 3f 74 68 69 73 2e 70 6f 73 69 74 69 6f 6e 3d 6e 65 77 20 67 6f 6f 67 6c 65 2e 6d 61 70 73 2e 4c 61 74 4c 6e 67 28 65 2e 6c 61 74 4c 6e 67 29 3a 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 62 5f 6c 61 74 69 74 75 64 65 22 29 26 26 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 22 62 5f 6c 6f 6e 67 69 74 75 64 65 22 29 26 26 28 74 68 69 73 2e 70 6f 73 69 74 69 6f 6e 3d 6e 65 77 20 67 6f 6f 67 6c 65 2e 6d 61 70 73 2e 4c 61 74 4c 6e 67 28 65 2e 62 5f 6c 61 74 69 74 75 64 65 2c 65 2e 62 5f 6c 6f 6e 67 69 74 75 64 65 29 29 2c 74 68 69 73 2e 64 61 74 61 3d 65 2c 74 68 69 73 2e 62 5f 69 64 3d 65 2e 62 5f 69 64 2c 74 68 69 73 2e 62 5f 61 74 6c 61 73 5f 69 64 3d Data Ascii: e2bc"),this._ready=!1,e.latLng?this.position=new google.maps.LatLng(e.latLng):e.hasOwnProperty("b_latitude")&&e.hasOwnProperty("b_longitude")&&(this.position=new google.maps.LatLng(e.b_latitude,e.b_longitude)),this.data=e,this.b_id=e.b_id,this.b_atlas_id=
2024-02-08 18:35:44 UTC	6557	IN	Data Raw: 69 66 69 65 64 22 7d 5d 7d 2c 7b 66 65 61 74 75 72 65 54 79 70 65 3a 22 72 6f 61 64 22 2c 65 6c 65 6d 65 6e 74 54 79 70 65 3a 22 6c 61 62 65 6c 73 22 2c 73 74 79 6c 65 72 73 3a 5b 7b 76 69 73 69 62 69 6c 69 74 79 3a 22 6f 66 66 22 7d 5d 7d 2c 7b 66 65 61 74 75 72 65 54 79 70 65 3a 22 77 61 74 65 72 22 2c 65 6c 65 6d 65 6e 74 54 79 70 65 3a 22 61 6c 6c 22 2c 73 74 79 6c 65 72 73 3a 5b 7b 68 75 65 3a 22 23 30 30 33 35 38 30 22 7d 2c 7b 76 69 73 69 62 69 6c 69 74 79 3a 22 6f 6e 22 7d 5d 7d 2c 7b 66 65 61 74 75 72 65 54 79 70 65 3a 22 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 2e 63 6f 75 6e 74 72 79 22 2c 65 6c 65 6d 65 6e 74 54 79 70 65 3a 22 73 74 72 6f 6b 65 22 2c 73 74 79 6c 65 72 73 3a 5b 7b 63 6f 6c 6f 72 3a 22 23 66 38 66 36 65 65 22 7d 2c 7b 77 65 69 Data Ascii: ified"}]},{featureType:"road",elementType:"labels",stylers:[{visibility:"off"}]},{featureType:"water",elementType:"all",stylers:[{hue:"#003580"},{visibility:"on"}]},{featureType:"administrative.country",elementType:"stroke",stylers:[{color:"#f8f6ee"},{wei

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
168	192.168.2.5	49902	142.250.9.100	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:44 UTC	386	OUT	GET /.well-known/web-identity HTTP/1.1 Host: google.com Connection: keep-alive Accept: application/json Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: webidentity User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:44 UTC	466	IN	HTTP/1.1 301 Moved Permanently Location: https://www.google.com/.well-known/web-identity Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Server: sffe Content-Length: 244 X-XSS-Protection: 0 Date: Thu, 08 Feb 2024 18:29:54 GMT Expires: Thu, 08 Feb 2024 18:59:54 GMT Cache-Control: public, max-age=1800 Content-Type: text/html; charset=UTF-8 Age: 350 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:44 UTC	244	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 2e 77 65 6c 6c 2d 6b 6e 6f 77 6e 2f 77 65 62 2d 69 64 65 6e 74 69 74 79 22 3e 68 65 72 65 3c 2f 41 3e 2e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>301 Moved</TITLE></HEAD><BODY><H1>301 Moved</H1>The document has moved<A HREF="https://www.google.com/.well-known/web-identity">here</A>.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
169	192.168.2.5	49905	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:44 UTC	740	OUT	GET /static/js/atlas_cst_cloudfront_sd/138d388521c0fb45e14005cb8098ebebb7158dce.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:44 UTC	810	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 621029 Connection: close Server: nginx Date: Wed, 10 Jan 2024 12:45:08 GMT Last-Modified: Wed, 10 Jan 2024 11:45:34 GMT ETag: "659e835e-979e5" Expires: Fri, 09 Feb 2024 12:45:08 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 309e9e958e8d35f7e17ae8ac267b7dea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: vblIsatTaFwzquVE3TxDsftjijBGxIBWfrSy2zvw3_ZmnhImC8mP4w== Age: 2526635
2024-02-08 18:35:44 UTC	15574	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 3b 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 65 6e 61 62 6c 65 5f 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 26 26 28 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 2e 61 74 6c 61 73 5f 63 73 74 3d 7b 6c 6f 61 64 65 64 3a 21 30 2c 72 75 6e 3a 21 31 7d 29 2c 62 6f 6f 6b 69 6e 67 2e 6a 73 74 6d 70 6c 28 22 61 74 6c 61 73 5f 69 77 5f 64 65 66 61 75 6c 74 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 33 37 33 3a 32 66 38 63 34 64 64 38 22 29 3b 76 61 72 20 69 3d 5b 27 5c 6e 3c 64 69 76 20 63 6c 61 73 73 3d 22 69 77 2d 63 Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(e){return e};booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.atlas_cst={loaded:!0,run:!1}),booking.jstmpl("atlas_iw_default",function(){_i_("373:2f8c4dd8");var i=['\n<div class="iw-c
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 6c 6c 2c 72 5b 39 32 5d 29 29 2c 72 5b 39 33 5d 5d 2e 6a 6f 69 6e 28 22 22 29 29 2c 74 2b 3d 72 5b 37 38 5d 2c 69 2e 4d 4e 28 73 5b 35 33 5d 2c 74 29 2c 5f 2b 3d 72 5b 39 34 5d 2c 69 2e 4d 4a 28 69 2e 4d 43 28 73 5b 33 5d 29 2e 62 5f 62 6c 6f 63 6b 73 29 26 26 69 2e 4d 4a 28 69 2e 4d 43 28 73 5b 33 5d 29 2e 62 5f 62 6c 6f 63 6b 73 5b 30 5d 2e 6e 75 6d 5f 72 6f 6f 6d 73 5f 61 76 61 69 6c 61 62 6c 65 5f 74 72 61 6e 73 6c 61 74 65 64 29 26 26 69 2e 4d 4a 28 69 2e 41 54 4c 41 53 5f 45 4e 56 28 22 61 63 74 69 6f 6e 22 29 2b 22 22 3d 3d 22 68 6f 74 65 6c 22 29 3f 5f 2b 3d 5b 72 5b 39 35 5d 2c 69 2e 4d 43 28 73 5b 35 33 5d 29 2c 72 5b 39 36 5d 2c 69 2e 4d 43 28 73 5b 33 5d 29 2e 62 5f 62 6c 6f 63 6b 73 5b 30 5d 2e 6e 75 6d 5f 72 6f 6f 6d 73 5f 61 76 61 69 6c 61 Data Ascii: ll,r[92])),r[93]].join("")),t+=r[78],i.MN(s[53],t),_+=r[94],i.MJ(i.MC(s[3]).b_blocks)&&i.MJ(i.MC(s[3]).b_blocks[0].num_rooms_available_translated)&&i.MJ(i.ATLAS_ENV("action")+""=="hotel")?_+=[r[95],i.MC(s[53]),r[96],i.MC(s[3]).b_blocks[0].num_rooms_availa
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 5d 29 29 26 26 69 2e 4d 4a 28 69 2e 4d 42 28 72 5b 34 35 5d 29 3c 37 29 26 26 69 2e 4d 4e 28 72 5b 34 39 5d 2c 69 2e 4d 45 28 61 5b 38 33 5d 2c 69 2e 4d 42 2c 69 2e 4d 4e 2c 6e 75 6c 6c 29 29 2c 65 2b 3d 5b 69 2e 4d 43 28 72 5b 34 39 5d 29 2c 61 5b 36 30 5d 5d 2e 6a 6f 69 6e 28 22 22 29 7d 72 65 74 75 72 6e 20 69 2e 4d 4e 28 22 66 65 5f 61 64 6a 65 63 74 69 76 65 22 2c 30 29 2c 69 2e 4d 4e 28 22 66 65 5f 68 69 64 65 5f 6c 6f 77 5f 61 64 6a 65 63 74 69 76 65 73 22 2c 30 29 2c 69 2e 4d 4e 28 22 66 65 5f 73 63 6f 72 65 22 2c 30 29 2c 65 2b 3d 61 5b 31 36 5d 2c 5f 72 5f 28 65 29 7d 28 6e 29 2c 5f 2e 73 68 69 66 74 28 29 2c 69 2e 4d 4e 28 72 5b 34 38 5d 2c 6e 29 2c 69 2e 4d 4a 28 69 2e 4d 42 28 72 5b 34 37 5d 29 29 26 26 69 2e 4d 4e 28 22 66 65 5f 61 64 6a 65 Data Ascii: ]))&&i.MJ(i.MB(r[45])<7)&&i.MN(r[49],i.ME(a[83],i.MB,i.MN,null)),e+=[i.MC(r[49]),a[60]].join("")}return i.MN("fe_adjective",0),i.MN("fe_hide_low_adjectives",0),i.MN("fe_score",0),e+=a[16],_r_(e)}(n),_.shift(),i.MN(r[48],n),i.MJ(i.MB(r[47]))&&i.MN("fe_adje
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 5c 74 5c 6e 5c 74 5c 74 22 2c 22 5c 6e 5c 6e 5c 74 5c 74 22 2c 22 5c 6e 5c 6e 5c 74 5c 74 5c 6e 5c 74 5c 74 22 2c 22 5c 6e 5c 6e 5c 74 5c 74 5c 74 22 2c 22 5c 6e 5c 74 5c 74 5c 74 5c 74 5c 6e 5c 74 5c 74 5c 74 5c 74 22 2c 22 5c 6e 5c 74 3c 22 2c 27 20 63 6c 61 73 73 3d 22 72 65 76 69 65 77 2d 73 63 6f 72 65 2d 62 61 64 67 65 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 27 2c 22 2f 70 72 69 76 61 74 65 2f 61 31 31 79 5f 72 61 74 69 6e 67 5f 73 63 6f 72 65 5f 66 6f 72 5f 73 63 72 65 65 6e 72 65 61 64 65 72 2f 6e 61 6d 65 22 2c 27 22 3e 5c 6e 5c 74 5c 74 27 2c 22 5c 6e 5c 74 3c 2f 22 2c 22 3e 5c 6e 22 2c 22 5c 6e 5c 74 5c 74 5c 74 5c 74 5c 74 5c 6e 5c 74 5c 74 5c 74 5c 74 5c 74 22 2c 22 5c 6e 5c 74 5c 74 5c 74 5c 74 5c 74 22 2c 27 5c 6e 5c 74 5c 74 5c 74 5c 74 Data Ascii: \t\n\t\t","\n\n\t\t","\n\n\t\t\n\t\t","\n\n\t\t\t","\n\t\t\t\t\n\t\t\t\t","\n\t<",' class="review-score-badge" aria-label="',"/private/a11y_rating_score_for_screenreader/name",'">\n\t\t',"\n\t</",">\n","\n\t\t\t\t\t\n\t\t\t\t\t","\n\t\t\t\t\t",'\n\t\t\t\t
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 37 5d 29 7d 29 2c 4d 3d 72 2e 4d 45 28 6c 5b 31 30 37 5d 2c 72 2e 4d 42 2c 72 2e 4d 4e 2c 6e 75 6c 6c 29 2c 61 2e 73 68 69 66 74 28 29 2c 4d 29 2c 6c 5b 31 30 38 5d 2c 72 2e 46 2e 65 6e 74 69 74 69 65 73 28 72 2e 4d 42 28 63 5b 33 35 5d 29 29 2c 6c 5b 31 30 32 5d 5d 2e 6a 6f 69 6e 28 22 22 29 2c 72 2e 4d 44 28 63 5b 38 34 5d 29 3f 5f 2b 3d 6c 5b 31 30 33 5d 3a 5f 2b 3d 6c 5b 39 38 5d 2c 5f 2b 3d 6c 5b 31 30 34 5d 29 2c 5f 2b 3d 6c 5b 38 5d 2c 72 2e 4d 4e 28 63 5b 38 33 5d 2c 5f 29 2c 65 2b 3d 6c 5b 31 30 39 5d 2c 5f 3d 22 22 2c 5f 2b 3d 5b 6c 5b 31 31 30 5d 2c 72 2e 4d 42 28 63 5b 37 36 5d 29 2c 6c 5b 31 31 31 5d 5d 2e 6a 6f 69 6e 28 22 22 29 2c 5f 2b 3d 72 2e 46 2e 65 6e 74 69 74 69 65 73 28 72 2e 4d 42 28 63 5b 37 33 5d 29 29 2c 72 2e 4d 4a 28 72 2e 4d Data Ascii: 7])}),M=r.ME(l[107],r.MB,r.MN,null),a.shift(),M),l[108],r.F.entities(r.MB(c[35])),l[102]].join(""),r.MD(c[84])?_+=l[103]:_+=l[98],_+=l[104]),_+=l[8],r.MN(c[83],_),e+=l[109],_="",_+=[l[110],r.MB(c[76]),l[111]].join(""),_+=r.F.entities(r.MB(c[73])),r.MJ(r.M
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 4d 61 74 72 69 78 20 76 61 6c 75 65 73 3d 22 30 20 30 20 30 20 30 20 30 20 30 20 30 20 30 20 30 20 30 20 30 20 30 20 30 20 30 20 30 20 30 20 30 20 30 20 30 2e 31 20 30 22 20 69 6e 3d 22 73 68 61 64 6f 77 42 6c 75 72 4f 75 74 65 72 32 22 20 72 65 73 75 6c 74 3d 22 73 68 61 64 6f 77 4d 61 74 72 69 78 4f 75 74 65 72 32 22 2f 3e 5c 6e 20 20 20 20 20 20 3c 66 65 4d 65 72 67 65 3e 5c 6e 20 20 20 20 20 20 20 20 3c 66 65 4d 65 72 67 65 4e 6f 64 65 20 69 6e 3d 22 73 68 61 64 6f 77 4d 61 74 72 69 78 4f 75 74 65 72 31 22 2f 3e 5c 6e 20 20 20 20 20 20 20 20 3c 66 65 4d 65 72 67 65 4e 6f 64 65 20 69 6e 3d 22 73 68 61 64 6f 77 4d 61 74 72 69 78 4f 75 74 65 72 32 22 2f 3e 5c 6e 20 20 20 20 20 20 3c 2f 66 65 4d 65 72 67 65 3e 5c 6e 20 20 20 20 3c 2f 66 69 6c 74 65 72 3e Data Ascii: Matrix values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0.1 0" in="shadowBlurOuter2" result="shadowMatrixOuter2"/>\n <feMerge>\n <feMergeNode in="shadowMatrixOuter1"/>\n <feMergeNode in="shadowMatrixOuter2"/>\n </feMerge>\n </filter>
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 31 31 2e 32 33 34 32 20 31 34 2e 35 36 30 35 20 31 31 2e 30 39 36 34 20 31 34 2e 32 39 39 37 20 31 31 2e 31 38 37 31 43 31 34 2e 30 33 38 39 20 31 31 2e 32 37 37 39 20 31 33 2e 39 30 31 20 31 31 2e 35 36 32 39 20 31 33 2e 39 39 31 38 20 31 31 2e 38 32 33 37 5a 22 20 66 69 6c 6c 3d 22 23 46 46 38 30 30 30 22 2f 3e 5c 6e 3c 2f 73 76 67 3e 5c 6e 5c 6e 27 2c 27 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 3c 73 76 67 20 63 6c 61 73 73 3d 22 6d 61 72 6b 65 72 2d 6c 61 6e 64 6d 61 72 6b 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 32 32 20 32 34 22 3e 5c 6e 20 20 20 20 3c 65 6c 6c 69 70 73 65 20 63 6c 61 73 73 3d 22 73 68 61 64 6f 77 22 20 66 69 6c 6c 2d 6f 70 Data Ascii: 11.2342 14.5605 11.0964 14.2997 11.1871C14.0389 11.2779 13.901 11.5629 13.9918 11.8237Z" fill="#FF8000"/>\n</svg>\n\n','\n\n\n\n\n\n\n<svg class="marker-landmark" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 22 24">\n <ellipse class="shadow" fill-op
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 2e 32 32 4c 39 37 2e 35 39 20 38 30 2e 32 32 6c 32 35 2e 38 2d 32 31 2e 33 39 61 31 31 2e 37 20 31 31 2e 37 20 30 20 30 20 30 20 33 2e 33 37 2d 31 32 2e 39 31 7a 6d 2d 38 2e 35 32 20 36 2e 37 39 6c 2d 32 36 2e 35 32 20 32 32 61 36 2e 35 39 20 36 2e 35 39 20 30 20 30 20 30 2d 32 20 37 2e 31 31 6c 31 31 2e 31 32 20 33 33 2e 33 37 61 33 2e 36 36 20 33 2e 36 36 20 30 20 30 20 31 2d 32 2e 39 35 20 34 2e 38 31 20 33 2e 35 38 20 33 2e 35 38 20 30 20 30 20 31 2d 32 2e 37 32 2d 2e 36 38 6c 2d 32 37 2e 32 39 2d 32 30 2d 2e 31 34 2d 2e 30 38 61 36 2e 37 38 20 36 2e 37 38 20 30 20 30 20 30 2d 2e 37 36 2d 2e 34 37 63 2d 2e 31 36 2d 2e 30 38 2d 2e 33 33 2d 2e 31 34 2d 2e 34 39 2d 2e 32 31 73 2d 2e 33 2d 2e 31 33 2d 2e 34 36 2d 2e 31 38 2d 2e 33 39 2d 2e 31 2d 2e 35 38 Data Ascii: .22L97.59 80.22l25.8-21.39a11.7 11.7 0 0 0 3.37-12.91zm-8.52 6.79l-26.52 22a6.59 6.59 0 0 0-2 7.11l11.12 33.37a3.66 3.66 0 0 1-2.95 4.81 3.58 3.58 0 0 1-2.72-.68l-27.29-20-.14-.08a6.78 6.78 0 0 0-.76-.47c-.16-.08-.33-.14-.49-.21s-.3-.13-.46-.18-.39-.1-.58
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 3a 64 65 73 6b 74 6f 70 5f 72 6f 6f 6d 5f 6c 69 73 74 5f 70 72 69 63 65 5f 63 6f 6c 75 6d 6e 5f 68 6f 76 65 72 5f 6f 76 65 72 5f 69 5f 69 63 6f 6e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 2c 22 69 63 6f 6e 73 65 74 2f 69 6e 66 6f 5f 73 69 67 6e 22 2c 27 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 73 70 61 6e 3e 5c 6e 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 5c 6e 5c 6e 20 20 20 20 20 20 20 20 3c 64 69 76 20 69 64 3d 22 27 2c 27 22 20 63 6c 61 73 73 3d 22 62 75 69 2d 63 61 72 64 20 62 75 69 2d 75 2d 68 69 64 64 65 6e 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 75 69 2d 63 61 72 64 5f 5f 63 6f 6e 74 65 6e 74 22 3e 5c 6e 20 20 20 20 20 Data Ascii: :desktop_room_list_price_column_hover_over_i_icon\n ","iconset/info_sign",'\n </span>\n </div>\n\n <div id="','" class="bui-card bui-u-hidden">\n <div class="bui-card__content">\n
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 6d 65 73 73 61 67 65 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 27 2c 22 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 2c 27 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 70 2d 63 61 72 64 5f 5f 75 72 67 65 6e 63 79 2d 73 63 61 72 63 69 74 79 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: message">\n ',"\n </div>\n ",'\n <div class="map-card__urgency-scarcity">\n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
170	192.168.2.5	49907	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:44 UTC	740	OUT	GET /static/js/calendar2_cloudfront_sd/06071dd1c4e89fbe99e5ad6e21584a6bf9585e84.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:44 UTC	808	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 52156 Connection: close Server: nginx Date: Mon, 15 Jan 2024 07:57:23 GMT Last-Modified: Tue, 12 Jan 2021 10:06:38 GMT ETag: "5ffd74ae-cbbc" Expires: Wed, 14 Feb 2024 07:57:23 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 f4c38e024a95b76a27c9f3dc9ff2eda6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: UyALxw7NsOL406U_MaFIMB-Wv7OTrdSlIgjCwOe5alTlhn90pnLqaQ== Age: 2111900
2024-02-08 18:35:44 UTC	15576	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 7d 3b 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 65 6e 61 62 6c 65 5f 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 26 26 28 62 6f 6f 6b 69 6e 67 2e 65 6e 76 2e 73 63 72 69 70 74 73 5f 74 72 61 63 6b 69 6e 67 2e 63 61 6c 65 6e 64 61 72 32 3d 7b 6c 6f 61 64 65 64 3a 21 30 2c 72 75 6e 3a 21 31 7d 29 2c 62 6f 6f 6b 69 6e 67 2e 65 6e 73 75 72 65 4e 61 6d 65 73 70 61 63 65 45 78 69 73 74 73 28 22 63 61 6c 65 6e 64 61 72 32 22 29 2c 66 75 6e 63 74 69 6f 6e 28 6e 2c 72 2c 73 2c 74 2c 65 29 7b 5f 69 5f 28 22 61 34 31 3a 34 61 64 39 62 39 62 31 22 29 2c 73 2e 4f 4e 45 5f 44 41 Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(t){return t};booking.env.enable_scripts_tracking&&(booking.env.scripts_tracking.calendar2={loaded:!0,run:!1}),booking.ensureNamespaceExists("calendar2"),function(n,r,s,t,e){_i_("a41:4ad9b9b1"),s.ONE_DA
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 28 29 29 2c 66 29 7b 76 61 72 20 73 3d 27 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 32 2d 62 75 74 74 6f 6e 20 63 32 2d 62 75 74 74 6f 6e 2d 65 61 72 6c 69 65 72 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 32 2d 62 75 74 74 6f 6e 2d 69 6e 6e 65 72 20 61 31 31 79 5f 73 62 5f 63 61 6c 65 6e 64 61 72 5f 70 72 65 76 5f 6e 65 78 74 5f 6d 6f 6e 74 68 5f 62 75 74 74 6f 6e 22 20 72 6f 6c 65 3d 22 70 72 65 73 65 6e 74 61 74 69 6f 6e 22 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 22 74 72 75 65 22 3e 26 6c 61 72 72 3b 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 32 2d 62 75 74 74 6f 6e 20 63 32 2d 62 75 74 74 6f 6e 2d 66 75 72 74 68 65 72 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 32 2d 62 75 74 74 6f 6e 2d 69 6e 6e 65 72 20 61 31 31 79 5f Data Ascii: ()),f){var s='<div class="c2-button c2-button-earlier"><div class="c2-button-inner a11y_sb_calendar_prev_next_month_button" role="presentation" aria-hidden="true">←</div></div><div class="c2-button c2-button-further"><div class="c2-button-inner a11y_
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 69 73 2e 67 65 74 44 61 79 28 65 29 2c 61 3d 6f 2e 6d 6f 6e 74 68 49 64 28 6e 2e 67 65 74 59 65 61 72 28 29 2c 6e 2e 67 65 74 4d 6f 6e 74 68 28 29 29 2c 72 3d 69 7c 7c 7b 7d 3b 2d 31 3d 3d 3d 74 68 69 73 2e 67 65 74 56 69 73 69 62 6c 65 4d 6f 6e 74 68 73 28 29 2e 69 6e 64 65 78 4f 66 28 61 29 26 26 74 68 69 73 2e 73 65 6c 65 63 74 4d 6f 6e 74 68 28 61 29 2c 67 26 26 6d 7c 7c 22 61 70 69 22 3d 3d 3d 72 2e 74 79 70 65 7c 7c 21 30 21 3d 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 63 6c 6f 73 65 4f 6e 44 61 74 65 53 65 6c 65 63 74 65 64 7c 7c 74 68 69 73 2e 68 69 64 65 28 29 2c 22 75 73 65 72 22 3d 3d 3d 72 2e 74 79 70 65 26 26 28 74 68 69 73 2e 66 69 72 65 43 61 6c 6c 62 61 63 6b 28 22 6f 6e 44 61 74 65 53 65 6c 65 63 74 65 64 22 2c 6e 2c 72 2c 74 68 69 73 2e Data Ascii: is.getDay(e),a=o.monthId(n.getYear(),n.getMonth()),r=i\|\|{};-1===this.getVisibleMonths().indexOf(a)&&this.selectMonth(a),g&&m\|\|"api"===r.type\|\|!0!==this.options.closeOnDateSelected\|\|this.hide(),"user"===r.type&&(this.fireCallback("onDateSelected",n,r,this.
2024-02-08 18:35:44 UTC	3812	IN	Data Raw: 65 6e 64 61 72 5f 2e 6f 70 74 69 6f 6e 73 2e 6d 6f 6e 74 68 4e 61 6d 65 73 5b 69 5d 2b 22 20 22 2b 65 29 2c 5f 72 5f 28 74 29 7d 2c 67 65 74 48 54 4d 4c 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 5f 69 5f 28 22 61 34 31 3a 66 39 32 32 30 38 30 65 22 29 3b 76 61 72 20 74 3d 74 68 69 73 2e 67 65 74 4d 6f 6e 74 68 28 29 2c 65 3d 74 68 69 73 2e 67 65 74 59 65 61 72 28 29 2c 69 3d 75 2e 67 65 74 4e 75 6d 62 65 72 4f 66 44 61 79 73 49 6e 4d 6f 6e 74 68 28 74 2c 65 29 2c 6e 3d 31 2c 61 3d 6e 65 77 20 44 61 74 65 28 65 2c 74 2c 31 29 2e 67 65 74 44 61 79 28 29 2c 72 3d 22 22 3b 69 66 28 74 68 69 73 2e 63 61 6c 65 6e 64 61 72 5f 2e 6f 70 74 69 6f 6e 73 2e 73 75 6e 64 61 79 46 69 72 73 74 7c 7c 28 61 3d 28 61 2b 36 29 25 37 29 2c 66 29 7b 76 61 72 20 73 3d 6c 2e 6a 73 74 Data Ascii: endar_.options.monthNames[i]+" "+e),_r_(t)},getHTML:function(){_i_("a41:f922080e");var t=this.getMonth(),e=this.getYear(),i=u.getNumberOfDaysInMonth(t,e),n=1,a=new Date(e,t,1).getDay(),r="";if(this.calendar_.options.sundayFirst\|\|(a=(a+6)%7),f){var s=l.jst

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
171	192.168.2.5	49764	18.238.55.22	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:44 UTC	688	OUT	GET /xdata/images/xphoto/2880x868/308526620.jpeg?k=0663a1420ea98a013af0eda32bb4d11258521a39c5b8a5a4e2777ee5661dee55&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:44 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Tue, 06 Feb 2024 08:27:05 GMT ETag: "b9a8ca902a668d150d71f3c9f7a5cc2e4159dddf" Content-Language: 245767 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 46b3f244fe2a22dff3a717bf9da34d86.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P4 X-Amz-Cf-Id: YBAVLuAyXHRS6jCUl1g9xzK0DPJq9rmY6Xam6xZ4hyRkD9y_29YUDA== Age: 209319
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 66 62 63 37 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 03 64 0b 40 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: fbc7JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222d@"}!1AQa"q
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 10 fb 57 05 6d 11 69 86 07 41 5d c6 8c 0f f6 78 07 ad 7a 59 64 ff 00 7d 63 ca cd 61 7a 17 24 d4 ce db 19 48 fe ed 79 76 a5 0b 34 b2 31 3d 39 1f 5a f5 0d 5f 8d 3e 4f 71 5e 75 7a 81 2e 53 b8 27 9c d2 cd 65 fb d4 87 94 c7 f7 4d 99 f1 e0 e0 e7 3e a2 90 9d d8 f9 76 8c d4 e9 6c d2 49 b9 f0 a8 3a 62 a7 6b 62 23 8f fb bb bb d7 0c 27 78 b3 d1 92 f7 91 d7 78 28 7f c4 b6 53 9c 8c f5 ae 9f b5 61 f8 5e 21 16 9a c0 0c 73 5b bd fd ab e9 70 4f f7 28 f9 4c 6f f1 e4 84 a2 9d 8a 2b a8 e5 1b 4b 8a 00 a7 62 8b 80 da 29 48 a0 71 45 c0 4c 62 8a 77 5a 28 01 a0 66 9d 8e 28 c5 2d 20 13 14 53 a8 c5 21 8d a5 c0 a5 c5 25 03 17 00 0a 50 05 1d a8 14 00 9d 28 14 ec 51 8a 06 25 2d 2d 02 80 13 14 53 a8 a4 03 68 a7 51 8a 06 25 14 b8 a5 c5 00 37 14 62 9d 8a 31 48 2c 36 8a 75 18 a0 2c 36 8a Data Ascii: WmiA]xzYd}caz$Hyv41=9Z_>Oq^uz.S'eM>vlI:bkb#'xx(Sa^!s[pO(Lo+Kb)HqELbwZ(f(- S!%P(Q%--ShQ%7b1H,6u,6
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 5f 79 f2 27 55 03 20 f5 c9 fc ab 97 bd f1 0e a9 e2 e7 91 da 6f b2 69 f9 f9 52 2e 19 a8 e4 65 73 a3 bc bb f1 b4 93 cf e4 5a ac 6a bd d9 9c 56 46 a3 65 6d ab fe f2 5b f8 bc e1 ce d0 c2 b8 fd 03 45 fe da d4 3c 8b 50 ee c3 aa ca d5 d4 5c 78 52 ce d1 9a 3b 98 9e 09 02 f0 62 6e a7 f0 ad 63 49 33 29 57 6b a1 8d 2c 52 e9 b3 6d 73 f2 9e dd 8d 57 bd 81 1d 3e d1 6d f2 af f1 20 a6 ea 57 52 da 59 5d e9 b2 e6 7b a4 ff 00 54 c7 92 32 38 35 cf e9 1a b4 c8 e6 de e9 8a 4c 38 c9 fe 2a 1c 6d b1 2a 7c db 93 b4 a1 64 de a7 03 b8 aa b7 0e 12 4c ff 00 0b 55 cb d8 c1 cb aa ed 94 f5 1d 8d 66 5c 3b 79 7b 4a d0 a4 27 11 ad 2f 93 20 60 01 5c e6 ba 1d 17 50 0f 36 19 82 86 c8 3e fe 95 cb c8 77 c4 15 ba 52 d8 cc d1 c9 82 70 47 dd a2 a2 ba 4d 0a 1b b4 cf a1 3c 21 7c 6f 34 63 1b 9c b4 27 Data Ascii: _y'U oiR.esZjVFem[E<P\xR;bncI3)Wk,RmsW>m WRY]{T285L8m\|dLUf\;y{J'/ `\P6>wRpGM<!\|o4c'
2024-02-08 18:35:44 UTC	15311	IN	Data Raw: d8 4d 61 88 57 89 d5 83 92 52 d4 c9 d4 b8 b6 f3 3b 1a cc 81 5a 48 c9 03 8c 66 b7 6e 6c cc da 56 de e0 54 3a 5d b0 6b 5e 07 20 e0 d7 93 26 d6 87 b6 95 f5 2a 5b 59 c9 39 55 23 a9 e2 bd 13 42 d2 c6 99 a7 82 47 ef 9f 96 35 43 c3 da 40 69 cc d2 0f 94 74 ae 92 53 c6 07 4e 95 e8 e1 29 34 b9 99 e5 63 2b 26 f9 62 73 da dc 46 ee 16 80 0c 86 e0 8a e1 b5 bd 3c 5a 68 d3 46 c3 1b 4e 54 9a f5 14 b6 0c e7 23 27 b5 73 fe 2c d1 8d dd 99 8d 17 96 23 ff 00 af 5d 35 61 cc 8e 5a 53 e5 67 89 e9 16 52 6a 17 a5 79 20 64 9c 7e 95 67 57 d1 3c 90 4a 82 06 d0 48 af 45 d1 3c 28 ba 63 49 23 2f 2c 3d 2b 98 f1 c4 8b 60 8a 07 f1 71 58 f2 25 03 7e 7e 69 1c 7d b4 8b 6a a2 38 c0 dd 5a 76 bf bc 61 bb 39 15 8f a5 46 6e f5 00 7b 05 ae c2 c3 4f 66 29 f2 f0 c6 b3 84 2e c7 39 59 16 34 cb 49 8b 87 Data Ascii: MaWR;ZHfnlVT:]k^ &*[Y9U#BG5C@itSN)4c+&bsF<ZhFNT#'s,#]5aZSgRjy d~gW<JHE<(cI#/,=+`qX%~~i}j8Zva9Fn{Of).9Y4I
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 66 66 66 30 0d 0a 36 46 98 5a 51 a9 53 94 c7 d0 6d 98 78 b0 c9 8f 92 37 20 1f 5a f4 62 78 ae 1b 4a 75 1e 26 82 de 33 95 2c 49 3e bc 57 74 48 c7 35 09 be 54 99 eb 4a 2a 0f 95 15 e4 1c 73 d2 aa 4b 80 0f 35 6e 53 b8 11 e9 cd 53 91 41 5c e7 8a 91 34 55 fb 5a d9 47 3c e4 65 11 77 31 ad 6b 0b f8 75 2b 75 b8 81 b2 ac 33 d6 b9 1d 7a 66 83 4f b9 00 e4 32 e0 8f 51 50 f8 46 59 e1 8c 9c 9f 29 48 0c b9 e8 2b aa 94 ec 73 d4 a5 cf 13 d2 ad 81 38 ca ae 6b 5a 0d c0 72 40 ac 3b 33 1b 28 6c 3f 3d 2b 66 dc 82 38 8d 8f d6 bb 93 ba 3c c6 b9 5d 8b ea 78 ea 7f 0a b3 03 2e 7a 9a ae 9b b6 fd c0 3f 1a 9e 23 20 3f c3 8f a5 30 35 a0 71 b3 ab 54 ea 72 78 3f 9d 57 b6 32 15 fe 12 2a c0 c8 3c c7 9a 42 25 ed c9 cf d2 90 91 8e a6 91 5b 72 fc ab 81 e9 41 27 18 e2 80 14 63 1d 4d 44 e0 6d 6e Data Ascii: fff06FZQSmx7 ZbxJu&3,I>WtH5TJsK5nSSA\4UZG<ew1ku+u3zfO2QPFY)H+s8kZr@;3(l?=+f8<]x.z?# ?05qTrx?W2<B%[rA'cMDmn
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 4a 6d b5 60 a2 8e bd 28 ad 0c 44 c9 a2 97 1c 67 b7 ad 18 e3 3d aa 80 4a 5a 4e d9 a5 3d 33 da 81 0d a2 8a 3a 50 01 45 14 77 c7 7a 04 25 1d c5 14 64 8e 94 6c 06 4e be f3 26 9d 29 85 4b 1c 74 15 e7 56 37 b7 8d 61 74 92 a9 89 81 38 2d c5 7a 5f f6 82 8b 93 04 91 f0 dd 37 0e b5 81 e2 3b 58 27 53 17 92 15 0f 46 4e f5 e4 63 62 a5 a9 d9 45 9c 6e 8f 05 f5 bd c3 cf 2c ea b1 95 3f 31 c1 a8 75 5b db 4b 7b 17 82 da e7 7c c4 ee e2 b4 d1 ed 20 89 a0 98 3e c5 eb 9f 4a e3 35 1b 55 9b 51 2f 68 8c aa c7 03 77 7a e1 82 b9 d5 ab 36 b4 e8 ae da c3 cf f3 95 77 11 9f 5a ed 3c 2b a3 a8 ba 17 6b 23 31 c6 4e 78 15 ca 69 c9 65 6a b1 c5 72 ed b8 0c 91 9a ea 2d 3c 67 61 65 69 e4 c1 19 62 38 c6 2b a7 0a e2 aa 6a 67 59 4b 94 ee 81 0d 93 d2 93 ad 66 e8 da b2 6a f6 a5 d1 0a e2 b4 87 61 5e Data Ascii: Jm`(Dg=JZN=3:PEwz%dlN&)KtV7at8-z_7;X'SFNcbEn,?1u[K{\| >J5UQ/hwz6wZ<+k#1Nxiejr-<gaeib8+jgYKfja^
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: e7 45 c0 bb 9e 3a f1 47 1e b5 55 75 3b 37 5e 2e 53 f3 a5 fe d0 b4 ff 00 9f 84 fc e8 b8 8b 5f 88 c5 2f 1e b5 49 b5 6b 04 e1 ae 53 f3 a4 5d 5a c1 cf cb 74 9f 9d 00 5d 1c 9e b4 99 e6 ab 1d 56 c5 47 fc 7c a7 e7 4b fd a7 65 c6 2e 53 9f 7a 02 c5 ae 3d 69 32 0f 06 a1 1a 85 99 1f f1 f0 9f 9d 2f f6 85 91 ff 00 97 84 fc e8 ba 0b 0a ca 47 2b 4d 07 3c 63 9a 6b 6a 5a 70 07 75 d2 81 f5 ac d7 f1 16 96 66 31 c5 38 62 29 dd 05 8d 22 9e f4 9d 3b e7 eb 55 06 b5 60 7e f4 ea a7 d0 d4 cb 7b 6b 30 fd dd c2 7e 74 ee 2b 12 81 b5 b7 0c 66 a9 df e9 3a 7e a5 19 5b cb 68 9f be 48 e9 57 15 a3 23 86 a3 19 3c 91 f8 d0 ec f7 0d 8e 0f 52 f8 61 a6 dc 06 92 ca 56 49 0f 45 3d 2b 8e d4 fc 09 aa e9 b9 26 df cc 41 fc 49 5e db 8c 9c 80 29 4e 18 6d 3c e7 b1 1c 54 38 f6 1a 91 f3 a3 da 79 0f b6 64 Data Ascii: E:GUu;7^.S_/IkS]Zt]VG\|Ke.Sz=i2/G+M<ckjZpuf18b)";U`~{k0~t+f:~[hHW#<RaVIE=+&AI^)Nm<T8yd
2024-02-08 18:35:44 UTC	16376	IN	Data Raw: 39 02 bb 0f 15 cb e7 6b 77 47 82 03 1e 95 c5 5c 63 cb c6 39 66 cd 72 41 28 c9 c4 f4 2f 78 dc d1 b4 5f 2a d6 06 60 33 cd 69 d8 44 1e 62 db 4b 1c 76 e7 15 42 2f 2c f9 51 b2 b7 0a 0d 6e 68 91 2a cb 72 ea 58 7c bc 66 b1 ab a9 a5 35 a1 70 42 8e 90 07 5c f2 7f 95 4d 77 13 5b 78 72 08 54 73 24 c5 cf e5 54 ed ee d0 95 b5 27 12 6f 2d bf f0 ab b7 37 82 ee d6 38 40 e2 25 da 4f a9 f5 ae 5b 58 de 14 f9 9f 29 4a 5b f6 9e d5 d1 d4 61 17 15 c8 ca a0 5d 0c f1 96 ae b0 5a b2 42 d2 32 fc ad d6 b9 5b d5 0d 21 61 fc 26 ba 30 ba 30 c5 42 c9 58 af 6e 33 e6 0e e3 35 6f 4e 53 e5 9e ed bb 15 4e 06 22 69 33 de ad 69 e5 91 df eb 5d 55 3e 13 08 ea d2 35 ac ae 8a fe ea e0 63 0e 36 93 5e 89 67 0c 57 56 2b 14 c0 32 10 31 5c 9d 8e 97 06 a5 65 bb 77 ef d7 90 0d 76 1a 2c 32 2d b2 c3 3a ed Data Ascii: 9kwG\c9frA(/x_`3iDbKvB/,QnhrX\|f5pB\Mw[xrTs$T'o-78@%O[X)J[a]ZB2[!a&00BXn35oNSN"i3i]U>5c6^gWV+21\ewv,2-:
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: 31 63 34 35 30 0d 0a 6a c6 5c 93 d2 a6 5b 62 cb d6 a7 8d 11 10 ef ce 7d a9 b7 61 58 a8 9e 58 01 73 ce 6a 56 00 10 16 82 88 06 e2 31 f5 a8 dd f6 fc cb cd 35 a8 17 d6 35 75 50 0e 1b bd 43 72 9b 1c 2e 73 8a a4 26 70 c0 82 6a 45 2f b8 bb 1d df 5a 4d 58 3a 95 d9 8a ce 49 1c 53 d8 16 21 80 c0 aa ed 26 64 dc 7a e7 a5 5a 76 3b 78 e0 62 88 44 d2 61 bb e5 e0 73 46 43 63 34 c0 d8 00 1e fd e9 47 de e2 b5 b1 98 38 00 f1 46 32 29 c4 f3 8c 52 05 e3 34 ec 26 33 73 03 81 4e f9 88 ed 46 de 68 18 ce 0f 14 58 42 60 e3 b5 34 a6 57 ad 4d b0 30 f4 a8 c4 78 73 d4 8a 06 34 0e 38 15 95 ab c1 3b c7 ba 14 05 8a 9c e6 b5 2e 2e 52 d2 32 64 04 03 d0 d4 36 2c f7 62 46 90 ed 4e 8a 2b 8f 11 52 29 59 9a c2 2e e7 11 6d 35 c6 9f 28 31 31 0e 5b 91 5d fd 85 d4 72 69 a2 7f 33 7b 81 f3 8f 4a c4 Data Ascii: 1c450j\[b}aXXsjV155uPCr.s&pjE/ZMX:IS!&dzZv;xbDasFCc4G8F2)R4&3sNFhXB`4WM0xs48;..R2d6,bFN+R)Y.m5(11[]ri3{J
2024-02-08 18:35:44 UTC	16384	IN	Data Raw: be 4f 43 da ba 3f 0f 68 57 30 ca 6e 6f b1 19 5c ed 07 bd 54 da e5 b8 96 87 46 b6 42 38 51 2d 55 bf 76 01 12 30 fc eb 34 a1 b8 9a 7b 65 9d 8a 31 c9 73 c6 0d 5b 79 6e de dd 92 2b 88 c9 cf 03 70 e9 56 3c 39 69 25 ac f2 1b d8 a3 74 95 4e 3e 61 e9 5c 49 bb 8b 53 3e c8 bd 9d a1 b7 66 69 19 9c a8 05 b3 fa d6 2e a1 72 d6 5f 69 b3 99 c3 07 7d cb b7 e6 eb db 35 d0 7d b2 17 d4 19 0c 61 56 20 46 3d fa 57 21 ad a4 82 ed a4 0b 85 07 19 ad 60 9b 7a 82 12 df ed d6 d3 2b db 44 06 e1 c7 bd 6d 2d cc 23 4b 89 ee 64 47 96 31 fb dd c7 05 4d 63 69 fa ac e9 20 64 51 20 41 8c 1a 7d 8d 82 ea f7 b3 bc d2 32 46 1b 74 c3 6f 15 a4 92 1d 8b 77 57 a8 b6 9b e0 6d ee c3 e7 00 64 7e 15 cd c8 ca a3 cc 27 e6 63 f7 6b ab bd b3 b4 b6 b4 6b 58 98 e1 0e 55 b6 f5 15 cd dd 5a 36 d0 e6 32 57 b1 a7 Data Ascii: OC?hW0no\TFB8Q-Uv04{e1s[yn+pV<9i%tN>a\IS>fi.r_i}5}aV F=W!`z+Dm-#KdG1Mci dQ A}2FtowWmd~'ckkXUZ62W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
172	192.168.2.5	49909	64.233.185.138	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:44 UTC	616	OUT	HEAD / HTTP/1.1 Host: www3.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:44 UTC	474	IN	HTTP/1.1 301 Moved Permanently Location: https://marketingplatform.google.com/about/enterprise/ Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Server: sffe Content-Length: 251 X-XSS-Protection: 0 Date: Thu, 08 Feb 2024 18:14:42 GMT Expires: Thu, 08 Feb 2024 18:44:42 GMT Cache-Control: public, max-age=1800 Content-Type: text/html; charset=UTF-8 Age: 1262 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
173	192.168.2.5	49910	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:44 UTC	2390	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 351 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNzQxNzMzMSwiZXhwIjoxNzA3NTAzNzMxfQ.FEIVHt_geecKbDx83EB0dlYHQMkXSYfLIM-3srS_0UjPxnecQjdJhC9-gxV_INNKE6waBeWBkxYx8xeq68HlVA x-booking-et-serialized-state: EFB4182z3JoJxbpLmYz6l9XMO8uwQw5vy57VA6rLJax-JW2gEd2Ycalwc-8XMLrKv x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: e4de82b919b800e4 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhAD4WLlocJITBMa3rDvM%2FTul1zrgyV20Oep4%2ByzvFe9TEP4%2FCO7SWdV4nDvU%2BPb6T8tysYngKSx198oV9JBFKQ14%2FRJ75raZDQGoIW6X8k3KrgZ8J43VSKpt36%2FaOYflD1Q6oFd0cBFlEO2ZPIWEaSdI7bMOXiUsqw%3D; lastSeen=0
2024-02-08 18:35:44 UTC	351	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 5f 73 74 61 67 65 22 3a 22 61 64 5f 73 6c 6f 74 5f 63 72 65 61 74 65 64 22 2c 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 55 4e 4b 4e 4f 57 4e 22 2c 22 73 69 74 65 5f 74 79 70 65 22 3a 22 57 57 57 22 2c 22 76 69 73 69 74 6f 72 5f 63 63 22 3a 22 75 73 22 2c 22 61 64 5f 70 6f 73 69 74 69 6f 6e 22 3a 22 49 4e 44 45 58 5f 50 52 49 4d 41 52 59 22 2c 22 70 61 67 65 6e 61 6d 65 22 3a 22 49 4e 44 45 58 22 2c 22 76 65 72 74 69 63 61 6c 22 3a 22 41 43 43 4f 4d 4d 4f 44 41 54 49 4f 4e 53 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 6d 75 74 Data Ascii: {"operationName":"trackAdStatus","variables":{"input":{"action_stage":"ad_slot_created","campaign_id":"UNKNOWN","site_type":"WWW","visitor_cc":"us","ad_position":"INDEX_PRIMARY","pagename":"INDEX","vertical":"ACCOMMODATIONS"}},"extensions":{},"query":"mut
2024-02-08 18:35:45 UTC	1103	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 361 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:44 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPeevHWoZ%2F%2FjOKFTactHcaOGLQqwZxWw9XkuvzQmkWU68cphdhF%2FUlxQ3u%2BInN%2FIbrF6AY7vtEIFDPIeUNIBXYGGUtQkoQXzGfabMLMMtvxZcK099Jkm3O7%2F6cisw9XIbw%2BOC8Xy7dlgDyq%2FPMSvgCikSFTNnjbiwRyE%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:44 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=636582c097b80122&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGWiGtlbbkvzb914rUiOnELyjPZdBDs0e6Q x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7db19e3781edb64ef4f7023d2c25783e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Pwlmae-my_9GHbiEdDhIUz0D3VSEXnAtAvKh8tpKvU6RiH-8T6HfCQ==
2024-02-08 18:35:45 UTC	361	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 3a 7b 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 65 78 74 65 6e 73 69 6f 6e 44 65 66 69 6e 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 61 6c 6c 41 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 63 68 69 6c 64 72 65 6e 57 69 74 68 54 79 70 65 52 65 66 65 72 65 6e 63 65 73 22 3a 7b 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 7d 2c 22 63 68 69 6c 64 72 65 6e 41 73 4c 69 73 74 22 3a 5b 5d 2c 22 65 6d 70 74 79 22 3a 66 61 6c 73 65 7d 2c 22 63 68 69 6c 64 72 65 6e 22 3a 5b 5d 2c 22 Data Ascii: {"data":{"trackAdStatus":{"appliedDirectives":[],"extensionDefinitions":[],"directives":[],"allAppliedDirectivesByName":{},"childrenWithTypeReferences":{"children":{"appliedDirectives":[],"directives":[]},"childrenAsList":[],"empty":false},"children":[],"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
174	192.168.2.5	49913	142.250.105.105	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:44 UTC	390	OUT	GET /.well-known/web-identity HTTP/1.1 Host: www.google.com Connection: keep-alive Accept: application/json Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: webidentity User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:44 UTC	651	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: application/json Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 78 Date: Thu, 08 Feb 2024 18:35:44 GMT Expires: Fri, 09 Feb 2024 18:35:44 GMT Cache-Control: public, max-age=86400 Last-Modified: Fri, 23 Jun 2023 19:00:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:44 UTC	78	IN	Data Raw: 7b 0a 20 20 22 70 72 6f 76 69 64 65 72 5f 75 72 6c 73 22 3a 20 5b 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2e 6a 73 6f 6e 22 0a 20 20 5d 0a 7d 0a Data Ascii: { "provider_urls": [ "https://accounts.google.com/gsi/fedcm.json" ]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
175	192.168.2.5	49911	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:44 UTC	2492	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 6889 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNzQxNzMzMSwiZXhwIjoxNzA3NTAzNzMxfQ.FEIVHt_geecKbDx83EB0dlYHQMkXSYfLIM-3srS_0UjPxnecQjdJhC9-gxV_INNKE6waBeWBkxYx8xeq68HlVA x-booking-et-serialized-state: EFB4182z3JoJxbpLmYz6l9XMO8uwQw5vy57VA6rLJax-JW2gEd2Ycalwc-8XMLrKv x-booking-site-type-id: 1 x-booking-pageview-id: e4de82b919b800e4 x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhAD4WLlocJITBMa3rDvM%2FTul1zrgyV20Oep4%2ByzvFe9TEP4%2FCO7SWdV4nDvU%2BPb6T8tysYngKSx198oV9JBFKQ14%2FRJ75raZDQGoIW6X8k3KrgZ8J43VSKpt36%2FaOYflD1Q6oFd0cBFlEO2ZPIWEaSdI7bMOXiUsqw%3D; lastSeen=0
2024-02-08 18:35:44 UTC	6889	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 4d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6d 61 67 65 57 69 64 74 68 22 3a 33 32 30 2c 22 69 6d 61 67 65 48 65 69 67 68 74 22 3a 34 30 30 2c 22 69 6e 70 75 74 22 3a 7b 22 74 65 73 74 43 61 6d 70 61 69 67 6e 49 64 73 22 3a 5b 5d 2c 22 63 61 6d 70 61 69 67 6e 49 64 73 22 3a 5b 22 64 65 38 37 30 65 33 61 2d 62 61 39 31 2d 34 36 30 35 2d 39 62 62 31 2d 36 31 65 61 64 31 61 66 63 36 38 34 22 5d 2c 22 63 61 72 6f 75 73 65 6c 49 6e 70 75 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 49 6e 70 75 74 22 3a 5b 7b 22 63 61 6d 70 61 69 67 6e 49 64 22 3a 22 64 65 38 37 30 65 33 61 2d 62 61 39 31 2d 34 36 30 35 2d 39 62 62 31 2d 36 31 65 61 64 31 61 66 63 36 Data Ascii: {"operationName":"MerchComponentsData","variables":{"imageWidth":320,"imageHeight":400,"input":{"testCampaignIds":[],"campaignIds":["de870e3a-ba91-4605-9bb1-61ead1afc684"],"carouselInput":{"campaignInput":[{"campaignId":"de870e3a-ba91-4605-9bb1-61ead1afc6
2024-02-08 18:35:45 UTC	1101	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 16332 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:45 GMT vary: Accept-Encoding, User-Agent set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2BI6h0LLlJfr4uEPODOppbFCV6Th8ROLIHCxxR34ODjqh9FeK%2B5WwxxW%2BXBiWehITLmwPt4eyEFq2SVOwaC2%2FReJiu846DJCGilmlNtxv2P43hLAQDIRlCu6XIGNC%2Bh1Nc15nZTRtXlXUNra0gS515qF2snrbxj%2BGg%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:45 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=3c3982c05aee012e&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGbU0cDFlnHkTi8L4aBxtj-w8ow2cRWrm5A x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 14e4300e15854895259e6944bb121ec8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: x6XQiVGNded4nDUHID6XVGoPtHDpHzqK_mgyXqQ0KONAq-c0WDrUZw==
2024-02-08 18:35:45 UTC	15283	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 6d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 22 3a 7b 22 63 6f 6d 70 6f 6e 65 6e 74 73 22 3a 5b 7b 22 73 75 62 48 65 61 64 69 6e 67 22 3a 6e 75 6c 6c 2c 22 64 65 73 69 67 6e 56 61 72 69 61 6e 74 22 3a 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 44 65 73 6b 74 6f 70 43 61 72 6f 75 73 65 6c 53 74 61 63 6b 65 64 43 61 72 64 73 22 2c 22 73 75 62 48 65 61 64 69 6e 67 22 3a 6e 75 6c 6c 2c 22 63 61 72 6f 75 73 65 6c 4c 61 79 6f 75 74 22 3a 22 44 45 53 4b 54 4f 50 5f 4d 45 44 49 55 4d 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 6d 61 67 65 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 72 2d 78 78 2e 62 73 74 61 74 69 63 2e 63 6f 6d 2f 78 64 61 74 61 2f 69 6d 61 67 65 73 2f 78 70 68 6f 74 6f 2f 33 32 30 78 34 30 30 Data Ascii: {"data":{"merchComponentsData":{"components":[{"subHeading":null,"designVariant":{"__typename":"DesktopCarouselStackedCards","subHeading":null,"carouselLayout":"DESKTOP_MEDIUM","items":[{"image":{"url":"https://r-xx.bstatic.com/xdata/images/xphoto/320x400
2024-02-08 18:35:45 UTC	1049	IN	Data Raw: 72 6f 75 73 65 6c 49 74 65 6d 49 6d 61 67 65 22 7d 2c 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 4d 65 72 63 68 43 61 72 6f 75 73 65 6c 53 74 61 63 6b 65 64 49 74 65 6d 22 2c 22 65 78 74 72 61 53 75 62 74 69 74 6c 65 22 3a 22 22 7d 2c 7b 22 70 72 69 63 65 22 3a 6e 75 6c 6c 2c 22 74 69 74 6c 65 22 3a 22 54 69 6e 79 20 68 6f 75 73 65 73 22 2c 22 66 69 6c 74 65 72 73 22 3a 6e 75 6c 6c 2c 22 73 75 62 74 69 74 6c 65 22 3a 22 22 2c 22 69 74 65 6d 49 64 22 3a 22 30 66 35 33 32 35 38 31 2d 64 30 36 66 2d 34 66 36 31 2d 39 66 65 36 2d 32 37 33 39 61 33 32 64 66 32 63 37 22 2c 22 72 65 76 69 65 77 53 63 6f 72 65 22 3a 6e 75 6c 6c 2c 22 69 6d 61 67 65 22 3a 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 72 2d 78 78 2e 62 73 74 61 74 69 63 2e 63 6f 6d 2f 78 64 61 74 Data Ascii: rouselItemImage"},"__typename":"MerchCarouselStackedItem","extraSubtitle":""},{"price":null,"title":"Tiny houses","filters":null,"subtitle":"","itemId":"0f532581-d06f-4f61-9fe6-2739a32df2c7","reviewScore":null,"image":{"url":"https://r-xx.bstatic.com/xdat

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
176	192.168.2.5	49912	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:44 UTC	2492	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 6889 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNzQxNzMzMSwiZXhwIjoxNzA3NTAzNzMxfQ.FEIVHt_geecKbDx83EB0dlYHQMkXSYfLIM-3srS_0UjPxnecQjdJhC9-gxV_INNKE6waBeWBkxYx8xeq68HlVA x-booking-et-serialized-state: EFB4182z3JoJxbpLmYz6l9XMO8uwQw5vy57VA6rLJax-JW2gEd2Ycalwc-8XMLrKv x-booking-site-type-id: 1 x-booking-pageview-id: e4de82b919b800e4 x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhAD4WLlocJITBMa3rDvM%2FTul1zrgyV20Oep4%2ByzvFe9TEP4%2FCO7SWdV4nDvU%2BPb6T8tysYngKSx198oV9JBFKQ14%2FRJ75raZDQGoIW6X8k3KrgZ8J43VSKpt36%2FaOYflD1Q6oFd0cBFlEO2ZPIWEaSdI7bMOXiUsqw%3D; lastSeen=0
2024-02-08 18:35:44 UTC	6889	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 4d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6d 61 67 65 57 69 64 74 68 22 3a 33 32 30 2c 22 69 6d 61 67 65 48 65 69 67 68 74 22 3a 34 30 30 2c 22 69 6e 70 75 74 22 3a 7b 22 74 65 73 74 43 61 6d 70 61 69 67 6e 49 64 73 22 3a 5b 5d 2c 22 63 61 6d 70 61 69 67 6e 49 64 73 22 3a 5b 22 32 35 33 31 32 61 36 65 2d 34 66 61 32 2d 34 61 65 61 2d 39 31 64 34 2d 64 39 64 66 32 35 63 33 32 63 61 64 22 5d 2c 22 63 61 72 6f 75 73 65 6c 49 6e 70 75 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 49 6e 70 75 74 22 3a 5b 7b 22 63 61 6d 70 61 69 67 6e 49 64 22 3a 22 32 35 33 31 32 61 36 65 2d 34 66 61 32 2d 34 61 65 61 2d 39 31 64 34 2d 64 39 64 66 32 35 63 33 32 63 Data Ascii: {"operationName":"MerchComponentsData","variables":{"imageWidth":320,"imageHeight":400,"input":{"testCampaignIds":[],"campaignIds":["25312a6e-4fa2-4aea-91d4-d9df25c32cad"],"carouselInput":{"campaignInput":[{"campaignId":"25312a6e-4fa2-4aea-91d4-d9df25c32c
2024-02-08 18:35:45 UTC	1100	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 8061 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:45 GMT vary: Accept-Encoding, User-Agent set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3WIkHcy0cldEpzO0rptx4CgRHn8k7lER%2BvXPMWns6VxRxgKuRWwf37vVkS0951y1S1nRz0Ea86xvkrQLOKlpztRPAZHnLUaq%2Fz7flF1ZcmfZm5%2BuuHcYae5Ii7scwH7FStSZ6DIrOG0JyKVCqbANF%2FI2lGPqAbk%2Bgs%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:45 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=067382c09b1602b6&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGQKl70s-AyLnVNhT7mlndQ52bP789cRe8w x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 8415794d557292780ff382a8c5bd6058.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: bY2DQA3S2-wYxhT57sGXvkbVKXaSzIZeLwge7y2r_72GKTwEbI1lZA==
2024-02-08 18:35:45 UTC	8061	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 6d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 22 3a 7b 22 63 6f 6d 70 6f 6e 65 6e 74 73 22 3a 5b 7b 22 64 65 73 69 67 6e 56 61 72 69 61 6e 74 22 3a 7b 22 69 74 65 6d 73 22 3a 5b 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 4d 65 72 63 68 43 61 72 6f 75 73 65 6c 53 74 61 63 6b 65 64 49 74 65 6d 22 2c 22 69 74 65 6d 49 64 22 3a 22 32 30 30 37 39 31 31 30 22 2c 22 74 69 74 6c 65 22 3a 22 4c 61 73 20 56 65 67 61 73 22 2c 22 65 78 74 72 61 53 75 62 74 69 74 6c 65 22 3a 6e 75 6c 6c 2c 22 66 69 6c 74 65 72 73 22 3a 6e 75 6c 6c 2c 22 74 61 72 67 65 74 4c 61 6e 64 69 6e 67 22 3a 7b 22 63 68 69 6c 64 72 65 6e 41 67 65 73 22 3a 5b 5d 2c 22 64 65 73 74 54 79 70 65 22 3a 22 43 49 54 59 22 2c 22 63 68 65 63 6b 69 6e 22 3a 6e 75 Data Ascii: {"data":{"merchComponentsData":{"components":[{"designVariant":{"items":[{"__typename":"MerchCarouselStackedItem","itemId":"20079110","title":"Las Vegas","extraSubtitle":null,"filters":null,"targetLanding":{"childrenAges":[],"destType":"CITY","checkin":nu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
177	192.168.2.5	49917	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:44 UTC	1605	OUT	GET /sendlayoutevents HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=1707417341870; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhAD4WLlocJITBMa3rDvM%2FTul1zrgyV20Oep4%2ByzvFe9TEP4%2FCO7SWdV4nDvU%2BPb6T8tysYngKSx198oV9JBFKQ14%2FRJ75raZDQGoIW6X8k3KrgZ8J43VSKpt36%2FaOYflD1Q6oFd0cBFlEO2ZPIWEaSdI7bMOXiUsqw%3D
2024-02-08 18:35:45 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:45 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=4dfa82c0bf7402b0&e=UmFuZG9tSVYkc2RlIyh9YReXsVhv1rQKB4Zv_9za_vc9BNbucbf7i3K3-NAcEzU9JDCqhkRbWSc x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 3f95374273631adbfd8e0d0a9f6d7b64.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 3cg_5Br8G_dQmdxk-tzG9iOh26sS6z9Hq5uTN_r3-1HoMpPKJ-t0JA==
2024-02-08 18:35:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
178	192.168.2.5	49916	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:44 UTC	627	OUT	GET /design-assets/assets/v3.109.0/images-flags/Us@3x.png HTTP/1.1 Host: t-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:45 UTC	532	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 950 Connection: close Last-Modified: Tue, 05 Dec 2023 13:24:05 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 12:02:50 GMT ETag: "025b409525836b9e0913038b2556d2cf" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 fcb94596db202c75ac0e559b3183be72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: P8TqN17zsk62iilJXU03Hr8ifFkG7pjllyefqY_6JGIHaR8AXPO7Qw== Age: 23575 Vary: Origin
2024-02-08 18:35:45 UTC	950	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 48 00 00 00 48 08 03 00 00 00 62 33 43 75 00 00 00 54 50 4c 54 45 19 2f 5d d1 77 7c cb 68 6d 3e 50 77 e0 a2 a6 d9 8d 91 21 37 63 ff ff ff bd 3d 44 c4 51 58 56 49 69 2b 3f 69 69 78 96 89 95 ac 59 68 8a 4a 5c 80 35 48 70 7a 87 a2 9d a6 ba e3 e6 ec d0 d5 de b0 b8 c8 bf c5 d2 32 31 59 d3 7d 82 e8 bd bf c9 62 67 f4 f5 f7 9d dd 5e 75 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 03 08 49 44 41 54 78 9c ed 56 d9 72 dc 20 10 9c 04 07 d6 e1 3e 37 09 ff ff 9f 29 98 19 d9 96 8d 94 b8 f4 e4 da ae 7d e8 5a a1 d6 d0 f4 00 00 9f c2 fd b6 c7 fc 5b f3 f3 f7 04 e4 87 cf 16 42 89 47 db 40 24 7a 22 ce 10 09 96 85 ea 4a 48 37 95 e7 7b b2 aa ec 26 b1 bd 47 14 ec 1d 05 4c 56 75 7e 4e 14 55 c4 a2 22 Data Ascii: PNGIHDRHHb3CuTPLTE/]w\|hm>Pw!7c=DQXVIi+?iixYhJ\5Hpz21Y}bg^upHYsIDATxVr >7)}Z[BG@$z"JH7{&GLVu~NU"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
179	192.168.2.5	49918	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:44 UTC	636	OUT	GET /static/img/favicon/9ca83ba2a5a3293ff07452cb24949a5843af4592.svg HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:45 UTC	797	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-Length: 1197 Connection: close Server: nginx Date: Tue, 23 Jan 2024 15:54:49 GMT Last-Modified: Tue, 21 Mar 2023 13:15:52 GMT ETag: "6419ae08-4ad" Expires: Thu, 22 Feb 2024 15:54:49 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 ea0f86c249e022d5015ce79f54e723d0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: YH9nE5x0GLL0iICLJyledFPLPD_k3sSMPdOdp5uStRucndJSSv-2mQ== Age: 1392055
2024-02-08 18:35:45 UTC	1197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0a 3c 21 2d 2d 20 4c 6f 76 69 6e 67 6c 79 20 65 78 70 6f 72 74 65 64 20 62 79 20 4a 65 73 73 20 53 74 75 62 65 6e 62 6f 72 64 20 66 6f 72 20 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 69 6e 20 41 6d 73 74 65 72 64 61 6d 20 31 36 2d 30 33 2d 32 30 32 33 20 2d 2d 3e 0a 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 69 64 3d 22 62 64 6f 74 2d 66 61 76 69 63 6f 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 78 3d 22 30 70 78 22 20 79 3d 22 30 70 78 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?>... Lovingly exported by Jess Stubenbord for Booking.com in Amsterdam 16-03-2023 --><svg version="1.1" id="bdot-favicon" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
180	192.168.2.5	49915	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:44 UTC	3378	OUT	GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=e4de82b919b800e4&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|4,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|2,cCHObKdBdUHINPSXeHDALOLOLMO\|5,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-ET-Serialized-State: EFB4182z3JoJxbpLmYz6l9XMO8uwQw5vy57VA6rLJax-JW2gEd2Ycalwc-8XMLrKv X-Booking-Language-Code: en-us X-Booking-Client-Info: sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: e4de82b919b800e4 X-Booking-Info: X-Booking-SiteType-Id: 1 X-Booking-Session-Id: db6e5bbb32eac0e80cfcae9b22f5390d sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhAD4WLlocJITBMa3rDvM%2FTul1zrgyV20Oep4%2ByzvFe9TEP4%2FCO7SWdV4nDvU%2BPb6T8tysYngKSx198oV9JBFKQ14%2FRJ75raZDQGoIW6X8k3KrgZ8J43VSKpt36%2FaOYflD1Q6oFd0cBFlEO2ZPIWEaSdI7bMOXiUsqw%3D; lastSeen=0
2024-02-08 18:35:45 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:45 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=a9d582c0b46300df&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejJmEO8yZqwjWJTHwVR-_9sFMpBprP2dsN8 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 34411558fb3a23efdbbaaddb8a12b574.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: CTKS1OMRy06C0w6QSvxljhEj3v8RKImVsLRaoB1OgfYCm5q1IV-5wQ==
2024-02-08 18:35:45 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
181	192.168.2.5	49919	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:45 UTC	2390	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 423 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNzQxNzMzMSwiZXhwIjoxNzA3NTAzNzMxfQ.FEIVHt_geecKbDx83EB0dlYHQMkXSYfLIM-3srS_0UjPxnecQjdJhC9-gxV_INNKE6waBeWBkxYx8xeq68HlVA x-booking-et-serialized-state: EFB4182z3JoJxbpLmYz6l9XMO8uwQw5vy57VA6rLJax-JW2gEd2Ycalwc-8XMLrKv x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: e4de82b919b800e4 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhAD4WLlocJITBMa3rDvM%2FTul1zrgyV20Oep4%2ByzvFe9TEP4%2FCO7SWdV4nDvU%2BPb6T8tysYngKSx198oV9JBFKQ14%2FRJ75raZDQGoIW6X8k3KrgZ8J43VSKpt36%2FaOYflD1Q6oFd0cBFlEO2ZPIWEaSdI7bMOXiUsqw%3D; lastSeen=0
2024-02-08 18:35:45 UTC	423	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 47 65 6e 69 75 73 53 69 67 6e 49 6e 53 68 65 65 74 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 50 61 67 65 22 3a 22 69 6e 64 65 78 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 47 65 6e 69 75 73 53 69 67 6e 49 6e 53 68 65 65 74 28 24 69 6e 70 75 74 3a 20 47 65 6e 69 75 73 53 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 49 6e 70 75 74 21 29 20 7b 5c 6e 20 20 67 65 6e 69 75 73 47 75 65 73 74 44 61 74 61 20 7b 5c 6e 20 20 20 20 73 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 28 69 6e 70 75 74 3a 20 24 69 6e 70 75 74 29 20 7b 5c 6e 20 20 20 20 20 20 74 69 74 6c 65 5c 6e 20 20 20 20 20 20 73 75 Data Ascii: {"operationName":"GeniusSignInSheet","variables":{"input":{"actionPage":"index"}},"extensions":{},"query":"query GeniusSignInSheet($input: GeniusSignInBottomSheetInput!) {\n geniusGuestData {\n signInBottomSheet(input: $input) {\n title\n su
2024-02-08 18:35:45 UTC	1091	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 368 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:45 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3Uq9DXdX8vdlIEhNyH3Rmb4T9WfcYQ7JyyEuyTAr6aAQcA6rwqqM2AT4kx%2BfDXSA2826XpOYVjTU7jYRuUILVrfcjfhNwffPmiTjZMUUA0THR7HNYJhVbDeMyd5aq46LTsVkPj4W1IVEGOpmOGmYUrtlkvBiFthACI%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:45 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=c82482c0387101cf&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGT-IQVGx23_JpTNBIe0bdDOXYoVjqMXNbQ x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 5988b4ae4648c0fec3c60a3cca580092.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: XSKxelTgqgrXpmtQ76uOSoMt4vDTccQJ0Onwj9RbRBDUs7JkcGQUWw==
2024-02-08 18:35:45 UTC	368	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 67 65 6e 69 75 73 47 75 65 73 74 44 61 74 61 22 3a 7b 22 73 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 22 3a 7b 22 73 69 67 6e 49 6e 43 74 61 22 3a 7b 22 74 69 74 6c 65 22 3a 22 53 69 67 6e 20 69 6e 20 6f 72 20 72 65 67 69 73 74 65 72 22 2c 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 47 65 6e 69 75 73 41 63 74 69 6f 6e 22 7d 2c 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 47 65 6e 69 75 73 53 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 22 2c 22 74 69 74 6c 65 22 3a 22 53 69 67 6e 20 69 6e 2c 20 73 61 76 65 20 6d 6f 6e 65 79 22 2c 22 73 75 62 74 69 74 6c 65 22 3a 5b 22 53 69 67 6e 20 69 6e 20 74 6f 20 5b 73 74 61 72 74 5f 62 6f 6c 64 5d 73 61 76 65 20 31 30 25 20 6f 72 20 6d 6f 72 65 5b 65 6e 64 5f 62 6f 6c 64 5d 20 77 69 Data Ascii: {"data":{"geniusGuestData":{"signInBottomSheet":{"signInCta":{"title":"Sign in or register","__typename":"GeniusAction"},"__typename":"GeniusSignInBottomSheet","title":"Sign in, save money","subtitle":["Sign in to [start_bold]save 10% or more[end_bold] wi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
182	192.168.2.5	49922	74.125.136.132	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:45 UTC	859	OUT	GET /safeframe/1-0-40/html/container.html HTTP/1.1 Host: 6187c7943c8809a450d5ea0d812d35d9.safeframe.googlesyndication.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:45 UTC	707	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/html Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="ads-gpt-scs" Report-To: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} Timing-Allow-Origin: * Content-Length: 6162 Date: Thu, 08 Feb 2024 18:35:45 GMT Expires: Fri, 07 Feb 2025 18:35:45 GMT Cache-Control: public, immutable, max-age=31536000 Last-Modified: Thu, 03 Nov 2022 19:10:08 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:45 UTC	545	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 61 66 65 46 72 61 6d 65 20 43 6f 6e 74 61 69 6e 65 72 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 68 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7d 3b 76 61 72 20 6e 3d 66 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="UTF-8"> <title>SafeFrame Container</title> <script>(function(){/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0*/var f=this\|\|self,h=function(a){return a};var n=f
2024-02-08 18:35:45 UTC	1252	IN	Data Raw: 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 67 6f 6f 67 23 68 74 6d 6c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 68 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 68 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 68 7d 29 7d 63 61 74 63 68 28 63 29 7b 66 2e 63 6f 6e 73 6f 6c 65 26 26 66 2e 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 63 2e 6d 65 73 73 61 67 65 29 7d 74 3d 61 7d 65 6c 73 65 20 74 3d 61 7d 72 65 74 75 72 6e 20 74 7d 3b 76 61 72 20 63 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 67 3d 62 61 3d 3d 3d 62 61 3f 61 3a 22 22 7d 3b 63 61 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 67 2b 22 22 7d 3b 76 61 72 20 62 61 3d 7b 7d 2c 64 61 3d 66 75 6e 63 74 69 Data Ascii: .createPolicy("goog#html",{createHTML:h,createScript:h,createScriptURL:h})}catch(c){f.console&&f.console.error(c.message)}t=a}else t=a}return t};var ca=function(a){this.g=ba===ba?a:""};ca.prototype.toString=function(){return this.g+""};var ba={},da=functi
2024-02-08 18:35:45 UTC	1252	IN	Data Raw: 74 68 69 73 2e 69 3d 22 26 22 3b 74 68 69 73 2e 68 3d 7b 7d 3b 74 68 69 73 2e 6f 3d 30 3b 74 68 69 73 2e 67 3d 5b 5d 7d 2c 7a 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 7b 7d 3b 63 5b 61 5d 3d 62 3b 72 65 74 75 72 6e 5b 63 5d 7d 2c 71 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 29 7b 76 61 72 20 6b 3d 5b 5d 3b 6a 61 28 61 2c 66 75 6e 63 74 69 6f 6e 28 67 2c 41 29 7b 28 67 3d 70 61 28 67 2c 62 2c 63 2c 64 2c 65 29 29 26 26 6b 2e 70 75 73 68 28 41 2b 22 3d 22 2b 67 29 7d 29 3b 72 65 74 75 72 6e 20 6b 2e 6a 6f 69 6e 28 62 29 7d 2c 70 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 29 7b 69 66 28 6e 75 6c 6c 3d 3d 61 29 72 65 74 75 72 6e 22 22 3b 62 3d 62 7c 7c 22 26 22 3b 63 3d 63 7c 7c 22 2c 24 22 3b 22 73 74 Data Ascii: this.i="&";this.h={};this.o=0;this.g=[]},z=function(a,b){var c={};c[a]=b;return[c]},qa=function(a,b,c,d,e){var k=[];ja(a,function(g,A){(g=pa(g,b,c,d,e))&&k.push(A+"="+g)});return k.join(b)},pa=function(a,b,c,d,e){if(null==a)return"";b=b\|\|"&";c=c\|\|",$";"st
2024-02-08 18:35:45 UTC	1252	IN	Data Raw: 28 29 3b 61 2e 6e 61 6d 65 26 26 2d 31 3d 3d 62 2e 69 6e 64 65 78 4f 66 28 61 2e 6e 61 6d 65 29 26 26 28 62 2b 3d 22 3a 20 22 2b 61 2e 6e 61 6d 65 29 3b 61 2e 6d 65 73 73 61 67 65 26 26 2d 31 3d 3d 62 2e 69 6e 64 65 78 4f 66 28 61 2e 6d 65 73 73 61 67 65 29 26 26 28 62 2b 3d 22 3a 20 22 2b 61 2e 6d 65 73 73 61 67 65 29 3b 69 66 28 61 2e 73 74 61 63 6b 29 7b 61 3d 61 2e 73 74 61 63 6b 3b 76 61 72 20 63 3d 62 3b 74 72 79 7b 2d 31 3d 3d 61 2e 69 6e 64 65 78 4f 66 28 63 29 26 26 28 61 3d 63 2b 22 5c 6e 22 2b 61 29 3b 66 6f 72 28 76 61 72 20 64 3b 61 21 3d 64 3b 29 64 3d 61 2c 61 3d 61 2e 72 65 70 6c 61 63 65 28 52 65 67 45 78 70 28 22 28 28 68 74 74 70 73 3f 3a 2f 2e 2e 2a 2f 29 5b 5e 2f 3a 5d 2a 3a 5c 5c 64 2b 28 3f 3a 2e 7c 5c 6e 29 2a 29 5c 5c 32 22 29 2c Data Ascii: ();a.name&&-1==b.indexOf(a.name)&&(b+=": "+a.name);a.message&&-1==b.indexOf(a.message)&&(b+=": "+a.message);if(a.stack){a=a.stack;var c=b;try{-1==a.indexOf(c)&&(a=c+"\n"+a);for(var d;a!=d;)d=a,a=a.replace(RegExp("((https?:/../)[^/:]:\\d+(?:.\|\n)*)\\2"),
2024-02-08 18:35:45 UTC	1252	IN	Data Raw: 5b 32 5d 2c 45 3d 43 5b 33 5d 3b 69 66 28 44 3e 45 2e 6c 65 6e 67 74 68 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 50 61 72 73 65 64 20 63 6f 6e 74 65 6e 74 20 73 69 7a 65 20 64 6f 65 73 6e 27 74 20 6d 61 74 63 68 2e 20 22 2b 44 2b 22 3a 22 2b 45 2e 6c 65 6e 67 74 68 29 3b 42 3d 7b 6d 3a 43 5b 31 5d 2c 63 6f 6e 74 65 6e 74 3a 45 2e 73 75 62 73 74 72 28 30 2c 44 29 2c 6c 3a 45 2e 73 75 62 73 74 72 28 44 29 7d 3b 76 61 72 20 46 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 42 2e 6c 29 3b 77 69 6e 64 6f 77 2e 6e 61 6d 65 3d 22 22 3b 76 61 72 20 42 61 3d 42 2e 63 6f 6e 74 65 6e 74 3b 46 2e 67 6f 6f 67 5f 73 61 66 65 66 72 61 6d 65 5f 68 6c 74 26 26 28 66 2e 67 6f 6f 67 5f 73 61 66 65 66 72 61 6d 65 5f 68 6c 74 3d 46 2e 67 6f 6f 67 5f 73 61 66 65 66 72 61 6d 65 5f 68 6c Data Ascii: [2],E=C[3];if(D>E.length)throw Error("Parsed content size doesn't match. "+D+":"+E.length);B={m:C[1],content:E.substr(0,D),l:E.substr(D)};var F=JSON.parse(B.l);window.name="";var Ba=B.content;F.goog_safeframe_hlt&&(f.goog_safeframe_hlt=F.goog_safeframe_hl
2024-02-08 18:35:45 UTC	609	IN	Data Raw: 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2c 21 31 29 2c 46 61 3d 6e 75 6c 6c 2c 55 3d 4b 2e 6c 65 6e 67 74 68 2d 31 2c 56 3d 55 3b 30 3c 3d 56 3b 2d 2d 56 29 7b 76 61 72 20 57 3d 4b 5b 56 5d 3b 21 46 61 26 26 6b 61 2e 74 65 73 74 28 57 2e 75 72 6c 29 26 26 28 46 61 3d 57 29 3b 69 66 28 57 2e 75 72 6c 26 26 21 57 2e 6a 29 7b 78 3d 57 3b 62 72 65 61 6b 7d 7d 76 61 72 20 6c 61 3d 6e 75 6c 6c 2c 47 61 3d 4b 2e 6c 65 6e 67 74 68 26 26 4b 5b 55 5d 2e 75 72 6c 3b 30 21 3d 78 2e 64 65 70 74 68 26 26 47 61 26 26 28 6c 61 3d 4b 5b 55 5d 29 3b 48 3d 6e 65 77 20 6d 61 3b 69 66 28 48 2e 68 29 7b 76 61 72 20 48 61 3d 48 2e 68 2e 75 72 6c 7c 7c 22 22 3b 49 2e 67 2e 70 75 73 68 28 34 29 3b 49 2e 68 5b 34 5d 3d 7a 28 22 74 6f 70 22 2c 48 61 29 7d 76 61 72 20 49 61 3d 7b Data Ascii: .location.href,!1),Fa=null,U=K.length-1,V=U;0<=V;--V){var W=K[V];!Fa&&ka.test(W.url)&&(Fa=W);if(W.url&&!W.j){x=W;break}}var la=null,Ga=K.length&&K[U].url;0!=x.depth&&Ga&&(la=K[U]);H=new ma;if(H.h){var Ha=H.h.url\|\|"";I.g.push(4);I.h[4]=z("top",Ha)}var Ia={

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
183	192.168.2.5	49923	18.165.98.45	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:45 UTC	569	OUT	GET /d8c14d4960ca/a18a4859af9c/challenge.js HTTP/1.1 Host: d8c14d4960ca.edge.sdk.awswaf.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:45 UTC	614	IN	HTTP/1.1 307 Temporary Redirect Server: CloudFront Date: Thu, 08 Feb 2024 18:35:45 GMT Content-Length: 0 Connection: close Access-Control-Allow-Headers: * Access-Control-Allow-Methods: * Access-Control-Allow-Origin: * Access-Control-Max-Age: 86400 Cache-Control: max-age=86400 Location: https://d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com/d8c14d4960ca/a18a4859af9c/challenge.js X-Cache: FunctionGeneratedResponse from cloudfront Via: 1.1 27dc27c157f4b42ae253527f76742be4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P4 X-Amz-Cf-Id: D95KlS3y5hg2sfQnzhQWvJo_qwikpXS5lqCuoNfySSThKJjnp_omlg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
184	192.168.2.5	49924	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:45 UTC	750	OUT	GET /static/js/searchresults_slick_cloudfront_sd/528359eb9f21194adf8c26f81e07c6eb21a2cc89.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Purpose: prefetch Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:45 UTC	807	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 36716 Connection: close Server: nginx Date: Thu, 01 Feb 2024 08:51:11 GMT Last-Modified: Tue, 04 Feb 2020 10:19:58 GMT ETag: "5e39454e-8f6c" Expires: Sat, 02 Mar 2024 08:51:11 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 d125bf8405e840aa51a88ae3d8d91fb2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: B06tgFqEH8n-emiS8E_Ft_zAo37Au9xio0ivZWD4esP1XHVCBZkjGg== Age: 639874
2024-02-08 18:35:45 UTC	15577	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 69 29 7b 72 65 74 75 72 6e 20 69 7d 3b 21 66 75 6e 63 74 69 6f 6e 28 69 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 5f 69 5f 28 22 30 33 39 62 3a 63 39 37 30 64 36 63 38 22 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 6e 65 2e 61 6d 64 3f 64 65 66 69 6e 65 28 5b 22 6a 71 75 65 72 79 22 5d 2c 69 29 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 69 28 72 65 71 75 69 72 65 28 22 6a 71 75 65 72 79 22 29 29 3a 69 28 6a 51 75 65 72 79 29 2c 5f 72 5f 28 29 7d 28 66 Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(i){return i};!function(i){"use strict";_i_("039b:c970d6c8"),"function"==typeof define&&define.amd?define(["jquery"],i):"undefined"!=typeof exports?module.exports=i(require("jquery")):i(jQuery),_r_()}(f
2024-02-08 18:35:45 UTC	16384	IN	Data Raw: 20 69 3d 74 68 69 73 3b 6c 28 69 2e 24 73 6c 69 64 65 72 29 2e 68 61 73 43 6c 61 73 73 28 22 73 6c 69 63 6b 2d 69 6e 69 74 69 61 6c 69 7a 65 64 22 29 7c 7c 28 6c 28 69 2e 24 73 6c 69 64 65 72 29 2e 61 64 64 43 6c 61 73 73 28 22 73 6c 69 63 6b 2d 69 6e 69 74 69 61 6c 69 7a 65 64 22 29 2c 69 2e 62 75 69 6c 64 4f 75 74 28 29 2c 69 2e 73 65 74 50 72 6f 70 73 28 29 2c 69 2e 73 74 61 72 74 4c 6f 61 64 28 29 2c 69 2e 6c 6f 61 64 53 6c 69 64 65 72 28 29 2c 69 2e 69 6e 69 74 69 61 6c 69 7a 65 45 76 65 6e 74 73 28 29 2c 69 2e 75 70 64 61 74 65 41 72 72 6f 77 73 28 29 2c 69 2e 75 70 64 61 74 65 44 6f 74 73 28 29 29 2c 69 2e 24 73 6c 69 64 65 72 2e 74 72 69 67 67 65 72 28 22 69 6e 69 74 22 2c 5b 69 5d 29 2c 5f 72 5f 28 29 7d 2c 72 2e 70 72 6f 74 6f 74 79 70 65 2e 69 Data Ascii: i=this;l(i.$slider).hasClass("slick-initialized")\|\|(l(i.$slider).addClass("slick-initialized"),i.buildOut(),i.setProps(),i.startLoad(),i.loadSlider(),i.initializeEvents(),i.updateArrows(),i.updateDots()),i.$slider.trigger("init",[i]),_r_()},r.prototype.i
2024-02-08 18:35:45 UTC	4755	IN	Data Raw: 74 2e 6f 70 74 69 6f 6e 73 2e 73 77 69 70 65 54 6f 53 6c 69 64 65 3f 74 2e 63 68 65 63 6b 4e 61 76 69 67 61 62 6c 65 28 74 2e 63 75 72 72 65 6e 74 53 6c 69 64 65 2b 74 2e 67 65 74 53 6c 69 64 65 43 6f 75 6e 74 28 29 29 3a 74 2e 63 75 72 72 65 6e 74 53 6c 69 64 65 2b 74 2e 67 65 74 53 6c 69 64 65 43 6f 75 6e 74 28 29 2c 74 2e 73 6c 69 64 65 48 61 6e 64 6c 65 72 28 65 29 2c 74 2e 63 75 72 72 65 6e 74 44 69 72 65 63 74 69 6f 6e 3d 30 2c 74 2e 74 6f 75 63 68 4f 62 6a 65 63 74 3d 7b 7d 2c 74 2e 24 73 6c 69 64 65 72 2e 74 72 69 67 67 65 72 28 22 73 77 69 70 65 22 2c 5b 74 2c 22 6c 65 66 74 22 5d 29 3b 62 72 65 61 6b 3b 63 61 73 65 22 72 69 67 68 74 22 3a 65 3d 74 2e 6f 70 74 69 6f 6e 73 2e 73 77 69 70 65 54 6f 53 6c 69 64 65 3f 74 2e 63 68 65 63 6b 4e 61 76 69 Data Ascii: t.options.swipeToSlide?t.checkNavigable(t.currentSlide+t.getSlideCount()):t.currentSlide+t.getSlideCount(),t.slideHandler(e),t.currentDirection=0,t.touchObject={},t.$slider.trigger("swipe",[t,"left"]);break;case"right":e=t.options.swipeToSlide?t.checkNavi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
185	192.168.2.5	49925	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:45 UTC	2107	OUT	POST /navigation_times HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 503 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/x-www-form-urlencoded X-Booking-CSRF: M1fFZQAAAAA=ow_iJm02C23yTbeZTjDwFw3ODjezY3bK5FHdo-YoJdT7GCkrsQ32GPbbWguo4KloItJB_vA0z9Y_xRO57ct8Amr5W_XGX_7GZSpQGGcZ9tRZ2sLvFoX1OvJhoh8lHbncqueaPtPA9hz8Y_-xROuXkd4r2dhb8qRB-XM9-fcVbZ1TIOfkTWMBhv8vt5DNEpcahji4EEgpTuAdyxqG sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhAD4WLlocJITBMa3rDvM%2FTul1zrgyV20Oep4%2ByzvFe9TEP4%2FCO7SWdV4nDvU%2BPb6T8tysYngKSx198oV9JBFKQ14%2FRJ75raZDQGoIW6X8k3KrgZ8J43VSKpt36%2FaOYflD1Q6oFd0cBFlEO2ZPIWEaSdI7bMOXiUsqw%3D; lastSeen=0
2024-02-08 18:35:45 UTC	503	OUT	Data Raw: 72 65 66 5f 61 63 74 69 6f 6e 3d 69 6e 64 65 78 26 70 69 64 3d 65 34 64 65 38 32 62 39 31 39 62 38 30 30 65 34 26 73 74 79 70 65 3d 31 26 6c 61 6e 67 3d 65 6e 26 66 69 72 73 74 3d 31 26 63 68 3d 64 26 62 6f 3d 33 26 61 69 64 3d 33 30 34 31 34 32 26 63 73 73 5f 6c 6f 61 64 3d 31 26 63 64 6e 3d 63 66 26 64 63 3d 34 26 6e 74 73 3d 30 25 32 43 30 25 32 43 31 37 30 37 34 31 37 33 32 37 36 39 30 25 32 43 30 25 32 43 30 25 32 43 30 25 32 43 30 25 32 43 31 37 30 37 34 31 37 33 33 30 32 37 38 25 32 43 31 37 30 37 34 31 37 33 33 30 32 38 38 25 32 43 31 37 30 37 34 31 37 33 33 30 34 31 30 25 32 43 31 37 30 37 34 31 37 33 33 30 34 31 30 25 32 43 31 37 30 37 34 31 37 33 33 30 36 35 31 25 32 43 31 37 30 37 34 31 37 33 33 30 34 31 31 25 32 43 31 37 30 37 34 31 37 33 33 Data Ascii: ref_action=index&pid=e4de82b919b800e4&stype=1&lang=en&first=1&ch=d&bo=3&aid=304142&css_load=1&cdn=cf&dc=4&nts=0%2C0%2C1707417327690%2C0%2C0%2C0%2C0%2C1707417330278%2C1707417330288%2C1707417330410%2C1707417330410%2C1707417330651%2C1707417330411%2C170741733
2024-02-08 18:35:45 UTC	1038	IN	HTTP/1.1 202 Accepted Content-Type: image/jpeg Content-Length: 0 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:45 GMT set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3UY1FdXKTGRja%2FonDDEPb1%2BP0FcQXyX9Aq5eUoWl1xHMxt3OfgRlOke3id7i7jFw2VquUfaU3XoSnJ%2FUck7uJhJ3JYTXV0GxxSG9jZQMtac228XUuUSv32WhE3%2BkOkPmhXo0fU0eDdHHTCOBLNZ%2BkW%2Fg3TxF6ECh84%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:45 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=a9be82c07e110101&e=UmFuZG9tSVYkc2RlIyh9YfnWSDpdIwKzDzbKZoiCiJsvFK0DMXnbtSU9Xnhsh1GJw5-Vh9UAqSg x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 fcb94596db202c75ac0e559b3183be72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: ESjepVom-8Q8zX6qZJOhIb0LKOJGMxjXOShuqRgM6oSaMSSImRA67A==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
186	192.168.2.5	49931	151.101.12.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:45 UTC	521	OUT	GET /ct/core.js HTTP/1.1 Host: s.pinimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:45 UTC	453	IN	HTTP/1.1 200 OK Connection: close Content-Length: 4719 ETag: "0ff86d58500d816b1bab19e76f4137dc" x-amz-server-side-encryption: AES256 Content-Type: application/javascript X-CDN: fastly alt-svc: h3=":443";ma=600 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Access-Control-Max-Age: 86400 Access-Control-Expose-Headers: X-CDN Vary: Accept-Encoding, Origin Cache-Control: max-age=7200 date: Thu, 08 Feb 2024 18:35:45 GMT
2024-02-08 18:35:45 UTC	1378	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 69 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 72 28 6e 29 7b 76 61 72 20 65 3b 72 65 74 75 72 6e 28 69 5b 6e 5d 7c 7c 28 65 3d 69 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 2c 74 5b 6e 5d 2e 63 61 6c 6c 28 65 2e 65 78 70 6f 72 74 73 2c 65 2c 65 2e 65 78 70 6f 72 74 73 2c 72 29 2c 65 2e 6c 3d 21 30 2c 65 29 29 2e 65 78 70 6f 72 74 73 7d 72 2e 6d 3d 74 2c 72 2e 63 3d 69 2c 72 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 74 29 7b 72 2e 6f 28 6e 2c 65 29 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 6e 2c 65 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 74 7d 29 7d 2c 72 2e 72 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 22 75 6e 64 65 66 69 6e Data Ascii: !function(t){var i={};function r(n){var e;return(i[n]\|\|(e=i[n]={i:n,l:!1,exports:{}},t[n].call(e.exports,e,e.exports,r),e.l=!0,e)).exports}r.m=t,r.c=i,r.d=function(n,e,t){r.o(n,e)\|\|Object.defineProperty(n,e,{enumerable:!0,get:t})},r.r=function(n){"undefin
2024-02-08 18:35:45 UTC	1378	IN	Data Raw: 6c 6c 28 6e 29 2e 73 6c 69 63 65 28 38 2c 2d 31 29 29 26 26 6e 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3f 6e 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2e 6e 61 6d 65 3a 74 29 7c 7c 22 53 65 74 22 3d 3d 3d 74 3f 41 72 72 61 79 2e 66 72 6f 6d 28 6e 29 3a 22 41 72 67 75 6d 65 6e 74 73 22 3d 3d 3d 74 7c 7c 2f 5e 28 3f 3a 55 69 7c 49 29 6e 74 28 3f 3a 38 7c 31 36 7c 33 32 29 28 3f 3a 43 6c 61 6d 70 65 64 29 3f 41 72 72 61 79 24 2f 2e 74 65 73 74 28 74 29 3f 69 28 6e 2c 65 29 3a 76 6f 69 64 20 30 7d 28 6e 2c 65 29 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 49 6e 76 61 6c 69 64 20 61 74 74 65 6d 70 74 20 74 6f 20 64 65 73 74 72 75 63 74 75 72 65 20 6e 6f 6e 2d 69 74 65 72 61 62 6c 65 20 69 6e 73 74 61 6e 63 65 2e Data Ascii: ll(n).slice(8,-1))&&n.constructor?n.constructor.name:t)\|\|"Set"===t?Array.from(n):"Arguments"===t\|\|/^(?:Ui\|I)nt(?:8\|16\|32)(?:Clamped)?Array$/.test(t)?i(n,e):void 0}(n,e)\|\|function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.
2024-02-08 18:35:45 UTC	1378	IN	Data Raw: 75 6e 6b 6e 6f 77 6e 22 3b 66 75 6e 63 74 69 6f 6e 20 61 28 6e 29 7b 6e 2e 76 65 72 73 69 6f 6e 3d 6f 2c 31 30 30 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3c 28 69 2e 4c 49 53 54 2e 53 45 4e 44 5f 4c 4f 47 53 2e 63 68 61 6e 63 65 7c 7c 30 29 26 26 72 2e 76 28 6e 29 7d 72 2e 73 65 74 56 65 72 73 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6f 3d 6e 7d 2c 72 2e 76 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 65 3d 6e 65 77 20 77 69 6e 64 6f 77 2e 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 3b 65 2e 77 69 74 68 43 72 65 64 65 6e 74 69 61 6c 73 3d 21 31 2c 65 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 22 45 72 72 6f 72 20 6d 65 73 73 61 67 65 20 66 61 69 6c 65 64 20 74 6f 20 73 65 6e 64 22 29 Data Ascii: unknown";function a(n){n.version=o,100*Math.random()<(i.LIST.SEND_LOGS.chance\|\|0)&&r.v(n)}r.setVersion=function(n){o=n},r.v=function(n){var e=new window.XMLHttpRequest;e.withCredentials=!1,e.onerror=function(){console.error("Error message failed to send")
2024-02-08 18:35:45 UTC	585	IN	Data Raw: 6c 69 62 5c 2f 6d 61 69 6e 5c 2e 5b 30 2d 39 61 2d 66 5d 7b 38 7d 5c 2e 6a 73 2f 67 3b 69 2e 73 65 6e 64 45 76 65 6e 74 49 6e 66 6f 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 65 2c 74 3b 6e 26 26 6e 2e 62 6c 6f 63 6b 65 64 55 52 49 26 26 22 68 74 74 70 73 3a 2f 2f 73 2e 70 69 6e 69 6d 67 2e 63 6f 6d 2f 63 74 2f 6c 69 62 2f 6d 61 69 6e 2e 36 34 36 31 61 33 31 61 2e 6a 73 22 3d 3d 3d 6e 2e 62 6c 6f 63 6b 65 64 55 52 49 26 26 28 65 3d 22 44 69 72 65 63 74 69 76 65 3a 20 22 2b 6e 2e 65 66 66 65 63 74 69 76 65 44 69 72 65 63 74 69 76 65 2b 22 20 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 22 2b 6e 2e 64 69 73 70 6f 73 69 74 69 6f 6e 2b 22 20 42 6c 6f 63 6b 65 64 20 55 52 49 3a 20 22 2b 6e 2e 62 6c 6f 63 6b 65 64 55 52 49 2c 6e 2e 6f 72 69 67 69 6e 61 6c 50 Data Ascii: lib\/main\.[0-9a-f]{8}\.js/g;i.sendEventInfo=function(n){var e,t;n&&n.blockedURI&&"https://s.pinimg.com/ct/lib/main.6461a31a.js"===n.blockedURI&&(e="Directive: "+n.effectiveDirective+" Disposition: "+n.disposition+" Blocked URI: "+n.blockedURI,n.originalP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
187	192.168.2.5	49935	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:45 UTC	1464	OUT	GET /td/fls/rul/activityi;fledge=1;src=4228414;type=views;cat=views;ord=4995395844978;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=2105455417;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-02-08 18:35:45 UTC	967	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:45 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: IDE=AHWqTUnbs1U97w3kjt_Ux_SYNB3RTvhWcFlsDnRTOjaaiOIzJkWJfhsSJjnfBxZx8Ok; expires=Sat, 07-Feb-2026 18:35:45 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Set-Cookie: test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:45 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-08 18:35:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
188	192.168.2.5	49930	108.139.23.251	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:45 UTC	526	OUT	GET /scevent.min.js HTTP/1.1 Host: sc-static.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:45 UTC	662	IN	HTTP/1.1 200 OK Content-Type: application/javascript;charset=utf-8 Content-Length: 42347 Connection: close Server: CloudFront Date: Thu, 08 Feb 2024 18:35:45 GMT Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Origin: * Content-Encoding: utf-8 Cache-Control: private, s-maxage=0, max-age=600 Set-Cookie: X-AB=d1ca3400158747da9d5bc0bddbc64722;max-age=86400;expires=Fri, 09 Feb 2024 18:35:45 GMT;Path=/scevent.min.js;Secure;SameSite=None X-Cache: Miss from cloudfront Via: 1.1 6407b86e5baafe7d37861f17c38bd09c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL58-P2 X-Amz-Cf-Id: zB4D-B5X4iXqUelllUseqYBn2hKTBUVW6KNZc26ccx2uVzsk3sbnGQ==
2024-02-08 18:35:45 UTC	15722	IN	Data Raw: 2f 2a 2a 20 53 6e 61 70 63 68 61 74 20 50 69 78 65 6c 20 53 44 4b 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 66 6f 72 28 76 61 72 20 74 2c 72 3d 31 2c 65 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 72 3c 65 3b 72 2b 2b 29 66 6f 72 28 76 61 72 20 69 20 69 6e 20 74 3d 61 72 67 75 6d 65 6e 74 73 5b 72 5d 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 69 29 26 26 28 6e 5b 69 5d 3d 74 5b 69 5d 29 3b 72 65 74 75 72 6e 20 6e 7d 2c 6e 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 Data Ascii: /** Snapchat Pixel SDK */!function(){"use strict";var n=function(){return n=Object.assign\|\|function(n){for(var t,r=1,e=arguments.length;r<e;r++)for(var i in t=arguments[r])Object.prototype.hasOwnProperty.call(t,i)&&(n[i]=t[i]);return n},n.apply(this,argu
2024-02-08 18:35:45 UTC	16384	IN	Data Raw: 7b 72 65 74 75 72 6e 20 45 72 2e 73 74 72 69 6e 67 69 66 79 28 6e 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 72 29 7b 72 65 74 75 72 6e 20 63 28 72 29 3f 66 28 74 2c 72 29 3f 76 6f 69 64 20 30 3a 28 4f 28 74 2c 72 29 2c 72 29 3a 72 7d 29 29 7d 63 61 74 63 68 28 6e 29 7b 77 6e 28 22 4a 53 4e 22 2c 6e 29 7d 74 72 79 7b 69 66 28 63 28 6e 29 26 26 21 66 28 74 2c 6e 29 29 7b 4f 28 74 2c 6e 29 3b 76 61 72 20 72 3d 22 22 3b 69 66 28 54 28 6e 2e 74 6f 4a 53 4f 4e 29 29 72 65 74 75 72 6e 20 50 72 28 6e 2e 74 6f 4a 53 4f 4e 28 29 29 3b 69 66 28 6f 28 6e 29 29 7b 66 6f 72 28 76 61 72 20 65 3d 44 28 6e 29 2c 69 3d 30 3b 69 3c 65 3b 69 2b 2b 29 7b 72 2b 3d 28 69 3f 22 2c 22 3a 22 22 29 2b 28 28 73 3d 50 72 28 6e 5b 69 5d 29 29 7c 7c 22 6e 75 6c 6c 22 29 7d 72 65 74 75 72 Data Ascii: {return Er.stringify(n,(function(n,r){return c(r)?f(t,r)?void 0:(O(t,r),r):r}))}catch(n){wn("JSN",n)}try{if(c(n)&&!f(t,n)){O(t,n);var r="";if(T(n.toJSON))return Pr(n.toJSON());if(o(n)){for(var e=D(n),i=0;i<e;i++){r+=(i?",":"")+((s=Pr(n[i]))\|\|"null")}retur
2024-02-08 18:35:45 UTC	10241	IN	Data Raw: 2f 5e 30 2b 7c 5c 44 2f 67 2c 5f 69 7c 7c 5b 22 31 22 5d 29 2c 68 3d 44 28 5f 29 2c 79 3d 30 3b 79 3c 68 3b 79 2b 2b 29 74 5b 70 5d 3d 28 74 5b 70 5d 3f 74 5b 70 5d 2b 22 2c 22 3a 22 22 29 2b 5f 5b 79 5d 3b 65 6c 73 65 20 74 5b 70 3d 75 2e 72 65 70 6c 61 63 65 28 22 5f 22 2c 22 5f 68 22 29 5d 3d 28 74 5b 70 5d 3f 74 5b 70 5d 2b 22 2c 22 3a 22 22 29 2b 58 72 28 6c 29 7d 7d 63 61 74 63 68 28 6e 29 7b 77 6e 28 22 41 53 43 50 4d 22 2c 6e 29 7d 44 28 6e 6e 28 74 29 29 3e 31 26 26 41 6e 28 7b 70 63 3a 74 7d 29 7d 28 6e 29 7d 29 29 29 2c 21 21 74 7d 63 61 74 63 68 28 74 29 7b 77 6e 28 22 41 4d 41 4c 22 2c 74 2c 6e 2e 77 61 74 63 68 5f 65 6c 29 7d 72 65 74 75 72 6e 21 30 7d 66 75 6e 63 74 69 6f 6e 20 53 69 28 6e 29 7b 74 72 79 7b 69 66 28 21 6d 69 28 6e 29 29 76 Data Ascii: /^0+\|\D/g,_i\|\|["1"]),h=D(_),y=0;y<h;y++)t[p]=(t[p]?t[p]+",":"")+_[y];else t[p=u.replace("_","_h")]=(t[p]?t[p]+",":"")+Xr(l)}}catch(n){wn("ASCPM",n)}D(nn(t))>1&&An({pc:t})}(n)}))),!!t}catch(t){wn("AMAL",t,n.watch_el)}return!0}function Si(n){try{if(!mi(n))v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
189	192.168.2.5	49936	142.250.9.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:45 UTC	576	OUT	GET /gsi/fedcm/listaccounts HTTP/1.1 Host: accounts.google.com Connection: keep-alive Accept: application/json Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: webidentity User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:45 UTC	1300	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 08 Feb 2024 18:35:45 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt Cross-Origin-Resource-Policy: same-site Content-Security-Policy: script-src 'report-sample' 'nonce-_OlNNeP-qsfBWGx8o6zzqg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1" Report-To: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]} Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:45 UTC	20	IN	Data Raw: 66 0d 0a 7b 22 61 63 63 6f 75 6e 74 73 22 3a 5b 5d 7d 0d 0a Data Ascii: f{"accounts":[]}
2024-02-08 18:35:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
190	192.168.2.5	49933	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:45 UTC	1436	OUT	GET /td/rul/988382855?random=1707417344353&cv=11&fst=1707417344353&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=ZgWTCPidsIkYEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&value=0&bttype=purchase&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-02-08 18:35:45 UTC	954	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:45 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure Set-Cookie: IDE=AHWqTUlAWu6rXBfYjTV_Uj7dXhX3h_q_6YxHN2kY_h3QN3MMpusGnzAEA8nM1wi4; expires=Sat, 07-Feb-2026 18:35:45 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:45 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-08 18:35:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
191	192.168.2.5	49934	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:45 UTC	1405	OUT	GET /td/rul/988382855?random=1707417344393&cv=11&fst=1707417344393&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-02-08 18:35:45 UTC	954	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:45 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure Set-Cookie: IDE=AHWqTUnHW0Ct2FI_4k8rZAnxKtdZ9ablu95vKeDB5Ybo6Dangkor7kezMtHQbzny; expires=Sat, 07-Feb-2026 18:35:45 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:45 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-08 18:35:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
192	192.168.2.5	49938	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:45 UTC	1844	OUT	GET /td/rul/1060768846?random=1707417344498&cv=11&fst=1707417344498&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nh4qqVoyv2KiIad5kPNddW86jrjYgKSk8&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-02-08 18:35:45 UTC	954	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:45 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure Set-Cookie: IDE=AHWqTUkCdleldgRcseCjt9xnaLisLRyPgnxMgBV5RG9_NU49aCNg--lr_r1NG9pb; expires=Sat, 07-Feb-2026 18:35:45 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:45 UTC	298	IN	Data Raw: 33 65 61 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 6f 72 69 67 69 6e 2d 74 72 69 61 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 41 76 68 35 4e 79 30 58 45 46 43 79 51 37 2b 6f 4e 69 65 58 73 6b 55 72 71 59 38 65 64 55 7a 4c 35 2f 58 72 77 4b 6c 47 6a 41 52 51 48 57 34 54 46 52 4b 2b 6a 56 64 35 48 6e 44 49 70 59 32 30 6e 35 4f 4c 48 66 67 55 34 6b 75 37 78 34 38 4e 33 75 68 47 2f 41 30 41 41 41 42 78 65 79 4a 76 63 6d 6c 6e 61 57 34 69 4f 69 4a 6f 64 48 52 77 63 7a 6f 76 4c 32 52 76 64 57 4a 73 5a 57 4e 73 61 57 4e 72 4c 6d 35 6c 64 44 6f 30 4e 44 4d 69 4c 43 4a 6d 5a 57 46 30 64 58 4a 6c 49 6a 6f 69 55 48 4a 70 64 6d 46 6a 65 56 4e 68 62 6d 52 69 62 33 68 42 5a 48 4e 42 55 45 6c 7a 49 69 77 69 5a 58 68 77 61 Data Ascii: 3ea<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwa
2024-02-08 18:35:45 UTC	711	IN	Data Raw: 5a 58 30 3d 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 3e 76 61 72 20 69 67 5f 6c 69 73 74 3d 7b 22 69 6e 74 65 72 65 73 74 47 72 6f 75 70 73 22 3a 5b 7b 22 61 63 74 69 6f 6e 22 3a 31 2c 22 69 6e 74 65 72 65 73 74 47 72 6f 75 70 41 74 74 72 69 62 75 74 65 73 22 3a 7b 22 6f 77 6e 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 74 64 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 22 2c 22 6e 61 6d 65 22 3a 22 31 6a 39 32 37 30 32 39 34 22 7d 7d 2c 7b 22 61 63 74 69 6f 6e 22 3a 31 2c 22 69 6e 74 65 72 65 73 74 47 72 6f 75 70 41 74 74 72 69 62 75 74 65 73 22 3a 7b 22 6f 77 6e 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 74 64 2e 64 6f 75 62 6c 65 63 6c 69 63 6b 2e 6e 65 74 22 2c 22 6e 61 6d 65 22 3a 22 31 6a 39 32 37 30 35 33 34 22 7d 7d 5d 7d 3b 3c Data Ascii: ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j9270294"}},{"action":1,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"1j9270534"}}]};<
2024-02-08 18:35:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
193	192.168.2.5	49939	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:45 UTC	1404	OUT	GET /td/rul/973712236?random=1707417344535&cv=11&fst=1707417344535&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-02-08 18:35:45 UTC	954	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:45 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure Set-Cookie: IDE=AHWqTUkwA06e2LmJDlVDtE3nlV6zyMr1NHCmYbFzpS9jAPeELWgMasnX2ocNY86m; expires=Sat, 07-Feb-2026 18:35:45 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:45 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-08 18:35:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
194	192.168.2.5	49940	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:45 UTC	1404	OUT	GET /td/rul/973712236?random=1707417344582&cv=11&fst=1707417344582&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-02-08 18:35:45 UTC	954	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:45 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure Set-Cookie: IDE=AHWqTUnsZ9ai0_ZXF64whabKFxfevw9TEhFwFyJ67cU2xzIOOdgy-qTpAfxpK67U; expires=Sat, 07-Feb-2026 18:35:45 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:45 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-08 18:35:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
195	192.168.2.5	49942	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:45 UTC	1605	OUT	GET /sendlayoutevents HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=1707417341870; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhAD4WLlocJITBMa3rDvM%2FTul1zrgyV20Oep4%2ByzvFe9TEP4%2FCO7SWdV4nDvU%2BPb6T8tysYngKSx198oV9JBFKQ14%2FRJ75raZDQGoIW6X8k3KrgZ8J43VSKpt36%2FaOYflD1Q6oFd0cBFlEO2ZPIWEaSdI7bMOXiUsqw%3D
2024-02-08 18:35:45 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:45 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=e03382c0640a02ce&e=UmFuZG9tSVYkc2RlIyh9YReXsVhv1rQKB4Zv_9za_ve0JX5_B19J6mRMM7g9LMMhznTVfJ0aDHk x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 5988b4ae4648c0fec3c60a3cca580092.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: _YgjJ_QvKnDjYgIugZrqUL05Am8-Bs_anjuOmbjQ4IpvcN9ITfgi5A==
2024-02-08 18:35:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
196	192.168.2.5	49943	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:45 UTC	2255	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 2441 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: e4de82b919b800e4 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2BI6h0LLlJfr4uEPODOppbFCV6Th8ROLIHCxxR34ODjqh9FeK%2B5WwxxW%2BXBiWehITLmwPt4eyEFq2SVOwaC2%2FReJiu846DJCGilmlNtxv2P43hLAQDIRlCu6XIGNC%2Bh1Nc15nZTRtXlXUNra0gS515qF2snrbxj%2BGg%3D; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw
2024-02-08 18:35:45 UTC	2441	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 68 65 61 64 65 72 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 73 65 72 76 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 32 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 70 72 6f 64 75 63 74 5f 76 65 72 74 69 63 61 6c 73 5f 6c 6f 61 64 65 64 22 3a 5b 7b 22 69 74 65 6d 5f 74 79 70 65 22 3a 22 61 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 73 22 2c 22 69 74 65 6d 5f 70 6f 73 69 74 69 6f 6e 22 3a 31 2c 22 69 73 5f 69 74 65 6d 5f 70 72 65 73 65 6c 65 63 74 65 64 22 3a 31 7d 2c 7b 22 69 74 65 6d 5f 74 79 70 65 22 3a 22 66 6c 69 67 68 74 73 22 2c 22 69 74 65 6d 5f 70 6f 73 69 74 69 6f 6e 22 3a 32 2c 22 69 73 5f 69 74 65 6d 5f 70 72 65 73 65 6c Data Ascii: {"events":[{"action_name":"webcoreux.header_component_served","action_version":"2.0.0","content":{"product_verticals_loaded":[{"item_type":"accommodations","item_position":1,"is_item_preselected":1},{"item_type":"flights","item_position":2,"is_item_presel
2024-02-08 18:35:46 UTC	1181	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 83 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:46 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhAKIBft1%2FAnTuzQ49KXtMwe7e2f2rKdQJONlBOwYo%2FHm6oPLbBd%2Fwrf9G7gWFEcTvQ1iUEwoKeqRFUKt31SjP%2FQZkajq6dMe%2FbPgi3hB9Dc2pQBf%2FxrESnhc0wFCc1FRjWOlEPvYM4ktSLGfesrpkrbSswRM9gNzNE%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:46 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=2d6b82c0e6530202&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsuTeNu9de1NJUMADLbtBXA_nNwu9ZD7rYI x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 a1a074529ccb9ea97acd7d95c506f336.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: wBa9TZarIAf4ZiMVA4WSUJbE6HyG4s2VozKzlERwiIgxruTtbEzFSg==
2024-02-08 18:35:46 UTC	83	IN	Data Raw: 5b 7b 22 63 6f 64 65 22 3a 39 2c 22 73 74 61 74 75 73 22 3a 30 7d 2c 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d 2c 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d 5d Data Ascii: [{"code":9,"status":0},{"status":1,"content":"Sent"},{"content":"Sent","status":1}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
197	192.168.2.5	49944	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:45 UTC	2677	OUT	GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=e4de82b919b800e4&ete=&etg=&etcg=cCHObEfEITNPfbeQMIaWYUQJFFQccCcCcCC\|5&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,cCHObKdBdUHINPSXeHDALOLOLMO\|3&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-ET-Serialized-State: EFB4182z3JoJxbpLmYz6l9XMO8uwQw5vy57VA6rLJax-JW2gEd2Ycalwc-8XMLrKv X-Booking-Language-Code: en-us X-Booking-Client-Info: sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: e4de82b919b800e4 X-Booking-Info: X-Booking-SiteType-Id: 1 X-Booking-Session-Id: db6e5bbb32eac0e80cfcae9b22f5390d sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT%2BI6h0LLlJfr4uEPODOppbFCV6Th8ROLIHCxxR34ODjqh9FeK%2B5WwxxW%2BXBiWehITLmwPt4eyEFq2SVOwaC2%2FReJiu846DJCGilmlNtxv2P43hLAQDIRlCu6XIGNC%2Bh1Nc15nZTRtXlXUNra0gS515qF2snrbxj%2BGg%3D; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V
2024-02-08 18:35:46 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:45 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=5f4c82c084a30294&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejIZPJizrOQgaKgpMbGlhnrg5DqxIBC1Ius x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 f4c38e024a95b76a27c9f3dc9ff2eda6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: x34wUMTupCidXQ_YU4htOyj9vv0MFzS55W79_0DXr6E3kB7ACti9lg==
2024-02-08 18:35:46 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
198	192.168.2.5	49946	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:45 UTC	2699	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 359 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNzQxNzMzMSwiZXhwIjoxNzA3NTAzNzMxfQ.FEIVHt_geecKbDx83EB0dlYHQMkXSYfLIM-3srS_0UjPxnecQjdJhC9-gxV_INNKE6waBeWBkxYx8xeq68HlVA x-booking-et-serialized-state: EFB4182z3JoJxbpLmYz6l9XMO8uwQw5vy57VA6rLJax-JW2gEd2Ycalwc-8XMLrKv x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: e4de82b919b800e4 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3Uq9DXdX8vdlIEhNyH3Rmb4T9WfcYQ7JyyEuyTAr6aAQcA6rwqqM2AT4kx%2BfDXSA2826XpOYVjTU7jYRuUILVrfcjfhNwffPmiTjZMUUA0THR7HNYJhVbDeMyd5aq46LTsVkPj4W1IVEGOpmOGmYUrtlkvBiFthACI%3D
2024-02-08 18:35:45 UTC	359	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 5f 73 74 61 67 65 22 3a 22 6e 6f 5f 61 64 5f 72 65 74 75 72 6e 65 64 5f 66 72 6f 6d 5f 67 70 74 22 2c 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 55 4e 4b 4e 4f 57 4e 22 2c 22 73 69 74 65 5f 74 79 70 65 22 3a 22 57 57 57 22 2c 22 76 69 73 69 74 6f 72 5f 63 63 22 3a 22 75 73 22 2c 22 61 64 5f 70 6f 73 69 74 69 6f 6e 22 3a 22 49 4e 44 45 58 5f 50 52 49 4d 41 52 59 22 2c 22 70 61 67 65 6e 61 6d 65 22 3a 22 49 4e 44 45 58 22 2c 22 76 65 72 74 69 63 61 6c 22 3a 22 41 43 43 4f 4d 4d 4f 44 41 54 49 4f 4e 53 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 Data Ascii: {"operationName":"trackAdStatus","variables":{"input":{"action_stage":"no_ad_returned_from_gpt","campaign_id":"UNKNOWN","site_type":"WWW","visitor_cc":"us","ad_position":"INDEX_PRIMARY","pagename":"INDEX","vertical":"ACCOMMODATIONS"}},"extensions":{},"que
2024-02-08 18:35:46 UTC	1095	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 361 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:46 GMT vary: Accept-Encoding, User-Agent set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3Wpi2t3pXciPKAR9gZRqWFhXBw5kboCvKSp0fJA90%2Bn2UzPhT0mWhlh1BGSmjABdwH2OjA18nRK9WRd7C8oTs3zKvR4%2B8rHxw70fxGEjLhjDB0Cnwy5VyQ%2F0VZmW2uO7Fq9ytl73ugvdgq6UT270NU9c2uAtEsohLA%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:46 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=ec5082c02fb502df&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGSx2Tk74luEE1uxsvKM4OMPVJIWcZiAsBQ x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 086e2cd5d94fa729de58c51b5666e0e4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: TvJIQWVMaZIeJTJD8qk0hgN17xiLJ0hsEfVGQsfcLzw20UpAWkhVxA==
2024-02-08 18:35:46 UTC	361	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 3a 7b 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 41 20 4a 53 4f 4e 20 73 63 61 6c 61 72 22 2c 22 63 68 69 6c 64 72 65 6e 57 69 74 68 54 79 70 65 52 65 66 65 72 65 6e 63 65 73 22 3a 7b 22 65 6d 70 74 79 22 3a 66 61 6c 73 65 2c 22 63 68 69 6c 64 72 65 6e 41 73 4c 69 73 74 22 3a 5b 5d 2c 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 7d 7d 2c 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 61 6c 6c 41 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 6e 61 6d 65 22 3a 22 4a 53 4f 4e 22 2c 22 64 69 72 65 63 74 69 76 65 73 42 79 Data Ascii: {"data":{"trackAdStatus":{"description":"A JSON scalar","childrenWithTypeReferences":{"empty":false,"childrenAsList":[],"children":{"directives":[],"appliedDirectives":[]}},"appliedDirectives":[],"allAppliedDirectivesByName":{},"name":"JSON","directivesBy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
199	192.168.2.5	49947	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:45 UTC	2699	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 359 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNzQxNzMzMSwiZXhwIjoxNzA3NTAzNzMxfQ.FEIVHt_geecKbDx83EB0dlYHQMkXSYfLIM-3srS_0UjPxnecQjdJhC9-gxV_INNKE6waBeWBkxYx8xeq68HlVA x-booking-et-serialized-state: EFB4182z3JoJxbpLmYz6l9XMO8uwQw5vy57VA6rLJax-JW2gEd2Ycalwc-8XMLrKv x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: e4de82b919b800e4 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3Uq9DXdX8vdlIEhNyH3Rmb4T9WfcYQ7JyyEuyTAr6aAQcA6rwqqM2AT4kx%2BfDXSA2826XpOYVjTU7jYRuUILVrfcjfhNwffPmiTjZMUUA0THR7HNYJhVbDeMyd5aq46LTsVkPj4W1IVEGOpmOGmYUrtlkvBiFthACI%3D
2024-02-08 18:35:45 UTC	359	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 5f 73 74 61 67 65 22 3a 22 61 64 5f 62 6c 6f 63 6b 65 72 5f 6e 6f 74 5f 64 65 74 65 63 74 65 64 22 2c 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 55 4e 4b 4e 4f 57 4e 22 2c 22 73 69 74 65 5f 74 79 70 65 22 3a 22 57 57 57 22 2c 22 76 69 73 69 74 6f 72 5f 63 63 22 3a 22 75 73 22 2c 22 61 64 5f 70 6f 73 69 74 69 6f 6e 22 3a 22 49 4e 44 45 58 5f 50 52 49 4d 41 52 59 22 2c 22 70 61 67 65 6e 61 6d 65 22 3a 22 49 4e 44 45 58 22 2c 22 76 65 72 74 69 63 61 6c 22 3a 22 41 43 43 4f 4d 4d 4f 44 41 54 49 4f 4e 53 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 Data Ascii: {"operationName":"trackAdStatus","variables":{"input":{"action_stage":"ad_blocker_not_detected","campaign_id":"UNKNOWN","site_type":"WWW","visitor_cc":"us","ad_position":"INDEX_PRIMARY","pagename":"INDEX","vertical":"ACCOMMODATIONS"}},"extensions":{},"que
2024-02-08 18:35:46 UTC	1091	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 361 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:46 GMT vary: Accept-Encoding, User-Agent set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWznlSlRZNNCt3uSEWppJCYH588b8iYKXXOnIOKpcULYw5G8qmBlVrUKP4MYa8JC7f9xeViVK4AXz6g8ApKkIokAyiVjrl%2Be7Ypbx0JpGBkh%2BkvyOLCcCjVgj1VWVNbgbfGITiSF2OndEnOsUedtFNaHBwC6U5fUDzek%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:46 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=cf5b82c1fe9f00a5&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGf6Nl5ZeVgJAWMYHBBTnbr1DUifC7cYy9Q x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 31341771a4bfa40d7b1f61883ffb56c6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: ZhcjjOX5iDNWjYCDWqnx-K3dIqC_tzQMroQoRjV1mqyCYP_La7H1Ow==
2024-02-08 18:35:46 UTC	361	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 3a 7b 22 63 68 69 6c 64 72 65 6e 22 3a 5b 5d 2c 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 63 6f 65 72 63 69 6e 67 22 3a 7b 7d 2c 22 64 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 61 6c 6c 41 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 44 65 66 69 6e 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 6e 61 6d 65 22 3a 22 4a 53 4f 4e 22 2c 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 41 20 4a 53 4f 4e 20 73 63 61 6c 61 72 22 2c 22 61 6c 6c 44 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 63 68 69 6c 64 72 65 6e 57 69 74 68 Data Ascii: {"data":{"trackAdStatus":{"children":[],"directives":[],"coercing":{},"directivesByName":{},"allAppliedDirectivesByName":{},"extensionDefinitions":[],"name":"JSON","appliedDirectives":[],"description":"A JSON scalar","allDirectivesByName":{},"childrenWith

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
200	192.168.2.5	49948	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:45 UTC	585	OUT	GET /d8c14d4960ca/a18a4859af9c/challenge.js HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:46 UTC	534	IN	HTTP/1.1 200 OK Content-Type: text/javascript Content-Length: 1093410 Connection: close Vary: Accept-Encoding Date: Thu, 08 Feb 2024 18:35:46 GMT cache-control: private, max-age=86400 last-modified: Thu, 8 Feb 2024 18:35:46 +0000 pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65c51f02-53dd15f828ee78e009a4b900 X-Cache: Miss from cloudfront Via: 1.1 d591fee4e3f29cf0e3380368d25b4a40.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: e74neDKOMIYPkNeFqIOys8op9a8kpsF4kHcfu7_nFsllVlnjCu6D9w==
2024-02-08 18:35:46 UTC	15850	IN	Data Raw: 2f 2a 21 20 3c 21 2d 40 70 72 65 73 65 72 76 65 20 41 57 53 20 57 41 46 20 49 6e 74 65 67 72 61 74 69 6f 6e 20 44 65 76 65 6c 6f 70 65 72 20 47 75 69 64 65 20 3c 68 74 74 70 73 3a 2f 2f 64 6f 63 73 2e 61 77 73 2e 61 6d 61 7a 6f 6e 2e 63 6f 6d 2f 77 61 66 2f 6c 61 74 65 73 74 2f 64 65 76 65 6c 6f 70 65 72 67 75 69 64 65 2f 77 61 66 2d 6a 61 76 61 73 63 72 69 70 74 2d 73 64 6b 2e 68 74 6d 6c 3e 2d 2d 3e 20 2a 2f 0a 76 61 72 20 61 32 5f 30 78 33 33 66 33 3d 5b 27 4f 6e 6c 79 5c 78 32 30 50 4b 43 53 23 31 32 5c 78 32 30 50 46 58 5c 78 32 30 69 6e 5c 78 32 30 70 61 73 73 77 6f 72 64 5c 78 32 30 69 6e 74 65 67 72 69 74 79 5c 78 32 30 6d 6f 64 65 5c 78 32 30 73 75 70 70 6f 72 74 65 64 2e 27 2c 27 41 72 69 61 6c 5c 78 32 30 54 55 52 27 2c 27 70 61 67 65 58 27 2c Data Ascii: /! <!-@preserve AWS WAF Integration Developer Guide <https://docs.aws.amazon.com/waf/latest/developerguide/waf-javascript-sdk.html>--> /var a2_0x33f3=['Only\x20PKCS#12\x20PFX\x20in\x20password\x20integrity\x20mode\x20supported.','Arial\x20TUR','pageX',
2024-02-08 18:35:46 UTC	16384	IN	Data Raw: 45 6e 63 72 79 70 74 65 64 50 72 69 76 61 74 65 4b 65 79 49 6e 66 6f 2e 27 2c 27 70 61 67 65 49 64 27 2c 27 34 38 34 32 38 57 63 44 68 52 6f 27 2c 27 66 72 6f 6d 49 6e 74 27 2c 27 73 74 72 69 6e 67 27 2c 27 66 6f 72 6d 61 74 4e 75 6d 62 65 72 27 2c 27 5c 78 32 30 28 45 78 74 65 72 6e 61 6c 5c 78 32 30 6f 72 5c 78 32 30 49 6e 73 74 61 6e 63 65 5c 78 32 30 6f 66 29 27 2c 27 69 6e 69 74 27 2c 27 31 31 65 75 6b 64 54 69 27 2c 27 62 65 68 61 76 69 6f 72 27 2c 27 6d 61 63 41 6c 67 6f 72 69 74 68 6d 27 2c 27 32 2e 31 36 2e 38 34 30 2e 31 2e 31 30 31 2e 33 2e 34 2e 32 2e 36 27 2c 27 76 6f 75 63 68 65 72 41 6e 64 55 70 64 61 74 65 54 6f 6b 65 6e 27 2c 27 74 69 74 6c 65 27 2c 27 72 65 64 75 63 65 27 2c 27 67 65 74 43 69 70 68 65 72 46 6f 72 50 4b 43 53 31 32 50 42 Data Ascii: EncryptedPrivateKeyInfo.','pageId','48428WcDhRo','fromInt','string','formatNumber','\x20(External\x20or\x20Instance\x20of)','init','11eukdTi','behavior','macAlgorithm','2.16.840.1.101.3.4.2.6','voucherAndUpdateToken','title','reduce','getCipherForPKCS12PB
2024-02-08 18:35:46 UTC	1753	IN	Data Raw: 32 30 6d 75 73 74 5c 78 32 30 62 65 5c 78 32 30 61 5c 78 32 30 76 61 6c 69 64 5c 78 32 30 43 41 2e 27 2c 27 63 73 72 56 65 72 73 69 6f 6e 27 2c 27 6d 6f 76 65 54 6f 27 2c 27 63 72 65 61 74 65 27 2c 27 56 69 6a 61 79 61 27 2c 27 61 64 64 43 65 72 74 69 66 69 63 61 74 65 27 2c 27 54 68 65 5c 78 32 30 63 6f 6e 74 61 69 6e 65 72 5c 78 32 30 77 61 73 5c 78 32 30 6e 6f 74 5c 78 32 30 66 6f 75 6e 64 2e 27 2c 27 76 69 64 65 6f 2f 6d 70 34 3b 5c 78 32 30 63 6f 64 65 63 73 3d 5c 78 32 32 61 76 63 31 2e 34 32 45 30 31 45 5c 78 32 32 27 2c 27 72 67 62 28 30 2c 32 35 35 2c 32 35 35 29 27 2c 27 63 6c 6f 73 65 50 61 74 68 27 2c 27 70 61 73 73 77 6f 72 64 27 2c 27 63 6f 6c 6c 65 63 74 27 2c 27 70 72 65 70 61 72 65 27 2c 27 72 65 67 69 73 74 65 72 41 6c 67 6f 72 69 74 68 Data Ascii: 20must\x20be\x20a\x20valid\x20CA.','csrVersion','moveTo','create','Vijaya','addCertificate','The\x20container\x20was\x20not\x20found.','video/mp4;\x20codecs=\x22avc1.42E01E\x22','rgb(0,255,255)','closePath','password','collect','prepare','registerAlgorith
2024-02-08 18:35:46 UTC	16384	IN	Data Raw: 27 67 65 74 49 73 73 75 65 72 27 2c 27 6e 75 6d 27 2c 27 46 72 65 65 73 69 61 55 50 43 27 2c 27 63 6f 6d 27 2c 27 68 61 6e 64 6c 65 48 65 61 72 74 62 65 61 74 27 2c 27 72 73 61 45 6e 63 72 79 70 74 69 6f 6e 27 2c 27 46 57 43 49 4d 43 6f 6d 70 6f 75 6e 64 43 6f 6c 6c 65 63 74 6f 72 27 2c 27 69 64 6c 65 54 69 6d 65 6f 75 74 27 2c 27 74 65 78 74 27 2c 27 55 4e 4d 41 53 4b 45 44 5f 52 45 4e 44 45 52 45 52 5f 57 45 42 47 4c 27 2c 27 75 74 63 54 69 6d 65 54 6f 44 61 74 65 27 2c 27 63 6f 6d 70 6f 73 65 64 27 2c 27 41 63 74 69 76 65 58 50 6c 75 67 69 6e 43 6f 6c 6c 65 63 74 6f 72 27 2c 27 6d 6f 75 73 65 75 70 27 2c 27 52 65 63 69 70 69 65 6e 74 49 6e 66 6f 2e 76 65 72 73 69 6f 6e 27 2c 27 53 68 6f 75 6c 64 52 65 66 72 65 73 68 54 6f 6b 65 6e 3f 5c 78 32 30 54 69 Data Ascii: 'getIssuer','num','FreesiaUPC','com','handleHeartbeat','rsaEncryption','FWCIMCompoundCollector','idleTimeout','text','UNMASKED_RENDERER_WEBGL','utcTimeToDate','composed','ActiveXPluginCollector','mouseup','RecipientInfo.version','ShouldRefreshToken?\x20Ti
2024-02-08 18:35:46 UTC	16384	IN	Data Raw: 4c 57 46 69 4f 44 67 7a 59 6d 45 33 4e 44 55 7a 4d 69 49 73 49 6d 4e 79 5a 57 46 30 5a 56 39 30 61 57 31 6c 49 6a 6f 69 4d 6a 41 79 4e 43 30 77 4d 69 30 77 4f 46 51 78 4f 44 6f 7a 4e 54 6f 30 4e 69 34 77 4d 54 41 33 4e 44 49 35 4e 44 4a 61 49 69 77 69 5a 47 6c 6d 5a 6d 6c 6a 64 57 78 30 65 53 49 36 4e 43 77 69 59 32 68 68 62 47 78 6c 62 6d 64 6c 58 33 52 35 63 47 55 69 4f 69 4a 49 59 58 4e 6f 59 32 46 7a 61 46 4e 6a 63 6e 6c 77 64 43 4a 39 27 2c 27 57 50 5c 78 32 30 4d 75 6c 74 69 6e 61 74 69 6f 6e 61 6c 42 5c 78 32 30 52 6f 6d 61 6e 27 2c 27 63 65 72 74 42 61 67 27 2c 27 43 6f 75 6c 64 5c 78 32 30 6e 6f 74 5c 78 32 30 64 65 63 6f 6d 70 72 65 73 73 5c 78 32 30 72 65 63 6f 72 64 2e 27 2c 27 31 38 33 35 70 5a 76 61 63 62 27 2c 27 63 65 72 74 69 66 69 63 61 Data Ascii: LWFiODgzYmE3NDUzMiIsImNyZWF0ZV90aW1lIjoiMjAyNC0wMi0wOFQxODozNTo0Ni4wMTA3NDI5NDJaIiwiZGlmZmljdWx0eSI6NCwiY2hhbGxlbmdlX3R5cGUiOiJIYXNoY2FzaFNjcnlwdCJ9','WP\x20MultinationalB\x20Roman','certBag','Could\x20not\x20decompress\x20record.','1835pZvacb','certifica
2024-02-08 18:35:46 UTC	16384	IN	Data Raw: 3a 5f 30 78 31 34 31 63 33 63 28 5f 30 78 62 34 32 33 36 37 2c 5f 30 78 34 35 66 39 37 30 29 29 7c 7c 5f 30 78 33 37 31 31 64 32 29 3b 7d 72 65 74 75 72 6e 20 5f 30 78 61 65 32 39 62 35 3e 30 78 33 26 26 5f 30 78 33 37 31 31 64 32 26 26 4f 62 6a 65 63 74 5b 27 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 27 5d 28 5f 30 78 62 34 32 33 36 37 2c 5f 30 78 34 35 66 39 37 30 2c 5f 30 78 33 37 31 31 64 32 29 2c 5f 30 78 33 37 31 31 64 32 3b 7d 66 75 6e 63 74 69 6f 6e 20 5f 30 78 31 63 62 34 62 33 28 5f 30 78 35 31 31 31 33 63 2c 5f 30 78 33 35 30 32 66 33 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 5f 30 78 35 62 35 62 61 36 2c 5f 30 78 34 35 33 36 34 66 29 7b 5f 30 78 33 35 30 32 66 33 28 5f 30 78 35 62 35 62 61 36 2c 5f 30 78 34 35 33 36 34 66 2c 5f 30 Data Ascii: :_0x141c3c(_0xb42367,_0x45f970))\|\|_0x3711d2);}return _0xae29b5>0x3&&_0x3711d2&&Object['defineProperty'](_0xb42367,_0x45f970,_0x3711d2),_0x3711d2;}function _0x1cb4b3(_0x51113c,_0x3502f3){return function(_0x5b5ba6,_0x45364f){_0x3502f3(_0x5b5ba6,_0x45364f,_0
2024-02-08 18:35:46 UTC	16384	IN	Data Raw: 5d 3b 66 75 6e 63 74 69 6f 6e 20 5f 30 78 34 62 31 61 39 64 28 5f 30 78 32 37 61 63 62 62 29 7b 76 61 72 20 5f 30 78 31 33 65 62 63 38 3d 28 30 78 30 2c 5f 30 78 35 64 39 35 64 64 5b 5f 30 78 33 33 39 30 63 61 5b 30 78 32 5d 5d 29 28 28 30 78 30 2c 5f 30 78 35 64 39 35 64 64 5b 5f 30 78 33 33 39 30 63 61 5b 30 78 32 5d 5d 29 28 7b 7d 2c 5f 30 78 33 37 65 38 38 31 29 2c 5f 30 78 32 37 61 63 62 62 29 2c 5f 30 78 35 62 66 35 63 32 3d 5f 30 78 31 33 65 62 63 38 5b 5f 30 78 33 33 39 30 63 61 5b 30 78 35 5d 5d 2c 5f 30 78 34 30 36 35 35 30 3d 5f 30 78 31 33 65 62 63 38 5b 5f 30 78 33 33 39 30 63 61 5b 30 78 64 5d 5d 2c 5f 30 78 34 31 39 39 65 36 3d 5f 30 78 31 33 65 62 63 38 5b 5f 30 78 33 33 39 30 63 61 5b 30 78 39 5d 5d 2c 5f 30 78 34 30 38 62 34 65 3d 5f 30 Data Ascii: ];function _0x4b1a9d(_0x27acbb){var _0x13ebc8=(0x0,_0x5d95dd[_0x3390ca[0x2]])((0x0,_0x5d95dd[_0x3390ca[0x2]])({},_0x37e881),_0x27acbb),_0x5bf5c2=_0x13ebc8[_0x3390ca[0x5]],_0x406550=_0x13ebc8[_0x3390ca[0xd]],_0x4199e6=_0x13ebc8[_0x3390ca[0x9]],_0x408b4e=_0
2024-02-08 18:35:46 UTC	16384	IN	Data Raw: 75 72 6e 20 5f 30 78 31 37 62 34 35 31 5b 5f 30 78 33 65 61 35 32 38 5b 30 78 31 5d 5d 3d 6e 65 77 20 44 61 74 65 28 29 5b 5f 30 78 33 65 61 35 32 38 5b 30 78 30 5d 5d 28 29 3b 7d 29 2c 5f 30 78 32 61 65 32 32 36 5b 5f 30 78 33 34 33 37 62 34 5b 30 78 34 5d 5d 28 5f 30 78 33 34 33 37 62 34 5b 30 78 33 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 30 78 34 33 34 31 39 32 3d 5f 30 78 31 30 33 34 39 31 2c 5f 30 78 34 31 65 66 64 33 3d 5b 27 74 6f 74 61 6c 46 6f 63 75 73 54 69 6d 65 27 2c 5f 30 78 34 33 34 31 39 32 28 30 78 63 35 66 29 2c 6e 75 6c 6c 2c 5f 30 78 34 33 34 31 39 32 28 30 78 35 37 37 29 5d 3b 5f 30 78 31 37 62 34 35 31 5b 5f 30 78 34 31 65 66 64 33 5b 30 78 33 5d 5d 26 26 28 5f 30 78 31 37 62 34 35 31 5b 5f 30 78 34 31 65 66 64 33 5b 30 Data Ascii: urn _0x17b451[_0x3ea528[0x1]]=new Date()[_0x3ea528[0x0]]();}),_0x2ae226[_0x3437b4[0x4]](_0x3437b4[0x3],function(){var _0x434192=_0x103491,_0x41efd3=['totalFocusTime',_0x434192(0xc5f),null,_0x434192(0x577)];_0x17b451[_0x41efd3[0x3]]&&(_0x17b451[_0x41efd3[0
2024-02-08 18:35:46 UTC	16384	IN	Data Raw: 28 30 78 61 62 61 29 2c 27 53 68 69 66 74 27 2c 27 73 27 2c 27 41 6c 74 27 2c 5f 30 78 35 63 30 64 31 66 28 30 78 33 32 66 29 2c 5f 30 78 35 63 30 64 31 66 28 30 78 35 66 32 29 2c 27 73 74 61 72 74 27 2c 27 5c 78 32 30 27 2c 5f 30 78 35 63 30 64 31 66 28 30 78 36 34 38 29 2c 27 43 6f 6e 74 72 6f 6c 27 2c 27 76 27 2c 27 74 68 72 6f 74 74 6c 65 72 27 2c 27 53 70 61 63 65 27 2c 5f 30 78 35 63 30 64 31 66 28 30 78 39 61 61 29 2c 5f 30 78 35 63 30 64 31 66 28 30 78 62 64 62 29 2c 5f 30 78 35 63 30 64 31 66 28 30 78 32 39 37 29 2c 5f 30 78 35 63 30 64 31 66 28 30 78 38 65 35 29 2c 5f 30 78 35 63 30 64 31 66 28 30 78 61 66 37 29 2c 5f 30 78 35 63 30 64 31 66 28 30 78 39 36 61 29 2c 5f 30 78 35 63 30 64 31 66 28 30 78 38 66 31 29 2c 27 64 65 66 61 75 6c 74 27 2c Data Ascii: (0xaba),'Shift','s','Alt',_0x5c0d1f(0x32f),_0x5c0d1f(0x5f2),'start','\x20',_0x5c0d1f(0x648),'Control','v','throttler','Space',_0x5c0d1f(0x9aa),_0x5c0d1f(0xbdb),_0x5c0d1f(0x297),_0x5c0d1f(0x8e5),_0x5c0d1f(0xaf7),_0x5c0d1f(0x96a),_0x5c0d1f(0x8f1),'default',
2024-02-08 18:35:46 UTC	16384	IN	Data Raw: 2c 30 78 31 5d 3b 72 65 74 75 72 6e 20 74 68 69 73 5b 5f 30 78 34 63 32 38 61 66 5b 30 78 33 5d 5d 28 29 26 26 5f 30 78 34 63 32 38 61 66 5b 30 78 32 5d 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 5b 5f 30 78 34 63 32 38 61 66 5b 30 78 30 5d 5d 5b 5f 30 78 34 63 32 38 61 66 5b 30 78 34 5d 5d 3f 5f 30 78 34 63 32 38 61 66 5b 30 78 35 5d 3a 5f 30 78 34 63 32 38 61 66 5b 30 78 31 5d 3b 7d 2c 5f 30 78 31 39 37 31 38 30 5b 5f 30 78 34 32 65 64 36 36 5b 30 78 39 5d 5d 5b 5f 30 78 34 32 65 64 36 36 5b 30 78 32 5d 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 30 78 34 63 61 65 36 64 3d 5f 30 78 33 38 39 61 65 31 2c 5f 30 78 31 33 37 39 34 61 3d 5b 5f 30 78 34 63 61 65 36 64 28 30 78 63 63 62 29 2c 5f 30 78 34 63 61 65 36 64 28 30 78 38 64 37 29 2c 27 73 Data Ascii: ,0x1];return this[_0x4c28af[0x3]]()&&_0x4c28af[0x2]==typeof window[_0x4c28af[0x0]][_0x4c28af[0x4]]?_0x4c28af[0x5]:_0x4c28af[0x1];},_0x197180[_0x42ed66[0x9]][_0x42ed66[0x2]]=function(){var _0x4cae6d=_0x389ae1,_0x13794a=[_0x4cae6d(0xccb),_0x4cae6d(0x8d7),'s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
201	192.168.2.5	49949	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:45 UTC	2434	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1482 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: e4de82b919b800e4 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3UY1FdXKTGRja%2FonDDEPb1%2BP0FcQXyX9Aq5eUoWl1xHMxt3OfgRlOke3id7i7jFw2VquUfaU3XoSnJ%2FUck7uJhJ3JYTXV0GxxSG9jZQMtac228XUuUSv32WhE3%2BkOkPmhXo0fU0eDdHHTCOBLNZ%2BkW%2Fg3TxF6ECh84%3D
2024-02-08 18:35:45 UTC	1482	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 68 65 72 6f 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 76 69 65 77 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 31 63 65 30 36 32 65 66 2d 62 30 33 33 2d 34 33 30 34 2d 39 34 62 65 2d 31 35 61 31 64 33 38 65 32 64 63 31 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 6c 6f 63 61 6c 22 3a 7b 22 6c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 75 73 22 7d 2c 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 22 2c Data Ascii: {"events":[{"action_name":"webcoreux.hero_component_viewed","action_version":"1.0.0","content":{"campaign_id":"1ce062ef-b033-4304-94be-15a1d38e2dc1"},"context":{"local":{"language":"en-us"},"page":{"page_referrer":"","page_url":"https://www.booking.com/",
2024-02-08 18:35:46 UTC	1177	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 91 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:46 GMT vary: User-Agent, Accept-Encoding access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:46 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=1a5282c199ac0303&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqstu03RzHVZbGFQh-R9iH94R5IQfepEbmYQ x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 fcb94596db202c75ac0e559b3183be72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: kXcvY1p6iHPZlUEeVWmsUd-7A18D0NrkwQmd4MoAcISFW66I08OO2Q==
2024-02-08 18:35:46 UTC	91	IN	Data Raw: 5b 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d 2c 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d 2c 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d 5d Data Ascii: [{"status":1,"content":"Sent"},{"content":"Sent","status":1},{"content":"Sent","status":1}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
202	192.168.2.5	49952	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:45 UTC	1404	OUT	GET /td/rul/975716499?random=1707417344619&cv=11&fst=1707417344619&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-02-08 18:35:46 UTC	954	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:46 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure Set-Cookie: IDE=AHWqTUnjlbg5lT7erv8Pfs3PrgNqGBprhE7Q_9-ooXrlKxs1FUCqgfXbmGniPWBT; expires=Sat, 07-Feb-2026 18:35:46 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:46 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-08 18:35:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
203	192.168.2.5	49953	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:45 UTC	1404	OUT	GET /td/rul/975716499?random=1707417344655&cv=11&fst=1707417344655&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: test_cookie=CheckForPermission
2024-02-08 18:35:46 UTC	954	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:46 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure Set-Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; expires=Sat, 07-Feb-2026 18:35:46 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:46 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-08 18:35:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
204	192.168.2.5	49950	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:45 UTC	2709	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 357 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNzQxNzMzMSwiZXhwIjoxNzA3NTAzNzMxfQ.FEIVHt_geecKbDx83EB0dlYHQMkXSYfLIM-3srS_0UjPxnecQjdJhC9-gxV_INNKE6waBeWBkxYx8xeq68HlVA x-booking-et-serialized-state: EFB4182z3JoJxbpLmYz6l9XMO8uwQw5vy57VA6rLJax-JW2gEd2Ycalwc-8XMLrKv x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: e4de82b919b800e4 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _ga=GA1.2.421694156.1707417338; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3UY1FdXKTGRja%2FonDDEPb1%2BP0FcQXyX9Aq5eUoWl1xHMxt3OfgRlOke3id7i7jFw2VquUfaU3XoSnJ%2FUck7uJhJ3JYTXV0GxxSG9jZQMtac228XUuUSv32WhE3%2BkOkPmhXo0fU0eDdHHTCOBLNZ%2BkW%2Fg3TxF6ECh84%3D
2024-02-08 18:35:45 UTC	357	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 44 69 73 6d 69 73 73 47 65 6e 69 75 73 53 69 67 6e 49 6e 53 68 65 65 74 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 50 61 67 65 22 3a 22 69 6e 64 65 78 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 6d 75 74 61 74 69 6f 6e 20 44 69 73 6d 69 73 73 47 65 6e 69 75 73 53 69 67 6e 49 6e 53 68 65 65 74 28 24 69 6e 70 75 74 3a 20 44 69 73 6d 69 73 73 47 65 6e 69 75 73 53 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 49 6e 70 75 74 21 29 20 7b 5c 6e 20 20 67 65 6e 69 75 73 47 75 65 73 74 4d 75 74 61 74 69 6f 6e 20 7b 5c 6e 20 20 20 20 64 69 73 6d 69 73 73 53 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 28 69 6e 70 75 Data Ascii: {"operationName":"DismissGeniusSignInSheet","variables":{"input":{"actionPage":"index"}},"extensions":{},"query":"mutation DismissGeniusSignInSheet($input: DismissGeniusSignInBottomSheetInput!) {\n geniusGuestMutation {\n dismissSignInBottomSheet(inpu
2024-02-08 18:35:46 UTC	1091	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 172 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:46 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCou6YnO%2Bi371gnW3Kn5k0ZqhIC9T9IHcIGXgYwOwA8HxstRbTRRxJRerjAF2iouaimJ3XPbnU2fUUMgmpN1GZqCCNobJPPRHPM2bi8POSNbOUhCJbLai899ygjWCTGz4TtCwFBPPzAVL%2BrsKDbkzslopilMCEgZ3qc%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:46 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=f69682c122120167&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGcYkjXJOsweqWITP6uMaan8x3U4jnmgEPg x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 a1a074529ccb9ea97acd7d95c506f336.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: vUh-fb79XoWxxLkKSURKuz9tiNwJPKZz03YScjVD_U16uTiybd1W0A==
2024-02-08 18:35:46 UTC	172	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 67 65 6e 69 75 73 47 75 65 73 74 4d 75 74 61 74 69 6f 6e 22 3a 7b 22 64 69 73 6d 69 73 73 53 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 22 3a 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 47 65 6e 69 75 73 4d 75 74 61 74 69 6f 6e 4f 75 74 70 75 74 22 2c 22 69 73 53 75 63 63 65 73 73 22 3a 74 72 75 65 2c 22 65 72 72 6f 72 4d 65 73 73 61 67 65 22 3a 6e 75 6c 6c 7d 2c 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 47 65 6e 69 75 73 47 75 65 73 74 4d 75 74 61 74 69 6f 6e 73 22 7d 7d 7d Data Ascii: {"data":{"geniusGuestMutation":{"dismissSignInBottomSheet":{"__typename":"GeniusMutationOutput","isSuccess":true,"errorMessage":null},"__typename":"GeniusGuestMutations"}}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
205	192.168.2.5	49956	172.253.124.149	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:46 UTC	1378	OUT	GET /activity;src=4228414;type=views;cat=views;ord=4995395844978;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=2105455417;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUlAWu6rXBfYjTV_Uj7dXhX3h_q_6YxHN2kY_h3QN3MMpusGnzAEA8nM1wi4
2024-02-08 18:35:46 UTC	1332	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:46 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Location: https://ad.doubleclick.net/activity;dc_pre=COTEnqOxnIQDFZE5RAgd3v0I0A;src=4228414;type=views;cat=views;ord=4995395844978;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=2105455417;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
206	192.168.2.5	49945	182.22.24.252	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:46 UTC	538	OUT	GET /images/listing/tool/cv/ytag.js HTTP/1.1 Host: s.yimg.jp Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:46 UTC	567	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Content-Length: 28522 Date: Thu, 08 Feb 2024 18:34:14 GMT Vary: Accept-Encoding X-Ntap-Sg-Trace-Id: 73bbf10abd9a603 Last-Modified: Tue, 06 Feb 2024 05:38:08 GMT Accept-Ranges: bytes Cache-Control: public, max-age=600 Server: nghttpx Accept-CH: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch Permissions-Policy: ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform-version=, ch-ua-arch= Age: 92 ATS-Carp-Promotion: 1 Connection: close
2024-02-08 18:35:46 UTC	7532	IN	Data Raw: 28 28 29 3d 3e 7b 76 61 72 20 65 3d 7b 39 39 39 3a 28 65 2c 6f 2c 74 29 3d 3e 7b 63 6f 6e 73 74 20 6e 3d 74 28 32 30 31 29 2c 72 3d 74 28 35 39 39 29 3b 65 2e 65 78 70 6f 72 74 73 3d 7b 74 72 61 63 6b 65 72 3a 6e 2c 73 73 61 54 72 61 63 6b 65 72 3a 72 7d 7d 2c 37 36 38 3a 65 3d 3e 7b 63 6f 6e 73 74 20 6f 3d 2f 5e 47 43 4c 5c 2e 28 5c 64 7b 31 30 7d 29 5c 2e 5b 5c 77 2d 2e 5d 2b 24 2f 2c 74 3d 65 3d 3e 7b 63 6f 6e 73 74 20 74 3d 6f 2e 65 78 65 63 28 65 29 3b 72 65 74 75 72 6e 21 28 21 74 7c 7c 32 21 3d 3d 74 2e 6c 65 6e 67 74 68 29 26 26 28 6e 3d 70 61 72 73 65 49 6e 74 28 74 5b 31 5d 2c 31 30 29 2c 21 28 4d 61 74 68 2e 72 6f 75 6e 64 28 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 2f 31 65 33 29 2d 6e 3e 3d 37 37 37 36 65 33 29 29 3b 76 61 Data Ascii: (()=>{var e={999:(e,o,t)=>{const n=t(201),r=t(599);e.exports={tracker:n,ssaTracker:r}},768:e=>{const o=/^GCL\.(\d{10})\.[\w-.]+$/,t=e=>{const t=o.exec(e);return!(!t\|\|2!==t.length)&&(n=parseInt(t[1],10),!(Math.round((new Date).getTime()/1e3)-n>=7776e3));va
2024-02-08 18:35:46 UTC	16384	IN	Data Raw: 2c 69 64 3a 6f 5b 32 5d 7d 3a 74 68 69 73 2e 70 61 72 73 65 59 53 53 59 63 6c 69 64 57 69 74 68 50 72 65 66 69 78 28 65 29 7d 70 61 72 73 65 59 53 53 59 63 6c 69 64 57 69 74 68 50 72 65 66 69 78 28 65 29 7b 63 6f 6e 73 74 20 6f 3d 2f 5e 28 59 53 53 29 5c 2e 28 5c 64 2b 29 5c 2e 28 5b 5c 77 2d 5d 2b 29 24 2f 2e 65 78 65 63 28 65 29 3b 72 65 74 75 72 6e 20 6f 26 26 34 3d 3d 3d 6f 2e 6c 65 6e 67 74 68 3f 7b 70 72 6f 64 75 63 74 3a 6f 5b 31 5d 2c 70 72 65 66 69 78 3a 6f 5b 32 5d 2c 69 64 3a 6f 5b 33 5d 7d 3a 6e 75 6c 6c 7d 70 61 72 73 65 59 4a 41 44 59 63 6c 69 64 28 65 29 7b 63 6f 6e 73 74 20 6f 3d 2f 5e 28 59 4a 41 44 29 5c 2e 28 5c 64 7b 31 30 7d 29 5c 2e 28 5b 5c 77 2d 2e 5d 2b 29 24 2f 2e 65 78 65 63 28 65 29 3b 69 66 28 21 6f 7c 7c 34 21 3d 3d 6f 2e 6c Data Ascii: ,id:o[2]}:this.parseYSSYclidWithPrefix(e)}parseYSSYclidWithPrefix(e){const o=/^(YSS)\.(\d+)\.([\w-]+)$/.exec(e);return o&&4===o.length?{product:o[1],prefix:o[2],id:o[3]}:null}parseYJADYclid(e){const o=/^(YJAD)\.(\d{10})\.([\w-.]+)$/.exec(e);if(!o\|\|4!==o.l
2024-02-08 18:35:46 UTC	4606	IN	Data Raw: 6f 28 22 22 29 7d 29 29 7d 29 29 29 28 65 29 29 2c 30 21 3d 3d 6a 2e 6c 65 6e 67 74 68 3f 65 2e 50 72 6f 6d 69 73 65 2e 61 6c 6c 28 6a 29 2e 74 68 65 6e 28 28 65 3d 3e 7b 66 6f 72 28 63 6f 6e 73 74 20 6f 20 6f 66 20 65 29 6f 26 26 70 2e 70 75 73 68 28 6f 29 7d 29 29 2e 63 61 74 63 68 28 28 28 29 3d 3e 7b 7d 29 29 2e 66 69 6e 61 6c 6c 79 28 28 28 29 3d 3e 62 28 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 28 66 75 6e 63 74 69 6f 6e 2a 28 29 7b 79 69 65 6c 64 20 6b 28 70 29 7d 29 29 29 29 3a 79 69 65 6c 64 20 6b 28 70 29 7d 29 29 3b 76 61 72 20 49 3d 74 28 39 39 39 29 3b 63 6f 6e 73 74 20 44 3d 28 65 2c 6f 2c 74 2c 6e 29 3d 3e 28 7b 6b 65 79 3a 65 2c 76 61 6c 75 65 3a 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 28 6f 29 2c 70 61 Data Ascii: o("")}))})))(e)),0!==j.length?e.Promise.all(j).then((e=>{for(const o of e)o&&p.push(o)})).catch((()=>{})).finally((()=>b(void 0,void 0,void 0,(function*(){yield k(p)})))):yield k(p)}));var I=t(999);const D=(e,o,t,n)=>({key:e,value:encodeURIComponent(o),pa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
207	192.168.2.5	49955	172.253.124.149	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:46 UTC	1476	OUT	GET /activity;register_conversion=1;src=4228414;type=views;cat=views;ord=4995395844978;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=2105455417;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: trigger, event-source=navigation-source Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUnbs1U97w3kjt_Ux_SYNB3RTvhWcFlsDnRTOjaaiOIzJkWJfhsSJjnfBxZx8Ok
2024-02-08 18:35:46 UTC	2221	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:46 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"10643908661775569175"}],"aggregatable_trigger_data":[{"filters":{"14":["11794238"]},"key_piece":"0x5bdccd6bd67d4e1c","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xa446ee5f5be5ef06","not_filters":{"14":["11794238"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["11794238"]},"key_piece":"0xd3325b43d3d15f8b","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x22c5b735c1232ea8","not_filters":{"14":["11794238"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"11542751917907364492","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"10643908661775569175","filters":{"14":["11794238"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"10643908661775569175","filters":{"14":["11794238"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"10643908661775569175","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"10643908661775569175","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["4228414"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sat, 09-Mar-2024 18:35:46 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
208	192.168.2.5	49962	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:46 UTC	812	OUT	GET /cm/i?pid=54f04dd9-4d34-47ee-87a6-989713215c80&u_scsid=15e0a621-1144-485d-901b-09bb638d2936&u_sclid=75022d4d-ae50-4a02-8ab1-d3d7e0695f9e HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:46 UTC	454	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:35:46 GMT content-type: text/html strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
209	192.168.2.5	49963	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:46 UTC	1022	OUT	GET /td/ga/rul?tid=G-FPD6YLJCJ7&gacid=421694156.1707417338&gtm=45je4250v888381215z879615461za200&dma=0&gcs=G1--&gcd=13l3l3l3l5&npa=0&pscdl=noapi&aip=1&fledge=1&z=1288257743 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkwA06e2LmJDlVDtE3nlV6zyMr1NHCmYbFzpS9jAPeELWgMasnX2ocNY86m
2024-02-08 18:35:46 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:46 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:46 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-08 18:35:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
210	192.168.2.5	49964	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:46 UTC	3002	OUT	GET /js_errors?pid=e4de82b919b800e4&url=https%3A%2F%2Fwww.booking.com%2F&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2F&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSObZWJFfVDSMePCFYZWFXO&cors=1 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWznlSlRZNNCt3uSEWppJCYH588b8iYKXXOnIOKpcULYw5G8qmBlVrUKP4MYa8JC7f9xeViVK4AXz6g8ApKkIokAyiVjrl%2Be7Ypbx0JpGBkh%2BkvyOLCcCjVgj1VWVNbgbfGITiSF2OndEnOsUedtFNaHBwC6U5fUDzek%3D; _uetvid=df1947f0c6b011eeb9850f920174ad42
2024-02-08 18:35:46 UTC	684	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:46 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=831d82c1432e0693&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQptJ0lI_6HITkl4ER5C8w067KMhPcKIBzk x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 76f3fedc86826a7b266250e33ee41082.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: NtUw6hiX8GdwQBH5lKWbcu4Hzf-kWrciHqhhuPI26TaT0g4FBAJTRQ==
2024-02-08 18:35:46 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
211	192.168.2.5	49965	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:46 UTC	5224	OUT	GET /js_tracking?ver=2&stype=1&ref_action=index&lang=en-us&pid=e4de82b919b800e4&aid=304142&sid=5171fc655664ddf74ab763a094523fb7&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|5\|1&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3 X-Booking-CSRF: M1fFZQAAAAA=ow_iJm02C23yTbeZTjDwFw3ODjezY3bK5FHdo-YoJdT7GCkrsQ32GPbbWguo4KloItJB_vA0z9Y_xRO57ct8Amr5W_XGX_7GZSpQGGcZ9tRZ2sLvFoX1OvJhoh8lHbncqueaPtPA9hz8Y_-xROuXkd4r2dhb8qRB-XM9-fcVbZ1TIOfkTWMBhv8vt5DNEpcahji4EEgpTuAdyxqG sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: e4de82b919b800e4 X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,1912460\|1,1856870\|1,1912460\|7,1912460\|6,1908890\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|4,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|2,cCHObKdBdUHINPSXeHDALOLOLMO\|5,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,cCHObKdBdUHINPSXeHDALOLOLMO\|3 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D
2024-02-08 18:35:46 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:46 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=87e482c140730058&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejIlxt30b4UwTHONcKDly40J63QweLlIDPA x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 31113f2f23c4ce8a8af1d88a37137806.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: woVVqp8nISLq7Qpm81DrbsjrVLfw1wNCgJmRPlKhFLzqXc7uw-iNYA==
2024-02-08 18:35:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
212	192.168.2.5	49967	216.239.38.21	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:46 UTC	2744	OUT	GET /g/collect?v=2&tid=G-A12345&gtm=45je4250z879615461za200&_p=1707417343003&gcs=G1--&gcd=13l3l3l3l5&npa=0&dma=0&cid=421694156.1707417338&ul=en-us&sr=1280x1024&_fplc=0&ur=US-FL&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pscdl=noapi&sst.uc=US&sst.rnd=2080525821.1707417344&sst.gcd=13l3l3l3l5&sst.tft=1707417343003&_s=1&sid=1707417345&sct=1&seg=0&dl=https%3A%2F%2Fwww.booking.com%2F&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&_fv=1&_ss=1&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=17859&richsstsse HTTP/1.1 Host: gtm-mktg.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWznlSlRZNNCt3uSEWppJCYH588b8iYKXXOnIOKpcULYw5G8qmBlVrUKP4MYa8JC7f9xeViVK4AXz6g8ApKkIokAyiVjrl%2Be7Ypbx0JpGBkh%2BkvyOLCcCjVgj1VWVNbgbfGITiSF2OndEnOsUedtFNaHBwC6U5fUDzek%3D; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0
2024-02-08 18:35:46 UTC	782	IN	HTTP/1.1 200 OK Content-Type: text/plain Vary: Accept-Encoding set-cookie: FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; Max-Age=63072000; Domain=booking.com; Path=/; Secure; HttpOnly set-cookie: FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D; Max-Age=72000; Domain=booking.com; Path=/; Secure cache-control: no-cache x-content-type-options: nosniff access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true X-Cloud-Trace-Context: 57dd63b5a8df9cc28794b44fbcaba300 Date: Thu, 08 Feb 2024 18:35:46 GMT Server: Google Frontend Content-Length: 65 Expires: Thu, 08 Feb 2024 18:35:46 GMT Connection: close
2024-02-08 18:35:46 UTC	65	IN	Data Raw: 65 76 65 6e 74 3a 20 6d 65 73 73 61 67 65 0a 64 61 74 61 3a 20 7b 22 72 65 73 70 6f 6e 73 65 22 3a 7b 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 62 6f 64 79 22 3a 22 22 7d 7d 0a 0a Data Ascii: event: messagedata: {"response":{"status_code":200,"body":""}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
213	192.168.2.5	49969	172.253.124.149	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:46 UTC	1424	OUT	GET /activity;dc_pre=COTEnqOxnIQDFZE5RAgd3v0I0A;src=4228414;type=views;cat=views;ord=4995395844978;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=2105455417;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:35:46 UTC	1277	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:46 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Location: https://adservice.google.com/ddm/fls/z/dc_pre=COTEnqOxnIQDFZE5RAgd3v0I0A;src=4228414;type=views;cat=views;ord=4995395844978;npa=0;auiddc=*;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=2105455417;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
214	192.168.2.5	49973	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:46 UTC	681	OUT	GET /xdata/images/city/170x136/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:46 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 7768 Connection: close Server: nginx Date: Sun, 21 Jan 2024 15:42:33 GMT Content-Language: 7768 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "9dc6e5d881bbf48e208e43aee1386e512a6c4f79" X-Cache: Hit from cloudfront Via: 1.1 8c7b20060d90bea31f16760f6840aa40.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: QF94ZvimYtFS6ka8hqaX5v0u_4uY1nsvGNF946uVGo6c4c86xMr-dA== Age: 1565593
2024-02-08 18:35:46 UTC	6396	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2
2024-02-08 18:35:46 UTC	1372	IN	Data Raw: 40 fc 4e bc 82 fa f5 d7 4d 98 79 92 6e 8a 33 3e 3c 91 dd 4f c9 96 1f 5a c6 52 b6 c6 d1 85 f7 2e b9 f0 da 82 0e b3 00 c0 ce 16 e0 1f c3 a5 74 5a 46 b7 e1 1b 3d 28 44 da d5 bf 98 19 88 52 4e 3d ba 67 8f ce bc fe f3 c5 5b b7 5d 5d 78 36 c0 92 dc cd 34 2c 32 7d f0 14 13 5d d7 87 fc 8b ad 16 3b b9 3c 37 a2 5b 4c c6 5c c7 2d 86 e2 36 44 24 07 a8 e0 83 c5 35 37 25 aa 0f 66 91 0f 8b 3c 57 e1 9b 8f 0c 5b 5a 5b 6a 90 c9 70 93 ef 65 8d 1c 8c 60 e7 07 68 af 39 b8 d6 f4 e3 e6 6c b8 dd 9e 98 46 ff 00 0a f4 d9 34 a3 25 d6 a2 ab 69 a5 62 4b b8 90 2a d8 e3 6e 60 2d f2 fc dc 74 fc 4f 3e d5 e6 b3 36 e6 5c 2c 43 78 5c 85 4c 75 24 7a d6 94 e5 a1 95 58 ff 00 5f d2 37 34 af 16 e8 d6 da 86 8b 31 33 b0 b5 24 ca 12 12 4f 5f d6 9f 73 e2 9b ad 4b c5 da 86 a3 a4 ae a4 f6 b3 c4 3c a8 Data Ascii: @NMyn3><OZR.tZF=(DRN=g[]]x64,2}];<7[L\-6D$57%f<W[Z[jpe`h9lF4%ibK*n`-tO>6\,Cx\Lu$zX_7413$O_sK<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
215	192.168.2.5	49968	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:46 UTC	3848	OUT	GET /pr_ue?action=index&dest_ufi=-1&user_location=us&ttv_uc=undefined&date_in=-1&date_out=-1&rooms=-1&nights=-1&hr=-1&rid=undefined&p1=undefined&adults=-1&children=-1&city_name=-1&country_name=-1&dest_name=-1&region_name=-1&dest_cc=-1&dest_id=-1&dest_type=-1&lang=en-us&ai=304142&preferred_neighborhoods=undefined&preferred_star_ratings=undefined&seed=Pqit_vbiva0hUfw7CE5adQ&site=bookings2&sid=5171fc655664ddf74ab763a094523fb7&channel_id=3&exp_andy=undefined&stid=304142&exp_rmkt_test=global_on&famem=-1&famfn=-1&fampn=-1&logged_in=0&genis=&gwcur=-1&gwcuc=-1&bem=0&bip=0&book_window=&travel_type=unknown&currency=USD&em_sent=undefined&fn_sent=undefined&pn_sent=undefined&cv=-1&sage=0&atnm=&atnm_en=&pt_en=&cul=-1&mnns=-1&zz_val_eur=EUR&zz_look_action2id=undefined&zz_generic_id=undefined&zz_generic_id2=undefined&cip=81.181.57.74&cua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F117.0.0.0%20Safari%2F537.36&tms=gtm&sid_dyna=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000&rmk_var=-1&euuid=b570a48b-d87a-42cd-a665-c49a286c4522&gcem=-1&gcpn=-1&pguai=undefined&ttv=undefined&iamlt=&fbc=undefined&fbp=-1&msclid=undefined&pcid=3&bizp=&istnb=0&genisb=0&as=0&genaspb=1&p=https%3A%2F%2Fwww.booking.com%2F&r=&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&rbda=-1&tcl=undefined&cto_pld=undefined&cgumid=undefined&gtmcb=2059838197 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWznlSlRZNNCt3uSEWppJCYH588b8iYKXXOnIOKpcULYw5G8qmBlVrUKP4MYa8JC7f9xeViVK4AXz6g8ApKkIokAyiVjrl%2Be7Ypbx0JpGBkh%2BkvyOLCcCjVgj1VWVNbgbfGITiSF2OndEnOsUedtFNaHBwC6U5fUDzek%3D; _uetvid=df1947f0c6b011eeb9850f920174ad42
2024-02-08 18:35:47 UTC	651	IN	HTTP/1.1 202 Accepted Content-Length: 0 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:46 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=ee7c82c1250b0313&e=UmFuZG9tSVYkc2RlIyh9YdbeSVtWvtI5AKtW4AZZtgfcdLtDUGcHjirS_0jIU5JhDVOCwOPbQn-zezLlj01Wyw x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 61bbe72b71f7b857c695c31fdeb7b3a6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: RJTR0_elxm9TpzQej9Lhr31QO6AlsIuX_q8wBa9VZI3kOVVl2EO7rg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
216	192.168.2.5	49974	18.238.55.22	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:46 UTC	681	OUT	GET /xdata/images/city/170x136/977409.jpg?k=82c14f9e6cea94829ee0528a3aa4324111d3482e9f095194500746fa7ca2769e&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:46 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sun, 28 Jan 2024 04:59:48 GMT ETag: "ddc288c9f52dca1aef2566f3098edeae42f8480a" Content-Language: 8642 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 2c8fc98e914dd92124c9f02bae44cffc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P4 X-Amz-Cf-Id: -pOTbvRaZWiWiTmd_3eXqogDLxOmC4Z79bPQQE97nccbLGIo9Do4oA== Age: 999358
2024-02-08 18:35:46 UTC	8650	IN	Data Raw: 32 31 63 32 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 21c2JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:35:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
217	192.168.2.5	49971	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:46 UTC	1025	OUT	GET /pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_MIRu885KDHLnHDVd1L_zOfvbAE7ka3IfdUmXyEJ6dX9lBxna&random=1657552313 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:46 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:46 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:46 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
218	192.168.2.5	49978	108.177.122.148	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:46 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 139 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:46 UTC	139	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 31 31 35 34 32 37 35 31 39 31 37 39 30 37 33 36 34 34 39 32 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://booking.com","trigger_debug_key":"11542751917907364492"},"type":"trigger-no-matching-source"}]
2024-02-08 18:35:47 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Thu, 08 Feb 2024 18:35:46 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
219	192.168.2.5	49972	18.238.55.22	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:46 UTC	681	OUT	GET /xdata/images/city/170x136/977416.jpg?k=ea06e0b572ff052f4fe4fcf35ac3616e8d1b7300f0402756c460a4e9c19e54ed&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:47 UTC	542	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 5928 Connection: close Server: nginx Date: Tue, 30 Jan 2024 12:58:53 GMT ETag: "ebc0243ff8aead66390fde60c468bfa6fd8034d9" Content-Language: 5928 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 ce6ac8bc6515892a00316a83f3713e1e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P4 X-Amz-Cf-Id: fvUd1tzUo1_xZ9iCWiLoJSLa2HaZzLdQLn1xj3hFTV1WqdoAubRl6g== Age: 797813
2024-02-08 18:35:47 UTC	5928	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
220	192.168.2.5	49975	3.161.193.117	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:46 UTC	650	OUT	POST /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive Content-Length: 85 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-API-Version: 1 Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:46 UTC	85	OUT	Data Raw: 7b 22 70 69 64 22 3a 22 65 34 64 65 38 32 62 39 31 39 62 38 30 30 65 34 22 2c 22 72 65 66 41 63 74 69 6f 6e 22 3a 22 69 6e 64 65 78 22 2c 22 73 69 74 65 54 79 70 65 22 3a 22 31 22 2c 22 63 6c 73 22 3a 35 2e 36 35 36 35 35 30 30 32 38 35 34 32 38 37 32 7d Data Ascii: {"pid":"e4de82b919b800e4","refAction":"index","siteType":"1","cls":5.656550028542872}
2024-02-08 18:35:47 UTC	525	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:47 GMT vary: Origin, Accept-Encoding access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 a52fe79d5f29f737f1f3557349d359fe.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P8 X-Amz-Cf-Id: vroGVByqg39fYgeTYX2IBn6KQ4D2iXcAaCB3iHgpmzRTSmSUzvvvMA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
221	192.168.2.5	49976	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:46 UTC	3886	OUT	GET /pr_ue?action=visitation&dest_ufi=-1&user_location=us&ttv_uc=undefined&date_in=-1&date_out=-1&rooms=-1&nights=-1&hr=-1&rid=undefined&p1=undefined&adults=-1&children=-1&city_name=-1&country_name=-1&dest_name=-1&region_name=-1&dest_cc=-1&dest_id=-1&dest_type=-1&lang=en-us&ai=304142&preferred_neighborhoods=undefined&preferred_star_ratings=undefined&seed=Pqit_vbiva0hUfw7CE5adQ&site=bookings2&sid=5171fc655664ddf74ab763a094523fb7&channel_id=3&exp_andy=undefined&stid=304142&exp_rmkt_test=global_on&famem=-1&famfn=-1&fampn=-1&logged_in=0&genis=&gwcur=-1&gwcuc=-1&bem=0&bip=0&book_window=&travel_type=unknown&currency=USD&em_sent=undefined&fn_sent=undefined&pn_sent=undefined&cv=-1&sage=0&atnm=&atnm_en=&pt_en=&cul=-1&mnns=-1&zz_val_eur=EUR&zz_look_action2id=undefined&zz_generic_id=undefined&zz_generic_id2=undefined&cip=81.181.57.74&cua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F117.0.0.0%20Safari%2F537.36&tms=gtm&sid_dyna=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000&rmk_var=-1&euuid=b570a48b-d87a-42cd-a665-c49a286c4522&gcem=-1&gcpn=-1&pguai=undefined&ttv=undefined&iamlt=&fbc=undefined&fbp=-1&msclid=undefined&pcid=3&bizp=&istnb=0&genisb=0&as=0&genaspb=1&p=https%3A%2F%2Fwww.booking.com%2F&r=&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&rbda=-1&tcl=undefined&cto_pld=undefined&gtmcb=2120349371 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCou6YnO%2Bi371gnW3Kn5k0ZqhIC9T9IHcIGXgYwOwA8HxstRbTRRxJRerjAF2iouaimJ3XPbnU2fUUMgmpN1GZqCCNobJPPRHPM2bi8POSNbOUhCJbLai899ygjWCTGz4TtCwFBPPzAVL%2BrsKDbkzslopilMCEgZ3qc%3D
2024-02-08 18:35:47 UTC	651	IN	HTTP/1.1 202 Accepted Content-Length: 0 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:47 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=078682c16f530156&e=UmFuZG9tSVYkc2RlIyh9YdbeSVtWvtI5AKtW4AZZtgfcdLtDUGcHjostDrC2ospKbL-OLI41yVWQfsV__vqSEg x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 c625b1bdde545acdeb26c9f6ad3a8c6e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: xntm6S4Xb5N1hxEwzPESdqR6qc8R40TvUb8pC9PZMn2e0uRzjIyvKQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
222	192.168.2.5	49977	64.233.177.99	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:46 UTC	1135	OUT	GET /recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&cb=pehgtvg39f6l HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:47 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 08 Feb 2024 18:35:47 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-Cf2zb6BNm4_v9sAYB4nn8A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:47 UTC	361	IN	Data Raw: 32 61 35 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b Data Ascii: 2a58<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face {
2024-02-08 18:35:47 UTC	1252	IN	Data Raw: 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 Data Ascii: o/v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//f
2024-02-08 18:35:47 UTC	1252	IN	Data Raw: 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 31 45 30 30 2d 31 45 39 46 2c 20 55 2b 31 45 46 32 2d 31 45 46 46 2c 20 55 2b 32 30 32 30 2c 20 55 2b 32 30 41 30 2d 32 30 41 42 2c 20 55 2b 32 30 41 44 2d 32 30 43 46 2c 20 Data Ascii: boto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF,
2024-02-08 18:35:47 UTC	1252	IN	Data Raw: 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 Data Ascii: font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}/* greek */@font-face { font-family: 'Roboto'; font-sty
2024-02-08 18:35:47 UTC	1252	IN	Data Raw: 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c 20 55 2b 30 32 44 43 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 55 2b 32 30 30 30 2d 32 30 36 46 2c 20 55 2b 32 30 37 34 2c 20 55 2b 32 30 41 43 2c 20 55 2b 32 31 32 32 2c 20 55 2b 32 31 39 31 2c 20 55 2b 32 31 39 33 2c 20 55 2b 32 32 31 32 2c 20 55 2b 32 32 31 35 2c 20 55 2b 46 45 46 46 2c 20 55 2b 46 46 46 44 3b 0a 7d 0a Data Ascii: to/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;}
2024-02-08 18:35:47 UTC	1252	IN	Data Raw: 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 39 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 43 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 32 2d 30 31 30 33 2c 20 55 2b 30 31 31 30 2d 30 31 31 31 2c 20 55 2b 30 31 32 38 2d 30 31 32 39 2c 20 55 2b 30 31 36 38 2d Data Ascii: * vietnamese */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 900; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfCxc4EsA.woff2) format('woff2'); unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-
2024-02-08 18:35:47 UTC	1252	IN	Data Raw: 36 42 4e 6d 34 5f 76 39 73 41 59 42 34 6e 6e 38 41 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 61 70 69 32 2f 27 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 78 35 57 57 6f 45 35 37 46 76 30 64 36 41 54 4b 73 4c 44 49 41 4b 6e 74 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 22 20 6e 6f 6e 63 65 3d 22 43 66 32 7a 62 Data Ascii: 6BNm4_v9sAYB4nn8A" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.com/recaptcha/api2/';</script><script type="text/javascript" src="https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__en.js" nonce="Cf2zb
2024-02-08 18:35:47 UTC	1252	IN	Data Raw: 79 71 37 37 41 4d 64 63 6e 46 69 74 46 76 36 62 32 71 7a 4f 4b 65 37 38 75 5a 62 38 67 54 64 54 30 74 6b 45 6b 7a 31 6f 66 6e 51 44 62 57 62 4f 78 71 5f 68 62 73 74 30 31 79 63 6d 36 35 65 51 4e 46 51 6f 6d 62 6f 51 55 54 2d 49 48 5a 52 68 42 5f 52 71 57 6f 6f 45 6d 7a 58 45 35 75 6c 57 71 45 58 31 4a 46 6a 54 73 6c 61 31 49 37 65 4e 43 56 6c 78 66 6b 79 37 4e 5f 47 54 36 71 6c 65 4f 54 39 31 35 71 61 4b 5f 50 46 43 4f 6c 4a 6e 6d 51 34 5f 42 63 38 66 5a 4a 79 58 79 71 71 42 52 36 4e 38 39 57 70 4e 39 78 55 6e 75 58 57 58 41 74 41 34 65 39 6a 49 48 6a 6d 7a 56 68 57 62 61 6f 33 48 62 4c 42 6a 7a 36 78 30 37 66 37 42 42 55 65 50 68 52 54 2d 34 53 54 57 4f 62 55 69 70 55 58 34 46 77 54 79 6d 53 6d 66 78 36 46 73 64 34 69 62 74 33 6e 4b 52 48 47 30 7a 33 4b Data Ascii: yq77AMdcnFitFv6b2qzOKe78uZb8gTdT0tkEkz1ofnQDbWbOxq_hbst01ycm65eQNFQomboQUT-IHZRhB_RqWooEmzXE5ulWqEX1JFjTsla1I7eNCVlxfky7N_GT6qleOT915qaK_PFCOlJnmQ4_Bc8fZJyXyqqBR6N89WpN9xUnuXWXAtA4e9jIHjmzVhWbao3HbLBjz6x07f7BBUePhRT-4STWObUipUX4FwTymSmfx6Fsd4ibt3nKRHG0z3K
2024-02-08 18:35:47 UTC	1252	IN	Data Raw: 78 32 32 4c 79 39 33 64 33 63 75 5a 32 39 76 5a 32 78 6c 4c 6d 4e 76 62 53 39 71 63 79 39 69 5a 79 39 4c 61 31 64 47 5a 56 4e 56 55 6d 56 72 57 45 64 35 59 32 52 77 63 6c 5a 44 4c 56 56 5a 4e 6b 56 45 4c 56 70 47 4e 57 78 73 4d 6b 70 44 54 57 6c 49 61 45 70 46 4d 6c 4a 72 4c 6d 70 7a 5c 78 32 32 2c 5c 78 32 32 5c 78 32 32 2c 5c 78 32 32 62 30 4e 61 51 6e 52 6a 63 55 4e 4d 53 58 6b 77 4d 45 4a 4b 4f 46 5a 6d 57 6b 30 77 5a 33 6c 52 56 47 4e 6b 55 56 6c 47 4f 47 31 74 4f 57 6c 52 64 55 52 52 54 44 68 5a 54 57 31 76 61 6e 52 79 4e 47 4e 56 62 55 52 6f 55 33 49 79 54 31 46 4a 4b 33 4a 73 54 33 6c 58 57 6e 55 31 61 6a 5a 75 5a 6a 68 48 54 6d 56 77 64 46 6c 76 56 47 68 4d 56 47 4e 4c 55 30 4a 4a 52 7a 52 46 63 57 4d 77 53 31 41 32 4b 7a 52 59 54 46 52 73 63 6d Data Ascii: x22Ly93d3cuZ29vZ2xlLmNvbS9qcy9iZy9La1dGZVNVUmVrWEd5Y2RwclZDLVVZNkVELVpGNWxsMkpDTWlIaEpFMlJrLmpz\x22,\x22\x22,\x22b0NaQnRjcUNMSXkwMEJKOFZmWk0wZ3lRVGNkUVlGOG1tOWlRdURRTDhZTW1vanRyNGNVbURoU3IyT1FJK3JsT3lXWnU1ajZuZjhHTmVwdFlvVGhMVGNLU0JJRzRFcWMwS1A2KzRYTFRscm
2024-02-08 18:35:47 UTC	471	IN	Data Raw: 70 4e 47 67 72 64 6e 41 34 65 6d 67 7a 4d 33 70 6e 4c 32 4e 34 56 30 5a 72 52 33 68 4c 52 33 70 58 63 6b 68 4f 4b 33 6c 76 62 30 35 49 59 6b 46 4f 59 6c 59 77 5a 44 59 32 55 54 4e 4d 57 55 78 72 65 45 73 35 52 30 4a 68 4e 44 56 68 59 53 39 68 56 32 74 49 4f 48 64 70 57 6e 4e 7a 53 46 6c 42 51 6a 55 31 56 6d 64 49 51 33 55 30 55 44 6c 68 51 56 42 56 51 69 74 4f 65 54 4e 71 59 7a 6c 34 62 6b 70 52 4d 7a 6b 77 4e 6c 49 7a 63 47 35 78 55 30 39 75 52 33 55 34 4f 58 4a 73 4e 33 64 51 51 57 38 30 5a 58 6b 34 5a 48 64 43 51 30 6b 35 61 55 55 77 54 33 49 76 4f 46 6c 55 56 47 78 74 62 54 46 49 65 57 31 43 62 32 56 31 52 54 46 47 51 31 4e 75 56 30 31 75 63 46 70 68 53 45 52 30 4b 31 70 42 4f 45 52 69 4c 33 68 4c 4e 55 6c 30 63 46 4a 45 54 47 4e 53 61 57 35 61 5a 46 Data Ascii: pNGgrdnA4emgzM3pnL2N4V0ZrR3hLR3pXckhOK3lvb05IYkFOYlYwZDY2UTNMWUxreEs5R0JhNDVhYS9hV2tIOHdpWnNzSFlBQjU1VmdIQ3U0UDlhQVBVQitOeTNqYzl4bkpRMzkwNlIzcG5xU09uR3U4OXJsN3dQQW80ZXk4ZHdCQ0k5aUUwT3IvOFlUVGxtbTFIeW1Cb2V1RTFGQ1NuV01ucFphSER0K1pBOERiL3hLNUl0cFJETGNSaW5aZF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
223	192.168.2.5	49980	18.238.55.22	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:46 UTC	681	OUT	GET /xdata/images/city/170x136/977388.jpg?k=4c9c54255e9d2e2d8084959527abea6b6b8a4b8a538a921f1df9e4bea2503ff6&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:47 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 7785 Connection: close Server: nginx Date: Mon, 22 Jan 2024 16:01:01 GMT ETag: "2eef344c8759d5a9a3cb0676ff6e037d072dced5" Content-Language: 7785 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 616cc46c05372de12125d489da3bca56.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P4 X-Amz-Cf-Id: 2Mqri-OvLhBJSIhKup6GczEI1efM-dKvGKJxnupt_JdwflWNEw8_AQ== Age: 1478086
2024-02-08 18:35:47 UTC	7785	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
224	192.168.2.5	49981	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	671	OUT	POST /d8c14d4960ca/a18a4859af9c/verify HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive Content-Length: 8541 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:47 UTC	8541	OUT	Data Raw: 7b 22 63 68 61 6c 6c 65 6e 67 65 22 3a 7b 22 69 6e 70 75 74 22 3a 22 65 79 4a 32 5a 58 4a 7a 61 57 39 75 49 6a 6f 78 4c 43 4a 31 59 6d 6c 6b 49 6a 6f 69 4d 7a 45 31 4f 54 52 69 4e 44 51 74 4d 47 5a 6b 4f 43 30 30 4f 57 49 31 4c 57 49 7a 59 7a 49 74 5a 57 55 30 4d 54 59 30 5a 47 55 32 4e 44 56 6d 49 69 77 69 59 58 52 30 5a 57 31 77 64 46 39 70 5a 43 49 36 49 6d 55 33 59 6a 6b 7a 4d 44 55 35 4c 54 4a 6c 4d 6d 55 74 4e 44 68 6b 4f 43 30 34 59 54 64 6c 4c 57 46 69 4f 44 67 7a 59 6d 45 33 4e 44 55 7a 4d 69 49 73 49 6d 4e 79 5a 57 46 30 5a 56 39 30 61 57 31 6c 49 6a 6f 69 4d 6a 41 79 4e 43 30 77 4d 69 30 77 4f 46 51 78 4f 44 6f 7a 4e 54 6f 30 4e 69 34 77 4d 54 41 33 4e 44 49 35 4e 44 4a 61 49 69 77 69 5a 47 6c 6d 5a 6d 6c 6a 64 57 78 30 65 53 49 36 4e 43 77 69 Data Ascii: {"challenge":{"input":"eyJ2ZXJzaW9uIjoxLCJ1YmlkIjoiMzE1OTRiNDQtMGZkOC00OWI1LWIzYzItZWU0MTY0ZGU2NDVmIiwiYXR0ZW1wdF9pZCI6ImU3YjkzMDU5LTJlMmUtNDhkOC04YTdlLWFiODgzYmE3NDUzMiIsImNyZWF0ZV90aW1lIjoiMjAyNC0wMi0wOFQxODozNTo0Ni4wMTA3NDI5NDJaIiwiZGlmZmljdWx0eSI6NCwi
2024-02-08 18:35:47 UTC	585	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 296 Connection: close Date: Thu, 08 Feb 2024 18:35:47 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65c51f03-2f5714665e488b33655d02f7 X-Cache: Miss from cloudfront Via: 1.1 b9d1b307966c2273bf97ed7c681603da.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: RZ6EGREFfWbqZFnCJRD0x1dF4aAi7iinG_yuiMuOpjWTxNsACuTsKg==
2024-02-08 18:35:47 UTC	296	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 6e 55 6d 43 74 74 45 41 41 41 41 41 3a 4c 53 73 63 34 4e 6e 6b 51 31 62 36 34 75 6b 5a 79 43 68 63 30 2f 2b 51 73 6f 64 69 76 6d 30 5a 33 47 47 75 57 69 43 77 4e 4b 2f 4c 32 48 67 6e 6d 6e 41 6f 51 4a 59 52 30 6d 68 32 76 4d 53 66 34 4e 74 68 33 2b 43 4f 52 52 38 44 4f 64 41 34 76 79 59 56 78 39 66 76 4a 57 45 69 46 59 63 38 34 59 6c 47 48 41 36 37 75 33 42 58 75 64 42 52 6a 47 39 54 46 76 37 53 4d 6f 47 4b 66 43 42 62 4e 6c 6e 31 36 65 47 53 4f 54 6d 68 62 78 75 56 4b 53 34 4f 35 4a 32 65 66 47 62 37 57 39 42 47 4a 48 55 4d 79 43 4b 4b 61 65 72 43 6e 4c 65 64 30 53 45 38 44 2b 52 75 42 4e 57 37 39 65 70 Data Ascii: {"token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAnUmCttEAAAAA:LSsc4NnkQ1b64ukZyChc0/+Qsodivm0Z3GGuWiCwNK/L2HgnmnAoQJYR0mh2vMSf4Nth3+CORR8DOdA4vyYVx9fvJWEiFYc84YlGHA67u3BXudBRjG9TFv7SMoGKfCBbNln16eGSOTmhbxuVKS4O5J2efGb7W9BGJHUMyCKKaerCnLed0SE8D+RuBNW79ep

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
225	192.168.2.5	49984	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	686	OUT	GET /xdata/images/xphoto/263x210/57584488.jpeg?k=d8d4706fc72ee789d870eb6b05c0e546fd4ad85d72a3af3e30fb80ca72f0ba57&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:47 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Tue, 30 Jan 2024 04:39:46 GMT Content-Language: 8621 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "196fea0ab45d56a1dbce18f3c3cd9eb1a591fb85" X-Cache: Hit from cloudfront Via: 1.1 d3385c1527acfbb7e4b167c6fc3a82fe.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: yiRwnW9hHZYjmcUW50rwEhWr15hicYbjtiRSDMjz4cKVG3P3axT0Kg== Age: 827761
2024-02-08 18:35:47 UTC	6398	IN	Data Raw: 31 38 66 36 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 18f6JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:35:47 UTC	2238	IN	Data Raw: 38 62 37 0d 0a 1a c4 fe d7 84 7f cb 39 3f 4f f1 a4 1a c5 bf f7 24 fc 87 f8 d3 e5 0b 9b 26 52 7a 32 fe 75 56 e2 04 99 a3 2d 26 36 48 b2 0d a7 19 2a 72 3f 95 50 fe d8 b7 fe ec 9f 90 ff 00 1a 69 d5 ed 89 c6 24 ff 00 be 68 b0 1a fe 7b 1c fc e3 34 cd cd ff 00 3d 14 7e 35 93 fd ab 6d ea ff 00 f7 cd 37 fb 5e d7 d5 ff 00 2a 00 d9 0c c3 9d d1 9f 72 79 a7 ef 7e a0 c7 ff 00 7d 56 17 f6 bd af ab ff 00 df 34 8d ab 5a e3 23 cc 3f 41 40 1b 32 99 18 63 29 cf ab 57 95 f8 a7 e1 ae ab aa eb 37 3a 85 9d dd 96 d9 88 22 39 18 a9 18 00 7a 1f 4a ed 9b 59 b7 cf dc 97 eb 81 fe 35 19 d6 2d cf f0 cb f9 0f f1 ac ea 42 33 56 91 70 9b 8b ba 3c 3f 53 d1 35 9f 0d ca ab a9 59 bc 48 c7 0b 28 21 91 be 8c 38 fc 2b b8 f0 d5 f0 ff 00 84 56 46 27 ee 89 09 ae b6 ee ee c2 ee de 48 27 8d 9e 29 06 Data Ascii: 8b79?O$&Rz2uV-&6Hr?Pi$h{4=~5m7^ry~}V4Z#?A@2c)W7:"9zJY5-B3Vp<?S5YH(!8+VF'H')
2024-02-08 18:35:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
226	192.168.2.5	49982	18.238.55.22	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	681	OUT	GET /xdata/images/city/170x136/976877.jpg?k=2aab28217f0fb039e0f35ea2b2c3976141b5860b074f74220edf998115935cda&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:47 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sat, 03 Feb 2024 04:46:57 GMT ETag: "40721dda4c91c5977182d60b367c4d39dec3ab3d" Content-Language: 8350 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 c079338af747d912717239089fea0484.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P4 X-Amz-Cf-Id: qrxfeikvzwRyDyuTpKopCGzIB_ssXescMnX8QeTs6SWmBPJAXM3-mg== Age: 481730
2024-02-08 18:35:47 UTC	8358	IN	Data Raw: 32 30 39 65 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 209eJFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:35:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
227	192.168.2.5	49983	18.238.55.22	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	681	OUT	GET /xdata/images/city/170x136/977381.jpg?k=ab236c5e99ba40341684e2d3bfcd8256d36f5e63883350af9faa988cd4d49939&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:47 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 6127 Connection: close Server: nginx Date: Sat, 20 Jan 2024 23:59:23 GMT ETag: "981fae551c2728433847e16bffb3f0a7cc67dc9c" Content-Language: 6127 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 28fca7284ad6e07382ad05b79a20cd6a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P4 X-Amz-Cf-Id: AANYQkhEOMXod417RoPS9BIhETDWV0-GYaFP7q7jgqgONj1CejlhTg== Age: 1622184
2024-02-08 18:35:47 UTC	6127	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
228	192.168.2.5	49985	18.238.55.22	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	686	OUT	GET /xdata/images/hotel/263x210/119467716.jpeg?k=f3c2c6271ab71513e044e48dfde378fcd6bb80cb893e39b9b78b33a60c0131c9&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:47 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Tue, 30 Jan 2024 06:16:58 GMT ETag: "118c01722e55044d816db848ac471d09024e4d85" Content-Language: 10601 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 f26a1d19b20e4cf5dd8998779bc5b1fc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P4 X-Amz-Cf-Id: c7b0rOtoMYf7p-9X49iAQ5vACYZOn9aLFBbJi7RgG-Kw8tJpZsOpyA== Age: 821929
2024-02-08 18:35:47 UTC	10609	IN	Data Raw: 32 39 36 39 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 2969JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:35:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
229	192.168.2.5	49987	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	686	OUT	GET /xdata/images/hotel/263x210/100235855.jpeg?k=5b6e6cff16cfd290e953768d63ee15f633b56348238a705c45759aa3a81ba82b&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:47 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sun, 21 Jan 2024 16:24:01 GMT ETag: "9aff9e5c9b69d9442b7f563196b1a2235d432b9f" Content-Language: 12530 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 b340a44dae03e8ff13e054502e49abe2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: Tbg-XLCVVGvFvq2FH9dT_XpBLAgV9iWhIWib8e8leIQWV_ojdPateQ== Age: 1563106
2024-02-08 18:35:47 UTC	12538	IN	Data Raw: 33 30 66 32 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 30f2JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:35:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
230	192.168.2.5	49986	18.238.55.22	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	686	OUT	GET /xdata/images/xphoto/263x210/45450084.jpeg?k=f8c2954e867a1dd4b479909c49528531dcfb676d8fbc0d60f51d7b51bb32d1d9&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:47 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sun, 21 Jan 2024 16:24:01 GMT ETag: "581d7d6f2cc7c0efc5bd54aa0a1fa4c3bdb259f4" Content-Language: 10257 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 590897dc65a5ea6dcbac1c8ea98c65c4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P4 X-Amz-Cf-Id: HlZEmB0Mc53sDBGl6-GT0Ww4ljiX0G15Orzb2S8G9uXuY4Lc1VUYog== Age: 1563106
2024-02-08 18:35:47 UTC	10265	IN	Data Raw: 32 38 31 31 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 2811JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:35:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
231	192.168.2.5	49988	64.233.177.157	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	1505	OUT	GET /ddm/fls/z/dc_pre=COTEnqOxnIQDFZE5RAgd3v0I0A;src=4228414;type=views;cat=views;ord=4995395844978;npa=0;auiddc=;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=2105455417;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2 HTTP/1.1 Host: adservice.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:47 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:47 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:47 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
232	192.168.2.5	49989	151.101.12.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	534	OUT	GET /ct/lib/main.6461a31a.js HTTP/1.1 Host: s.pinimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:47 UTC	481	IN	HTTP/1.1 200 OK Connection: close Content-Length: 21660 ETag: "08e95d77f762cc0c0c06ce86f8334b6f" x-amz-server-side-encryption: AES256 Content-Encoding: gzip Content-Type: application/javascript X-CDN: fastly alt-svc: h3=":443";ma=600 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Access-Control-Max-Age: 86400 Access-Control-Expose-Headers: X-CDN Vary: Accept-Encoding, Origin Cache-Control: max-age=1209600 date: Thu, 08 Feb 2024 18:35:47 GMT
2024-02-08 18:35:47 UTC	1378	IN	Data Raw: 1f 8b 08 08 db 8d c2 65 00 03 6d 61 69 6e 2e 36 34 36 31 61 33 31 61 2e 6a 73 00 c4 5c 0f 73 db b6 92 ff 2a 32 67 aa 10 21 a5 90 94 2c 3b 14 11 8d 93 e7 ce e4 5e 9b 76 92 f4 e6 3a 1e 8f 87 96 20 8b ad 0c fa 48 d0 ae 9f a5 7e f6 db 05 08 12 94 48 db 71 de cd 9b 36 36 09 82 8b 1f 16 fb 0f bb a0 0f 96 05 9f 8b 24 e5 76 42 1e 6e e3 ac c7 e8 c3 76 aa 1b 7b 99 2d 54 33 9f 66 4c 14 19 b7 d9 99 38 df 6c 6c 4e f1 82 3e 24 a1 70 d7 e1 81 ef b2 bf 6e d2 4c e4 e1 c3 76 eb 26 f0 68 38 8f d7 6b 9b 0f cb 76 97 bb f5 75 46 e0 66 4d 0f 3c 97 13 a2 5b b7 d9 f0 9a 26 6e 36 9c 53 06 3f 17 b4 42 26 e0 65 40 97 0d 53 bc 24 9b cd 2f 97 7f b0 b9 18 2e d8 32 e1 ec d7 2c bd 61 99 b8 97 dd 1e 18 2f ae 59 16 5f ae 59 08 e4 af 98 08 93 2d d9 02 bd cc a0 47 1e ac 82 ab b7 17 d6 01 15 Data Ascii: emain.6461a31a.js\s*2g!,;^v: H~Hq66$vBnv{-T3fL8llN>$pnLv&h8kvuFfM<[&n6S?B&e@S$/.2,a/Y_Y-G
2024-02-08 18:35:47 UTC	1378	IN	Data Raw: 58 9a 6a 2d f8 c6 73 20 ff df 09 bb 83 18 77 bf 11 46 04 97 de e5 79 6a 30 b5 5f 28 e3 5c 43 d9 6a 99 9d 59 96 23 ea e8 02 b1 a3 4d 4f 34 1d cf 58 b7 03 7f 3a 25 f9 5d 22 e6 18 92 3c cc e3 9c 59 71 3e 4f 12 2b 94 d7 6b 90 45 ee 97 37 10 b4 c6 d9 bd 15 ea 70 75 2a 5b a5 3e 87 fa 72 50 5e f7 94 2f d1 7d ff b0 6b 3c aa eb 3c 0f f4 5b f3 7c 10 d4 14 fc 09 6c 27 6a 7a ea b6 24 13 bc 2e 07 5d b1 bf 6a 1c ef de bd f3 55 f3 25 fc 98 8c ab 27 7f 1a a3 96 81 72 28 3d 40 0b 2a 4e 6d e0 1b 47 e9 f9 29 bd 63 d9 07 20 65 13 b0 72 b0 67 a9 e5 a5 da a5 49 f6 81 c9 02 06 02 45 d8 b7 54 be 93 6f 36 4a 35 39 79 87 01 8e 56 9b d2 45 58 b2 7f 52 f7 4f 36 9b c4 ec 38 33 ae c3 84 44 d4 db 79 15 a6 0b 6d 11 b5 b9 ba aa 1f e3 ba 0a 2a c0 37 c9 45 a9 97 56 94 4b 2b d9 86 d0 53 2a Data Ascii: Xj-s wFyj0_(\CjY#MO4X:%]"<Yq>O+kE7pu[>rP^/}k<<[\|l'jz$.]jU%'r(=@NmG)c ergIETo6J59yVEXRO683Dym7EVK+S
2024-02-08 18:35:47 UTC	1378	IN	Data Raw: 36 d8 d6 9f 83 f4 a9 57 e0 2a 73 e8 6a 8b e2 b0 a6 0c c2 c6 b5 61 43 17 11 bd d1 0a da 12 99 0c e3 9b 9b f5 bd ad 9e 34 03 4b 88 70 6e 41 23 6e a3 c5 94 dc b5 86 35 3b 2f 97 01 d2 ad 7b eb c0 98 95 f8 df 6d 3f 0c 95 27 a0 2b f7 c3 f0 cb 3a bd 2b 6f 4d 43 e0 60 52 09 f8 20 20 82 a8 d3 d7 72 0b 6d 43 b8 b3 85 37 3f 7e fa f2 eb e9 87 af 17 3f 9f fc cf c5 fb df bf 9e 7e a1 87 5e bb eb a4 95 e7 10 ad 39 be d6 56 b3 10 21 b2 7b a9 5e 7b 99 72 bf 02 27 8c 1c e1 43 75 d9 ea 63 dd 65 9a b6 94 39 c6 c1 76 eb 8e 03 19 63 41 0f 9b b4 7a 7c 31 cc 8b 4b 99 cb ea f7 55 3c a6 ef 6d df f5 89 b1 b5 de ce e3 72 cb a4 06 38 f0 b7 5b 88 08 3f 0c ff fc 39 fe 4b 75 c1 c4 05 b0 ec 26 4d d7 5f 92 7f 31 7a 0c 02 0e f7 ab d6 ed 4f 7b 12 d4 15 5b 57 85 44 fb 05 40 9d 9e 97 46 48 35 Data Ascii: 6W*sjaC4KpnA#n5;/{m?'+:+oMC`R rmC7?~?~^9V!{^{r'Cuce9vcAz\|1KU<mr8[?9Ku&M_1zO{[WD@FH5
2024-02-08 18:35:47 UTC	1378	IN	Data Raw: 5b 39 77 e7 f4 76 5b b5 3c 5e 3b 5c 94 45 cf 7f da 7f 80 3e d8 85 e4 93 ae 03 0f 60 a2 85 bb 70 e3 66 5d b1 7c f5 be 71 64 ee c9 0a 79 4b f7 9d 5a 9d 1a 1c 13 f6 b0 93 42 48 58 b2 96 ab 9b be ac e8 a6 2b 83 8d 91 8d ea 58 fe fc ea 18 43 e1 c3 a2 f8 6e 81 00 25 cf db ee c6 3d ff f5 e5 97 4f 74 2f 3d f3 20 4f 7c e9 93 4c 2e 1e 54 0a 77 6b 27 d2 88 97 45 13 54 9c 8b 38 cb d4 11 47 17 b4 72 3b 55 a5 d1 b1 f7 76 52 9f 0e bd 34 4e 49 8a 1f c0 10 83 f6 75 1e b8 b1 94 09 51 76 43 f4 8a 84 0b e5 df 92 48 38 5d 27 43 bf 66 f7 78 5e 08 4f a0 cc e7 2c cf c1 97 df a7 7c a1 15 54 1f 12 ad f3 cf 57 75 b4 00 ab f7 cc 78 e1 95 a5 e8 b5 9e 26 7a df 3c 81 f6 aa f4 c9 f2 84 41 da 75 b6 68 f7 30 e4 ee c9 40 45 25 71 58 15 28 74 1e 8d 05 bf d3 33 43 03 73 b6 a7 b5 2f 01 ab 27 Data Ascii: [9wv[<^;\E>`pf]\|qdyKZBHX+XCn%=Ot/= O\|L.Twk'ET8Gr;UvR4NIuQvCH8]'Cfx^O,\|TWux&z<Auh0@E%qX(t3Cs/'
2024-02-08 18:35:47 UTC	1378	IN	Data Raw: 5c 14 b6 57 e5 cd 88 0d 92 59 7d eb 20 ff 06 89 59 c0 c7 ea 3f fe 8d 95 88 95 e7 c4 d2 01 e6 fd 68 36 05 77 46 f0 04 38 2f f3 a0 99 93 9c 57 d5 e2 34 f2 d9 48 9e 48 ec fa 2a 59 1d 17 d3 d9 f7 36 32 ad df d9 e4 4c e8 cf 6b e4 f4 aa ec 6e e2 26 4e 0a 72 52 ff dd 83 a6 ec e1 41 cf 76 d9 db ff 5c bd fc 63 0f ed 7f 13 03 3f d1 e2 58 dd fe 3f f6 ae bc b9 6d 1c d9 7f 95 44 95 71 91 23 48 26 09 9e b2 39 5e 47 3e a2 f8 5c 1f c9 4c 3c 8e 8a 91 68 9b b1 2d 69 74 38 87 a5 ef be bf 06 40 11 94 94 37 33 55 ef ed d6 ab da 3f 12 83 38 bb 1b 8d 3e c8 6e a8 fc bd db 6c 2c 47 9d 8a 5d c8 16 fa 31 5b e3 47 19 d5 a1 e7 43 58 a6 b9 09 03 41 48 b0 61 1e 00 22 93 77 96 52 7d d3 d5 1f f3 e6 17 74 ac b8 7b 63 15 4a 98 fa 65 29 85 3f fd 41 6c cb ea af 84 22 69 66 29 39 4b bc da 17 Data Ascii: \WY} Y?h6wF8/W4HH*Y62Lkn&NrRAv\c?X?mDq#H&9^G>\L<h-it8@73U?8>nl,G]1[GCXAHa"wR}t{cJe)?Al"if)9K
2024-02-08 18:35:47 UTC	1378	IN	Data Raw: f5 8f c6 56 e3 32 9b b6 cc de 18 a5 70 6a fb 53 ee 98 28 36 1f 92 c7 41 da 35 e5 0c af d6 eb 63 1c 76 8a a3 55 08 49 0b 7b 89 2e fa 99 58 11 09 9a 14 b1 ae dd 54 c2 3d 19 a6 2f 7a fd 5e 4d 70 10 14 cc 3c c6 ad fe 7b af 05 da 0f bb 74 c5 53 5f 9c 26 d5 85 89 01 f2 86 46 79 13 99 ca 61 bb 4b 9e c8 c5 59 62 52 c3 7c f1 98 8e ef fa 5d ba b1 cc 58 bc 65 d0 7c 56 a9 76 3d 11 b0 9b eb f3 f2 cb 05 4d 7a 5b 4c 6a a7 fc aa 47 71 9d 56 06 49 9b 5e 65 f2 1e 90 22 dc 45 9a 0f cf b3 8d 61 fd b0 75 7e 11 3f ef 9d b6 0f 4f 9a db 87 ed f3 8b 93 b3 ed fd dd c6 33 8c 6f 60 db b0 2d 8b 4d 86 59 a3 72 33 68 d3 35 57 0f e7 80 3c b9 4d 2b 33 b6 b3 7b d6 7a 07 d7 79 f7 b4 75 b0 dc 7f 90 f5 6a a0 51 f6 94 76 6b e9 20 bb c7 80 f3 e6 d9 f6 e9 6e 9b 56 dc 3d de 3d 3b 5f 3d 68 d4 19 Data Ascii: V2pjS(6A5cvUI{.XT=/z^Mp<{tS_&FyaKYbR\|]Xe\|Vv=Mz[LjGqVI^e"Eau~?O3o`-MYr3h5W<M+3{zyujQvk nV==;_=h
2024-02-08 18:35:47 UTC	1378	IN	Data Raw: 43 50 02 6c db 63 8e 58 c6 02 e1 98 c3 41 00 30 9e 83 0d 74 9d d0 a5 2f 81 2e c1 e4 03 0e 1b 8c c1 1d 6c 34 b7 5d 4c c6 b9 03 76 04 15 c3 eb 92 1d e7 bb a6 fe 2b 00 ea 85 01 a5 8f 19 ca 6b fc 0c 37 38 d3 5c 35 1f 28 fa e6 6c 6c 0c 29 e9 70 58 4a f4 cb 4a 19 af ba 33 7d 1f 63 37 22 8b 03 51 2e e7 3d 88 01 99 6b 73 17 f8 c8 9a 26 f4 a1 4d cc 09 6c 64 cd 71 2c 68 2a 38 52 d6 9c c6 36 07 53 46 dc b6 23 59 b3 13 3b d8 1b 62 04 f5 f1 b2 7e 19 13 57 71 17 5b 2f 2b 8e 62 db 73 6d 17 9b ee 78 ca a5 1f ae 76 6e f5 ab a4 f2 cf 16 9f 29 bb 5f 7a cc f7 f4 9a 42 16 0f 28 ec 4c 16 9b f4 92 59 16 8f e9 1d 84 2c 9e c2 7c 50 c5 1d 76 93 17 2f 29 4d 53 16 8f d8 5d 6c 6d dc 6d da fe 46 b5 7a 67 66 57 77 30 a3 f5 48 48 c3 fd 59 59 e0 e8 e5 bb 45 2f 6b 6a d0 3b 43 94 6b ce b5 Data Ascii: CPlcXA0t/.l4]Lv+k78\5(ll)pXJJ3}c7"Q.=ks&Mldq,h*8R6SF#Y;b~Wq[/+bsmxvn)_zB(LY,\|Pv/)MS]lmmFzgfWw0HHYYE/kj;Ck
2024-02-08 18:35:47 UTC	1378	IN	Data Raw: 62 fc ab a5 f1 b6 2b 0c ce 10 43 c6 25 fb 53 cc 10 89 19 b8 36 c3 db d2 07 20 1a 62 6d 52 4f 4b dc 5c f2 37 3d 92 c3 25 8f e4 f5 92 47 b2 bf e4 91 ec 2d 79 24 af 96 3c 92 b7 4b 1e c9 bb 45 8f e4 cd a2 47 52 ff 23 86 49 11 41 c3 91 c8 12 35 bf c5 74 c4 31 0c 32 53 d6 7c 88 01 9a 0d ad 07 d1 22 6b de 63 1e 88 21 d2 92 6a f1 5f 63 a8 00 1c 6d cf e6 0a 89 f1 38 86 cc 84 38 84 92 94 35 3d 8a 0d 85 5c 02 c7 b9 aa 13 e8 04 d1 0a 6a 38 56 f4 d7 5d a4 dc 41 ca 72 9f e6 b0 f0 95 5e 17 be d2 7e e1 2b ed 15 be d2 ab c2 57 7a 5b f8 4a ef 0a 5f e9 4d e1 2b fd 41 be 92 2c fe 46 37 0b cb e2 07 d6 cd 8b ef 85 0b 21 29 40 f7 8d 4e 15 ea ec 5b 5e ee 8d d9 63 5e ce c6 6c 00 5f 66 b0 c9 9d 8d 01 5d 3a d6 bb 1a 2c 3b 5f 03 93 a1 5e 44 c2 2e b6 d0 15 58 c2 31 1b c0 7d b3 e4 1c Data Ascii: b+C%S6 bmROK\7=%G-y$<KEGR#IA5t12S\|"kc!j_cm885=\j8V]Ar^~+Wz[J_M+A,F7!)@N[^c^l_f]:,;_^D.X1}
2024-02-08 18:35:47 UTC	1378	IN	Data Raw: c3 55 dd 44 ed f6 eb 73 94 1b de 8c 3d 9f 1f b4 4e a9 b2 dd 3c 39 de 6b ed 53 fa 59 87 7e 86 fd 7b cc 7d 0f ce 53 e5 34 8f e5 79 71 91 dc ca 58 e5 c6 8b 0a db 5f 6c 79 9f 0c 7b 32 99 8b 8d e3 1f 06 03 55 e0 97 41 15 13 d9 57 04 6c 19 a2 be 08 90 2a c2 df 54 98 94 b9 a5 cd 9c c7 bd d5 26 a3 85 45 1a 63 b3 5a 59 7f e2 eb 15 06 1f 06 c5 c9 28 1d e2 e1 55 5c e9 7c aa d0 8f e8 a5 4f 58 51 40 9a a4 8f ed 4e 7f 02 96 f8 56 61 6f e3 2b aa a8 5c b3 77 b2 d4 be e9 51 48 12 0a 0f 3d d4 be 51 b5 83 3b 3c fc a1 1e b0 81 d7 ec 37 f5 d0 fd 84 87 0f ea 01 87 5e 0e 1e e5 85 ef d8 e4 f1 35 7b 0f 08 40 8b 5f d1 4f 2c f0 40 ff 61 52 56 21 6e a8 60 12 56 11 83 c5 40 1a 54 99 c3 58 81 9c 4f 87 10 bb ed ac 8b b5 fe 19 97 2a 18 5c c9 8a 88 29 ec 4f fe 45 dc d5 70 b5 6d a4 eb bf Data Ascii: UDs=N<9kSY~{}S4yqX_ly{2UAWlT&EcZY(U\\|OXQ@NVao+\wQH=Q;<7^5{@_O,@aRV!n`V@TXO\)OEpm
2024-02-08 18:35:47 UTC	1378	IN	Data Raw: a8 9d ca c1 e0 be a9 04 83 ba a9 fc b6 7a 2a 83 28 11 97 01 81 2f f5 40 b7 29 98 0d ca 53 23 0c b9 db 6d 03 4f 76 2f b6 8c 1f 34 69 7e ba 7d 7a e7 b4 b3 27 c2 a3 da 14 41 45 97 a7 48 65 d5 29 9e ad 9a 15 51 5f 75 d3 fa a7 31 ad 33 41 d0 81 6e 2d 5d ad ee 5d d7 fd 2c 54 04 89 42 01 f1 45 14 ce ea b6 f0 66 09 0d 28 26 7e 5c f1 a3 f2 f7 72 79 29 24 cf 9d d5 70 32 3e 1a e1 ee 91 8f f0 fd d1 c9 f9 e1 87 c3 33 e6 e2 7a e7 f4 c0 8e 34 1e c8 2c 08 0a 64 54 17 0f 90 e2 9d 34 fe b7 55 e0 fc ea 97 bd fd 57 6f 89 d4 ef 8f 8f 82 96 c9 17 73 19 de 1c 4e 3f 41 18 53 7a 3d 27 1e 21 0e 93 03 1a 53 b3 b9 f2 95 17 4e db d6 d3 67 44 fb 3e 7f 3e 78 1a 84 a3 c1 e0 d9 7f 87 e1 f3 9f 76 06 cf 60 c0 b3 b3 3b fa 71 67 b4 db 0f 77 a1 c2 0f 60 bf 35 08 fa c3 9d f0 d9 8f bb c3 9f 76 Data Ascii: z*(/@)S#mOv/4i~}z'AEHe)Q_u13An-]],TBEf(&~\ry)$p2>3z4,dT4UWosN?ASz='!SNgD>>xv`;qgw`5v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
233	192.168.2.5	49990	64.233.177.99	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	983	OUT	GET /recaptcha/api2/aframe HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:47 UTC	847	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Expires: Thu, 08 Feb 2024 18:35:47 GMT Date: Thu, 08 Feb 2024 18:35:47 GMT Cache-Control: private, max-age=300 Content-Security-Policy: script-src 'report-sample' 'nonce-RFPqWuTXUJt5jc4Hq4GrUg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:47 UTC	405	IN	Data Raw: 33 33 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 52 46 50 71 57 75 54 58 55 4a 74 35 6a 63 34 48 71 34 47 72 55 67 22 3e 2f 2a 2a 20 41 6e 74 69 2d 66 72 61 75 64 20 61 6e 64 20 61 6e 74 69 2d 61 62 75 73 65 20 61 70 70 6c 69 63 61 74 69 6f 6e 73 20 6f 6e 6c 79 2e 20 53 65 65 20 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 20 2a 2f 20 74 72 79 7b 76 61 72 20 63 6c 69 65 6e 74 73 3d 7b 27 73 6f 64 61 72 27 3a 27 68 Data Ascii: 33d<!DOCTYPE HTML><html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"></head><body><script nonce="RFPqWuTXUJt5jc4Hq4GrUg">/** Anti-fraud and anti-abuse applications only. See google.com/recaptcha */ try{var clients={'sodar':'h
2024-02-08 18:35:47 UTC	431	IN	Data Raw: 2e 64 61 74 61 29 3b 76 61 72 20 63 3d 63 6c 69 65 6e 74 73 5b 62 5b 27 69 64 27 5d 5d 3b 69 66 28 63 29 7b 76 61 72 20 64 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 69 6d 67 27 29 3b 64 2e 73 72 63 3d 63 2b 62 5b 27 70 61 72 61 6d 73 27 5d 2b 27 26 72 63 3d 27 2b 28 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 72 63 3a 3a 61 22 29 3f 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 72 63 3a 3a 62 22 29 3a 22 22 29 3b 77 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 64 29 3b 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 22 72 63 3a 3a 65 22 2c 70 61 72 73 65 49 6e 74 28 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 Data Ascii: .data);var c=clients[b['id']];if(c){var d=document.createElement('img');d.src=c+b['params']+'&rc='+(localStorage.getItem("rc::a")?sessionStorage.getItem("rc::b"):"");window.document.body.appendChild(d);sessionStorage.setItem("rc::e",parseInt(sessionStorag
2024-02-08 18:35:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
234	192.168.2.5	49993	18.64.236.43	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	401	OUT	GET /static/img/favicon/9ca83ba2a5a3293ff07452cb24949a5843af4592.svg HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:47 UTC	797	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-Length: 1197 Connection: close Server: nginx Date: Tue, 23 Jan 2024 15:54:49 GMT Last-Modified: Tue, 21 Mar 2023 13:15:52 GMT Expires: Thu, 22 Feb 2024 15:54:49 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "6419ae08-4ad" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 d9385f35ab823b6294a5ec3a85ed4be6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: GYZKUYCh6ZTH5F3fjDvRevGmG2kZdUJr2ezCfpvio3x8Sf9ct48c-w== Age: 1392058
2024-02-08 18:35:47 UTC	1197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0a 3c 21 2d 2d 20 4c 6f 76 69 6e 67 6c 79 20 65 78 70 6f 72 74 65 64 20 62 79 20 4a 65 73 73 20 53 74 75 62 65 6e 62 6f 72 64 20 66 6f 72 20 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 69 6e 20 41 6d 73 74 65 72 64 61 6d 20 31 36 2d 30 33 2d 32 30 32 33 20 2d 2d 3e 0a 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 69 64 3d 22 62 64 6f 74 2d 66 61 76 69 63 6f 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 78 3d 22 30 70 78 22 20 79 3d 22 30 70 78 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?>... Lovingly exported by Jess Stubenbord for Booking.com in Amsterdam 16-03-2023 --><svg version="1.1" id="bdot-favicon" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
235	192.168.2.5	49994	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	2416	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
2024-02-08 18:35:47 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:47 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=d2b982c1d3d7016d&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGbaZjl7raZA1cB0n7oTaFORZdRJ2uRrxHQ x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 e6c353101750d150139bda8d95719802.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: KCYKs3lG8OLfVmMkqonZd5cMzPcd75l_vvk75vVuvmJlI_TZW4q-DQ==
2024-02-08 18:35:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
236	192.168.2.5	49992	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	453	OUT	GET /xdata/images/xphoto/2880x868/308526620.jpeg?k=0663a1420ea98a013af0eda32bb4d11258521a39c5b8a5a4e2777ee5661dee55&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:47 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 08 Feb 2024 16:07:55 GMT ETag: "b9a8ca902a668d150d71f3c9f7a5cc2e4159dddf" Content-Language: 245767 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 086e2cd5d94fa729de58c51b5666e0e4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: COHZjsn08MPG3pz17Q_UMuEBz9kBQmTMW10YD7M_Rb7eFRiIwNwrEA== Age: 8872
2024-02-08 18:35:47 UTC	15836	IN	Data Raw: 33 63 30 30 37 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 03 64 0b 40 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 Data Ascii: 3c007JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222d@"}!1AQa"
2024-02-08 18:35:47 UTC	16384	IN	Data Raw: 93 06 81 0d 3f 7b 1d a9 71 8a 52 b9 19 a4 0a 71 c9 a6 0c 33 49 4b 8a 33 8e 31 41 22 00 41 c9 e9 47 39 a5 23 8a 51 d2 81 81 3f 9d 27 27 ef 52 81 c6 68 1c d0 00 05 21 e9 4a 28 a6 03 78 a5 18 27 da 97 6e 69 0a e2 99 2d 06 06 69 76 d2 11 c5 2e 0d 21 00 14 b8 a3 18 a2 80 00 39 a7 f1 8c 53 40 a7 03 8e d4 99 48 95 3a 73 4f 1c d4 2a 72 6a 51 c5 43 34 8b 24 00 53 c1 19 a8 c5 3b b5 43 34 42 b6 33 c5 34 d2 8e 99 a4 34 20 63 49 34 dc 67 ad 3b bd 07 8a ab 12 c4 3c 1e 29 47 34 1a 6e 4e 69 00 e3 81 49 9c d2 13 49 9f 6a 2c 03 b3 4a 0d 33 3e d4 a2 9d 84 3a 80 69 33 48 28 02 52 dc 53 7a d3 49 e2 90 35 00 38 f5 e6 97 03 39 a6 8e 4d 38 80 0d 20 42 1e 3b d2 2f 4e 69 f8 14 80 64 50 31 47 4c e2 9d 8c 8a 41 9c 60 53 80 f5 34 98 11 b2 f1 4c c6 2a 7d a2 9a cb 4d 30 b1 09 3e d4 d3 Data Ascii: ?{qRq3IK31A"AG9#Q?''Rh!J(x'ni-iv.!9S@H:sOrjQC4$S;C4B344 cI4g;<)G4nNiIIj,J3>:i3H(RSzI589M8 B;/NidP1GLA`S4L}M0>
2024-02-08 18:35:47 UTC	16384	IN	Data Raw: 0e 97 a2 da db c2 9b 11 77 63 9c 8a e2 f4 4b 40 5d 5c 74 07 35 de d9 cf f2 29 23 91 c5 65 56 4d 9d 14 61 63 5a 0b 24 60 14 20 38 ee 6b 17 50 f0 a5 d4 1a c1 d5 f4 66 55 9d c6 26 84 fd d7 35 bf 0c c3 19 a9 cd e2 ec da 5b 15 0a 56 36 71 b9 cc c9 ac ea f0 82 1f 48 c4 fd 0e d9 54 0a ce b9 d4 f5 79 ed 9e 37 71 6a ac 31 d7 71 3f 95 74 17 e1 24 52 ce dc 0e 95 43 4e d3 96 fa e3 7b f1 1e 78 38 a1 3d 47 b2 2b 68 d0 69 fe 1c b7 92 f0 ab b4 92 73 f2 a9 62 d5 b0 be 28 b6 b9 81 8e d7 8c 91 91 b8 62 b6 e0 b2 b7 85 0e c8 d5 88 1c 1c 57 39 aa 69 09 77 23 b3 b8 41 f5 aa bb 26 31 6d 68 72 5a 95 e4 3a bd fb 48 62 42 07 52 45 35 6c ad 0f ca 60 84 23 f0 76 a6 0d 30 d8 ad ad d4 be 5b ab 2a f2 4e 69 d7 ce 61 d3 a5 b9 56 e0 44 c3 f4 aa 4f 53 39 5d 2b 33 cd 7e d4 d6 1a b4 c2 d9 b1 Data Ascii: wcK@]\t5)#eVMacZ$` 8kPfU&5[V6qHTy7qj1q?t$RCN{x8=G+hisb(bW9iw#A&1mhrZ:HbBRE5l`#v0[*NiaVDOS9]+3~
2024-02-08 18:35:47 UTC	16384	IN	Data Raw: 2b 3a 70 a1 80 c7 5a b3 3d c0 c1 02 ab 5b fe fa 7c 9e 7d 2b 0a 95 52 56 1c 53 be a5 64 84 07 0f 30 dc 41 f9 41 aa fe 29 d3 ad 6f b4 49 8c 04 79 a8 32 a5 47 07 da 8d 72 fd 2c 5a 3d ce aa 37 75 cd 65 5c f8 99 7c 93 15 a4 6a cc e3 91 d8 7b d7 3c 39 e5 2b a3 8f 19 56 11 5c bb 9e 73 75 a2 33 b7 00 a4 ca 3a 7f 8d 76 1e 1f b1 9e 2f 0d db c3 1c 6c d3 92 d9 1d ba d7 37 a9 dc 4a 2e 8c be 76 e7 ea 71 5e 8b e0 7b b2 2c 2c 5d c0 63 26 e1 cf d6 ba 2a c6 4d 28 c9 f5 3c b8 2e 67 ca 71 d7 ba 64 d6 7b 8d c4 e5 66 19 25 08 38 c1 ac bb 5b 8f b2 dd 45 70 06 36 38 61 ef eb 5e b3 f1 0f 4b 33 68 46 ee 18 d0 c8 9f 79 95 79 c5 78 f6 f1 b1 58 0d d9 e8 7d 2b e8 30 31 4e 97 b3 66 58 9a 6e 9c 94 91 ef de 1f d5 ad f5 7d 3a 3b 88 98 1c ae 0a 8e a3 eb 5c 4f c4 2f 09 e4 3e a7 60 9f 38 1f Data Ascii: +:pZ=[\|}+RVSd0AA)oIy2Gr,Z=7ue\\|j{<9+V\su3:v/l7J.vq^{,,]c&*M(<.gqd{f%8[Ep68a^K3hFyyxX}+01NfXn}:;\O/>`8
2024-02-08 18:35:47 UTC	16384	IN	Data Raw: c8 c1 8f 03 9a d3 d5 ad 84 2d e7 28 f9 0f 53 59 2e e8 18 6d 61 eb 91 58 cb 72 91 61 d2 e6 dc 7e fa 7c 93 d0 03 4d 59 65 ff 00 9e af f9 d4 5b e3 6f bc c5 9b d4 9a 37 af 76 e6 a6 e3 24 32 cd 9e 25 7f ce 95 66 9f 3f eb 5f fe fa a8 c3 a6 7e f0 a7 07 4c f5 14 d3 02 4f 3a 53 d6 67 fc e9 0c d3 76 95 ff 00 3a 66 53 3c b0 14 bb 90 0f bc 29 dc 07 ac d3 01 fe b5 ff 00 3a 05 c5 c8 e9 2b ff 00 df 54 d1 22 93 da 95 99 73 c3 0a 77 01 c2 ea e8 1f f5 d2 7f df 54 f1 75 70 c7 fd 7c 83 fe 05 51 6e 42 3e f0 a4 04 03 c1 1f 9d 2b 81 67 ed 57 0b ff 00 2d e4 ff 00 be a8 5b cb b3 d6 69 3f ef aa 87 72 f7 61 48 5c 7f 7c 53 4c 0b 62 fa e7 a0 99 ff 00 ef aa 5f b7 dd 9f f9 6a ff 00 9d 54 50 b9 c9 7a 94 60 90 32 39 f7 aa 5a e8 0d db 52 75 ba bb 76 da 26 7f 7f 9a ae 86 97 68 0e e5 be a7 Data Ascii: -(SY.maXra~\|MYe[o7v$2%f?_~LO:Sgv:fS<):+T"swTup\|QnB>+gW-[i?raH\\|SLb_jTPz`29ZRuv&h
2024-02-08 18:35:48 UTC	16384	IN	Data Raw: bd 4e 3d 2d a3 b7 b7 46 94 c9 d4 f6 15 bd 08 ae 7d 48 ad f0 9e 85 18 65 45 04 83 c6 0d 3a 9a 87 78 dc cb 86 c6 78 3d 29 d5 f4 11 b2 89 e2 bd c4 3d 69 69 0f 5a 5a 60 21 a0 50 69 45 00 14 86 96 92 80 0a 33 45 14 08 51 46 29 29 68 01 31 48 7a 52 d1 4c 04 14 70 28 a0 50 01 9a 28 fc 28 a0 04 c5 26 05 2d 14 08 6e 31 45 3a 8a 60 27 02 8c 52 1e 69 73 40 06 29 29 dd a9 b4 01 47 34 75 a5 e2 8e b5 b1 cc 80 01 4d 3c 51 d0 d2 93 c5 03 13 39 14 b8 e2 81 82 28 3c 74 a4 01 83 46 29 37 1c 52 e7 23 d6 80 03 cd 04 50 28 cd 00 1d a8 02 94 1a 07 14 00 da 05 29 a4 02 80 13 1c f5 a7 8c 01 cd 37 14 bc 62 80 0c f3 c5 2e 69 bd 0d 2f 7a 00 5e b4 98 34 03 cd 38 9a 00 4c 51 4b f8 e6 9b 9a 43 1d d6 93 76 0e 3b 52 01 9e f4 b8 ed 40 09 9c 9a 3b f4 a4 c7 34 ec 1c f1 40 0b 9f 6a 06 00 e2 Data Ascii: N=-F}HeE:xx=)=iiZZ`!PiE3EQF))h1HzRLp(P((&-n1E:`'Ris@))G4uM<Q9(<tF)7R#P()7b.i/z^48LQKCv;R@;4@j
2024-02-08 18:35:48 UTC	16384	IN	Data Raw: aa 3b e9 51 59 41 f7 a8 99 7f d7 72 4e 63 3f ca 9e 4f cb f8 d3 26 38 47 3e a8 6b 97 4b 13 67 7b 16 6c 3e 48 54 0e 00 51 51 ca 10 b9 eb d6 92 d0 9f 2f 1f ec ad 4d b4 6e 27 14 d3 ba b1 2d 7b c4 6b 0e 47 1c 54 aa 16 31 ea 69 0b 80 31 51 33 f5 a4 d5 8a 77 61 34 b9 07 9a a3 2c b9 3c e2 a6 72 39 aa 93 10 0d 49 b5 38 a0 8c 83 92 47 39 a9 33 81 4b 03 22 c6 77 75 cd 4c 02 48 38 a0 b6 f5 21 89 bf 7c ea 48 27 1d ab 0f c4 d7 13 5b 5c 58 bc 21 5b 7c 82 36 cf a1 ad e5 b7 91 25 de a5 70 45 67 dc d8 f9 b2 ac 93 ca ac 10 ee 03 de 98 a3 e4 49 7b 7a 96 76 9e 5c 63 32 b2 d6 24 10 34 7b a5 94 13 23 73 cd 6a ba c1 2c c2 49 1b e9 4f 63 13 2f 38 35 2e c6 d0 56 67 23 a8 c4 e3 74 8e bd 6b 95 92 04 f3 db 23 ad 77 7a ba f9 eb b5 47 02 b8 bb b1 b2 e1 b1 5d d8 39 d9 d8 e4 cc 95 e1 72 Data Ascii: ;QYArNc?O&8G>kKg{l>HTQQ/Mn'-{kGT1i1Q3wa4,<r9I8G93K"wuLH8!\|H'[\X![\|6%pEgI{zv\c2$4{#sj,IOc/85.Vg#tk#wzG]9r
2024-02-08 18:35:48 UTC	16384	IN	Data Raw: 82 0e 17 39 ad 68 d5 e5 a8 9d 87 52 9b 95 37 18 9c 15 83 c9 6b 28 9d 50 00 bd 2b d2 b4 99 9a 6b 48 26 93 ab a8 35 e7 2b 0c 86 e8 db a9 c8 2f 8c 7d 2b d0 f4 f2 d1 41 0c 78 e5 40 15 ed b6 a5 2b a3 cf cb 93 bc bc 8d f5 fb b4 dc 73 4b bb 6c 24 e3 26 b0 ef af ae 81 21 14 81 eb 53 52 6e 2a e8 f5 a9 c3 da 3b 23 73 ed 30 44 3e 69 07 e7 59 fa bf 88 ac f4 fd 3a 69 18 e4 ed 3b 7d cd 62 e2 56 53 29 56 7f ad 72 da ce 9b ae 6b 6c 12 1b 66 f2 23 6d d8 ac 69 d5 9c a7 66 b4 23 15 05 4d 59 3b b3 8b b8 93 ce b8 95 cf 57 62 cb ed 51 16 c0 e3 f3 ab 17 b6 37 36 17 06 0b b8 99 25 ed 55 88 00 f2 1b 8e 83 3c 66 bb d3 f7 75 3e 6e 57 73 6d 9a 3a 63 5a 96 02 e7 3d 7a 8a eb 2d 5e d6 65 c4 04 1d be f5 1f 85 7c 24 6e 04 57 f7 65 36 1f e0 38 35 b7 79 e1 eb 4d 21 a4 9e d7 24 39 cf 27 8a Data Ascii: 9hR7k(P+kH&5+/}+Ax@+sKl$&!SRn*;#s0D>iY:i;}bVS)Vrklf#mif#MY;WbQ76%U<fu>nWsm:cZ=z-^e\|$nWe685yM!$9'
2024-02-08 18:35:48 UTC	16384	IN	Data Raw: d9 c7 ca 5c 2f 6a 9e 7b cb 41 dd 1e 79 2a dc c4 de 5c 81 e2 2f d8 d6 fe 8d a1 cb 32 19 65 90 c6 aa 33 93 50 dd 89 2e 75 44 b9 bc 2c f1 64 90 00 19 ad 1b a9 2e ee bc ab 78 22 68 e2 7c 0f 9f 8a da 56 b0 c9 ad b4 94 bd b5 77 f3 66 75 47 e0 ae 3d 69 f7 3a 15 83 ca ac 92 39 64 e5 c3 d6 ee 99 1d b6 97 64 d6 a6 e5 56 6e ea 3a 56 4c 69 1c d7 77 22 49 c3 31 03 03 3e f5 95 d8 98 5a 5d 69 9a 6d d8 86 24 32 3b 8c 1f 41 56 a6 b5 58 ae 85 c6 f0 c8 47 dd 1d 05 65 6a 5a 5c 70 05 96 d9 b2 e7 ef 0a a5 3d fb 43 12 c5 13 e4 a8 f9 f2 7b d0 fd ed 85 66 43 ab 5a 5c de 48 4b 3f c8 1f 0a 17 b0 a2 de 27 b4 b3 8f ed 73 30 87 d0 d3 ec af 1e ea ec 0e 10 e3 68 c7 39 f7 ad 3d 63 4a 17 22 08 e5 bb db 12 f2 71 8a b6 f9 74 28 a9 6a 96 62 44 78 66 0d 0b 1f 9b 77 6a bc c2 de d9 26 78 24 85 Data Ascii: \/j{Ay*\/2e3P.uD,d.x"h\|VwfuG=i:9ddVn:VLiw"I1>Z]im$2;AVXGejZ\p=C{fCZ\HK?'s0h9=cJ"qt(jbDxfwj&x$
2024-02-08 18:35:48 UTC	16384	IN	Data Raw: 98 f5 06 ac db df ac 83 b7 cb 56 26 56 28 b3 af 39 ea 2a 6e 16 33 22 b4 c9 c9 18 35 63 cb 08 9b 4e 7f 0a bb 6e f0 c8 c0 b0 c6 78 35 35 cd 8a 32 66 27 e2 9b 62 71 b9 8f b5 43 05 6e 87 a5 48 96 83 76 46 76 d4 ff 00 62 19 52 cd 92 0f 15 2b 47 2a b0 1f c2 68 72 ec 64 f4 2b 15 1d 00 e0 77 34 9f 67 52 43 02 33 e9 56 8c 3d 7d 2a 58 ad e3 9e 58 e2 07 0c c7 14 e0 c1 3d 4c b7 42 c0 b8 04 aa f5 c5 4a 96 73 6d 25 60 91 81 ee 16 b7 f5 8d 21 74 3b f8 62 2d 94 91 41 35 ae f3 ac 6a ab 10 1b 71 d8 56 ca f7 35 92 bb 38 b4 b2 bc 07 22 d5 f1 fe ed 4f 1e 9b 78 ed 96 b7 70 3e 95 d4 8b c9 01 c6 3f 4a 68 bc 73 fc 58 fc 2a ac 2e 43 98 3a 4d e9 72 04 0d 8f a5 3d 34 8b d0 3f d4 b7 e5 5d 1b dd 4b 8e 1c fe 54 a6 ee 5d b8 0e 7f 2a 5c a8 7c 87 3c ba 45 e3 73 e4 36 3e 94 d7 d1 ae b9 26 Data Ascii: V&V(9n3"5cNnx552f'bqCnHvFvbR+Ghrd+w4gRC3V=}XX=LBJsm%`!t;b-A5jqV58"Oxp>?JhsX.C:Mr=4?]KT]*\\|<Es6>&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
237	192.168.2.5	49996	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	3704	OUT	GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=e4de82b919b800e4&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|4,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|2,cCHObKdBdUHINPSXeHDALOLOLMO\|5,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
2024-02-08 18:35:47 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:47 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=89e082c1286e010f&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejLQIO37oY1BU6_MMd3SUPNSZjfPmnTmXAI x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 76f3fedc86826a7b266250e33ee41082.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Me-8jN6mIFnS8MhrGGfGJS4ul0hGwEyXVk9Whoyx1tUbt59phDO_VQ==
2024-02-08 18:35:47 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
238	192.168.2.5	49997	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	2686	OUT	GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=e4de82b919b800e4&ete=&etg=&etcg=cCHObEfEITNPfbeQMIaWYUQJFFQccCcCcCC\|5&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,cCHObKdBdUHINPSXeHDALOLOLMO\|3&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
2024-02-08 18:35:48 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:48 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=fcdc82c2f3d900a7&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejLIFJ265gEAKGSCm0wwnU0yE0eY0kxiQ8M x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 e6c353101750d150139bda8d95719802.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: HNCuGQOpfcXy2SX5aiVgtdpuggII3HIokdDtpT8mttXrgJ1cm6Iglg==
2024-02-08 18:35:48 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
239	192.168.2.5	50014	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	1506	OUT	GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e&u_sclid=75022d4d-ae50-4a02-8ab1-d3d7e0695f9e&u_scsid=15e0a621-1144-485d-901b-09bb638d2936&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&huah=true&m_dcl=8009&m_fcps=7323&m_pi=7989&m_pl=15337&m_pv=2&m_rd=17424&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F&trackId=c9cbee82-e00d-415b-9153-72ae9e8eb698&ts=1707417345114&v=3.9.1-2402072137 HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:47 UTC	722	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:35:47 GMT access-control-allow-origin: * cache-control: no-cache, no-transform set-cookie: sc_at=v2\|H4sIAAAAAAAAAAXBgQ0AIAgDsItIQBcH54CGKzje1tLaqVde8Qh0QypPy7oZga7g8xmjEsYNjn6TFIVqMgAAAA==;SameSite=None;Version=1;Comment=;Domain=.snapchat.com;Path=/;Max-Age=33696000;Secure content-type: image/png strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 68 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:47 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 0b 49 44 41 54 78 da 63 60 00 02 00 00 05 00 01 e9 fa dc d8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxc`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
240	192.168.2.5	49995	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	2407	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
2024-02-08 18:35:48 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:47 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=9fe282c1b3e60072&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqstgKKdWjSzGIXlO7fMuwCeAeq6OqXMP458 x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 e268ddb03ed9480c5c602c27323a81ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: ChHletaXQuaRSZEt8UUvsWyXv8_TYYGTBg9jI8f_Ct0jP4YzPm-Hjw==
2024-02-08 18:35:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
241	192.168.2.5	50004	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	790	OUT	GET /pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_MIRu885KDHLnHDVd1L_zOfvbAE7ka3IfdUmXyEJ6dX9lBxna&random=1657552313 HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:47 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:47 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:47 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
242	192.168.2.5	50007	3.161.193.117	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	2031	OUT	GET /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
2024-02-08 18:35:48 UTC	513	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html;charset=iso-8859-1 Content-Length: 411 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:48 GMT cache-control: must-revalidate,no-cache,no-store strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 f45ee13a6e40ffa2235d2e4b0449d0ec.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P8 X-Amz-Cf-Id: GqVcEHaCQRZpJG1oCJN7e8eppo4AS93aKbBU7TQClhTsU9FnYk9A9Q==
2024-02-08 18:35:48 UTC	411	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 2f 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 32 3e 48 54 54 50 20 45 52 52 4f 52 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 32 3e 0a 3c 74 61 62 6c 65 3e 0a 3c 74 72 3e 3c 74 68 3e 55 52 49 3a 3c 2f 74 68 3e 3c 74 64 3e 2f 77 65 62 2d 76 69 74 61 6c 73 2f 73 65 6e 64 2d 76 69 74 61 6c 73 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/><title>Error 405 Method Not Allowed</title></head><body><h2>HTTP ERROR 405 Method Not Allowed</h2><table><tr><th>URI:</th><td>/web-vitals/send-vitals</td></tr><tr>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
243	192.168.2.5	50010	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	446	OUT	GET /xdata/images/city/170x136/977409.jpg?k=82c14f9e6cea94829ee0528a3aa4324111d3482e9f095194500746fa7ca2769e&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:47 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sun, 28 Jan 2024 04:59:48 GMT ETag: "ddc288c9f52dca1aef2566f3098edeae42f8480a" Content-Language: 8642 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 e268ddb03ed9480c5c602c27323a81ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: rr7YxukKFIPzAYojFfD6lgVlcOtr7mcQMaENAFkw3LJnAP84KfElWA== Age: 999359
2024-02-08 18:35:47 UTC	8650	IN	Data Raw: 32 31 63 32 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 21c2JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:35:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
244	192.168.2.5	50006	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	446	OUT	GET /xdata/images/city/170x136/977416.jpg?k=ea06e0b572ff052f4fe4fcf35ac3616e8d1b7300f0402756c460a4e9c19e54ed&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:47 UTC	542	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 5928 Connection: close Server: nginx Date: Tue, 30 Jan 2024 12:58:53 GMT ETag: "ebc0243ff8aead66390fde60c468bfa6fd8034d9" Content-Language: 5928 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 c1bfc7dbcf7f9782aa3be590b7ce3d6a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: auDb3534IOYn7DFXvRzJ3mf0XaBM86J5vvlxGHXU9z_KeVuGQyMGnA== Age: 797814
2024-02-08 18:35:47 UTC	5928	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
245	192.168.2.5	50015	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	1511	OUT	GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=CUSTOM_EVENT_2&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e&u_sclid=75022d4d-ae50-4a02-8ab1-d3d7e0695f9e&u_scsid=15e0a621-1144-485d-901b-09bb638d2936&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&huah=true&m_dcl=8009&m_fcps=7323&m_pi=7989&m_pl=15337&m_pv=2&m_rd=17436&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F&trackId=559cb617-2573-4523-9e5d-f09d91c1516c&ts=1707417345126&v=3.9.1-2402072137 HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:48 UTC	681	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:35:48 GMT access-control-allow-origin: * cache-control: no-cache, no-transform set-cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==;SameSite=None;Version=1;Comment=;Domain=.snapchat.com;Path=/;Max-Age=33696000;Secure content-type: image/png strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 68 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: clear Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:48 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 0b 49 44 41 54 78 da 63 60 00 02 00 00 05 00 01 e9 fa dc d8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxc`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
246	192.168.2.5	50002	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	2920	OUT	GET /js_tracking?ver=2&stype=1&ref_action=index&lang=en-us&pid=e4de82b919b800e4&aid=304142&sid=5171fc655664ddf74ab763a094523fb7&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|5\|1&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
2024-02-08 18:35:48 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:48 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=597182c2bc54013d&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejLxfzJmWex1W2rhPL8O4veGsP5P-RigJJE x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 d48a409d6a3222e2cc9a060d30206d3c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: IV15hxlmzpv532YHzCb0hVfN7IR49gcXjk6DpLpTeN2515ptYFasFA==
2024-02-08 18:35:48 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
247	192.168.2.5	50013	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	613	OUT	GET /config/com/54f04dd9-4d34-47ee-87a6-989713215c80.js?v=3.9.1-2402072137 HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:48 UTC	564	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:35:48 GMT access-control-allow-origin: https://www.booking.com content-type: application/javascript strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 186 x-envoy-upstream-service-time: 37 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:48 UTC	186	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 72 79 7b 77 69 6e 64 6f 77 2e 73 6e 61 70 74 72 2e 63 66 67 28 27 35 34 66 30 34 64 64 39 2d 34 64 33 34 2d 34 37 65 65 2d 38 37 61 36 2d 39 38 39 37 31 33 32 31 35 63 38 30 27 2c 7b 22 61 73 63 22 3a 5b 5d 2c 22 61 22 3a 5b 22 50 49 49 22 2c 22 41 56 33 22 5d 2c 22 69 70 67 22 3a 22 34 30 22 2c 22 62 22 3a 5b 5d 2c 22 74 22 3a 22 22 2c 22 76 22 3a 22 33 2e 37 2e 35 2d 32 34 30 31 30 33 32 33 34 37 22 2c 22 65 63 22 3a 5b 5d 7d 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 28 29 3b Data Ascii: !function(){"use strict";try{window.snaptr.cfg('54f04dd9-4d34-47ee-87a6-989713215c80',{"asc":[],"a":["PII","AV3"],"ipg":"40","b":[],"t":"","v":"3.7.5-2401032347","ec":[]})}catch(e){}}();

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
248	192.168.2.5	50001	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	3060	OUT	GET /js_errors?pid=e4de82b919b800e4&url=https%3A%2F%2Fwww.booking.com%2F&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2F&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSObZWJFfVDSMePCFYZWFXO&cors=1 HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
2024-02-08 18:35:48 UTC	684	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:48 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=77b482c2241e0276&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpn_enQ4fg-gbUxKKG7ZAKgHrvFhnric9A x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7699e4f17e72e42cba0c247c650005d2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Q6dJ6wLPXdHhljfdKV4uyT_RoxYaxngsJQTA_Eh3owW_NVkN-13-4Q==
2024-02-08 18:35:48 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
249	192.168.2.5	50012	74.125.136.138	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	655	OUT	GET /about/enterprise/ HTTP/1.1 Host: marketingplatform.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:48 UTC	887	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/html Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/uxe-owners-acl/marketing_platform Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="uxe-owners-acl/marketing_platform" Report-To: {"group":"uxe-owners-acl/marketing_platform","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/uxe-owners-acl/marketing_platform"}]} Content-Length: 125161 Date: Thu, 08 Feb 2024 18:35:48 GMT Expires: Thu, 08 Feb 2024 18:35:48 GMT Cache-Control: private, max-age=3000 Last-Modified: Tue, 09 Jan 2024 09:58:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:48 UTC	365	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 67 6c 75 65 2d 66 6c 65 78 62 6f 78 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0a 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 45 6e Data Ascii: <!DOCTYPE html><html class="glue-flexbox" lang="en"> <head> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge" /> <meta content="initial-scale=1, minimum-scale=1, width=device-width" name="viewport"> <title>En
2024-02-08 18:35:48 UTC	1252	IN	Data Raw: 63 6f 6e 74 65 6e 74 3d 22 47 6f 6f 67 6c 65 20 4d 61 72 6b 65 74 69 6e 67 20 50 6c 61 74 66 6f 72 6d 20 6f 66 66 65 72 73 20 61 6e 20 65 6e 74 65 72 70 72 69 73 65 20 61 6e 61 6c 79 74 69 63 73 20 73 6f 6c 75 74 69 6f 6e 20 74 6f 20 67 61 69 6e 20 69 6e 73 69 67 68 74 73 20 69 6e 74 6f 20 79 6f 75 72 20 61 64 76 65 72 74 69 73 69 6e 67 2c 20 6d 61 72 6b 65 74 69 6e 67 2c 20 63 75 73 74 6f 6d 65 72 73 2c 20 61 6e 64 20 73 61 6c 65 73 2e 22 20 2f 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 63 61 6e 6f 6e 69 63 61 6c 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 72 6b 65 74 69 6e 67 70 6c 61 74 66 6f 72 6d 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 61 62 6f 75 74 2f 65 6e 74 65 72 70 72 69 73 65 2f 22 2f 3e 0a 0a 0a 20 20 3c 73 63 72 69 70 74 20 74 79 70 Data Ascii: content="Google Marketing Platform offers an enterprise analytics solution to gain insights into your advertising, marketing, customers, and sales." /> <link rel="canonical" href="https://marketingplatform.google.com/about/enterprise/"/> <script typ
2024-02-08 18:35:48 UTC	1252	IN	Data Raw: 73 3a 2f 2f 77 77 77 2e 66 61 63 65 62 6f 6f 6b 2e 63 6f 6d 2f 47 6f 6f 67 6c 65 2f 22 2c 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 2f 75 73 65 72 2f 47 6f 6f 67 6c 65 22 2c 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6c 69 6e 6b 65 64 69 6e 2e 63 6f 6d 2f 63 6f 6d 70 61 6e 79 2f 67 6f 6f 67 6c 65 22 2c 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 77 69 6b 69 64 61 74 61 2e 6f 72 67 2f 77 69 6b 69 2f 51 39 35 22 2c 20 22 68 74 74 70 73 3a 2f 2f 65 6e 2e 77 69 6b 69 70 65 64 69 61 2e 6f 72 67 2f 77 69 6b 69 2f 47 6f 6f 67 6c 65 22 5d 7d 2c 22 63 6f 70 79 72 69 67 68 74 48 6f 6c 64 65 72 22 3a 20 7b 22 40 74 79 70 65 22 3a 20 22 4f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 2c 22 6e 61 6d 65 22 3a 20 22 47 6f 6f 67 6c 65 22 2c 22 75 72 Data Ascii: s://www.facebook.com/Google/", "https://www.youtube.com/user/Google", "https://www.linkedin.com/company/google", "https://www.wikidata.org/wiki/Q95", "https://en.wikipedia.org/wiki/Google"]},"copyrightHolder": {"@type": "Organization","name": "Google","ur
2024-02-08 18:35:48 UTC	1252	IN	Data Raw: 70 72 69 73 65 20 41 64 76 65 72 74 69 73 69 6e 67 20 26 61 6d 70 3b 20 41 6e 61 6c 79 74 69 63 73 20 53 6f 6c 75 74 69 6f 6e 73 20 2d 20 47 6f 6f 67 6c 65 20 4d 61 72 6b 65 74 69 6e 67 20 50 6c 61 74 66 6f 72 6d 22 3e 0a 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 47 6f 6f 67 6c 65 20 4d 61 72 6b 65 74 69 6e 67 20 50 6c 61 74 66 6f 72 6d 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 47 6f 6f 67 6c 65 20 4d 61 72 6b 65 74 69 6e 67 20 50 6c 61 74 66 6f 72 6d 20 6f 66 66 65 72 73 20 61 6e 20 65 6e 74 65 72 70 72 69 73 65 20 61 6e 61 6c 79 74 69 63 73 20 73 6f 6c 75 74 69 6f 6e 20 74 Data Ascii: prise Advertising & Analytics Solutions - Google Marketing Platform"> <meta property="og:site_name" content="Google Marketing Platform"> <meta property="og:description" content="Google Marketing Platform offers an enterprise analytics solution t
2024-02-08 18:35:48 UTC	1252	IN	Data Raw: 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 38 30 78 31 38 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 67 2f 32 78 2f 67 6f 6f 67 6c 65 67 5f 73 74 61 6e 64 61 72 64 5f 63 6f 6c 6f 72 5f 31 39 32 64 70 2e 70 6e 67 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 70 72 6f 64 75 63 74 2f 69 63 6f 2f 67 6f 6f 67 6c 65 67 5f 73 74 61 6e 64 61 72 64 5f 33 32 64 70 2e 69 63 6f 22 Data Ascii: ecomposed" sizes="180x180" href="https://www.gstatic.com/images/branding/googleg/2x/googleg_standard_color_192dp.png"> <link rel="icon" type="image/png" sizes="32x32" href="https://www.gstatic.com/images/branding/product/ico/googleg_standard_32dp.ico"
2024-02-08 18:35:48 UTC	1252	IN	Data Raw: 27 3a 0a 20 20 20 20 20 20 20 20 6e 65 77 20 44 61 74 65 28 29 2e 67 65 74 54 69 6d 65 28 29 2c 65 76 65 6e 74 3a 27 67 74 6d 2e 6a 73 27 7d 29 3b 76 61 72 20 66 3d 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 73 29 5b 30 5d 2c 0a 20 20 20 20 20 20 20 20 6a 3d 64 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 73 29 2c 64 6c 3d 6c 21 3d 27 64 61 74 61 4c 61 79 65 72 27 3f 27 26 6c 3d 27 2b 6c 3a 27 27 3b 6a 2e 61 73 79 6e 63 3d 74 72 75 65 3b 6a 2e 73 72 63 3d 0a 20 20 20 20 20 20 20 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 6d 2e 6a 73 3f 69 64 3d 27 2b 69 2b 64 6c 3b 66 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 6a 2c 66 29 3b 0a 20 Data Ascii: ': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= 'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
2024-02-08 18:35:48 UTC	1252	IN	Data Raw: 68 65 61 64 65 72 5f 5f 68 61 6d 62 75 72 67 65 72 2d 6c 69 6e 6b 22 0a 20 20 20 20 20 20 20 20 20 20 61 72 69 61 2d 63 6f 6e 74 72 6f 6c 73 3d 22 68 2d 6a 73 2d 68 65 61 64 65 72 5f 5f 64 72 61 77 65 72 22 0a 20 20 20 20 20 20 20 20 20 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 3d 22 66 61 6c 73 65 22 0a 20 20 20 20 20 20 20 20 20 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 4f 70 65 6e 20 74 68 65 20 6e 61 76 69 67 61 74 69 6f 6e 20 64 72 61 77 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 76 67 20 61 6c 74 3d 22 22 20 72 6f 6c 65 3d 22 69 6d 67 22 20 63 6c 61 73 73 3d 22 68 2d 63 2d 68 65 61 64 65 72 5f 5f 68 61 6d 62 75 72 67 65 72 2d 69 6d 67 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 2d 63 2d 68 65 61 64 65 72 5f 5f 68 61 6d 62 75 72 67 65 72 2d 69 6d 67 2d Data Ascii: header__hamburger-link" aria-controls="h-js-header__drawer" aria-expanded="false" aria-label="Open the navigation drawer"> <svg alt="" role="img" class="h-c-header__hamburger-img h-c-header__hamburger-img-
2024-02-08 18:35:48 UTC	1252	IN	Data Raw: 70 72 6f 64 75 63 74 2d 6c 6f 67 6f 22 3e 0a 20 20 20 20 20 20 3c 61 20 20 20 20 20 64 61 74 61 2d 67 2d 65 76 65 6e 74 3d 22 66 6f 72 20 65 6e 74 65 72 70 72 69 73 65 73 22 0a 20 20 20 20 64 61 74 61 2d 67 2d 61 63 74 69 6f 6e 3d 22 6c 6f 67 6f 22 0a 20 20 20 20 64 61 74 61 2d 67 2d 6c 61 62 65 6c 3d 22 67 6c 6f 62 61 6c 20 6e 61 76 22 0a 0a 20 20 20 20 20 20 20 20 20 20 68 72 65 66 3d 22 2f 61 62 6f 75 74 2f 22 0a 20 20 20 20 20 20 20 20 20 20 63 6c 61 73 73 3d 22 68 2d 63 2d 68 65 61 64 65 72 5f 5f 70 72 6f 64 75 63 74 2d 6c 6f 67 6f 2d 6c 69 6e 6b 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 68 2d 63 2d 68 65 61 64 65 72 5f 5f 70 72 6f 64 75 63 74 2d 6c 6f 67 6f 2d 74 65 78 74 20 67 6d 70 2d 6c 6f 67 6f 2d 74 65 78 74 22 3e Data Ascii: product-logo"> <a data-g-event="for enterprises" data-g-action="logo" data-g-label="global nav" href="/about/" class="h-c-header__product-logo-link"> <span class="h-c-header__product-logo-text gmp-logo-text">
2024-02-08 18:35:48 UTC	1252	IN	Data Raw: 72 20 73 6d 61 6c 6c 20 62 75 73 69 6e 65 73 73 65 73 22 0a 20 20 20 20 64 61 74 61 2d 67 2d 6c 61 62 65 6c 3d 22 67 6c 6f 62 61 6c 20 6e 61 76 22 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 68 72 65 66 3d 22 2f 61 62 6f 75 74 2f 73 6d 61 6c 6c 2d 62 75 73 69 6e 65 73 73 2f 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6c 61 73 73 3d 22 68 2d 63 2d 68 65 61 64 65 72 5f 5f 6e 61 76 2d 6c 69 2d 6c 69 6e 6b 22 0a 20 64 61 74 61 2d 64 72 6f 70 64 6f 77 6e 2d 74 61 72 67 65 74 3d 22 73 6d 62 2d 73 75 62 6e 61 76 22 20 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 46 6f 72 20 53 6d 61 6c 6c 20 42 75 73 69 6e 65 73 73 65 73 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 Data Ascii: r small businesses" data-g-label="global nav" href="/about/small-business/" class="h-c-header__nav-li-link" data-dropdown-target="smb-subnav" > For Small Businesses </a>
2024-02-08 18:35:48 UTC	1252	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 61 72 67 65 74 3d 22 5f 73 65 6c 66 22 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6c 61 73 73 3d 22 68 2d 63 2d 68 65 61 64 65 72 5f 5f 6e 61 76 2d 6c 69 2d 6c 69 6e 6b 22 0a 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 42 6c 6f 67 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 3c 2f 75 6c 3e 0a 20 20 3c 2f 6e 61 76 3e 0a 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 2d 63 2d 68 65 61 64 65 72 5f 5f 63 74 61 20 68 2d 63 2d 68 65 61 64 65 72 5f 5f 63 74 61 2d 2d 74 6f 70 2d 74 69 65 72 22 3e 0a 20 20 20 20 3c 75 6c 20 63 6c 61 73 73 3d 22 68 2d 63 2d 68 65 61 64 65 72 5f 5f 63 74 61 2d 6c 69 73 74 22 3e 0a 20 20 20 20 20 20 Data Ascii: target="_self" class="h-c-header__nav-li-link"> Blog </a> </li> </ul> </nav> <div class="h-c-header__cta h-c-header__cta--top-tier"> <ul class="h-c-header__cta-list">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
250	192.168.2.5	50017	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	1319	OUT	GET /pagead/1p-user-list/988382855/?random=1707417344393&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_gWvym3Dpd03oexxdK-7GraOGOHdCrnDIP6cnm_QV7Lz1kW9a&random=1612479673&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:48 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
251	192.168.2.5	50005	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	446	OUT	GET /xdata/images/city/170x136/977388.jpg?k=4c9c54255e9d2e2d8084959527abea6b6b8a4b8a538a921f1df9e4bea2503ff6&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:48 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 7785 Connection: close Server: nginx Date: Mon, 22 Jan 2024 16:01:01 GMT ETag: "2eef344c8759d5a9a3cb0676ff6e037d072dced5" Content-Language: 7785 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 61bbe72b71f7b857c695c31fdeb7b3a6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Xynkw4ZTAnbCsryvdQDwsuWbUO98-2DQX9bwE2mF8SA2KA3PFwm3Tg== Age: 1478087
2024-02-08 18:35:48 UTC	7785	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
252	192.168.2.5	50003	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:47 UTC	446	OUT	GET /xdata/images/city/170x136/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:48 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 7768 Connection: close Server: nginx Date: Sun, 21 Jan 2024 15:42:33 GMT ETag: "9dc6e5d881bbf48e208e43aee1386e512a6c4f79" Content-Language: 7768 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 d48a409d6a3222e2cc9a060d30206d3c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: hDv4ffcbrSN8d555QPTE0m5d1JXUxfJHNiYHVa6evkXxmM8e9FklMQ== Age: 1565595
2024-02-08 18:35:48 UTC	7768	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
253	192.168.2.5	50009	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	392	OUT	GET /design-assets/assets/v3.109.0/images-flags/Us@3x.png HTTP/1.1 Host: t-cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:48 UTC	532	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 950 Connection: close Last-Modified: Tue, 05 Dec 2023 13:24:05 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 12:02:50 GMT ETag: "025b409525836b9e0913038b2556d2cf" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 09aa283795aaafe63cbd7c2cbac2c306.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: ru4gKKwj-Q4h3VaO8DN12gY0mKgqn6_IMgXlGXxDIpC5wW0QZHFCCQ== Age: 23579 Vary: Origin
2024-02-08 18:35:48 UTC	950	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 48 00 00 00 48 08 03 00 00 00 62 33 43 75 00 00 00 54 50 4c 54 45 19 2f 5d d1 77 7c cb 68 6d 3e 50 77 e0 a2 a6 d9 8d 91 21 37 63 ff ff ff bd 3d 44 c4 51 58 56 49 69 2b 3f 69 69 78 96 89 95 ac 59 68 8a 4a 5c 80 35 48 70 7a 87 a2 9d a6 ba e3 e6 ec d0 d5 de b0 b8 c8 bf c5 d2 32 31 59 d3 7d 82 e8 bd bf c9 62 67 f4 f5 f7 9d dd 5e 75 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 03 08 49 44 41 54 78 9c ed 56 d9 72 dc 20 10 9c 04 07 d6 e1 3e 37 09 ff ff 9f 29 98 19 d9 96 8d 94 b8 f4 e4 da ae 7d e8 5a a1 d6 d0 f4 00 00 9f c2 fd b6 c7 fc 5b f3 f3 f7 04 e4 87 cf 16 42 89 47 db 40 24 7a 22 ce 10 09 96 85 ea 4a 48 37 95 e7 7b b2 aa ec 26 b1 bd 47 14 ec 1d 05 4c 56 75 7e 4e 14 55 c4 a2 22 Data Ascii: PNGIHDRHHb3CuTPLTE/]w\|hm>Pw!7c=DQXVIi+?iixYhJ\5Hpz21Y}bg^upHYsIDATxVr >7)}Z[BG@$z"JH7{&GLVu~NU"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
254	192.168.2.5	50020	216.239.32.21	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	2770	OUT	GET /g/collect?v=2&tid=G-A12345&gtm=45je4250z879615461za200&_p=1707417343003&gcs=G1--&gcd=13l3l3l3l5&npa=0&dma=0&cid=421694156.1707417338&ul=en-us&sr=1280x1024&_fplc=0&ur=US-FL&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pscdl=noapi&sst.uc=US&sst.rnd=2080525821.1707417344&sst.gcd=13l3l3l3l5&sst.tft=1707417343003&_s=1&sid=1707417345&sct=1&seg=0&dl=https%3A%2F%2Fwww.booking.com%2F&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&_fv=1&_ss=1&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=17859&richsstsse HTTP/1.1 Host: gtm-mktg.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
2024-02-08 18:35:48 UTC	676	IN	HTTP/1.1 200 OK Content-Type: text/plain Vary: Accept-Encoding set-cookie: FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; Max-Age=63072000; Domain=booking.com; Path=/; Secure; HttpOnly set-cookie: FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; Max-Age=72000; Domain=booking.com; Path=/; Secure cache-control: no-cache x-content-type-options: nosniff X-Cloud-Trace-Context: 3d823b9738e38f91fd9fe36620bda9ef Date: Thu, 08 Feb 2024 18:35:48 GMT Server: Google Frontend Content-Length: 65 Expires: Thu, 08 Feb 2024 18:35:48 GMT Connection: close
2024-02-08 18:35:48 UTC	65	IN	Data Raw: 65 76 65 6e 74 3a 20 6d 65 73 73 61 67 65 0a 64 61 74 61 3a 20 7b 22 72 65 73 70 6f 6e 73 65 22 3a 7b 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 62 6f 64 79 22 3a 22 22 7d 7d 0a 0a Data Ascii: event: messagedata: {"response":{"status_code":200,"body":""}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
255	192.168.2.5	50016	108.177.122.148	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	1177	OUT	GET /activity;register_conversion=1;src=4228414;type=views;cat=views;ord=4995395844978;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=2105455417;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:35:48 UTC	2221	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"10643908661775569175"}],"aggregatable_trigger_data":[{"filters":{"14":["11794238"]},"key_piece":"0x5bdccd6bd67d4e1c","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xa446ee5f5be5ef06","not_filters":{"14":["11794238"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["11794238"]},"key_piece":"0xd3325b43d3d15f8b","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x22c5b735c1232ea8","not_filters":{"14":["11794238"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"11542751917907364492","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"10643908661775569175","filters":{"14":["11794238"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"10643908661775569175","filters":{"14":["11794238"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"10643908661775569175","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"10643908661775569175","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["4228414"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sat, 09-Mar-2024 18:35:48 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
256	192.168.2.5	50032	151.101.128.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	716	OUT	GET /user/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%7D&cb=1707417346995&dep=2%2CPAGE_LOAD HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:48 UTC	684	IN	HTTP/1.1 200 OK Connection: close Content-Length: 302 access-control-expose-headers: Epik,Pin-Unauth pin-unauth: dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 2 referrer-policy: origin x-pinterest-rid: 1692653603042919 Date: Thu, 08 Feb 2024 18:35:48 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: f9d1c7100d6ab6a9fc70375cea0fca5e275d3fa9
2024-02-08 18:35:48 UTC	302	IN	Data Raw: 7b 22 61 65 6d 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 65 6d 46 6e 4c 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 50 68 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 47 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 44 62 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 4c 6f 63 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 45 78 74 65 72 6e 61 6c 49 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 45 70 69 6b 49 66 72 61 6d 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 68 72 6f 6d 65 4e 65 77 55 73 65 72 41 67 65 6e 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 45 75 22 3a 74 72 75 65 2c 22 69 73 55 74 69 6c 69 7a 69 6e 67 41 64 76 65 72 74 69 73 65 72 31 70 45 6e 61 Data Ascii: {"aemEnabled":true,"aemFnLnEnabled":false,"aemPhEnabled":false,"aemGeEnabled":false,"aemDbEnabled":false,"aemLocEnabled":false,"aemExternalIdEnabled":false,"ctEpikIframeEnabled":true,"chromeNewUserAgentEnabled":true,"isEu":true,"isUtilizingAdvertiser1pEna

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
257	192.168.2.5	50022	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	451	OUT	GET /xdata/images/xphoto/263x210/57584488.jpeg?k=d8d4706fc72ee789d870eb6b05c0e546fd4ad85d72a3af3e30fb80ca72f0ba57&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:48 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Tue, 30 Jan 2024 04:39:46 GMT ETag: "196fea0ab45d56a1dbce18f3c3cd9eb1a591fb85" Content-Language: 8621 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 4a9f56098c7d51e12b8d2ac77b6f1bcc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 5zHdUvJAiLu8ZJs6XWPhnZmvhg1SN-Q6dV_K96r9yqvnhoEApm0w4w== Age: 827762
2024-02-08 18:35:48 UTC	8629	IN	Data Raw: 32 31 61 64 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 21adJFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:35:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
258	192.168.2.5	50023	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	446	OUT	GET /xdata/images/city/170x136/976877.jpg?k=2aab28217f0fb039e0f35ea2b2c3976141b5860b074f74220edf998115935cda&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:48 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sat, 03 Feb 2024 04:46:57 GMT ETag: "40721dda4c91c5977182d60b367c4d39dec3ab3d" Content-Language: 8350 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 6f067a3fd6e721a7db2a2901701a65d8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: PHr-IpClh56goVE_EeFlW2tCL3OnRCz7u4N3sp5OXbpTwXVD3O6icQ== Age: 481731
2024-02-08 18:35:48 UTC	8358	IN	Data Raw: 32 30 39 65 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 209eJFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:35:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
259	192.168.2.5	50025	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	451	OUT	GET /xdata/images/hotel/263x210/100235855.jpeg?k=5b6e6cff16cfd290e953768d63ee15f633b56348238a705c45759aa3a81ba82b&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:48 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sun, 21 Jan 2024 16:24:01 GMT ETag: "9aff9e5c9b69d9442b7f563196b1a2235d432b9f" Content-Language: 12530 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 6e0f9dce97fcb3c9b684592a289e4e72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: cx_rCB2ob3O_eD0UT5w2FhKzQsDGDA6AagpXYHhgAQ3NY6D8se53gA== Age: 1563107
2024-02-08 18:35:48 UTC	12538	IN	Data Raw: 33 30 66 32 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 30f2JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:35:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
260	192.168.2.5	50033	151.101.128.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	755	OUT	GET /user/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1707417346997&dep=5%2CEVENT_TAGS_ABSENT HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:48 UTC	684	IN	HTTP/1.1 200 OK Connection: close Content-Length: 302 access-control-expose-headers: Epik,Pin-Unauth pin-unauth: dWlkPU4yUmlaRFEzTkdNdFpqbGxOQzAwWW1FMUxXSXlOVFV0Wm1VeU9HUmtZV0ppWldGbQ cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 0 referrer-policy: origin x-pinterest-rid: 9311020053850088 Date: Thu, 08 Feb 2024 18:35:48 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: f9d1c7100d6ab6a9fc70375cea0fca5e275d3fa9
2024-02-08 18:35:48 UTC	302	IN	Data Raw: 7b 22 61 65 6d 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 65 6d 46 6e 4c 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 50 68 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 47 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 44 62 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 4c 6f 63 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 45 78 74 65 72 6e 61 6c 49 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 45 70 69 6b 49 66 72 61 6d 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 68 72 6f 6d 65 4e 65 77 55 73 65 72 41 67 65 6e 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 45 75 22 3a 74 72 75 65 2c 22 69 73 55 74 69 6c 69 7a 69 6e 67 41 64 76 65 72 74 69 73 65 72 31 70 45 6e 61 Data Ascii: {"aemEnabled":true,"aemFnLnEnabled":false,"aemPhEnabled":false,"aemGeEnabled":false,"aemDbEnabled":false,"aemLocEnabled":false,"aemExternalIdEnabled":false,"ctEpikIframeEnabled":true,"chromeNewUserAgentEnabled":true,"isEu":true,"isUtilizingAdvertiser1pEna

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
261	192.168.2.5	50024	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	446	OUT	GET /xdata/images/city/170x136/977381.jpg?k=ab236c5e99ba40341684e2d3bfcd8256d36f5e63883350af9faa988cd4d49939&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:48 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 6127 Connection: close Server: nginx Date: Sat, 20 Jan 2024 23:59:23 GMT ETag: "981fae551c2728433847e16bffb3f0a7cc67dc9c" Content-Language: 6127 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 d48a409d6a3222e2cc9a060d30206d3c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Rb3Qdf_cJUqNxjzraI-cE3Rq3vvHeZc38gSwxMUAUYDj70rLH34wYA== Age: 1622185
2024-02-08 18:35:48 UTC	6127	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
262	192.168.2.5	50029	18.67.65.100	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	404	OUT	GET /d8c14d4960ca/a18a4859af9c/verify HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:48 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Thu, 08 Feb 2024 18:35:48 GMT X-Cache: Error from cloudfront Via: 1.1 d0f195624e615b103c40900f88cfd922.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: bgZboc9nC8Bn0tLCmxiCKMuFhzlT02RO9Y6I_gwvud7EQekBLgpjEg==
2024-02-08 18:35:48 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
263	192.168.2.5	50031	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive Content-Length: 1770 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:48 UTC	1770	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 6e 55 6d 43 74 74 45 41 41 41 41 41 3a 4c 53 73 63 34 4e 6e 6b 51 31 62 36 34 75 6b 5a 79 43 68 63 30 2f 2b 51 73 6f 64 69 76 6d 30 5a 33 47 47 75 57 69 43 77 4e 4b 2f 4c 32 48 67 6e 6d 6e 41 6f 51 4a 59 52 30 6d 68 32 76 4d 53 66 34 4e 74 68 33 2b 43 4f 52 52 38 44 4f 64 41 34 76 79 59 56 78 39 66 76 4a 57 45 69 46 59 63 38 34 59 6c 47 48 41 36 37 75 33 42 58 75 64 42 52 6a 47 39 54 46 76 37 53 4d 6f 47 4b 66 43 42 62 4e 6c 6e 31 36 65 47 53 4f 54 6d 68 62 78 75 56 4b 53 34 4f 35 4a 32 65 66 47 62 37 57 39 42 47 4a 48 55 4d 79 43 4b 4b 61 65 72 43 6e 4c 65 64 30 53 45 38 44 2b Data Ascii: {"existing_token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAnUmCttEAAAAA:LSsc4NnkQ1b64ukZyChc0/+Qsodivm0Z3GGuWiCwNK/L2HgnmnAoQJYR0mh2vMSf4Nth3+CORR8DOdA4vyYVx9fvJWEiFYc84YlGHA67u3BXudBRjG9TFv7SMoGKfCBbNln16eGSOTmhbxuVKS4O5J2efGb7W9BGJHUMyCKKaerCnLed0SE8D+
2024-02-08 18:35:48 UTC	585	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 860 Connection: close Date: Thu, 08 Feb 2024 18:35:48 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65c51f04-4cbbbd9d6bd56f3079afebe5 X-Cache: Miss from cloudfront Via: 1.1 d0f195624e615b103c40900f88cfd922.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: WDluZYtJ8VGk5vmqHSDzgS6BpvC_2Ok73H1k9RV2t7FlrR7KvLp6nA==
2024-02-08 18:35:48 UTC	860	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 6f 52 61 42 66 33 6b 64 41 41 41 41 3a 55 71 4d 42 32 50 56 4b 30 39 52 70 54 6d 63 30 42 59 54 79 43 48 70 6e 70 79 79 49 4f 41 42 64 69 52 72 79 5a 6d 74 2f 35 50 44 56 76 57 66 37 4d 64 76 41 39 4e 32 4b 4d 5a 50 2f 73 59 62 65 45 57 53 36 34 6b 4c 6e 37 6d 73 50 4c 7a 4a 57 7a 76 4f 34 66 41 43 46 30 6a 41 38 31 6d 4c 6a 55 43 33 6f 69 5a 43 6d 31 4e 2b 77 6c 43 54 63 52 73 67 4d 6b 69 53 4f 6a 4c 4b 38 44 4f 6e 6c 74 2b 55 54 7a 52 63 64 70 68 31 7a 5a 51 74 78 42 67 6e 46 4b 69 62 4e 39 4e 55 6a 63 45 65 4c 69 50 53 49 64 76 46 61 58 42 6e 33 72 51 73 37 36 46 56 70 6d 65 6e 43 68 77 4f 6e 65 78 64 Data Ascii: {"token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoRaBf3kdAAAA:UqMB2PVK09RpTmc0BYTyCHpnpyyIOABdiRryZmt/5PDVvWf7MdvA9N2KMZP/sYbeEWS64kLn7msPLzJWzvO4fACF0jA81mLjUC3oiZCm1N+wlCTcRsgMkiSOjLK8DOnlt+UTzRcdph1zZQtxBgnFKibN9NUjcEeLiPSIdvFaXBn3rQs76FVpmenChwOnexd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
264	192.168.2.5	50030	142.251.15.154	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	1270	OUT	GET /ddm/fls/z/dc_pre=COTEnqOxnIQDFZE5RAgd3v0I0A;src=4228414;type=views;cat=views;ord=4995395844978;npa=0;auiddc=;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=2105455417;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2 HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:48 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
265	192.168.2.5	50028	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	2106	OUT	GET /pagead/1p-conversion/988382855/?random=71414136&cv=11&fst=1707417344353&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=ZgWTCPidsIkYEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&value=0&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&fmt=3&ct_cookie_present=false&sscte=1&crd=CIK9sQII7LuxAiIBAUABSid0cmlnZ2VyLCBldmVudC1zb3VyY2U9bmF2aWdhdGlvbi1zb3VyY2ViBAoCAgM&pscrd=CJL-lL3ht4-vyAESTkNoQUlnSlNTcmdZUTRQWHg3c3lZMlA4WkVpWUFtUzFSNi15TEtiTDJjTXdtWmVCbnhGT0VENVRiZjU0MTZpV2RyRUJoMFh6MnNhdHZqdxpaQ2hFSWdKU1NyZ1lRc3I2NWlwYVprN0diQVJJdUFFRzJzTzFsd0J1c0VxelpYa0VxMXF1c2ZsQ0FCMGhtMlZUY05ENG40cnd1blR3c1FEY2dPclZNMERGakdBIhMIpr_8orGchAMVpZTLAR2HqA4eMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAg&is_vtc=1&ocp_id=AR_FZea6KKWprr4Ph9G68AE&cid=CAQSKQAvHhf_Gt7QoUpXdus5QEyG1eIxuz3AHR2Emh1ZeXw0s6O0dji9wyhm&eitems=ChAIgJSSrgYQzemNw6uqy5stEh0ArMYPzZOA1xjXSQD69MmJkKwXUUq0zbPsrxxgqQ&random=1769082692 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:48 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
266	192.168.2.5	50034	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	2416	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
2024-02-08 18:35:48 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:48 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=1f2f82c2f64202c5&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGUVQ5roHjzJbYgHC9Cn6QidszpFBmDxH6g x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 e268ddb03ed9480c5c602c27323a81ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: a8_YFlE3N60tQNmgkiBO6onsz7Y3AQTI1K1G5c5GYRCj6-DQ_av1VA==
2024-02-08 18:35:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
267	192.168.2.5	50037	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	451	OUT	GET /xdata/images/hotel/263x210/119467716.jpeg?k=f3c2c6271ab71513e044e48dfde378fcd6bb80cb893e39b9b78b33a60c0131c9&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:48 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Tue, 30 Jan 2024 06:16:58 GMT ETag: "118c01722e55044d816db848ac471d09024e4d85" Content-Language: 10601 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 8415794d557292780ff382a8c5bd6058.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: uwQSjiFyPrIo7_ou2orh5ksQsc-KOfWx2ybCKFiaPyoMoZmVNXjZ1A== Age: 821930
2024-02-08 18:35:48 UTC	10609	IN	Data Raw: 32 39 36 39 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 2969JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:35:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
268	192.168.2.5	50036	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	451	OUT	GET /xdata/images/xphoto/263x210/45450084.jpeg?k=f8c2954e867a1dd4b479909c49528531dcfb676d8fbc0d60f51d7b51bb32d1d9&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:48 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sun, 21 Jan 2024 16:24:01 GMT ETag: "581d7d6f2cc7c0efc5bd54aa0a1fa4c3bdb259f4" Content-Language: 10257 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 9546eb427ef2137803aed00cad4fc426.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: YS849ydDeV-ncpTmYjor6ciFW040a-OoFzKGz02A4LYATJ9KmMSviA== Age: 1563107
2024-02-08 18:35:48 UTC	10265	IN	Data Raw: 32 38 31 31 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 2811JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:35:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
269	192.168.2.5	50045	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	1378	OUT	GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e&u_sclid=75022d4d-ae50-4a02-8ab1-d3d7e0695f9e&u_scsid=15e0a621-1144-485d-901b-09bb638d2936&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&huah=true&m_dcl=8009&m_fcps=7323&m_pi=7989&m_pl=15337&m_pv=2&m_rd=17424&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F&trackId=c9cbee82-e00d-415b-9153-72ae9e8eb698&ts=1707417345114&v=3.9.1-2402072137 HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBgQ0AIAgDsItIQBcH54CGKzje1tLaqVde8Qh0QypPy7oZga7g8xmjEsYNjn6TFIVqMgAAAA==
2024-02-08 18:35:48 UTC	526	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:35:48 GMT access-control-allow-origin: * cache-control: no-cache, no-transform content-type: image/png strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 68 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:48 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 0b 49 44 41 54 78 da 63 60 00 02 00 00 05 00 01 e9 fa dc d8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxc`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
270	192.168.2.5	50043	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	1758	OUT	GET /pagead/1p-user-list/1060768846/?random=1707417344498&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nh4qqVoyv2KiIad5kPNddW86jrjYgKSk8&npa=0&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_coWeJkuj5Q3yNq70idh4WJdx3zfM6vO8uiPSFkYUXc53APfl&random=2710065598&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:48 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
271	192.168.2.5	50040	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	2407	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
2024-02-08 18:35:48 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:48 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=bb5382c24e1a02fd&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqstQl65E0q6QZhpxh8i67P-BzJX_ELBZJAg x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 8415794d557292780ff382a8c5bd6058.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: LuytZDub6FdUrVSEVD0bCxGM2w7jIxW0Tve7iAzw8Igd1qBopD8GOg==
2024-02-08 18:35:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
272	192.168.2.5	50042	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	1383	OUT	GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=CUSTOM_EVENT_2&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e&u_sclid=75022d4d-ae50-4a02-8ab1-d3d7e0695f9e&u_scsid=15e0a621-1144-485d-901b-09bb638d2936&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&huah=true&m_dcl=8009&m_fcps=7323&m_pi=7989&m_pl=15337&m_pv=2&m_rd=17436&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F&trackId=559cb617-2573-4523-9e5d-f09d91c1516c&ts=1707417345126&v=3.9.1-2402072137 HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:35:48 UTC	526	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:35:48 GMT access-control-allow-origin: * cache-control: no-cache, no-transform content-type: image/png strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 68 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:48 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 0b 49 44 41 54 78 da 63 60 00 02 00 00 05 00 01 e9 fa dc d8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxc`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
273	192.168.2.5	50044	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	1317	OUT	GET /pagead/1p-user-list/973712236/?random=1707417344535&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_y-kMF1ofi7FwUZE1wjFhsX8V103pkvRQFAPg8V_tgv1nWHYT&random=766671962&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:48 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
274	192.168.2.5	50046	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	1318	OUT	GET /pagead/1p-user-list/975716499/?random=1707417344655&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_niQM3PtsxhJz-etk4SiuaPuc1uxP5cjUkkc_zlGDgt3gu_xP&random=1844959785&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:48 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
275	192.168.2.5	50047	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	1318	OUT	GET /pagead/1p-user-list/975716499/?random=1707417344619&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_Z60qOBRC0pooYPssvY44WDhxPvAjD20AS2HYNebi_Po98qJK&random=3590766466&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:48 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
276	192.168.2.5	50048	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	1317	OUT	GET /pagead/1p-user-list/973712236/?random=1707417344582&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_rndnWdCAQi6iVyq6cjrgu1EiG1Y8Myw6XFmXv6PP16V-EZAM&random=593389060&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:48 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
277	192.168.2.5	50049	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	1084	OUT	GET /pagead/1p-user-list/988382855/?random=1707417344393&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_gWvym3Dpd03oexxdK-7GraOGOHdCrnDIP6cnm_QV7Lz1kW9a&random=1612479673&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:48 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
278	192.168.2.5	50050	151.101.128.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	1401	OUT	GET /v3/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%226461a31a%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1707417346998 HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:49 UTC	594	IN	HTTP/1.1 200 OK Connection: close Content-Length: 35 cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT content-type: image/gif access-control-allow-origin: * set-cookie: ar_debug=1; Expires=Fri, 07 Feb 2025 18:35:49 GMT; Path=/; Domain=.pinterest.com; Secure; HTTPOnly; SameSite=None x-envoy-upstream-service-time: 1 referrer-policy: origin x-pinterest-rid: 1702364451705642 Date: Thu, 08 Feb 2024 18:35:49 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: f9d1c7100d6ab6a9fc70375cea0fca5e275d3fa9
2024-02-08 18:35:49 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
279	192.168.2.5	50051	151.101.128.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	1604	OUT	GET /v3/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1707417347660&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22aem_eligible_list%22%3A%5B%22fn%22%5D%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%226461a31a%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:49 UTC	914	IN	HTTP/1.1 200 OK Connection: close Content-Length: 35 cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT content-type: image/gif access-control-allow-origin: * set-cookie: ar_debug=1; Expires=Fri, 07 Feb 2025 18:35:49 GMT; Path=/; Domain=.pinterest.com; Secure; HTTPOnly; SameSite=None set-cookie: _pinterest_ct_ua="TWc9PSYyQmdMeTJ2eFJzSk91TERJcUVCQjRKc0lCd3J4VHVoTFJiMkNEWUc0ZVZ4eHkyb1Y1Z2I1ejVSRXdmc05CYW5QU0R6Ukg1STFmTzFjd3dsdXg4YmI4bUM0UURpZ2FNNU42VFpKQmd0QUVRRT0melAzQmdRVXdsM0VlN0llbzVzRnpOdnFPL1BvPQ=="; Expires=Fri, 07 Feb 2025 18:35:49 GMT; Path=/; Domain=ct.pinterest.com; Secure; SameSite=None x-envoy-upstream-service-time: 2 referrer-policy: origin x-pinterest-rid: 6952545923706450 Date: Thu, 08 Feb 2024 18:35:49 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: f9d1c7100d6ab6a9fc70375cea0fca5e275d3fa9
2024-02-08 18:35:49 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
280	192.168.2.5	50052	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	1028	OUT	POST /pagead/landing?gcs=G1--&gcd=13l3l3l3l5&rnd=2080525821.1707417344&url=https%3A%2F%2Fwww.booking.com%2F&dma=0&npa=0&gtm=45He4250n815Q664QZv79615461za200&auid=1592208705.1707417344 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:48 UTC	830	IN	HTTP/1.1 302 Found P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' Location: https://googleads.g.doubleclick.net/pagead/landing?gcs=G1--&gcd=13l3l3l3l5&rnd=2080525821.1707417344&url=https%3A%2F%2Fwww.booking.com%2F&dma=0&npa=0&gtm=45He4250n815Q664QZv79615461za200&auid=1592208705.1707417344 X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
281	192.168.2.5	50053	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	1871	OUT	GET /pagead/1p-conversion/988382855/?random=71414136&cv=11&fst=1707417344353&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=ZgWTCPidsIkYEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&value=0&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&capi=1&fmt=3&ct_cookie_present=false&sscte=1&crd=CIK9sQII7LuxAiIBAUABSid0cmlnZ2VyLCBldmVudC1zb3VyY2U9bmF2aWdhdGlvbi1zb3VyY2ViBAoCAgM&pscrd=CJL-lL3ht4-vyAESTkNoQUlnSlNTcmdZUTRQWHg3c3lZMlA4WkVpWUFtUzFSNi15TEtiTDJjTXdtWmVCbnhGT0VENVRiZjU0MTZpV2RyRUJoMFh6MnNhdHZqdxpaQ2hFSWdKU1NyZ1lRc3I2NWlwYVprN0diQVJJdUFFRzJzTzFsd0J1c0VxelpYa0VxMXF1c2ZsQ0FCMGhtMlZUY05ENG40cnd1blR3c1FEY2dPclZNMERGakdBIhMIpr_8orGchAMVpZTLAR2HqA4eMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAg&is_vtc=1&ocp_id=AR_FZea6KKWprr4Ph9G68AE&cid=CAQSKQAvHhf_Gt7QoUpXdus5QEyG1eIxuz3AHR2Emh1ZeXw0s6O0dji9wyhm&eitems=ChAIgJSSrgYQzemNw6uqy5stEh0ArMYPzZOA1xjXSQD69MmJkKwXUUq0zbPsrxxgqQ&random=1769082692 HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:48 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:48 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
282	192.168.2.5	50054	151.101.192.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	551	OUT	GET /user/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1707417346997&dep=5%2CEVENT_TAGS_ABSENT HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:49 UTC	622	IN	HTTP/1.1 200 OK Connection: close Content-Length: 302 access-control-expose-headers: Epik,Pin-Unauth pin-unauth: dWlkPVlUZGxORFUyWVRRdFpqSTVNeTAwWlRSaExUZzNZVFl0T0dZMlltSXpNVGcxWWpSag cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT access-control-allow-origin: * content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 1 referrer-policy: origin x-pinterest-rid: 2688668540719476 Date: Thu, 08 Feb 2024 18:35:48 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: f9d1c7100d6ab6a9fc70375cea0fca5e275d3fa9
2024-02-08 18:35:49 UTC	302	IN	Data Raw: 7b 22 61 65 6d 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 65 6d 46 6e 4c 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 50 68 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 47 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 44 62 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 4c 6f 63 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 45 78 74 65 72 6e 61 6c 49 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 45 70 69 6b 49 66 72 61 6d 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 68 72 6f 6d 65 4e 65 77 55 73 65 72 41 67 65 6e 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 45 75 22 3a 74 72 75 65 2c 22 69 73 55 74 69 6c 69 7a 69 6e 67 41 64 76 65 72 74 69 73 65 72 31 70 45 6e 61 Data Ascii: {"aemEnabled":true,"aemFnLnEnabled":false,"aemPhEnabled":false,"aemGeEnabled":false,"aemDbEnabled":false,"aemLocEnabled":false,"aemExternalIdEnabled":false,"ctEpikIframeEnabled":true,"chromeNewUserAgentEnabled":true,"isEu":true,"isUtilizingAdvertiser1pEna

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
283	192.168.2.5	50055	18.67.65.100	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:48 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Thu, 08 Feb 2024 18:35:48 GMT X-Cache: Error from cloudfront Via: 1.1 0920aeb1eced22df07c9ece1cab0a554.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: rtl1r_oeM7Imz0IZU0FmdckdC_2Vv6ZRU0iObqf3i06lUbqkzdBgJA==
2024-02-08 18:35:48 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
284	192.168.2.5	50056	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive Content-Length: 2316 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:48 UTC	2316	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 6f 52 61 42 66 33 6b 64 41 41 41 41 3a 55 71 4d 42 32 50 56 4b 30 39 52 70 54 6d 63 30 42 59 54 79 43 48 70 6e 70 79 79 49 4f 41 42 64 69 52 72 79 5a 6d 74 2f 35 50 44 56 76 57 66 37 4d 64 76 41 39 4e 32 4b 4d 5a 50 2f 73 59 62 65 45 57 53 36 34 6b 4c 6e 37 6d 73 50 4c 7a 4a 57 7a 76 4f 34 66 41 43 46 30 6a 41 38 31 6d 4c 6a 55 43 33 6f 69 5a 43 6d 31 4e 2b 77 6c 43 54 63 52 73 67 4d 6b 69 53 4f 6a 4c 4b 38 44 4f 6e 6c 74 2b 55 54 7a 52 63 64 70 68 31 7a 5a 51 74 78 42 67 6e 46 4b 69 62 4e 39 4e 55 6a 63 45 65 4c 69 50 53 49 64 76 46 61 58 42 6e 33 72 51 73 37 36 46 56 70 6d 65 Data Ascii: {"existing_token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoRaBf3kdAAAA:UqMB2PVK09RpTmc0BYTyCHpnpyyIOABdiRryZmt/5PDVvWf7MdvA9N2KMZP/sYbeEWS64kLn7msPLzJWzvO4fACF0jA81mLjUC3oiZCm1N+wlCTcRsgMkiSOjLK8DOnlt+UTzRcdph1zZQtxBgnFKibN9NUjcEeLiPSIdvFaXBn3rQs76FVpme
2024-02-08 18:35:49 UTC	585	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 948 Connection: close Date: Thu, 08 Feb 2024 18:35:49 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65c51f04-5bce59317faa70481638a068 X-Cache: Miss from cloudfront Via: 1.1 e418fd5667de46c635f0321ea814c2e0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: ZKdZVfPjMa3qSTQXyvzAY4qKobttMwM9DCbZm-u5RRhjap6oV-IFJw==
2024-02-08 18:35:49 UTC	948	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 66 6b 36 42 56 47 34 69 41 41 41 41 3a 6a 6e 34 6a 69 48 6a 31 4b 47 52 32 57 65 70 51 55 4c 64 44 41 50 4e 68 32 37 61 52 38 73 36 34 73 6d 4f 53 2b 6a 4f 4a 46 63 75 30 2f 67 44 72 31 6b 2b 42 69 4a 6d 4f 34 49 4a 4e 4d 31 72 6c 42 30 35 41 6a 57 73 37 31 63 38 52 70 34 35 69 6b 32 67 58 7a 2b 6b 5a 6c 76 52 58 5a 43 4d 75 6c 70 56 45 72 61 69 47 70 6c 63 4e 74 35 42 65 70 36 52 55 37 38 48 39 70 36 4d 53 37 35 32 39 31 66 65 7a 61 4d 4c 72 30 67 4e 72 2b 62 41 34 6e 51 50 53 33 44 66 6a 4d 54 42 46 71 69 4d 49 55 37 44 62 45 73 75 33 4b 6d 2b 6a 53 6c 31 4e 6a 33 45 7a 69 50 55 70 6e 51 6e 4a 70 42 37 Data Ascii: {"token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAfk6BVG4iAAAA:jn4jiHj1KGR2WepQULdDAPNh27aR8s64smOS+jOJFcu0/gDr1k+BiJmO4IJNM1rlB05AjWs71c8Rp45ik2gXz+kZlvRXZCMulpVEraiGplcNt5Bep6RU78H9p6MS75291fezaMLr0gNr+bA4nQPS3DfjMTBFqiMIU7DbEsu3Km+jSl1Nj3EziPUpnQnJpB7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
285	192.168.2.5	50058	216.239.34.181	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	1799	OUT	POST /g/collect?v=2&tid=G-FPD6YLJCJ7&gtm=45je4250v888381215z879615461za200&_p=1707417343003&_gaz=1&gcs=G1--&gcd=13l3l3l3l5&npa=0&dma=0&cid=421694156.1707417338&ul=en-us&sr=1280x1024&ir=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pae=1&pscdl=noapi&_eu=EA&_s=1&cu=EUR&dl=https%3A%2F%2Fwww.booking.com%2F&sid=1707417345&sct=1&seg=0&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&_fv=1&_ss=1&ep.cd_action=index&ep.cd_adults=-1&ep.cd_page_url=https%3A%2F%2Fwww.booking.com%2F&ep.cd_ai=304142&ep.cd_book_window=&ep.cd_full_referrer=&ep.cd_glev=&ep.cd_language=en-us&epn.cd_logged_in=0&ep.cd_tsmp=1707417343416&ep.cd_user_location=us&ep.cd_site_section=Stays&up.up_ga_client_id=421694156.1707417338&upn.up_is_subscribed_to_newsletter=0&tfd=17690 HTTP/1.1 Host: analytics.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:49 UTC	449	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: https://www.booking.com Date: Thu, 08 Feb 2024 18:35:49 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Credentials: true Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
286	192.168.2.5	50059	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	717	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 8452 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:35:48 UTC	8452	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 64 37 33 36 31 61 34 2d 63 63 63 66 2d 34 30 62 39 2d 62 63 31 31 2d 36 36 61 32 35 38 35 32 32 35 33 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 35 31 33 63 38 63 37 34 2d 38 35 31 32 2d 34 65 61 61 2d 38 30 30 66 2d 33 66 39 30 33 30 32 36 62 32 65 30 22 2c 22 73 73 22 3a 22 31 35 65 30 61 36 32 31 2d 31 31 34 34 2d 34 38 35 64 2d 39 30 31 62 2d 30 39 62 62 36 33 38 64 32 39 33 36 22 2c 22 73 68 22 3a 31 30 32 34 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"fd7361a4-cccf-40b9-bc11-66a258522530","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"513c8c74-8512-4eaa-800f-3f903026b2e0","ss":"15e0a621-1144-485d-901b-09bb638d2936","sh":1024,"s
2024-02-08 18:35:49 UTC	482	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:35:49 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 2 server: API Gateway alt-svc: clear access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
287	192.168.2.5	50062	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	1523	OUT	GET /pagead/1p-user-list/1060768846/?random=1707417344498&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nh4qqVoyv2KiIad5kPNddW86jrjYgKSk8&npa=0&data=page_type%3Dhome%3Bhotelid%3D0%3Bweekday%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_coWeJkuj5Q3yNq70idh4WJdx3zfM6vO8uiPSFkYUXc53APfl&random=2710065598&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:49 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:49 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:49 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
288	192.168.2.5	50060	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	1082	OUT	GET /pagead/1p-user-list/973712236/?random=1707417344535&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_y-kMF1ofi7FwUZE1wjFhsX8V103pkvRQFAPg8V_tgv1nWHYT&random=766671962&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:49 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:49 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:49 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
289	192.168.2.5	50063	151.101.128.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	540	OUT	GET /static/ct/token_create.js HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:49 UTC	367	IN	HTTP/1.1 200 OK Connection: close Content-Length: 4043 ETag: "78412b2c11f2fe96714fadf0062f86a5" x-amz-server-side-encryption: AES256 Cache-Control: max-age=7200 Content-Type: application/javascript Date: Thu, 08 Feb 2024 18:35:49 GMT Age: 3144 Vary: Accept-Encoding X-CDN: fastly alt-svc: h3=":443";ma=600 Timing-Allow-Origin: https://ct.pinterest.com
2024-02-08 18:35:49 UTC	1378	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 72 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 69 28 6e 29 7b 76 61 72 20 65 3b 72 65 74 75 72 6e 28 72 5b 6e 5d 7c 7c 28 65 3d 72 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 2c 74 5b 6e 5d 2e 63 61 6c 6c 28 65 2e 65 78 70 6f 72 74 73 2c 65 2c 65 2e 65 78 70 6f 72 74 73 2c 69 29 2c 65 2e 6c 3d 21 30 2c 65 29 29 2e 65 78 70 6f 72 74 73 7d 69 2e 6d 3d 74 2c 69 2e 63 3d 72 2c 69 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 74 29 7b 69 2e 6f 28 6e 2c 65 29 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 6e 2c 65 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 74 7d 29 7d 2c 69 2e 72 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 22 75 6e 64 65 66 69 6e Data Ascii: !function(t){var r={};function i(n){var e;return(r[n]\|\|(e=r[n]={i:n,l:!1,exports:{}},t[n].call(e.exports,e,e.exports,i),e.l=!0,e)).exports}i.m=t,i.c=r,i.d=function(n,e,t){i.o(n,e)\|\|Object.defineProperty(n,e,{enumerable:!0,get:t})},i.r=function(n){"undefin
2024-02-08 18:35:49 UTC	1378	IN	Data Raw: 3d 74 28 32 29 2c 69 3d 7b 7d 2c 63 3d 22 75 6e 6b 6e 6f 77 6e 22 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 6e 2e 76 65 72 73 69 6f 6e 3d 63 2c 31 30 30 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3c 28 72 2e 4c 49 53 54 2e 53 45 4e 44 5f 4c 4f 47 53 2e 63 68 61 6e 63 65 7c 7c 30 29 26 26 69 2e 76 28 6e 29 7d 69 2e 73 65 74 56 65 72 73 69 6f 6e 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 63 3d 6e 7d 2c 69 2e 76 3d 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 65 3d 6e 65 77 20 77 69 6e 64 6f 77 2e 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 3b 65 2e 77 69 74 68 43 72 65 64 65 6e 74 69 61 6c 73 3d 21 31 2c 65 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 22 45 72 72 6f 72 20 6d 65 73 73 61 67 65 20 66 61 Data Ascii: =t(2),i={},c="unknown";function o(n){n.version=c,100*Math.random()<(r.LIST.SEND_LOGS.chance\|\|0)&&i.v(n)}i.setVersion=function(n){c=n},i.v=function(n){var e=new window.XMLHttpRequest;e.withCredentials=!1,e.onerror=function(){console.error("Error message fa
2024-02-08 18:35:49 UTC	1287	IN	Data Raw: 53 65 74 22 3d 3d 3d 74 3f 41 72 72 61 79 2e 66 72 6f 6d 28 6e 29 3a 22 41 72 67 75 6d 65 6e 74 73 22 3d 3d 3d 74 7c 7c 2f 5e 28 3f 3a 55 69 7c 49 29 6e 74 28 3f 3a 38 7c 31 36 7c 33 32 29 28 3f 3a 43 6c 61 6d 70 65 64 29 3f 41 72 72 61 79 24 2f 2e 74 65 73 74 28 74 29 3f 72 28 6e 2c 65 29 3a 76 6f 69 64 20 30 7d 28 6e 2c 65 29 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 49 6e 76 61 6c 69 64 20 61 74 74 65 6d 70 74 20 74 6f 20 64 65 73 74 72 75 63 74 75 72 65 20 6e 6f 6e 2d 69 74 65 72 61 62 6c 65 20 69 6e 73 74 61 6e 63 65 2e 5c 6e 49 6e 20 6f 72 64 65 72 20 74 6f 20 62 65 20 69 74 65 72 61 62 6c 65 2c 20 6e 6f 6e 2d 61 72 72 61 79 20 6f 62 6a 65 63 74 73 20 6d 75 73 74 20 68 61 76 65 20 61 20 5b Data Ascii: Set"===t?Array.from(n):"Arguments"===t\|\|/^(?:Ui\|I)nt(?:8\|16\|32)(?:Clamped)?Array$/.test(t)?r(n,e):void 0}(n,e)\|\|function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
290	192.168.2.5	50065	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	1083	OUT	GET /pagead/1p-user-list/975716499/?random=1707417344655&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_niQM3PtsxhJz-etk4SiuaPuc1uxP5cjUkkc_zlGDgt3gu_xP&random=1844959785&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:49 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:49 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:49 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
291	192.168.2.5	50061	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	2416	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
2024-02-08 18:35:49 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:49 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=9d4c82c2b76702d3&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGbLSyvuwLWEZZ27C50jcksWDtPlYShnGZg x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 ea0f86c249e022d5015ce79f54e723d0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Llqp-w-5Q0H8lqvw63ITSgO-zHOV_2bsBFFVElF4HVUYx6mUiZvrqQ==
2024-02-08 18:35:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
292	192.168.2.5	50064	151.101.192.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	512	OUT	GET /user/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%7D&cb=1707417346995&dep=2%2CPAGE_LOAD HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:49 UTC	622	IN	HTTP/1.1 200 OK Connection: close Content-Length: 302 access-control-expose-headers: Epik,Pin-Unauth pin-unauth: dWlkPU56UmhaRFEwWmpRdFpHVXlaUzAwWkdFNUxXRTFPV010TnpNNU56a3hPR0l4T1RKbA cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT access-control-allow-origin: * content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 3 referrer-policy: origin x-pinterest-rid: 2058751479959604 Date: Thu, 08 Feb 2024 18:35:49 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: f9d1c7100d6ab6a9fc70375cea0fca5e275d3fa9
2024-02-08 18:35:49 UTC	302	IN	Data Raw: 7b 22 61 65 6d 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 65 6d 46 6e 4c 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 50 68 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 47 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 44 62 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 4c 6f 63 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 45 78 74 65 72 6e 61 6c 49 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 45 70 69 6b 49 66 72 61 6d 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 68 72 6f 6d 65 4e 65 77 55 73 65 72 41 67 65 6e 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 45 75 22 3a 74 72 75 65 2c 22 69 73 55 74 69 6c 69 7a 69 6e 67 41 64 76 65 72 74 69 73 65 72 31 70 45 6e 61 Data Ascii: {"aemEnabled":true,"aemFnLnEnabled":false,"aemPhEnabled":false,"aemGeEnabled":false,"aemDbEnabled":false,"aemLocEnabled":false,"aemExternalIdEnabled":false,"ctEpikIframeEnabled":true,"chromeNewUserAgentEnabled":true,"isEu":true,"isUtilizingAdvertiser1pEna

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
293	192.168.2.5	50066	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:48 UTC	717	OUT	POST /p HTTP/1.1 Host: tr6.snapchat.com Connection: keep-alive Content-Length: 877 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:35:48 UTC	877	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 64 37 33 36 31 61 34 2d 63 63 63 66 2d 34 30 62 39 2d 62 63 31 31 2d 36 36 61 32 35 38 35 32 32 35 33 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 30 66 64 34 33 66 38 30 2d 38 66 37 61 2d 34 34 35 66 2d 39 34 36 31 2d 30 34 62 34 66 33 36 35 65 30 64 62 22 2c 22 73 73 22 3a 22 31 35 65 30 61 36 32 31 2d 31 31 34 34 2d 34 38 35 64 2d 39 30 31 62 2d 30 39 62 62 36 33 38 64 32 39 33 36 22 2c 22 73 68 22 3a 31 30 32 34 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"fd7361a4-cccf-40b9-bc11-66a258522530","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"0fd43f80-8f7a-445f-9461-04b4f365e0db","ss":"15e0a621-1144-485d-901b-09bb638d2936","sh":1024,"s
2024-02-08 18:35:49 UTC	388	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:35:49 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: clear Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
294	192.168.2.5	50067	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:49 UTC	717	OUT	POST /p HTTP/1.1 Host: tr6.snapchat.com Connection: keep-alive Content-Length: 877 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:35:49 UTC	877	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 64 37 33 36 31 61 34 2d 63 63 63 66 2d 34 30 62 39 2d 62 63 31 31 2d 36 36 61 32 35 38 35 32 32 35 33 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 35 35 37 34 39 37 62 34 2d 34 37 38 64 2d 34 30 30 63 2d 38 37 63 65 2d 65 65 31 30 38 66 66 33 37 35 34 61 22 2c 22 73 73 22 3a 22 31 35 65 30 61 36 32 31 2d 31 31 34 34 2d 34 38 35 64 2d 39 30 31 62 2d 30 39 62 62 36 33 38 64 32 39 33 36 22 2c 22 73 68 22 3a 31 30 32 34 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"fd7361a4-cccf-40b9-bc11-66a258522530","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"557497b4-478d-400c-87ce-ee108ff3754a","ss":"15e0a621-1144-485d-901b-09bb638d2936","sh":1024,"s
2024-02-08 18:35:49 UTC	388	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:35:49 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: clear Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
295	192.168.2.5	50068	151.101.192.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:49 UTC	685	OUT	GET /ct.html HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:49 UTC	363	IN	HTTP/1.1 200 OK Connection: close Content-Length: 565 cache-control: max-age=86400 content-type: text/html; charset=utf-8 x-envoy-upstream-service-time: 0 referrer-policy: origin x-pinterest-rid: 1452042789329847 Date: Thu, 08 Feb 2024 18:35:49 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: f9d1c7100d6ab6a9fc70375cea0fca5e275d3fa9
2024-02-08 18:35:49 UTC	565	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 50 69 6e 74 65 72 65 73 74 20 63 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 20 69 64 3d 22 72 6f 6f 74 22 3e 3c 2f 64 69 76 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6d 65 73 73 61 67 65 22 2c 20 28 65 76 65 6e 74 29 20 3d 3e 20 7b 69 66 20 28 65 76 65 6e 74 2e 6f 72 69 67 69 6e 20 21 3d 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 69 6e 74 65 72 65 73 74 2e 63 6f 6d 22 29 20 7b 72 65 74 75 72 6e 3b 7d 74 72 79 20 7b 69 66 20 28 65 76 65 6e 74 2e 64 61 74 61 2e 6b 65 79 20 3d 3d 20 22 5f 65 70 69 6b 5f 6c 6f 63 61 6c 73 74 6f 72 65 Data Ascii: <!DOCTYPE html><html lang="en"><head><title>Pinterest ct</title></head><body><div id="root"></div><script>window.addEventListener("message", (event) => {if (event.origin != "https://www.pinterest.com") {return;}try {if (event.data.key == "_epik_localstore

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
296	192.168.2.5	50069	64.233.177.99	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:49 UTC	1036	OUT	GET /recaptcha/api2/webworker.js?hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&cb=pehgtvg39f6l Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:49 UTC	655	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Expires: Thu, 08 Feb 2024 18:35:49 GMT Date: Thu, 08 Feb 2024 18:35:49 GMT Cache-Control: private, max-age=300 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:49 UTC	108	IN	Data Raw: 36 36 0d 0a 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 78 35 57 57 6f 45 35 37 46 76 30 64 36 41 54 4b 73 4c 44 49 41 4b 6e 74 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 29 3b 0d 0a Data Ascii: 66importScripts('https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__en.js');
2024-02-08 18:35:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
297	192.168.2.5	50071	64.233.177.99	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:49 UTC	1024	OUT	GET /js/bg/KkWFeSURekXGycdprVC-UY6ED-ZF5ll2JCMiHhJE2Rk.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&cb=pehgtvg39f6l Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:49 UTC	799	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="botguard-scs" Report-To: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} Content-Length: 17071 Date: Thu, 08 Feb 2024 18:35:49 GMT Expires: Fri, 07 Feb 2025 18:35:49 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 15 Jan 2024 10:00:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:49 UTC	453	IN	Data Raw: 2f 2a 20 41 6e 74 69 2d 73 70 61 6d 2e 20 57 61 6e 74 20 74 6f 20 73 61 79 20 68 65 6c 6c 6f 3f 20 43 6f 6e 74 61 63 74 20 28 62 61 73 65 36 34 29 20 59 6d 39 30 5a 33 56 68 63 6d 51 74 59 32 39 75 64 47 46 6a 64 45 42 6e 62 32 39 6e 62 47 55 75 59 32 39 74 20 2a 2f 20 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 66 3d 66 75 6e 63 74 69 6f 6e 28 4f 29 7b 72 65 74 75 72 6e 20 4f 7d 2c 52 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 6d 3d 66 75 6e 63 74 69 6f 6e 28 4f 2c 42 29 7b 69 66 28 21 28 4f 3d 28 42 3d 52 2e 74 72 75 73 74 65 64 54 79 70 65 73 2c 6e 75 6c 6c 29 2c 42 29 7c 7c 21 42 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 72 65 74 75 72 6e 20 4f 3b 74 72 79 7b 4f 3d 42 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 62 67 22 2c 7b 63 72 65 61 74 65 48 54 4d Data Ascii: /* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */ (function(){var f=function(O){return O},R=this\|\|self,m=function(O,B){if(!(O=(B=R.trustedTypes,null),B)\|\|!B.createPolicy)return O;try{O=B.createPolicy("bg",{createHTM
2024-02-08 18:35:49 UTC	1252	IN	Data Raw: 74 28 44 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 44 29 7b 72 65 74 75 72 6e 22 22 2b 44 7d 7d 28 52 29 28 41 72 72 61 79 28 37 38 32 34 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 7c 30 29 2e 6a 6f 69 6e 28 22 5c 6e 22 29 2b 27 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 4f 61 3d 66 75 6e 63 74 69 6f 6e 28 42 2c 4f 29 7b 28 28 4f 2e 70 75 73 68 28 42 5b 30 5d 3c 3c 32 34 7c 42 5b 31 5d 3c 3c 31 36 7c 42 5b 32 5d 3c 3c 38 7c 42 5b 33 5d 29 2c 4f 29 2e 70 75 73 68 28 42 5b 34 5d 3c 3c 32 34 7c 42 5b 35 5d 3c 3c 31 36 7c 42 5b 36 5d 3c 3c 38 7c 42 5b 37 5d 29 2c 4f 29 2e 70 75 73 68 28 42 5b 38 5d 3c 3c 32 34 7c 42 5b 39 5d 3c 3c 31 36 7c 42 5b 31 30 5d 3c 3c 38 7c 42 5b 31 31 5d 29 7d 2c 44 67 3d 66 75 6e 63 74 69 6f 6e 28 42 2c 4f 29 7b 72 65 74 75 72 6e 28 Data Ascii: t(D)}:function(D){return""+D}}(R)(Array(7824*Math.random()\|0).join("\n")+'(function(){var Oa=function(B,O){((O.push(B[0]<<24\|B[1]<<16\|B[2]<<8\|B[3]),O).push(B[4]<<24\|B[5]<<16\|B[6]<<8\|B[7]),O).push(B[8]<<24\|B[9]<<16\|B[10]<<8\|B[11])},Dg=function(B,O){return(
2024-02-08 18:35:49 UTC	1252	IN	Data Raw: 7d 63 61 74 63 68 28 64 29 7b 7d 7d 63 61 74 63 68 28 64 29 7b 7d 28 30 2c 42 5b 31 5d 29 28 66 75 6e 63 74 69 6f 6e 28 64 2c 66 29 7b 4f 2e 75 28 64 2c 74 72 75 65 2c 66 29 7d 2c 28 4f 2e 68 3d 5b 5d 2c 66 75 6e 63 74 69 6f 6e 28 64 29 7b 28 68 28 5b 4b 5d 2c 28 64 3d 21 4f 2e 69 2e 6c 65 6e 67 74 68 2c 4f 29 29 2c 64 29 26 26 7a 28 66 61 6c 73 65 2c 74 72 75 65 2c 4f 29 7d 29 2c 66 75 6e 63 74 69 6f 6e 28 64 29 7b 72 65 74 75 72 6e 20 4f 2e 6c 28 64 29 7d 29 7d 65 6c 73 65 7b 69 66 28 52 3d 3d 53 67 29 72 65 74 75 72 6e 20 44 3d 42 5b 32 5d 2c 43 28 4f 2c 38 33 2c 42 5b 36 5d 29 2c 43 28 4f 2c 36 32 2c 44 29 2c 4f 2e 43 28 42 29 3b 52 3d 3d 4b 3f 28 4f 2e 42 3d 5b 5d 2c 4f 2e 54 3d 6e 75 6c 6c 2c 4f 2e 50 3d 5b 5d 29 3a 52 3d 3d 65 67 26 26 22 6c 6f 61 Data Ascii: }catch(d){}}catch(d){}(0,B[1])(function(d,f){O.u(d,true,f)},(O.h=[],function(d){(h([K],(d=!O.i.length,O)),d)&&z(false,true,O)}),function(d){return O.l(d)})}else{if(R==Sg)return D=B[2],C(O,83,B[6]),C(O,62,D),O.C(B);R==K?(O.B=[],O.T=null,O.P=[]):R==eg&&"loa
2024-02-08 18:35:49 UTC	1252	IN	Data Raw: 75 65 2c 4f 29 3b 74 72 79 7b 44 3d 52 2e 47 28 29 2c 52 2e 57 3d 44 2c 52 2e 4e 3d 30 2c 52 2e 48 3d 44 2c 64 3d 6b 46 28 4f 2c 52 29 2c 53 3d 52 2e 47 28 29 2d 52 2e 48 2c 52 2e 44 2b 3d 53 2c 53 3c 28 42 3f 30 3a 31 30 29 7c 7c 30 3e 3d 52 2e 54 33 2d 2d 7c 7c 28 53 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 53 29 2c 52 2e 42 2e 70 75 73 68 28 32 35 34 3e 3d 53 3f 53 3a 32 35 34 29 29 7d 66 69 6e 61 6c 6c 79 7b 52 2e 6a 3d 66 61 6c 73 65 7d 72 65 74 75 72 6e 20 64 7d 7d 2c 76 74 3d 66 75 6e 63 74 69 6f 6e 28 42 2c 4f 29 7b 72 65 74 75 72 6e 5b 28 4f 28 66 75 6e 63 74 69 6f 6e 28 52 29 7b 52 28 42 29 7d 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 42 7d 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 5d 7d 2c 61 62 3d 66 75 6e 63 74 69 6f 6e 28 42 2c Data Ascii: ue,O);try{D=R.G(),R.W=D,R.N=0,R.H=D,d=kF(O,R),S=R.G()-R.H,R.D+=S,S<(B?0:10)\|\|0>=R.T3--\|\|(S=Math.floor(S),R.B.push(254>=S?S:254))}finally{R.j=false}return d}},vt=function(B,O){return[(O(function(R){R(B)}),function(){return B}),function(){}]},ab=function(B,
2024-02-08 18:35:49 UTC	1252	IN	Data Raw: 70 6c 61 63 65 3a 4f 2c 70 61 72 65 6e 74 3a 4f 2c 64 6f 63 75 6d 65 6e 74 3a 4f 2c 70 6f 70 3a 4f 2c 73 74 61 63 6b 3a 4f 2c 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 3a 4f 2c 66 6c 6f 6f 72 3a 4f 2c 63 61 6c 6c 3a 4f 2c 63 6f 6e 73 6f 6c 65 3a 4f 7d 29 7d 2c 6b 46 3d 66 75 6e 63 74 69 6f 6e 28 42 2c 4f 2c 52 2c 44 29 7b 66 6f 72 28 3b 4f 2e 69 2e 6c 65 6e 67 74 68 3b 29 7b 44 3d 28 4f 2e 58 3d 6e 75 6c 6c 2c 4f 29 2e 69 2e 70 6f 70 28 29 3b 74 72 79 7b 52 3d 64 5f 28 44 2c 4f 29 7d 63 61 74 63 68 28 53 29 7b 72 28 53 2c 4f 29 7d 69 66 28 42 26 26 4f 2e 58 29 7b 28 42 3d 4f 2e 58 2c 42 29 28 66 75 6e 63 74 69 6f 6e 28 29 7b 7a 28 74 72 75 65 2c 74 72 75 65 2c 4f 29 7d 29 3b 62 72 65 61 6b 7d 7d 72 65 74 75 72 6e 20 52 7d 2c 4d 4f 3d 66 Data Ascii: place:O,parent:O,document:O,pop:O,stack:O,propertyIsEnumerable:O,floor:O,call:O,console:O})},kF=function(B,O,R,D){for(;O.i.length;){D=(O.X=null,O).i.pop();try{R=d_(D,O)}catch(S){r(S,O)}if(B&&O.X){(B=O.X,B)(function(){z(true,true,O)});break}}return R},MO=f
2024-02-08 18:35:49 UTC	1252	IN	Data Raw: 44 29 7b 74 72 79 7b 44 3d 42 5b 28 28 4f 7c 30 29 2b 32 29 25 33 5d 2c 42 5b 4f 5d 3d 28 42 5b 4f 5d 7c 30 29 2d 28 42 5b 28 28 4f 7c 30 29 2b 31 29 25 33 5d 7c 30 29 2d 28 44 7c 30 29 5e 28 31 3d 3d 4f 3f 44 3c 3c 52 3a 44 3e 3e 3e 52 29 7d 63 61 74 63 68 28 53 29 7b 74 68 72 6f 77 20 53 3b 7d 7d 2c 6c 52 3d 66 75 6e 63 74 69 6f 6e 28 42 2c 4f 2c 52 2c 44 2c 53 2c 64 29 7b 69 66 28 21 4f 2e 46 29 7b 4f 2e 4b 2b 2b 3b 74 72 79 7b 66 6f 72 28 52 3d 28 64 3d 28 53 3d 4f 2e 59 2c 30 29 2c 76 6f 69 64 20 30 29 3b 2d 2d 42 3b 29 74 72 79 7b 69 66 28 28 44 3d 76 6f 69 64 20 30 2c 4f 29 2e 5a 29 52 3d 66 59 28 4f 2c 4f 2e 5a 29 3b 65 6c 73 65 7b 69 66 28 28 64 3d 57 28 33 31 32 2c 4f 29 2c 64 29 3e 3d 53 29 62 72 65 61 6b 3b 52 3d 28 44 3d 45 28 28 43 28 4f 2c Data Ascii: D){try{D=B[((O\|0)+2)%3],B[O]=(B[O]\|0)-(B[((O\|0)+1)%3]\|0)-(D\|0)^(1==O?D<<R:D>>>R)}catch(S){throw S;}},lR=function(B,O,R,D,S,d){if(!O.F){O.K++;try{for(R=(d=(S=O.Y,0),void 0);--B;)try{if((D=void 0,O).Z)R=fY(O,O.Z);else{if((d=W(312,O),d)>=S)break;R=(D=E((C(O,
2024-02-08 18:35:49 UTC	1252	IN	Data Raw: 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 42 2e 63 61 6c 6c 26 26 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 42 2e 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 26 26 21 42 2e 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 28 22 63 61 6c 6c 22 29 29 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 7d 65 6c 73 65 20 72 65 74 75 72 6e 22 6e 75 6c 6c 22 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 52 26 26 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 42 2e 63 61 6c 6c 29 72 65 74 75 72 6e 22 6f 62 6a 65 63 74 22 3b 72 65 74 75 72 6e 20 52 7d 2c 79 58 3d 66 75 6e 63 74 69 6f 6e 28 42 2c 4f 29 7b 31 30 34 3c 42 2e 55 2e 6c 65 6e 67 74 68 3f 49 28 5b 79 2c 33 36 5d 2c 42 2c 30 29 Data Ascii: efined"!=typeof B.call&&"undefined"!=typeof B.propertyIsEnumerable&&!B.propertyIsEnumerable("call"))return"function"}else return"null";else if("function"==R&&"undefined"==typeof B.call)return"object";return R},yX=function(B,O){104<B.U.length?I([y,36],B,0)
2024-02-08 18:35:49 UTC	1252	IN	Data Raw: 74 68 2c 30 29 2c 5b 5d 29 3b 6d 3c 78 3b 6d 2b 2b 29 76 5b 6d 5d 7c 7c 28 54 5b 6d 5d 3d 6e 28 6b 29 29 3b 66 6f 72 28 6b 3d 30 3b 6b 3c 78 3b 6b 2b 2b 29 76 5b 6b 5d 26 26 28 54 5b 6b 5d 3d 45 28 66 29 29 3b 66 6f 72 28 58 3d 5b 5d 3b 65 2d 2d 3b 29 58 2e 70 75 73 68 28 57 28 45 28 66 29 2c 66 29 29 3b 4c 28 66 2c 66 75 6e 63 74 69 6f 6e 28 75 2c 59 2c 61 2c 67 2c 42 74 29 7b 66 6f 72 28 67 3d 28 59 3d 5b 5d 2c 42 74 3d 5b 5d 2c 30 29 3b 67 3c 78 3b 67 2b 2b 29 7b 69 66 28 61 3d 54 5b 67 5d 2c 21 76 5b 67 5d 29 7b 66 6f 72 28 3b 61 3e 3d 42 74 2e 6c 65 6e 67 74 68 3b 29 42 74 2e 70 75 73 68 28 45 28 75 29 29 3b 61 3d 42 74 5b 61 5d 7d 59 2e 70 75 73 68 28 61 29 7d 75 2e 4f 3d 50 74 28 28 75 2e 5a 3d 50 74 28 58 2e 73 6c 69 63 65 28 29 2c 75 29 2c 59 29 Data Ascii: th,0),[]);m<x;m++)v[m]\|\|(T[m]=n(k));for(k=0;k<x;k++)v[k]&&(T[k]=E(f));for(X=[];e--;)X.push(W(E(f),f));L(f,function(u,Y,a,g,Bt){for(g=(Y=[],Bt=[],0);g<x;g++){if(a=T[g],!v[g]){for(;a>=Bt.length;)Bt.push(E(u));a=Bt[a]}Y.push(a)}u.O=Pt((u.Z=Pt(X.slice(),u),Y)
2024-02-08 18:35:49 UTC	1252	IN	Data Raw: 30 2c 30 29 2c 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 7c 7c 7b 7d 29 2c 44 29 2e 58 6a 3d 4f 2e 74 69 6d 65 4f 72 69 67 69 6e 7c 7c 28 4f 2e 74 69 6d 69 6e 67 7c 7c 7b 7d 29 2e 6e 61 76 69 67 61 74 69 6f 6e 53 74 61 72 74 7c 7c 30 2c 33 31 32 29 2c 30 29 2c 30 29 29 2c 31 35 34 29 29 2c 34 30 34 29 29 2c 66 75 6e 63 74 69 6f 6e 28 66 2c 6d 2c 5a 2c 65 2c 76 29 7b 66 6f 72 28 76 3d 44 67 28 28 65 3d 45 28 66 29 2c 66 29 29 2c 6d 3d 30 2c 5a 3d 5b 5d 3b 6d 3c 76 3b 6d 2b 2b 29 5a 2e 70 75 73 68 28 4a 28 66 29 29 3b 43 28 66 2c 65 2c 5a 29 7d 29 2c 31 36 37 29 2c 35 30 36 29 29 2c 66 75 6e 63 74 69 6f 6e 28 66 2c 6d 2c 5a 2c 65 29 7b 43 28 66 2c 28 5a 3d 28 65 3d 45 28 66 29 2c 6d 3d 45 28 66 29 2c 45 29 28 66 29 2c 5a 29 2c 57 28 65 2c 66 29 Data Ascii: 0,0),window.performance\|\|{}),D).Xj=O.timeOrigin\|\|(O.timing\|\|{}).navigationStart\|\|0,312),0),0)),154)),404)),function(f,m,Z,e,v){for(v=Dg((e=E(f),f)),m=0,Z=[];m<v;m++)Z.push(J(f));C(f,e,Z)}),167),506)),function(f,m,Z,e){C(f,(Z=(e=E(f),m=E(f),E)(f),Z),W(e,f)
2024-02-08 18:35:49 UTC	1252	IN	Data Raw: 52 3d 3d 66 7c 7c 5a 3d 3d 66 2e 45 47 26 26 65 3d 3d 66 29 26 26 28 43 28 66 2c 6d 2e 59 68 2c 5a 2e 61 70 70 6c 79 28 65 2c 6d 2e 53 29 29 2c 66 2e 57 3d 66 2e 47 28 29 29 7d 29 2c 31 39 39 29 2c 31 35 33 29 29 2c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 47 4f 28 31 2c 66 29 7d 29 2c 32 37 39 29 2c 33 36 32 29 29 2c 5b 30 2c 30 2c 30 5d 29 29 2c 66 75 6e 63 74 69 6f 6e 28 66 2c 6d 2c 5a 2c 65 29 7b 43 28 66 2c 28 6d 3d 57 28 28 5a 3d 45 28 28 6d 3d 28 65 3d 45 28 66 29 2c 45 28 66 29 29 2c 66 29 29 2c 65 3d 57 28 65 2c 66 29 2c 6d 29 2c 66 29 2c 5a 29 2c 65 20 69 6e 20 6d 7c 30 29 7d 29 2c 34 37 35 29 2c 7b 7d 29 29 2c 43 29 28 44 2c 34 38 37 2c 30 29 2c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 72 5f 28 66 2c 33 29 7d 29 2c 31 36 29 2c 34 33 38 29 2c 30 29 2c 66 Data Ascii: R==f\|\|Z==f.EG&&e==f)&&(C(f,m.Yh,Z.apply(e,m.S)),f.W=f.G())}),199),153)),function(f){GO(1,f)}),279),362)),[0,0,0])),function(f,m,Z,e){C(f,(m=W((Z=E((m=(e=E(f),E(f)),f)),e=W(e,f),m),f),Z),e in m\|0)}),475),{})),C)(D,487,0),function(f){r_(f,3)}),16),438),0),f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
298	192.168.2.5	50075	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:49 UTC	1083	OUT	GET /pagead/1p-user-list/975716499/?random=1707417344619&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_Z60qOBRC0pooYPssvY44WDhxPvAjD20AS2HYNebi_Po98qJK&random=3590766466&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:49 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:49 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:49 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
299	192.168.2.5	50077	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:49 UTC	1082	OUT	GET /pagead/1p-user-list/973712236/?random=1707417344582&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_rndnWdCAQi6iVyq6cjrgu1EiG1Y8Myw6XFmXv6PP16V-EZAM&random=593389060&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:49 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:49 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:49 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
300	192.168.2.5	50078	18.67.65.100	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:49 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:49 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Thu, 08 Feb 2024 18:35:49 GMT X-Cache: Error from cloudfront Via: 1.1 4a050b98a443ca2d3af477f9b4dc39ae.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: kz012nsLGHyTkEFEuCVk-sIzCvZGbU1F8SCThAaWSteF2tJ6ZjrjWg==
2024-02-08 18:35:49 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
301	192.168.2.5	50079	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:49 UTC	3111	OUT	GET / HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAfk6BVG4iAAAA:jn4jiHj1KGR2WepQULdDAPNh27aR8s64smOS+jOJFcu0/gDr1k+BiJmO4IJNM1rlB05AjWs71c8Rp45ik2gXz+kZlvRXZCMulpVEraiGplcNt5Bep6RU78H9p6MS75291fezaMLr0gNr+bA4nQPS3DfjMTBFqiMIU7DbEsu3Km+jSl1Nj3EziPUpnQnJpB7ZP5f8pdx+EtXFOwOFxqd/qKBOvGjbRwWEVchKGfdFQfL7rT6hj2pc2vMMvPl/2W2L5N8MSeHH; lastSeen=1707417348450
2024-02-08 18:35:50 UTC	2210	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:50 GMT vary: User-Agent, Accept-Encoding link: <https://cf.bstatic.com/static/css/gprof_icons_cloudfront_sd.iq_ltr/f2fce41920df3c9225af5c680c3a8127d2caaceb.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/incentives_cloudfront_sd.iq_ltr/f1558a6e9832a4eb8cfe1d3d14db176bd3564335.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/index_cloudfront_sd.iq_ltr/903b49ae71c75322442d1bc9a0dc298bb8a6e32e.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/main_cloudfront_sd.iq_ltr/e6474733abba1cd6bc8a66bea1aa8643d7435c30.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/main_exps_cloudfront_sd.iq_ltr/586b07455f7783cafa801bdea38881f1f98ad36d.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/xp-index-sb_cloudfront_sd.iq_ltr/5b5ab8ab66a5ce3092875d0725122439c4f2dfdd.css>; rel=preload; as=style nel: {"report_to":"default","max_age":604800} report-to: {"max_age":604800,"endpoints":[{"url":"https://nellie.booking.com/report"}],"group":"default"} set-cookie: _implmdnbl=2__1__0; path=/; expires=Sat, 09-Feb-2019 18:35:49 GMT; HttpOnly set-cookie: px_init=0; domain=booking.com; expires=Tue, 17-May-2078 13:11:38 GMT; SameSite=Strict; secure; HttpOnly set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8kqA80E7Dah055EUUCXJybztZSKxkA5aCnIJFLwuEv5PRBH%2FuOIr093hmKmylOzKy1om%2BA6S9CXSpp3YXWEQ5uMtGzdXyxL7fd6KnVt8wEbVbuHrbuxq5uAQY%2BNxC%2Fj%2BSMmkfmWa3MeC%2FkjdjYc5vu2uXFBZYHleA%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:50 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-type-options: nosniff x-recruiting: Like HTTP headers? Come write ours: https://careers.booking.com x-terms-of-service: https://www.booking.com/content/terms.html x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 a01680a1fee7e35f1738191420d98822.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: j745hGj1SGWrfP6x-7iJlYhxUUGn1rJ6kX6nY52pQieFMsUOyngmcg==
2024-02-08 18:35:50 UTC	11218	IN	Data Raw: 32 62 63 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 59 6f 75 20 6b 6e 6f 77 20 79 6f 75 20 63 6f 75 6c 64 20 62 65 20 67 65 74 74 69 6e 67 20 70 61 69 64 20 74 6f 20 70 6f 6b 65 20 61 72 6f 75 6e 64 20 69 6e 20 6f 75 72 20 63 6f 64 65 3f 0a 57 65 27 72 65 20 68 69 72 69 6e 67 20 64 65 73 69 67 6e 65 72 73 20 61 6e 64 20 64 65 76 65 6c 6f 70 65 72 73 20 74 6f 20 77 6f 72 6b 20 69 6e 20 41 6d 73 74 65 72 64 61 6d 3a 0a 68 74 74 70 73 3a 2f 2f 63 61 72 65 65 72 73 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 0a 2d 2d 3e 0a 3c 21 2d 2d 20 77 64 6f 74 2d 38 30 32 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 34 31 44 41 48 64 55 37 77 51 59 53 74 33 6c 22 Data Ascii: 2bca<!DOCTYPE html>...You know you could be getting paid to poke around in our code?We're hiring designers and developers to work in Amsterdam:https://careers.booking.com/-->... wdot-802 --><script type="text/javascript" nonce="41DAHdU7wQYSt3l"
2024-02-08 18:35:50 UTC	16384	IN	Data Raw: 39 65 32 34 0d 0a 3c 74 69 74 6c 65 3e 0a 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 7c 20 4f 66 66 69 63 69 61 6c 20 73 69 74 65 20 7c 20 54 68 65 20 62 65 73 74 20 68 6f 74 65 6c 73 2c 20 66 6c 69 67 68 74 73 2c 20 63 61 72 20 72 65 6e 74 61 6c 73 20 26 20 61 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 73 20 0a 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 45 78 70 6c 6f 72 65 20 74 68 65 20 77 6f 72 6c 64 20 77 69 74 68 20 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 2e 20 42 69 67 20 73 61 76 69 6e 67 73 20 6f 6e 20 68 6f 6d 65 73 2c 20 68 6f 74 65 6c 73 2c 20 66 6c 69 67 68 74 73 2c 20 63 61 72 20 72 65 6e 74 61 6c 73 2c 20 74 61 78 69 73 2c 20 61 6e 64 20 61 74 74 72 61 63 74 69 6f 6e 73 20 e2 Data Ascii: 9e24<title>Booking.com \| Official site \| The best hotels, flights, car rentals & accommodations </title><meta name="description" content="Explore the world with Booking.com. Big savings on homes, hotels, flights, car rentals, taxis, and attractions
2024-02-08 18:35:50 UTC	16384	IN	Data Raw: 22 2c 22 64 61 74 65 5f 77 69 74 68 5f 77 65 65 6b 64 61 79 5f 74 69 6d 65 5f 66 72 6f 6d 5f 75 6e 74 69 6c 22 3a 22 7b 77 65 65 6b 64 61 79 7d 2c 20 7b 62 65 67 69 6e 5f 6d 61 72 6b 65 72 7d 7b 6d 6f 6e 74 68 5f 6e 61 6d 65 7d 20 7b 64 61 79 5f 6f 66 5f 6d 6f 6e 74 68 7d 7b 65 6e 64 5f 6d 61 72 6b 65 72 7d 2c 20 7b 66 75 6c 6c 5f 79 65 61 72 7d 20 66 72 6f 6d 20 7b 74 69 6d 65 7d 20 75 6e 74 69 6c 20 7b 74 69 6d 65 5f 75 6e 74 69 6c 7d 22 2c 22 64 61 74 65 5f 77 69 74 68 5f 77 65 65 6b 64 61 79 5f 77 69 74 68 5f 6d 61 72 6b 65 72 73 22 3a 22 7b 77 65 65 6b 64 61 79 7d 2c 20 7b 62 65 67 69 6e 5f 6d 61 72 6b 65 72 7d 7b 6d 6f 6e 74 68 5f 6e 61 6d 65 7d 20 7b 64 61 79 5f 6f 66 5f 6d 6f 6e 74 68 7d 7b 65 6e 64 5f 6d 61 72 6b 65 72 7d 2c 20 7b 66 75 6c 6c 5f Data Ascii: ","date_with_weekday_time_from_until":"{weekday}, {begin_marker}{month_name} {day_of_month}{end_marker}, {full_year} from {time} until {time_until}","date_with_weekday_with_markers":"{weekday}, {begin_marker}{month_name} {day_of_month}{end_marker}, {full_
2024-02-08 18:35:50 UTC	7724	IN	Data Raw: 69 71 5f 6c 74 72 2f 61 63 37 33 61 31 35 33 33 63 39 62 31 33 37 64 31 35 34 65 34 31 32 61 66 35 38 62 30 62 36 61 37 34 65 32 30 39 61 35 2e 63 73 73 27 2c 0a 65 6d 70 74 79 3a 20 27 27 0a 7d 2c 0a 66 65 5f 65 6e 61 62 6c 65 5f 66 70 73 5f 67 6f 61 6c 5f 77 69 74 68 5f 76 61 6c 75 65 3a 20 31 2c 0a 62 5f 65 6d 61 69 6c 5f 76 61 6c 69 64 61 74 69 6f 6e 5f 72 65 67 65 78 20 3a 20 2f 5e 28 5b 5c 77 2d 5c 2e 5c 2b 5d 2b 40 28 5b 5c 77 2d 5d 2b 5c 2e 29 2b 5b 5c 77 2d 5d 7b 32 2c 31 34 7d 29 3f 24 2f 2c 0a 62 5f 64 6f 6d 61 69 6e 5f 65 6e 64 20 3a 20 27 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 27 2c 0a 62 5f 6f 72 69 67 69 6e 61 6c 5f 75 72 6c 20 3a 20 27 68 74 74 70 73 3a 26 23 34 37 3b 26 23 34 37 3b 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 26 23 34 37 3b Data Ascii: iq_ltr/ac73a1533c9b137d154e412af58b0b6a74e209a5.css',empty: ''},fe_enable_fps_goal_with_value: 1,b_email_validation_regex : /^([\w-\.\+]+@([\w-]+\.)+[\w-]{2,14})?$/,b_domain_end : '.booking.com',b_original_url : 'https://www.booking.com/
2024-02-08 18:35:50 UTC	16384	IN	Data Raw: 63 64 33 38 0d 0a 73 5f 75 73 65 72 5f 63 65 6e 74 65 72 5f 62 61 72 3a 20 31 2c 0a 62 5f 73 69 74 65 5f 65 78 70 65 72 69 6d 65 6e 74 5f 75 73 65 72 5f 63 65 6e 74 65 72 5f 62 61 72 3a 20 31 2c 0a 62 5f 72 65 67 5f 75 73 65 72 5f 69 73 5f 67 65 6e 69 75 73 20 3a 20 22 22 2c 0a 70 72 6f 66 69 6c 65 5f 6d 65 6e 75 3a 20 7b 0a 62 5f 75 73 65 72 5f 61 75 74 68 5f 6c 65 76 65 6c 3a 20 30 2c 0a 62 5f 64 6f 6d 61 69 6e 5f 66 6f 72 5f 61 70 70 3a 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 0a 62 5f 71 75 65 72 79 5f 70 61 72 61 6d 73 5f 77 69 74 68 5f 6c 61 6e 67 5f 6e 6f 5f 65 78 74 3a 20 22 3f 6c 61 62 65 6c 3d 67 65 6e 31 37 33 6e 72 2d 31 46 43 41 45 6f 67 67 49 34 36 41 64 49 4d 31 67 45 61 49 38 43 69 41 45 42 6d 41 45 Data Ascii: cd38s_user_center_bar: 1,b_site_experiment_user_center_bar: 1,b_reg_user_is_genius : "",profile_menu: {b_user_auth_level: 0,b_domain_for_app: "https://www.booking.com",b_query_params_with_lang_no_ext: "?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAE
2024-02-08 18:35:50 UTC	16384	IN	Data Raw: 61 4c 4d 4d 44 41 53 4e 4d 4f 62 65 64 46 4c 50 54 62 64 49 61 4f 22 3a 30 2c 22 64 4e 58 4f 42 56 62 57 66 45 54 58 45 63 59 50 45 59 52 41 62 61 54 61 54 61 45 54 22 3a 31 2c 22 59 64 58 66 4d 4f 62 57 4a 5a 4c 42 4b 42 61 55 65 63 55 55 57 65 22 3a 30 2c 22 48 57 41 46 59 54 66 56 45 64 46 41 50 54 50 57 4f 47 41 64 65 42 56 4f 53 50 44 48 43 4f 4c 63 4f 22 3a 31 2c 22 42 4b 65 57 49 45 63 56 4b 62 54 42 50 41 41 41 63 51 61 5a 4a 43 4e 51 4f 56 45 62 55 4f 49 46 4e 4b 4e 4d 43 22 3a 30 2c 22 59 54 54 48 62 58 65 65 56 4a 57 63 57 50 61 44 4d 57 4f 4d 48 54 63 59 65 49 48 63 55 4a 50 55 46 4f 22 3a 31 2c 22 42 48 44 54 4a 64 52 65 4c 44 45 5a 52 45 52 45 48 47 44 43 53 56 48 59 59 66 50 48 65 22 3a 30 2c 22 5a 43 61 44 4d 53 64 56 4c 51 4a 43 59 46 65 Data Ascii: aLMMDASNMObedFLPTbdIaO":0,"dNXOBVbWfETXEcYPEYRAbaTaTaET":1,"YdXfMObWJZLBKBaUecUUWe":0,"HWAFYTfVEdFAPTPWOGAdeBVOSPDHCOLcO":1,"BKeWIEcVKbTBPAAAcQaZJCNQOVEbUOIFNKNMC":0,"YTTHbXeeVJWcWPaDMWOMHTcYeIHcUJPUFO":1,"BHDTJdReLDEZREREHGDCSVHYYfPHe":0,"ZCaDMSdVLQJCYFe
2024-02-08 18:35:50 UTC	16384	IN	Data Raw: 32 2c 22 4e 41 46 51 43 4a 57 5a 55 62 58 65 43 46 4e 5a 46 45 5a 61 48 52 64 4d 44 4d 53 41 46 45 54 22 3a 31 2c 22 62 51 47 42 50 47 4a 49 4d 41 44 58 44 63 56 56 50 65 50 48 59 59 66 50 48 65 22 3a 31 2c 22 49 5a 42 54 64 46 50 66 42 4b 53 41 45 4c 53 58 5a 57 51 46 4f 4c 51 44 52 43 41 47 5a 47 58 57 55 4a 4e 51 51 64 4b 42 55 50 49 4d 4c 5a 59 49 50 66 5a 45 54 22 3a 31 2c 22 4f 62 55 44 5a 4d 55 4c 41 46 45 4a 4b 61 45 63 61 4d 45 41 66 64 53 52 66 41 41 58 65 22 3a 31 2c 22 63 43 48 4f 62 54 50 65 41 65 4d 4a 4a 66 4e 51 62 48 56 45 5a 59 52 45 48 47 57 50 48 44 44 57 65 22 3a 31 2c 22 4f 4d 49 5a 45 50 51 42 61 46 42 64 64 51 4a 58 44 62 59 58 61 52 49 59 41 43 22 3a 31 2c 22 65 57 66 61 51 44 53 57 53 47 55 51 48 4d 51 4f 46 66 4f 42 66 43 22 3a Data Ascii: 2,"NAFQCJWZUbXeCFNZFEZaHRdMDMSAFET":1,"bQGBPGJIMADXDcVVPePHYYfPHe":1,"IZBTdFPfBKSAELSXZWQFOLQDRCAGZGXWUJNQQdKBUPIMLZYIPfZET":1,"ObUDZMULAFEJKaEcaMEAfdSRfAAXe":1,"cCHObTPeAeMJJfNQbHVEZYREHGWPHDDWe":1,"OMIZEPQBaFBddQJXDbYXaRIYAC":1,"eWfaQDSWSGUQHMQOFfOBfC":
2024-02-08 18:35:50 UTC	3392	IN	Data Raw: 4b 42 47 4f 22 3a 31 2c 22 48 57 41 46 4e 52 59 54 51 57 59 51 57 65 44 5a 51 4e 55 5a 55 59 61 54 54 43 22 3a 31 2c 22 48 57 41 46 59 42 66 50 44 42 64 4c 45 44 48 49 57 44 62 41 47 61 61 65 52 66 59 4f 22 3a 32 2c 22 61 64 55 41 56 59 43 64 49 63 50 57 57 57 65 54 61 62 5a 4e 48 43 22 3a 32 2c 22 49 5a 64 48 55 59 55 50 56 4e 50 4d 66 54 62 46 4d 47 53 55 48 4f 43 57 45 5a 58 52 44 64 61 65 22 3a 31 2c 22 62 51 62 59 46 63 49 4b 53 43 59 62 63 49 4e 48 4a 4e 62 4f 56 56 54 59 41 42 4f 46 4f 22 3a 31 2c 22 63 43 63 43 63 43 44 50 43 44 43 63 42 55 48 42 5a 4e 58 4d 52 55 4d 56 4d 49 54 41 46 66 4b 44 58 4e 4b 65 22 3a 31 2c 22 49 5a 45 53 61 5a 45 59 5a 44 45 62 65 4e 42 5a 58 54 51 65 46 58 55 46 63 4e 51 53 59 53 42 4e 61 4b 65 22 3a 31 2c 22 4f 61 61 Data Ascii: KBGO":1,"HWAFNRYTQWYQWeDZQNUZUYaTTC":1,"HWAFYBfPDBdLEDHIWDbAGaaeRfYO":2,"adUAVYCdIcPWWWeTabZNHC":2,"IZdHUYUPVNPMfTbFMGSUHOCWEZXRDdae":1,"bQbYFcIKSCYbcINHJNbOVVTYABOFO":1,"cCcCcCDPCDCcBUHBZNXMRUMVMITAFfKDXNKe":1,"IZESaZEYZDEbeNBZXTQeFXUFcNQSYSBNaKe":1,"Oaa
2024-02-08 18:35:50 UTC	16384	IN	Data Raw: 64 64 64 36 0d 0a 61 65 62 4a 52 58 46 59 4f 22 3a 31 2c 22 4f 44 52 45 47 5a 55 54 50 54 55 61 44 53 4b 42 5a 56 4b 46 50 61 44 57 41 44 57 52 65 22 3a 31 2c 22 48 57 41 46 4e 46 43 53 44 57 51 63 61 4e 59 43 4c 4a 42 54 63 5a 4a 51 63 53 42 4c 66 50 4a 61 41 4b 44 4b 65 22 3a 31 2c 22 49 5a 42 54 64 46 50 66 42 4b 53 41 45 4c 53 58 50 48 63 65 55 4c 4a 42 62 41 62 43 57 43 4a 55 62 55 4b 65 22 3a 31 2c 22 41 45 41 46 50 51 58 52 61 65 5a 43 4c 44 62 55 54 50 4f 66 46 52 57 58 46 5a 45 56 43 22 3a 31 2c 22 49 4e 51 48 55 59 5a 49 45 50 66 4c 45 5a 58 5a 45 63 53 61 45 52 4d 4a 44 57 58 56 58 65 52 65 22 3a 31 2c 22 61 58 54 62 53 46 59 54 42 48 4d 48 48 56 62 52 65 49 59 42 42 56 59 55 66 46 64 48 4d 4e 51 4a 54 65 45 52 58 57 58 46 5a 45 56 43 22 3a 31 Data Ascii: ddd6aebJRXFYO":1,"ODREGZUTPTUaDSKBZVKFPaDWADWRe":1,"HWAFNFCSDWQcaNYCLJBTcZJQcSBLfPJaAKDKe":1,"IZBTdFPfBKSAELSXPHceULJBbAbCWCJUbUKe":1,"AEAFPQXRaeZCLDbUTPOfFRWXFZEVC":1,"INQHUYZIEPfLEZXZEcSaERMJDWXVXeRe":1,"aXTbSFYTBHMHHVbReIYBBVYUfFdHMNQJTeERXWXFZEVC":1
2024-02-08 18:35:50 UTC	16384	IN	Data Raw: 4a 55 4a 44 52 53 4c 51 4b 4c 63 63 47 53 4f 46 53 66 55 57 52 43 22 3a 31 2c 22 61 58 54 66 48 41 45 44 42 4f 53 49 53 49 42 54 42 59 51 66 42 4e 65 5a 49 4e 51 46 4b 46 62 62 65 52 65 22 3a 31 2c 22 49 5a 56 54 57 52 47 66 4f 4a 49 4c 4f 22 3a 31 2c 22 48 57 41 46 59 59 59 52 4b 47 43 61 52 58 4c 4d 4c 52 53 55 50 52 65 22 3a 31 2c 22 63 43 48 4f 62 45 66 45 49 54 4e 50 66 62 65 51 4d 49 54 61 53 64 46 61 4c 62 46 44 58 46 5a 4d 49 63 43 63 43 63 43 43 22 3a 31 2c 22 59 64 58 66 64 4b 4e 4b 4e 4b 48 55 53 42 41 50 42 52 59 63 46 49 54 43 22 3a 31 2c 22 47 43 53 58 5a 4c 44 65 41 42 61 4b 44 44 4b 49 48 65 63 62 4f 46 59 66 5a 58 58 64 64 4f 45 52 65 22 3a 31 2c 22 50 50 58 47 53 43 5a 57 61 5a 58 62 53 59 62 51 4d 55 50 4e 5a 46 5a 65 61 50 52 65 22 3a Data Ascii: JUJDRSLQKLccGSOFSfUWRC":1,"aXTfHAEDBOSISIBTBYQfBNeZINQFKFbbeRe":1,"IZVTWRGfOJILO":1,"HWAFYYYRKGCaRXLMLRSUPRe":1,"cCHObEfEITNPfbeQMITaSdFaLbFDXFZMIcCcCcCC":1,"YdXfdKNKNKHUSBAPBRYcFITC":1,"GCSXZLDeABaKDDKIHecbOFYfZXXddOERe":1,"PPXGSCZWaZXbSYbQMUPNZFZeaPRe":

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
302	192.168.2.5	50081	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:49 UTC	2416	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
2024-02-08 18:35:49 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:49 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=1dea82c299e60225&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGd0lEkr6L_H7TQGxsXzEFmQ1yFKIbDQ2AA x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 6f067a3fd6e721a7db2a2901701a65d8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: dq67ckRgBz2XFs0UDHM3ecp2C5epJyXoy7VLX_DMWBqejxT7AHhUHQ==
2024-02-08 18:35:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
303	192.168.2.5	50082	216.137.45.32	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:49 UTC	2369	OUT	POST /v1/report HTTP/1.1 Host: web-perf.booking.com Connection: keep-alive Content-Length: 1950 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=utf-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; lastSeen=1707417348450
2024-02-08 18:35:49 UTC	1950	OUT	Data Raw: 7b 22 6d 65 74 72 69 63 73 22 3a 7b 22 77 65 62 56 69 74 61 6c 73 22 3a 7b 22 74 74 66 62 22 3a 7b 22 69 64 22 3a 22 76 33 2d 31 37 30 37 34 31 37 33 34 33 34 31 34 2d 31 38 32 38 36 34 37 32 32 39 38 32 39 22 2c 22 76 61 6c 75 65 22 3a 33 35 37 39 2e 38 39 39 39 39 39 39 39 39 39 39 34 2c 22 6e 61 76 69 67 61 74 69 6f 6e 54 79 70 65 22 3a 22 6e 61 76 69 67 61 74 65 22 7d 2c 22 66 63 70 22 3a 7b 22 69 64 22 3a 22 76 33 2d 31 37 30 37 34 31 37 33 34 33 34 31 34 2d 39 30 35 37 38 33 30 31 34 37 32 39 31 22 2c 22 76 61 6c 75 65 22 3a 37 33 32 33 2e 32 39 39 39 39 39 39 39 39 39 38 38 2c 22 6e 61 76 69 67 61 74 69 6f 6e 54 79 70 65 22 3a 22 6e 61 76 69 67 61 74 65 22 7d 2c 22 63 6c 73 22 3a 7b 22 69 64 22 3a 22 76 33 2d 31 37 30 37 34 31 37 33 34 33 36 35 36 Data Ascii: {"metrics":{"webVitals":{"ttfb":{"id":"v3-1707417343414-1828647229829","value":3579.899999999994,"navigationType":"navigate"},"fcp":{"id":"v3-1707417343414-9057830147291","value":7323.299999999988,"navigationType":"navigate"},"cls":{"id":"v3-1707417343656
2024-02-08 18:35:49 UTC	648	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 11 Connection: close server: envoy date: Thu, 08 Feb 2024 18:35:49 GMT vary: Origin access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true referrer-policy: no-referrer x-frame-options: SAMEORIGIN x-content-type-options: nosniff strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 a46e14507c5d47c673aa8a27e655d93c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-C2 X-Amz-Cf-Id: niIMdMoFJp4K65BBsbY7kBia0tB0iytgYOd-f8xi91s8xn_WJEVBjw==
2024-02-08 18:35:49 UTC	11	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 7d Data Ascii: {"ok":true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
304	192.168.2.5	50083	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:49 UTC	716	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 947 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:35:49 UTC	947	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 64 37 33 36 31 61 34 2d 63 63 63 66 2d 34 30 62 39 2d 62 63 31 31 2d 36 36 61 32 35 38 35 32 32 35 33 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 34 37 65 39 33 32 38 62 2d 34 31 66 64 2d 34 65 31 64 2d 39 64 30 31 2d 63 35 62 37 61 30 35 38 33 63 31 35 22 2c 22 73 73 22 3a 22 31 35 65 30 61 36 32 31 2d 31 31 34 34 2d 34 38 35 64 2d 39 30 31 62 2d 30 39 62 62 36 33 38 64 32 39 33 36 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"fd7361a4-cccf-40b9-bc11-66a258522530","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"47e9328b-41fd-4e1d-9d01-c5b7a0583c15","ss":"15e0a621-1144-485d-901b-09bb638d2936","bg":true,"s
2024-02-08 18:35:49 UTC	523	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:35:49 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
305	192.168.2.5	50084	151.101.192.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:49 UTC	1399	OUT	GET /v3/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%226461a31a%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1707417346998 HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSYyQmdMeTJ2eFJzSk91TERJcUVCQjRKc0lCd3J4VHVoTFJiMkNEWUc0ZVZ4eHkyb1Y1Z2I1ejVSRXdmc05CYW5QU0R6Ukg1STFmTzFjd3dsdXg4YmI4bUM0UURpZ2FNNU42VFpKQmd0QUVRRT0melAzQmdRVXdsM0VlN0llbzVzRnpOdnFPL1BvPQ=="
2024-02-08 18:35:50 UTC	594	IN	HTTP/1.1 200 OK Connection: close Content-Length: 35 cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT content-type: image/gif access-control-allow-origin: * set-cookie: ar_debug=1; Expires=Fri, 07 Feb 2025 18:35:50 GMT; Path=/; Domain=.pinterest.com; Secure; HTTPOnly; SameSite=None x-envoy-upstream-service-time: 1 referrer-policy: origin x-pinterest-rid: 8818208948934048 Date: Thu, 08 Feb 2024 18:35:50 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: f9d1c7100d6ab6a9fc70375cea0fca5e275d3fa9
2024-02-08 18:35:50 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
306	192.168.2.5	50085	151.101.192.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:49 UTC	1602	OUT	GET /v3/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1707417347660&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22aem_eligible_list%22%3A%5B%22fn%22%5D%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%226461a31a%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSYyQmdMeTJ2eFJzSk91TERJcUVCQjRKc0lCd3J4VHVoTFJiMkNEWUc0ZVZ4eHkyb1Y1Z2I1ejVSRXdmc05CYW5QU0R6Ukg1STFmTzFjd3dsdXg4YmI4bUM0UURpZ2FNNU42VFpKQmd0QUVRRT0melAzQmdRVXdsM0VlN0llbzVzRnpOdnFPL1BvPQ=="
2024-02-08 18:35:50 UTC	914	IN	HTTP/1.1 200 OK Connection: close Content-Length: 35 cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT content-type: image/gif access-control-allow-origin: * set-cookie: ar_debug=1; Expires=Fri, 07 Feb 2025 18:35:50 GMT; Path=/; Domain=.pinterest.com; Secure; HTTPOnly; SameSite=None set-cookie: _pinterest_ct_ua="TWc9PSY4dDVmd0o2ZzF4RVN2ZHlPL090aCt3NnpTWkZQdlF2bFR0OHJrNFBlM3NYbW9ucGRrMGIrL0lES2pGVnRRNzVaWitlbjRUZDhYVzc2U2E3ZFFrSzhES2RCUlpvb2tIT1pnU2JNS1FUWTd3bz0mclU4SWk0WVFTSXEwdmVJSEttb3prYlpuZzBjPQ=="; Expires=Fri, 07 Feb 2025 18:35:50 GMT; Path=/; Domain=ct.pinterest.com; Secure; SameSite=None x-envoy-upstream-service-time: 1 referrer-policy: origin x-pinterest-rid: 6978440013281099 Date: Thu, 08 Feb 2024 18:35:50 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: f9d1c7100d6ab6a9fc70375cea0fca5e275d3fa9
2024-02-08 18:35:50 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
307	192.168.2.5	50087	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:49 UTC	716	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 944 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:35:49 UTC	944	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 64 37 33 36 31 61 34 2d 63 63 63 66 2d 34 30 62 39 2d 62 63 31 31 2d 36 36 61 32 35 38 35 32 32 35 33 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 61 61 30 39 31 64 38 63 2d 66 38 35 63 2d 34 66 65 61 2d 38 32 32 31 2d 64 34 34 37 63 35 62 38 62 66 34 34 22 2c 22 73 73 22 3a 22 31 35 65 30 61 36 32 31 2d 31 31 34 34 2d 34 38 35 64 2d 39 30 31 62 2d 30 39 62 62 36 33 38 64 32 39 33 36 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"fd7361a4-cccf-40b9-bc11-66a258522530","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"aa091d8c-f85c-4fea-8221-d447c5b8bf44","ss":"15e0a621-1144-485d-901b-09bb638d2936","bg":true,"s
2024-02-08 18:35:50 UTC	523	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:35:50 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
308	192.168.2.5	50088	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:50 UTC	717	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 1020 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:35:50 UTC	1020	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 64 37 33 36 31 61 34 2d 63 63 63 66 2d 34 30 62 39 2d 62 63 31 31 2d 36 36 61 32 35 38 35 32 32 35 33 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 62 35 37 39 33 35 62 30 2d 65 65 37 65 2d 34 38 62 63 2d 38 66 65 66 2d 31 30 37 32 66 65 65 36 36 37 34 35 22 2c 22 73 73 22 3a 22 31 35 65 30 61 36 32 31 2d 31 31 34 34 2d 34 38 35 64 2d 39 30 31 62 2d 30 39 62 62 36 33 38 64 32 39 33 36 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"fd7361a4-cccf-40b9-bc11-66a258522530","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"b57935b0-ee7e-48bc-8fef-1072fee66745","ss":"15e0a621-1144-485d-901b-09bb638d2936","bg":true,"s
2024-02-08 18:35:50 UTC	523	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:35:50 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
309	192.168.2.5	50090	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:50 UTC	716	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 945 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:35:50 UTC	945	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 64 37 33 36 31 61 34 2d 63 63 63 66 2d 34 30 62 39 2d 62 63 31 31 2d 36 36 61 32 35 38 35 32 32 35 33 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 36 33 35 38 61 37 33 32 2d 66 35 33 31 2d 34 31 36 62 2d 62 39 63 32 2d 61 32 37 61 39 37 66 30 65 61 62 63 22 2c 22 73 73 22 3a 22 31 35 65 30 61 36 32 31 2d 31 31 34 34 2d 34 38 35 64 2d 39 30 31 62 2d 30 39 62 62 36 33 38 64 32 39 33 36 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"fd7361a4-cccf-40b9-bc11-66a258522530","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"6358a732-f531-416b-b9c2-a27a97f0eabc","ss":"15e0a621-1144-485d-901b-09bb638d2936","bg":true,"s
2024-02-08 18:35:50 UTC	482	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:35:50 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: clear access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
310	192.168.2.5	50089	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:50 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive Content-Length: 2412 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:50 UTC	2412	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 66 6b 36 42 56 47 34 69 41 41 41 41 3a 6a 6e 34 6a 69 48 6a 31 4b 47 52 32 57 65 70 51 55 4c 64 44 41 50 4e 68 32 37 61 52 38 73 36 34 73 6d 4f 53 2b 6a 4f 4a 46 63 75 30 2f 67 44 72 31 6b 2b 42 69 4a 6d 4f 34 49 4a 4e 4d 31 72 6c 42 30 35 41 6a 57 73 37 31 63 38 52 70 34 35 69 6b 32 67 58 7a 2b 6b 5a 6c 76 52 58 5a 43 4d 75 6c 70 56 45 72 61 69 47 70 6c 63 4e 74 35 42 65 70 36 52 55 37 38 48 39 70 36 4d 53 37 35 32 39 31 66 65 7a 61 4d 4c 72 30 67 4e 72 2b 62 41 34 6e 51 50 53 33 44 66 6a 4d 54 42 46 71 69 4d 49 55 37 44 62 45 73 75 33 4b 6d 2b 6a 53 6c 31 4e 6a 33 45 7a 69 50 Data Ascii: {"existing_token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAfk6BVG4iAAAA:jn4jiHj1KGR2WepQULdDAPNh27aR8s64smOS+jOJFcu0/gDr1k+BiJmO4IJNM1rlB05AjWs71c8Rp45ik2gXz+kZlvRXZCMulpVEraiGplcNt5Bep6RU78H9p6MS75291fezaMLr0gNr+bA4nQPS3DfjMTBFqiMIU7DbEsu3Km+jSl1Nj3EziP
2024-02-08 18:35:50 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1036 Connection: close Vary: Accept-Encoding Date: Thu, 08 Feb 2024 18:35:50 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65c51f06-4ceca3bd21e1a86f32d6f403 X-Cache: Miss from cloudfront Via: 1.1 199b065e4c1253c9590e1b5e57083906.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: E10fu7waYsqZ8SDEnPU2TYihv74EyxRjVRz2yXHQXgRcss1VEUaeUw==
2024-02-08 18:35:50 UTC	1036	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 6d 32 2b 42 4c 6a 30 6e 41 41 41 41 3a 43 71 7a 32 31 79 33 4a 51 38 42 41 6e 47 39 4a 48 4a 44 68 71 32 64 63 6f 2f 31 4c 30 54 4a 4a 61 79 4f 52 47 65 70 38 33 32 79 72 54 75 72 55 74 56 65 2f 33 35 54 7a 41 4a 6b 54 74 33 36 52 46 46 33 6c 31 2f 6b 4c 6a 47 57 57 39 64 39 69 42 37 35 4e 5a 63 79 70 57 6b 77 77 44 39 4b 6e 67 57 45 75 41 68 41 6c 55 62 55 71 6f 34 72 48 56 31 2b 45 37 39 6d 55 35 69 79 42 41 51 56 32 38 2f 68 62 6f 57 6e 47 4d 58 4c 43 72 65 6f 68 65 77 46 56 46 73 61 77 47 63 30 41 77 55 49 72 37 43 76 68 41 78 2b 46 70 7a 50 4d 39 36 65 36 6a 6d 4e 62 73 51 66 72 68 74 4c 62 51 33 4a Data Ascii: {"token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
311	192.168.2.5	50091	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:50 UTC	2416	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
2024-02-08 18:35:50 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:50 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=4f1d82c3b701020a&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGcA-NCNBCuXy2X_sRdWogyJXakaZ9zseHQ x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 c1bfc7dbcf7f9782aa3be590b7ce3d6a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 8r5RTjPeJstLs2sei2sEGCGERFt50Ezbem0U3Ayv-5RZOrNz2XegWg==
2024-02-08 18:35:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
312	192.168.2.5	50080	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:50 UTC	5532	OUT	GET /js_tracking?ver=2&stype=1&ref_action=index&lang=en-us&pid=e4de82b919b800e4&aid=304142&sid=5171fc655664ddf74ab763a094523fb7&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|17142&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3 X-Booking-CSRF: M1fFZQAAAAA=ow_iJm02C23yTbeZTjDwFw3ODjezY3bK5FHdo-YoJdT7GCkrsQ32GPbbWguo4KloItJB_vA0z9Y_xRO57ct8Amr5W_XGX_7GZSpQGGcZ9tRZ2sLvFoX1OvJhoh8lHbncqueaPtPA9hz8Y_-xROuXkd4r2dhb8qRB-XM9-fcVbZ1TIOfkTWMBhv8vt5DNEpcahji4EEgpTuAdyxqG sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: e4de82b919b800e4 X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,1912460\|1,1856870\|1,1912460\|7,1912460\|6,1908890\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|4,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|2,cCHObKdBdUHINPSXeHDALOLOLMO\|5,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,cCHObKdBdUHINPSXeHDALOLOLMO\|3 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; lastSeen=1707417349049; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8kqA80E7Dah055EUUCXJybztZSKxkA5aCnIJFLwuEv5PRBH%2FuOIr093hmKmylOzKy1om%2BA6S9CXSpp3YXWEQ5uMtGzdXyxL7fd6KnVt8wEbVbuHrbuxq5uAQY%2BNxC%2Fj%2BSMmkfmWa3MeC%2FkjdjYc5vu2uXFBZYHleA%3D
2024-02-08 18:35:50 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:50 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=799482c3ec6c024c&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejL3-sl63BIyrR6fb8WfzD5QoInSlmrc7LI x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7eeed291abf48890d3f36565208941a8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: yAIjJCEJr90VqXgsrOyggbrmnuCHRtaxJ8tXXlAnm2WMZpHxDrVHrg==
2024-02-08 18:35:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
313	192.168.2.5	50092	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:50 UTC	2416	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
2024-02-08 18:35:51 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:50 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=5ae382c35cb702c6&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGYPoCIoVWsVLNIe3BC9NAAexDGoCMCkqBg x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 45893c5ff2aa24fa7dce9573a0274642.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: M2mv-Kp0bvWzlAHAk96h2bfSdvzgZ4warcYXvmYOHEwWeh9G2ZT9bg==
2024-02-08 18:35:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
314	192.168.2.5	50094	18.67.65.100	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:50 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:51 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Thu, 08 Feb 2024 18:35:51 GMT X-Cache: Error from cloudfront Via: 1.1 a7a1b4c19abc42d237405ce4c4069f10.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: r6NfVNothIULy1g8vkQzG80gw4PLnkFiFNm5ezaonUKwStdHS8QScQ==
2024-02-08 18:35:51 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
315	192.168.2.5	50095	3.161.193.117	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:50 UTC	650	OUT	POST /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive Content-Length: 86 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-API-Version: 1 Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:50 UTC	86	OUT	Data Raw: 7b 22 70 69 64 22 3a 22 65 34 64 65 38 32 62 39 31 39 62 38 30 30 65 34 22 2c 22 72 65 66 41 63 74 69 6f 6e 22 3a 22 69 6e 64 65 78 22 2c 22 73 69 74 65 54 79 70 65 22 3a 22 31 22 2c 22 6c 63 70 22 3a 31 37 31 34 32 2e 33 39 39 39 39 39 39 39 39 39 39 34 7d Data Ascii: {"pid":"e4de82b919b800e4","refAction":"index","siteType":"1","lcp":17142.399999999994}
2024-02-08 18:35:51 UTC	525	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:51 GMT vary: Origin, Accept-Encoding access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 c3264e7e1770af395200cef88a978aec.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P8 X-Amz-Cf-Id: Os6MSGzEgC7DBJRlx6VUqyoEu3iaMlPNU628mqTGaTWeaLSKqQtF8Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
316	192.168.2.5	50093	172.64.155.119	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:50 UTC	597	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:51 UTC	370	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:35:51 GMT Content-Type: application/json Content-Length: 68 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8525f98bdbb9070d-ATL
2024-02-08 18:35:51 UTC	68	IN	Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 47 41 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 47 65 6f 72 67 69 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d Data Ascii: {"country":"US","state":"GA","stateName":"Georgia","continent":"NA"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
317	192.168.2.5	50097	64.233.177.99	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:50 UTC	1128	OUT	POST /recaptcha/api2/reload?k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 7793 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-protobuffer Accept: / Origin: https://www.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&cb=pehgtvg39f6l Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:50 UTC	7793	OUT	Data Raw: 0a 18 78 35 57 57 6f 45 35 37 46 76 30 64 36 41 54 4b 73 4c 44 49 41 4b 6e 74 12 a4 0f 30 33 41 46 63 57 65 41 36 4e 2d 62 71 72 64 44 41 51 4b 34 6b 5f 48 59 46 44 50 79 45 36 4a 54 57 43 76 75 69 57 52 33 31 2d 73 4c 49 5f 65 35 44 65 4b 6e 51 33 59 33 32 46 64 37 30 31 68 79 6a 68 39 56 38 58 62 6d 5f 2d 6d 58 48 35 4c 50 64 41 52 5a 45 64 51 35 79 59 36 61 5f 62 4a 31 33 45 79 72 34 38 47 2d 52 70 49 36 4c 2d 35 59 73 6c 76 55 78 6c 36 68 6c 41 79 39 66 6c 32 6c 61 73 69 73 53 47 44 78 4c 4d 4b 4e 5a 6b 48 51 44 47 57 59 65 31 76 47 62 6e 6e 6c 65 41 73 34 37 55 44 70 2d 35 36 4d 6f 68 37 63 72 43 46 6f 51 2d 55 54 5f 41 58 53 4f 55 59 79 74 74 65 5f 5f 34 53 78 63 55 57 59 31 7a 62 34 65 36 44 4c 50 66 43 73 6d 6e 68 72 72 48 35 75 64 78 38 5a 2d 6b Data Ascii: x5WWoE57Fv0d6ATKsLDIAKnt03AFcWeA6N-bqrdDAQK4k_HYFDPyE6JTWCvuiWR31-sLI_e5DeKnQ3Y32Fd701hyjh9V8Xbm_-mXH5LPdARZEdQ5yY6a_bJ13Eyr48G-RpI6L-5YslvUxl6hlAy9fl2lasisSGDxLMKNZkHQDGWYe1vGbnnleAs47UDp-56Moh7crCFoQ-UT_AXSOUYytte__4SxcUWY1zb4e6DLPfCsmnhrrH5udx8Z-k
2024-02-08 18:35:51 UTC	696	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Date: Thu, 08 Feb 2024 18:35:51 GMT Expires: Thu, 08 Feb 2024 18:35:51 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: _GRECAPTCHA=09AJmcDEmmSVjhXu6iSND5nUlaG4u8jg9r3gIsM8fricsYrppd_RXehS30W8rvMgVb0KtN3BzkTFd51AiDyh7KnUA;Path=/recaptcha;Expires=Tue, 06-Aug-2024 18:35:51 GMT;Secure;HttpOnly;Priority=HIGH;SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:51 UTC	556	IN	Data Raw: 61 36 34 0d 0a 29 5d 7d 27 0a 5b 22 72 72 65 73 70 22 2c 22 30 33 41 46 63 57 65 41 37 4e 6b 39 69 5a 78 45 56 79 35 71 4f 6b 44 5f 70 55 54 62 6e 2d 63 65 32 36 52 44 69 2d 48 63 52 79 37 59 71 74 6c 4e 6c 5a 61 67 70 31 51 52 73 65 38 75 4f 66 59 6a 72 56 5a 52 61 6b 59 48 52 39 30 61 51 38 6e 57 4f 37 4b 7a 38 5f 57 49 76 6b 6c 4a 4a 5f 79 47 51 79 34 30 38 7a 48 78 5f 33 77 56 42 6a 66 58 30 32 50 59 46 6e 53 73 58 59 44 4e 4c 4a 78 31 6f 41 77 51 41 5a 46 4e 6c 5f 71 42 62 33 67 75 53 71 64 37 64 6a 55 6e 64 31 6e 2d 35 5f 50 46 4d 49 36 64 65 78 6e 70 30 35 78 53 6d 37 44 5f 64 67 34 51 47 51 72 5f 63 61 46 4c 66 72 52 5f 6a 36 53 63 52 77 72 79 75 4a 4c 47 62 70 52 50 4e 44 49 72 73 44 45 39 79 49 39 47 76 48 42 4a 48 43 73 7a 4e 59 32 57 55 45 36 Data Ascii: a64)]}'["rresp","03AFcWeA7Nk9iZxEVy5qOkD_pUTbn-ce26RDi-HcRy7YqtlNlZagp1QRse8uOfYjrVZRakYHR90aQ8nWO7Kz8_WIvklJJ_yGQy408zHx_3wVBjfX02PYFnSsXYDNLJx1oAwQAZFNl_qBb3guSqd7djUnd1n-5_PFMI6dexnp05xSm7D_dg4QGQr_caFLfrR_j6ScRwryuJLGbpRPNDIrsDE9yI9GvHBJHCszNY2WUE6
2024-02-08 18:35:51 UTC	1252	IN	Data Raw: 50 79 75 73 38 7a 35 6a 2d 72 4d 34 57 57 67 65 61 67 6b 45 68 6f 42 6d 50 4a 66 30 49 73 6d 2d 75 6f 69 31 2d 68 71 32 47 63 34 70 78 45 79 61 44 37 48 74 50 4f 33 77 35 41 46 33 61 6e 4e 57 34 6a 4e 5f 31 75 53 64 51 54 6a 57 41 4d 54 77 61 6d 31 64 78 35 38 62 32 47 5f 75 70 52 70 63 70 71 43 5a 4b 70 48 59 69 30 77 44 54 55 59 34 36 39 64 35 76 4a 58 4b 63 75 58 47 78 73 64 6b 65 38 53 69 70 6f 33 5f 6a 74 68 51 22 2c 6e 75 6c 6c 2c 31 32 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 22 62 67 64 61 74 61 22 2c 22 4c 79 39 33 64 33 63 75 5a 32 39 76 5a 32 78 6c 4c 6d 4e 76 62 53 39 71 63 79 39 69 5a 79 39 4c 61 31 64 47 5a 56 4e 56 55 6d 56 72 57 45 64 35 59 32 52 77 63 6c 5a 44 4c 56 56 5a 4e 6b 56 45 4c 56 70 47 4e 57 78 73 4d 6b 70 44 54 57 Data Ascii: Pyus8z5j-rM4WWgeagkEhoBmPJf0Ism-uoi1-hq2Gc4pxEyaD7HtPO3w5AF3anNW4jN_1uSdQTjWAMTwam1dx58b2G_upRpcpqCZKpHYi0wDTUY469d5vJXKcuXGxsdke8Sipo3_jthQ",null,120,null,null,null,["bgdata","Ly93d3cuZ29vZ2xlLmNvbS9qcy9iZy9La1dGZVNVUmVrWEd5Y2RwclZDLVVZNkVELVpGNWxsMkpDTW
2024-02-08 18:35:51 UTC	859	IN	Data Raw: 30 52 51 5a 44 52 6d 56 56 64 6e 61 32 6c 30 52 57 74 77 55 58 4e 51 59 54 64 51 54 58 67 31 52 55 5a 44 61 6b 70 4a 56 6e 68 5a 65 6d 77 78 56 46 6c 57 59 6a 46 31 4f 48 70 46 55 33 5a 61 62 45 68 55 65 47 4e 52 56 47 56 56 53 30 74 68 53 6b 64 71 52 48 46 78 4c 32 31 36 56 57 70 75 62 58 52 42 54 54 64 75 61 6d 78 6a 4d 58 64 6a 64 31 56 72 54 57 35 71 4f 54 5a 48 65 47 70 43 52 45 39 31 62 45 31 47 54 55 70 36 5a 48 4e 48 55 55 4e 52 53 47 4a 4f 4b 7a 52 4b 53 31 5a 30 4e 48 42 6f 54 56 55 34 55 32 70 58 63 6a 42 77 62 56 42 42 63 6b 6c 4f 55 47 6c 77 5a 31 5a 44 64 45 6c 4d 65 55 70 34 56 47 4a 46 57 54 6c 5a 63 6d 35 31 52 32 70 76 55 32 4e 33 51 33 4e 33 65 47 30 76 64 6a 46 32 59 7a 56 42 65 47 4e 33 65 48 68 47 63 57 68 4a 61 79 74 6c 51 30 45 78 Data Ascii: 0RQZDRmVVdna2l0RWtwUXNQYTdQTXg1RUZDakpJVnhZemwxVFlWYjF1OHpFU3ZabEhUeGNRVGVVS0thSkdqRHFxL216VWpubXRBTTduamxjMXdjd1VrTW5qOTZHeGpCRE91bE1GTUp6ZHNHUUNRSGJOKzRKS1Z0NHBoTVU4U2pXcjBwbVBBcklOUGlwZ1ZDdElMeUp4VGJFWTlZcm51R2pvU2N3Q3N3eG0vdjF2YzVBeGN3eHhGcWhJaytlQ0Ex
2024-02-08 18:35:51 UTC	1252	IN	Data Raw: 31 36 36 38 0d 0a 46 36 56 32 4d 35 54 44 4e 7a 52 45 73 31 5a 45 52 69 64 6d 4d 72 57 6a 64 4f 57 48 42 6e 52 57 46 45 5a 6d 46 75 4d 33 56 6c 4d 33 64 4c 4f 58 4a 6f 63 47 4a 45 4f 48 4d 79 54 31 59 77 52 7a 52 4f 4d 47 68 50 56 6b 70 74 61 55 38 31 55 6a 4e 7a 59 33 42 6a 4f 45 4e 4b 4b 32 5a 34 51 55 77 76 4e 6b 4e 6b 61 57 74 71 4e 6b 31 51 64 56 4a 5a 62 6b 46 59 4c 32 46 6e 52 6d 31 31 61 6c 52 53 53 57 67 72 62 47 4a 72 61 31 4e 32 52 56 68 76 51 31 56 32 4d 46 42 59 65 6a 4e 70 62 6d 70 4c 61 6c 4a 51 4b 33 5a 4a 64 56 4e 49 53 33 51 30 54 55 5a 50 4c 32 78 6a 55 55 4a 68 65 46 6c 69 64 56 52 6d 52 58 70 36 62 48 4a 57 56 31 70 75 55 69 74 6e 63 58 4a 6b 62 55 6b 78 61 6b 52 78 5a 30 64 33 61 46 5a 6a 63 56 4d 34 4d 6c 55 34 56 57 30 35 51 32 56 Data Ascii: 1668F6V2M5TDNzREs1ZERidmMrWjdOWHBnRWFEZmFuM3VlM3dLOXJocGJEOHMyT1YwRzROMGhPVkptaU81UjNzY3BjOENKK2Z4QUwvNkNkaWtqNk1QdVJZbkFYL2FnRm11alRSSWgrbGJra1N2RVhvQ1V2MFBYejNpbmpLalJQK3ZJdVNIS3Q0TUZPL2xjUUJheFlidVRmRXp6bHJWV1puUitncXJkbUkxakRxZ0d3aFZjcVM4MlU4VW05Q2V
2024-02-08 18:35:51 UTC	1252	IN	Data Raw: 4d 33 5a 55 5a 6c 42 75 59 32 67 31 4c 30 68 32 53 55 4e 43 53 55 5a 69 57 47 35 48 5a 30 39 55 4d 47 70 74 5a 6c 68 4c 51 32 78 48 62 56 70 33 4d 45 73 33 5a 32 64 6f 4d 44 64 43 4f 45 68 30 4f 47 35 59 54 6e 70 6d 61 31 55 30 51 33 64 45 4b 7a 41 34 62 32 39 61 4e 48 68 6e 51 55 31 73 4f 44 56 35 56 6b 78 43 4b 7a 59 72 64 30 78 51 63 6d 68 6a 56 7a 64 78 52 46 56 44 4e 55 4a 32 62 46 56 69 59 57 78 55 53 31 45 77 57 46 6c 42 64 57 68 74 4e 6e 70 36 65 56 70 49 5a 33 6b 79 4b 32 78 58 52 53 74 47 4d 46 45 35 55 30 4a 75 59 6c 46 59 55 31 64 55 5a 7a 46 73 4e 47 52 53 4f 56 4a 74 4d 6b 46 50 64 33 68 4d 64 57 39 44 56 47 46 52 54 46 59 30 54 57 52 4f 5a 45 68 72 63 6b 6c 53 53 6b 51 33 56 55 64 6c 64 58 42 6b 59 6d 6c 77 65 48 4e 59 4e 32 46 6e 54 48 6c Data Ascii: M3ZUZlBuY2g1L0h2SUNCSUZiWG5HZ09UMGptZlhLQ2xHbVp3MEs3Z2doMDdCOEh0OG5YTnpma1U0Q3dEKzA4b29aNHhnQU1sODV5VkxCKzYrd0xQcmhjVzdxRFVDNUJ2bFViYWxUS1EwWFlBdWhtNnp6eVpIZ3kyK2xXRStGMFE5U0JuYlFYU1dUZzFsNGRSOVJtMkFPd3hMdW9DVGFRTFY0TWROZEhrcklSSkQ3VUdldXBkYmlweHNYN2FnTHl
2024-02-08 18:35:51 UTC	1252	IN	Data Raw: 59 56 70 31 63 45 6f 35 4d 55 56 73 64 6e 55 31 56 54 4a 59 56 55 64 45 4f 55 31 52 52 58 42 72 65 44 4e 74 53 32 56 6d 65 6a 68 46 4d 6a 6c 58 65 54 68 5a 57 6d 6c 76 4e 46 4e 4d 51 33 4a 59 62 55 70 75 56 55 6c 79 61 57 74 4b 59 58 67 34 4e 6c 70 52 54 58 52 5a 52 6d 74 56 54 6b 46 61 53 6b 78 6a 57 45 74 47 51 6e 63 34 63 30 77 72 4e 30 67 31 61 44 4a 36 56 56 42 68 63 53 74 4b 4f 45 74 6f 4f 45 39 6a 55 7a 5a 47 51 53 39 4b 4d 58 4a 75 63 7a 59 7a 57 6e 46 44 59 54 68 4f 4e 6b 6c 45 64 6c 4e 35 51 57 52 6a 5a 46 5a 68 53 44 68 4b 51 58 46 72 56 6b 4d 78 56 55 31 59 57 6c 4a 56 56 32 5a 6e 4d 6e 4e 33 4b 31 6c 6c 51 6d 38 79 65 56 4a 52 56 54 42 70 51 54 46 78 59 7a 46 53 52 45 4e 53 4e 6d 39 48 54 6a 64 48 54 7a 56 71 65 47 5a 69 4f 46 4e 56 4c 32 78 Data Ascii: YVp1cEo5MUVsdnU1VTJYVUdEOU1RRXBreDNtS2VmejhFMjlXeThZWmlvNFNMQ3JYbUpuVUlyaWtKYXg4NlpRTXRZRmtVTkFaSkxjWEtGQnc4c0wrN0g1aDJ6VVBhcStKOEtoOE9jUzZGQS9KMXJuczYzWnFDYThONklEdlN5QWRjZFZhSDhKQXFrVkMxVU1YWlJVV2ZnMnN3K1llQm8yeVJRVTBpQTFxYzFSRENSNm9HTjdHTzVqeGZiOFNVL2x
2024-02-08 18:35:51 UTC	1252	IN	Data Raw: 55 7a 4a 33 55 45 64 48 56 7a 64 79 52 58 64 4a 54 45 6c 49 4e 32 4a 71 52 6c 4e 6d 64 79 39 54 4d 6e 56 77 56 46 5a 79 63 57 45 30 62 32 39 52 57 6e 42 44 53 45 5a 49 4f 48 4d 30 62 55 73 34 59 55 39 58 54 6d 49 72 4f 46 56 35 59 33 55 79 64 55 31 42 65 6b 4a 45 64 30 4e 33 65 44 4d 72 56 6b 78 55 54 30 78 42 61 56 70 74 4d 47 4e 74 61 6c 6c 33 4e 6e 46 61 4f 55 4d 34 56 56 63 35 64 6c 6c 52 63 58 4a 53 65 45 56 36 4b 33 46 6f 62 53 39 47 4d 45 39 6d 52 45 31 47 65 48 4e 48 63 55 35 68 4d 56 4a 54 56 32 4e 35 62 55 64 79 64 46 6c 4d 4e 43 73 34 59 58 41 77 54 48 42 6f 57 58 52 77 54 47 56 68 65 46 64 43 63 48 56 76 4e 7a 67 79 54 48 6c 46 55 30 30 33 4f 54 42 30 59 33 68 53 54 46 4e 74 57 6a 64 44 64 30 5a 46 4d 6a 68 49 55 6d 35 52 5a 54 51 79 4e 30 31 Data Ascii: UzJ3UEdHVzdyRXdJTElIN2JqRlNmdy9TMnVwVFZycWE0b29RWnBDSEZIOHM0bUs4YU9XTmIrOFV5Y3UydU1BekJEd0N3eDMrVkxUT0xBaVptMGNtall3NnFaOUM4VVc5dllRcXJSeEV6K3FobS9GME9mRE1GeHNHcU5hMVJTV2N5bUdydFlMNCs4YXAwTHBoWXRwTGVheFdCcHVvNzgyTHlFU003OTB0Y3hSTFNtWjdDd0ZFMjhIUm5RZTQyN01
2024-02-08 18:35:51 UTC	736	IN	Data Raw: 61 32 6c 36 54 58 64 44 63 30 74 76 51 53 38 76 53 47 68 42 62 57 70 59 4f 47 4a 32 4c 7a 46 44 4e 31 42 57 65 47 64 6a 52 6c 41 35 64 46 42 51 55 47 70 74 51 30 39 70 56 6a 5a 4c 64 46 70 6d 51 6a 5a 57 55 32 74 46 62 56 42 48 55 6e 5a 5a 4e 7a 6b 72 4f 47 56 6a 59 6d 74 79 61 54 63 79 61 58 67 33 54 56 52 4c 53 45 31 53 4d 6a 59 72 4d 47 52 70 51 69 39 79 4e 30 63 7a 5a 6c 4e 76 61 6c 6f 79 64 6e 4e 54 53 33 4a 79 61 30 64 31 4e 45 46 34 63 7a 4a 76 65 54 49 31 54 44 4e 34 5a 57 39 73 65 47 6c 6c 63 58 4a 52 61 48 68 75 54 33 42 6d 57 45 4e 30 51 57 5a 75 4e 46 4a 69 55 33 4e 6a 4b 33 64 6c 52 6b 4a 7a 54 55 78 56 56 47 52 31 52 47 67 79 54 6d 35 72 63 57 45 31 56 6c 56 4b 65 44 46 4a 55 47 77 79 61 30 4e 4c 4e 44 52 61 55 43 74 72 55 57 6c 48 62 47 68 Data Ascii: a2l6TXdDc0tvQS8vSGhBbWpYOGJ2LzFDN1BWeGdjRlA5dFBQUGptQ09pVjZLdFpmQjZWU2tFbVBHUnZZNzkrOGVjYmtyaTcyaXg3TVRLSE1SMjYrMGRpQi9yN0czZlNvaloydnNTS3Jya0d1NEF4czJveTI1TDN4ZW9seGllcXJRaHhuT3BmWEN0QWZuNFJiU3NjK3dlRkJzTUxVVGR1RGgyTm5rcWE1VlVKeDFJUGwya0NLNDRaUCtrUWlHbGh
2024-02-08 18:35:51 UTC	1252	IN	Data Raw: 31 33 35 64 0d 0a 31 36 52 6a 5a 35 4c 33 52 32 4e 57 68 53 62 6e 56 71 4d 45 35 6a 51 6b 49 31 5a 6d 70 51 65 6d 5a 31 4d 30 56 59 63 48 64 6f 56 6b 59 30 57 57 6c 35 4e 48 5a 6f 56 47 68 74 51 32 68 47 4d 30 68 61 53 33 5a 46 63 45 39 73 55 56 46 70 56 6c 4e 46 4f 44 64 68 59 6a 42 69 57 45 31 56 55 55 31 4f 65 46 42 4f 56 31 63 35 54 56 70 34 52 6d 74 43 61 47 52 58 4d 45 35 42 63 47 39 34 64 54 67 78 63 48 6f 30 57 56 70 6a 4b 30 52 4c 59 6c 4a 5a 52 31 64 54 5a 55 6f 7a 5a 32 73 34 4c 32 78 4a 52 31 46 42 4d 30 68 68 4b 32 78 68 52 47 6f 72 56 55 39 4e 4e 45 31 78 61 54 52 6d 57 46 68 74 61 47 51 77 65 44 49 79 63 44 6b 33 53 48 52 48 59 33 4e 32 65 6c 70 79 55 44 42 68 63 6e 56 49 53 54 59 30 5a 6a 52 48 63 6c 52 4b 51 55 35 57 5a 58 4d 33 64 31 52 Data Ascii: 135d16RjZ5L3R2NWhSbnVqME5jQkI1ZmpQemZ1M0VYcHdoVkY0WWl5NHZoVGhtQ2hGM0haS3ZFcE9sUVFpVlNFODdhYjBiWE1VUU1OeFBOV1c5TVp4RmtCaGRXME5BcG94dTgxcHo0WVpjK0RLYlJZR1dTZUozZ2s4L2xJR1FBM0hhK2xhRGorVU9NNE1xaTRmWFhtaGQweDIycDk3SHRHY3N2elpyUDBhcnVISTY0ZjRHclRKQU5WZXM3d1R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
318	192.168.2.5	50098	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:51 UTC	716	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 946 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:35:51 UTC	946	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 64 37 33 36 31 61 34 2d 63 63 63 66 2d 34 30 62 39 2d 62 63 31 31 2d 36 36 61 32 35 38 35 32 32 35 33 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 62 36 39 31 64 32 36 32 2d 37 33 36 37 2d 34 61 35 65 2d 62 66 61 65 2d 31 34 61 34 64 65 66 33 39 31 66 31 22 2c 22 73 73 22 3a 22 31 35 65 30 61 36 32 31 2d 31 31 34 34 2d 34 38 35 64 2d 39 30 31 62 2d 30 39 62 62 36 33 38 64 32 39 33 36 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"fd7361a4-cccf-40b9-bc11-66a258522530","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"b691d262-7367-4a5e-bfae-14a4def391f1","ss":"15e0a621-1144-485d-901b-09bb638d2936","bg":true,"s
2024-02-08 18:35:51 UTC	523	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:35:51 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
319	192.168.2.5	50099	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:51 UTC	716	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 945 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:35:51 UTC	945	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 64 37 33 36 31 61 34 2d 63 63 63 66 2d 34 30 62 39 2d 62 63 31 31 2d 36 36 61 32 35 38 35 32 32 35 33 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 66 66 35 31 63 32 34 39 2d 37 34 39 61 2d 34 63 32 34 2d 38 33 33 38 2d 31 63 30 32 32 61 66 33 32 65 65 31 22 2c 22 73 73 22 3a 22 31 35 65 30 61 36 32 31 2d 31 31 34 34 2d 34 38 35 64 2d 39 30 31 62 2d 30 39 62 62 36 33 38 64 32 39 33 36 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"fd7361a4-cccf-40b9-bc11-66a258522530","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"ff51c249-749a-4c24-8338-1c022af32ee1","ss":"15e0a621-1144-485d-901b-09bb638d2936","bg":true,"s
2024-02-08 18:35:51 UTC	482	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:35:51 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: clear access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
320	192.168.2.5	50100	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:51 UTC	3337	OUT	GET /js_tracking?ver=2&stype=1&ref_action=index&lang=en-us&pid=e4de82b919b800e4&aid=304142&sid=5171fc655664ddf74ab763a094523fb7&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|17142&m=UmFuZG9tSVYkc2RlIyh9YeYIAJ5VxtCclrd6vLNvnbhm5Rlp2tkcNvDW44l9Q8zjAGVNddikoYQCNQeAsKEyZkcPvHOyIwMP-6chec5tyca6gHnSciej4PlNk9aG_pavrPcuZcOfD581xXAwfRDC-TXTshg7jxEriyIJrcbee7E9cPGZsz_oO3B6EuDd9tnXRVxeP-EE5_JpnKhFuCVe5EqGK-vLL35qqhPRMB1nrI6OaQDJvdtiaQgKgg5XZs1j_BSMjSyRKB2qn4zcVmZWe9w5vB8JH8LNpXXlPH1OV_UVVYWBLysbxrOitYgptkB9XgKijnth88Xlfdm0IEeX4w HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8kqA80E7Dah055EUUCXJybztZSKxkA5aCnIJFLwuEv5PRBH%2FuOIr093hmKmylOzKy1om%2BA6S9CXSpp3YXWEQ5uMtGzdXyxL7fd6KnVt8wEbVbuHrbuxq5uAQY%2BNxC%2Fj%2BSMmkfmWa3MeC%2FkjdjYc5vu2uXFBZYHleA%3D; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3JoFJ/d3+jTRbAw8j2g3DznWiIRblwWjQRtj/04PDlBt/o55ocKzBIQxZ/e0Rt7iMiaISeSKOQt; lastSeen=1707417350227
2024-02-08 18:35:51 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:51 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=f0f182c3a60202de&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejIRH_DavBgRQplIMOt9dHaQexbhQtoafEg x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 8415794d557292780ff382a8c5bd6058.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: TazaGG8n0dMg7bozDQj62pQj8BtCUoiwUD9tHZiY0da__K7l6JoWog==
2024-02-08 18:35:51 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
321	192.168.2.5	50101	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:51 UTC	668	OUT	GET /psb/capla/static/css/client.38ffee15.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "c9009dc966b4c139ffffe886598ac0c0" If-Modified-Since: Thu, 08 Feb 2024 12:34:07 GMT
2024-02-08 18:35:51 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:51 GMT ETag: "c9009dc966b4c139ffffe886598ac0c0" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: eIF2AzqToVz8ZJUSLOnoWnohwEtsxZAT Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 a53ebc5c4d12bc9682b9c11ea18dccbe.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 62EvVhAET5bBWUULfUMuvcN6B7ndGNgSoQrbvSKNyxqBcet3IqeLkw== Age: 20745 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
322	192.168.2.5	50103	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:51 UTC	676	OUT	GET /psb/capla/static/css/7bcb015e.5b709f3d.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "8b761ecf11f6b807d0d765ee8cd5851e" If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
2024-02-08 18:35:51 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:51 GMT ETag: "8b761ecf11f6b807d0d765ee8cd5851e" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: .wxzOg8QkFu.xibWr3CgHbjp4QG_aTPI Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 8415794d557292780ff382a8c5bd6058.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 4HS60j8vk8650AL3OpFs6ZcaKxqSLTcTPWyiXPk_qfqGSNKFMmoBtA== Age: 19156 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
323	192.168.2.5	50102	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:51 UTC	676	OUT	GET /psb/capla/static/css/eb60141d.cad86b29.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "2980ea90c3f4c27d77bffbd1527870a7" If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
2024-02-08 18:35:51 UTC	514	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:51 GMT ETag: "2980ea90c3f4c27d77bffbd1527870a7" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: sAJOuwpsDtZfgppaREh03xaE5gNkW8K5 Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 e6c353101750d150139bda8d95719802.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: NKYQNwrYRc-dAVQ1qrqKU6vQsu3BuU8Ydb1mNW7FIh8iXZKMxJJ7sQ== Age: 8912 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
324	192.168.2.5	50104	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:51 UTC	676	OUT	GET /psb/capla/static/css/c6a78acb.bffda4a9.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "6f3e8bb7938a05e927b3ca4454f98fa8" If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
2024-02-08 18:35:51 UTC	492	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:51 GMT ETag: "6f3e8bb7938a05e927b3ca4454f98fa8" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: b5qwU9Uw68HNRDgalzg4bB9gCMOFsuHv Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 6f067a3fd6e721a7db2a2901701a65d8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: P8pMAg2AJVUY_OTkqglfySWslOX0ck2NKbWV7XvbEHNFtGrA8dKjqQ== Age: 24716 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
325	192.168.2.5	50107	18.238.55.22	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:51 UTC	687	OUT	GET /xdata/images/xphoto/720x217/308526620.jpeg?k=0663a1420ea98a013af0eda32bb4d11258521a39c5b8a5a4e2777ee5661dee55&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:51 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Tue, 06 Feb 2024 13:36:48 GMT ETag: "cf49f2767391bbeca534ff6153c75f4f4a46d9e6" Content-Language: 25671 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 8df8d5dfeb782c83ceeb5679f78a9e4e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P4 X-Amz-Cf-Id: lCo8xEcsMXX12i8Bn2gCLemDtIS_wZyid_iJxhZrm4YE2a5SC9GDCw== Age: 190743
2024-02-08 18:35:51 UTC	16384	IN	Data Raw: 36 34 34 37 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d9 02 d0 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 6447JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:35:51 UTC	9295	IN	Data Raw: a4 33 4d 0f d9 c1 31 4a c9 b9 89 cb 00 78 3f 96 2a e3 aa 25 26 f4 38 f9 23 2c 37 30 18 a8 f0 dd 8e 30 38 15 db 0b 1b 61 c7 d9 e3 fc a9 93 69 96 f3 c4 62 58 d1 18 f0 ac 38 20 d5 72 b4 3e 46 73 4a b2 20 50 93 fc a1 40 19 cf 24 55 09 d4 dd ce 89 23 b2 39 5c 8c 8e 08 ed 51 5d 5e df 43 13 b4 30 6c 58 58 30 c9 f4 fd 6b 5a d1 85 cf d9 e7 65 12 cd 32 ee 51 90 14 26 e1 9e 4f a7 b7 ad 79 8d d4 4b 5d 4d 19 0c 31 5b a4 51 47 77 71 89 10 f0 14 75 1d b3 df 9a b7 24 c6 38 8b 20 62 0e 0f 1d 4f d2 91 a5 b3 b4 bb 91 8a 46 d3 37 07 7b 06 2a a3 b8 a4 93 57 8e de d7 c9 46 8f 2d 83 e6 11 96 00 f1 df da b2 49 de e8 b5 4e 0d 6b 22 34 f3 2e e1 13 ca ca b9 6e 99 c6 31 4f 12 6d 8c b7 9c fb 4b 91 f3 75 3c 62 b3 d6 f6 dc 73 04 c2 6d ca 14 26 e2 31 83 c9 20 e0 77 06 b4 34 e4 8a e6 67 Data Ascii: 3M1Jx?%&8#,7008aibX8 r>FsJ P@$U#9\Q]^C0lXX0kZe2Q&OyK]M1[QGwqu$8 bOF7{WF-INk"4.n1OmKu<bsm&1 w4g
2024-02-08 18:35:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
326	192.168.2.5	50105	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:51 UTC	676	OUT	GET /psb/capla/static/css/f50a2dfc.837540b6.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "fdb620d16ddcb3d874c0d96880365b4d" If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
2024-02-08 18:35:51 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:51 GMT ETag: "fdb620d16ddcb3d874c0d96880365b4d" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: gKQ3dko_aeSe7flBYen.8nJ6TCgcueOK Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 31113f2f23c4ce8a8af1d88a37137806.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: WWKLVdJ4zDRzsW_jJ1S2MUlS69MK4hujfwmcjMyiawpCrpapg4hDnQ== Age: 24716 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
327	192.168.2.5	50106	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:51 UTC	676	OUT	GET /psb/capla/static/css/a6a21c13.8939445f.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "e262f92e286a4c74280bd4b3fdee8cbb" If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
2024-02-08 18:35:51 UTC	492	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:51 GMT ETag: "e262f92e286a4c74280bd4b3fdee8cbb" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 7G8nAXI18cFrDtj.jVsLGUJVDX12qJHu Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 61bbe72b71f7b857c695c31fdeb7b3a6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: RUUgiJKxcJy0msyUkyDcwX17mVpCc-gEfQBRA4vaIB0Y3Ii5JT2XcA== Age: 24716 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
328	192.168.2.5	50108	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:51 UTC	2416	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A40+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=https%3A%2F%2Fwww.booking.com%2F&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1; lastSeen=0; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKtCN8f0CTZfWNos6UY8OZ4ZuKqD7lOHNNN1nWShMMvvR%2BobBXSAxNSowlARb03UMjJi%2B9e9o94k%2BAvkmXyC%2BIJoIL0JdOJORHZxwfgtAbVy0svgfd5pConBZiQA0wtFzUROKKVqaayr1QfO3cPU7TPDYv2kakPqjo%3D; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=7nmvNrkhrOXpxPBAhzawOYlRiYBQS4%2FSXw2GknYBd7%2B3vM%2Bh%2B%2BbCe%2FszAjCUINJziwjc5TPTKaib2HHN4664pa5lV9KmVlzs4AeOHYvWCFN8c4FlGnLJt2E%2BToUtWQ%3D%3D
2024-02-08 18:35:51 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:51 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=5f4c82c3a57f00ac&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGURt3UxnhB_zO0diVhZcLQuIQUapjsoeQw x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 76f3fedc86826a7b266250e33ee41082.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 9rdZWcbSDnu05juodZQCp9vbk9DDhOxYnYKzIR_o4R3Gx6LICQY-5A==
2024-02-08 18:35:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
329	192.168.2.5	50111	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:51 UTC	676	OUT	GET /psb/capla/static/css/f5d0e2e7.a54d85eb.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "88d8b9631fe60984baabd22260a86e6e" If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
2024-02-08 18:35:52 UTC	514	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:51 GMT ETag: "88d8b9631fe60984baabd22260a86e6e" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 45SgOdslZ5ni1p_3JE_2CMeJEvzIw3pO Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6f067a3fd6e721a7db2a2901701a65d8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: i0V7EkZi8G-juyKDw6-wRf8MQJK7sVQSS4djIcjXtYZns4XmA8KTTw== Age: 8912 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
330	192.168.2.5	50109	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:51 UTC	676	OUT	GET /psb/capla/static/css/d2a738da.079c3b4c.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "1a7c523a95596c5b0b122ad8d8e3b553" If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
2024-02-08 18:35:52 UTC	514	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:51 GMT ETag: "1a7c523a95596c5b0b122ad8d8e3b553" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: y6hnIHqnWmWPq9JqZ4Ue_o6YIF6Bl_1N Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 e6c353101750d150139bda8d95719802.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Ab27q_aVf-GrPuZ85T7oz0rYbZnj-qaID0aewaa7c98p788BJzkHLQ== Age: 8912 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
331	192.168.2.5	50112	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:51 UTC	676	OUT	GET /psb/capla/static/css/4e596c2c.3a2fb681.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "51be0c43cc481b13fe70d3ba27e2ffd9" If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
2024-02-08 18:35:52 UTC	514	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:52 GMT ETag: "51be0c43cc481b13fe70d3ba27e2ffd9" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: SFV4Wl1bGgrYBAvh1g48Ac217jtyPkYJ Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 e268ddb03ed9480c5c602c27323a81ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Cc3ivPLhwrC0sbcOLV5idzVHtmJ4FbXART9PjNDv06hVVKSMyWJTPg== Age: 8912 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
332	192.168.2.5	50110	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:51 UTC	676	OUT	GET /psb/capla/static/css/53a8d0d3.b1818b84.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "f820477c322829e348f318a453e432a5" If-Modified-Since: Thu, 08 Feb 2024 11:37:52 GMT
2024-02-08 18:35:52 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:52 GMT ETag: "f820477c322829e348f318a453e432a5" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: BiPU5vSMYzP0dcXjFNJqaYKjd8Wn7Ys7 Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 fcb94596db202c75ac0e559b3183be72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: zfWAjzsMsZoScNQ50hSNHB4gxkGS_WZNnhF0GTzuqAULql2VBSQswA== Age: 24717 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
333	192.168.2.5	50113	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:51 UTC	694	OUT	GET /psb/capla/static/js/remoteEntry.4935f89c.client.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "a687e666ee59c8527c21313adba1bf8f" If-Modified-Since: Sun, 04 Feb 2024 06:12:25 GMT
2024-02-08 18:35:52 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:52 GMT ETag: "a687e666ee59c8527c21313adba1bf8f" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: vN7OnMe.ojdXDDTQ9pmibMWIDd5xf9ld Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 309e9e958e8d35f7e17ae8ac267b7dea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: pnix4EujdE-uuulO1uKGXWhw1dELOnlTuLv74nEnWLjjx2wuVBX-qA== Age: 36173 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
334	192.168.2.5	50114	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:51 UTC	690	OUT	GET /psb/capla/static/js/4a89d2db.6c0ec4b3.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "71d148d7e362a60e9a0c56222e4c1c42" If-Modified-Since: Wed, 07 Feb 2024 05:15:19 GMT
2024-02-08 18:35:52 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:52 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 9di50fL8JQhTrzdM_SzIninZxtneOruI Server: AmazonS3 ETag: "71d148d7e362a60e9a0c56222e4c1c42" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 a1a074529ccb9ea97acd7d95c506f336.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: YdAj7I6suRnGolrh_kTZqM1Z1DFNJIs_QRBLoaGqlpdO9hR0uf42oQ== Age: 37436 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
335	192.168.2.5	50115	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:52 UTC	690	OUT	GET /psb/capla/static/js/0a098284.df965884.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "47bb1a597dd42cabf5425fe918f725b5" If-Modified-Since: Thu, 08 Feb 2024 06:30:47 GMT
2024-02-08 18:35:52 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:52 GMT ETag: "47bb1a597dd42cabf5425fe918f725b5" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 66kT4AfYW6XFbY2uR01i.yN9iev4sCir Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 fcb94596db202c75ac0e559b3183be72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: V4G1Ug0TuUx-IvSXggptd01-zbZO70ndt7jW4d8vsK3VhcS4ypnsqw== Age: 10034 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
336	192.168.2.5	50116	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:52 UTC	690	OUT	GET /psb/capla/static/js/7bcb015e.cf9d45ea.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "762dbdde80c9b4faddafa20df78215de" If-Modified-Since: Thu, 08 Feb 2024 14:53:52 GMT
2024-02-08 18:35:52 UTC	566	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:52 GMT ETag: "762dbdde80c9b4faddafa20df78215de" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: zc90J05kqhlmzNDNZXeMr8lu3QU56RZ9 Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 309e9e958e8d35f7e17ae8ac267b7dea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: IxMjG-4nAdlPRITyhcj7Tj-sLl09L5C5aMHcMdgz6-tS_I4mlo0Ysw== Age: 8904 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
337	192.168.2.5	50117	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:52 UTC	690	OUT	GET /psb/capla/static/js/eb60141d.05ae682b.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "8bd695624a0284c0c75e95e6cf849e19" If-Modified-Since: Mon, 05 Feb 2024 10:15:49 GMT
2024-02-08 18:35:52 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:52 GMT ETag: "8bd695624a0284c0c75e95e6cf849e19" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: GxdC2HoWy3SKzPu2JnW5Pb.Aec0Emv2p Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 14e4300e15854895259e6944bb121ec8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: uv3VdCHDxV07LwQgoOFJ1BEHhyjaut_k5E4fGYvZK20sjAMqexQVQQ== Age: 74656 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
338	192.168.2.5	50118	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:52 UTC	690	OUT	GET /psb/capla/static/js/f50a2dfc.854e46ce.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "16cef59d8ed8d631e974161b3405d558" If-Modified-Since: Thu, 08 Feb 2024 10:31:47 GMT
2024-02-08 18:35:52 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:52 GMT ETag: "16cef59d8ed8d631e974161b3405d558" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: cG2AdJvzFJaivaHGwS_vd7j4ON5X64Sy Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 d125bf8405e840aa51a88ae3d8d91fb2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: uJDbAVk56m6R7ba61JrXMA0QTF1TUgYsjorxDgfCjjD_JLcu2cum2A== Age: 25491 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
339	192.168.2.5	50119	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:52 UTC	686	OUT	GET /xdata/images/xphoto/500x500/184698944.png?k=6bb1bf3c13db4a7ba3c22a2d1f1051f793c525a78104703b4dec3eb12101f545&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:52 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/png Transfer-Encoding: chunked Connection: close Server: nginx Date: Sun, 21 Jan 2024 13:30:27 GMT Content-Language: 39328 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "faf4c565c493f3bc0e80e65cd746519a6611b1b3" X-Cache: Hit from cloudfront Via: 1.1 349ae0102af9efb84ba18944b2446234.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: wikU6mJ9aeVSUGEZcFtOB-uMOKVGWa2qAbdPDXs5pHJaF1i2R3Ei9g== Age: 1573525
2024-02-08 18:35:52 UTC	16384	IN	Data Raw: 39 35 64 61 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 f4 00 00 01 f4 08 06 00 00 00 cb d6 df 8a 00 00 80 00 49 44 41 54 78 da ec 9d 07 58 dc 56 d6 86 67 06 b7 74 a7 6c 36 75 93 4d db dd 6c fa 66 d3 7b f2 a7 6e b2 e9 71 b2 29 4e dc d2 9d 38 76 e2 6e dc 7b ef 06 83 31 cd 14 63 63 9b 6a 30 a6 83 01 37 dc 01 e3 de 0d 98 36 7d ce 7f cf 95 04 33 cc 80 c1 bd 7c ef f3 9c 47 1a e9 ea 4a 33 d2 e8 3b e7 dc ab 2b 9d 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 95daPNGIHDRIDATxXVgtl6uMlf{nq)N8vn{1ccj076}3\|GJ3;+
2024-02-08 18:35:52 UTC	16384	IN	Data Raw: db 74 3d 9d c7 84 9c d2 3a e1 d6 44 9b 7f 6b ee 3c 99 b1 c3 46 89 db 6c b4 6e bf 5d 9e 53 7e e6 9b cf e3 84 e0 1c 8f 82 1e 95 7b 88 0a f6 28 cf 88 2f da 68 a5 80 6c cf 11 7a ef e9 69 54 b8 df 21 05 86 f7 c5 c2 f1 e8 7b 63 dd ca 3d ff d5 2c 8a dd 62 a3 c8 42 2b 0d 8e ad a0 99 19 35 f4 c5 a0 a5 1e 05 3d b4 a0 96 7a 44 1c a1 48 f9 6a 5e 1b 4d 8d de e2 51 d0 c7 2f 2e a2 04 f1 9d 58 a0 37 89 7d af 2a 35 d2 9f 3c 9c e7 6e 83 17 c9 63 8b 17 65 f9 bb 24 6e b3 d3 b3 5f cc 74 2b f7 cf 37 86 d3 92 4d 36 da 7e 94 5f 8d 6a 97 6d f9 3d a7 67 ba 95 e3 6b 34 32 bf 5c be 89 90 85 71 9d f8 fe cb 8b ec 14 2f 8e b5 e4 a8 43 9e d7 62 31 e5 75 7c 6c 9b e5 ef e2 90 1d 57 b7 1e b2 d3 5d 2f 0e 70 cf 60 fc 32 4f 9e 1b 76 3a f8 85 49 7c 7e b8 c3 a3 5b 06 e3 a9 3e 72 78 65 5e cf c3 Data Ascii: t=:Dk<Fln]S~{(/hlziT!{c=,bB+5=zDHj^MQ/.X7}*5<nce$n_t+7M6~_jm=gk42\q/Cb1u\|lW]/p`2Ov:I\|~[>rxe^
2024-02-08 18:35:52 UTC	5602	IN	Data Raw: f5 53 ab 62 59 3f 35 b5 ea c3 5d 36 5e a9 5f f4 ff 50 29 d6 aa 33 68 63 ed 97 53 77 df f5 f0 80 8d 2f 3c 3b 6a 47 ab 06 71 bb 3a d7 8e d9 de 57 9d 37 44 00 00 19 5b 49 44 41 54 eb a5 a4 7d 09 b5 07 6e fc fc ae 9e f9 0b 1a 8e d8 be e3 de 5e f9 9b 54 a4 07 1e e8 53 78 b4 5e cc c6 a3 0d 86 6f f5 3f 16 bb 39 00 11 43 b8 f5 06 d9 28 19 72 85 70 3d c9 de db 13 51 72 a1 39 06 a1 42 fe 90 b2 de 47 fe a3 e7 40 de 88 c2 21 75 ec 47 1f 02 d3 b1 4c 65 fe 90 6e df df d7 8a 1b d7 35 4a d8 a9 b2 ce 95 ba 7a 2e ae c5 b4 98 77 f5 c0 13 9d f2 4c d4 8e eb 71 1e ae f7 a2 f0 3b ba e5 05 a3 f2 db 9c e8 bd de dd e1 52 af 19 9d 73 4c 2f ef 9a 9d 73 8d e0 6f eb 50 20 35 db 17 9a e8 1d 13 7a 20 ca 3d 1b 33 76 9d ea 83 2d 50 ae 7f 7f b1 fc ba d1 54 b9 ea b1 54 95 6d 42 50 bc 97 3d Data Ascii: SbY?5]6^_P)3hcSw/<;jGq:W7D[IDAT}n^TSx^o?9C(rp=Qr9BG@!uGLen5Jz.wLq;RsL/soP 5z =3v-PTTmBP=
2024-02-08 18:35:52 UTC	973	IN	Data Raw: 33 63 36 0d 0a 8f 71 6d e4 99 5e e7 b9 48 5f 79 46 64 be 3f 35 72 bc 64 56 69 a7 95 82 ba 87 53 23 ae d1 d7 39 9f ff 30 42 08 21 e4 14 90 d4 88 aa 2a f4 8b 24 ab fa 3f 65 7a 44 0b 99 1a d1 51 b7 33 55 d4 8b 02 99 11 eb 55 d2 45 2a e5 52 99 12 11 50 d1 06 54 de e5 ba 5e ae e7 60 09 e1 9b 6d 95 b5 5d 4e 30 c7 02 2a 67 7f 79 ba 0a 7b 5c 44 b1 0a 7e 83 ee ff 5c c6 54 49 0c 4c 88 e8 19 98 50 e5 35 c9 8c b8 5b cf bb 96 d1 37 21 84 10 f2 5d 49 3f 2e e2 02 19 1b 71 bd ca fc 56 ff b8 88 07 55 f0 0d fc 63 ab 3e 25 93 23 9e f6 8f ac fa 04 96 a5 c9 ba 4f f7 cb b8 aa 0f aa ac 6f 29 c9 8a f8 b3 56 0e ae 46 85 81 7f 41 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 Data Ascii: 3c6qm^H_yFd?5rdViS#90B!$?ezDQ3UUERPT^`m]N0*gy{\D~\TILP5[7!]I?.qVUc>%#Oo)VFAB!B!B!B!B!B!B!B!B!B!B
2024-02-08 18:35:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
340	192.168.2.5	50120	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:52 UTC	690	OUT	GET /psb/capla/static/js/a6a21c13.ad9f14d9.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "16323cfbc6f714b70bb4777cc3449e90" If-Modified-Since: Thu, 08 Feb 2024 11:37:54 GMT
2024-02-08 18:35:52 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:52 GMT ETag: "16323cfbc6f714b70bb4777cc3449e90" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: kqN2G1a.LgAUJYnNTKfAE6M57bfozxMp Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 f4c38e024a95b76a27c9f3dc9ff2eda6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: UF6_E4IYirlQuz5k-O59VuO3qHeq0QVg1QilP1U1OglkURLwsQwWdQ== Age: 19156 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
341	192.168.2.5	50121	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:52 UTC	690	OUT	GET /psb/capla/static/js/f5d0e2e7.5cd38fd6.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "2a4be84facf3e21bb4a9ebb12a10a92e" If-Modified-Since: Wed, 07 Feb 2024 09:32:56 GMT
2024-02-08 18:35:52 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:52 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 6HKmc0VuwQiz3hwVRPEGNwP114NmNjqR Server: AmazonS3 ETag: "2a4be84facf3e21bb4a9ebb12a10a92e" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 9546eb427ef2137803aed00cad4fc426.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 8Esu_zHShUOTbSPJ1QiK_4YrzoG7tRa47nqFIumU9e9utrMFqpYAJg== Age: 24742 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
342	192.168.2.5	50122	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:54 UTC	3119	OUT	GET /logo?ver=1&sid=5171fc655664ddf74ab763a094523fb7&t=17074173491 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8kqA80E7Dah055EUUCXJybztZSKxkA5aCnIJFLwuEv5PRBH%2FuOIr093hmKmylOzKy1om%2BA6S9CXSpp3YXWEQ5uMtGzdXyxL7fd6KnVt8wEbVbuHrbuxq5uAQY%2BNxC%2Fj%2BSMmkfmWa3MeC%2FkjdjYc5vu2uXFBZYHleA%3D; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3JoFJ/d3+jTRbAw8j2g3DznWiIRblwWjQRtj/04PDlBt/o55ocKzBIQxZ/e0Rt7iMiaISeSKOQt; lastSeen=1707417350227; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A51+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false
2024-02-08 18:35:54 UTC	780	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:54 GMT vary: User-Agent, Accept-Encoding set-cookie: BJS=-; domain=booking.com; expires=Fri, 09-Feb-2024 18:35:54 GMT; Secure; HTTPOnly strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=bf7c82c598060193&e=UmFuZG9tSVYkc2RlIyh9YbpBYTW1tHKzcCCoZ6RGgMZVQbriEy5vmtkj8Tb71lwd x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7eeed291abf48890d3f36565208941a8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: J8eTfUvMGLlRBByVkjKgx8Xa7r-zsZGlv5xJPFiYtTq0hTVj29pSwg==
2024-02-08 18:35:54 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
343	192.168.2.5	50123	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:54 UTC	690	OUT	GET /psb/capla/static/js/d2a738da.35cba7bb.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "1aa264da71f354aad6dce94f5a3374d9" If-Modified-Since: Tue, 06 Feb 2024 10:33:56 GMT
2024-02-08 18:35:54 UTC	613	IN	HTTP/1.1 304 Not Modified Connection: close Last-Modified: Tue, 06 Feb 2024 10:33:56 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: psEU8QZUmatvf68kU4tSuAW8A3BMuh.z Server: AmazonS3 Date: Thu, 08 Feb 2024 12:32:55 GMT ETag: "1aa264da71f354aad6dce94f5a3374d9" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 d125bf8405e840aa51a88ae3d8d91fb2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: na-4nBncYp6zNtBiW5mV9UWuhOmoKl6IB51g5x50ghGwVMMANVfXrg== Age: 21780 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
344	192.168.2.5	50125	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:54 UTC	690	OUT	GET /psb/capla/static/js/4e596c2c.d3513b52.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "cbed6c40f80b88278fe92b7987f24d10" If-Modified-Since: Thu, 08 Feb 2024 14:16:47 GMT
2024-02-08 18:35:54 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:54 GMT ETag: "cbed6c40f80b88278fe92b7987f24d10" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: N9Nsx4DgMqmKhaYxp1E50bp1h3vfmgas Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 31341771a4bfa40d7b1f61883ffb56c6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: KFD6Dx7GKohWmstoJXyVQgfwbUg3u9sZ4DiBXzZtFKcgu6gP3ugFnA== Age: 13728 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
345	192.168.2.5	50124	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:54 UTC	690	OUT	GET /psb/capla/static/js/21928fd5.cc39b346.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "32f6cb6519036a5cb6d7245e1f3f4a10" If-Modified-Since: Mon, 05 Feb 2024 10:15:48 GMT
2024-02-08 18:35:54 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:54 GMT ETag: "32f6cb6519036a5cb6d7245e1f3f4a10" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 7a98ctKrCWxMZvJTJoQpOhig1fq1QPGC Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 f588325f7617672d954c4267c8bee1ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: PxnG0OaZSFga66pt55DkZ6ghfhPIBfycXNROeZ78Fawzu9tE-nIIbg== Age: 85727 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
346	192.168.2.5	50126	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:54 UTC	690	OUT	GET /psb/capla/static/js/3d066b0d.6a5d1f73.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "b9431959d1fba61458d500bc4cba3939" If-Modified-Since: Tue, 06 Feb 2024 05:16:14 GMT
2024-02-08 18:35:54 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:54 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: dEnmDEtw.I4qhNxITUcP6I6qsZhacRX8 Server: AmazonS3 ETag: "b9431959d1fba61458d500bc4cba3939" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 a01680a1fee7e35f1738191420d98822.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 7EkeH94kv-UsoXcJFJkIkeXQoQ5550-N5AwqlWePzqCdvEicV7av1A== Age: 25492 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
347	192.168.2.5	50127	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:54 UTC	4212	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1052 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6 X-Booking-AID: 304142 X-Booking-Pageview-Id: 2c8482c2544201f4 X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,1912460\|1,1856870\|1,1912460\|7,1908890\|1,1912460\|6,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7 sec-ch-ua-platform: "Windows" X-Booking-Language-Code: en-us X-Booking-CSRF: RVfFZQAAAAA=qVueflVyIcgKOJdfCMKcmiDGjvY9UqM_W79drieypCCd1wLxtNOjZPcMNKEslcD0Tiyh8b7rdIv86FT89bynmubUkLo31LJ5cM248yQm3ulKZFWN-WKHCjXqy964TaJvn5A_S7b4oaNG1jhNZ7aGF2JNPgwXGQBCPiOREYDFBwUwhotUpEosEVmLfdyz_vXpYSXlaaCHZibCaVWm sec-ch-ua-mobile: ?0 X-Partner-Channel-Id: 3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAKFvpSuBsACAdICJDdhNmRhMmNiLThiNjMtNDQ1OS04MGUwLTI1OGM3NjBkNWQzMdgCBeACAQ Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Accept: application/json, text/javascript, /; q=0.01 X-Booking-SiteType-Id: 1 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8kqA80E7Dah055EUUCXJybztZSKxkA5aCnIJFLwuEv5PRBH%2FuOIr093hmKmylOzKy1om%2BA6S9CXSpp3YXWEQ5uMtGzdXyxL7fd6KnVt8wEbVbuHrbuxq5uAQY%2BNxC%2Fj%2BSMmkfmWa3MeC%2FkjdjYc5vu2uXFBZYHleA%3D; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3JoFJ/d3+jTRbAw8j2g3DznWiIRblwWjQRtj/04PDlBt/o55ocKzBIQxZ/e0Rt7iMiaISeSKOQt; lastSeen=1707417350227; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A51+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false
2024-02-08 18:35:54 UTC	1052	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 63 33 36 30 5f 74 65 73 74 2e 69 6e 64 65 78 5f 70 61 67 65 5f 6a 73 5f 68 65 61 6c 74 68 63 68 65 63 6b 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 31 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 47 6c 6f 72 79 20 74 6f 20 43 33 36 30 20 66 72 6f 6d 20 6a 73 21 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 23 69 6e 64 65 78 73 65 61 72 63 68 22 2c 22 70 61 67 65 5f 74 69 74 6c 65 22 3a 22 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 7c 20 4f 66 66 Data Ascii: {"events":[{"action_name":"c360_test.index_page_js_healthcheck","action_version":"1.1.0","content":{"message":"Glory to C360 from js!"},"context":{"page":{"page_referrer":"","page_url":"https://www.booking.com/#indexsearch","page_title":"Booking.com \| Off
2024-02-08 18:35:55 UTC	1171	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 61 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:55 GMT vary: User-Agent, Accept-Encoding access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPefz11GFz2XDsuxniWysDhYDakkGwaWp4sTAC4tqHnZ0k3PWpIdXDVooPaztJkJl31v3F8fHw9lMHBdd8c1REz5cDYfcMeR0%2FAqDBnUQFnqTjIrUPxmDWl2d9rLaM5SH6Q0wauuC31ecfmXBHEfMHkwnjEl7hHRC7c4%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:55 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=c94a82c59e50021b&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqstIHnEhcjk6dXMQDrsBmxRVAsS-hgxOX1c x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7eeed291abf48890d3f36565208941a8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: vx4ExWttuNZfKuABSMv7A92IokoA5MTlQUxpd9Y9SczNfesszqgEMg==
2024-02-08 18:35:55 UTC	61	IN	Data Raw: 5b 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d 2c 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d 5d Data Ascii: [{"status":1,"content":"Sent"},{"status":1,"content":"Sent"}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
348	192.168.2.5	50128	3.161.193.117	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:54 UTC	2119	OUT	GET /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8kqA80E7Dah055EUUCXJybztZSKxkA5aCnIJFLwuEv5PRBH%2FuOIr093hmKmylOzKy1om%2BA6S9CXSpp3YXWEQ5uMtGzdXyxL7fd6KnVt8wEbVbuHrbuxq5uAQY%2BNxC%2Fj%2BSMmkfmWa3MeC%2FkjdjYc5vu2uXFBZYHleA%3D; lastSeen=1707417350227
2024-02-08 18:35:55 UTC	513	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html;charset=iso-8859-1 Content-Length: 411 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:55 GMT cache-control: must-revalidate,no-cache,no-store strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 c3264e7e1770af395200cef88a978aec.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P8 X-Amz-Cf-Id: 061yaGZ_tQefUfroADIPxvlY-zlVwFjtO0zXGbQ5qeKlBd7iXx1Tlg==
2024-02-08 18:35:55 UTC	411	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 2f 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 32 3e 48 54 54 50 20 45 52 52 4f 52 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 32 3e 0a 3c 74 61 62 6c 65 3e 0a 3c 74 72 3e 3c 74 68 3e 55 52 49 3a 3c 2f 74 68 3e 3c 74 64 3e 2f 77 65 62 2d 76 69 74 61 6c 73 2f 73 65 6e 64 2d 76 69 74 61 6c 73 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/><title>Error 405 Method Not Allowed</title></head><body><h2>HTTP ERROR 405 Method Not Allowed</h2><table><tr><th>URI:</th><td>/web-vitals/send-vitals</td></tr><tr>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
349	192.168.2.5	50132	104.18.32.137	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:55 UTC	380	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:55 UTC	249	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:35:55 GMT Content-Type: text/javascript Content-Length: 79 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8525f9a6c9a76762-ATL
2024-02-08 18:35:55 UTC	79	IN	Data Raw: 6a 73 6f 6e 46 65 65 64 28 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 47 41 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 47 65 6f 72 67 69 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d 29 3b Data Ascii: jsonFeed({"country":"US","state":"GA","stateName":"Georgia","continent":"NA"});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
350	192.168.2.5	50131	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:55 UTC	660	OUT	GET /psb/capla/static/js/0a098284.df965884.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "47bb1a597dd42cabf5425fe918f725b5" If-Modified-Since: Thu, 08 Feb 2024 06:30:47 GMT
2024-02-08 18:35:55 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:55 GMT ETag: "47bb1a597dd42cabf5425fe918f725b5" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 66kT4AfYW6XFbY2uR01i.yN9iev4sCir Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 34411558fb3a23efdbbaaddb8a12b574.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 04zxoth3MwD7m_GdiGzadVBcLqEXvQ4sItacvIhJXtkXGd3UdiXa8w== Age: 10037 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
351	192.168.2.5	50129	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:55 UTC	4678	OUT	GET /js_tracking?aid=304142&pid=2c8482c2544201f4&ver=2&sid=5171fc655664ddf74ab763a094523fb7&ref_action=index&lang=en-us&stype=1&ete=&etg=&etcg=cCHObKdPHMfFdHMEKdbfZRLRMLFSZaTaTaET\|1&ets=cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YYo1mfebd19Q2WIimWOyIN1gUe4_-JQdNOBTMuHuYCJPue7ik10LWViyRYmmf149m9vSAg2JJTyfAEk9RiEQZejXjro5rDJvxnq57UaGsDKd0iBXLkMuV2sFYEHSFmXZW5zvkIdbv7-B87Oi9zo36Fnq7AU8K4Y8Y-SdtsN1A2dfLiciDUxBuNe45QSxoxZcHhPcdr6v26QamVEbge_7LQ_MDhbvlSKq9Lwf9P11FwHzxPymBNBmu_dZFb8tK9Z3wY0RAyYm7D0hfdu-LCtv4j3isKKp1L_CiYhwCnyC42X_OqimTrSjKXCbKfd3YnkJbQ HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6 X-Booking-CSRF: RVfFZQAAAAA=qVueflVyIcgKOJdfCMKcmiDGjvY9UqM_W79drieypCCd1wLxtNOjZPcMNKEslcD0Tiyh8b7rdIv86FT89bynmubUkLo31LJ5cM248yQm3ulKZFWN-WKHCjXqy964TaJvn5A_S7b4oaNG1jhNZ7aGF2JNPgwXGQBCPiOREYDFBwUwhotUpEosEVmLfdyz_vXpYSXlaaCHZibCaVWm sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAKFvpSuBsACAdICJDdhNmRhMmNiLThiNjMtNDQ1OS04MGUwLTI1OGM3NjBkNWQzMdgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: 2c8482c2544201f4 X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,1912460\|1,1856870\|1,1912460\|7,1908890\|1,1912460\|6,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _ga=GA1.1.421694156.1707417338; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT8kqA80E7Dah055EUUCXJybztZSKxkA5aCnIJFLwuEv5PRBH%2FuOIr093hmKmylOzKy1om%2BA6S9CXSpp3YXWEQ5uMtGzdXyxL7fd6KnVt8wEbVbuHrbuxq5uAQY%2BNxC%2Fj%2BSMmkfmWa3MeC%2FkjdjYc5vu2uXFBZYHleA%3D; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3JoFJ/d3+jTRbAw8j2g3DznWiIRblwWjQRtj/04PDlBt/o55ocKzBIQxZ/e0Rt7iMiaISeSKOQt; lastSeen=1707417350227; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A51+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false
2024-02-08 18:35:55 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:55 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=bffc82c58a0c0323&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejLL3_rwFu1q69HCRIQM9xvtlrb2zZnhZ3k x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 4a9f56098c7d51e12b8d2ac77b6f1bcc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 1qwoEsXmWeQlq1fuRc_80RPXWrNRiJkFiIYZOBzPOm0rs6KiXNlLOQ==
2024-02-08 18:35:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
352	192.168.2.5	50130	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:55 UTC	791	OUT	GET /recaptcha/api2/reload?k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AJmcDEmmSVjhXu6iSND5nUlaG4u8jg9r3gIsM8fricsYrppd_RXehS30W8rvMgVb0KtN3BzkTFd51AiDyh7KnUA; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:55 UTC	518	IN	HTTP/1.1 405 HTTP method GET is not supported by this URL Content-Type: text/html; charset=UTF-8 Date: Thu, 08 Feb 2024 18:35:55 GMT Expires: Thu, 08 Feb 2024 18:35:55 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:55 UTC	217	IN	Data Raw: 64 33 0d 0a 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 48 54 54 50 20 6d 65 74 68 6f 64 20 47 45 54 20 69 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 20 62 79 20 74 68 69 73 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 48 31 3e 48 54 54 50 20 6d 65 74 68 6f 64 20 47 45 54 20 69 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 20 62 79 20 74 68 69 73 20 55 52 4c 3c 2f 48 31 3e 0a 3c 48 32 3e 45 72 72 6f 72 20 34 30 35 3c 2f 48 32 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 0d 0a Data Ascii: d3<HTML><HEAD><TITLE>HTTP method GET is not supported by this URL</TITLE></HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000"><H1>HTTP method GET is not supported by this URL</H1><H2>Error 405</H2></BODY></HTML>
2024-02-08 18:35:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
353	192.168.2.5	50134	3.161.193.117	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:55 UTC	650	OUT	POST /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive Content-Length: 85 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-API-Version: 1 Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:55 UTC	85	OUT	Data Raw: 7b 22 70 69 64 22 3a 22 32 63 38 34 38 32 63 32 35 34 34 32 30 31 66 34 22 2c 22 72 65 66 41 63 74 69 6f 6e 22 3a 22 69 6e 64 65 78 22 2c 22 73 69 74 65 54 79 70 65 22 3a 22 31 22 2c 22 63 6c 73 22 3a 31 2e 37 30 38 37 31 34 37 39 39 36 30 34 31 37 34 7d Data Ascii: {"pid":"2c8482c2544201f4","refAction":"index","siteType":"1","cls":1.708714799604174}
2024-02-08 18:35:55 UTC	525	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:55 GMT vary: Origin, Accept-Encoding access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 a83ebc4f48951c33ec25d9d836f74fb4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P8 X-Amz-Cf-Id: WG1lHyS0HW_jvex_l_mvLN1WDpIGPTVZBAmlt4O6kFy7VxEEUEqWKg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
354	192.168.2.5	50135	3.162.125.32	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:55 UTC	613	OUT	OPTIONS /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=BXAbRIVE HTTP/1.1 Host: accommodations.booking.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-booking-et-serialized-state Origin: https://www.booking.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:55 UTC	684	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:55 GMT x-frame-options: SAMEORIGIN x-content-type-options: nosniff access-control-allow-methods: HEAD,OPTIONS,GET,POST access-control-allow-headers: x-booking-et-serialized-state vary: Origin access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 91996b055df3611b680390c98760c3d4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P3 X-Amz-Cf-Id: ybnBxptM5oiNF-aylKad-gcTiwIDSL8nP1ihWu6qGQxuJFGak68bxw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
355	192.168.2.5	50138	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:55 UTC	676	OUT	GET /psb/capla/static/css/7bcb015e.5b709f3d.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "8b761ecf11f6b807d0d765ee8cd5851e" If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
2024-02-08 18:35:55 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:55 GMT ETag: "8b761ecf11f6b807d0d765ee8cd5851e" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: .wxzOg8QkFu.xibWr3CgHbjp4QG_aTPI Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 34411558fb3a23efdbbaaddb8a12b574.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: K5Ar0aM1MYGfRhTkgNAr1Wdmzz0ewK6h-jmtXTxbsCwEIJ56Da8Iaw== Age: 19160 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
356	192.168.2.5	50136	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:55 UTC	676	OUT	GET /psb/capla/static/css/eb60141d.cad86b29.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "2980ea90c3f4c27d77bffbd1527870a7" If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
2024-02-08 18:35:55 UTC	514	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:55 GMT ETag: "2980ea90c3f4c27d77bffbd1527870a7" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: sAJOuwpsDtZfgppaREh03xaE5gNkW8K5 Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 5988b4ae4648c0fec3c60a3cca580092.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: BFZI523Azg1PhYkajpktb0jRTNQ447tta5St293LGqJ0XobcgZmiVA== Age: 8916 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
357	192.168.2.5	50137	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:55 UTC	676	OUT	GET /psb/capla/static/css/c6a78acb.bffda4a9.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "6f3e8bb7938a05e927b3ca4454f98fa8" If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
2024-02-08 18:35:55 UTC	492	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:55 GMT ETag: "6f3e8bb7938a05e927b3ca4454f98fa8" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: b5qwU9Uw68HNRDgalzg4bB9gCMOFsuHv Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 f4c38e024a95b76a27c9f3dc9ff2eda6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: hSQSXeQnl-YrXKnu8PZXj4H58W0O5HuxqUTXT4-x6wzhvLz0ok8gYA== Age: 24720 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
358	192.168.2.5	50139	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:55 UTC	676	OUT	GET /psb/capla/static/css/f50a2dfc.837540b6.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "fdb620d16ddcb3d874c0d96880365b4d" If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
2024-02-08 18:35:55 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:55 GMT ETag: "fdb620d16ddcb3d874c0d96880365b4d" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: gKQ3dko_aeSe7flBYen.8nJ6TCgcueOK Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 ea0f86c249e022d5015ce79f54e723d0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: UVOlVcP19p6PTOMPogTufauQ0l2xvmRSr9TRB134V6F9-LtgdHuuNA== Age: 24720 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
359	192.168.2.5	50140	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:55 UTC	676	OUT	GET /psb/capla/static/css/a6a21c13.8939445f.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "e262f92e286a4c74280bd4b3fdee8cbb" If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
2024-02-08 18:35:55 UTC	492	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:55 GMT ETag: "e262f92e286a4c74280bd4b3fdee8cbb" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 7G8nAXI18cFrDtj.jVsLGUJVDX12qJHu Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 309e9e958e8d35f7e17ae8ac267b7dea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: YQGXoaIdejaYrERzryvVI2_wRxR-02G8Krjtfcgv8S-1kYbhB_MY8w== Age: 24720 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
360	192.168.2.5	50141	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:55 UTC	676	OUT	GET /psb/capla/static/css/f5d0e2e7.a54d85eb.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "88d8b9631fe60984baabd22260a86e6e" If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
2024-02-08 18:35:55 UTC	514	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:55 GMT ETag: "88d8b9631fe60984baabd22260a86e6e" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 45SgOdslZ5ni1p_3JE_2CMeJEvzIw3pO Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 a1a074529ccb9ea97acd7d95c506f336.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Lh0nTLL0obhHVPgjDIW6LY86S0fwP_zhyJN3LSj_lRBTXUTxOCCR3Q== Age: 8916 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
361	192.168.2.5	50142	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:55 UTC	452	OUT	GET /xdata/images/xphoto/720x217/308526620.jpeg?k=0663a1420ea98a013af0eda32bb4d11258521a39c5b8a5a4e2777ee5661dee55&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:55 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Tue, 06 Feb 2024 13:36:48 GMT ETag: "cf49f2767391bbeca534ff6153c75f4f4a46d9e6" Content-Language: 25671 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 309e9e958e8d35f7e17ae8ac267b7dea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: YKJfIl754ADC5NSic7wKTrcMLFutsQiGDNqp_7m5tBfc1fA_3E18Kw== Age: 190747
2024-02-08 18:35:55 UTC	16384	IN	Data Raw: 36 34 34 37 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d9 02 d0 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 6447JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:35:55 UTC	9295	IN	Data Raw: a4 33 4d 0f d9 c1 31 4a c9 b9 89 cb 00 78 3f 96 2a e3 aa 25 26 f4 38 f9 23 2c 37 30 18 a8 f0 dd 8e 30 38 15 db 0b 1b 61 c7 d9 e3 fc a9 93 69 96 f3 c4 62 58 d1 18 f0 ac 38 20 d5 72 b4 3e 46 73 4a b2 20 50 93 fc a1 40 19 cf 24 55 09 d4 dd ce 89 23 b2 39 5c 8c 8e 08 ed 51 5d 5e df 43 13 b4 30 6c 58 58 30 c9 f4 fd 6b 5a d1 85 cf d9 e7 65 12 cd 32 ee 51 90 14 26 e1 9e 4f a7 b7 ad 79 8d d4 4b 5d 4d 19 0c 31 5b a4 51 47 77 71 89 10 f0 14 75 1d b3 df 9a b7 24 c6 38 8b 20 62 0e 0f 1d 4f d2 91 a5 b3 b4 bb 91 8a 46 d3 37 07 7b 06 2a a3 b8 a4 93 57 8e de d7 c9 46 8f 2d 83 e6 11 96 00 f1 df da b2 49 de e8 b5 4e 0d 6b 22 34 f3 2e e1 13 ca ca b9 6e 99 c6 31 4f 12 6d 8c b7 9c fb 4b 91 f3 75 3c 62 b3 d6 f6 dc 73 04 c2 6d ca 14 26 e2 31 83 c9 20 e0 77 06 b4 34 e4 8a e6 67 Data Ascii: 3M1Jx?%&8#,7008aibX8 r>FsJ P@$U#9\Q]^C0lXX0kZe2Q&OyK]M1[QGwqu$8 bOF7{WF-INk"4.n1OmKu<bsm&1 w4g
2024-02-08 18:35:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
362	192.168.2.5	50143	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:55 UTC	4663	OUT	GET /js_tracking?aid=304142&pid=2c8482c2544201f4&ver=2&sid=5171fc655664ddf74ab763a094523fb7&ref_action=index&lang=en-us&stype=1&ete=&etg=&etcg=&ets=cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3&etgwv=js_web_vitals_cls_per_mille\|1&m=UmFuZG9tSVYkc2RlIyh9YYo1mfebd19Q2WIimWOyIN1gUe4_-JQdNOBTMuHuYCJPue7ik10LWViyRYmmf149m9vSAg2JJTyfAEk9RiEQZejXjro5rDJvxnq57UaGsDKd0iBXLkMuV2sFYEHSFmXZW5zvkIdbv7-B87Oi9zo36Fnq7AU8K4Y8Y-SdtsN1A2dfLiciDUxBuNe45QSxoxZcHhPcdr6v26QamVEbge_7LQ_MDhbvlSKq9Lwf9P11FwHzxPymBNBmu_dZFb8tK9Z3wY0RAyYm7D0hfdu-LCtv4j3isKKp1L_CiYhwCnyC42X_OqimTrSjKXCbKfd3YnkJbQ HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3 X-Booking-CSRF: RVfFZQAAAAA=qVueflVyIcgKOJdfCMKcmiDGjvY9UqM_W79drieypCCd1wLxtNOjZPcMNKEslcD0Tiyh8b7rdIv86FT89bynmubUkLo31LJ5cM248yQm3ulKZFWN-WKHCjXqy964TaJvn5A_S7b4oaNG1jhNZ7aGF2JNPgwXGQBCPiOREYDFBwUwhotUpEosEVmLfdyz_vXpYSXlaaCHZibCaVWm sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAKFvpSuBsACAdICJDdhNmRhMmNiLThiNjMtNDQ1OS04MGUwLTI1OGM3NjBkNWQzMdgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: 2c8482c2544201f4 X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,1912460\|1,1856870\|1,1912460\|7,1908890\|1,1912460\|6,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3JoFJ/d3+jTRbAw8j2g3DznWiIRblwWjQRtj/04PDlBt/o55ocKzBIQxZ/e0Rt7iMiaISeSKOQt; lastSeen=1707417350227; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.421694156.1707417338; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPefz11GFz2XDsuxniWysDhYDakkGwaWp4sTAC4tqHnZ0k3PWpIdXDVooPaztJkJl31v3F8fHw9lMHBdd8c1REz5cDYfcMeR0%2FAqDBnUQFnqTjIrUPxmDWl2d9rLaM5SH6Q0wauuC31ecfmXBHEfMHkwnjEl7hHRC7c4%3D
2024-02-08 18:35:56 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:55 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=a60e82c591c500d2&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejIp-ou6RW7_bNw66h3ZbAx09schXMMSiVQ x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 4a9f56098c7d51e12b8d2ac77b6f1bcc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: WBy_S_LyuYXuY5OCJdN9UrHNoFcfFp15vcD_WhtrAi_a-zDemN45Yg==
2024-02-08 18:35:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
363	192.168.2.5	50144	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:55 UTC	451	OUT	GET /xdata/images/xphoto/500x500/184698944.png?k=6bb1bf3c13db4a7ba3c22a2d1f1051f793c525a78104703b4dec3eb12101f545&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:56 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/png Transfer-Encoding: chunked Connection: close Server: nginx Date: Sun, 21 Jan 2024 13:30:27 GMT ETag: "faf4c565c493f3bc0e80e65cd746519a6611b1b3" Content-Language: 39328 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 d48a409d6a3222e2cc9a060d30206d3c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: l0m_T-hAJ8niolMdLQo2fXvaP_SPpGdTWZtkcK64EgrA4E2igcY8Kg== Age: 1573528
2024-02-08 18:35:56 UTC	15835	IN	Data Raw: 39 39 61 30 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 f4 00 00 01 f4 08 06 00 00 00 cb d6 df 8a 00 00 80 00 49 44 41 54 78 da ec 9d 07 58 dc 56 d6 86 67 06 b7 74 a7 6c 36 75 93 4d db dd 6c fa 66 d3 7b f2 a7 6e b2 e9 71 b2 29 4e dc d2 9d 38 76 e2 6e dc 7b ef 06 83 31 cd 14 63 63 9b 6a 30 a6 83 01 37 dc 01 e3 de 0d 98 36 7d ce 7f cf 95 04 33 cc 80 c1 bd 7c ef f3 9c 47 1a e9 ea 4a 33 d2 e8 3b e7 dc ab 2b 9d 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 99a0PNGIHDRIDATxXVgtl6uMlf{nq)N8vn{1ccj076}3\|GJ3;+
2024-02-08 18:35:56 UTC	16384	IN	Data Raw: dc ad 65 1e 05 7d d2 fc 34 b9 2f de 8f 26 e8 ff fe af bb a0 ff b7 db ec ba 8c 44 e4 ea 6a 4a de 52 4b 5d 06 bb ff 3e 2c c8 69 45 46 1a b7 bc 82 d2 4b ed 32 cb 13 b9 7c a3 c7 6c 4c d8 8a 22 99 42 d6 be 73 e9 81 1a e1 04 b9 ff 1f 7a 8e 5a 24 9b 83 12 8b 6c 52 cc 37 1d 74 d0 cb 5f 4d 77 2b f7 d0 7f 46 d0 ea bd 0e f9 3b 69 75 4e 08 48 f5 f8 5b 6f d9 75 4c fe ae 87 55 c7 71 4f 05 67 84 ec 2e ce ee a1 6a d7 f3 c6 99 8c 5d 65 36 8f d7 d7 e7 3d 02 a4 a0 73 ea 9d 9b 59 76 89 fa fe f7 5b a0 5b b9 bf 3c dd 57 a6 d8 b9 7f 8c 16 a5 fb 44 66 bb 95 e3 df 6b 61 fa 2e 99 d5 d2 8e 8d cf d1 8e 32 87 dc 66 e3 41 65 ca c7 7f a0 d2 5d d0 9f ff 74 a2 5b 9d ff f7 e5 14 59 9e eb e4 a9 96 5d e3 ff c5 21 e1 08 3b 9a d9 a1 ae 6a d9 6b 64 af de a5 7c 34 ed a3 23 85 53 e8 96 c7 5d ef Data Ascii: e}4/&DjJRK]>,iEFK2\|lL"BszZ$lR7t_Mw+F;iuNH[ouLUqOg.j]e6=sYv[[<WDfka.2fAe]t[Y]!;jkd\|4#S]
2024-02-08 18:35:56 UTC	7117	IN	Data Raw: cb 43 17 94 c8 90 f9 78 66 7d a9 bc 96 b8 c7 48 da 2b d7 bd 1b 5a 42 d4 9e c8 b1 8e 7d de 7e b3 d4 fd 37 7e 90 67 d6 5f 1e b9 e3 db 8f 90 58 79 4c 5a 1c 4f 22 2b d5 48 7b a3 ee 5f a0 eb 71 48 8b a7 ae f0 bd 9a b2 d2 ff 64 52 b6 af 86 46 da b5 12 56 94 fc 2e 35 5b 7e cb 6f 43 42 7e 04 dc d4 7e f1 45 0f 7f b2 f1 ca db bb ae ba b1 f5 f8 c3 37 3e 39 74 db 23 4f 0e d9 dc f0 bf 53 8b 9b dd d3 b3 60 c4 73 a3 76 0d 53 41 66 34 4a dc bd f4 89 c1 9b f7 bd 36 66 ff 3e 8d ee 8f a8 08 fd 6f 8f 2b 2a 47 1a 1f 02 6d a2 d1 7f dd 4f f4 0b 74 30 84 b8 5e 85 ba 45 5e 18 b5 43 f4 1a 79 4e 25 8b 63 0d 86 6d 35 99 01 48 b2 b1 46 2c 88 8c 9b a7 ec 36 52 86 40 9f 53 e1 36 18 b6 45 af d1 6d bd 1e 15 88 ff f4 59 67 a2 64 5c 5b ef 93 8d 2a e5 1d 52 7b c0 7a a9 3d 70 bd 8b a2 b7 1b Data Ascii: Cxf}H+ZB}~7~g_XyLZO"+H{_qHdRFV.5[~oCB~~E7>9t#OS`svSAf4J6f>o+GmOt0^E^CyN%cm5HF,6R@S6EmYgd\[R{z=p
2024-02-08 18:35:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
364	192.168.2.5	50146	18.64.236.43	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:55 UTC	421	OUT	GET /static/css/fonticons_clean/base64/woff/5d61b8a7156073e5e3e9741f65dda44ae3eef7d2.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:56 UTC	795	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 226735 Connection: close Server: nginx Date: Thu, 01 Feb 2024 17:28:24 GMT Last-Modified: Wed, 10 Apr 2019 11:21:48 GMT ETag: "5cadd1cc-375af" Expires: Sat, 02 Mar 2024 17:28:24 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 d3385c1527acfbb7e4b167c6fc3a82fe.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: -U_krsPyAnPzkTN0eski0uzrxq1CuZU-jtjZg1LpNuNn13rnmhNarA== Age: 608851
2024-02-08 18:35:56 UTC	15325	IN	Data Raw: 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 62 6f 6f 6b 69 6e 67 2d 69 63 6f 6e 73 65 74 27 3b 0a 20 20 20 20 73 72 63 3a 20 75 72 6c 28 64 61 74 61 3a 61 70 70 6c 69 63 61 74 69 6f 6e 2f 66 6f 6e 74 2d 77 6f 66 66 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3b 62 61 73 65 36 34 2c 64 30 39 47 52 67 41 42 41 41 41 41 41 70 65 34 41 41 77 41 41 41 41 43 6c 32 67 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 42 48 55 31 56 43 41 41 41 42 48 41 41 41 4b 4e 77 41 41 43 6a 63 4e 51 77 38 53 55 39 54 4c 7a 49 41 41 43 6e 34 41 41 41 41 59 41 41 41 41 47 41 50 45 67 65 37 59 32 31 68 63 41 41 41 4b 6c 67 41 41 41 48 4d 41 41 41 42 7a 4e 66 46 48 6c 68 6e 59 58 4e 77 41 Data Ascii: @font-face { font-family: 'booking-iconset'; src: url(data:application/font-woff;charset=utf-8;base64,d09GRgABAAAAApe4AAwAAAACl2gAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAABHU1VCAAABHAAAKNwAACjcNQw8SU9TLzIAACn4AAAAYAAAAGAPEge7Y21hcAAAKlgAAAHMAAABzNfFHlhnYXNwA
2024-02-08 18:35:56 UTC	16384	IN	Data Raw: 75 41 53 63 75 41 53 4d 69 42 67 63 4f 41 51 63 4f 41 51 63 4f 41 52 55 55 46 68 63 65 41 52 63 65 41 52 63 65 41 54 4d 79 4e 6a 63 2b 41 54 63 2b 41 54 63 2b 41 54 55 30 4a 69 63 75 41 52 4d 75 41 51 63 68 4a 67 59 48 44 67 4d 56 4d 42 51 56 48 41 45 56 46 42 34 43 46 78 34 42 4e 77 55 6c 46 6a 59 33 50 67 4d 31 50 41 45 31 50 41 45 78 4e 43 34 43 41 53 63 48 49 7a 63 6e 4d 78 63 33 4d 77 63 58 49 79 45 6a 45 53 4d 31 4d 6a 59 33 50 67 45 33 50 67 45 33 50 67 45 33 4d 78 45 6c 44 67 45 48 44 67 45 48 44 67 45 6a 49 69 59 6e 4c 67 45 6e 4c 67 45 6e 4c 67 45 31 4e 44 59 33 50 67 45 33 50 67 45 33 50 67 45 7a 4d 68 59 58 48 67 45 58 48 67 45 58 48 67 45 56 46 41 59 48 42 43 49 46 44 67 67 49 46 51 30 4d 46 51 6b 49 44 51 55 46 42 77 49 43 41 67 49 43 41 67 Data Ascii: uAScuASMiBgcOAQcOAQcOARUUFhceARceARceATMyNjc+ATc+ATc+ATU0JicuARMuAQchJgYHDgMVMBQVHAEVFB4CFx4BNwUlFjY3PgM1PAE1PAExNC4CAScHIzcnMxc3MwcXIyEjESM1MjY3PgE3PgE3PgE3MxElDgEHDgEHDgEjIiYnLgEnLgEnLgE1NDY3PgE3PgE3PgEzMhYXHgEXHgEXHgEVFAYHBCIFDggIFQ0MFQkIDQUFBwICAgICAg
2024-02-08 18:35:56 UTC	16384	IN	Data Raw: 2b 51 6e 46 52 4c 69 31 52 62 30 4a 79 65 51 45 45 51 76 30 6e 4e 6a 59 6e 4a 7a 63 33 4a 77 48 65 4c 45 35 72 50 30 42 72 54 69 73 72 54 6d 74 41 50 32 74 4f 4c 50 35 41 56 30 56 45 56 31 64 45 52 6c 59 42 79 53 77 6f 44 68 41 70 4b 54 41 53 45 52 59 58 47 66 33 50 2b 42 41 67 45 53 31 4f 42 51 4d 78 4c 76 36 7a 2b 42 51 67 44 79 74 4a 4c 54 58 37 4b 79 63 42 5a 6d 78 73 2f 6f 55 42 52 6b 78 53 52 6c 6b 50 44 51 4d 65 43 77 46 4b 53 54 73 73 54 6d 78 41 50 32 78 4f 4c 47 51 42 42 57 38 41 41 41 41 45 41 44 51 41 43 77 4f 52 41 36 67 41 45 67 41 70 41 44 34 41 55 67 41 41 41 53 63 4f 41 51 63 4f 41 51 63 58 48 67 45 79 4e 6a 63 2b 41 54 51 6d 4a 77 4d 4f 41 53 4d 69 4a 69 63 6d 4e 44 63 32 4d 68 63 57 4d 6a 63 32 4d 68 63 57 46 41 63 78 41 54 49 57 48 77 Data Ascii: +QnFRLi1Rb0JyeQEEQv0nNjYnJzc3JwHeLE5rP0BrTisrTmtAP2tOLP5AV0VEV1dERlYBySwoDhApKTASERYXGf3P+BAgES1OBQMxLv6z+BQgDytJLTX7KycBZmxs/oUBRkxSRlkPDQMeCwFKSTssTmxAP2xOLGQBBW8AAAAEADQACwORA6gAEgApAD4AUgAAAScOAQcOAQcXHgEyNjc+ATQmJwMOASMiJicmNDc2MhcWMjc2MhcWFAcxATIWHw
2024-02-08 18:35:56 UTC	16253	IN	Data Raw: 5a 56 41 77 4e 48 30 73 48 45 41 59 43 41 67 49 48 42 51 55 4b 43 52 51 46 43 41 55 46 43 67 45 77 6e 41 55 4a 43 79 74 4e 61 44 30 46 49 51 59 2f 41 68 55 4d 4a 67 77 59 42 50 30 52 49 77 73 4b 42 44 59 4a 48 42 39 47 43 67 31 54 45 51 49 6d 4b 6b 4a 52 4a 79 59 79 48 67 77 44 44 51 76 2b 51 77 77 62 43 42 63 50 44 78 63 48 42 41 58 47 42 52 63 4c 61 67 45 43 41 67 55 50 43 48 4d 4b 43 51 51 44 45 77 70 30 43 67 6b 45 75 41 77 55 41 77 67 46 48 43 51 45 4a 42 6e 2b 37 77 77 51 41 52 41 4c 32 77 49 44 42 41 49 47 42 44 67 4b 45 77 4d 44 43 67 6f 34 43 68 4d 44 2b 67 63 61 43 37 41 66 46 69 78 2f 52 56 59 49 48 52 30 66 57 67 51 42 42 51 49 44 41 67 34 4a 46 41 55 47 42 67 6b 4f 43 52 51 46 41 41 41 41 42 41 41 4b 2f 38 41 47 5a 41 4f 2b 41 43 59 41 56 77 Data Ascii: ZVAwNH0sHEAYCAgIHBQUKCRQFCAUFCgEwnAUJCytNaD0FIQY/AhUMJgwYBP0RIwsKBDYJHB9GCg1TEQImKkJRJyYyHgwDDQv+QwwbCBcPDxcHBAXGBRcLagECAgUPCHMKCQQDEwp0CgkEuAwUAwgFHCQEJBn+7wwQARAL2wIDBAIGBDgKEwMDCgo4ChMD+gcaC7AfFix/RVYIHR0fWgQBBQIDAg4JFAUGBgkOCRQFAAAABAAK/8AGZAO+ACYAVw
2024-02-08 18:35:56 UTC	16384	IN	Data Raw: 57 31 52 4c 49 41 51 44 41 77 4d 45 41 77 50 2b 72 51 45 43 52 53 77 30 41 67 45 4c 43 77 45 43 41 51 45 42 41 51 45 42 41 51 45 42 41 51 45 42 41 51 45 43 41 51 45 42 41 51 45 43 41 51 45 42 41 51 45 42 41 51 45 42 41 67 45 42 41 51 49 42 4c 51 49 70 49 77 45 43 41 51 49 42 41 51 45 42 41 51 45 42 41 51 49 42 41 67 45 42 41 51 45 43 41 64 4d 42 41 67 45 42 41 51 49 42 41 51 49 42 41 67 45 42 41 51 49 42 41 67 45 42 41 6a 65 48 53 67 45 43 41 51 77 4e 41 58 30 42 41 67 45 42 41 51 45 42 41 67 45 42 41 51 49 42 41 51 45 43 41 51 45 43 41 51 49 42 41 53 78 73 50 41 45 42 41 53 4e 43 48 67 31 44 4d 77 45 43 41 51 49 42 41 51 45 42 41 51 45 42 41 51 49 42 41 67 45 42 41 51 45 43 41 64 54 58 53 59 4d 30 41 67 46 46 41 77 51 42 42 41 4d 44 42 41 50 2b 71 67 45 Data Ascii: W1RLIAQDAwMEAwP+rQECRSw0AgELCwECAQEBAQEBAQEBAQEBAQECAQEBAQECAQEBAQEBAQEBAgEBAQIBLQIpIwECAQIBAQEBAQEBAQIBAgEBAQECAdMBAgEBAQIBAQIBAgEBAQIBAgEBAjeHSgECAQwNAX0BAgEBAQEBAgEBAQIBAQECAQECAQIBASxsPAEBASNCHg1DMwECAQIBAQEBAQEBAQIBAgEBAQECAdTXSYM0AgFFAwQBBAMDBAP+qgE
2024-02-08 18:35:56 UTC	16384	IN	Data Raw: 41 54 51 6d 49 79 49 47 46 54 41 55 46 52 51 57 46 78 55 4f 41 77 63 4f 41 52 55 63 41 54 45 55 46 6a 73 42 50 67 45 33 4d 53 55 75 41 79 63 31 50 67 45 39 41 54 51 6d 49 79 49 47 46 54 41 55 46 52 51 57 46 78 55 4f 41 51 63 65 41 78 63 65 41 52 63 7a 4d 6a 59 31 4d 44 51 31 4e 43 59 6e 4d 51 55 52 42 77 58 38 41 67 55 49 45 78 73 4c 54 47 46 6b 49 68 55 59 5a 6d 64 6d 5a 68 67 56 4a 57 52 67 53 77 73 62 45 76 77 41 43 7a 31 52 57 43 55 61 4d 78 4d 4f 43 54 56 46 52 44 77 49 44 68 64 45 51 6a 51 48 45 68 41 4d 42 4c 34 45 48 53 49 45 33 41 63 30 51 30 55 5a 44 67 6b 31 52 45 55 38 43 41 34 53 4d 52 6b 6e 57 45 34 37 43 69 4d 64 41 38 59 45 42 41 77 53 57 53 52 6d 42 51 6f 4b 42 57 59 6b 49 79 55 51 42 69 51 73 4c 51 2b 72 45 44 45 6c 56 55 70 56 65 48 68 Data Ascii: ATQmIyIGFTAUFRQWFxUOAwcOARUcATEUFjsBPgE3MSUuAyc1PgE9ATQmIyIGFTAUFRQWFxUOAQceAxceARczMjY1MDQ1NCYnMQURBwX8AgUIExsLTGFkIhUYZmdmZhgVJWRgSwsbEvwACz1RWCUaMxMOCTVFRDwIDhdEQjQHEhAMBL4EHSIE3Ac0Q0UZDgk1REU8CA4SMRknWE47CiMdA8YEBAwSWSRmBQoKBWYkIyUQBiQsLQ+rEDElVUpVeHh
2024-02-08 18:35:56 UTC	16384	IN	Data Raw: 48 41 45 42 41 51 45 46 42 78 38 2f 48 77 49 42 42 67 73 47 41 51 45 42 41 51 45 42 43 42 49 4a 42 52 45 4d 47 54 49 61 44 42 6b 4d 45 68 73 43 41 78 51 52 41 78 59 79 49 79 4d 79 4d 69 4d 6a 4d 76 37 6e 41 77 55 44 41 67 59 44 41 67 45 44 42 77 4d 6f 55 43 6b 44 43 41 4d 4b 44 77 63 4d 42 41 30 46 42 67 63 43 41 51 45 42 2b 51 34 6f 44 67 34 4f 6b 72 49 75 58 43 34 43 41 77 49 62 4e 68 73 50 48 51 38 51 4b 51 34 4e 41 78 41 54 4a 78 4d 66 50 52 38 48 45 41 6f 64 4f 68 34 47 44 67 67 42 41 67 45 66 50 52 34 43 42 41 49 33 62 54 63 42 41 77 45 55 47 77 45 42 48 68 55 37 64 6a 73 48 44 67 67 4b 45 67 67 68 51 79 45 43 42 41 4d 62 4e 78 73 45 42 67 51 42 41 77 45 52 49 68 45 4c 44 67 49 46 43 67 55 44 42 51 49 43 46 68 45 52 48 41 4d 41 41 41 41 49 41 41 44 Data Ascii: HAEBAQEFBx8/HwIBBgsGAQEBAQEBCBIJBREMGTIaDBkMEhsCAxQRAxYyIyMyMiMjMv7nAwUDAgYDAgEDBwMoUCkDCAMKDwcMBA0FBgcCAQEB+Q4oDg4OkrIuXC4CAwIbNhsPHQ8QKQ4NAxATJxMfPR8HEAodOh4GDggBAgEfPR4CBAI3bTcBAwEUGwEBHhU7djsHDggKEgghQyECBAMbNxsEBgQBAwERIhELDgIFCgUDBQICFhERHAMAAAAIAAD
2024-02-08 18:35:56 UTC	16384	IN	Data Raw: 61 6d 71 37 69 31 42 51 69 37 73 41 41 41 41 41 41 51 41 4b 2f 38 59 45 4a 67 4f 77 41 43 67 41 41 41 45 32 4d 68 63 54 48 67 45 7a 49 54 49 57 42 77 55 4f 41 52 63 54 46 67 59 6e 4a 53 59 69 42 77 55 47 4a 6a 63 54 4e 69 59 6e 4a 53 59 32 4d 79 45 79 4e 6a 63 54 41 67 30 46 44 41 56 74 42 52 73 4f 41 57 45 50 42 41 7a 2b 34 67 77 4b 42 57 30 45 43 67 7a 2b 34 67 73 69 43 2f 37 69 44 41 6f 45 62 51 55 4b 44 50 37 69 44 41 51 50 41 57 45 50 47 77 52 74 41 37 41 4f 44 76 36 76 44 52 51 4d 43 64 41 49 49 41 37 2b 73 41 34 49 43 64 41 49 43 4e 41 4a 43 41 34 42 55 41 34 67 43 4e 41 4a 44 42 51 4e 41 56 45 41 41 41 41 41 44 41 41 41 2f 38 41 45 42 67 4f 77 41 42 77 41 49 41 41 6b 41 43 67 41 4c 51 41 7a 41 44 63 41 4f 77 41 2b 41 45 49 41 54 41 42 59 41 41 41 Data Ascii: amq7i1BQi7sAAAAAAQAK/8YEJgOwACgAAAE2MhcTHgEzITIWBwUOARcTFgYnJSYiBwUGJjcTNiYnJSY2MyEyNjcTAg0FDAVtBRsOAWEPBAz+4gwKBW0ECgz+4gsiC/7iDAoEbQUKDP7iDAQPAWEPGwRtA7AODv6vDRQMCdAIIA7+sA4ICdAICNAJCA4BUA4gCNAJDBQNAVEAAAAADAAA/8AEBgOwABwAIAAkACgALQAzADcAOwA+AEIATABYAAA
2024-02-08 18:35:56 UTC	16384	IN	Data Raw: 46 44 49 66 41 52 34 42 4e 7a 34 42 4e 7a 34 42 4e 7a 34 42 46 78 34 42 46 78 34 42 4e 7a 34 42 4a 79 34 42 41 7a 49 57 46 52 51 47 49 79 49 6d 4e 54 51 32 46 7a 49 32 4e 54 51 6d 49 79 49 47 46 52 51 57 45 7a 49 57 46 52 51 47 49 79 49 6d 4e 54 51 32 4d 78 55 79 4e 6a 55 30 4a 69 4d 69 42 68 55 55 46 6a 4d 42 49 53 49 6d 4e 54 51 32 4d 79 45 2b 41 54 63 2b 41 54 4d 79 46 68 63 65 41 54 63 7a 4d 6a 59 33 50 67 45 7a 4f 67 45 7a 4f 67 45 56 4d 68 59 7a 48 67 45 56 46 41 59 48 42 68 59 58 48 67 45 7a 4d 6a 59 33 50 67 45 33 4d 7a 49 57 46 52 51 47 49 7a 63 31 4e 43 59 72 41 53 34 42 49 79 49 47 42 79 34 42 49 79 49 47 42 79 45 69 42 68 55 48 46 42 59 56 48 67 45 58 48 67 45 58 48 67 45 56 46 78 51 57 46 77 34 42 42 77 34 42 42 78 77 42 46 78 34 42 46 78 34 Data Ascii: FDIfAR4BNz4BNz4BNz4BFx4BFx4BNz4BJy4BAzIWFRQGIyImNTQ2FzI2NTQmIyIGFRQWEzIWFRQGIyImNTQ2MxUyNjU0JiMiBhUUFjMBISImNTQ2MyE+ATc+ATMyFhceATczMjY3PgEzOgEzOgEVMhYzHgEVFAYHBhYXHgEzMjY3PgE3MzIWFRQGIzc1NCYrAS4BIyIGBy4BIyIGByEiBhUHFBYVHgEXHgEXHgEVFxQWFw4BBw4BBxwBFx4BFx4
2024-02-08 18:35:56 UTC	16384	IN	Data Raw: 48 67 45 7a 4d 6a 59 33 50 67 45 31 4e 43 59 6e 4c 67 45 6a 4a 79 49 47 42 77 34 42 46 52 51 57 46 78 34 42 4d 7a 49 32 4e 7a 34 42 4e 54 51 6d 4a 79 34 42 49 77 49 41 61 72 75 4c 55 46 43 4c 75 32 70 71 75 34 74 51 55 49 75 37 35 67 67 49 42 77 63 48 45 77 30 4d 46 41 67 48 43 41 67 49 42 78 51 4c 44 42 4d 48 51 42 71 4b 47 53 63 49 46 41 73 4d 45 77 63 49 43 41 63 48 42 78 4d 4e 44 42 51 49 43 41 63 49 42 34 77 50 43 6a 59 52 4b 68 67 42 41 54 67 6f 4b 44 67 42 41 51 67 30 49 69 45 34 45 54 67 56 4f 68 57 31 43 67 38 6b 50 43 6b 58 49 54 74 54 4d 77 45 42 43 77 6f 5a 42 77 63 43 41 51 4d 6c 55 43 73 72 55 43 55 44 41 51 4a 4a 4e 79 41 50 47 77 67 4d 47 51 31 51 63 41 45 42 4d 31 4d 37 49 52 63 70 50 4e 63 46 43 67 51 45 42 41 51 45 42 41 6f 46 42 67 6f Data Ascii: HgEzMjY3PgE1NCYnLgEjJyIGBw4BFRQWFx4BMzI2Nz4BNTQmJy4BIwIAaruLUFCLu2pqu4tQUIu75ggIBwcHEw0MFAgHCAgIBxQLDBMHQBqKGScIFAsMEwcICAcHBxMNDBQICAcIB4wPCjYRKhgBATgoKDgBAQg0IiE4ETgVOhW1Cg8kPCkXITtTMwEBCwoZBwcCAQMlUCsrUCUDAQJJNyAPGwgMGQ1QcAEBM1M7IRcpPNcFCgQEBAQEBAoFBgo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
365	192.168.2.5	50145	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:55 UTC	2873	OUT	GET /logo?ver=1&sid=5171fc655664ddf74ab763a094523fb7&t=17074173491 HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3JoFJ/d3+jTRbAw8j2g3DznWiIRblwWjQRtj/04PDlBt/o55ocKzBIQxZ/e0Rt7iMiaISeSKOQt; lastSeen=1707417350227; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.421694156.1707417338; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPefz11GFz2XDsuxniWysDhYDakkGwaWp4sTAC4tqHnZ0k3PWpIdXDVooPaztJkJl31v3F8fHw9lMHBdd8c1REz5cDYfcMeR0%2FAqDBnUQFnqTjIrUPxmDWl2d9rLaM5SH6Q0wauuC31ecfmXBHEfMHkwnjEl7hHRC7c4%3D
2024-02-08 18:35:56 UTC	780	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:56 GMT vary: Accept-Encoding, User-Agent set-cookie: BJS=-; domain=booking.com; expires=Fri, 09-Feb-2024 18:35:56 GMT; Secure; HTTPOnly strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=d57182c6f4d7004b&e=UmFuZG9tSVYkc2RlIyh9YbpBYTW1tHKztSBgnGdE66xt1tdc9AVkU6epAWgx68WZ x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 b0c7b942a33f0f4451718aee53f7840c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: jT_ZCQV2fl1ccfpAXml_yJnUghZvSsbsiBYEk63YKIKC_UuwuFUqpg==
2024-02-08 18:35:56 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
366	192.168.2.5	50147	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:55 UTC	2825	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3JoFJ/d3+jTRbAw8j2g3DznWiIRblwWjQRtj/04PDlBt/o55ocKzBIQxZ/e0Rt7iMiaISeSKOQt; lastSeen=1707417350227; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.421694156.1707417338; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPefz11GFz2XDsuxniWysDhYDakkGwaWp4sTAC4tqHnZ0k3PWpIdXDVooPaztJkJl31v3F8fHw9lMHBdd8c1REz5cDYfcMeR0%2FAqDBnUQFnqTjIrUPxmDWl2d9rLaM5SH6Q0wauuC31ecfmXBHEfMHkwnjEl7hHRC7c4%3D
2024-02-08 18:35:56 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:56 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=479782c68630026a&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsuDR2QyILQ6zGjuCVakxeSXghMp0IxGo-Q x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 fcb94596db202c75ac0e559b3183be72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: ms0_em2OEu0pV3IcfWcWWkq9MIczHxTertek3ga9uWVlIkcqVuPo_Q==
2024-02-08 18:35:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
367	192.168.2.5	50148	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:55 UTC	4265	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 509 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3 X-Booking-AID: 304142 X-Booking-Pageview-Id: 2c8482c2544201f4 X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,1912460\|1,1856870\|1,1912460\|7,1908890\|1,1912460\|6,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7 sec-ch-ua-platform: "Windows" X-Booking-Language-Code: en-us X-Booking-CSRF: RVfFZQAAAAA=qVueflVyIcgKOJdfCMKcmiDGjvY9UqM_W79drieypCCd1wLxtNOjZPcMNKEslcD0Tiyh8b7rdIv86FT89bynmubUkLo31LJ5cM248yQm3ulKZFWN-WKHCjXqy964TaJvn5A_S7b4oaNG1jhNZ7aGF2JNPgwXGQBCPiOREYDFBwUwhotUpEosEVmLfdyz_vXpYSXlaaCHZibCaVWm sec-ch-ua-mobile: ?0 X-Partner-Channel-Id: 3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAKFvpSuBsACAdICJDdhNmRhMmNiLThiNjMtNDQ1OS04MGUwLTI1OGM3NjBkNWQzMdgCBeACAQ Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Accept: application/json, text/javascript, /; q=0.01 X-Booking-SiteType-Id: 1 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3JoFJ/d3+jTRbAw8j2g3DznWiIRblwWjQRtj/04PDlBt/o55ocKzBIQxZ/e0Rt7iMiaISeSKOQt; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.421694156.1707417338; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPefz11GFz2XDsuxniWysDhYDakkGwaWp4sTAC4tqHnZ0k3PWpIdXDVooPaztJkJl31v3F8fHw9lMHBdd8c1REz5cDYfcMeR0%2FAqDBnUQFnqTjIrUPxmDWl2d9rLaM5SH6Q0wauuC31ecfmXBHEfMHkwnjEl7hHRC7c4%3D; lastSeen=0
2024-02-08 18:35:55 UTC	509	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 70 72 69 76 61 63 79 5f 63 6f 6e 73 65 6e 74 2e 63 6f 6f 6b 69 65 5f 63 6f 6e 73 65 6e 74 5f 6c 6f 61 64 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 6c 6f 61 64 5f 64 75 72 61 74 69 6f 6e 22 3a 31 37 30 35 37 30 39 39 33 36 35 39 37 2c 22 64 69 73 70 6c 61 79 65 64 22 3a 66 61 6c 73 65 2c 22 6e 65 74 77 6f 72 6b 5f 69 6e 66 6f 72 6d 61 74 69 6f 6e 22 3a 7b 22 65 66 66 65 63 74 69 76 65 5f 74 79 70 65 22 3a 22 34 67 22 7d 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f Data Ascii: {"events":[{"action_name":"privacy_consent.cookie_consent_loaded","action_version":"1.0.0","content":{"load_duration":1705709936597,"displayed":false,"network_information":{"effective_type":"4g"}},"context":{"page":{"page_referrer":"","page_url":"https://
2024-02-08 18:35:56 UTC	1183	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 31 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:56 GMT vary: User-Agent, Accept-Encoding access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKAimfo93c2GrBDhhKwo6bWKuVj3PL8CFrhr0%2BqmCv4c3d%2B3eXrKgkJqKu4CkWInIJPix%2FdzGgLa83gGD4gcCULKAMcixtmqDHZCsf6fcT6zs4kfQG%2FWoSybhGedPUjj4dJwcO6Qa13VaaHS%2FcpWxeTdhj%2FM0ATu%2Bc%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:56 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=dac582c6a0df0271&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqstfVjYIelkYzadXmwVKGWQ6tyknkKfErzQ x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 09aa283795aaafe63cbd7c2cbac2c306.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: LU2wBnTD86QGE3onkbmm0mFUymQftDrp1K2t7zUSGckLZsM7inwptQ==
2024-02-08 18:35:56 UTC	31	IN	Data Raw: 5b 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d 5d Data Ascii: [{"status":1,"content":"Sent"}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
368	192.168.2.5	50149	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:55 UTC	676	OUT	GET /psb/capla/static/css/d2a738da.079c3b4c.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "1a7c523a95596c5b0b122ad8d8e3b553" If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
2024-02-08 18:35:56 UTC	514	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:56 GMT ETag: "1a7c523a95596c5b0b122ad8d8e3b553" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: y6hnIHqnWmWPq9JqZ4Ue_o6YIF6Bl_1N Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 a53ebc5c4d12bc9682b9c11ea18dccbe.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 5m4Jv4db17HUJnj6AQaM2HMGWlPsbdJPwsG24fH7ux5yNEndXPoF5w== Age: 8917 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
369	192.168.2.5	50150	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:55 UTC	676	OUT	GET /psb/capla/static/css/53a8d0d3.b1818b84.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "f820477c322829e348f318a453e432a5" If-Modified-Since: Thu, 08 Feb 2024 11:37:52 GMT
2024-02-08 18:35:56 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:56 GMT ETag: "f820477c322829e348f318a453e432a5" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: BiPU5vSMYzP0dcXjFNJqaYKjd8Wn7Ys7 Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 45893c5ff2aa24fa7dce9573a0274642.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: llHuvUJ8wmE6cFCNK4MUz34JD9RtmgjcLXxlcW6QJKqW7Np31EauyA== Age: 24721 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
370	192.168.2.5	50151	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:56 UTC	676	OUT	GET /psb/capla/static/css/b9a82cb8.c62928a4.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "d4cb397172a601054d15e416b713f8b5" If-Modified-Since: Tue, 06 Feb 2024 05:14:54 GMT
2024-02-08 18:35:56 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:56 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: ZWcBtyq5.ToLH0XKRcMymv7pEUycHruY Server: AmazonS3 ETag: "d4cb397172a601054d15e416b713f8b5" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 309e9e958e8d35f7e17ae8ac267b7dea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: S6huJFCufohq6H82LG9JQ716Uj06imT4vCRmTlEG5RKwLWtM-N5XHA== Age: 21886 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
371	192.168.2.5	50152	3.162.125.32	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:56 UTC	2480	OUT	GET /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=BXAbRIVE HTTP/1.1 Host: accommodations.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json x-booking-et-serialized-state: Ef98IG0fjgY56Y63N0XdXtUDZNdmFwr2XgKIh92Hu06LJvnE66CkRQe8kZKZ05qgz sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; _ga=GA1.2.421694156.1707417338; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPefz11GFz2XDsuxniWysDhYDakkGwaWp4sTAC4tqHnZ0k3PWpIdXDVooPaztJkJl31v3F8fHw9lMHBdd8c1REz5cDYfcMeR0%2FAqDBnUQFnqTjIrUPxmDWl2d9rLaM5SH6Q0wauuC31ecfmXBHEfMHkwnjEl7hHRC7c4%3D; lastSeen=0
2024-02-08 18:35:56 UTC	650	IN	HTTP/1.1 200 OK Content-Type: application/json Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:56 GMT x-frame-options: SAMEORIGIN x-content-type-options: nosniff access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com vary: Accept-Encoding referrer-policy: no-referrer strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 f3131b940cd6fd6a885d42f83a5b3a42.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P3 X-Amz-Cf-Id: GO19plvACVuzlCWHs_eN4GsB3Q2Cc2z36c2ysVBFOZT3WlCvQCqmSA==
2024-02-08 18:35:56 UTC	6435	IN	Data Raw: 31 39 31 62 0d 0a 7b 22 63 68 75 6e 6b 73 22 3a 5b 22 62 39 61 38 32 63 62 38 22 5d 2c 22 65 78 70 65 72 69 6d 65 6e 74 54 61 67 73 22 3a 7b 22 59 54 54 48 62 58 65 65 56 65 43 46 5a 41 63 62 52 62 52 4f 66 4c 4d 54 65 43 59 48 44 52 46 63 4f 22 3a 31 2c 22 48 4d 62 4f 48 4e 46 50 42 4a 59 49 59 4b 63 50 4e 53 4e 48 52 55 65 42 4f 46 4f 22 3a 31 7d 2c 22 66 65 61 74 75 72 65 4e 61 6d 65 73 22 3a 7b 22 49 65 5a 58 58 44 4e 46 56 46 4b 4f 55 59 4c 4c 46 4a 59 62 43 63 65 4d 4e 50 56 62 50 53 55 61 62 53 63 63 45 54 4b 65 22 3a 66 61 6c 73 65 2c 22 45 42 44 49 62 49 62 58 44 65 42 47 47 54 63 5a 4a 46 66 48 62 65 4d 50 45 54 22 3a 74 72 75 65 2c 22 49 65 50 46 62 4a 4d 46 56 46 4b 4f 55 59 4c 4c 48 4e 4f 56 52 65 22 3a 74 72 75 65 7d 2c 22 73 65 6f 45 78 70 Data Ascii: 191b{"chunks":["b9a82cb8"],"experimentTags":{"YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO":1,"HMbOHNFPBJYIYKcPNSNHRUeBOFO":1},"featureNames":{"IeZXXDNFVFKOUYLLFJYbCceMNPVbPSUabSccETKe":false,"EBDIbIbXDeBGGTcZJFfHbeMPET":true,"IePFbJMFVFKOUYLLHNOVRe":true},"seoExp
2024-02-08 18:35:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
372	192.168.2.5	50153	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:56 UTC	716	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 946 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:35:56 UTC	946	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 64 37 33 36 31 61 34 2d 63 63 63 66 2d 34 30 62 39 2d 62 63 31 31 2d 36 36 61 32 35 38 35 32 32 35 33 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 31 31 36 36 36 66 65 33 2d 33 38 61 63 2d 34 65 61 38 2d 39 37 61 34 2d 65 63 66 65 64 36 37 34 62 34 62 38 22 2c 22 73 73 22 3a 22 31 35 65 30 61 36 32 31 2d 31 31 34 34 2d 34 38 35 64 2d 39 30 31 62 2d 30 39 62 62 36 33 38 64 32 39 33 36 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"fd7361a4-cccf-40b9-bc11-66a258522530","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"11666fe3-38ac-4ea8-97a4-ecfed674b4b8","ss":"15e0a621-1144-485d-901b-09bb638d2936","bg":true,"s
2024-02-08 18:35:57 UTC	523	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:35:56 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
373	192.168.2.5	50155	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:56 UTC	716	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 946 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:35:56 UTC	946	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 64 37 33 36 31 61 34 2d 63 63 63 66 2d 34 30 62 39 2d 62 63 31 31 2d 36 36 61 32 35 38 35 32 32 35 33 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 38 66 65 33 63 62 37 31 2d 61 39 33 34 2d 34 35 33 38 2d 38 38 37 39 2d 36 35 63 32 39 31 64 62 33 36 38 30 22 2c 22 73 73 22 3a 22 31 35 65 30 61 36 32 31 2d 31 31 34 34 2d 34 38 35 64 2d 39 30 31 62 2d 30 39 62 62 36 33 38 64 32 39 33 36 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"fd7361a4-cccf-40b9-bc11-66a258522530","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"8fe3cb71-a934-4538-8879-65c291db3680","ss":"15e0a621-1144-485d-901b-09bb638d2936","bg":true,"s
2024-02-08 18:35:57 UTC	482	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:35:57 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: clear access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
374	192.168.2.5	50154	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:56 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive Content-Length: 2476 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:56 UTC	2476	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 6d 32 2b 42 4c 6a 30 6e 41 41 41 41 3a 43 71 7a 32 31 79 33 4a 51 38 42 41 6e 47 39 4a 48 4a 44 68 71 32 64 63 6f 2f 31 4c 30 54 4a 4a 61 79 4f 52 47 65 70 38 33 32 79 72 54 75 72 55 74 56 65 2f 33 35 54 7a 41 4a 6b 54 74 33 36 52 46 46 33 6c 31 2f 6b 4c 6a 47 57 57 39 64 39 69 42 37 35 4e 5a 63 79 70 57 6b 77 77 44 39 4b 6e 67 57 45 75 41 68 41 6c 55 62 55 71 6f 34 72 48 56 31 2b 45 37 39 6d 55 35 69 79 42 41 51 56 32 38 2f 68 62 6f 57 6e 47 4d 58 4c 43 72 65 6f 68 65 77 46 56 46 73 61 77 47 63 30 41 77 55 49 72 37 43 76 68 41 78 2b 46 70 7a 50 4d 39 36 65 36 6a 6d 4e 62 73 51 Data Ascii: {"existing_token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQ
2024-02-08 18:35:57 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1124 Connection: close Vary: Accept-Encoding Date: Thu, 08 Feb 2024 18:35:57 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65c51f0d-22ecf2940246e52d7355bb18 X-Cache: Miss from cloudfront Via: 1.1 920629f47fa586ce02a1a1af8b626578.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: tzJWWtKVHZO-jO4hxON7BtXDkY_1KXXT-B2y2op1YFBN7F2bkmynJw==
2024-02-08 18:35:57 UTC	1124	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 61 75 75 43 6f 65 34 43 41 41 41 41 3a 4b 31 6c 51 4d 6e 76 77 62 68 72 6a 65 45 31 2b 53 62 56 48 78 50 50 50 67 75 6b 70 58 68 56 61 76 6e 6a 52 71 66 48 58 76 77 45 75 34 4d 4e 64 50 57 6f 39 6a 4d 38 48 37 36 58 61 39 31 38 4c 48 78 75 46 7a 32 31 63 36 56 31 62 42 42 2f 37 78 78 58 6f 46 6b 4a 57 34 43 36 65 46 4b 47 67 50 66 6b 4e 57 35 47 6e 64 71 5a 76 6d 76 6d 72 4a 55 50 59 30 4e 76 2f 69 6d 41 51 78 55 36 37 64 42 44 45 34 6e 37 50 78 33 61 78 79 33 65 68 51 59 5a 34 51 49 42 72 37 36 44 6b 53 34 2b 34 49 54 76 63 35 56 6c 30 67 4b 58 61 57 68 46 4b 46 61 67 44 72 65 4d 45 62 4b 47 59 56 5a 72 Data Ascii: {"token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAauuCoe4CAAAA:K1lQMnvwbhrjeE1+SbVHxPPPgukpXhVavnjRqfHXvwEu4MNdPWo9jM8H76Xa918LHxuFz21c6V1bBB/7xxXoFkJW4C6eFKGgPfkNW5GndqZvmvmrJUPY0Nv/imAQxU67dBDE4n7Px3axy3ehQYZ4QIBr76DkS4+4ITvc5Vl0gKXaWhFKFagDreMEbKGYVZr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
375	192.168.2.5	50158	3.161.193.117	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:56 UTC	650	OUT	POST /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive Content-Length: 85 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-API-Version: 1 Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:56 UTC	85	OUT	Data Raw: 7b 22 70 69 64 22 3a 22 32 63 38 34 38 32 63 32 35 34 34 32 30 31 66 34 22 2c 22 72 65 66 41 63 74 69 6f 6e 22 3a 22 69 6e 64 65 78 22 2c 22 73 69 74 65 54 79 70 65 22 3a 22 31 22 2c 22 6c 63 70 22 3a 33 32 33 39 2e 36 30 30 30 30 30 30 30 30 30 30 36 7d Data Ascii: {"pid":"2c8482c2544201f4","refAction":"index","siteType":"1","lcp":3239.600000000006}
2024-02-08 18:35:57 UTC	525	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:57 GMT vary: Origin, Accept-Encoding access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 34700202f8798821d47df9cb3d503402.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P8 X-Amz-Cf-Id: 7WlsQqbhpa2h-epmfDSuTazesE0ePx_LFI7XpJO51knnmlSfPBA6JQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
376	192.168.2.5	50157	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:57 UTC	4622	OUT	GET /js_tracking?aid=304142&pid=2c8482c2544201f4&ver=2&sid=5171fc655664ddf74ab763a094523fb7&ref_action=index&lang=en-us&stype=1&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|3239&m=UmFuZG9tSVYkc2RlIyh9YYo1mfebd19Q2WIimWOyIN1gUe4_-JQdNOBTMuHuYCJPue7ik10LWViyRYmmf149m9vSAg2JJTyfAEk9RiEQZejXjro5rDJvxnq57UaGsDKd0iBXLkMuV2sFYEHSFmXZW5zvkIdbv7-B87Oi9zo36Fnq7AU8K4Y8Y-SdtsN1A2dfLiciDUxBuNe45QSxoxZcHhPcdr6v26QamVEbge_7LQ_MDhbvlSKq9Lwf9P11FwHzxPymBNBmu_dZFb8tK9Z3wY0RAyYm7D0hfdu-LCtv4j3isKKp1L_CiYhwCnyC42X_OqimTrSjKXCbKfd3YnkJbQ HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3 X-Booking-CSRF: RVfFZQAAAAA=qVueflVyIcgKOJdfCMKcmiDGjvY9UqM_W79drieypCCd1wLxtNOjZPcMNKEslcD0Tiyh8b7rdIv86FT89bynmubUkLo31LJ5cM248yQm3ulKZFWN-WKHCjXqy964TaJvn5A_S7b4oaNG1jhNZ7aGF2JNPgwXGQBCPiOREYDFBwUwhotUpEosEVmLfdyz_vXpYSXlaaCHZibCaVWm sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAKFvpSuBsACAdICJDdhNmRhMmNiLThiNjMtNDQ1OS04MGUwLTI1OGM3NjBkNWQzMdgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: 2c8482c2544201f4 X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,1912460\|1,1856870\|1,1912460\|7,1908890\|1,1912460\|6,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3JoFJ/d3+jTRbAw8j2g3DznWiIRblwWjQRtj/04PDlBt/o55ocKzBIQxZ/e0Rt7iMiaISeSKOQt; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.421694156.1707417338; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKAimfo93c2GrBDhhKwo6bWKuVj3PL8CFrhr0%2BqmCv4c3d%2B3eXrKgkJqKu4CkWInIJPix%2FdzGgLa83gGD4gcCULKAMcixtmqDHZCsf6fcT6zs4kfQG%2FWoSybhGedPUjj4dJwcO6Qa13VaaHS%2FcpWxeTdhj%2FM0ATu%2Bc%3D; lastSeen=0
2024-02-08 18:35:57 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:57 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=252c82c6e89801e3&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejL_g9w9Fwm5EJCrpCPU0OTALkwl61hB-Ic x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 6f067a3fd6e721a7db2a2901701a65d8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: zYy-rwu9OWfeXJCWPnDRs_DOWQN2eys0MKM-WNnPJdDeBI9ElH7FjQ==
2024-02-08 18:35:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
377	192.168.2.5	50160	3.161.193.117	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:57 UTC	2109	OUT	GET /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; _ga=GA1.2.421694156.1707417338; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKAimfo93c2GrBDhhKwo6bWKuVj3PL8CFrhr0%2BqmCv4c3d%2B3eXrKgkJqKu4CkWInIJPix%2FdzGgLa83gGD4gcCULKAMcixtmqDHZCsf6fcT6zs4kfQG%2FWoSybhGedPUjj4dJwcO6Qa13VaaHS%2FcpWxeTdhj%2FM0ATu%2Bc%3D; lastSeen=0
2024-02-08 18:35:57 UTC	513	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html;charset=iso-8859-1 Content-Length: 411 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:57 GMT cache-control: must-revalidate,no-cache,no-store strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 f7d8aa9f8887673e75fcf6c12b2312f6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P8 X-Amz-Cf-Id: vjhIvi6ygrQwrG8PzwXSviWfFNWYwf1EEaQIe8bGEZBJ-nEFt6RIMQ==
2024-02-08 18:35:57 UTC	411	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 2f 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 32 3e 48 54 54 50 20 45 52 52 4f 52 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 32 3e 0a 3c 74 61 62 6c 65 3e 0a 3c 74 72 3e 3c 74 68 3e 55 52 49 3a 3c 2f 74 68 3e 3c 74 64 3e 2f 77 65 62 2d 76 69 74 61 6c 73 2f 73 65 6e 64 2d 76 69 74 61 6c 73 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/><title>Error 405 Method Not Allowed</title></head><body><h2>HTTP ERROR 405 Method Not Allowed</h2><table><tr><th>URI:</th><td>/web-vitals/send-vitals</td></tr><tr>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
378	192.168.2.5	50159	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:57 UTC	3454	OUT	GET /js_tracking?aid=304142&pid=2c8482c2544201f4&ver=2&sid=5171fc655664ddf74ab763a094523fb7&ref_action=index&lang=en-us&stype=1&ete=&etg=&etcg=cCHObKdPHMfFdHMEKdbfZRLRMLFSZaTaTaET\|1&ets=cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YYo1mfebd19Q2WIimWOyIN1gUe4_-JQdNOBTMuHuYCJPue7ik10LWViyRYmmf149m9vSAg2JJTyfAEk9RiEQZejXjro5rDJvxnq57UaGsDKd0iBXLkMuV2sFYEHSFmXZW5zvkIdbv7-B87Oi9zo36Fnq7AU8K4Y8Y-SdtsN1A2dfLiciDUxBuNe45QSxoxZcHhPcdr6v26QamVEbge_7LQ_MDhbvlSKq9Lwf9P11FwHzxPymBNBmu_dZFb8tK9Z3wY0RAyYm7D0hfdu-LCtv4j3isKKp1L_CiYhwCnyC42X_OqimTrSjKXCbKfd3YnkJbQ HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3JoFJ/d3+jTRbAw8j2g3DznWiIRblwWjQRtj/04PDlBt/o55ocKzBIQxZ/e0Rt7iMiaISeSKOQt; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.421694156.1707417338; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKAimfo93c2GrBDhhKwo6bWKuVj3PL8CFrhr0%2BqmCv4c3d%2B3eXrKgkJqKu4CkWInIJPix%2FdzGgLa83gGD4gcCULKAMcixtmqDHZCsf6fcT6zs4kfQG%2FWoSybhGedPUjj4dJwcO6Qa13VaaHS%2FcpWxeTdhj%2FM0ATu%2Bc%3D; lastSeen=0
2024-02-08 18:35:57 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:57 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=0b9882c649fc0196&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejJLXJpz4ySWqvh5HfMYlKsiKvf-LPIXv9o x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 f588325f7617672d954c4267c8bee1ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: m-VaiYN5U-OPwIRpf3GwotxTLfNzldvZqcIA2H9xll9TeiGRXPkXbw==
2024-02-08 18:35:57 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
379	192.168.2.5	50161	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:57 UTC	1015	OUT	GET /recaptcha/api.js?render=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&onload=onLoadRecaptchaV3Callback&_=1707417351908 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AJmcDEmmSVjhXu6iSND5nUlaG4u8jg9r3gIsM8fricsYrppd_RXehS30W8rvMgVb0KtN3BzkTFd51AiDyh7KnUA; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:57 UTC	528	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Thu, 08 Feb 2024 18:35:57 GMT Date: Thu, 08 Feb 2024 18:35:57 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:57 UTC	724	IN	Data Raw: 35 32 63 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 52c/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2024-02-08 18:35:57 UTC	607	IN	Data Raw: 69 4f 69 4a 6f 64 48 52 77 63 7a 6f 76 4c 32 64 76 62 32 64 73 5a 53 35 6a 62 32 30 36 4e 44 51 7a 49 69 77 69 5a 6d 56 68 64 48 56 79 5a 53 49 36 49 6b 52 70 63 32 46 69 62 47 56 55 61 47 6c 79 5a 46 42 68 63 6e 52 35 55 33 52 76 63 6d 46 6e 5a 56 42 68 63 6e 52 70 64 47 6c 76 62 6d 6c 75 5a 79 49 73 49 6d 56 34 63 47 6c 79 65 53 49 36 4d 54 63 79 4e 54 51 77 4e 7a 6b 35 4f 53 77 69 61 58 4e 54 64 57 4a 6b 62 32 31 68 61 57 34 69 4f 6e 52 79 64 57 55 73 49 6d 6c 7a 56 47 68 70 63 6d 52 51 59 58 4a 30 65 53 49 36 64 48 4a 31 5a 58 30 3d 27 3b 64 2e 68 65 61 64 2e 70 72 65 70 65 6e 64 28 6d 29 3b 70 6f 2e 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 78 35 57 Data Ascii: iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/x5W
2024-02-08 18:35:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
380	192.168.2.5	50163	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:57 UTC	3568	OUT	POST /js_tracking?aid=304142&pid=2c8482c2544201f4&ver=2&sid=5171fc655664ddf74ab763a094523fb7&ref_action=index&lang=en-us&stype=1&m=UmFuZG9tSVYkc2RlIyh9YYo1mfebd19Q2WIimWOyIN1gUe4_-JQdNOBTMuHuYCJPue7ik10LWViyRYmmf149m9vSAg2JJTyfAEk9RiEQZejXjro5rDJvxnq57UaGsDKd0iBXLkMuV2sFYEHSFmXZW5zvkIdbv7-B87Oi9zo36Fnq7AU8K4Y8Y-SdtsN1A2dfLiciDUxBuNe45QSxoxZcHhPcdr6v26QamVEbge_7LQ_MDhbvlSKq9Lwf9P11FwHzxPymBNBmu_dZFb8tK9Z3wY0RAyYm7D0hfdu-LCtv4j3isKKp1L_CiYhwCnyC42X_OqimTrSjKXCbKfd3YnkJbQ&etgwv=js_onload_resource_transfer_size%7C293&_=1707417355833 HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3JoFJ/d3+jTRbAw8j2g3DznWiIRblwWjQRtj/04PDlBt/o55ocKzBIQxZ/e0Rt7iMiaISeSKOQt; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.421694156.1707417338; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKAimfo93c2GrBDhhKwo6bWKuVj3PL8CFrhr0%2BqmCv4c3d%2B3eXrKgkJqKu4CkWInIJPix%2FdzGgLa83gGD4gcCULKAMcixtmqDHZCsf6fcT6zs4kfQG%2FWoSybhGedPUjj4dJwcO6Qa13VaaHS%2FcpWxeTdhj%2FM0ATu%2Bc%3D; lastSeen=0
2024-02-08 18:35:57 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:57 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=851782c64ceb002b&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejIUWlhuNkUFm8-pCDazVJAkGDJ53C-lCYg x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 31341771a4bfa40d7b1f61883ffb56c6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: KrFpvDVVjQsApb2JhiCRiUQ-UcTFsSgcinWBoNwoksWNhHc2fzeXEQ==
2024-02-08 18:35:57 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
381	192.168.2.5	50165	142.250.9.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:57 UTC	385	OUT	GET /gsi/fedcm.json HTTP/1.1 Host: accounts.google.com Connection: keep-alive Accept: application/json Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: webidentity User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:57 UTC	1088	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Expires: Thu, 08 Feb 2024 18:35:57 GMT Date: Thu, 08 Feb 2024 18:35:57 GMT Cache-Control: private, max-age=3600 Report-To: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]} Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Content-Security-Policy: script-src 'report-sample' 'nonce-KmERBgsVoSPuNfpc9zLU9A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:57 UTC	164	IN	Data Raw: 33 66 64 0d 0a 7b 22 69 64 74 6f 6b 65 6e 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 69 73 73 75 65 22 2c 20 22 69 64 5f 74 6f 6b 65 6e 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 69 73 73 75 65 22 2c 20 22 69 64 5f 61 73 73 65 72 74 69 6f 6e 5f 65 6e 64 70 6f 69 6e 74 22 Data Ascii: 3fd{"idtoken_endpoint": "https://accounts.google.com/gsi/fedcm/issue", "id_token_endpoint": "https://accounts.google.com/gsi/fedcm/issue", "id_assertion_endpoint"
2024-02-08 18:35:57 UTC	864	IN	Data Raw: 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 69 73 73 75 65 22 2c 20 22 61 63 63 6f 75 6e 74 73 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 6c 69 73 74 61 63 63 6f 75 6e 74 73 22 2c 20 22 63 6c 69 65 6e 74 5f 6d 65 74 61 64 61 74 61 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 63 6c 69 65 6e 74 6d 65 74 61 64 61 74 61 22 2c 20 22 63 6c 69 65 6e 74 5f 69 64 5f 6d 65 74 61 64 61 74 61 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 Data Ascii: : "https://accounts.google.com/gsi/fedcm/issue", "accounts_endpoint": "https://accounts.google.com/gsi/fedcm/listaccounts", "client_metadata_endpoint": "https://accounts.google.com/gsi/fedcm/clientmetadata", "client_id_metadata_endpoint": "https://account
2024-02-08 18:35:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
382	192.168.2.5	50162	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:57 UTC	676	OUT	GET /psb/capla/static/css/4e596c2c.3a2fb681.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "51be0c43cc481b13fe70d3ba27e2ffd9" If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
2024-02-08 18:35:57 UTC	514	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:35:57 GMT ETag: "51be0c43cc481b13fe70d3ba27e2ffd9" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: SFV4Wl1bGgrYBAvh1g48Ac217jtyPkYJ Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 c625b1bdde545acdeb26c9f6ad3a8c6e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 37aOh2Y86iQXjYveir8qazpl2jz9_YY3Ai67AHsDutYTF9Bjli8ALw== Age: 8917 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
383	192.168.2.5	50166	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:57 UTC	402	OUT	GET /static/opensearch/en-us/e19e3ca297c466eb18e0b783736192a638f6a66e.xml HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:57 UTC	767	IN	HTTP/1.1 200 OK Content-Type: text/xml Content-Length: 679 Connection: close Server: nginx Date: Mon, 05 Feb 2024 07:28:45 GMT Last-Modified: Wed, 10 Apr 2019 11:21:56 GMT ETag: "5cadd1d4-2a7" Expires: Wed, 06 Mar 2024 07:28:45 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 a1a074529ccb9ea97acd7d95c506f336.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: bAT9arLa7FP2zYjc87kTqUzGvvEyrYUU0PBJK7cpeo-RCUEZ-N5bmg== Age: 299232
2024-02-08 18:35:57 UTC	679	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 4f 70 65 6e 53 65 61 72 63 68 44 65 73 63 72 69 70 74 69 6f 6e 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 61 39 2e 63 6f 6d 2f 2d 2f 73 70 65 63 2f 6f 70 65 6e 73 65 61 72 63 68 2f 31 2e 31 2f 22 20 78 6d 6c 6e 73 3a 6d 6f 7a 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 32 30 30 36 2f 62 72 6f 77 73 65 72 2f 73 65 61 72 63 68 2f 22 3e 0a 3c 53 68 6f 72 74 4e 61 6d 65 3e 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 3c 2f 53 68 6f 72 74 4e 61 6d 65 3e 0a 3c 44 65 73 63 72 69 70 74 69 6f 6e 3e 6f 6e 6c 69 6e 65 20 68 6f 74 65 6c 20 72 65 73 65 72 76 61 74 69 6f 6e 73 3c 2f 44 65 73 63 72 69 70 74 69 6f 6e 3e 0a 3c 49 6d Data Ascii: <?xml version="1.0" encoding="UTF-8"?><OpenSearchDescription xmlns="http://a9.com/-/spec/opensearch/1.1/" xmlns:moz="http://www.mozilla.org/2006/browser/search/"><ShortName>Booking.com</ShortName><Description>online hotel reservations</Description><Im

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
384	192.168.2.5	50167	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:57 UTC	636	OUT	GET /d8c14d4960ca/a18a4859af9c/challenge.js HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-Modified-Since: Thu, 8 Feb 2024 18:35:46 +0000
2024-02-08 18:35:57 UTC	519	IN	HTTP/1.1 304 Not Modified Content-Type: text/javascript Connection: close Vary: Accept-Encoding Date: Thu, 08 Feb 2024 18:35:57 GMT cache-control: private, max-age=86400 last-modified: Thu, 8 Feb 2024 18:35:46 +0000 pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65c51f0d-6973e2bf0fbb23073604b56a X-Cache: Miss from cloudfront Via: 1.1 a12c29ca3e64ac2015cf4f6c9099b8ce.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: 6hhGVJjjQpvRZd-x368osJQABugXgjVksbr6iHnMtzyo_YmnCOCKrw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
385	192.168.2.5	50168	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:57 UTC	1514	OUT	GET /td/fls/rul/activityi;fledge=1;src=4228414;type=views;cat=views;ord=4050429631327;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=1884632172;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:35:57 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:57 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:57 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-08 18:35:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
386	192.168.2.5	50170	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:57 UTC	1455	OUT	GET /td/rul/988382855?random=1707417356533&cv=11&fst=1707417356533&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:35:57 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:57 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:57 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-08 18:35:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
387	192.168.2.5	50173	172.253.124.149	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:57 UTC	1390	OUT	GET /activity;src=4228414;type=views;cat=views;ord=4050429631327;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=1884632172;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:35:57 UTC	1332	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:57 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Location: https://ad.doubleclick.net/activity;dc_pre=CIu156ixnIQDFXji_QUdFZIKVQ;src=4228414;type=views;cat=views;ord=4050429631327;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=1884632172;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
388	192.168.2.5	50172	172.253.124.149	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:57 UTC	1485	OUT	GET /activity;register_conversion=1;src=4228414;type=views;cat=views;ord=4050429631327;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=1884632172;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: trigger, event-source;navigation-source Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:35:57 UTC	2216	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:57 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"6432892630366387804"}],"aggregatable_trigger_data":[{"filters":{"14":["11794238"]},"key_piece":"0x5bdccd6bd67d4e1c","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xa446ee5f5be5ef06","not_filters":{"14":["11794238"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["11794238"]},"key_piece":"0xd3325b43d3d15f8b","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x22c5b735c1232ea8","not_filters":{"14":["11794238"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"17667716434259013476","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"6432892630366387804","filters":{"14":["11794238"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"6432892630366387804","filters":{"14":["11794238"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"6432892630366387804","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"6432892630366387804","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["4228414"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sat, 09-Mar-2024 18:35:57 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
389	192.168.2.5	50176	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:57 UTC	1027	OUT	POST /pagead/landing?gcs=G1--&gcd=13l3l3l3l5&rnd=858995681.1707417357&url=https%3A%2F%2Fwww.booking.com%2F&dma=0&npa=0&gtm=45He4250n815Q664QZv79615461za200&auid=1592208705.1707417344 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:57 UTC	829	IN	HTTP/1.1 302 Found P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:57 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' Location: https://googleads.g.doubleclick.net/pagead/landing?gcs=G1--&gcd=13l3l3l3l5&rnd=858995681.1707417357&url=https%3A%2F%2Fwww.booking.com%2F&dma=0&npa=0&gtm=45He4250n815Q664QZv79615461za200&auid=1592208705.1707417344 X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:57 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
390	192.168.2.5	50174	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:57 UTC	2026	OUT	GET /td/rul/1060768846?random=1707417356687&cv=11&fst=1707417356687&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nh4qqVoyv2KiIad5kPNddW86jrjYgKSk8&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=page_type%3Dhome%3Bcheckindate%3D-1%3Bcheckoutdate%3D-1%3Bhotelid%3D0%3Bbook_window%3D%3Bweekday%3D-1%3Bdest_cc%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bnights%3D-1%3Brooms%3D-1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Bguestcount%3D-1%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdest_ufi%3D-1%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:35:57 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:57 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:57 UTC	606	IN	Data Raw: 33 65 61 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 6f 72 69 67 69 6e 2d 74 72 69 61 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 41 76 68 35 4e 79 30 58 45 46 43 79 51 37 2b 6f 4e 69 65 58 73 6b 55 72 71 59 38 65 64 55 7a 4c 35 2f 58 72 77 4b 6c 47 6a 41 52 51 48 57 34 54 46 52 4b 2b 6a 56 64 35 48 6e 44 49 70 59 32 30 6e 35 4f 4c 48 66 67 55 34 6b 75 37 78 34 38 4e 33 75 68 47 2f 41 30 41 41 41 42 78 65 79 4a 76 63 6d 6c 6e 61 57 34 69 4f 69 4a 6f 64 48 52 77 63 7a 6f 76 4c 32 52 76 64 57 4a 73 5a 57 4e 73 61 57 4e 72 4c 6d 35 6c 64 44 6f 30 4e 44 4d 69 4c 43 4a 6d 5a 57 46 30 64 58 4a 6c 49 6a 6f 69 55 48 4a 70 64 6d 46 6a 65 56 4e 68 62 6d 52 69 62 33 68 42 5a 48 4e 42 55 45 6c 7a 49 69 77 69 5a 58 68 77 61 Data Ascii: 3ea<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwa
2024-02-08 18:35:57 UTC	403	IN	Data Raw: 74 72 79 7b 69 66 28 69 2e 61 63 74 69 6f 6e 3d 3d 30 29 7b 6e 61 76 69 67 61 74 6f 72 2e 6a 6f 69 6e 41 64 49 6e 74 65 72 65 73 74 47 72 6f 75 70 28 69 2e 69 6e 74 65 72 65 73 74 47 72 6f 75 70 41 74 74 72 69 62 75 74 65 73 2c 69 2e 65 78 70 69 72 61 74 69 6f 6e 54 69 6d 65 49 6e 53 65 63 6f 6e 64 73 29 3b 7d 65 6c 73 65 20 69 66 28 69 2e 61 63 74 69 6f 6e 3d 3d 31 29 7b 6e 61 76 69 67 61 74 6f 72 2e 6c 65 61 76 65 41 64 49 6e 74 65 72 65 73 74 47 72 6f 75 70 28 69 2e 69 6e 74 65 72 65 73 74 47 72 6f 75 70 41 74 74 72 69 62 75 74 65 73 29 3b 7d 7d 63 61 74 63 68 28 65 29 7b 6e 61 76 69 67 61 74 6f 72 2e 73 65 6e 64 42 65 61 63 6f 6e 28 60 68 74 74 70 73 3a 2f 2f 70 61 67 65 61 64 32 2e 67 6f 6f 67 6c 65 73 79 6e 64 69 63 61 74 69 6f 6e 2e 63 6f 6d 2f 70 Data Ascii: try{if(i.action==0){navigator.joinAdInterestGroup(i.interestGroupAttributes,i.expirationTimeInSeconds);}else if(i.action==1){navigator.leaveAdInterestGroup(i.interestGroupAttributes);}}catch(e){navigator.sendBeacon(`https://pagead2.googlesyndication.com/p
2024-02-08 18:35:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
391	192.168.2.5	50171	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:57 UTC	3342	OUT	POST /navigation_times HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 503 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/x-www-form-urlencoded X-Booking-CSRF: RVfFZQAAAAA=qVueflVyIcgKOJdfCMKcmiDGjvY9UqM_W79drieypCCd1wLxtNOjZPcMNKEslcD0Tiyh8b7rdIv86FT89bynmubUkLo31LJ5cM248yQm3ulKZFWN-WKHCjXqy964TaJvn5A_S7b4oaNG1jhNZ7aGF2JNPgwXGQBCPiOREYDFBwUwhotUpEosEVmLfdyz_vXpYSXlaaCHZibCaVWm sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3JoFJ/d3+jTRbAw8j2g3DznWiIRblwWjQRtj/04PDlBt/o55ocKzBIQxZ/e0Rt7iMiaISeSKOQt; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.421694156.1707417338; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKAimfo93c2GrBDhhKwo6bWKuVj3PL8CFrhr0%2BqmCv4c3d%2B3eXrKgkJqKu4CkWInIJPix%2FdzGgLa83gGD4gcCULKAMcixtmqDHZCsf6fcT6zs4kfQG%2FWoSybhGedPUjj4dJwcO6Qa13VaaHS%2FcpWxeTdhj%2FM0ATu%2Bc%3D; lastSeen=0
2024-02-08 18:35:57 UTC	503	OUT	Data Raw: 72 65 66 5f 61 63 74 69 6f 6e 3d 69 6e 64 65 78 26 70 69 64 3d 32 63 38 34 38 32 63 32 35 34 34 32 30 31 66 34 26 73 74 79 70 65 3d 31 26 6c 61 6e 67 3d 65 6e 26 66 69 72 73 74 3d 30 26 63 68 3d 64 26 62 6f 3d 33 26 61 69 64 3d 33 30 34 31 34 32 26 63 73 73 5f 6c 6f 61 64 3d 31 26 63 64 6e 3d 63 66 26 64 63 3d 34 26 6e 74 73 3d 30 25 32 43 30 25 32 43 31 37 30 37 34 31 37 33 34 38 34 31 38 25 32 43 30 25 32 43 30 25 32 43 30 25 32 43 30 25 32 43 31 37 30 37 34 31 37 33 34 38 34 32 31 25 32 43 31 37 30 37 34 31 37 33 34 38 34 36 33 25 32 43 31 37 30 37 34 31 37 33 34 38 34 36 33 25 32 43 31 37 30 37 34 31 37 33 34 38 34 36 33 25 32 43 31 37 30 37 34 31 37 33 34 38 37 31 33 25 32 43 31 37 30 37 34 31 37 33 34 38 34 36 35 25 32 43 31 37 30 37 34 31 37 33 34 Data Ascii: ref_action=index&pid=2c8482c2544201f4&stype=1&lang=en&first=0&ch=d&bo=3&aid=304142&css_load=1&cdn=cf&dc=4&nts=0%2C0%2C1707417348418%2C0%2C0%2C0%2C0%2C1707417348421%2C1707417348463%2C1707417348463%2C1707417348463%2C1707417348713%2C1707417348465%2C170741734
2024-02-08 18:35:58 UTC	1032	IN	HTTP/1.1 202 Accepted Content-Type: image/jpeg Content-Length: 0 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:58 GMT set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3UgBcvDN2nanV89DesY1vDJpOQG2w5rJXkyq57Fey6ZSnz8XrWS2PFhwhI9Cne4k7CcBnpWWdHk8d9T9HbjGeIc4G5Q%2BiRnb9gzMbtE1%2FYlnt%2BY5fPPq4oxRh3ozHHssIBpfaWe4ho6NxYEhWlBm7qbD3YA0TwWMwA%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:58 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=31d782c677b80165&e=UmFuZG9tSVYkc2RlIyh9YfnWSDpdIwKzDzbKZoiCiJvcvqcRuFqsxxT-IqsU5IW6l1y2UKp-qns x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 c625b1bdde545acdeb26c9f6ad3a8c6e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: AyRPNNKCubGNCPuuQYx0YHR3pvp0DLU_nDXYhVRo4fthdnCdzsbPpg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
392	192.168.2.5	50177	64.233.185.99	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:57 UTC	390	OUT	GET /.well-known/web-identity HTTP/1.1 Host: www.google.com Connection: keep-alive Accept: application/json Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: webidentity User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:57 UTC	651	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: application/json Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 78 Date: Thu, 08 Feb 2024 18:35:57 GMT Expires: Fri, 09 Feb 2024 18:35:57 GMT Cache-Control: public, max-age=86400 Last-Modified: Fri, 23 Jun 2023 19:00:00 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:57 UTC	78	IN	Data Raw: 7b 0a 20 20 22 70 72 6f 76 69 64 65 72 5f 75 72 6c 73 22 3a 20 5b 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2e 6a 73 6f 6e 22 0a 20 20 5d 0a 7d 0a Data Ascii: { "provider_urls": [ "https://accounts.google.com/gsi/fedcm.json" ]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
393	192.168.2.5	50182	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:57 UTC	1454	OUT	GET /td/rul/973712236?random=1707417356716&cv=11&fst=1707417356716&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:35:58 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:58 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:58 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-08 18:35:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
394	192.168.2.5	50179	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:57 UTC	1454	OUT	GET /td/rul/973712236?random=1707417356745&cv=11&fst=1707417356745&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:35:58 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:58 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:58 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-08 18:35:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
395	192.168.2.5	50183	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:57 UTC	4545	OUT	GET /pr_ue?action=index&dest_ufi=-1&user_location=us&ttv_uc=undefined&date_in=-1&date_out=-1&rooms=-1&nights=-1&hr=-1&rid=undefined&p1=undefined&adults=-1&children=-1&city_name=-1&country_name=-1&dest_name=-1&region_name=-1&dest_cc=-1&dest_id=-1&dest_type=-1&lang=en-us&ai=304142&preferred_neighborhoods=undefined&preferred_star_ratings=undefined&seed=Pqit_vbiva0hUfw7CE5adQ&site=bookings2&sid=5171fc655664ddf74ab763a094523fb7&channel_id=3&exp_andy=undefined&stid=304142&exp_rmkt_test=global_on&famem=-1&famfn=-1&fampn=-1&logged_in=0&genis=&gwcur=-1&gwcuc=-1&bem=0&bip=0&book_window=&travel_type=unknown&currency=USD&em_sent=undefined&fn_sent=undefined&pn_sent=undefined&cv=-1&sage=18&atnm=&atnm_en=&pt_en=&cul=-1&mnns=-1&zz_val_eur=EUR&zz_look_action2id=undefined&zz_generic_id=undefined&zz_generic_id2=undefined&cip=81.181.57.74&cua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F117.0.0.0%20Safari%2F537.36&tms=gtm&sid_dyna=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000&rmk_var=-1&euuid=6271f1cf-d4aa-43a2-8f7e-6faa7f4000b0&gcem=-1&gcpn=-1&pguai=undefined&ttv=undefined&iamlt=&fbc=undefined&fbp=-1&msclid=undefined&pcid=3&bizp=&istnb=0&genisb=0&as=0&genaspb=1&p=https%3A%2F%2Fwww.booking.com%2F&r=&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAKFvpSuBsACAdICJDdhNmRhMmNiLThiNjMtNDQ1OS04MGUwLTI1OGM3NjBkNWQzMdgCBeACAQ&rbda=-1&tcl=undefined&cto_pld=undefined&cgumid=undefined&gtmcb=895809361 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.0.1707417345.60.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _ga_A12345=GS1.1.1707417345.1.0.1707417345.0.0.0; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3JoFJ/d3+jTRbAw8j2g3DznWiIRblwWjQRtj/04PDlBt/o55ocKzBIQxZ/e0Rt7iMiaISeSKOQt; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.421694156.1707417338; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKAimfo93c2GrBDhhKwo6bWKuVj3PL8CFrhr0%2BqmCv4c3d%2B3eXrKgkJqKu4CkWInIJPix%2FdzGgLa83gGD4gcCULKAMcixtmqDHZCsf6fcT6zs4kfQG%2FWoSybhGedPUjj4dJwcO6Qa13VaaHS%2FcpWxeTdhj%2FM0ATu%2Bc%3D; lastSeen=0
2024-02-08 18:35:58 UTC	651	IN	HTTP/1.1 202 Accepted Content-Length: 0 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:58 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=c35082c7bef002df&e=UmFuZG9tSVYkc2RlIyh9YdbeSVtWvtI5AKtW4AZZtgfcdLtDUGcHjmmgQD_TfmXHFkAILcxDqCVRis-IhdZ3Ng x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 e268ddb03ed9480c5c602c27323a81ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: S3mTDwJPtERjJa_zoG2Il4bQa0fBq65sVJKBoRguD3VRRAvxdOu5IA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
396	192.168.2.5	50181	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:57 UTC	1454	OUT	GET /td/rul/975716499?random=1707417356784&cv=11&fst=1707417356784&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:35:58 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:58 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:58 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-08 18:35:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
397	192.168.2.5	50186	216.239.38.21	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:58 UTC	3029	OUT	GET /g/collect?v=2&tid=G-A12345&gtm=45je4250z879615461za200&_p=1707417355756&gcs=G1--&gcd=13l3l3l3l5&npa=0&dma=0&cid=421694156.1707417338&ul=en-us&sr=1280x1024&ur=US-FL&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pscdl=noapi&sst.uc=US&sst.rnd=858995681.1707417357&sst.gcd=13l3l3l3l5&sst.tft=1707417355756&_s=1&sid=1707417345&sct=1&seg=1&dl=https%3A%2F%2Fwww.booking.com%2F&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=8579&richsstsse HTTP/1.1 Host: gtm-mktg.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKAimfo93c2GrBDhhKwo6bWKuVj3PL8CFrhr0%2BqmCv4c3d%2B3eXrKgkJqKu4CkWInIJPix%2FdzGgLa83gGD4gcCULKAMcixtmqDHZCsf6fcT6zs4kfQG%2FWoSybhGedPUjj4dJwcO6Qa13VaaHS%2FcpWxeTdhj%2FM0ATu%2Bc%3D; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0
2024-02-08 18:35:58 UTC	566	IN	HTTP/1.1 200 OK Content-Type: text/plain Vary: Accept-Encoding set-cookie: FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; Max-Age=63072000; Domain=booking.com; Path=/; Secure; HttpOnly cache-control: no-cache x-content-type-options: nosniff access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true X-Cloud-Trace-Context: 180570b4b0bb01bac676254c1a85bc3f Date: Thu, 08 Feb 2024 18:35:58 GMT Server: Google Frontend Content-Length: 65 Expires: Thu, 08 Feb 2024 18:35:58 GMT Connection: close
2024-02-08 18:35:58 UTC	65	IN	Data Raw: 65 76 65 6e 74 3a 20 6d 65 73 73 61 67 65 0a 64 61 74 61 3a 20 7b 22 72 65 73 70 6f 6e 73 65 22 3a 7b 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 62 6f 64 79 22 3a 22 22 7d 7d 0a 0a Data Ascii: event: messagedata: {"response":{"status_code":200,"body":""}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
398	192.168.2.5	50189	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:58 UTC	1454	OUT	GET /td/rul/975716499?random=1707417356815&cv=11&fst=1707417356815&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:35:58 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:58 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:58 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-08 18:35:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
399	192.168.2.5	50188	3.161.193.117	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:58 UTC	387	OUT	OPTIONS /report HTTP/1.1 Host: nellie.booking.com Connection: keep-alive Origin: https://cf.bstatic.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:58 UTC	557	IN	HTTP/1.1 204 No Content Content-Type: text/html Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:58 GMT allow: POST, OPTIONS access-control-allow-headers: content-type access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 d3b019645d09c89af6e150e75be90942.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P8 X-Amz-Cf-Id: NxVsMCJWh0FpKbDvxyTIqnY43L2NhvjHzz4a-zZup0Lc7j-3eQNyFA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
400	192.168.2.5	50187	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:58 UTC	919	OUT	GET /cm/i?pid=54f04dd9-4d34-47ee-87a6-989713215c80&u_scsid=224e9da2-3ebe-4de0-94ba-0d5d22c95b7f&u_sclid=75022d4d-ae50-4a02-8ab1-d3d7e0695f9e HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:35:58 UTC	454	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:35:58 GMT content-type: text/html strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
401	192.168.2.5	50191	64.233.185.138	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:58 UTC	616	OUT	HEAD / HTTP/1.1 Host: www3.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:58 UTC	474	IN	HTTP/1.1 301 Moved Permanently Location: https://marketingplatform.google.com/about/enterprise/ Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Server: sffe Content-Length: 251 X-XSS-Protection: 0 Date: Thu, 08 Feb 2024 18:14:42 GMT Expires: Thu, 08 Feb 2024 18:44:42 GMT Cache-Control: public, max-age=1800 Content-Type: text/html; charset=UTF-8 Age: 1276 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
402	192.168.2.5	50192	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:58 UTC	1633	OUT	GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e&u_sclid=75022d4d-ae50-4a02-8ab1-d3d7e0695f9e&u_scsid=224e9da2-3ebe-4de0-94ba-0d5d22c95b7f&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&df=true&huah=true&m_dcl=4806&m_fcps=3239&m_pi=4770&m_pl=7436&m_pv=2&m_rd=8600&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&trackId=42b0a81f-b07d-418a-b96a-d1b9785bfcee&ts=1707417357018&v=3.9.1-2402072137 HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:35:58 UTC	526	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:35:58 GMT access-control-allow-origin: * cache-control: no-cache, no-transform content-type: image/png strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 68 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:58 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 0b 49 44 41 54 78 da 63 60 00 02 00 00 05 00 01 e9 fa dc d8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxc`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
403	192.168.2.5	50193	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:58 UTC	613	OUT	GET /config/com/54f04dd9-4d34-47ee-87a6-989713215c80.js?v=3.9.1-2402072137 HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:58 UTC	564	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:35:58 GMT access-control-allow-origin: https://www.booking.com content-type: application/javascript strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 186 x-envoy-upstream-service-time: 36 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:58 UTC	186	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 72 79 7b 77 69 6e 64 6f 77 2e 73 6e 61 70 74 72 2e 63 66 67 28 27 35 34 66 30 34 64 64 39 2d 34 64 33 34 2d 34 37 65 65 2d 38 37 61 36 2d 39 38 39 37 31 33 32 31 35 63 38 30 27 2c 7b 22 61 73 63 22 3a 5b 5d 2c 22 61 22 3a 5b 22 50 49 49 22 2c 22 41 56 33 22 5d 2c 22 69 70 67 22 3a 22 34 30 22 2c 22 62 22 3a 5b 5d 2c 22 74 22 3a 22 22 2c 22 76 22 3a 22 33 2e 37 2e 35 2d 32 34 30 31 30 33 32 33 34 37 22 2c 22 65 63 22 3a 5b 5d 7d 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 28 29 3b Data Ascii: !function(){"use strict";try{window.snaptr.cfg('54f04dd9-4d34-47ee-87a6-989713215c80',{"asc":[],"a":["PII","AV3"],"ipg":"40","b":[],"t":"","v":"3.7.5-2401032347","ec":[]})}catch(e){}}();

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
404	192.168.2.5	50194	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:58 UTC	688	OUT	GET /xdata/images/xphoto/2880x868/308526620.jpeg?k=0663a1420ea98a013af0eda32bb4d11258521a39c5b8a5a4e2777ee5661dee55&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:58 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Tue, 06 Feb 2024 08:27:05 GMT ETag: "b9a8ca902a668d150d71f3c9f7a5cc2e4159dddf" Content-Language: 245767 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 711d3c800952edc1dd6cabc0c877aa5a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: ZbbySsXGspKTjHc-lQ2RciyYIp8PmsNWUZ3wxZ9Picqy3Dp-39HZOQ== Age: 209333
2024-02-08 18:35:58 UTC	16384	IN	Data Raw: 31 36 61 33 31 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 03 64 0b 40 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 Data Ascii: 16a31JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222d@"}!1AQa"
2024-02-08 18:35:58 UTC	16384	IN	Data Raw: 2c 10 fb 57 05 6d 11 69 86 07 41 5d c6 8c 0f f6 78 07 ad 7a 59 64 ff 00 7d 63 ca cd 61 7a 17 24 d4 ce db 19 48 fe ed 79 76 a5 0b 34 b2 31 3d 39 1f 5a f5 0d 5f 8d 3e 4f 71 5e 75 7a 81 2e 53 b8 27 9c d2 cd 65 fb d4 87 94 c7 f7 4d 99 f1 e0 e0 e7 3e a2 90 9d d8 f9 76 8c d4 e9 6c d2 49 b9 f0 a8 3a 62 a7 6b 62 23 8f fb bb bb d7 0c 27 78 b3 d1 92 f7 91 d7 78 28 7f c4 b6 53 9c 8c f5 ae 9f b5 61 f8 5e 21 16 9a c0 0c 73 5b bd fd ab e9 70 4f f7 28 f9 4c 6f f1 e4 84 a2 9d 8a 2b a8 e5 1b 4b 8a 00 a7 62 8b 80 da 29 48 a0 71 45 c0 4c 62 8a 77 5a 28 01 a0 66 9d 8e 28 c5 2d 20 13 14 53 a8 c5 21 8d a5 c0 a5 c5 25 03 17 00 0a 50 05 1d a8 14 00 9d 28 14 ec 51 8a 06 25 2d 2d 02 80 13 14 53 a8 a4 03 68 a7 51 8a 06 25 14 b8 a5 c5 00 37 14 62 9d 8a 31 48 2c 36 8a 75 18 a0 2c 36 Data Ascii: ,WmiA]xzYd}caz$Hyv41=9Z_>Oq^uz.S'eM>vlI:bkb#'xx(Sa^!s[pO(Lo+Kb)HqELbwZ(f(- S!%P(Q%--ShQ%7b1H,6u,6
2024-02-08 18:35:58 UTC	16384	IN	Data Raw: d1 5f 79 f2 27 55 03 20 f5 c9 fc ab 97 bd f1 0e a9 e2 e7 91 da 6f b2 69 f9 f9 52 2e 19 a8 e4 65 73 a3 bc bb f1 b4 93 cf e4 5a ac 6a bd d9 9c 56 46 a3 65 6d ab fe f2 5b f8 bc e1 ce d0 c2 b8 fd 03 45 fe da d4 3c 8b 50 ee c3 aa ca d5 d4 5c 78 52 ce d1 9a 3b 98 9e 09 02 f0 62 6e a7 f0 ad 63 49 33 29 57 6b a1 8d 2c 52 e9 b3 6d 73 f2 9e dd 8d 57 bd 81 1d 3e d1 6d f2 af f1 20 a6 ea 57 52 da 59 5d e9 b2 e6 7b a4 ff 00 54 c7 92 32 38 35 cf e9 1a b4 c8 e6 de e9 8a 4c 38 c9 fe 2a 1c 6d b1 2a 7c db 93 b4 a1 64 de a7 03 b8 aa b7 0e 12 4c ff 00 0b 55 cb d8 c1 cb aa ed 94 f5 1d 8d 66 5c 3b 79 7b 4a d0 a4 27 11 ad 2f 93 20 60 01 5c e6 ba 1d 17 50 0f 36 19 82 86 c8 3e fe 95 cb c8 77 c4 15 ba 52 d8 cc d1 c9 82 70 47 dd a2 a2 ba 4d 0a 1b b4 cf a1 3c 21 7c 6f 34 63 1b 9c b4 Data Ascii: _y'U oiR.esZjVFem[E<P\xR;bncI3)Wk,RmsW>m WRY]{T285L8m\|dLUf\;y{J'/ `\P6>wRpGM<!\|o4c
2024-02-08 18:35:58 UTC	16384	IN	Data Raw: 56 d8 4d 61 88 57 89 d5 83 92 52 d4 c9 d4 b8 b6 f3 3b 1a cc 81 5a 48 c9 03 8c 66 b7 6e 6c cc da 56 de e0 54 3a 5d b0 6b 5e 07 20 e0 d7 93 26 d6 87 b6 95 f5 2a 5b 59 c9 39 55 23 a9 e2 bd 13 42 d2 c6 99 a7 82 47 ef 9f 96 35 43 c3 da 40 69 cc d2 0f 94 74 ae 92 53 c6 07 4e 95 e8 e1 29 34 b9 99 e5 63 2b 26 f9 62 73 da dc 46 ee 16 80 0c 86 e0 8a e1 b5 bd 3c 5a 68 d3 46 c3 1b 4e 54 9a f5 14 b6 0c e7 23 27 b5 73 fe 2c d1 8d dd 99 8d 17 96 23 ff 00 af 5d 35 61 cc 8e 5a 53 e5 67 89 e9 16 52 6a 17 a5 79 20 64 9c 7e 95 67 57 d1 3c 90 4a 82 06 d0 48 af 45 d1 3c 28 ba 63 49 23 2f 2c 3d 2b 98 f1 c4 8b 60 8a 07 f1 71 58 f2 25 03 7e 7e 69 1c 7d b4 8b 6a a2 38 c0 dd 5a 76 bf bc 61 bb 39 15 8f a5 46 6e f5 00 7b 05 ae c2 c3 4f 66 29 f2 f0 c6 b3 84 2e c7 39 59 16 34 cb 49 8b Data Ascii: VMaWR;ZHfnlVT:]k^ &*[Y9U#BG5C@itSN)4c+&bsF<ZhFNT#'s,#]5aZSgRjy d~gW<JHE<(cI#/,=+`qX%~~i}j8Zva9Fn{Of).9Y4I
2024-02-08 18:35:58 UTC	16384	IN	Data Raw: 3e 56 0c 19 5b d0 52 9f 94 d4 16 b2 db dc 40 0c 2c 19 14 63 22 a6 c1 3d 6b de 84 b9 a2 99 e2 49 59 d8 5c 66 90 9c 71 47 43 46 2a c4 27 4a 28 e6 96 81 0d a5 14 bd 69 0d 00 14 51 9a 33 40 06 28 a2 83 40 82 90 d2 8e 69 0d 00 14 51 45 30 0a 33 8a 28 c5 00 00 d0 68 e0 52 50 02 1c d0 05 2d 2e 28 01 08 e6 92 9d 49 c5 00 14 1a 28 34 00 98 27 bd 1d 3a d1 93 da 83 9c 50 06 7d 02 93 14 e5 ad ce 41 33 8a 4c d3 ba 1a 5c 0c d0 00 28 34 77 a5 a0 06 8c f7 a5 a0 93 de 93 a9 a0 05 a5 ed 48 78 1c 51 9c f4 a0 62 53 b8 c5 27 4f ad 18 a0 00 0a 4c 52 d3 85 17 10 dc 0a 4c 1c d3 80 c9 a5 ef 8a 06 36 94 1e 79 a0 ad 2e 38 a0 62 13 cf 14 b4 71 45 20 0c 91 47 d2 9d 8e 29 01 c1 a0 03 34 1e 68 e7 da 94 0a 00 40 29 71 cd 27 43 4f ed 40 0c 61 e9 40 1e b4 51 d6 90 07 53 8a 5c 52 74 a5 a0 Data Ascii: >V[R@,c"=kIY\fqGCF*'J(iQ3@(@iQE03(hRP-.(I(4':P}A3L\(4wHxQbS'OLRL6y.8bqE G)4h@)q'CO@a@QS\Rt
2024-02-08 18:35:59 UTC	10810	IN	Data Raw: 1d 28 fc 28 01 3b 52 77 a7 53 7b d3 01 79 a2 93 3c d2 91 40 06 69 73 9a 6d 3a 80 1a 47 34 51 de 8c d0 20 a2 80 68 34 00 76 a3 b5 07 a5 00 d0 30 a4 a5 34 94 00 52 f1 de 8a 28 01 46 73 cd 1d e8 14 77 a0 03 b5 1d a8 a3 b5 00 25 2d 20 e6 81 40 0b 40 34 52 d0 02 60 51 48 41 f5 a5 1c 50 02 77 a5 ed 41 a3 ad 00 2f 6a 4a 33 45 00 14 51 49 8f 7a 00 33 9e 29 57 e5 a4 e9 4a 79 a0 00 f0 69 33 4a 79 34 98 a0 05 e6 8c 62 8a 43 9f 5a 06 28 eb 41 eb 40 38 a5 eb cd 00 25 2e 29 33 cd 2e 69 00 94 52 9a 4a 00 50 31 d6 8e 29 39 34 bd a8 00 a2 8a 31 40 05 28 34 99 a5 ce 3b 50 01 93 9a 5e b4 03 45 00 18 c5 14 67 9a 29 00 a4 53 4f 1d 28 cd 2f 6a 00 4c 66 94 f4 a4 ce 68 c7 bd 30 12 8a 5c f1 8c 51 8a 00 05 14 74 a2 80 01 8a 5e 28 20 0a 4c 8a 00 28 a0 52 e2 81 0b 49 9c 02 5b f4 a5 Data Ascii: ((;RwS{y<@ism:G4Q h4v04R(Fsw%- @@4R`QHAPwA/jJ3EQIz3)WJyi3Jy4bCZ(A@8%.)3.iRJP1)941@(4;P^Eg)SO(/jLfh0\Qt^( L(RI[
2024-02-08 18:35:59 UTC	16384	IN	Data Raw: 39 31 38 33 0d 0a a7 88 2e 75 88 92 39 63 55 d8 78 ac 86 90 76 34 6f c0 e0 f3 49 d5 6d 6a 54 69 28 bd 04 58 1e 52 db cf 3e d5 ab 77 18 86 28 e3 c6 7f 76 0f e9 59 f1 48 4b aa 83 cb 1c 55 ed 46 52 07 5e 55 71 5c 55 9d d1 db 87 f8 8c 0b 99 36 90 81 79 66 18 fc 2a 66 76 59 97 9c f1 50 93 e6 49 01 3e a4 d5 94 5d f7 27 23 a0 ac de 88 eb dc e8 fc 19 96 92 ed 9b 82 b1 0a ea ec 61 0d a6 48 0f 5d b5 cc 68 02 2b 1d 32 f6 f1 8f 61 fa 9a ea b4 82 25 b1 e0 e7 2b 5c 15 37 3b a8 bf 70 f3 7d 78 84 b8 6c 74 ac a5 70 b2 c6 47 a5 6d 78 86 3c dc 95 c7 6a c4 0a 43 c7 9e 95 db 4b e1 38 a5 f1 17 6d 58 7d a9 49 39 1d eb d2 7c 1b a9 8f 22 5b 77 e1 55 81 1f 4a f3 68 5c c7 78 a0 0e 0d 7a 37 81 a3 59 65 b9 56 1d ab 9e b1 bc 1a e5 3b 57 7c c6 31 e9 4c 81 58 c8 dc 75 42 29 91 ee 86 52 Data Ascii: 9183.u9cUxv4oImjTi(XR>w(vYHKUFR^Uq\U6yf*fvYPI>]'#aH]h+2a%+\7;p}xltpGmx<jCK8mX}I9\|"[wUJh\xz7YeV;W\|1LXuB)R
2024-02-08 18:35:59 UTC	16384	IN	Data Raw: f4 ae 5e 68 18 6a 8e a0 60 87 26 bd 28 5b 46 61 e4 9e a2 b8 9b 88 31 af 4f b4 67 0c 45 29 2d 06 6d 5b 26 fb 60 56 3f 30 ec 1b 89 ec 6a 3d 1e f8 69 5a b3 96 5c 82 3a 7a 56 84 76 cc 2d 06 f7 11 a6 39 00 f2 6b 9d d6 25 8e ca 37 b8 83 71 78 c7 71 d6 9c b6 03 b8 1e 26 84 8f f5 74 7f c2 4d 0f fc f2 fc ce 2b c7 13 c7 b2 80 80 a2 67 3f 37 14 f1 e3 ef 98 fe e4 30 f5 ac ee 07 af ff 00 c2 4d 0f fc f2 1f f7 d5 1f f0 92 c5 ff 00 3c 87 fd f5 5e 42 be 3f 5d db 4d b9 27 dc 62 9c 3c 7d 1e e1 9b 42 05 3b 81 eb 9f f0 92 c5 ff 00 3c 87 fd f5 4a 7c 4b 11 1c c2 a7 fe 05 5e 56 de 32 71 01 98 69 e4 c6 3b e6 98 3c 77 19 8c 17 b0 23 3f ed 51 a0 1e 93 79 aa db 5c ae 52 30 b2 7b 56 44 f7 73 b2 14 03 a8 c6 6b 8b 5f 1e 5b 1c af d8 db db 0d 53 7f c2 6d 6a 23 19 b6 90 37 e3 4f 41 1b d1 Data Ascii: ^hj`&([Fa1OgE)-m[&`V?0j=iZ\:zVv-9k%7qxq&tM+g?70M<^B?]M'b<}B;<J\|K^V2qi;<w#?Qy\R0{VDsk_[Smj#7OA
2024-02-08 18:35:59 UTC	4491	IN	Data Raw: 5f c6 a3 11 b9 1f 5a 7a da 5d ca e8 64 52 3e 6c 9a d2 f2 6e cf 1b d3 14 be 5d e0 27 32 8e 9c 50 3b b2 6d 3d 80 92 41 ce 45 5c 2c 49 aa 96 91 3c 40 99 08 cb 75 ab 5c 7a d0 22 50 40 19 ac bd 65 0b c0 08 f5 eb 5a 01 c0 5c 77 ac dd 5e 52 b6 fc 54 cb 60 5b 8c b8 bc b7 7d 3d 62 67 2f b5 07 5f 5a a7 25 94 b1 c2 93 48 78 3f 77 d6 ab 40 f1 ef 0d 28 f9 47 6a bd 77 74 9a ad d6 44 82 18 10 e0 03 dc 57 2b 8b 4e e5 32 94 f1 f9 5b 9b 2b 82 3b 54 04 e7 1c 74 a9 af bc 95 ba 31 c5 97 5e 9b bb 66 a1 90 e0 9f 50 39 ad a0 d1 0c 7a e7 a9 ad 9d 0d 37 5f a0 f6 26 b1 a2 24 9d ac 2b 6f 44 c8 9e 59 00 fb 91 b5 15 15 a0 ec 6b 41 7b e8 b9 32 90 f2 8c 65 41 3c 7d 7a 56 6c 4a 5e fd 63 6e 0a 8c d6 9c b2 66 3d d9 fb c5 49 aa 30 9f 37 54 91 95 72 71 8a e1 89 ea 4b 62 ec 31 92 84 93 95 2f Data Ascii: _Zz]dR>ln]'2P;m=AE\,I<@u\z"P@eZ\w^RT`[}=bg/_Z%Hx?w@(GjwtDW+N2[+;Tt1^fP9z7_&$+oDYkA{2eA<}zVlJ^cnf=I07TrqKb1/
2024-02-08 18:35:59 UTC	16384	IN	Data Raw: 31 63 34 35 33 0d 0a 18 13 9a 6a c6 5c 93 d2 a6 5b 62 cb d6 a7 8d 11 10 ef ce 7d a9 b7 61 58 a8 9e 58 01 73 ce 6a 56 00 10 16 82 88 06 e2 31 f5 a8 dd f6 fc cb cd 35 a8 17 d6 35 75 50 0e 1b bd 43 72 9b 1c 2e 73 8a a4 26 70 c0 82 6a 45 2f b8 bb 1d df 5a 4d 58 3a 95 d9 8a ce 49 1c 53 d8 16 21 80 c0 aa ed 26 64 dc 7a e7 a5 5a 76 3b 78 e0 62 88 44 d2 61 bb e5 e0 73 46 43 63 34 c0 d8 00 1e fd e9 47 de e2 b5 b1 98 38 00 f1 46 32 29 c4 f3 8c 52 05 e3 34 ec 26 33 73 03 81 4e f9 88 ed 46 de 68 18 ce 0f 14 58 42 60 e3 b5 34 a6 57 ad 4d b0 30 f4 a8 c4 78 73 d4 8a 06 34 0e 38 15 95 ab c1 3b c7 ba 14 05 8a 9c e6 b5 2e 2e 52 d2 32 64 04 03 d0 d4 36 2c f7 62 46 90 ed 4e 8a 2b 8f 11 52 29 59 9a c2 2e e7 11 6d 35 c6 9f 28 31 31 0e 5b 91 5d fd 85 d4 72 69 a2 7f 33 7b 81 f3 Data Ascii: 1c453j\[b}aXXsjV155uPCr.s&pjE/ZMX:IS!&dzZv;xbDasFCc4G8F2)R4&3sNFhXB`4WM0xs48;..R2d6,bFN+R)Y.m5(11[]ri3{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
405	192.168.2.5	50196	172.253.124.149	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:58 UTC	1424	OUT	GET /activity;dc_pre=CIu156ixnIQDFXji_QUdFZIKVQ;src=4228414;type=views;cat=views;ord=4050429631327;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=1884632172;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:35:58 UTC	1277	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:58 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Location: https://adservice.google.com/ddm/fls/z/dc_pre=CIu156ixnIQDFXji_QUdFZIKVQ;src=4228414;type=views;cat=views;ord=4050429631327;npa=0;auiddc=*;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=1884632172;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
406	192.168.2.5	50197	3.161.193.117	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:58 UTC	330	OUT	POST /report HTTP/1.1 Host: nellie.booking.com Connection: keep-alive Content-Length: 452 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:58 UTC	452	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 33 32 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 37 39 33 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 38 2e 31 33 38 2e 36 34 2e 31 36 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 74 79 70 65 22 3a 22 61 62 61 6e 64 6f 6e 65 64 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 63 66 2e 62 73 74 61 74 69 63 2e 63 6f 6d 2f 73 Data Ascii: [{"age":32,"body":{"elapsed_time":793,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"108.138.64.16","status_code":200,"type":"abandoned"},"type":"network-error","url":"https://cf.bstatic.com/s
2024-02-08 18:35:58 UTC	389	IN	HTTP/1.1 204 No Content Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:58 GMT strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 f7d8aa9f8887673e75fcf6c12b2312f6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P8 X-Amz-Cf-Id: LsqMGLGB4HDDTWSjYKAxN9kcYMjonGjuDG4JhL-4HNDu8zkIrLK78g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
407	192.168.2.5	50199	142.250.9.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:58 UTC	576	OUT	GET /gsi/fedcm/listaccounts HTTP/1.1 Host: accounts.google.com Connection: keep-alive Accept: application/json Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: webidentity User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:58 UTC	1300	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 08 Feb 2024 18:35:58 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt Report-To: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]} Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1" Content-Security-Policy: script-src 'report-sample' 'nonce-IDdNPGsP2kPspC9Blt9cBw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Cross-Origin-Resource-Policy: same-site Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:58 UTC	20	IN	Data Raw: 66 0d 0a 7b 22 61 63 63 6f 75 6e 74 73 22 3a 5b 5d 7d 0d 0a Data Ascii: f{"accounts":[]}
2024-02-08 18:35:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
408	192.168.2.5	50200	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:58 UTC	3619	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 351 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNzQxNzM1MCwiZXhwIjoxNzA3NTAzNzUwfQ.GScpUqtXyYVxaiSOtDPL64FlZdpGlmRRZW6zIB_EC_tMtaHBiRzF_1350_WKHiUqLKvkSUNrzKP1PXSibJvlpQ x-booking-et-serialized-state: Ef98IG0fjgY56Y63N0XdXtUDZNdmFwr2XgKIh92Hu06LJvnE66CkRQe8kZKZ05qgz x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: 2c8482c2544201f4 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3JoFJ/d3+jTRbAw8j2g3DznWiIRblwWjQRtj/04PDlBt/o55ocKzBIQxZ/e0Rt7iMiaISeSKOQt; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3UgBcvDN2nanV89DesY1vDJpOQG2w5rJXkyq57Fey6ZSnz8XrWS2PFhwhI9Cne4k7CcBnpWWdHk8d9T9HbjGeIc4G5Q%2BiRnb9gzMbtE1%2FYlnt%2BY5fPPq4oxRh3ozHHssIBpfaWe4ho6NxYEhWlBm7qbD3YA0TwWMwA%3D; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42
2024-02-08 18:35:58 UTC	351	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 5f 73 74 61 67 65 22 3a 22 61 64 5f 73 6c 6f 74 5f 63 72 65 61 74 65 64 22 2c 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 55 4e 4b 4e 4f 57 4e 22 2c 22 73 69 74 65 5f 74 79 70 65 22 3a 22 57 57 57 22 2c 22 76 69 73 69 74 6f 72 5f 63 63 22 3a 22 75 73 22 2c 22 61 64 5f 70 6f 73 69 74 69 6f 6e 22 3a 22 49 4e 44 45 58 5f 50 52 49 4d 41 52 59 22 2c 22 70 61 67 65 6e 61 6d 65 22 3a 22 49 4e 44 45 58 22 2c 22 76 65 72 74 69 63 61 6c 22 3a 22 41 43 43 4f 4d 4d 4f 44 41 54 49 4f 4e 53 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 6d 75 74 Data Ascii: {"operationName":"trackAdStatus","variables":{"input":{"action_stage":"ad_slot_created","campaign_id":"UNKNOWN","site_type":"WWW","visitor_cc":"us","ad_position":"INDEX_PRIMARY","pagename":"INDEX","vertical":"ACCOMMODATIONS"}},"extensions":{},"query":"mut
2024-02-08 18:35:59 UTC	1095	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 361 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:59 GMT vary: Accept-Encoding, User-Agent set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3XM30tieRoEaSlKNMnuqUhjk6RQaENR%2BlMnMzeH07AUwTelfDhEt8RPiGSed2X4H%2F2GkHOjfdv1FrX1%2Fth3Me9CBrxqyHzthvcIyDZIFnWwgjESTUGKGLFTJNrUbsw2lQzn9YI6DfLqd0q1DXDbe3jrwBk4N51JY2E%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:59 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=327f82c7f1f90203&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGfpSc184RvVYQqZlt4XpPdlwV4p_DlTO3g x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 086e2cd5d94fa729de58c51b5666e0e4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: uKqQQzBRgR8ag2X4AnbkOc75mSwXIj647PHrJGiSTsq-mSrvCi7eqA==
2024-02-08 18:35:59 UTC	361	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 3a 7b 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 41 20 4a 53 4f 4e 20 73 63 61 6c 61 72 22 2c 22 61 6c 6c 44 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 44 65 66 69 6e 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 6e 61 6d 65 22 3a 22 4a 53 4f 4e 22 2c 22 64 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 63 68 69 6c 64 72 65 6e 57 69 74 68 54 79 70 65 52 65 66 65 72 65 6e 63 65 73 22 3a 7b 22 63 68 69 6c 64 72 65 6e 41 73 4c 69 73 74 22 3a 5b 5d 2c 22 65 6d 70 74 79 22 3a 66 61 6c 73 65 2c 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 64 69 72 65 63 74 69 76 65 73 22 3a Data Ascii: {"data":{"trackAdStatus":{"appliedDirectives":[],"description":"A JSON scalar","allDirectivesByName":{},"extensionDefinitions":[],"name":"JSON","directivesByName":{},"childrenWithTypeReferences":{"childrenAsList":[],"empty":false,"children":{"directives":

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
409	192.168.2.5	50201	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:58 UTC	3721	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 6889 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNzQxNzM1MCwiZXhwIjoxNzA3NTAzNzUwfQ.GScpUqtXyYVxaiSOtDPL64FlZdpGlmRRZW6zIB_EC_tMtaHBiRzF_1350_WKHiUqLKvkSUNrzKP1PXSibJvlpQ x-booking-et-serialized-state: Ef98IG0fjgY56Y63N0XdXtUDZNdmFwr2XgKIh92Hu06LJvnE66CkRQe8kZKZ05qgz x-booking-site-type-id: 1 x-booking-pageview-id: 2c8482c2544201f4 x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3JoFJ/d3+jTRbAw8j2g3DznWiIRblwWjQRtj/04PDlBt/o55ocKzBIQxZ/e0Rt7iMiaISeSKOQt; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3UgBcvDN2nanV89DesY1vDJpOQG2w5rJXkyq57Fey6ZSnz8XrWS2PFhwhI9Cne4k7CcBnpWWdHk8d9T9HbjGeIc4G5Q%2BiRnb9gzMbtE1%2FYlnt%2BY5fPPq4oxRh3ozHHssIBpfaWe4ho6NxYEhWlBm7qbD3YA0TwWMwA%3D; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42
2024-02-08 18:35:58 UTC	6889	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 4d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6d 61 67 65 57 69 64 74 68 22 3a 33 32 30 2c 22 69 6d 61 67 65 48 65 69 67 68 74 22 3a 34 30 30 2c 22 69 6e 70 75 74 22 3a 7b 22 74 65 73 74 43 61 6d 70 61 69 67 6e 49 64 73 22 3a 5b 5d 2c 22 63 61 6d 70 61 69 67 6e 49 64 73 22 3a 5b 22 64 65 38 37 30 65 33 61 2d 62 61 39 31 2d 34 36 30 35 2d 39 62 62 31 2d 36 31 65 61 64 31 61 66 63 36 38 34 22 5d 2c 22 63 61 72 6f 75 73 65 6c 49 6e 70 75 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 49 6e 70 75 74 22 3a 5b 7b 22 63 61 6d 70 61 69 67 6e 49 64 22 3a 22 64 65 38 37 30 65 33 61 2d 62 61 39 31 2d 34 36 30 35 2d 39 62 62 31 2d 36 31 65 61 64 31 61 66 63 36 Data Ascii: {"operationName":"MerchComponentsData","variables":{"imageWidth":320,"imageHeight":400,"input":{"testCampaignIds":[],"campaignIds":["de870e3a-ba91-4605-9bb1-61ead1afc684"],"carouselInput":{"campaignInput":[{"campaignId":"de870e3a-ba91-4605-9bb1-61ead1afc6
2024-02-08 18:35:59 UTC	1107	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 16332 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:59 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBJ605U0vDzDse4dHJb86Hj76aMS%2F1TOMUvYggDqmt%2FBxRRa79YTuiO6DPwa5Z%2B2iq%2F%2FZt2KAE7Q5VuChNEVKNBWysy7wEeUUBHh4gNH9gYaRRO%2FeP5T1TyYRQcnzJX0JQH8dbOsy7Q%2FjNmp9HSh3pcMjg%2BGu1HK%2Fc4%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:59 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=524082c7053601ee&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGfn1QfSdsz4_V9hgeCm5CgvUrTULWJCG6w x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 086e2cd5d94fa729de58c51b5666e0e4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: q09TsqXiAeP3O5Qy0SB7LsNnPwel66XwEfituz9nzPzdMhm4xVVB0g==
2024-02-08 18:35:59 UTC	15277	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 6d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 22 3a 7b 22 63 6f 6d 70 6f 6e 65 6e 74 73 22 3a 5b 7b 22 68 65 61 64 69 6e 67 22 3a 22 42 72 6f 77 73 65 20 62 79 20 70 72 6f 70 65 72 74 79 20 74 79 70 65 22 2c 22 66 69 6c 74 65 72 73 49 6e 66 6f 22 3a 6e 75 6c 6c 2c 22 64 65 73 69 67 6e 56 61 72 69 61 6e 74 22 3a 7b 22 63 61 72 6f 75 73 65 6c 4c 61 79 6f 75 74 22 3a 22 44 45 53 4b 54 4f 50 5f 4d 45 44 49 55 4d 22 2c 22 68 65 61 64 69 6e 67 22 3a 22 42 72 6f 77 73 65 20 62 79 20 70 72 6f 70 65 72 74 79 20 74 79 70 65 22 2c 22 61 73 70 65 63 74 52 61 74 69 6f 22 3a 22 35 3a 34 22 2c 22 63 61 72 6f 75 73 65 6c 43 74 61 22 3a 6e 75 6c 6c 2c 22 73 75 62 48 65 61 64 69 6e 67 22 3a 6e 75 6c 6c 2c 22 70 72 69 63 65 54 65 78 Data Ascii: {"data":{"merchComponentsData":{"components":[{"heading":"Browse by property type","filtersInfo":null,"designVariant":{"carouselLayout":"DESKTOP_MEDIUM","heading":"Browse by property type","aspectRatio":"5:4","carouselCta":null,"subHeading":null,"priceTex
2024-02-08 18:35:59 UTC	1055	IN	Data Raw: 66 2d 63 61 74 65 72 69 6e 67 2f 69 6e 64 65 78 2e 65 6e 2d 75 73 2e 68 74 6d 6c 22 7d 2c 22 73 75 62 74 69 74 6c 65 22 3a 22 22 2c 22 65 78 74 72 61 53 75 62 74 69 74 6c 65 22 3a 22 22 2c 22 69 74 65 6d 49 64 22 3a 22 63 65 30 34 62 39 62 38 2d 64 30 33 66 2d 34 37 30 61 2d 62 31 34 65 2d 65 30 36 36 66 30 61 31 66 32 66 63 22 2c 22 72 65 76 69 65 77 53 63 6f 72 65 22 3a 6e 75 6c 6c 2c 22 74 69 74 6c 65 22 3a 22 53 65 6c 66 2d 63 61 74 65 72 69 6e 67 20 41 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 73 22 2c 22 70 72 69 63 65 22 3a 6e 75 6c 6c 2c 22 66 69 6c 74 65 72 73 22 3a 6e 75 6c 6c 2c 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 4d 65 72 63 68 43 61 72 6f 75 73 65 6c 53 74 61 63 6b 65 64 49 74 65 6d 22 7d 2c 7b 22 73 75 62 74 69 74 6c 65 22 3a 22 22 2c 22 74 Data Ascii: f-catering/index.en-us.html"},"subtitle":"","extraSubtitle":"","itemId":"ce04b9b8-d03f-470a-b14e-e066f0a1f2fc","reviewScore":null,"title":"Self-catering Accommodations","price":null,"filters":null,"__typename":"MerchCarouselStackedItem"},{"subtitle":"","t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
410	192.168.2.5	50202	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:58 UTC	3721	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 6889 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNzQxNzM1MCwiZXhwIjoxNzA3NTAzNzUwfQ.GScpUqtXyYVxaiSOtDPL64FlZdpGlmRRZW6zIB_EC_tMtaHBiRzF_1350_WKHiUqLKvkSUNrzKP1PXSibJvlpQ x-booking-et-serialized-state: Ef98IG0fjgY56Y63N0XdXtUDZNdmFwr2XgKIh92Hu06LJvnE66CkRQe8kZKZ05qgz x-booking-site-type-id: 1 x-booking-pageview-id: 2c8482c2544201f4 x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3JoFJ/d3+jTRbAw8j2g3DznWiIRblwWjQRtj/04PDlBt/o55ocKzBIQxZ/e0Rt7iMiaISeSKOQt; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3UgBcvDN2nanV89DesY1vDJpOQG2w5rJXkyq57Fey6ZSnz8XrWS2PFhwhI9Cne4k7CcBnpWWdHk8d9T9HbjGeIc4G5Q%2BiRnb9gzMbtE1%2FYlnt%2BY5fPPq4oxRh3ozHHssIBpfaWe4ho6NxYEhWlBm7qbD3YA0TwWMwA%3D; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42
2024-02-08 18:35:58 UTC	6889	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 4d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6d 61 67 65 57 69 64 74 68 22 3a 33 32 30 2c 22 69 6d 61 67 65 48 65 69 67 68 74 22 3a 34 30 30 2c 22 69 6e 70 75 74 22 3a 7b 22 74 65 73 74 43 61 6d 70 61 69 67 6e 49 64 73 22 3a 5b 5d 2c 22 63 61 6d 70 61 69 67 6e 49 64 73 22 3a 5b 22 32 35 33 31 32 61 36 65 2d 34 66 61 32 2d 34 61 65 61 2d 39 31 64 34 2d 64 39 64 66 32 35 63 33 32 63 61 64 22 5d 2c 22 63 61 72 6f 75 73 65 6c 49 6e 70 75 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 49 6e 70 75 74 22 3a 5b 7b 22 63 61 6d 70 61 69 67 6e 49 64 22 3a 22 32 35 33 31 32 61 36 65 2d 34 66 61 32 2d 34 61 65 61 2d 39 31 64 34 2d 64 39 64 66 32 35 63 33 32 63 Data Ascii: {"operationName":"MerchComponentsData","variables":{"imageWidth":320,"imageHeight":400,"input":{"testCampaignIds":[],"campaignIds":["25312a6e-4fa2-4aea-91d4-d9df25c32cad"],"carouselInput":{"campaignInput":[{"campaignId":"25312a6e-4fa2-4aea-91d4-d9df25c32c
2024-02-08 18:35:59 UTC	1098	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 8061 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:59 GMT vary: Accept-Encoding, User-Agent set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBtrc9jcR8FHAZMgVsPDpO7k61zYzfvcAjZN%2BRki3c7UB3918wAejvzi8Uw9wj94zjKlskVeTbjCxUVFcfkqNKas8HUPlorLCqhSg%2BuX8%2BK09RWBvmliG5DU9pml%2FAvTAo8b0NT01eyZ7LmqOV9j%2FXUt583TZ0KwvdQ%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:59 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=49fa82c7a151025a&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGWG3J746WuUdNm3oDpMIMP_AlkQbT31VkQ x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 45893c5ff2aa24fa7dce9573a0274642.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: txLU5R96Tj1xjhJwVLdnMnQIWBVhmJUJ4IRRojUCknAdpg3XD5PLlQ==
2024-02-08 18:35:59 UTC	8061	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 6d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 22 3a 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 4d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 52 65 73 75 6c 74 22 2c 22 63 6f 6d 70 6f 6e 65 6e 74 73 22 3a 5b 7b 22 64 65 73 69 67 6e 56 61 72 69 61 6e 74 22 3a 7b 22 73 75 62 48 65 61 64 69 6e 67 22 3a 22 54 68 65 73 65 20 70 6f 70 75 6c 61 72 20 64 65 73 74 69 6e 61 74 69 6f 6e 73 20 68 61 76 65 20 61 20 6c 6f 74 20 74 6f 20 6f 66 66 65 72 22 2c 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 44 65 73 6b 74 6f 70 43 61 72 6f 75 73 65 6c 53 74 61 63 6b 65 64 43 61 72 64 73 22 2c 22 63 61 72 6f 75 73 65 6c 43 74 61 22 3a 6e 75 6c 6c 2c 22 68 65 61 64 69 6e 67 22 3a 22 45 78 70 6c 6f 72 65 20 55 6e 69 74 65 64 20 Data Ascii: {"data":{"merchComponentsData":{"__typename":"MerchComponentsDataResult","components":[{"designVariant":{"subHeading":"These popular destinations have a lot to offer","__typename":"DesktopCarouselStackedCards","carouselCta":null,"heading":"Explore United

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
411	192.168.2.5	50203	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:58 UTC	3721	OUT	GET /js_errors?pid=2c8482c2544201f4&url=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&m=UmFuZG9tSVYkc2RlIyh9YYo1mfebd19Q2WIimWOyIN1gUe4_-JQdNOBTMuHuYCJPue7ik10LWViyRYmmf149m9vSAg2JJTyfAEk9RiEQZejXjro5rDJvxnq57UaGsDKd0iBXLkMuV2sFYEHSFmXZW5zvkIdbv7-B87Oi9zo36Fnq7AU8K4Y8Y-SdtsN1A2dfLiciDUxBuNe45QSxoxZcHhPcdr6v26QamVEbge_7LQ_MDhbvlSKq9Lwf9P11FwHzxPymBNBmu_dZFb8tK9Z3wY0RAyYm7D0hfdu-LCtv4j3isKKp1L_CiYhwCnyC42X_OqimTrSjKXCbKfd3YnkJbQ&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSObZWJFfVDSMePCFYZWFXO&cors=1 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3JoFJ/d3+jTRbAw8j2g3DznWiIRblwWjQRtj/04PDlBt/o55ocKzBIQxZ/e0Rt7iMiaISeSKOQt; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3UgBcvDN2nanV89DesY1vDJpOQG2w5rJXkyq57Fey6ZSnz8XrWS2PFhwhI9Cne4k7CcBnpWWdHk8d9T9HbjGeIc4G5Q%2BiRnb9gzMbtE1%2FYlnt%2BY5fPPq4oxRh3ozHHssIBpfaWe4ho6NxYEhWlBm7qbD3YA0TwWMwA%3D; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42
2024-02-08 18:35:59 UTC	684	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:59 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=597182c7c14600f1&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpphmDYh65cLNIacp2twAXyfImPPaf9JpP x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 31113f2f23c4ce8a8af1d88a37137806.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 2eerBsU1l1sF9xphh4Aj5A39oFRqIElQxmE3Qh2ub8i6Vlap8KtJYA==
2024-02-08 18:35:59 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
412	192.168.2.5	50207	172.253.124.132	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:58 UTC	859	OUT	GET /safeframe/1-0-40/html/container.html HTTP/1.1 Host: 0f492a439f0f79bcbc4fe15f41ea6011.safeframe.googlesyndication.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:59 UTC	707	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/html Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="ads-gpt-scs" Report-To: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} Timing-Allow-Origin: * Content-Length: 6162 Date: Thu, 08 Feb 2024 18:35:59 GMT Expires: Fri, 07 Feb 2025 18:35:59 GMT Cache-Control: public, immutable, max-age=31536000 Last-Modified: Thu, 03 Nov 2022 19:10:08 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:59 UTC	545	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 61 66 65 46 72 61 6d 65 20 43 6f 6e 74 61 69 6e 65 72 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 68 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7d 3b 76 61 72 20 6e 3d 66 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="UTF-8"> <title>SafeFrame Container</title> <script>(function(){/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0*/var f=this\|\|self,h=function(a){return a};var n=f
2024-02-08 18:35:59 UTC	1252	IN	Data Raw: 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 67 6f 6f 67 23 68 74 6d 6c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 68 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 68 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 68 7d 29 7d 63 61 74 63 68 28 63 29 7b 66 2e 63 6f 6e 73 6f 6c 65 26 26 66 2e 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 63 2e 6d 65 73 73 61 67 65 29 7d 74 3d 61 7d 65 6c 73 65 20 74 3d 61 7d 72 65 74 75 72 6e 20 74 7d 3b 76 61 72 20 63 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 67 3d 62 61 3d 3d 3d 62 61 3f 61 3a 22 22 7d 3b 63 61 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 67 2b 22 22 7d 3b 76 61 72 20 62 61 3d 7b 7d 2c 64 61 3d 66 75 6e 63 74 69 Data Ascii: .createPolicy("goog#html",{createHTML:h,createScript:h,createScriptURL:h})}catch(c){f.console&&f.console.error(c.message)}t=a}else t=a}return t};var ca=function(a){this.g=ba===ba?a:""};ca.prototype.toString=function(){return this.g+""};var ba={},da=functi
2024-02-08 18:35:59 UTC	1252	IN	Data Raw: 74 68 69 73 2e 69 3d 22 26 22 3b 74 68 69 73 2e 68 3d 7b 7d 3b 74 68 69 73 2e 6f 3d 30 3b 74 68 69 73 2e 67 3d 5b 5d 7d 2c 7a 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 7b 7d 3b 63 5b 61 5d 3d 62 3b 72 65 74 75 72 6e 5b 63 5d 7d 2c 71 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 29 7b 76 61 72 20 6b 3d 5b 5d 3b 6a 61 28 61 2c 66 75 6e 63 74 69 6f 6e 28 67 2c 41 29 7b 28 67 3d 70 61 28 67 2c 62 2c 63 2c 64 2c 65 29 29 26 26 6b 2e 70 75 73 68 28 41 2b 22 3d 22 2b 67 29 7d 29 3b 72 65 74 75 72 6e 20 6b 2e 6a 6f 69 6e 28 62 29 7d 2c 70 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 29 7b 69 66 28 6e 75 6c 6c 3d 3d 61 29 72 65 74 75 72 6e 22 22 3b 62 3d 62 7c 7c 22 26 22 3b 63 3d 63 7c 7c 22 2c 24 22 3b 22 73 74 Data Ascii: this.i="&";this.h={};this.o=0;this.g=[]},z=function(a,b){var c={};c[a]=b;return[c]},qa=function(a,b,c,d,e){var k=[];ja(a,function(g,A){(g=pa(g,b,c,d,e))&&k.push(A+"="+g)});return k.join(b)},pa=function(a,b,c,d,e){if(null==a)return"";b=b\|\|"&";c=c\|\|",$";"st
2024-02-08 18:35:59 UTC	1252	IN	Data Raw: 28 29 3b 61 2e 6e 61 6d 65 26 26 2d 31 3d 3d 62 2e 69 6e 64 65 78 4f 66 28 61 2e 6e 61 6d 65 29 26 26 28 62 2b 3d 22 3a 20 22 2b 61 2e 6e 61 6d 65 29 3b 61 2e 6d 65 73 73 61 67 65 26 26 2d 31 3d 3d 62 2e 69 6e 64 65 78 4f 66 28 61 2e 6d 65 73 73 61 67 65 29 26 26 28 62 2b 3d 22 3a 20 22 2b 61 2e 6d 65 73 73 61 67 65 29 3b 69 66 28 61 2e 73 74 61 63 6b 29 7b 61 3d 61 2e 73 74 61 63 6b 3b 76 61 72 20 63 3d 62 3b 74 72 79 7b 2d 31 3d 3d 61 2e 69 6e 64 65 78 4f 66 28 63 29 26 26 28 61 3d 63 2b 22 5c 6e 22 2b 61 29 3b 66 6f 72 28 76 61 72 20 64 3b 61 21 3d 64 3b 29 64 3d 61 2c 61 3d 61 2e 72 65 70 6c 61 63 65 28 52 65 67 45 78 70 28 22 28 28 68 74 74 70 73 3f 3a 2f 2e 2e 2a 2f 29 5b 5e 2f 3a 5d 2a 3a 5c 5c 64 2b 28 3f 3a 2e 7c 5c 6e 29 2a 29 5c 5c 32 22 29 2c Data Ascii: ();a.name&&-1==b.indexOf(a.name)&&(b+=": "+a.name);a.message&&-1==b.indexOf(a.message)&&(b+=": "+a.message);if(a.stack){a=a.stack;var c=b;try{-1==a.indexOf(c)&&(a=c+"\n"+a);for(var d;a!=d;)d=a,a=a.replace(RegExp("((https?:/../)[^/:]:\\d+(?:.\|\n)*)\\2"),
2024-02-08 18:35:59 UTC	1252	IN	Data Raw: 5b 32 5d 2c 45 3d 43 5b 33 5d 3b 69 66 28 44 3e 45 2e 6c 65 6e 67 74 68 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 50 61 72 73 65 64 20 63 6f 6e 74 65 6e 74 20 73 69 7a 65 20 64 6f 65 73 6e 27 74 20 6d 61 74 63 68 2e 20 22 2b 44 2b 22 3a 22 2b 45 2e 6c 65 6e 67 74 68 29 3b 42 3d 7b 6d 3a 43 5b 31 5d 2c 63 6f 6e 74 65 6e 74 3a 45 2e 73 75 62 73 74 72 28 30 2c 44 29 2c 6c 3a 45 2e 73 75 62 73 74 72 28 44 29 7d 3b 76 61 72 20 46 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 42 2e 6c 29 3b 77 69 6e 64 6f 77 2e 6e 61 6d 65 3d 22 22 3b 76 61 72 20 42 61 3d 42 2e 63 6f 6e 74 65 6e 74 3b 46 2e 67 6f 6f 67 5f 73 61 66 65 66 72 61 6d 65 5f 68 6c 74 26 26 28 66 2e 67 6f 6f 67 5f 73 61 66 65 66 72 61 6d 65 5f 68 6c 74 3d 46 2e 67 6f 6f 67 5f 73 61 66 65 66 72 61 6d 65 5f 68 6c Data Ascii: [2],E=C[3];if(D>E.length)throw Error("Parsed content size doesn't match. "+D+":"+E.length);B={m:C[1],content:E.substr(0,D),l:E.substr(D)};var F=JSON.parse(B.l);window.name="";var Ba=B.content;F.goog_safeframe_hlt&&(f.goog_safeframe_hlt=F.goog_safeframe_hl
2024-02-08 18:35:59 UTC	609	IN	Data Raw: 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2c 21 31 29 2c 46 61 3d 6e 75 6c 6c 2c 55 3d 4b 2e 6c 65 6e 67 74 68 2d 31 2c 56 3d 55 3b 30 3c 3d 56 3b 2d 2d 56 29 7b 76 61 72 20 57 3d 4b 5b 56 5d 3b 21 46 61 26 26 6b 61 2e 74 65 73 74 28 57 2e 75 72 6c 29 26 26 28 46 61 3d 57 29 3b 69 66 28 57 2e 75 72 6c 26 26 21 57 2e 6a 29 7b 78 3d 57 3b 62 72 65 61 6b 7d 7d 76 61 72 20 6c 61 3d 6e 75 6c 6c 2c 47 61 3d 4b 2e 6c 65 6e 67 74 68 26 26 4b 5b 55 5d 2e 75 72 6c 3b 30 21 3d 78 2e 64 65 70 74 68 26 26 47 61 26 26 28 6c 61 3d 4b 5b 55 5d 29 3b 48 3d 6e 65 77 20 6d 61 3b 69 66 28 48 2e 68 29 7b 76 61 72 20 48 61 3d 48 2e 68 2e 75 72 6c 7c 7c 22 22 3b 49 2e 67 2e 70 75 73 68 28 34 29 3b 49 2e 68 5b 34 5d 3d 7a 28 22 74 6f 70 22 2c 48 61 29 7d 76 61 72 20 49 61 3d 7b Data Ascii: .location.href,!1),Fa=null,U=K.length-1,V=U;0<=V;--V){var W=K[V];!Fa&&ka.test(W.url)&&(Fa=W);if(W.url&&!W.j){x=W;break}}var la=null,Ga=K.length&&K[U].url;0!=x.depth&&Ga&&(la=K[U]);H=new ma;if(H.h){var Ha=H.h.url\|\|"";I.g.push(4);I.h[4]=z("top",Ha)}var Ia={

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
413	192.168.2.5	50206	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:58 UTC	1024	OUT	GET /pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_bKnn4gJpxh610xABibZH5I811MGr-I-n9wGDzZ9KOO-e4-mB&random=635174606 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:59 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:59 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:59 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
414	192.168.2.5	50211	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:58 UTC	4607	OUT	GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=2c8482c2544201f4&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|4,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|2,cCHObKdBdUHINPSXeHDALOLOLMO\|5,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-ET-Serialized-State: Ef98IG0fjgY56Y63N0XdXtUDZNdmFwr2XgKIh92Hu06LJvnE66CkRQe8kZKZ05qgz X-Booking-Language-Code: en-us X-Booking-Client-Info: sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: 2c8482c2544201f4 X-Booking-Info: X-Booking-SiteType-Id: 1 X-Booking-Session-Id: db6e5bbb32eac0e80cfcae9b22f5390d sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3JoFJ/d3+jTRbAw8j2g3DznWiIRblwWjQRtj/04PDlBt/o55ocKzBIQxZ/e0Rt7iMiaISeSKOQt; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3UgBcvDN2nanV89DesY1vDJpOQG2w5rJXkyq57Fey6ZSnz8XrWS2PFhwhI9Cne4k7CcBnpWWdHk8d9T9HbjGeIc4G5Q%2BiRnb9gzMbtE1%2FYlnt%2BY5fPPq4oxRh3ozHHssIBpfaWe4ho6NxYEhWlBm7qbD3YA0TwWMwA%3D; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42
2024-02-08 18:35:59 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:59 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=486682c7a9ec0245&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejLNx_lZPWE_VnFBNdI7twds4nN2E2iC5l0 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 76f3fedc86826a7b266250e33ee41082.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: TMK1a2v5M0_ysnhMuHnpg9D7goWDy94KXKKe5UTeO1jT529FOKkANg==
2024-02-08 18:35:59 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
415	192.168.2.5	50208	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:58 UTC	3619	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 423 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNzQxNzM1MCwiZXhwIjoxNzA3NTAzNzUwfQ.GScpUqtXyYVxaiSOtDPL64FlZdpGlmRRZW6zIB_EC_tMtaHBiRzF_1350_WKHiUqLKvkSUNrzKP1PXSibJvlpQ x-booking-et-serialized-state: Ef98IG0fjgY56Y63N0XdXtUDZNdmFwr2XgKIh92Hu06LJvnE66CkRQe8kZKZ05qgz x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: 2c8482c2544201f4 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3JoFJ/d3+jTRbAw8j2g3DznWiIRblwWjQRtj/04PDlBt/o55ocKzBIQxZ/e0Rt7iMiaISeSKOQt; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3UgBcvDN2nanV89DesY1vDJpOQG2w5rJXkyq57Fey6ZSnz8XrWS2PFhwhI9Cne4k7CcBnpWWdHk8d9T9HbjGeIc4G5Q%2BiRnb9gzMbtE1%2FYlnt%2BY5fPPq4oxRh3ozHHssIBpfaWe4ho6NxYEhWlBm7qbD3YA0TwWMwA%3D; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42
2024-02-08 18:35:58 UTC	423	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 47 65 6e 69 75 73 53 69 67 6e 49 6e 53 68 65 65 74 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 50 61 67 65 22 3a 22 69 6e 64 65 78 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 47 65 6e 69 75 73 53 69 67 6e 49 6e 53 68 65 65 74 28 24 69 6e 70 75 74 3a 20 47 65 6e 69 75 73 53 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 49 6e 70 75 74 21 29 20 7b 5c 6e 20 20 67 65 6e 69 75 73 47 75 65 73 74 44 61 74 61 20 7b 5c 6e 20 20 20 20 73 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 28 69 6e 70 75 74 3a 20 24 69 6e 70 75 74 29 20 7b 5c 6e 20 20 20 20 20 20 74 69 74 6c 65 5c 6e 20 20 20 20 20 20 73 75 Data Ascii: {"operationName":"GeniusSignInSheet","variables":{"input":{"actionPage":"index"}},"extensions":{},"query":"query GeniusSignInSheet($input: GeniusSignInBottomSheetInput!) {\n geniusGuestData {\n signInBottomSheet(input: $input) {\n title\n su
2024-02-08 18:35:59 UTC	1098	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 89 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:59 GMT vary: Accept-Encoding, User-Agent set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhMkPrb7BMdgkeBlz9oHfYQuoYGiM4pBYZsR%2FHlaqFOXgTZUhpPTElQGaxRiPA1iwdBpvuySMc986R8T0pwU%2BGYv2d6r9dFCh8SPiGQb1F993nZXnhDTp%2BFtyEtuJp0WMukPWkwubQ56I6hY%2B%2BQ%2FLAU%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:59 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=1b4a82c71289001d&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGdPPNZcG_18rruCWrpqmlufmvptlGqLWEA x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 4a91a321d4c2ab7334c6f285093956ae.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: KJkjYPgh-svPv2fZWa-57GiNNM6nPJGgPnk1w9zjCotSzaA9TdK4dg==
2024-02-08 18:35:59 UTC	89	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 67 65 6e 69 75 73 47 75 65 73 74 44 61 74 61 22 3a 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 47 65 6e 69 75 73 47 75 65 73 74 51 75 65 72 69 65 73 22 2c 22 73 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 22 3a 6e 75 6c 6c 7d 7d 7d Data Ascii: {"data":{"geniusGuestData":{"__typename":"GeniusGuestQueries","signInBottomSheet":null}}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
416	192.168.2.5	50215	151.101.128.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:58 UTC	1047	OUT	GET /user/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA%22%7D&cb=1707417357969&dep=2%2CPAGE_LOAD HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSY4dDVmd0o2ZzF4RVN2ZHlPL090aCt3NnpTWkZQdlF2bFR0OHJrNFBlM3NYbW9ucGRrMGIrL0lES2pGVnRRNzVaWitlbjRUZDhYVzc2U2E3ZFFrSzhES2RCUlpvb2tIT1pnU2JNS1FUWTd3bz0mclU4SWk0WVFTSXEwdmVJSEttb3prYlpuZzBjPQ=="
2024-02-08 18:35:59 UTC	684	IN	HTTP/1.1 200 OK Connection: close Content-Length: 302 access-control-expose-headers: Epik,Pin-Unauth pin-unauth: dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 4 referrer-policy: origin x-pinterest-rid: 4992398483211480 Date: Thu, 08 Feb 2024 18:35:59 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: f9d1c7100d6ab6a9fc70375cea0fca5e275d3fa9
2024-02-08 18:35:59 UTC	302	IN	Data Raw: 7b 22 61 65 6d 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 65 6d 46 6e 4c 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 50 68 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 47 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 44 62 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 4c 6f 63 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 45 78 74 65 72 6e 61 6c 49 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 45 70 69 6b 49 66 72 61 6d 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 68 72 6f 6d 65 4e 65 77 55 73 65 72 41 67 65 6e 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 45 75 22 3a 74 72 75 65 2c 22 69 73 55 74 69 6c 69 7a 69 6e 67 41 64 76 65 72 74 69 73 65 72 31 70 45 6e 61 Data Ascii: {"aemEnabled":true,"aemFnLnEnabled":false,"aemPhEnabled":false,"aemGeEnabled":false,"aemDbEnabled":false,"aemLocEnabled":false,"aemExternalIdEnabled":false,"ctEpikIframeEnabled":true,"chromeNewUserAgentEnabled":true,"isEu":true,"isUtilizingAdvertiser1pEna

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
417	192.168.2.5	50214	151.101.128.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:58 UTC	988	OUT	GET /user/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1707417357971&dep=5%2CEVENT_TAGS_ABSENT HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSY4dDVmd0o2ZzF4RVN2ZHlPL090aCt3NnpTWkZQdlF2bFR0OHJrNFBlM3NYbW9ucGRrMGIrL0lES2pGVnRRNzVaWitlbjRUZDhYVzc2U2E3ZFFrSzhES2RCUlpvb2tIT1pnU2JNS1FUWTd3bz0mclU4SWk0WVFTSXEwdmVJSEttb3prYlpuZzBjPQ=="
2024-02-08 18:35:59 UTC	684	IN	HTTP/1.1 200 OK Connection: close Content-Length: 302 access-control-expose-headers: Epik,Pin-Unauth pin-unauth: dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 2 referrer-policy: origin x-pinterest-rid: 6239342772424961 Date: Thu, 08 Feb 2024 18:35:59 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: f9d1c7100d6ab6a9fc70375cea0fca5e275d3fa9
2024-02-08 18:35:59 UTC	302	IN	Data Raw: 7b 22 61 65 6d 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 65 6d 46 6e 4c 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 50 68 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 47 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 44 62 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 4c 6f 63 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 45 78 74 65 72 6e 61 6c 49 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 45 70 69 6b 49 66 72 61 6d 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 68 72 6f 6d 65 4e 65 77 55 73 65 72 41 67 65 6e 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 45 75 22 3a 74 72 75 65 2c 22 69 73 55 74 69 6c 69 7a 69 6e 67 41 64 76 65 72 74 69 73 65 72 31 70 45 6e 61 Data Ascii: {"aemEnabled":true,"aemFnLnEnabled":false,"aemPhEnabled":false,"aemGeEnabled":false,"aemDbEnabled":false,"aemLocEnabled":false,"aemExternalIdEnabled":false,"ctEpikIframeEnabled":true,"chromeNewUserAgentEnabled":true,"isEu":true,"isUtilizingAdvertiser1pEna

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
418	192.168.2.5	50217	64.233.177.99	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	1238	OUT	GET /recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&cb=8mbox63omknd HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AJmcDEmmSVjhXu6iSND5nUlaG4u8jg9r3gIsM8fricsYrppd_RXehS30W8rvMgVb0KtN3BzkTFd51AiDyh7KnUA; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:59 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 08 Feb 2024 18:35:59 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-O4KufxAl980C5s4AIwI1gQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:35:59 UTC	361	IN	Data Raw: 32 62 30 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b Data Ascii: 2b05<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face {
2024-02-08 18:35:59 UTC	1252	IN	Data Raw: 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 Data Ascii: o/v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//f
2024-02-08 18:35:59 UTC	1252	IN	Data Raw: 39 2c 20 55 2b 32 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 Data Ascii: 9, U+20AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329,
2024-02-08 18:35:59 UTC	1252	IN	Data Raw: 30 2d 30 34 39 31 2c 20 55 2b 30 34 42 30 2d 30 34 42 31 2c 20 55 2b 32 31 31 36 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a Data Ascii: 0-0491, U+04B0-04B1, U+2116;}/* greek-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}
2024-02-08 18:35:59 UTC	1252	IN	Data Raw: 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c Data Ascii: */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA,
2024-02-08 18:35:59 UTC	1252	IN	Data Raw: 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 42 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 33 37 30 2d 30 33 37 37 2c 20 55 2b 30 33 37 41 2d 30 33 37 46 2c 20 55 2b 30 33 38 34 2d 30 33 38 41 2c 20 55 2b 30 33 38 43 2c 20 55 2b 30 33 38 45 2d 30 33 41 31 2c 20 55 2b 30 33 41 33 2d 30 33 46 46 3b 0a 7d 0a 2f 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b Data Ascii: l(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2) format('woff2'); unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}/* vietnamese */@font-face { font-family: 'Roboto'; font-style: normal;
2024-02-08 18:35:59 UTC	1252	IN	Data Raw: 20 55 2b 46 45 46 46 2c 20 55 2b 46 46 46 44 3b 0a 7d 0a 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 78 35 57 57 6f 45 35 37 46 76 30 64 36 41 54 4b 73 4c 44 49 41 4b 6e 74 2f 73 74 79 6c 65 73 5f 5f 6c 74 72 2e 63 73 73 22 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 4f 34 4b 75 66 78 41 6c 39 38 30 43 35 73 34 41 49 77 49 31 67 51 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 Data Ascii: U+FEFF, U+FFFD;}</style><link rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/styles__ltr.css"><script nonce="O4KufxAl980C5s4AIwI1gQ" type="text/javascript">window['__recaptcha_api'] = 'http
2024-02-08 18:35:59 UTC	1252	IN	Data Raw: 75 33 51 51 5a 63 4f 57 65 35 54 73 30 75 5a 57 30 55 6d 52 76 41 32 4b 34 67 50 44 66 37 4c 4a 65 70 67 71 43 79 51 42 45 48 57 66 4d 6e 6b 43 75 48 2d 71 39 57 42 62 66 6b 6f 57 2d 33 79 72 52 42 5f 34 31 34 63 75 70 62 7a 4e 59 78 58 75 77 62 33 55 59 49 53 38 6e 6d 45 58 4e 61 42 4c 4a 63 64 61 72 6d 75 5f 64 32 7a 4a 6e 45 34 5a 30 6c 47 5f 74 74 6e 55 5f 58 35 75 6f 56 76 79 34 48 36 44 71 4a 33 4a 69 38 44 4d 65 6b 5f 57 4d 73 32 4a 64 75 77 59 6d 68 65 32 58 62 44 4b 67 75 71 69 66 65 6f 64 74 53 58 45 63 77 43 5f 6b 50 2d 66 54 46 62 6d 67 68 59 4b 4c 46 56 38 6b 32 66 79 4e 51 6e 76 6a 4e 6d 62 49 58 71 66 31 31 2d 71 6d 73 76 5a 5a 31 73 43 7a 7a 6c 6f 5a 5f 45 33 78 4c 53 4a 45 41 51 71 65 2d 52 73 4c 49 2d 34 76 41 49 48 4b 6e 6e 64 36 72 6d Data Ascii: u3QQZcOWe5Ts0uZW0UmRvA2K4gPDf7LJepgqCyQBEHWfMnkCuH-q9WBbfkoW-3yrRB_414cupbzNYxXuwb3UYIS8nmEXNaBLJcdarmu_d2zJnE4Z0lG_ttnU_X5uoVvy4H6DqJ3Ji8DMek_WMs2JduwYmhe2XbDKguqifeodtSXEcwC_kP-fTFbmghYKLFV8k2fyNQnvjNmbIXqf11-qmsvZZ1sCzzloZ_E3xLSJEAQqe-RsLI-4vAIHKnnd6rm
2024-02-08 18:35:59 UTC	1252	IN	Data Raw: 57 4a 4b 5f 5f 50 5f 62 66 53 62 75 4f 39 43 74 62 6e 72 67 64 4a 43 36 35 22 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 4f 34 4b 75 66 78 41 6c 39 38 30 43 35 73 34 41 49 77 49 31 67 51 22 3e 0a 20 20 20 20 20 20 72 65 63 61 70 74 63 68 61 2e 61 6e 63 68 6f 72 2e 4d 61 69 6e 2e 69 6e 69 74 28 22 5b 5c 78 32 32 61 69 6e 70 75 74 5c 78 32 32 2c 5b 5c 78 32 32 62 67 64 61 74 61 5c 78 32 32 2c 5c 78 32 32 4c 79 39 33 64 33 63 75 5a 32 39 76 5a 32 78 6c 4c 6d 4e 76 62 53 39 71 63 79 39 69 5a 79 39 4c 61 31 64 47 5a 56 4e 56 55 6d 56 72 57 45 64 35 59 32 52 77 63 6c 5a 44 4c 56 56 5a 4e 6b 56 45 4c 56 70 47 4e 57 78 73 4d 6b 70 44 54 57 6c 49 61 45 70 46 4d 6c 4a 72 4c 6d 70 7a 5c 78 Data Ascii: WJK__P_bfSbuO9CtbnrgdJC65"><script type="text/javascript" nonce="O4KufxAl980C5s4AIwI1gQ"> recaptcha.anchor.Main.init("[\x22ainput\x22,[\x22bgdata\x22,\x22Ly93d3cuZ29vZ2xlLmNvbS9qcy9iZy9La1dGZVNVUmVrWEd5Y2RwclZDLVVZNkVELVpGNWxsMkpDTWlIaEpFMlJrLmpz\x
2024-02-08 18:35:59 UTC	644	IN	Data Raw: 7a 4e 49 55 6b 31 55 51 55 45 77 61 43 74 59 5a 48 68 36 52 6b 4e 74 51 56 4a 50 65 6d 31 6e 64 54 46 45 55 6a 46 78 62 7a 51 35 57 6a 59 34 65 6d 30 77 59 31 64 79 64 53 39 6a 56 47 63 79 59 33 56 50 55 33 52 48 64 58 42 77 53 56 4a 4a 5a 32 35 50 5a 58 70 36 4e 6a 6c 43 53 56 68 4f 53 44 46 42 52 47 6c 48 61 58 52 58 4d 46 70 5a 54 6c 4a 6e 54 56 52 32 4d 57 34 78 64 45 64 6e 64 32 52 51 4d 55 4e 68 65 55 49 79 51 55 4e 6d 4b 33 68 78 59 57 39 72 5a 69 74 46 56 44 5a 6a 53 57 52 7a 55 31 49 34 4e 6e 46 56 51 55 5a 75 63 55 5a 7a 4d 56 46 58 53 6b 70 69 61 58 52 46 53 45 64 74 62 31 42 70 4d 58 56 45 56 6a 4a 32 57 6b 35 6e 55 47 38 77 4d 33 46 4d 54 7a 46 4b 51 6c 42 55 65 54 52 4a 59 56 4e 4c 55 53 74 48 65 6d 5a 4e 62 33 68 52 59 57 35 52 5a 33 55 34 Data Ascii: zNIUk1UQUEwaCtYZHh6RkNtQVJPem1ndTFEUjFxbzQ5WjY4em0wY1dydS9jVGcyY3VPU3RHdXBwSVJJZ25PZXp6NjlCSVhOSDFBRGlHaXRXMFpZTlJnTVR2MW4xdEdnd2RQMUNheUIyQUNmK3hxYW9rZitFVDZjSWRzU1I4NnFVQUZucUZzMVFXSkpiaXRFSEdtb1BpMXVEVjJ2Wk5nUG8wM3FMTzFKQlBUeTRJYVNLUStHemZNb3hRYW5RZ3U4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
419	192.168.2.5	50218	64.233.185.148	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 139 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:59 UTC	139	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 31 37 36 36 37 37 31 36 34 33 34 32 35 39 30 31 33 34 37 36 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://booking.com","trigger_debug_key":"17667716434259013476"},"type":"trigger-no-matching-source"}]
2024-02-08 18:35:59 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Thu, 08 Feb 2024 18:35:59 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
420	192.168.2.5	50220	64.233.177.157	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	1505	OUT	GET /ddm/fls/z/dc_pre=CIu156ixnIQDFXji_QUdFZIKVQ;src=4228414;type=views;cat=views;ord=4050429631327;npa=0;auiddc=;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=1884632172;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2 HTTP/1.1 Host: adservice.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:59 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:59 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:59 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
421	192.168.2.5	50223	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	1319	OUT	GET /pagead/1p-user-list/988382855/?random=1707417356533&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_gdaH382UdbAT3pTI4QArto9DJ6zfY4NMXdbth7hSGs09MH9-&random=4243601863&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:59 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:59 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:59 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
422	192.168.2.5	50224	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	1889	OUT	GET /pagead/1p-user-list/1060768846/?random=1707417356687&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nh4qqVoyv2KiIad5kPNddW86jrjYgKSk8&npa=0&data=page_type%3Dhome%3Bcheckindate%3D-1%3Bcheckoutdate%3D-1%3Bhotelid%3D0%3Bbook_window%3D%3Bweekday%3D-1%3Bdest_cc%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bnights%3D-1%3Brooms%3D-1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Bguestcount%3D-1%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdest_ufi%3D-1%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_PSJZTlF3xHNBsCQJNXjp8P52oWLmj9dYKvL6ae3o34g5Uiz2&random=954397539&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:59 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:59 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:59 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
423	192.168.2.5	50227	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	1317	OUT	GET /pagead/1p-user-list/973712236/?random=1707417356716&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_VC_dWnF5zlO-sJxDecgZQ7JbED0pEd9zFsh_javD5gIRkRhk&random=689319094&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:59 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:59 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:59 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
424	192.168.2.5	50226	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	1318	OUT	GET /pagead/1p-user-list/973712236/?random=1707417356745&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_c43MYL9RI3Thfd_9DdM04RURnZRUImtlZ5ONbr2LQojys0VJ&random=4009849583&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:59 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:59 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:59 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
425	192.168.2.5	50229	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	3619	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 359 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNzQxNzM1MCwiZXhwIjoxNzA3NTAzNzUwfQ.GScpUqtXyYVxaiSOtDPL64FlZdpGlmRRZW6zIB_EC_tMtaHBiRzF_1350_WKHiUqLKvkSUNrzKP1PXSibJvlpQ x-booking-et-serialized-state: Ef98IG0fjgY56Y63N0XdXtUDZNdmFwr2XgKIh92Hu06LJvnE66CkRQe8kZKZ05qgz x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: 2c8482c2544201f4 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQfrhtLbQ3JoFJ/d3+jTRbAw8j2g3DznWiIRblwWjQRtj/04PDlBt/o55ocKzBIQxZ/e0Rt7iMiaISeSKOQt; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3UgBcvDN2nanV89DesY1vDJpOQG2w5rJXkyq57Fey6ZSnz8XrWS2PFhwhI9Cne4k7CcBnpWWdHk8d9T9HbjGeIc4G5Q%2BiRnb9gzMbtE1%2FYlnt%2BY5fPPq4oxRh3ozHHssIBpfaWe4ho6NxYEhWlBm7qbD3YA0TwWMwA%3D; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42
2024-02-08 18:35:59 UTC	359	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 5f 73 74 61 67 65 22 3a 22 6e 6f 5f 61 64 5f 72 65 74 75 72 6e 65 64 5f 66 72 6f 6d 5f 67 70 74 22 2c 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 55 4e 4b 4e 4f 57 4e 22 2c 22 73 69 74 65 5f 74 79 70 65 22 3a 22 57 57 57 22 2c 22 76 69 73 69 74 6f 72 5f 63 63 22 3a 22 75 73 22 2c 22 61 64 5f 70 6f 73 69 74 69 6f 6e 22 3a 22 49 4e 44 45 58 5f 50 52 49 4d 41 52 59 22 2c 22 70 61 67 65 6e 61 6d 65 22 3a 22 49 4e 44 45 58 22 2c 22 76 65 72 74 69 63 61 6c 22 3a 22 41 43 43 4f 4d 4d 4f 44 41 54 49 4f 4e 53 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 Data Ascii: {"operationName":"trackAdStatus","variables":{"input":{"action_stage":"no_ad_returned_from_gpt","campaign_id":"UNKNOWN","site_type":"WWW","visitor_cc":"us","ad_position":"INDEX_PRIMARY","pagename":"INDEX","vertical":"ACCOMMODATIONS"}},"extensions":{},"que
2024-02-08 18:35:59 UTC	1103	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 361 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:59 GMT vary: Accept-Encoding, User-Agent set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZitMpm0TqG6KE7JbCEBVF%2Bh1bJNZA41%2FoK74k584uhBo%2FBqz5s%2FJ6syNiJP%2Btl22zEZJ8tYeVF2XXJaMJvWgWJnJKEsooMaTrwgciLCUgrspGylznaGb02jCHu%2BgMrXBMWseES1F9ys%2B91XnNJYbDw0%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:59 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=2e4082c7feef0201&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGWAt1Djj9uqkXKH8e8WITLuqCLrlGfftrA x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 4a91a321d4c2ab7334c6f285093956ae.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 8X_t3Re9WDso4PL9iCZkGjwh9wdHjNG4KjhSsMnZBKbluNxneMmGpA==
2024-02-08 18:35:59 UTC	361	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 3a 7b 22 64 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 61 6c 6c 44 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 63 68 69 6c 64 72 65 6e 22 3a 5b 5d 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 41 20 4a 53 4f 4e 20 73 63 61 6c 61 72 22 2c 22 65 78 74 65 6e 73 69 6f 6e 44 65 66 69 6e 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 63 6f 65 72 63 69 6e 67 22 3a 7b 7d 2c 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 6e 61 6d 65 22 3a 22 4a 53 4f 4e 22 2c 22 63 68 69 6c 64 72 65 6e 57 69 74 68 54 79 70 65 52 65 66 65 72 65 6e 63 65 73 22 3a 7b 22 65 6d 70 74 79 22 3a 66 61 6c 73 65 2c 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 61 70 70 6c Data Ascii: {"data":{"trackAdStatus":{"directivesByName":{},"allDirectivesByName":{},"children":[],"description":"A JSON scalar","extensionDefinitions":[],"coercing":{},"appliedDirectives":[],"name":"JSON","childrenWithTypeReferences":{"empty":false,"children":{"appl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
426	192.168.2.5	50228	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	1318	OUT	GET /pagead/1p-user-list/975716499/?random=1707417356815&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_HJeVreViYDXLcWf6R_L2LSf4gUv3DarQGY-WFjASXo1WtBY_&random=2474861554&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:59 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:59 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:59 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
427	192.168.2.5	50222	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive Content-Length: 2560 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:59 UTC	2560	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 6d 32 2b 42 4c 6a 30 6e 41 41 41 41 3a 43 71 7a 32 31 79 33 4a 51 38 42 41 6e 47 39 4a 48 4a 44 68 71 32 64 63 6f 2f 31 4c 30 54 4a 4a 61 79 4f 52 47 65 70 38 33 32 79 72 54 75 72 55 74 56 65 2f 33 35 54 7a 41 4a 6b 54 74 33 36 52 46 46 33 6c 31 2f 6b 4c 6a 47 57 57 39 64 39 69 42 37 35 4e 5a 63 79 70 57 6b 77 77 44 39 4b 6e 67 57 45 75 41 68 41 6c 55 62 55 71 6f 34 72 48 56 31 2b 45 37 39 6d 55 35 69 79 42 41 51 56 32 38 2f 68 62 6f 57 6e 47 4d 58 4c 43 72 65 6f 68 65 77 46 56 46 73 61 77 47 63 30 41 77 55 49 72 37 43 76 68 41 78 2b 46 70 7a 50 4d 39 36 65 36 6a 6d 4e 62 73 51 Data Ascii: {"existing_token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAm2+BLj0nAAAA:Cqz21y3JQ8BAnG9JHJDhq2dco/1L0TJJayORGep832yrTurUtVe/35TzAJkTt36RFF3l1/kLjGWW9d9iB75NZcypWkwwD9KngWEuAhAlUbUqo4rHV1+E79mU5iyBAQV28/hboWnGMXLCreohewFVFsawGc0AwUIr7CvhAx+FpzPM96e6jmNbsQ
2024-02-08 18:35:59 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1212 Connection: close Vary: Accept-Encoding Date: Thu, 08 Feb 2024 18:35:59 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65c51f0f-3a52eaca4ba75d3a37591a25 X-Cache: Miss from cloudfront Via: 1.1 68261aebcfc232344da2ef3bf1d3f9ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: W-nd21B3YlpGZRomfPKGW0e4QiSvWSzdfDYXqZZ6JhCFdwSXlLHhTA==
2024-02-08 18:35:59 UTC	1212	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 6f 69 75 43 71 54 45 43 41 41 41 41 3a 4b 5a 48 30 4c 58 6e 31 4c 6d 74 4c 61 78 34 34 63 72 33 75 6c 4e 37 5a 57 4b 44 4b 6d 6b 77 44 30 66 31 4e 76 78 6b 54 62 2f 6a 4d 71 4e 31 71 56 46 38 2f 50 50 7a 78 5a 33 46 66 47 62 61 63 34 4b 6c 77 4d 7a 56 71 74 48 42 4c 74 6e 7a 33 54 6c 66 59 33 6c 5a 46 4c 75 52 78 42 6f 2f 47 33 47 6f 78 56 70 6c 34 30 50 6d 37 39 52 6d 58 7a 43 35 46 66 66 46 56 7a 6d 74 41 68 66 6c 4b 6b 4b 6b 75 37 71 50 64 45 61 4e 39 74 7a 32 37 65 44 68 45 58 37 57 58 79 45 6d 6d 77 6e 45 38 6c 74 46 56 39 59 57 59 6f 6b 62 57 55 58 4c 4d 51 66 70 47 68 70 54 7a 51 6f 44 54 2f 68 69 Data Ascii: {"token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqTECAAAA:KZH0LXn1LmtLax44cr3ulN7ZWKDKmkwD0f1NvxkTb/jMqN1qVF8/PPzxZ3FfGbac4KlwMzVqtHBLtnz3TlfY3lZFLuRxBo/G3GoxVpl40Pm79RmXzC5FffFVzmtAhflKkKku7qPdEaN9tz27eDhEX7WXyEmmwnE8ltFV9YWYokbWUXLMQfpGhpTzQoDT/hi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
428	192.168.2.5	50231	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	1318	OUT	GET /pagead/1p-user-list/975716499/?random=1707417356784&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_42ioI1Ek00qaYvOFdRw6k6FN1HsC1z-x2AZ4jVpIftSxh6GR&random=3815724033&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:35:59 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:35:59 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:35:59 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
429	192.168.2.5	50230	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	3344	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1907 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: 2c8482c2544201f4 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3UgBcvDN2nanV89DesY1vDJpOQG2w5rJXkyq57Fey6ZSnz8XrWS2PFhwhI9Cne4k7CcBnpWWdHk8d9T9HbjGeIc4G5Q%2BiRnb9gzMbtE1%2FYlnt%2BY5fPPq4oxRh3ozHHssIBpfaWe4ho6NxYEhWlBm7qbD3YA0TwWMwA%3D; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAauuCoe4CAAAA:K1lQMnvwbhrjeE1+SbVHxPPPgukpXhVavnjRqfHXvwEu4MNdPWo9jM8H76Xa918LHxuFz21c6V1bBB/7xxXoFkJW4C6eFKGgPfkNW5GndqZvmvmrJUPY0Nv/imAQxU67dBDE4n7Px3axy3ehQYZ4QIBr76DkS4+4ITvc5Vl0gKXaWhFKFagDreMEbKGYVZrOj3CsSxNLAVj5g9OeNBuwyagHwqstdV4T1qmZUDdXclLvnAdAHFF2Cf3beEHUmkl/Lh/c8Rxh
2024-02-08 18:35:59 UTC	1907	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 68 65 61 64 65 72 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 73 65 72 76 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 32 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 70 72 6f 64 75 63 74 5f 76 65 72 74 69 63 61 6c 73 5f 6c 6f 61 64 65 64 22 3a 5b 7b 22 69 74 65 6d 5f 74 79 70 65 22 3a 22 61 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 73 22 2c 22 69 74 65 6d 5f 70 6f 73 69 74 69 6f 6e 22 3a 31 2c 22 69 73 5f 69 74 65 6d 5f 70 72 65 73 65 6c 65 63 74 65 64 22 3a 31 7d 2c 7b 22 69 74 65 6d 5f 74 79 70 65 22 3a 22 66 6c 69 67 68 74 73 22 2c 22 69 74 65 6d 5f 70 6f 73 69 74 69 6f 6e 22 3a 32 2c 22 69 73 5f 69 74 65 6d 5f 70 72 65 73 65 6c Data Ascii: {"events":[{"action_name":"webcoreux.header_component_served","action_version":"2.0.0","content":{"product_verticals_loaded":[{"item_type":"accommodations","item_position":1,"is_item_preselected":1},{"item_type":"flights","item_position":2,"is_item_presel
2024-02-08 18:35:59 UTC	1183	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 53 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:59 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBtrc9jcR8FHAZMgVsPDpO7k61zYzfvcAjZN%2BRki3c7UB%2FOuaskM%2BulJtHBypfdA2BES%2BlLjXxKGd68SboO%2Fp2Ri04nFqIp7HVkQPT9nEDvUCCQBd6%2FR6wuKsN%2BN1DK7Om0UrYAl3FZmR8FDwhcQqTgfv7vCcNkKImo%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:59 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=3c9282c7c9dd02b8&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqss5yH-soXs1oXdgwmTOt1LYPQVSXBourxg x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 6f067a3fd6e721a7db2a2901701a65d8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: dd6dspD9p9u0YIx2ln_nJxLlNQGnJzmTz0jPKHdWZABl9Rj86ZpOwA==
2024-02-08 18:35:59 UTC	53	IN	Data Raw: 5b 7b 22 63 6f 64 65 22 3a 39 2c 22 73 74 61 74 75 73 22 3a 30 7d 2c 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d 5d Data Ascii: [{"code":9,"status":0},{"content":"Sent","status":1}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
430	192.168.2.5	50232	151.101.128.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	1746	OUT	GET /v3/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%23indexsearch%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%226461a31a%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1707417357983 HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSY4dDVmd0o2ZzF4RVN2ZHlPL090aCt3NnpTWkZQdlF2bFR0OHJrNFBlM3NYbW9ucGRrMGIrL0lES2pGVnRRNzVaWitlbjRUZDhYVzc2U2E3ZFFrSzhES2RCUlpvb2tIT1pnU2JNS1FUWTd3bz0mclU4SWk0WVFTSXEwdmVJSEttb3prYlpuZzBjPQ=="
2024-02-08 18:36:00 UTC	594	IN	HTTP/1.1 200 OK Connection: close Content-Length: 35 cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT content-type: image/gif access-control-allow-origin: * set-cookie: ar_debug=1; Expires=Fri, 07 Feb 2025 18:36:00 GMT; Path=/; Domain=.pinterest.com; Secure; HTTPOnly; SameSite=None x-envoy-upstream-service-time: 1 referrer-policy: origin x-pinterest-rid: 4843844427758583 Date: Thu, 08 Feb 2024 18:36:00 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: f9d1c7100d6ab6a9fc70375cea0fca5e275d3fa9
2024-02-08 18:36:00 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
431	192.168.2.5	50234	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	5513	OUT	POST /sendlayoutevents HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 116 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3 X-Booking-AID: 304142 X-Booking-Pageview-Id: 2c8482c2544201f4 X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,1912460\|1,1856870\|1,1912460\|7,1908890\|1,1912460\|6,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|4,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|2,cCHObKdBdUHINPSXeHDALOLOLMO\|5,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,cCHObKdBdUHINPSXeHDALOLOLMO\|3 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7 sec-ch-ua-platform: "Windows" X-Booking-Language-Code: en-us X-Booking-CSRF: RVfFZQAAAAA=qVueflVyIcgKOJdfCMKcmiDGjvY9UqM_W79drieypCCd1wLxtNOjZPcMNKEslcD0Tiyh8b7rdIv86FT89bynmubUkLo31LJ5cM248yQm3ulKZFWN-WKHCjXqy964TaJvn5A_S7b4oaNG1jhNZ7aGF2JNPgwXGQBCPiOREYDFBwUwhotUpEosEVmLfdyz_vXpYSXlaaCHZibCaVWm sec-ch-ua-mobile: ?0 X-Partner-Channel-Id: 3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAKFvpSuBsACAdICJDdhNmRhMmNiLThiNjMtNDQ1OS04MGUwLTI1OGM3NjBkNWQzMdgCBeACAQ Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Accept: application/json, text/javascript, /; q=0.01 X-Booking-SiteType-Id: 1 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3UgBcvDN2nanV89DesY1vDJpOQG2w5rJXkyq57Fey6ZSnz8XrWS2PFhwhI9Cne4k7CcBnpWWdHk8d9T9HbjGeIc4G5Q%2BiRnb9gzMbtE1%2FYlnt%2BY5fPPq4oxRh3ozHHssIBpfaWe4ho6NxYEhWlBm7qbD3YA0TwWMwA%3D; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAauuCoe4CAAAA:K1lQMnvwbhrjeE1+SbVHxPPPgukpXhVavnjRqfHXvwEu4MNdPWo9jM8H76Xa918LHxuFz21c6V1bBB/7xxXoFkJW4C6eFKGgPfkNW5GndqZvmvmrJUPY0Nv/imAQxU67dBDE4n7Px3axy3ehQYZ4QIBr76DkS4+4ITvc5Vl0gKXaWhFKFagDreMEbKGYVZrOj3CsSxNLAVj5g9OeNBuwyagHwqstdV4T1qmZUDdXclLvnAdAHFF2Cf3beEHUmkl/Lh/c8Rxh
2024-02-08 18:35:59 UTC	116	OUT	Data Raw: 6c 61 79 6f 75 74 3d 33 34 25 32 43 36 25 32 43 32 25 32 43 39 25 32 43 37 25 32 43 35 25 32 43 32 37 25 32 43 31 25 32 43 34 34 25 32 43 33 25 32 43 34 30 25 32 43 34 25 32 43 31 30 25 32 43 33 32 25 32 43 33 36 25 32 43 31 39 26 61 63 74 69 6f 6e 3d 76 69 65 77 26 77 69 64 67 65 74 3d 35 26 68 61 73 5f 6f 70 65 6e 5f 62 6f 6f 6b 69 6e 67 73 3d Data Ascii: layout=34%2C6%2C2%2C9%2C7%2C5%2C27%2C1%2C44%2C3%2C40%2C4%2C10%2C32%2C36%2C19&action=view&widget=5&has_open_bookings=
2024-02-08 18:36:00 UTC	1189	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 14 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:59 GMT vary: User-Agent, Accept-Encoding access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPeeJerkuRbUZA%2BPRzRaCjWBf0aeIAzjJYeCqWjvWib93jzmUJne1zpitioAq4%2BmSIEp%2F7vTTjKMP6rLXy%2F9TicnCD%2B%2BY3pM0SNjKB%2F9PO7QqKmhL5Z96cQNw5T9bqjOmj%2Fr%2BEPz%2BKC8vaSnNOzp6OQ5qdUSYpaUaNrA%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:59 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=0b5082c7a4c6010d&e=UmFuZG9tSVYkc2RlIyh9YReXsVhv1rQKB4Zv_9za_vfe2q-QyefqVWBBu5hMNvTgtDLWk9uG53I x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 b0c7b942a33f0f4451718aee53f7840c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 0B6AsXx4YBgkdVgA7mpTeaaP6CmGDPkmWQGiP4IAxO5nWEUiLVYs7g==
2024-02-08 18:36:00 UTC	14	IN	Data Raw: 5b 7b 22 73 74 61 74 75 73 22 3a 31 7d 5d Data Ascii: [{"status":1}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
432	192.168.2.5	50233	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	3619	OUT	POST /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 359 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNzQxNzM1MCwiZXhwIjoxNzA3NTAzNzUwfQ.GScpUqtXyYVxaiSOtDPL64FlZdpGlmRRZW6zIB_EC_tMtaHBiRzF_1350_WKHiUqLKvkSUNrzKP1PXSibJvlpQ x-booking-et-serialized-state: Ef98IG0fjgY56Y63N0XdXtUDZNdmFwr2XgKIh92Hu06LJvnE66CkRQe8kZKZ05qgz x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: 2c8482c2544201f4 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3UgBcvDN2nanV89DesY1vDJpOQG2w5rJXkyq57Fey6ZSnz8XrWS2PFhwhI9Cne4k7CcBnpWWdHk8d9T9HbjGeIc4G5Q%2BiRnb9gzMbtE1%2FYlnt%2BY5fPPq4oxRh3ozHHssIBpfaWe4ho6NxYEhWlBm7qbD3YA0TwWMwA%3D; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAauuCoe4CAAAA:K1lQMnvwbhrjeE1+SbVHxPPPgukpXhVavnjRqfHXvwEu4MNdPWo9jM8H76Xa918LHxuFz21c6V1bBB/7xxXoFkJW4C6eFKGgPfkNW5GndqZvmvmrJUPY0Nv/imAQxU67dBDE4n7Px3axy3ehQYZ4QIBr76DkS4+4ITvc5Vl0gKXaWhFKFagDreMEbKGYVZrOj3CsSxNLAVj5g9OeNBuwyagHwqstdV4T1qmZUDdXclLvnAdAHFF2Cf3beEHUmkl/Lh/c8Rxh
2024-02-08 18:35:59 UTC	359	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 5f 73 74 61 67 65 22 3a 22 61 64 5f 62 6c 6f 63 6b 65 72 5f 6e 6f 74 5f 64 65 74 65 63 74 65 64 22 2c 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 55 4e 4b 4e 4f 57 4e 22 2c 22 73 69 74 65 5f 74 79 70 65 22 3a 22 57 57 57 22 2c 22 76 69 73 69 74 6f 72 5f 63 63 22 3a 22 75 73 22 2c 22 61 64 5f 70 6f 73 69 74 69 6f 6e 22 3a 22 49 4e 44 45 58 5f 50 52 49 4d 41 52 59 22 2c 22 70 61 67 65 6e 61 6d 65 22 3a 22 49 4e 44 45 58 22 2c 22 76 65 72 74 69 63 61 6c 22 3a 22 41 43 43 4f 4d 4d 4f 44 41 54 49 4f 4e 53 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 Data Ascii: {"operationName":"trackAdStatus","variables":{"input":{"action_stage":"ad_blocker_not_detected","campaign_id":"UNKNOWN","site_type":"WWW","visitor_cc":"us","ad_position":"INDEX_PRIMARY","pagename":"INDEX","vertical":"ACCOMMODATIONS"}},"extensions":{},"que
2024-02-08 18:36:00 UTC	1103	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 361 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:59 GMT vary: Accept-Encoding, User-Agent set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBK6LEtX6%2Blc%2BcKlaP5cQW5KLs4U86UGg%2BbJDD7HkFvsjc7A%2F1QvzoPs6%2FuLDGo9NVYFn3%2FAJxK1ThMiIBYa40CrngHmxgTkmXzla6e5GNksHflIAyjMTCMuU%2BHdLJvR8JFkGnVBSIWbzUoy%2FeL9yW29VxHcr1Zq6UM%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:35:59 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=f6b082c7c6ea03bc&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGcYkjXJOsweqeSsRyaIlRPto4ezj0DBkPA x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 c1bfc7dbcf7f9782aa3be590b7ce3d6a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 7BpQn10ujFT8o9-hULgvorli_I63gwhIs6Zi3uU4EalMPlY5dyhtQQ==
2024-02-08 18:36:00 UTC	361	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 3a 7b 22 64 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 63 6f 65 72 63 69 6e 67 22 3a 7b 7d 2c 22 63 68 69 6c 64 72 65 6e 57 69 74 68 54 79 70 65 52 65 66 65 72 65 6e 63 65 73 22 3a 7b 22 65 6d 70 74 79 22 3a 66 61 6c 73 65 2c 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 7d 2c 22 63 68 69 6c 64 72 65 6e 41 73 4c 69 73 74 22 3a 5b 5d 7d 2c 22 61 6c 6c 44 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 63 68 69 6c 64 72 65 6e 22 3a 5b 5d 2c 22 65 78 74 65 6e 73 69 6f 6e 44 65 66 69 6e 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 61 70 70 6c 69 65 64 44 69 72 Data Ascii: {"data":{"trackAdStatus":{"directivesByName":{},"coercing":{},"childrenWithTypeReferences":{"empty":false,"children":{"appliedDirectives":[],"directives":[]},"childrenAsList":[]},"allDirectivesByName":{},"children":[],"extensionDefinitions":[],"appliedDir

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
433	192.168.2.5	50235	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	3589	OUT	GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=2c8482c2544201f4&ete=&etg=&etcg=cCHObEfEITNPfbeQMIaWYUQJFFQccCcCcCC\|5&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,cCHObKdBdUHINPSXeHDALOLOLMO\|3&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-ET-Serialized-State: Ef98IG0fjgY56Y63N0XdXtUDZNdmFwr2XgKIh92Hu06LJvnE66CkRQe8kZKZ05qgz X-Booking-Language-Code: en-us X-Booking-Client-Info: sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: 2c8482c2544201f4 X-Booking-Info: X-Booking-SiteType-Id: 1 X-Booking-Session-Id: db6e5bbb32eac0e80cfcae9b22f5390d sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3UgBcvDN2nanV89DesY1vDJpOQG2w5rJXkyq57Fey6ZSnz8XrWS2PFhwhI9Cne4k7CcBnpWWdHk8d9T9HbjGeIc4G5Q%2BiRnb9gzMbtE1%2FYlnt%2BY5fPPq4oxRh3ozHHssIBpfaWe4ho6NxYEhWlBm7qbD3YA0TwWMwA%3D; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAauuCoe4CAAAA:K1lQMnvwbhrjeE1+SbVHxPPPgukpXhVavnjRqfHXvwEu4MNdPWo9jM8H76Xa918LHxuFz21c6V1bBB/7xxXoFkJW4C6eFKGgPfkNW5GndqZvmvmrJUPY0Nv/imAQxU67dBDE4n7Px3axy3ehQYZ4QIBr76DkS4+4ITvc5Vl0gKXaWhFKFagDreMEbKGYVZrOj3CsSxNLAVj5g9OeNBuwyagHwqstdV4T1qmZUDdXclLvnAdAHFF2Cf3beEHUmkl/Lh/c8Rxh
2024-02-08 18:35:59 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:59 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=797d82c774da00ff&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejL9JSW56Eiteuqm23VbuLmeWBlCgvXDZUk x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 d48a409d6a3222e2cc9a060d30206d3c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: pJYQDkQ6dXzdp68yZqcMasTeo7sUwid04BxagqAW18CTO1DM2sJIaw==
2024-02-08 18:35:59 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
434	192.168.2.5	50237	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	3371	OUT	GET /js_tracking?aid=304142&pid=2c8482c2544201f4&ver=2&sid=5171fc655664ddf74ab763a094523fb7&ref_action=index&lang=en-us&stype=1&ete=&etg=&etcg=&ets=cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3&etgwv=js_web_vitals_cls_per_mille\|1&m=UmFuZG9tSVYkc2RlIyh9YYo1mfebd19Q2WIimWOyIN1gUe4_-JQdNOBTMuHuYCJPue7ik10LWViyRYmmf149m9vSAg2JJTyfAEk9RiEQZejXjro5rDJvxnq57UaGsDKd0iBXLkMuV2sFYEHSFmXZW5zvkIdbv7-B87Oi9zo36Fnq7AU8K4Y8Y-SdtsN1A2dfLiciDUxBuNe45QSxoxZcHhPcdr6v26QamVEbge_7LQ_MDhbvlSKq9Lwf9P11FwHzxPymBNBmu_dZFb8tK9Z3wY0RAyYm7D0hfdu-LCtv4j3isKKp1L_CiYhwCnyC42X_OqimTrSjKXCbKfd3YnkJbQ HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAauuCoe4CAAAA:K1lQMnvwbhrjeE1+SbVHxPPPgukpXhVavnjRqfHXvwEu4MNdPWo9jM8H76Xa918LHxuFz21c6V1bBB/7xxXoFkJW4C6eFKGgPfkNW5GndqZvmvmrJUPY0Nv/imAQxU67dBDE4n7Px3axy3ehQYZ4QIBr76DkS4+4ITvc5Vl0gKXaWhFKFagDreMEbKGYVZrOj3CsSxNLAVj5g9OeNBuwyagHwqstdV4T1qmZUDdXclLvnAdAHFF2Cf3beEHUmkl/Lh/c8Rxh; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhMkPrb7BMdgkeBlz9oHfYQuoYGiM4pBYZsR%2FHlaqFOXgTZUhpPTElQGaxRiPA1iwdBpvuySMc986R8T0pwU%2BGYv2d6r9dFCh8SPiGQb1F993nZXnhDTp%2BFtyEtuJp0WMukPWkwubQ56I6hY%2B%2BQ%2FLAU%3D
2024-02-08 18:35:59 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:59 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=54ce82c7696602b7&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejLgZxK0e26HOqpvwQTPszFKGiORVW8zJno x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 3f95374273631adbfd8e0d0a9f6d7b64.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 9NTUchHcirqwe5we2AgK4dF5Od003oN_P5gQ_B1zBOGHGJL8SwQ2Hw==
2024-02-08 18:35:59 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
435	192.168.2.5	50236	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	2823	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAauuCoe4CAAAA:K1lQMnvwbhrjeE1+SbVHxPPPgukpXhVavnjRqfHXvwEu4MNdPWo9jM8H76Xa918LHxuFz21c6V1bBB/7xxXoFkJW4C6eFKGgPfkNW5GndqZvmvmrJUPY0Nv/imAQxU67dBDE4n7Px3axy3ehQYZ4QIBr76DkS4+4ITvc5Vl0gKXaWhFKFagDreMEbKGYVZrOj3CsSxNLAVj5g9OeNBuwyagHwqstdV4T1qmZUDdXclLvnAdAHFF2Cf3beEHUmkl/Lh/c8Rxh; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhMkPrb7BMdgkeBlz9oHfYQuoYGiM4pBYZsR%2FHlaqFOXgTZUhpPTElQGaxRiPA1iwdBpvuySMc986R8T0pwU%2BGYv2d6r9dFCh8SPiGQb1F993nZXnhDTp%2BFtyEtuJp0WMukPWkwubQ56I6hY%2B%2BQ%2FLAU%3D
2024-02-08 18:35:59 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:59 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=d59682c7d4d600bf&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqstUe95P5q-APun83hUAFADAjQNs4eZLYsw x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 f4c38e024a95b76a27c9f3dc9ff2eda6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: zCiTpPkaJfBjiMdzo6hPBJBpuUK4uwC5KByQxJuh-79sGVsG3hHhcw==
2024-02-08 18:35:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
436	192.168.2.5	50238	3.162.125.41	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	2176	OUT	GET /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=BXAbRIVE HTTP/1.1 Host: accommodations.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhMkPrb7BMdgkeBlz9oHfYQuoYGiM4pBYZsR%2FHlaqFOXgTZUhpPTElQGaxRiPA1iwdBpvuySMc986R8T0pwU%2BGYv2d6r9dFCh8SPiGQb1F993nZXnhDTp%2BFtyEtuJp0WMukPWkwubQ56I6hY%2B%2BQ%2FLAU%3D
2024-02-08 18:36:00 UTC	556	IN	HTTP/1.1 200 OK Content-Type: application/json Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:35:59 GMT x-frame-options: SAMEORIGIN x-content-type-options: nosniff vary: Accept-Encoding referrer-policy: no-referrer strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 0a2ddb6f9b0df10d973faa154be16dba.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P3 X-Amz-Cf-Id: tQs9XnHUzleQOmiEn7_Y6ofdwrzEoOSqlzGzto6yHnzsXyJyGyQ0ew==
2024-02-08 18:36:00 UTC	6435	IN	Data Raw: 31 39 31 62 0d 0a 7b 22 63 68 75 6e 6b 73 22 3a 5b 22 62 39 61 38 32 63 62 38 22 5d 2c 22 65 78 70 65 72 69 6d 65 6e 74 54 61 67 73 22 3a 7b 22 59 54 54 48 62 58 65 65 56 65 43 46 5a 41 63 62 52 62 52 4f 66 4c 4d 54 65 43 59 48 44 52 46 63 4f 22 3a 31 2c 22 48 4d 62 4f 48 4e 46 50 42 4a 59 49 59 4b 63 50 4e 53 4e 48 52 55 65 42 4f 46 4f 22 3a 31 7d 2c 22 66 65 61 74 75 72 65 4e 61 6d 65 73 22 3a 7b 22 49 65 5a 58 58 44 4e 46 56 46 4b 4f 55 59 4c 4c 46 4a 59 62 43 63 65 4d 4e 50 56 62 50 53 55 61 62 53 63 63 45 54 4b 65 22 3a 66 61 6c 73 65 2c 22 45 42 44 49 62 49 62 58 44 65 42 47 47 54 63 5a 4a 46 66 48 62 65 4d 50 45 54 22 3a 74 72 75 65 2c 22 49 65 50 46 62 4a 4d 46 56 46 4b 4f 55 59 4c 4c 48 4e 4f 56 52 65 22 3a 74 72 75 65 7d 2c 22 73 65 6f 45 78 70 Data Ascii: 191b{"chunks":["b9a82cb8"],"experimentTags":{"YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO":1,"HMbOHNFPBJYIYKcPNSNHRUeBOFO":1},"featureNames":{"IeZXXDNFVFKOUYLLFJYbCceMNPVbPSUabSccETKe":false,"EBDIbIbXDeBGGTcZJFfHbeMPET":true,"IePFbJMFVFKOUYLLHNOVRe":true},"seoExp
2024-02-08 18:36:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
437	192.168.2.5	50241	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	717	OUT	POST /p HTTP/1.1 Host: tr6.snapchat.com Connection: keep-alive Content-Length: 897 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:35:59 UTC	897	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 65 32 63 65 64 30 36 34 2d 33 31 34 64 2d 34 63 62 63 2d 61 61 37 61 2d 35 62 31 66 38 64 36 61 61 34 39 34 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 34 66 64 38 31 34 33 30 2d 34 62 34 65 2d 34 62 33 65 2d 61 35 39 37 2d 61 33 32 37 36 64 66 61 36 31 33 64 22 2c 22 73 73 22 3a 22 32 32 34 65 39 64 61 32 2d 33 65 62 65 2d 34 64 65 30 2d 39 34 62 61 2d 30 64 35 64 32 32 63 39 35 62 37 66 22 2c 22 64 66 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"e2ced064-314d-4cbc-aa7a-5b1f8d6aa494","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"4fd81430-4b4e-4b3e-a597-a3276dfa613d","ss":"224e9da2-3ebe-4de0-94ba-0d5d22c95b7f","df":true,"s
2024-02-08 18:35:59 UTC	429	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:35:59 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
438	192.168.2.5	50242	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	717	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 8472 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:35:59 UTC	8472	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 65 32 63 65 64 30 36 34 2d 33 31 34 64 2d 34 63 62 63 2d 61 61 37 61 2d 35 62 31 66 38 64 36 61 61 34 39 34 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 32 66 66 30 34 31 36 64 2d 64 34 39 32 2d 34 38 61 39 2d 61 31 34 36 2d 31 34 32 64 39 37 39 37 37 36 63 64 22 2c 22 73 73 22 3a 22 32 32 34 65 39 64 61 32 2d 33 65 62 65 2d 34 64 65 30 2d 39 34 62 61 2d 30 64 35 64 32 32 63 39 35 62 37 66 22 2c 22 64 66 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"e2ced064-314d-4cbc-aa7a-5b1f8d6aa494","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"2ff0416d-d492-48a9-a146-142d979776cd","ss":"224e9da2-3ebe-4de0-94ba-0d5d22c95b7f","df":true,"s
2024-02-08 18:35:59 UTC	482	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:35:59 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 2 server: API Gateway alt-svc: clear access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
439	192.168.2.5	50240	18.238.55.22	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	686	OUT	GET /xdata/images/hotel/263x210/100235855.jpeg?k=5b6e6cff16cfd290e953768d63ee15f633b56348238a705c45759aa3a81ba82b&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:35:59 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sun, 21 Jan 2024 16:24:01 GMT ETag: "9aff9e5c9b69d9442b7f563196b1a2235d432b9f" Content-Language: 12530 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 590897dc65a5ea6dcbac1c8ea98c65c4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P4 X-Amz-Cf-Id: 8rUDYrEOSbX8iMSj00fz37Eny9gjoQ9RiEj9OCt_cIrjqe-Xmc5A_A== Age: 1563118
2024-02-08 18:35:59 UTC	12543	IN	Data Raw: 33 30 66 32 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 30f2JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
440	192.168.2.5	50239	18.238.55.22	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	686	OUT	GET /xdata/images/xphoto/263x210/57584488.jpeg?k=d8d4706fc72ee789d870eb6b05c0e546fd4ad85d72a3af3e30fb80ca72f0ba57&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:00 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Tue, 30 Jan 2024 04:39:46 GMT Content-Language: 8621 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "196fea0ab45d56a1dbce18f3c3cd9eb1a591fb85" X-Cache: Hit from cloudfront Via: 1.1 b88fe06cb643513c120238beec43283e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P4 X-Amz-Cf-Id: WpW_MAFkctTl79KFvuQS9gCeiZHIHv5LCdmcMGmvDi3NCFgGTElJFw== Age: 827773
2024-02-08 18:36:00 UTC	8629	IN	Data Raw: 32 31 61 64 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 21adJFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:36:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
441	192.168.2.5	50243	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	3346	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 3966 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: 2c8482c2544201f4 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAauuCoe4CAAAA:K1lQMnvwbhrjeE1+SbVHxPPPgukpXhVavnjRqfHXvwEu4MNdPWo9jM8H76Xa918LHxuFz21c6V1bBB/7xxXoFkJW4C6eFKGgPfkNW5GndqZvmvmrJUPY0Nv/imAQxU67dBDE4n7Px3axy3ehQYZ4QIBr76DkS4+4ITvc5Vl0gKXaWhFKFagDreMEbKGYVZrOj3CsSxNLAVj5g9OeNBuwyagHwqstdV4T1qmZUDdXclLvnAdAHFF2Cf3beEHUmkl/Lh/c8Rxh; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBtrc9jcR8FHAZMgVsPDpO7k61zYzfvcAjZN%2BRki3c7UB3918wAejvzi8Uw9wj94zjKlskVeTbjCxUVFcfkqNKas8HUPlorLCqhSg%2BuX8%2BK09RWBvmliG5DU9pml%2FAvTAo8b0NT01eyZ7LmqOV9j%2FXUt583TZ0KwvdQ%3D
2024-02-08 18:35:59 UTC	3966	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 68 65 72 6f 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 76 69 65 77 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 31 63 65 30 36 32 65 66 2d 62 30 33 33 2d 34 33 30 34 2d 39 34 62 65 2d 31 35 61 31 64 33 38 65 32 64 63 31 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 6c 6f 63 61 6c 22 3a 7b 22 6c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 75 73 22 7d 2c 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 23 69 Data Ascii: {"events":[{"action_name":"webcoreux.hero_component_viewed","action_version":"1.0.0","content":{"campaign_id":"1ce062ef-b033-4304-94be-15a1d38e2dc1"},"context":{"local":{"language":"en-us"},"page":{"page_referrer":"","page_url":"https://www.booking.com/#i
2024-02-08 18:36:00 UTC	1178	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 211 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:00 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:00 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=15c582c8440a00da&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsuoOO22qnqmmP3zpGmlv4pyZlUgLveq-_4 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 b0c7b942a33f0f4451718aee53f7840c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: gxewv6kt2oW585DZBrp9NBCk5Po2HUT5roWbqWrzqnejp0EMKB_2Wg==
2024-02-08 18:36:00 UTC	211	IN	Data Raw: 5b 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d 2c 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d 2c 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d 2c 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d 2c 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d 2c 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d 2c 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d 5d Data Ascii: [{"status":1,"content":"Sent"},{"status":1,"content":"Sent"},{"content":"Sent","status":1},{"status":1,"content":"Sent"},{"content":"Sent","status":1},{"content":"Sent","status":1},{"status":1,"content":"Sent"}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
442	192.168.2.5	50244	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	681	OUT	GET /xdata/images/city/170x136/977409.jpg?k=82c14f9e6cea94829ee0528a3aa4324111d3482e9f095194500746fa7ca2769e&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:00 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sun, 28 Jan 2024 04:59:48 GMT ETag: "ddc288c9f52dca1aef2566f3098edeae42f8480a" Content-Language: 8642 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 8c7b20060d90bea31f16760f6840aa40.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: lbc6zK-2-I7s4VFm9joMuYINrEXdm0ALTIhKwox5tU224Cd1KT3FzQ== Age: 999372
2024-02-08 18:36:00 UTC	8650	IN	Data Raw: 32 31 63 32 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 21c2JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:36:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
443	192.168.2.5	50245	18.238.55.22	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	681	OUT	GET /xdata/images/city/170x136/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:00 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 7768 Connection: close Server: nginx Date: Sun, 21 Jan 2024 15:42:33 GMT ETag: "9dc6e5d881bbf48e208e43aee1386e512a6c4f79" Content-Language: 7768 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 590897dc65a5ea6dcbac1c8ea98c65c4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P4 X-Amz-Cf-Id: tbkaYsYZCXo1su5dqL7gxLow7zJNGnUSfO5XA4ItkcpXNWyw-K96sg== Age: 1565607
2024-02-08 18:36:00 UTC	7768	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
444	192.168.2.5	50246	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	681	OUT	GET /xdata/images/city/170x136/976877.jpg?k=2aab28217f0fb039e0f35ea2b2c3976141b5860b074f74220edf998115935cda&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:00 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sat, 03 Feb 2024 04:46:57 GMT Content-Language: 8350 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "40721dda4c91c5977182d60b367c4d39dec3ab3d" X-Cache: Hit from cloudfront Via: 1.1 2d1c46f78407b3ac919cadf865dd3246.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: OQEHT3DoNrshCORq5oIe-wWonxwSXW9GynnsS8lPHuPifK_cgdrTvg== Age: 481743
2024-02-08 18:36:00 UTC	6398	IN	Data Raw: 31 38 66 36 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 18f6JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:36:00 UTC	1967	IN	Data Raw: 37 61 38 0d 0a 00 f8 07 47 e0 32 5f 41 94 93 ff 00 2f 0d d8 0e cb 56 35 96 54 f1 56 85 23 64 00 f3 83 ff 00 7c 55 6f 00 95 4d 09 c7 3f eb db f9 0a b3 ac 39 4d 7f 44 62 bf f2 f1 27 5f 42 87 a5 42 5f bf f9 9e 34 5f ee 8c ff 00 12 5b 5c 47 61 f6 a4 da f2 35 ec 6e 8a 41 19 c0 60 a3 9f a8 ad 0b cd 3e 0b bf 08 5d 5b e3 7b bc 72 cf 12 30 e5 5d b2 f8 cf fb d5 af 7f 1c 37 56 7b 41 8d c8 90 36 32 0f 4a 86 08 42 e0 70 2b a1 e8 ee 4a 77 8d 89 f4 4d 2e 18 7c 25 16 95 74 1b c9 68 ca be 09 1c 12 4f 5e d5 e7 1e 2d 86 2b 1f 16 44 2d e4 0d 6a c2 32 b8 6c e0 01 8e 4f fc 06 bd 4e 0d ca 31 b8 1f 72 2b 94 f8 81 a5 24 f6 10 df a8 fd f4 32 28 66 55 fe 13 c7 f3 fa 9a d2 0f 53 29 47 43 ae d6 34 d8 3c 4d a4 4d a7 b5 c4 91 79 83 ef 42 09 3f 9e 2b 8e 4f 85 96 11 61 24 bd 90 80 31 93 Data Ascii: 7a8G2_A/V5TV#d\|UoM?9MDb'_BB_4_[\Ga5nA`>][{r0]7V{A62JBp+JwM.\|%thO^-+D-j2lON1r+$2(fUS)GC4<MMyB?+Oa$1
2024-02-08 18:36:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
445	192.168.2.5	50247	151.101.128.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:35:59 UTC	1949	OUT	GET /v3/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1707417358880&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA%22%2C%22aem_eligible_list%22%3A%5B%22fn%22%5D%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%23indexsearch%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%226461a31a%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSY4dDVmd0o2ZzF4RVN2ZHlPL090aCt3NnpTWkZQdlF2bFR0OHJrNFBlM3NYbW9ucGRrMGIrL0lES2pGVnRRNzVaWitlbjRUZDhYVzc2U2E3ZFFrSzhES2RCUlpvb2tIT1pnU2JNS1FUWTd3bz0mclU4SWk0WVFTSXEwdmVJSEttb3prYlpuZzBjPQ=="
2024-02-08 18:36:00 UTC	914	IN	HTTP/1.1 200 OK Connection: close Content-Length: 35 cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT content-type: image/gif access-control-allow-origin: * set-cookie: ar_debug=1; Expires=Fri, 07 Feb 2025 18:36:00 GMT; Path=/; Domain=.pinterest.com; Secure; HTTPOnly; SameSite=None set-cookie: _pinterest_ct_ua="TWc9PSZTaWxiNnRDMy9JV0h1aGhEb1ZWT0pJR2N4OVhNTUFySysyd0MyYlJJZURDYVA0NEJsWkRmdjVWNFB5OEtwc1VNSVpJVmM3UVBnNlh4TXB6RExNN2lDdHIxSk5zQ0RjdlZiSHh0ZGFPbThlRT0mTFJRTHkyRnB4cUZkQmZ6YUIwR1l2Y2NzbDNRPQ=="; Expires=Fri, 07 Feb 2025 18:36:00 GMT; Path=/; Domain=ct.pinterest.com; Secure; SameSite=None x-envoy-upstream-service-time: 3 referrer-policy: origin x-pinterest-rid: 1076132394368305 Date: Thu, 08 Feb 2024 18:36:00 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: f9d1c7100d6ab6a9fc70375cea0fca5e275d3fa9
2024-02-08 18:36:00 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
446	192.168.2.5	50249	3.161.193.117	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	2105	OUT	GET /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBtrc9jcR8FHAZMgVsPDpO7k61zYzfvcAjZN%2BRki3c7UB3918wAejvzi8Uw9wj94zjKlskVeTbjCxUVFcfkqNKas8HUPlorLCqhSg%2BuX8%2BK09RWBvmliG5DU9pml%2FAvTAo8b0NT01eyZ7LmqOV9j%2FXUt583TZ0KwvdQ%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA
2024-02-08 18:36:00 UTC	513	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html;charset=iso-8859-1 Content-Length: 411 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:00 GMT cache-control: must-revalidate,no-cache,no-store strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 d3b019645d09c89af6e150e75be90942.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P8 X-Amz-Cf-Id: Ep7WHPGBJVDLpTdtQSa7AdqlOadnlh66EAwwPmuMVlW86ZCl3EDsnQ==
2024-02-08 18:36:00 UTC	411	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 2f 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 32 3e 48 54 54 50 20 45 52 52 4f 52 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 32 3e 0a 3c 74 61 62 6c 65 3e 0a 3c 74 72 3e 3c 74 68 3e 55 52 49 3a 3c 2f 74 68 3e 3c 74 64 3e 2f 77 65 62 2d 76 69 74 61 6c 73 2f 73 65 6e 64 2d 76 69 74 61 6c 73 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/><title>Error 405 Method Not Allowed</title></head><body><h2>HTTP ERROR 405 Method Not Allowed</h2><table><tr><th>URI:</th><td>/web-vitals/send-vitals</td></tr><tr>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
447	192.168.2.5	50251	108.177.122.148	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	1177	OUT	GET /activity;register_conversion=1;src=4228414;type=views;cat=views;ord=4050429631327;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=1884632172;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:36:00 UTC	2216	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:00 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"6432892630366387804"}],"aggregatable_trigger_data":[{"filters":{"14":["11794238"]},"key_piece":"0x5bdccd6bd67d4e1c","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xa446ee5f5be5ef06","not_filters":{"14":["11794238"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["11794238"]},"key_piece":"0xd3325b43d3d15f8b","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x22c5b735c1232ea8","not_filters":{"14":["11794238"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"17667716434259013476","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"6432892630366387804","filters":{"14":["11794238"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"6432892630366387804","filters":{"14":["11794238"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"6432892630366387804","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"6432892630366387804","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["4228414"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sat, 09-Mar-2024 18:36:00 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
448	192.168.2.5	50248	18.67.65.100	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:00 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Thu, 08 Feb 2024 18:36:00 GMT X-Cache: Error from cloudfront Via: 1.1 5148e372b4ab17878741ea92be548472.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: PvqRvKUgTa1ZCfDwZcf5h3Jc_MN7nh4i_TcNpK-X1C9ype33FKe_bg==
2024-02-08 18:36:00 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
449	192.168.2.5	50250	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	3328	OUT	GET /js_tracking?aid=304142&pid=2c8482c2544201f4&ver=2&sid=5171fc655664ddf74ab763a094523fb7&ref_action=index&lang=en-us&stype=1&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|3239&m=UmFuZG9tSVYkc2RlIyh9YYo1mfebd19Q2WIimWOyIN1gUe4_-JQdNOBTMuHuYCJPue7ik10LWViyRYmmf149m9vSAg2JJTyfAEk9RiEQZejXjro5rDJvxnq57UaGsDKd0iBXLkMuV2sFYEHSFmXZW5zvkIdbv7-B87Oi9zo36Fnq7AU8K4Y8Y-SdtsN1A2dfLiciDUxBuNe45QSxoxZcHhPcdr6v26QamVEbge_7LQ_MDhbvlSKq9Lwf9P11FwHzxPymBNBmu_dZFb8tK9Z3wY0RAyYm7D0hfdu-LCtv4j3isKKp1L_CiYhwCnyC42X_OqimTrSjKXCbKfd3YnkJbQ HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBtrc9jcR8FHAZMgVsPDpO7k61zYzfvcAjZN%2BRki3c7UB3918wAejvzi8Uw9wj94zjKlskVeTbjCxUVFcfkqNKas8HUPlorLCqhSg%2BuX8%2BK09RWBvmliG5DU9pml%2FAvTAo8b0NT01eyZ7LmqOV9j%2FXUt583TZ0KwvdQ%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqTECAAAA:KZH0LXn1LmtLax44cr3ulN7ZWKDKmkwD0f1NvxkTb/jMqN1qVF8/PPzxZ3FfGbac4KlwMzVqtHBLtnz3TlfY3lZFLuRxBo/G3GoxVpl40Pm79RmXzC5FffFVzmtAhflKkKku7qPdEaN9tz27eDhEX7WXyEmmwnE8ltFV9YWYokbWUXLMQfpGhpTzQoDT/hiUfT0mUysYnL1xui4+/zI3a36phZVLKnVp39vcKq/HJmo0nWX97fMIcKfWJBuirBA//m3YGM3S
2024-02-08 18:36:00 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:00 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=96ec82c8fe0b0025&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejL3IGHvWQViJKLLsEgdmqIgeoW-LDUgzM0 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 c625b1bdde545acdeb26c9f6ad3a8c6e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: zrnZDOlU9HzLyt5gzTroJbVuFobazaA130Wj-I3eGfbhwtZUDpvGCQ==
2024-02-08 18:36:00 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
450	192.168.2.5	50252	216.239.32.21	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	2822	OUT	GET /g/collect?v=2&tid=G-A12345&gtm=45je4250z879615461za200&_p=1707417355756&gcs=G1--&gcd=13l3l3l3l5&npa=0&dma=0&cid=421694156.1707417338&ul=en-us&sr=1280x1024&ur=US-FL&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pscdl=noapi&sst.uc=US&sst.rnd=858995681.1707417357&sst.gcd=13l3l3l3l5&sst.tft=1707417355756&_s=1&sid=1707417345&sct=1&seg=1&dl=https%3A%2F%2Fwww.booking.com%2F&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=8579&richsstsse HTTP/1.1 Host: gtm-mktg.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBtrc9jcR8FHAZMgVsPDpO7k61zYzfvcAjZN%2BRki3c7UB3918wAejvzi8Uw9wj94zjKlskVeTbjCxUVFcfkqNKas8HUPlorLCqhSg%2BuX8%2BK09RWBvmliG5DU9pml%2FAvTAo8b0NT01eyZ7LmqOV9j%2FXUt583TZ0KwvdQ%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA
2024-02-08 18:36:00 UTC	472	IN	HTTP/1.1 200 OK Content-Type: text/plain Vary: Accept-Encoding set-cookie: FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; Max-Age=63072000; Domain=booking.com; Path=/; Secure; HttpOnly cache-control: no-cache x-content-type-options: nosniff X-Cloud-Trace-Context: d8b0e348389a47b8b938b664f280b068 Date: Thu, 08 Feb 2024 18:36:00 GMT Server: Google Frontend Content-Length: 65 Expires: Thu, 08 Feb 2024 18:36:00 GMT Connection: close
2024-02-08 18:36:00 UTC	65	IN	Data Raw: 65 76 65 6e 74 3a 20 6d 65 73 73 61 67 65 0a 64 61 74 61 3a 20 7b 22 72 65 73 70 6f 6e 73 65 22 3a 7b 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 62 6f 64 79 22 3a 22 22 7d 7d 0a 0a Data Ascii: event: messagedata: {"response":{"status_code":200,"body":""}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
451	192.168.2.5	50256	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	1398	OUT	GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e&u_sclid=75022d4d-ae50-4a02-8ab1-d3d7e0695f9e&u_scsid=224e9da2-3ebe-4de0-94ba-0d5d22c95b7f&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&df=true&huah=true&m_dcl=4806&m_fcps=3239&m_pi=4770&m_pl=7436&m_pv=2&m_rd=8600&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&trackId=42b0a81f-b07d-418a-b96a-d1b9785bfcee&ts=1707417357018&v=3.9.1-2402072137 HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:00 UTC	526	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:00 GMT access-control-allow-origin: * cache-control: no-cache, no-transform content-type: image/png strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 68 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:00 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 0b 49 44 41 54 78 da 63 60 00 02 00 00 05 00 01 e9 fa dc d8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxc`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
452	192.168.2.5	50258	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive Content-Length: 2739 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:00 UTC	2739	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 6f 69 75 43 71 54 45 43 41 41 41 41 3a 4b 5a 48 30 4c 58 6e 31 4c 6d 74 4c 61 78 34 34 63 72 33 75 6c 4e 37 5a 57 4b 44 4b 6d 6b 77 44 30 66 31 4e 76 78 6b 54 62 2f 6a 4d 71 4e 31 71 56 46 38 2f 50 50 7a 78 5a 33 46 66 47 62 61 63 34 4b 6c 77 4d 7a 56 71 74 48 42 4c 74 6e 7a 33 54 6c 66 59 33 6c 5a 46 4c 75 52 78 42 6f 2f 47 33 47 6f 78 56 70 6c 34 30 50 6d 37 39 52 6d 58 7a 43 35 46 66 66 46 56 7a 6d 74 41 68 66 6c 4b 6b 4b 6b 75 37 71 50 64 45 61 4e 39 74 7a 32 37 65 44 68 45 58 37 57 58 79 45 6d 6d 77 6e 45 38 6c 74 46 56 39 59 57 59 6f 6b 62 57 55 58 4c 4d 51 66 70 47 68 70 Data Ascii: {"existing_token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqTECAAAA:KZH0LXn1LmtLax44cr3ulN7ZWKDKmkwD0f1NvxkTb/jMqN1qVF8/PPzxZ3FfGbac4KlwMzVqtHBLtnz3TlfY3lZFLuRxBo/G3GoxVpl40Pm79RmXzC5FffFVzmtAhflKkKku7qPdEaN9tz27eDhEX7WXyEmmwnE8ltFV9YWYokbWUXLMQfpGhp
2024-02-08 18:36:00 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1300 Connection: close Vary: Accept-Encoding Date: Thu, 08 Feb 2024 18:36:00 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65c51f10-3b71e962427511b36ad070e1 X-Cache: Miss from cloudfront Via: 1.1 349b149961d8d2361c29d4be4b5847f2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: kOAg16izCvEFMTODEcbJIDuzsoDS4CoExRHrP1i6D1LDTffYij0LRw==
2024-02-08 18:36:00 UTC	1300	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 73 71 4b 43 56 73 59 4a 41 41 41 41 3a 73 61 66 65 47 62 68 78 50 4d 4f 39 54 43 62 66 48 6e 69 42 68 50 57 72 54 56 34 52 78 4e 61 53 74 7a 72 69 46 31 6f 4c 71 4b 58 4e 56 43 2b 44 50 2b 48 4d 78 44 2f 71 2b 39 43 57 4d 31 51 35 68 2b 33 4d 6c 38 5a 71 69 77 65 7a 31 51 31 76 49 43 57 50 4c 61 53 52 65 65 78 78 57 42 74 6e 66 72 2b 31 4f 33 47 55 6b 36 69 4e 6b 6e 43 38 2b 35 39 6b 37 36 75 6d 4b 4d 66 73 55 4b 5a 4d 61 6e 62 67 42 33 7a 4f 4d 39 49 63 4e 72 76 2b 55 48 37 35 35 48 50 4c 75 34 4a 45 6e 4b 35 4b 42 64 52 36 61 47 6e 70 42 47 56 4a 67 30 53 55 56 37 72 57 65 67 4f 43 7a 37 79 76 64 57 59 Data Ascii: {"token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAsqKCVsYJAAAA:safeGbhxPMO9TCbfHniBhPWrTV4RxNaStzriF1oLqKXNVC+DP+HMxD/q+9CWM1Q5h+3Ml8Zqiwez1Q1vICWPLaSReexxWBtnfr+1O3GUk6iNknC8+59k76umKMfsUKZManbgB3zOM9IcNrv+UH755HPLu4JEnK5KBdR6aGnpBGVJg0SUV7rWegOCz7yvdWY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
453	192.168.2.5	50259	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	789	OUT	GET /pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_bKnn4gJpxh610xABibZH5I811MGr-I-n9wGDzZ9KOO-e4-mB&random=635174606 HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:00 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:00 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:00 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
454	192.168.2.5	50260	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	453	OUT	GET /xdata/images/xphoto/2880x868/308526620.jpeg?k=0663a1420ea98a013af0eda32bb4d11258521a39c5b8a5a4e2777ee5661dee55&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:00 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 08 Feb 2024 16:07:55 GMT ETag: "b9a8ca902a668d150d71f3c9f7a5cc2e4159dddf" Content-Language: 245767 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 9546eb427ef2137803aed00cad4fc426.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: RIV7YF1S8CKjcYOvM3UWlRJ5fHPLupX0du3SE4cvbMIXZup7yAgLog== Age: 8885
2024-02-08 18:36:00 UTC	15836	IN	Data Raw: 33 63 30 30 37 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 03 64 0b 40 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 Data Ascii: 3c007JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222d@"}!1AQa"
2024-02-08 18:36:00 UTC	16384	IN	Data Raw: 93 06 81 0d 3f 7b 1d a9 71 8a 52 b9 19 a4 0a 71 c9 a6 0c 33 49 4b 8a 33 8e 31 41 22 00 41 c9 e9 47 39 a5 23 8a 51 d2 81 81 3f 9d 27 27 ef 52 81 c6 68 1c d0 00 05 21 e9 4a 28 a6 03 78 a5 18 27 da 97 6e 69 0a e2 99 2d 06 06 69 76 d2 11 c5 2e 0d 21 00 14 b8 a3 18 a2 80 00 39 a7 f1 8c 53 40 a7 03 8e d4 99 48 95 3a 73 4f 1c d4 2a 72 6a 51 c5 43 34 8b 24 00 53 c1 19 a8 c5 3b b5 43 34 42 b6 33 c5 34 d2 8e 99 a4 34 20 63 49 34 dc 67 ad 3b bd 07 8a ab 12 c4 3c 1e 29 47 34 1a 6e 4e 69 00 e3 81 49 9c d2 13 49 9f 6a 2c 03 b3 4a 0d 33 3e d4 a2 9d 84 3a 80 69 33 48 28 02 52 dc 53 7a d3 49 e2 90 35 00 38 f5 e6 97 03 39 a6 8e 4d 38 80 0d 20 42 1e 3b d2 2f 4e 69 f8 14 80 64 50 31 47 4c e2 9d 8c 8a 41 9c 60 53 80 f5 34 98 11 b2 f1 4c c6 2a 7d a2 9a cb 4d 30 b1 09 3e d4 d3 Data Ascii: ?{qRq3IK31A"AG9#Q?''Rh!J(x'ni-iv.!9S@H:sOrjQC4$S;C4B344 cI4g;<)G4nNiIIj,J3>:i3H(RSzI589M8 B;/NidP1GLA`S4L}M0>
2024-02-08 18:36:00 UTC	16384	IN	Data Raw: 0e 97 a2 da db c2 9b 11 77 63 9c 8a e2 f4 4b 40 5d 5c 74 07 35 de d9 cf f2 29 23 91 c5 65 56 4d 9d 14 61 63 5a 0b 24 60 14 20 38 ee 6b 17 50 f0 a5 d4 1a c1 d5 f4 66 55 9d c6 26 84 fd d7 35 bf 0c c3 19 a9 cd e2 ec da 5b 15 0a 56 36 71 b9 cc c9 ac ea f0 82 1f 48 c4 fd 0e d9 54 0a ce b9 d4 f5 79 ed 9e 37 71 6a ac 31 d7 71 3f 95 74 17 e1 24 52 ce dc 0e 95 43 4e d3 96 fa e3 7b f1 1e 78 38 a1 3d 47 b2 2b 68 d0 69 fe 1c b7 92 f0 ab b4 92 73 f2 a9 62 d5 b0 be 28 b6 b9 81 8e d7 8c 91 91 b8 62 b6 e0 b2 b7 85 0e c8 d5 88 1c 1c 57 39 aa 69 09 77 23 b3 b8 41 f5 aa bb 26 31 6d 68 72 5a 95 e4 3a bd fb 48 62 42 07 52 45 35 6c ad 0f ca 60 84 23 f0 76 a6 0d 30 d8 ad ad d4 be 5b ab 2a f2 4e 69 d7 ce 61 d3 a5 b9 56 e0 44 c3 f4 aa 4f 53 39 5d 2b 33 cd 7e d4 d6 1a b4 c2 d9 b1 Data Ascii: wcK@]\t5)#eVMacZ$` 8kPfU&5[V6qHTy7qj1q?t$RCN{x8=G+hisb(bW9iw#A&1mhrZ:HbBRE5l`#v0[*NiaVDOS9]+3~
2024-02-08 18:36:01 UTC	16384	IN	Data Raw: 2b 3a 70 a1 80 c7 5a b3 3d c0 c1 02 ab 5b fe fa 7c 9e 7d 2b 0a 95 52 56 1c 53 be a5 64 84 07 0f 30 dc 41 f9 41 aa fe 29 d3 ad 6f b4 49 8c 04 79 a8 32 a5 47 07 da 8d 72 fd 2c 5a 3d ce aa 37 75 cd 65 5c f8 99 7c 93 15 a4 6a cc e3 91 d8 7b d7 3c 39 e5 2b a3 8f 19 56 11 5c bb 9e 73 75 a2 33 b7 00 a4 ca 3a 7f 8d 76 1e 1f b1 9e 2f 0d db c3 1c 6c d3 92 d9 1d ba d7 37 a9 dc 4a 2e 8c be 76 e7 ea 71 5e 8b e0 7b b2 2c 2c 5d c0 63 26 e1 cf d6 ba 2a c6 4d 28 c9 f5 3c b8 2e 67 ca 71 d7 ba 64 d6 7b 8d c4 e5 66 19 25 08 38 c1 ac bb 5b 8f b2 dd 45 70 06 36 38 61 ef eb 5e b3 f1 0f 4b 33 68 46 ee 18 d0 c8 9f 79 95 79 c5 78 f6 f1 b1 58 0d d9 e8 7d 2b e8 30 31 4e 97 b3 66 58 9a 6e 9c 94 91 ef de 1f d5 ad f5 7d 3a 3b 88 98 1c ae 0a 8e a3 eb 5c 4f c4 2f 09 e4 3e a7 60 9f 38 1f Data Ascii: +:pZ=[\|}+RVSd0AA)oIy2Gr,Z=7ue\\|j{<9+V\su3:v/l7J.vq^{,,]c&*M(<.gqd{f%8[Ep68a^K3hFyyxX}+01NfXn}:;\O/>`8
2024-02-08 18:36:01 UTC	16384	IN	Data Raw: c8 c1 8f 03 9a d3 d5 ad 84 2d e7 28 f9 0f 53 59 2e e8 18 6d 61 eb 91 58 cb 72 91 61 d2 e6 dc 7e fa 7c 93 d0 03 4d 59 65 ff 00 9e af f9 d4 5b e3 6f bc c5 9b d4 9a 37 af 76 e6 a6 e3 24 32 cd 9e 25 7f ce 95 66 9f 3f eb 5f fe fa a8 c3 a6 7e f0 a7 07 4c f5 14 d3 02 4f 3a 53 d6 67 fc e9 0c d3 76 95 ff 00 3a 66 53 3c b0 14 bb 90 0f bc 29 dc 07 ac d3 01 fe b5 ff 00 3a 05 c5 c8 e9 2b ff 00 df 54 d1 22 93 da 95 99 73 c3 0a 77 01 c2 ea e8 1f f5 d2 7f df 54 f1 75 70 c7 fd 7c 83 fe 05 51 6e 42 3e f0 a4 04 03 c1 1f 9d 2b 81 67 ed 57 0b ff 00 2d e4 ff 00 be a8 5b cb b3 d6 69 3f ef aa 87 72 f7 61 48 5c 7f 7c 53 4c 0b 62 fa e7 a0 99 ff 00 ef aa 5f b7 dd 9f f9 6a ff 00 9d 54 50 b9 c9 7a 94 60 90 32 39 f7 aa 5a e8 0d db 52 75 ba bb 76 da 26 7f 7f 9a ae 86 97 68 0e e5 be a7 Data Ascii: -(SY.maXra~\|MYe[o7v$2%f?_~LO:Sgv:fS<):+T"swTup\|QnB>+gW-[i?raH\\|SLb_jTPz`29ZRuv&h
2024-02-08 18:36:01 UTC	16384	IN	Data Raw: bd 4e 3d 2d a3 b7 b7 46 94 c9 d4 f6 15 bd 08 ae 7d 48 ad f0 9e 85 18 65 45 04 83 c6 0d 3a 9a 87 78 dc cb 86 c6 78 3d 29 d5 f4 11 b2 89 e2 bd c4 3d 69 69 0f 5a 5a 60 21 a0 50 69 45 00 14 86 96 92 80 0a 33 45 14 08 51 46 29 29 68 01 31 48 7a 52 d1 4c 04 14 70 28 a0 50 01 9a 28 fc 28 a0 04 c5 26 05 2d 14 08 6e 31 45 3a 8a 60 27 02 8c 52 1e 69 73 40 06 29 29 dd a9 b4 01 47 34 75 a5 e2 8e b5 b1 cc 80 01 4d 3c 51 d0 d2 93 c5 03 13 39 14 b8 e2 81 82 28 3c 74 a4 01 83 46 29 37 1c 52 e7 23 d6 80 03 cd 04 50 28 cd 00 1d a8 02 94 1a 07 14 00 da 05 29 a4 02 80 13 1c f5 a7 8c 01 cd 37 14 bc 62 80 0c f3 c5 2e 69 bd 0d 2f 7a 00 5e b4 98 34 03 cd 38 9a 00 4c 51 4b f8 e6 9b 9a 43 1d d6 93 76 0e 3b 52 01 9e f4 b8 ed 40 09 9c 9a 3b f4 a4 c7 34 ec 1c f1 40 0b 9f 6a 06 00 e2 Data Ascii: N=-F}HeE:xx=)=iiZZ`!PiE3EQF))h1HzRLp(P((&-n1E:`'Ris@))G4uM<Q9(<tF)7R#P()7b.i/z^48LQKCv;R@;4@j
2024-02-08 18:36:01 UTC	16384	IN	Data Raw: aa 3b e9 51 59 41 f7 a8 99 7f d7 72 4e 63 3f ca 9e 4f cb f8 d3 26 38 47 3e a8 6b 97 4b 13 67 7b 16 6c 3e 48 54 0e 00 51 51 ca 10 b9 eb d6 92 d0 9f 2f 1f ec ad 4d b4 6e 27 14 d3 ba b1 2d 7b c4 6b 0e 47 1c 54 aa 16 31 ea 69 0b 80 31 51 33 f5 a4 d5 8a 77 61 34 b9 07 9a a3 2c b9 3c e2 a6 72 39 aa 93 10 0d 49 b5 38 a0 8c 83 92 47 39 a9 33 81 4b 03 22 c6 77 75 cd 4c 02 48 38 a0 b6 f5 21 89 bf 7c ea 48 27 1d ab 0f c4 d7 13 5b 5c 58 bc 21 5b 7c 82 36 cf a1 ad e5 b7 91 25 de a5 70 45 67 dc d8 f9 b2 ac 93 ca ac 10 ee 03 de 98 a3 e4 49 7b 7a 96 76 9e 5c 63 32 b2 d6 24 10 34 7b a5 94 13 23 73 cd 6a ba c1 2c c2 49 1b e9 4f 63 13 2f 38 35 2e c6 d0 56 67 23 a8 c4 e3 74 8e bd 6b 95 92 04 f3 db 23 ad 77 7a ba f9 eb b5 47 02 b8 bb b1 b2 e1 b1 5d d8 39 d9 d8 e4 cc 95 e1 72 Data Ascii: ;QYArNc?O&8G>kKg{l>HTQQ/Mn'-{kGT1i1Q3wa4,<r9I8G93K"wuLH8!\|H'[\X![\|6%pEgI{zv\c2$4{#sj,IOc/85.Vg#tk#wzG]9r
2024-02-08 18:36:01 UTC	16384	IN	Data Raw: 82 0e 17 39 ad 68 d5 e5 a8 9d 87 52 9b 95 37 18 9c 15 83 c9 6b 28 9d 50 00 bd 2b d2 b4 99 9a 6b 48 26 93 ab a8 35 e7 2b 0c 86 e8 db a9 c8 2f 8c 7d 2b d0 f4 f2 d1 41 0c 78 e5 40 15 ed b6 a5 2b a3 cf cb 93 bc bc 8d f5 fb b4 dc 73 4b bb 6c 24 e3 26 b0 ef af ae 81 21 14 81 eb 53 52 6e 2a e8 f5 a9 c3 da 3b 23 73 ed 30 44 3e 69 07 e7 59 fa bf 88 ac f4 fd 3a 69 18 e4 ed 3b 7d cd 62 e2 56 53 29 56 7f ad 72 da ce 9b ae 6b 6c 12 1b 66 f2 23 6d d8 ac 69 d5 9c a7 66 b4 23 15 05 4d 59 3b b3 8b b8 93 ce b8 95 cf 57 62 cb ed 51 16 c0 e3 f3 ab 17 b6 37 36 17 06 0b b8 99 25 ed 55 88 00 f2 1b 8e 83 3c 66 bb d3 f7 75 3e 6e 57 73 6d 9a 3a 63 5a 96 02 e7 3d 7a 8a eb 2d 5e d6 65 c4 04 1d be f5 1f 85 7c 24 6e 04 57 f7 65 36 1f e0 38 35 b7 79 e1 eb 4d 21 a4 9e d7 24 39 cf 27 8a Data Ascii: 9hR7k(P+kH&5+/}+Ax@+sKl$&!SRn*;#s0D>iY:i;}bVS)Vrklf#mif#MY;WbQ76%U<fu>nWsm:cZ=z-^e\|$nWe685yM!$9'
2024-02-08 18:36:01 UTC	16384	IN	Data Raw: d9 c7 ca 5c 2f 6a 9e 7b cb 41 dd 1e 79 2a dc c4 de 5c 81 e2 2f d8 d6 fe 8d a1 cb 32 19 65 90 c6 aa 33 93 50 dd 89 2e 75 44 b9 bc 2c f1 64 90 00 19 ad 1b a9 2e ee bc ab 78 22 68 e2 7c 0f 9f 8a da 56 b0 c9 ad b4 94 bd b5 77 f3 66 75 47 e0 ae 3d 69 f7 3a 15 83 ca ac 92 39 64 e5 c3 d6 ee 99 1d b6 97 64 d6 a6 e5 56 6e ea 3a 56 4c 69 1c d7 77 22 49 c3 31 03 03 3e f5 95 d8 98 5a 5d 69 9a 6d d8 86 24 32 3b 8c 1f 41 56 a6 b5 58 ae 85 c6 f0 c8 47 dd 1d 05 65 6a 5a 5c 70 05 96 d9 b2 e7 ef 0a a5 3d fb 43 12 c5 13 e4 a8 f9 f2 7b d0 fd ed 85 66 43 ab 5a 5c de 48 4b 3f c8 1f 0a 17 b0 a2 de 27 b4 b3 8f ed 73 30 87 d0 d3 ec af 1e ea ec 0e 10 e3 68 c7 39 f7 ad 3d 63 4a 17 22 08 e5 bb db 12 f2 71 8a b6 f9 74 28 a9 6a 96 62 44 78 66 0d 0b 1f 9b 77 6a bc c2 de d9 26 78 24 85 Data Ascii: \/j{Ay*\/2e3P.uD,d.x"h\|VwfuG=i:9ddVn:VLiw"I1>Z]im$2;AVXGejZ\p=C{fCZ\HK?'s0h9=cJ"qt(jbDxfwj&x$
2024-02-08 18:36:01 UTC	16384	IN	Data Raw: 98 f5 06 ac db df ac 83 b7 cb 56 26 56 28 b3 af 39 ea 2a 6e 16 33 22 b4 c9 c9 18 35 63 cb 08 9b 4e 7f 0a bb 6e f0 c8 c0 b0 c6 78 35 35 cd 8a 32 66 27 e2 9b 62 71 b9 8f b5 43 05 6e 87 a5 48 96 83 76 46 76 d4 ff 00 62 19 52 cd 92 0f 15 2b 47 2a b0 1f c2 68 72 ec 64 f4 2b 15 1d 00 e0 77 34 9f 67 52 43 02 33 e9 56 8c 3d 7d 2a 58 ad e3 9e 58 e2 07 0c c7 14 e0 c1 3d 4c b7 42 c0 b8 04 aa f5 c5 4a 96 73 6d 25 60 91 81 ee 16 b7 f5 8d 21 74 3b f8 62 2d 94 91 41 35 ae f3 ac 6a ab 10 1b 71 d8 56 ca f7 35 92 bb 38 b4 b2 bc 07 22 d5 f1 fe ed 4f 1e 9b 78 ed 96 b7 70 3e 95 d4 8b c9 01 c6 3f 4a 68 bc 73 fc 58 fc 2a ac 2e 43 98 3a 4d e9 72 04 0d 8f a5 3d 34 8b d0 3f d4 b7 e5 5d 1b dd 4b 8e 1c fe 54 a6 ee 5d b8 0e 7f 2a 5c a8 7c 87 3c ba 45 e3 73 e4 36 3e 94 d7 d1 ae b9 26 Data Ascii: V&V(9n3"5cNnx552f'bqCnHvFvbR+Ghrd+w4gRC3V=}XX=LBJsm%`!t;b-A5jqV58"Oxp>?JhsX.C:Mr=4?]KT]*\\|<Es6>&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
455	192.168.2.5	50261	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	3500	OUT	GET /js_errors?pid=2c8482c2544201f4&url=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&m=UmFuZG9tSVYkc2RlIyh9YYo1mfebd19Q2WIimWOyIN1gUe4_-JQdNOBTMuHuYCJPue7ik10LWViyRYmmf149m9vSAg2JJTyfAEk9RiEQZejXjro5rDJvxnq57UaGsDKd0iBXLkMuV2sFYEHSFmXZW5zvkIdbv7-B87Oi9zo36Fnq7AU8K4Y8Y-SdtsN1A2dfLiciDUxBuNe45QSxoxZcHhPcdr6v26QamVEbge_7LQ_MDhbvlSKq9Lwf9P11FwHzxPymBNBmu_dZFb8tK9Z3wY0RAyYm7D0hfdu-LCtv4j3isKKp1L_CiYhwCnyC42X_OqimTrSjKXCbKfd3YnkJbQ&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2F%23indexsearch&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSObZWJFfVDSMePCFYZWFXO&cors=1 HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqTECAAAA:KZH0LXn1LmtLax44cr3ulN7ZWKDKmkwD0f1NvxkTb/jMqN1qVF8/PPzxZ3FfGbac4KlwMzVqtHBLtnz3TlfY3lZFLuRxBo/G3GoxVpl40Pm79RmXzC5FffFVzmtAhflKkKku7qPdEaN9tz27eDhEX7WXyEmmwnE8ltFV9YWYokbWUXLMQfpGhpTzQoDT/hiUfT0mUysYnL1xui4+/zI3a36phZVLKnVp39vcKq/HJmo0nWX97fMIcKfWJBuirBA//m3YGM3S; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D
2024-02-08 18:36:00 UTC	684	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:00 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=6d9482c85836014e&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQp8r0B469yucrBHnxf7ZcBtwy7Kt5gsC-V x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 61bbe72b71f7b857c695c31fdeb7b3a6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: t1_4M2KzJOMtqLZ6Nw9pqh4qVPNeTxukGJ-ClrR__S1h1YivOkwh9A==
2024-02-08 18:36:00 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
456	192.168.2.5	50270	142.251.15.154	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	1270	OUT	GET /ddm/fls/z/dc_pre=CIu156ixnIQDFXji_QUdFZIKVQ;src=4228414;type=views;cat=views;ord=4050429631327;npa=0;auiddc=;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=1884632172;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2 HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:01 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:00 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:01 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
457	192.168.2.5	50266	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	1654	OUT	GET /pagead/1p-user-list/1060768846/?random=1707417356687&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2F&label=6OEvCKaZ3wMQzpjo-QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nh4qqVoyv2KiIad5kPNddW86jrjYgKSk8&npa=0&data=page_type%3Dhome%3Bcheckindate%3D-1%3Bcheckoutdate%3D-1%3Bhotelid%3D0%3Bbook_window%3D%3Bweekday%3D-1%3Bdest_cc%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bnights%3D-1%3Brooms%3D-1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Bguestcount%3D-1%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdest_ufi%3D-1%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_PSJZTlF3xHNBsCQJNXjp8P52oWLmj9dYKvL6ae3o34g5Uiz2&random=954397539&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:00 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:00 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:00 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
458	192.168.2.5	50264	151.101.192.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	784	OUT	GET /user/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1707417357971&dep=5%2CEVENT_TAGS_ABSENT HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZTaWxiNnRDMy9JV0h1aGhEb1ZWT0pJR2N4OVhNTUFySysyd0MyYlJJZURDYVA0NEJsWkRmdjVWNFB5OEtwc1VNSVpJVmM3UVBnNlh4TXB6RExNN2lDdHIxSk5zQ0RjdlZiSHh0ZGFPbThlRT0mTFJRTHkyRnB4cUZkQmZ6YUIwR1l2Y2NzbDNRPQ=="
2024-02-08 18:36:00 UTC	622	IN	HTTP/1.1 200 OK Connection: close Content-Length: 302 access-control-expose-headers: Epik,Pin-Unauth pin-unauth: dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT access-control-allow-origin: * content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 1 referrer-policy: origin x-pinterest-rid: 8852314083504575 Date: Thu, 08 Feb 2024 18:36:00 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: f9d1c7100d6ab6a9fc70375cea0fca5e275d3fa9
2024-02-08 18:36:00 UTC	302	IN	Data Raw: 7b 22 61 65 6d 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 65 6d 46 6e 4c 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 50 68 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 47 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 44 62 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 4c 6f 63 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 45 78 74 65 72 6e 61 6c 49 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 45 70 69 6b 49 66 72 61 6d 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 68 72 6f 6d 65 4e 65 77 55 73 65 72 41 67 65 6e 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 45 75 22 3a 74 72 75 65 2c 22 69 73 55 74 69 6c 69 7a 69 6e 67 41 64 76 65 72 74 69 73 65 72 31 70 45 6e 61 Data Ascii: {"aemEnabled":true,"aemFnLnEnabled":false,"aemPhEnabled":false,"aemGeEnabled":false,"aemDbEnabled":false,"aemLocEnabled":false,"aemExternalIdEnabled":false,"ctEpikIframeEnabled":true,"chromeNewUserAgentEnabled":true,"isEu":true,"isUtilizingAdvertiser1pEna

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
459	192.168.2.5	50262	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	4116	OUT	GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=2c8482c2544201f4&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|4,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|2,cCHObKdBdUHINPSXeHDALOLOLMO\|5,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqTECAAAA:KZH0LXn1LmtLax44cr3ulN7ZWKDKmkwD0f1NvxkTb/jMqN1qVF8/PPzxZ3FfGbac4KlwMzVqtHBLtnz3TlfY3lZFLuRxBo/G3GoxVpl40Pm79RmXzC5FffFVzmtAhflKkKku7qPdEaN9tz27eDhEX7WXyEmmwnE8ltFV9YWYokbWUXLMQfpGhpTzQoDT/hiUfT0mUysYnL1xui4+/zI3a36phZVLKnVp39vcKq/HJmo0nWX97fMIcKfWJBuirBA//m3YGM3S; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D
2024-02-08 18:36:01 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:00 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=4b9682c83f8f057d&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejJR_dmVwTXs0uId-C6edWDf5wzc-JpRVA0 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 4a9f56098c7d51e12b8d2ac77b6f1bcc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: g3y7netlUWOWE0U5KvHaFzZQYm9QrMp1XIrlphOuxtkVUK2c3CldAg==
2024-02-08 18:36:01 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
460	192.168.2.5	50265	151.101.192.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	843	OUT	GET /user/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA%22%7D&cb=1707417357969&dep=2%2CPAGE_LOAD HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZTaWxiNnRDMy9JV0h1aGhEb1ZWT0pJR2N4OVhNTUFySysyd0MyYlJJZURDYVA0NEJsWkRmdjVWNFB5OEtwc1VNSVpJVmM3UVBnNlh4TXB6RExNN2lDdHIxSk5zQ0RjdlZiSHh0ZGFPbThlRT0mTFJRTHkyRnB4cUZkQmZ6YUIwR1l2Y2NzbDNRPQ=="
2024-02-08 18:36:01 UTC	622	IN	HTTP/1.1 200 OK Connection: close Content-Length: 302 access-control-expose-headers: Epik,Pin-Unauth pin-unauth: dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT access-control-allow-origin: * content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 2 referrer-policy: origin x-pinterest-rid: 1607208511381443 Date: Thu, 08 Feb 2024 18:36:01 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: f9d1c7100d6ab6a9fc70375cea0fca5e275d3fa9
2024-02-08 18:36:01 UTC	302	IN	Data Raw: 7b 22 61 65 6d 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 65 6d 46 6e 4c 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 50 68 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 47 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 44 62 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 4c 6f 63 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 45 78 74 65 72 6e 61 6c 49 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 45 70 69 6b 49 66 72 61 6d 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 68 72 6f 6d 65 4e 65 77 55 73 65 72 41 67 65 6e 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 45 75 22 3a 74 72 75 65 2c 22 69 73 55 74 69 6c 69 7a 69 6e 67 41 64 76 65 72 74 69 73 65 72 31 70 45 6e 61 Data Ascii: {"aemEnabled":true,"aemFnLnEnabled":false,"aemPhEnabled":false,"aemGeEnabled":false,"aemDbEnabled":false,"aemLocEnabled":false,"aemExternalIdEnabled":false,"ctEpikIframeEnabled":true,"chromeNewUserAgentEnabled":true,"isEu":true,"isUtilizingAdvertiser1pEna

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
461	192.168.2.5	50269	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	1084	OUT	GET /pagead/1p-user-list/988382855/?random=1707417356533&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=qxb_CKLbrYADEIeNptcD&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_gdaH382UdbAT3pTI4QArto9DJ6zfY4NMXdbth7hSGs09MH9-&random=4243601863&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:00 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:00 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:00 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
462	192.168.2.5	50267	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	1082	OUT	GET /pagead/1p-user-list/973712236/?random=1707417356716&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=8GRyCJ3Eq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_VC_dWnF5zlO-sJxDecgZQ7JbED0pEd9zFsh_javD5gIRkRhk&random=689319094&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:00 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:00 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:00 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
463	192.168.2.5	50271	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	1083	OUT	GET /pagead/1p-user-list/973712236/?random=1707417356745&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=LJXqCKDEq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_c43MYL9RI3Thfd_9DdM04RURnZRUImtlZ5ONbr2LQojys0VJ&random=4009849583&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:01 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:00 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:01 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
464	192.168.2.5	50272	18.67.65.100	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:01 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Thu, 08 Feb 2024 18:36:00 GMT X-Cache: Error from cloudfront Via: 1.1 de349bd2105a0a744704f391ff854e62.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: qkFWUj1DGdd2GOMQWcvp-VLQDMoC_twbzelYSI3GKa6B4XqoPoipPg==
2024-02-08 18:36:01 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
465	192.168.2.5	50277	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	2828	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqTECAAAA:KZH0LXn1LmtLax44cr3ulN7ZWKDKmkwD0f1NvxkTb/jMqN1qVF8/PPzxZ3FfGbac4KlwMzVqtHBLtnz3TlfY3lZFLuRxBo/G3GoxVpl40Pm79RmXzC5FffFVzmtAhflKkKku7qPdEaN9tz27eDhEX7WXyEmmwnE8ltFV9YWYokbWUXLMQfpGhpTzQoDT/hiUfT0mUysYnL1xui4+/zI3a36phZVLKnVp39vcKq/HJmo0nWX97fMIcKfWJBuirBA//m3YGM3S; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D
2024-02-08 18:36:01 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:01 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=f38482c80cbf0075&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGR9iczthPsA1iEkzKYxFEiOBZ62DDwKO9A x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 45893c5ff2aa24fa7dce9573a0274642.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: BSPicvrrkvUIG7xhPMwRYkbu-AnOklEtxDDilSlpO0fdaa-t5Y-9Og==
2024-02-08 18:36:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
466	192.168.2.5	50268	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	1083	OUT	GET /pagead/1p-user-list/975716499/?random=1707417356815&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=mzmpCMbAq1gQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_HJeVreViYDXLcWf6R_L2LSf4gUv3DarQGY-WFjASXo1WtBY_&random=2474861554&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:00 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:00 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:00 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
467	192.168.2.5	50274	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	2819	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqTECAAAA:KZH0LXn1LmtLax44cr3ulN7ZWKDKmkwD0f1NvxkTb/jMqN1qVF8/PPzxZ3FfGbac4KlwMzVqtHBLtnz3TlfY3lZFLuRxBo/G3GoxVpl40Pm79RmXzC5FffFVzmtAhflKkKku7qPdEaN9tz27eDhEX7WXyEmmwnE8ltFV9YWYokbWUXLMQfpGhpTzQoDT/hiUfT0mUysYnL1xui4+/zI3a36phZVLKnVp39vcKq/HJmo0nWX97fMIcKfWJBuirBA//m3YGM3S; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D
2024-02-08 18:36:01 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:01 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=aac282c897c100eb&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsve0HXCdm2cTIsVTka6FKiyG8xnsCG7rAs x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 145bb9cba9e12350510f02ee9ab6ca22.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: LRIHSHUUrdcaEvGM6DKTBuU53T4gdiZefMWNzsQ7qRYf2_cJ6Sgu7Q==
2024-02-08 18:36:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
468	192.168.2.5	50263	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	3098	OUT	GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=2c8482c2544201f4&ete=&etg=&etcg=cCHObEfEITNPfbeQMIaWYUQJFFQccCcCcCC\|5&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,cCHObKdBdUHINPSXeHDALOLOLMO\|3&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqTECAAAA:KZH0LXn1LmtLax44cr3ulN7ZWKDKmkwD0f1NvxkTb/jMqN1qVF8/PPzxZ3FfGbac4KlwMzVqtHBLtnz3TlfY3lZFLuRxBo/G3GoxVpl40Pm79RmXzC5FffFVzmtAhflKkKku7qPdEaN9tz27eDhEX7WXyEmmwnE8ltFV9YWYokbWUXLMQfpGhpTzQoDT/hiUfT0mUysYnL1xui4+/zI3a36phZVLKnVp39vcKq/HJmo0nWX97fMIcKfWJBuirBA//m3YGM3S; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D
2024-02-08 18:36:01 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:01 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=e92082c88cb90411&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejJWR3NLN1ORe37YfrRzr7_IVi1yHMG1sKQ x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 9546eb427ef2137803aed00cad4fc426.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: BE4zhi1YcZxoYdmSLa--m60Fz1j4KKgu3QWv6K39HqY4o7C0YdjaHA==
2024-02-08 18:36:01 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
469	192.168.2.5	50276	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	451	OUT	GET /xdata/images/hotel/263x210/100235855.jpeg?k=5b6e6cff16cfd290e953768d63ee15f633b56348238a705c45759aa3a81ba82b&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:01 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sun, 21 Jan 2024 16:24:01 GMT ETag: "9aff9e5c9b69d9442b7f563196b1a2235d432b9f" Content-Language: 12530 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 c1bfc7dbcf7f9782aa3be590b7ce3d6a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: ZdTDEXwxe8WdG0NAhlYU4AiTp4ODkLKswWZTV8iu2oZAKU6t4TNqNg== Age: 1563119
2024-02-08 18:36:01 UTC	12538	IN	Data Raw: 33 30 66 32 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 30f2JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:36:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
470	192.168.2.5	50273	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	2822	OUT	GET /sendlayoutevents HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqTECAAAA:KZH0LXn1LmtLax44cr3ulN7ZWKDKmkwD0f1NvxkTb/jMqN1qVF8/PPzxZ3FfGbac4KlwMzVqtHBLtnz3TlfY3lZFLuRxBo/G3GoxVpl40Pm79RmXzC5FffFVzmtAhflKkKku7qPdEaN9tz27eDhEX7WXyEmmwnE8ltFV9YWYokbWUXLMQfpGhpTzQoDT/hiUfT0mUysYnL1xui4+/zI3a36phZVLKnVp39vcKq/HJmo0nWX97fMIcKfWJBuirBA//m3YGM3S; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D
2024-02-08 18:36:01 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:01 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=a33282c81d4901a1&e=UmFuZG9tSVYkc2RlIyh9YReXsVhv1rQKB4Zv_9za_vfqyrqLhLbG2visOc2dF3ScOGYufzIQV3U x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 7eeed291abf48890d3f36565208941a8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: lR2HMzaCQ9EYC8GCTT0oit4akD5-rzaf3efBNqEbzZ3PMkwa_sdzqQ==
2024-02-08 18:36:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
471	192.168.2.5	50275	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	451	OUT	GET /xdata/images/xphoto/263x210/57584488.jpeg?k=d8d4706fc72ee789d870eb6b05c0e546fd4ad85d72a3af3e30fb80ca72f0ba57&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:01 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Tue, 30 Jan 2024 04:39:46 GMT ETag: "196fea0ab45d56a1dbce18f3c3cd9eb1a591fb85" Content-Language: 8621 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 6f067a3fd6e721a7db2a2901701a65d8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: K5NK_86cOJ-ZNnrmxyPe1xBQbvhYyBs8YyE2Uy-cKbvlLETcBetGsQ== Age: 827774
2024-02-08 18:36:01 UTC	8629	IN	Data Raw: 32 31 61 64 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 21adJFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:36:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
472	192.168.2.5	50280	151.101.192.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	1511	OUT	GET /v3/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%23indexsearch%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%226461a31a%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1707417357983 HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZTaWxiNnRDMy9JV0h1aGhEb1ZWT0pJR2N4OVhNTUFySysyd0MyYlJJZURDYVA0NEJsWkRmdjVWNFB5OEtwc1VNSVpJVmM3UVBnNlh4TXB6RExNN2lDdHIxSk5zQ0RjdlZiSHh0ZGFPbThlRT0mTFJRTHkyRnB4cUZkQmZ6YUIwR1l2Y2NzbDNRPQ=="
2024-02-08 18:36:01 UTC	594	IN	HTTP/1.1 200 OK Connection: close Content-Length: 35 cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT content-type: image/gif access-control-allow-origin: * set-cookie: ar_debug=1; Expires=Fri, 07 Feb 2025 18:36:01 GMT; Path=/; Domain=.pinterest.com; Secure; HTTPOnly; SameSite=None x-envoy-upstream-service-time: 1 referrer-policy: origin x-pinterest-rid: 1829407200868305 Date: Thu, 08 Feb 2024 18:36:01 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: f9d1c7100d6ab6a9fc70375cea0fca5e275d3fa9
2024-02-08 18:36:01 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
473	192.168.2.5	50281	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	446	OUT	GET /xdata/images/city/170x136/977409.jpg?k=82c14f9e6cea94829ee0528a3aa4324111d3482e9f095194500746fa7ca2769e&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:01 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sun, 28 Jan 2024 04:59:48 GMT ETag: "ddc288c9f52dca1aef2566f3098edeae42f8480a" Content-Language: 8642 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 ea0f86c249e022d5015ce79f54e723d0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: kHz2g2ilG_9qYVQwoUQO1GiHcI2QL-Yo3hnHKqBtOa-KmJsNBZmofg== Age: 999373
2024-02-08 18:36:01 UTC	8650	IN	Data Raw: 32 31 63 32 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 21c2JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:36:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
474	192.168.2.5	50279	151.101.192.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	1714	OUT	GET /v3/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1707417358880&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVl6SmxPREk0TmpBdE9XUmpaUzAwTWpWaUxUazRZMkl0WVRFM056ZzFPVFU0TW1RNA%22%2C%22aem_eligible_list%22%3A%5B%22fn%22%5D%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2F%23indexsearch%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%226461a31a%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZTaWxiNnRDMy9JV0h1aGhEb1ZWT0pJR2N4OVhNTUFySysyd0MyYlJJZURDYVA0NEJsWkRmdjVWNFB5OEtwc1VNSVpJVmM3UVBnNlh4TXB6RExNN2lDdHIxSk5zQ0RjdlZiSHh0ZGFPbThlRT0mTFJRTHkyRnB4cUZkQmZ6YUIwR1l2Y2NzbDNRPQ=="
2024-02-08 18:36:01 UTC	914	IN	HTTP/1.1 200 OK Connection: close Content-Length: 35 cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT content-type: image/gif access-control-allow-origin: * set-cookie: ar_debug=1; Expires=Fri, 07 Feb 2025 18:36:01 GMT; Path=/; Domain=.pinterest.com; Secure; HTTPOnly; SameSite=None set-cookie: _pinterest_ct_ua="TWc9PSZkbWZLdDFSY2k0RytCMHNLTDhuVWhuQit1d1gzb2tkNjRDaHFUR2NwSy9hK25KRVljS2dwMUxocE53VFhBWmNEQUJYSEV6eURmdGtxL29kcXhpTnAyM0d6S1c1NzBROHppc083NktsbU9vZz0mY0M4cWljSXAxaDlIOFVBazhiS3FNM2xZeGtjPQ=="; Expires=Fri, 07 Feb 2025 18:36:01 GMT; Path=/; Domain=ct.pinterest.com; Secure; SameSite=None x-envoy-upstream-service-time: 2 referrer-policy: origin x-pinterest-rid: 1266500376609737 Date: Thu, 08 Feb 2024 18:36:01 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: f9d1c7100d6ab6a9fc70375cea0fca5e275d3fa9
2024-02-08 18:36:01 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
475	192.168.2.5	50278	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:00 UTC	446	OUT	GET /xdata/images/city/170x136/976877.jpg?k=2aab28217f0fb039e0f35ea2b2c3976141b5860b074f74220edf998115935cda&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:01 UTC	548	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sat, 03 Feb 2024 04:46:57 GMT ETag: "40721dda4c91c5977182d60b367c4d39dec3ab3d" Content-Language: 8350 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 f588325f7617672d954c4267c8bee1ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: KSw7pZGDpm0OqlWoLq_TrZGw6nNt_-7qD0LnaIyqHOJb0gZKRZaHMQ== Age: 481744
2024-02-08 18:36:01 UTC	8358	IN	Data Raw: 32 30 39 65 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 209eJFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:36:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
476	192.168.2.5	50282	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:01 UTC	446	OUT	GET /xdata/images/city/170x136/976919.jpg?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o= HTTP/1.1 Host: r-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:01 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 7768 Connection: close Server: nginx Date: Sun, 21 Jan 2024 15:42:33 GMT ETag: "9dc6e5d881bbf48e208e43aee1386e512a6c4f79" Content-Language: 7768 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 25d9b5959eaa82bb18ee3f35e6bf34b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 6amJzg-VA8rCKbPSyV_3Jw_JckHgPVjqb_khZNryRvUomfLmd4hYCw== Age: 1565608
2024-02-08 18:36:01 UTC	7768	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
477	192.168.2.5	50283	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:01 UTC	1083	OUT	GET /pagead/1p-user-list/975716499/?random=1707417356784&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2F&label=BcW9COaWsFgQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_42ioI1Ek00qaYvOFdRw6k6FN1HsC1z-x2AZ4jVpIftSxh6GR&random=3815724033&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:01 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:01 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:01 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
478	192.168.2.5	50284	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:01 UTC	717	OUT	POST /p HTTP/1.1 Host: tr6.snapchat.com Connection: keep-alive Content-Length: 898 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:01 UTC	898	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 65 32 63 65 64 30 36 34 2d 33 31 34 64 2d 34 63 62 63 2d 61 61 37 61 2d 35 62 31 66 38 64 36 61 61 34 39 34 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 66 65 31 33 37 65 31 30 2d 35 61 31 37 2d 34 34 63 66 2d 39 39 31 31 2d 37 34 62 61 37 35 32 30 35 65 32 61 22 2c 22 73 73 22 3a 22 32 32 34 65 39 64 61 32 2d 33 65 62 65 2d 34 64 65 30 2d 39 34 62 61 2d 30 64 35 64 32 32 63 39 35 62 37 66 22 2c 22 64 66 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"e2ced064-314d-4cbc-aa7a-5b1f8d6aa494","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"fe137e10-5a17-44cf-9911-74ba75205e2a","ss":"224e9da2-3ebe-4de0-94ba-0d5d22c95b7f","df":true,"s
2024-02-08 18:36:01 UTC	429	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:01 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
479	192.168.2.5	50287	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:01 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive Content-Length: 2746 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:01 UTC	2746	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 73 71 4b 43 56 73 59 4a 41 41 41 41 3a 73 61 66 65 47 62 68 78 50 4d 4f 39 54 43 62 66 48 6e 69 42 68 50 57 72 54 56 34 52 78 4e 61 53 74 7a 72 69 46 31 6f 4c 71 4b 58 4e 56 43 2b 44 50 2b 48 4d 78 44 2f 71 2b 39 43 57 4d 31 51 35 68 2b 33 4d 6c 38 5a 71 69 77 65 7a 31 51 31 76 49 43 57 50 4c 61 53 52 65 65 78 78 57 42 74 6e 66 72 2b 31 4f 33 47 55 6b 36 69 4e 6b 6e 43 38 2b 35 39 6b 37 36 75 6d 4b 4d 66 73 55 4b 5a 4d 61 6e 62 67 42 33 7a 4f 4d 39 49 63 4e 72 76 2b 55 48 37 35 35 48 50 4c 75 34 4a 45 6e 4b 35 4b 42 64 52 36 61 47 6e 70 42 47 56 4a 67 30 53 55 56 37 72 57 65 67 Data Ascii: {"existing_token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAsqKCVsYJAAAA:safeGbhxPMO9TCbfHniBhPWrTV4RxNaStzriF1oLqKXNVC+DP+HMxD/q+9CWM1Q5h+3Ml8Zqiwez1Q1vICWPLaSReexxWBtnfr+1O3GUk6iNknC8+59k76umKMfsUKZManbgB3zOM9IcNrv+UH755HPLu4JEnK5KBdR6aGnpBGVJg0SUV7rWeg
2024-02-08 18:36:01 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1388 Connection: close Vary: Accept-Encoding Date: Thu, 08 Feb 2024 18:36:01 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65c51f11-20461c65232244091a727030 X-Cache: Miss from cloudfront Via: 1.1 bfba2464a75a65b0c6568afe15f68b4c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: jlhyJ42O8YhhDWJpaH6qO7jY2hI0wP1K6RmnR-6utY2ofm-VnNqZmQ==
2024-02-08 18:36:01 UTC	1388	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 6c 49 36 43 51 39 63 4c 41 41 41 41 3a 38 5a 47 7a 6a 71 35 6a 4d 34 59 65 74 73 7a 42 62 32 50 73 46 58 30 64 39 7a 42 34 6d 48 4d 39 77 74 74 41 4d 61 42 4e 6e 48 4c 50 4f 57 4f 59 68 63 74 76 76 4f 41 4b 36 6f 38 4c 76 71 4b 50 62 67 5a 58 52 4d 31 65 79 46 75 42 50 4d 48 44 6f 54 6d 53 79 68 68 38 46 73 65 42 50 68 59 58 79 36 4d 39 33 4b 2f 2b 2f 4c 6b 52 57 51 45 35 44 33 58 46 43 4d 73 65 66 6c 5a 35 75 71 4e 5a 58 34 64 39 6c 37 30 35 4c 57 6d 43 4d 68 44 4c 36 35 52 69 6a 4f 6d 69 6c 63 55 4b 7a 36 32 30 45 65 62 75 2f 6e 71 72 33 61 66 4a 52 64 43 53 49 43 31 5a 63 30 6a 6e 41 37 30 58 79 70 74 Data Ascii: {"token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAlI6CQ9cLAAAA:8ZGzjq5jM4YetszBb2PsFX0d9zB4mHM9wttAMaBNnHLPOWOYhctvvOAK6o8LvqKPbgZXRM1eyFuBPMHDoTmSyhh8FseBPhYXy6M93K/+/LkRWQE5D3XFCMseflZ5uqNZX4d9l705LWmCMhDL65RijOmilcUKz620Eebu/nqr3afJRdCSIC1Zc0jnA70Xypt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
480	192.168.2.5	50285	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:01 UTC	2828	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqTECAAAA:KZH0LXn1LmtLax44cr3ulN7ZWKDKmkwD0f1NvxkTb/jMqN1qVF8/PPzxZ3FfGbac4KlwMzVqtHBLtnz3TlfY3lZFLuRxBo/G3GoxVpl40Pm79RmXzC5FffFVzmtAhflKkKku7qPdEaN9tz27eDhEX7WXyEmmwnE8ltFV9YWYokbWUXLMQfpGhpTzQoDT/hiUfT0mUysYnL1xui4+/zI3a36phZVLKnVp39vcKq/HJmo0nWX97fMIcKfWJBuirBA//m3YGM3S; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D
2024-02-08 18:36:01 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:01 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=118c82c843f4007e&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGUCc2VI2c_l8HxQeCaFXRBDN2UtBh-q8Sg x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 e268ddb03ed9480c5c602c27323a81ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: XS_8mYtI1HVndBwpTlq2PhFF7sghMUWsfgECSBUJtkVN630cVBvfkg==
2024-02-08 18:36:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
481	192.168.2.5	50286	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:01 UTC	2819	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqTECAAAA:KZH0LXn1LmtLax44cr3ulN7ZWKDKmkwD0f1NvxkTb/jMqN1qVF8/PPzxZ3FfGbac4KlwMzVqtHBLtnz3TlfY3lZFLuRxBo/G3GoxVpl40Pm79RmXzC5FffFVzmtAhflKkKku7qPdEaN9tz27eDhEX7WXyEmmwnE8ltFV9YWYokbWUXLMQfpGhpTzQoDT/hiUfT0mUysYnL1xui4+/zI3a36phZVLKnVp39vcKq/HJmo0nWX97fMIcKfWJBuirBA//m3YGM3S; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D
2024-02-08 18:36:01 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:01 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=3e1e82c8bb5803a8&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqstQWTfbNyda383pX4QljSCGY-XjUoBa5C8 x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 fcb94596db202c75ac0e559b3183be72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: TItik9i6EcOAWvKuOBzoZpBEHGL-jP7Jf32qkJ0RAq8m5dlPGDP14w==
2024-02-08 18:36:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
482	192.168.2.5	50288	3.161.193.117	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:01 UTC	650	OUT	POST /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive Content-Length: 85 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-API-Version: 1 Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:01 UTC	85	OUT	Data Raw: 7b 22 70 69 64 22 3a 22 32 63 38 34 38 32 63 32 35 34 34 32 30 31 66 34 22 2c 22 72 65 66 41 63 74 69 6f 6e 22 3a 22 69 6e 64 65 78 22 2c 22 73 69 74 65 54 79 70 65 22 3a 22 31 22 2c 22 63 6c 73 22 3a 36 39 2e 32 30 39 39 36 38 31 32 35 36 32 33 39 36 7d Data Ascii: {"pid":"2c8482c2544201f4","refAction":"index","siteType":"1","cls":69.20996812562396}
2024-02-08 18:36:01 UTC	525	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:01 GMT vary: Origin, Accept-Encoding access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 d3b019645d09c89af6e150e75be90942.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P8 X-Amz-Cf-Id: WW_BL3C8-qiN9ZJb0SDlG-f728W57RHIsE61WCisj_vboWjVYjwUHA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
483	192.168.2.5	50289	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:01 UTC	5862	OUT	GET /js_tracking?aid=304142&pid=2c8482c2544201f4&ver=2&sid=5171fc655664ddf74ab763a094523fb7&ref_action=index&lang=en-us&stype=1&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|69\|1&m=UmFuZG9tSVYkc2RlIyh9YYo1mfebd19Q2WIimWOyIN1gUe4_-JQdNOBTMuHuYCJPue7ik10LWViyRYmmf149m9vSAg2JJTyfAEk9RiEQZejXjro5rDJvxnq57UaGsDKd0iBXLkMuV2sFYEHSFmXZW5zvkIdbv7-B87Oi9zo36Fnq7AU8K4Y8Y-SdtsN1A2dfLiciDUxBuNe45QSxoxZcHhPcdr6v26QamVEbge_7LQ_MDhbvlSKq9Lwf9P11FwHzxPymBNBmu_dZFb8tK9Z3wY0RAyYm7D0hfdu-LCtv4j3isKKp1L_CiYhwCnyC42X_OqimTrSjKXCbKfd3YnkJbQ HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3 X-Booking-CSRF: RVfFZQAAAAA=qVueflVyIcgKOJdfCMKcmiDGjvY9UqM_W79drieypCCd1wLxtNOjZPcMNKEslcD0Tiyh8b7rdIv86FT89bynmubUkLo31LJ5cM248yQm3ulKZFWN-WKHCjXqy964TaJvn5A_S7b4oaNG1jhNZ7aGF2JNPgwXGQBCPiOREYDFBwUwhotUpEosEVmLfdyz_vXpYSXlaaCHZibCaVWm sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuAKFvpSuBsACAdICJDdhNmRhMmNiLThiNjMtNDQ1OS04MGUwLTI1OGM3NjBkNWQzMdgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: 2c8482c2544201f4 X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,1912460\|1,1856870\|1,1912460\|7,1908890\|1,1912460\|6,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|4,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|2,cCHObKdBdUHINPSXeHDALOLOLMO\|5,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,cCHObKdBdUHINPSXeHDALOLOLMO\|3 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAsqKCVsYJAAAA:safeGbhxPMO9TCbfHniBhPWrTV4RxNaStzriF1oLqKXNVC+DP+HMxD/q+9CWM1Q5h+3Ml8Zqiwez1Q1vICWPLaSReexxWBtnfr+1O3GUk6iNknC8+59k76umKMfsUKZManbgB3zOM9IcNrv+UH755HPLu4JEnK5KBdR6aGnpBGVJg0SUV7rWegOCz7yvdWYvCEZd2rt9lTJbhpgos8Vch8ZF5X8Medbcy+ltWyO3zx63NQD+C/vvBWVdiRS217TRbwfLXWUe
2024-02-08 18:36:02 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:01 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=3d7682c8503e01ef&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejILhF4DHvRhSgBVg8SyDXIR8vcprNZP_dA x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 4a9f56098c7d51e12b8d2ac77b6f1bcc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: vGHp-ABU8xYQVHSYgUK1K8r9thL20FzqddfStCmnH3UFoafltNQiWg==
2024-02-08 18:36:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
484	192.168.2.5	50290	64.233.177.99	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:01 UTC	1231	OUT	POST /recaptcha/api2/reload?k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 8884 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-protobuffer Accept: / Origin: https://www.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&cb=8mbox63omknd Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AJmcDEmmSVjhXu6iSND5nUlaG4u8jg9r3gIsM8fricsYrppd_RXehS30W8rvMgVb0KtN3BzkTFd51AiDyh7KnUA; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:01 UTC	8884	OUT	Data Raw: 0a 18 78 35 57 57 6f 45 35 37 46 76 30 64 36 41 54 4b 73 4c 44 49 41 4b 6e 74 12 8e 0f 30 33 41 46 63 57 65 41 37 46 66 44 75 59 38 69 32 5a 58 58 6a 5a 56 4e 51 63 4f 31 53 4f 34 63 4d 69 63 48 69 58 41 50 69 46 33 4f 4f 6d 73 6b 36 30 2d 38 49 62 2d 65 31 56 49 78 64 4f 4f 51 32 67 79 36 33 36 68 33 50 70 68 39 36 75 67 52 62 67 50 6d 74 54 53 76 49 54 6f 46 35 38 41 50 62 41 57 53 76 30 67 48 45 57 44 75 53 55 6c 54 32 6e 67 6c 4f 52 51 74 45 61 59 43 4b 43 64 4b 47 68 5a 75 78 34 79 72 4e 5f 5f 31 58 4e 41 65 5a 73 46 44 72 44 38 38 7a 30 70 56 57 77 6b 78 69 4c 78 31 6e 37 66 5f 69 47 57 6b 64 7a 79 67 4d 39 4b 79 52 65 39 50 64 66 69 42 78 59 49 4b 6a 30 33 46 67 36 5f 46 59 4c 6f 6d 70 4a 39 67 37 59 4a 5a 77 54 71 75 31 62 5a 44 76 31 50 6e 68 73 Data Ascii: x5WWoE57Fv0d6ATKsLDIAKnt03AFcWeA7FfDuY8i2ZXXjZVNQcO1SO4cMicHiXAPiF3OOmsk60-8Ib-e1VIxdOOQ2gy636h3Pph96ugRbgPmtTSvIToF58APbAWSv0gHEWDuSUlT2nglORQtEaYCKCdKGhZux4yrN__1XNAeZsFDrD88z0pVWwkxiLx1n7f_iGWkdzygM9KyRe9PdfiBxYIKj03Fg6_FYLompJ9g7YJZwTqu1bZDv1Pnhs
2024-02-08 18:36:02 UTC	696	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Date: Thu, 08 Feb 2024 18:36:01 GMT Expires: Thu, 08 Feb 2024 18:36:01 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: _GRECAPTCHA=09AJmcDEl4lP7G1sUzlkfo-ph5oEYDaZrMsr87jx805YMBfBXipJ4MvomJQXIF7z5TPrZE7LxvSiQSdmfSY1DEipM;Path=/recaptcha;Expires=Tue, 06-Aug-2024 18:36:01 GMT;Secure;HttpOnly;Priority=HIGH;SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:36:02 UTC	556	IN	Data Raw: 61 36 30 0d 0a 29 5d 7d 27 0a 5b 22 72 72 65 73 70 22 2c 22 30 33 41 46 63 57 65 41 37 49 32 6d 79 5f 69 44 53 46 66 73 30 59 44 37 63 7a 48 51 39 55 31 6c 5a 57 47 64 48 6e 48 4b 37 74 68 38 44 33 5f 76 58 72 64 5a 4a 49 76 6d 6a 34 4a 4f 4d 54 4d 59 56 43 4f 51 65 5a 38 59 61 37 41 55 78 61 5f 44 6e 50 73 76 52 4a 4a 5f 56 43 5a 46 75 4b 7a 4e 36 53 52 69 76 63 38 4b 42 70 50 50 4c 4e 67 42 59 4c 38 69 4d 66 52 59 6e 6e 31 52 70 43 57 6b 32 4f 41 46 44 76 6d 43 51 74 76 6a 4d 4f 55 6d 32 49 4e 4e 41 59 4a 58 6f 34 57 5a 55 38 2d 6c 68 4d 34 53 61 38 79 5a 75 4d 73 76 30 54 62 76 6f 76 67 4b 50 78 61 6c 6a 79 55 56 6b 72 39 51 56 37 78 6e 49 50 78 78 75 6e 73 64 6c 78 66 34 6b 53 6f 4d 35 70 53 6c 57 46 69 33 6f 63 73 4c 5f 4c 71 59 43 75 76 4c 49 55 33 Data Ascii: a60)]}'["rresp","03AFcWeA7I2my_iDSFfs0YD7czHQ9U1lZWGdHnHK7th8D3_vXrdZJIvmj4JOMTMYVCOQeZ8Ya7AUxa_DnPsvRJJ_VCZFuKzN6SRivc8KBpPPLNgBYL8iMfRYnn1RpCWk2OAFDvmCQtvjMOUm2INNAYJXo4WZU8-lhM4Sa8yZuMsv0TbvovgKPxaljyUVkr9QV7xnIPxxunsdlxf4kSoM5pSlWFi3ocsL_LqYCuvLIU3
2024-02-08 18:36:02 UTC	1252	IN	Data Raw: 64 64 63 51 32 61 69 54 48 36 6f 67 41 42 43 79 33 6e 6d 57 65 6e 69 67 52 6e 56 56 42 6b 34 36 2d 43 4a 48 43 57 78 55 45 35 49 34 66 52 77 66 66 54 64 6e 72 52 4c 56 61 53 49 37 32 4d 43 75 54 74 41 39 74 69 38 64 5a 6f 7a 4f 4c 45 66 75 69 62 37 6a 36 65 59 4c 41 61 66 42 5a 48 50 62 62 34 66 76 68 31 38 69 61 6f 6d 77 67 6e 36 65 67 78 30 64 4c 69 22 2c 6e 75 6c 6c 2c 31 32 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 22 62 67 64 61 74 61 22 2c 22 4c 79 39 33 64 33 63 75 5a 32 39 76 5a 32 78 6c 4c 6d 4e 76 62 53 39 71 63 79 39 69 5a 79 39 4c 61 31 64 47 5a 56 4e 56 55 6d 56 72 57 45 64 35 59 32 52 77 63 6c 5a 44 4c 56 56 5a 4e 6b 56 45 4c 56 70 47 4e 57 78 73 4d 6b 70 44 54 57 6c 49 61 45 70 46 4d 6c 4a 72 4c 6d 70 7a 22 2c 22 22 2c 22 62 30 Data Ascii: ddcQ2aiTH6ogABCy3nmWenigRnVVBk46-CJHCWxUE5I4fRwffTdnrRLVaSI72MCuTtA9ti8dZozOLEfuib7j6eYLAafBZHPbb4fvh18iaomwgn6egx0dLi",null,120,null,null,null,["bgdata","Ly93d3cuZ29vZ2xlLmNvbS9qcy9iZy9La1dGZVNVUmVrWEd5Y2RwclZDLVVZNkVELVpGNWxsMkpDTWlIaEpFMlJrLmpz","","b0
2024-02-08 18:36:02 UTC	855	IN	Data Raw: 4e 54 69 74 51 5a 58 52 44 56 58 4a 48 5a 7a 4a 47 55 7a 64 36 63 55 77 34 56 32 68 6d 52 48 52 47 62 58 68 4a 56 6a 42 61 56 45 31 35 52 45 78 79 5a 33 68 45 62 30 6c 32 53 6e 6c 6f 53 54 56 44 61 31 4e 59 56 31 68 74 56 44 56 31 4d 31 68 57 4e 56 46 5a 62 58 70 6f 4d 54 46 54 4d 30 6b 30 4d 6d 6c 35 59 55 6f 34 54 57 31 33 64 55 5a 45 4d 6c 4e 36 65 6c 56 73 62 6c 70 43 4e 56 68 58 4d 7a 4a 58 61 33 56 6f 61 7a 51 79 51 55 39 70 5a 31 59 33 61 54 4e 53 61 47 78 77 61 32 39 4c 52 79 39 71 5a 6a 55 78 61 32 6c 48 65 55 46 4c 4d 53 74 78 61 47 6f 31 62 56 46 74 64 56 6f 32 55 31 46 6f 57 6b 4a 71 65 56 46 4a 52 56 70 75 59 7a 4e 4d 51 32 52 50 54 6e 42 6d 62 30 6c 6a 4c 32 77 31 63 57 74 76 57 6b 45 77 4d 30 30 35 62 56 42 30 56 6b 4a 42 4d 47 56 69 65 6d Data Ascii: NTitQZXRDVXJHZzJGUzd6cUw4V2hmRHRGbXhJVjBaVE15RExyZ3hEb0l2SnloSTVDa1NYV1htVDV1M1hWNVFZbXpoMTFTM0k0Mml5YUo4TW13dUZEMlN6elVsblpCNVhXMzJXa3VoazQyQU9pZ1Y3aTNSaGxwa29LRy9qZjUxa2lHeUFLMStxaGo1bVFtdVo2U1FoWkJqeVFJRVpuYzNMQ2RPTnBmb0ljL2w1cWtvWkEwM005bVB0VkJBMGViem
2024-02-08 18:36:02 UTC	1252	IN	Data Raw: 31 36 37 30 0d 0a 52 56 63 34 62 6d 31 70 4b 79 39 6d 4d 30 46 72 5a 57 4e 53 62 6d 6c 73 61 6a 6c 4b 61 58 5a 49 64 54 56 72 4e 48 6b 7a 56 33 42 31 4e 6d 70 6a 55 46 49 33 64 6e 6b 77 56 32 63 72 59 6d 6f 72 4e 46 46 7a 63 6b 6b 76 63 56 64 5a 57 44 6b 7a 4e 7a 64 73 64 57 46 31 61 30 5a 43 5a 31 52 31 63 55 74 71 59 58 55 32 59 6c 4e 4c 63 32 52 6e 65 45 31 74 51 32 35 44 4f 57 35 6f 64 56 56 7a 51 6b 52 75 54 6e 64 4d 59 7a 56 55 53 56 42 6b 62 47 35 68 56 33 64 51 4e 48 6b 78 53 30 68 4c 56 48 42 4c 61 33 6f 32 5a 6b 6f 30 54 55 4e 5a 52 54 46 45 4d 48 6f 78 53 6b 74 6a 63 45 35 7a 56 44 56 6d 5a 6e 64 61 4e 58 46 45 64 45 52 54 63 6b 4e 6d 5a 7a 6c 69 52 55 77 35 51 56 70 4c 5a 46 46 36 4b 33 56 6d 54 6a 4e 31 62 45 68 6b 53 55 45 33 5a 6d 52 33 57 Data Ascii: 1670RVc4bm1pKy9mM0FrZWNSbmlsajlKaXZIdTVrNHkzV3B1NmpjUFI3dnkwV2crYmorNFFzckkvcVdZWDkzNzdsdWF1a0ZCZ1R1cUtqYXU2YlNLc2RneE1tQ25DOW5odVVzQkRuTndMYzVUSVBkbG5hV3dQNHkxS0hLVHBLa3o2Zko0TUNZRTFEMHoxSktjcE5zVDVmZndaNXFEdERTckNmZzliRUw5QVpLZFF6K3VmTjN1bEhkSUE3ZmR3W
2024-02-08 18:36:02 UTC	1252	IN	Data Raw: 4a 48 61 69 39 4d 64 55 39 4e 64 33 52 70 54 7a 46 54 63 30 78 6c 64 6c 4a 70 4d 57 39 75 51 54 56 45 61 6c 70 72 64 56 42 45 53 32 78 32 57 47 5a 6e 56 33 52 50 63 46 46 70 59 58 64 50 56 32 52 6f 4f 46 68 43 59 56 4e 59 4f 44 5a 74 62 58 5a 36 54 30 74 68 64 57 35 6b 5a 57 46 49 52 48 67 79 4d 6a 64 36 51 57 5a 6c 51 32 56 58 62 7a 4a 36 54 47 39 55 65 45 6c 4f 62 6d 52 6a 61 45 56 4c 62 30 39 46 61 46 52 58 62 47 4e 33 52 56 67 79 56 48 52 4b 59 6a 68 76 57 48 56 77 61 57 49 79 4d 6e 52 43 52 54 4e 54 51 55 6c 71 64 33 70 6c 53 33 4e 4a 64 69 39 69 61 56 6c 6e 52 6b 6c 43 56 6c 4e 73 4d 6a 56 79 54 48 51 79 4d 47 45 33 54 32 78 45 4f 46 6f 35 64 56 52 54 63 44 5a 4f 59 30 77 76 52 57 6c 56 4e 6d 56 6e 52 32 64 4d 51 7a 52 6c 51 6e 70 7a 64 32 4e 68 63 Data Ascii: JHai9MdU9Nd3RpTzFTc0xldlJpMW9uQTVEalprdVBES2x2WGZnV3RPcFFpYXdPV2RoOFhCYVNYODZtbXZ6T0thdW5kZWFIRHgyMjd6QWZlQ2VXbzJ6TG9UeElObmRjaEVLb09FaFRXbGN3RVgyVHRKYjhvWHVwaWIyMnRCRTNTQUlqd3plS3NJdi9iaVlnRklCVlNsMjVyTHQyMGE3T2xEOFo5dVRTcDZOY0wvRWlVNmVnR2dMQzRlQnpzd2Nhc
2024-02-08 18:36:02 UTC	1252	IN	Data Raw: 68 74 5a 6a 56 58 52 30 56 78 51 6d 35 57 56 30 6c 42 57 6e 4e 57 57 69 74 43 51 6d 39 53 4e 30 78 51 51 54 52 6a 4e 48 56 32 56 47 78 69 62 31 52 79 53 79 74 61 63 32 35 45 55 31 6c 54 52 55 78 5a 51 32 6c 79 51 6d 46 5a 64 32 70 54 61 44 6c 76 53 32 56 4f 5a 44 63 76 61 56 41 72 57 46 56 51 56 6b 56 58 4b 32 52 4e 55 57 55 79 55 6c 4e 6b 4e 56 70 49 64 33 59 31 4e 6c 56 49 55 31 6b 78 65 58 4a 55 64 55 52 34 5a 6e 68 6a 62 6c 68 46 65 6a 68 6e 54 48 52 42 4f 54 64 72 55 6a 67 78 62 47 6c 6e 4f 58 70 50 63 33 68 72 65 6b 78 47 52 32 39 45 53 46 70 49 4d 6a 4a 69 4e 58 56 68 56 44 45 77 4c 31 46 32 53 48 70 43 56 47 73 34 57 57 78 34 4d 46 67 72 53 56 5a 48 4d 6b 46 76 53 30 39 4a 56 55 46 55 57 57 52 36 64 31 52 4d 55 53 39 76 54 32 64 33 57 6b 74 55 61 Data Ascii: htZjVXR0VxQm5WV0lBWnNWWitCQm9SN0xQQTRjNHV2VGxib1RySytac25EU1lTRUxZQ2lyQmFZd2pTaDlvS2VOZDcvaVArWFVQVkVXK2RNUWUyUlNkNVpId3Y1NlVIU1kxeXJUdUR4ZnhjblhFejhnTHRBOTdrUjgxbGlnOXpPc3hrekxGR29ESFpIMjJiNXVhVDEwL1F2SHpCVGs4WWx4MFgrSVZHMkFvS09JVUFUWWR6d1RMUS9vT2d3WktUa
2024-02-08 18:36:02 UTC	1252	IN	Data Raw: 56 51 56 6b 46 6a 64 6b 46 4d 65 46 42 73 64 6a 4a 4c 53 48 5a 48 54 57 46 30 62 32 6f 30 65 54 5a 33 4c 7a 42 43 62 6a 52 30 4d 54 52 32 65 56 41 34 62 7a 42 73 62 56 68 77 51 6b 39 45 54 6d 6b 34 4b 7a 68 6c 57 6b 68 56 52 7a 46 70 61 47 49 33 55 32 52 4d 53 54 45 32 4e 31 68 4b 4e 6d 4e 5a 62 30 39 6c 54 47 78 57 53 54 63 35 63 32 64 6d 4f 45 78 77 4e 47 6b 78 54 6e 46 52 63 53 38 34 4f 55 51 7a 52 47 38 31 61 56 45 76 4d 33 4e 55 61 6d 74 35 63 6c 4a 55 62 31 64 51 56 6d 39 58 4d 45 31 51 61 57 30 30 5a 7a 68 71 4e 79 74 47 64 6e 52 4b 54 6c 42 78 5a 55 64 68 64 6b 4a 4d 53 56 46 46 4f 54 68 4c 63 45 63 7a 61 32 73 76 4f 55 46 73 63 6b 78 4c 52 47 38 34 51 57 52 72 61 47 68 6e 4c 7a 6c 79 64 56 64 49 64 31 4e 50 64 6a 56 50 51 32 46 73 62 55 46 35 65 Data Ascii: VQVkFjdkFMeFBsdjJLSHZHTWF0b2o0eTZ3LzBCbjR0MTR2eVA4bzBsbVhwQk9ETmk4KzhlWkhVRzFpaGI3U2RMSTE2N1hKNmNZb09lTGxWSTc5c2dmOExwNGkxTnFRcS84OUQzRG81aVEvM3NUamt5clJUb1dQVm9XME1QaW00ZzhqNytGdnRKTlBxZUdhdkJMSVFFOThLcEcza2svOUFsckxLRG84QWRraGhnLzlydVdId1NPdjVPQ2FsbUF5e
2024-02-08 18:36:02 UTC	744	IN	Data Raw: 6b 33 63 6e 6c 44 5a 48 46 32 65 6a 42 6b 52 47 31 36 62 45 6c 68 54 31 52 4b 55 57 74 4f 65 45 39 57 64 48 4a 72 5a 47 46 76 64 6d 59 76 55 33 6c 43 63 6d 52 31 56 55 46 6d 51 55 31 72 5a 57 4a 58 4d 6d 74 4b 61 48 4a 70 4d 6b 68 46 64 31 56 31 62 32 52 57 57 55 6c 68 57 57 74 6c 4e 53 39 30 5a 46 52 59 61 30 64 70 4b 31 41 32 63 33 51 30 61 6b 73 79 61 6e 63 79 56 47 70 4a 65 46 46 4e 52 6e 56 57 61 47 52 54 53 33 56 4d 4e 31 6c 6d 62 69 39 42 4e 57 68 34 53 6a 56 4d 53 46 6f 34 54 48 4e 72 56 45 74 54 55 48 68 59 54 55 64 6a 61 6a 4a 6b 5a 6d 34 76 53 6b 38 34 4e 47 52 55 61 45 46 54 4d 58 42 48 51 6d 70 33 54 6d 64 4a 53 55 64 5a 56 47 31 34 4d 32 5a 75 51 57 64 46 52 6d 6c 31 4f 46 68 78 4e 6b 4a 52 4d 46 46 52 61 54 6c 72 61 48 46 78 5a 6b 45 78 64 Data Ascii: k3cnlDZHF2ejBkRG16bElhT1RKUWtOeE9WdHJrZGFvdmYvU3lCcmR1VUFmQU1rZWJXMmtKaHJpMkhFd1V1b2RWWUlhWWtlNS90ZFRYa0dpK1A2c3Q0aksyancyVGpJeFFNRnVWaGRTS3VMN1lmbi9BNWh4SjVMSFo4THNrVEtTUHhYTUdjajJkZm4vSk84NGRUaEFTMXBHQmp3TmdJSUdZVG14M2ZuQWdFRml1OFhxNkJRMFFRaTlraHFxZkExd
2024-02-08 18:36:02 UTC	1252	IN	Data Raw: 31 32 65 33 0d 0a 59 56 4a 7a 62 31 6b 34 4f 48 6c 32 56 55 63 33 51 32 70 42 65 54 56 78 56 31 68 32 4f 44 63 72 53 32 31 6f 57 46 59 31 52 57 35 45 53 47 35 70 65 57 5a 34 55 6b 78 78 55 6e 56 6b 65 6c 56 68 65 48 5a 71 51 6b 6c 61 65 57 67 31 61 33 6c 45 4b 32 4a 58 56 6c 59 7a 56 6e 59 32 54 31 42 59 55 6e 46 31 61 6e 51 78 59 6c 6c 7a 62 6a 4a 33 4d 54 56 76 54 44 56 71 53 79 73 78 4b 33 6c 4b 59 54 4d 30 55 30 6f 72 63 32 39 4f 4f 58 4e 77 59 55 35 34 4e 44 6c 46 62 6b 64 77 5a 56 6c 31 53 6b 63 30 4d 6d 64 31 53 7a 52 75 59 32 45 72 4e 48 46 58 57 6b 4a 69 55 55 78 6c 54 57 4a 71 4d 44 46 50 61 46 52 68 4d 7a 68 6f 61 30 52 77 53 6a 4e 31 5a 58 70 70 55 55 35 43 63 45 78 51 61 45 39 47 53 30 5a 69 5a 55 39 4a 53 32 35 6a 61 6b 46 6e 64 6b 6c 53 55 Data Ascii: 12e3YVJzb1k4OHl2VUc3Q2pBeTVxV1h2ODcrS21oWFY1RW5ESG5peWZ4UkxxUnVkelVheHZqQklaeWg1a3lEK2JXVlYzVnY2T1BYUnF1anQxYllzbjJ3MTVvTDVqSysxK3lKYTM0U0orc29OOXNwYU54NDlFbkdwZVl1Skc0Mmd1SzRuY2ErNHFXWkJiUUxlTWJqMDFPaFRhMzhoa0RwSjN1ZXppUU5CcExQaE9GS0ZiZU9JS25jakFndklSU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
485	192.168.2.5	50292	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:02 UTC	2828	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqTECAAAA:KZH0LXn1LmtLax44cr3ulN7ZWKDKmkwD0f1NvxkTb/jMqN1qVF8/PPzxZ3FfGbac4KlwMzVqtHBLtnz3TlfY3lZFLuRxBo/G3GoxVpl40Pm79RmXzC5FffFVzmtAhflKkKku7qPdEaN9tz27eDhEX7WXyEmmwnE8ltFV9YWYokbWUXLMQfpGhpTzQoDT/hiUfT0mUysYnL1xui4+/zI3a36phZVLKnVp39vcKq/HJmo0nWX97fMIcKfWJBuirBA//m3YGM3S; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D
2024-02-08 18:36:02 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:02 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=bb7a82c9cc6e0193&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGem7VmSqKCd3d-fPoCg-kyXOMUjp7p236w x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 fcb94596db202c75ac0e559b3183be72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: MfTI0z1gQGzuKMkD4DVIc6mAiG7glmC-T_h7QWwzZGwWNYx7U773Zg==
2024-02-08 18:36:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
486	192.168.2.5	50293	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:02 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive Content-Length: 2827 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:02 UTC	2827	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 6c 49 36 43 51 39 63 4c 41 41 41 41 3a 38 5a 47 7a 6a 71 35 6a 4d 34 59 65 74 73 7a 42 62 32 50 73 46 58 30 64 39 7a 42 34 6d 48 4d 39 77 74 74 41 4d 61 42 4e 6e 48 4c 50 4f 57 4f 59 68 63 74 76 76 4f 41 4b 36 6f 38 4c 76 71 4b 50 62 67 5a 58 52 4d 31 65 79 46 75 42 50 4d 48 44 6f 54 6d 53 79 68 68 38 46 73 65 42 50 68 59 58 79 36 4d 39 33 4b 2f 2b 2f 4c 6b 52 57 51 45 35 44 33 58 46 43 4d 73 65 66 6c 5a 35 75 71 4e 5a 58 34 64 39 6c 37 30 35 4c 57 6d 43 4d 68 44 4c 36 35 52 69 6a 4f 6d 69 6c 63 55 4b 7a 36 32 30 45 65 62 75 2f 6e 71 72 33 61 66 4a 52 64 43 53 49 43 31 5a 63 30 Data Ascii: {"existing_token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAlI6CQ9cLAAAA:8ZGzjq5jM4YetszBb2PsFX0d9zB4mHM9wttAMaBNnHLPOWOYhctvvOAK6o8LvqKPbgZXRM1eyFuBPMHDoTmSyhh8FseBPhYXy6M93K/+/LkRWQE5D3XFCMseflZ5uqNZX4d9l705LWmCMhDL65RijOmilcUKz620Eebu/nqr3afJRdCSIC1Zc0
2024-02-08 18:36:02 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1476 Connection: close Vary: Accept-Encoding Date: Thu, 08 Feb 2024 18:36:02 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65c51f12-7b20beea48458def44ac5883 X-Cache: Miss from cloudfront Via: 1.1 e418fd5667de46c635f0321ea814c2e0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: 8Kg47ohIoZ7LWOd-JBNOGaf0ekcNXabqHKYN26HiBN0o_09NtQhd3Q==
2024-02-08 18:36:02 UTC	1476	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 71 4e 71 42 37 70 41 55 41 41 41 41 3a 77 61 53 75 63 4e 6c 47 68 76 55 78 51 30 43 34 52 33 4b 69 51 4d 6c 4a 2f 56 59 30 30 59 4c 5a 30 5a 2b 30 77 44 69 46 66 58 79 66 66 2f 34 38 66 72 70 75 76 75 68 74 71 73 2b 31 2f 36 6f 4b 44 57 54 42 48 57 54 34 48 6b 77 6c 73 4d 49 4b 33 2f 76 6f 68 4f 46 64 76 50 45 6b 52 47 4f 55 78 53 53 6e 51 38 39 34 66 41 74 35 54 44 63 58 78 34 69 55 75 51 67 53 57 32 34 72 72 57 43 5a 76 72 67 58 6d 63 6c 6e 4d 58 52 51 6d 57 30 4b 77 68 63 66 32 46 62 35 4d 54 45 33 6f 39 6e 64 59 36 79 63 5a 73 64 50 32 36 38 6e 64 53 74 4e 6a 7a 74 4d 34 42 57 42 57 53 71 35 4f 32 70 Data Ascii: {"token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAqNqB7pAUAAAA:waSucNlGhvUxQ0C4R3KiQMlJ/VY00YLZ0Z+0wDiFfXyff/48frpuvuhtqs+1/6oKDWTBHWT4HkwlsMIK3/vohOFdvPEkRGOUxSSnQ894fAt5TDcXx4iUuQgSW24rrWCZvrgXmclnMXRQmW0Kwhcf2Fb5MTE3o9ndY6ycZsdP268ndStNjztM4BWBWSq5O2p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
487	192.168.2.5	50294	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:02 UTC	2828	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqTECAAAA:KZH0LXn1LmtLax44cr3ulN7ZWKDKmkwD0f1NvxkTb/jMqN1qVF8/PPzxZ3FfGbac4KlwMzVqtHBLtnz3TlfY3lZFLuRxBo/G3GoxVpl40Pm79RmXzC5FffFVzmtAhflKkKku7qPdEaN9tz27eDhEX7WXyEmmwnE8ltFV9YWYokbWUXLMQfpGhpTzQoDT/hiUfT0mUysYnL1xui4+/zI3a36phZVLKnVp39vcKq/HJmo0nWX97fMIcKfWJBuirBA//m3YGM3S; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D
2024-02-08 18:36:03 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:03 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=f95782c97ed402ed&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGVL-gK0pTJKIuXRQDC3irH8Uo8y57YGsEQ x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 25d9b5959eaa82bb18ee3f35e6bf34b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: th0P70qgh4by4ZTprIqNWGTrpVsL1qWoN32ObeObkjxDT9BxakoHLg==
2024-02-08 18:36:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
488	192.168.2.5	50295	216.239.34.181	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:02 UTC	1755	OUT	POST /g/collect?v=2&tid=G-FPD6YLJCJ7&gtm=45je4250v888381215z879615461za200&_p=1707417355756&gcs=G1--&gcd=13l3l3l3l5&npa=0&dma=0&cid=421694156.1707417338&ul=en-us&sr=1280x1024&ir=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pae=1&pscdl=noapi&_eu=EA&_s=1&cu=EUR&dl=https%3A%2F%2Fwww.booking.com%2F&sid=1707417345&sct=1&seg=1&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&ep.cd_action=index&ep.cd_adults=-1&ep.cd_page_url=https%3A%2F%2Fwww.booking.com%2F&ep.cd_ai=304142&ep.cd_book_window=&ep.cd_full_referrer=&ep.cd_glev=&ep.cd_language=en-us&ep.cd_logged_in=0&ep.cd_tsmp=1707417349&ep.cd_user_location=us&_et=7&up.up_ga_client_id=421694156.1707417338&up.up_is_subscribed_to_newsletter=&tfd=13545 HTTP/1.1 Host: analytics.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:03 UTC	449	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: https://www.booking.com Date: Thu, 08 Feb 2024 18:36:03 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Credentials: true Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
489	192.168.2.5	50296	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:03 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive Content-Length: 2932 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:03 UTC	2932	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 71 4e 71 42 37 70 41 55 41 41 41 41 3a 77 61 53 75 63 4e 6c 47 68 76 55 78 51 30 43 34 52 33 4b 69 51 4d 6c 4a 2f 56 59 30 30 59 4c 5a 30 5a 2b 30 77 44 69 46 66 58 79 66 66 2f 34 38 66 72 70 75 76 75 68 74 71 73 2b 31 2f 36 6f 4b 44 57 54 42 48 57 54 34 48 6b 77 6c 73 4d 49 4b 33 2f 76 6f 68 4f 46 64 76 50 45 6b 52 47 4f 55 78 53 53 6e 51 38 39 34 66 41 74 35 54 44 63 58 78 34 69 55 75 51 67 53 57 32 34 72 72 57 43 5a 76 72 67 58 6d 63 6c 6e 4d 58 52 51 6d 57 30 4b 77 68 63 66 32 46 62 35 4d 54 45 33 6f 39 6e 64 59 36 79 63 5a 73 64 50 32 36 38 6e 64 53 74 4e 6a 7a 74 4d 34 42 Data Ascii: {"existing_token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAqNqB7pAUAAAA:waSucNlGhvUxQ0C4R3KiQMlJ/VY00YLZ0Z+0wDiFfXyff/48frpuvuhtqs+1/6oKDWTBHWT4HkwlsMIK3/vohOFdvPEkRGOUxSSnQ894fAt5TDcXx4iUuQgSW24rrWCZvrgXmclnMXRQmW0Kwhcf2Fb5MTE3o9ndY6ycZsdP268ndStNjztM4B
2024-02-08 18:36:03 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1564 Connection: close Vary: Accept-Encoding Date: Thu, 08 Feb 2024 18:36:03 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65c51f13-0965884d4482f3b4621d4aea X-Cache: Miss from cloudfront Via: 1.1 199b065e4c1253c9590e1b5e57083906.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: ga0qjjGtW1jFyGXtAGfFhC60sqqjUnW40YzFltlk1jkxnFqsv5E6oA==
2024-02-08 18:36:03 UTC	1564	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 63 6c 69 43 4e 48 4d 4e 41 41 41 41 3a 6e 2f 63 76 35 56 5a 39 71 56 4e 4d 53 76 46 4c 30 62 4f 51 54 4b 75 49 32 4f 50 76 54 45 65 46 65 79 68 54 4c 37 57 6a 77 47 4d 30 4f 47 2f 6e 34 77 32 62 61 54 79 6b 42 42 68 2f 59 5a 49 48 30 61 66 50 53 4c 54 4e 78 6e 54 66 78 2b 2f 47 30 61 69 57 64 65 56 48 5a 67 2f 47 67 35 79 71 4f 63 39 33 4d 45 72 64 39 33 79 6a 65 49 73 57 51 59 74 6e 44 67 55 76 34 67 4b 34 64 30 73 68 68 5a 70 78 61 42 50 61 2b 2f 35 31 48 30 2b 73 4a 4c 66 79 36 72 2f 61 75 51 6e 69 51 6b 51 61 4e 57 62 6f 77 72 72 34 61 69 75 5a 31 48 78 6e 35 59 4a 31 4f 4d 68 45 73 73 78 51 71 53 38 Data Ascii: {"token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAcliCNHMNAAAA:n/cv5VZ9qVNMSvFL0bOQTKuI2OPvTEeFeyhTL7WjwGM0OG/n4w2baTykBBh/YZIH0afPSLTNxnTfx+/G0aiWdeVHZg/Gg5yqOc93MErd93yjeIsWQYtnDgUv4gK4d0shhZpxaBPa+/51H0+sJLfy6r/auQniQkQaNWbowrr4aiuZ1Hxn5YJ1OMhEssxQqS8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
490	192.168.2.5	50297	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:03 UTC	2828	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqTECAAAA:KZH0LXn1LmtLax44cr3ulN7ZWKDKmkwD0f1NvxkTb/jMqN1qVF8/PPzxZ3FfGbac4KlwMzVqtHBLtnz3TlfY3lZFLuRxBo/G3GoxVpl40Pm79RmXzC5FffFVzmtAhflKkKku7qPdEaN9tz27eDhEX7WXyEmmwnE8ltFV9YWYokbWUXLMQfpGhpTzQoDT/hiUfT0mUysYnL1xui4+/zI3a36phZVLKnVp39vcKq/HJmo0nWX97fMIcKfWJBuirBA//m3YGM3S; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D
2024-02-08 18:36:03 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:03 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=2ae182c95e390010&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGe12w2CeFSnHHpIlrUlVKMnjbpE4drZYeQ x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 31113f2f23c4ce8a8af1d88a37137806.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: V7eOOTWyQA8DUrD35ctm1G7e60pknUUAg88LaX9IbQMotaIYFX3Ywg==
2024-02-08 18:36:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
491	192.168.2.5	50298	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:04 UTC	2828	OUT	GET /dml/graphql?lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAoiuCqTECAAAA:KZH0LXn1LmtLax44cr3ulN7ZWKDKmkwD0f1NvxkTb/jMqN1qVF8/PPzxZ3FfGbac4KlwMzVqtHBLtnz3TlfY3lZFLuRxBo/G3GoxVpl40Pm79RmXzC5FffFVzmtAhflKkKku7qPdEaN9tz27eDhEX7WXyEmmwnE8ltFV9YWYokbWUXLMQfpGhpTzQoDT/hiUfT0mUysYnL1xui4+/zI3a36phZVLKnVp39vcKq/HJmo0nWX97fMIcKfWJBuirBA//m3YGM3S; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D
2024-02-08 18:36:04 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:04 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=999182ca12930091&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGdW3x9Z2CFRcNr_k_tY3ic_R-CWohzuaOQ x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 8415794d557292780ff382a8c5bd6058.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: UF_9LlELAsYDT2_x4u71tUBLkcpX4XuxhdfVTxZcKcEfeWQYUyL5GQ==
2024-02-08 18:36:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
492	192.168.2.5	50299	18.67.65.100	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:04 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:04 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Thu, 08 Feb 2024 18:36:04 GMT X-Cache: Error from cloudfront Via: 1.1 040f8a2cdffe1cf7a35d28e06c3ed574.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: Ajar2r8TAWvxMlnJvr4X1yjtoP-VqJqWDcWvA54oD62lTPMJvb7XtA==
2024-02-08 18:36:04 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
493	192.168.2.5	50300	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:04 UTC	3311	OUT	GET /index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAcliCNHMNAAAA:n/cv5VZ9qVNMSvFL0bOQTKuI2OPvTEeFeyhTL7WjwGM0OG/n4w2baTykBBh/YZIH0afPSLTNxnTfx+/G0aiWdeVHZg/Gg5yqOc93MErd93yjeIsWQYtnDgUv4gK4d0shhZpxaBPa+/51H0+sJLfy6r/auQniQkQaNWbowrr4aiuZ1Hxn5YJ1OMhEssxQqS8lSl7lQ+l4Gvg/GzC+glgVIJ7q+Vvd2qNXBU8be/eAJXt3v+IBgPPT7+3k6BIj3HSxrID9I1jb
2024-02-08 18:36:05 UTC	2140	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:05 GMT vary: User-Agent, Accept-Encoding link: <https://cf.bstatic.com/static/css/gprof_icons_cloudfront_sd.iq_ltr/f2fce41920df3c9225af5c680c3a8127d2caaceb.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/incentives_cloudfront_sd.iq_ltr/f1558a6e9832a4eb8cfe1d3d14db176bd3564335.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/index_cloudfront_sd.iq_ltr/903b49ae71c75322442d1bc9a0dc298bb8a6e32e.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/main_cloudfront_sd.iq_ltr/e6474733abba1cd6bc8a66bea1aa8643d7435c30.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/main_exps_cloudfront_sd.iq_ltr/586b07455f7783cafa801bdea38881f1f98ad36d.css>; rel=preload; as=style link: <https://cf.bstatic.com/static/css/xp-index-sb_cloudfront_sd.iq_ltr/5b5ab8ab66a5ce3092875d0725122439c4f2dfdd.css>; rel=preload; as=style nel: {"max_age":604800,"report_to":"default"} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":604800,"group":"default"} set-cookie: _implmdnbl=2__1__0; path=/; expires=Sat, 09-Feb-2019 18:36:04 GMT; HttpOnly set-cookie: px_init=0; domain=booking.com; expires=Tue, 17-May-2078 13:12:08 GMT; SameSite=Strict; secure; HttpOnly set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBII%2FyfgaNcGcNRD%2FSIhmJOq2eq3%2BSsDkjCXhcZUnZ5lZoVH38ibtzR5rmv36AACzoYnyI6DkiXbs1zid0LilInunTzAXjjR4F9cb5ipLEysf66ICkaefY9O8pJ2ZjctKUTfhYUZ2omr4cRil0AUmIKbwrbYnWNYwUU%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:05 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-type-options: nosniff x-recruiting: Like HTTP headers? Come write ours: https://careers.booking.com x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 3f95374273631adbfd8e0d0a9f6d7b64.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 3v_r2BearbLaLnMYB0nczlf-BkyFNsor3Z2oWRgPdG8OM30v6uXS-g==
2024-02-08 18:36:05 UTC	11218	IN	Data Raw: 32 62 63 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 59 6f 75 20 6b 6e 6f 77 20 79 6f 75 20 63 6f 75 6c 64 20 62 65 20 67 65 74 74 69 6e 67 20 70 61 69 64 20 74 6f 20 70 6f 6b 65 20 61 72 6f 75 6e 64 20 69 6e 20 6f 75 72 20 63 6f 64 65 3f 0a 57 65 27 72 65 20 68 69 72 69 6e 67 20 64 65 73 69 67 6e 65 72 73 20 61 6e 64 20 64 65 76 65 6c 6f 70 65 72 73 20 74 6f 20 77 6f 72 6b 20 69 6e 20 41 6d 73 74 65 72 64 61 6d 3a 0a 68 74 74 70 73 3a 2f 2f 63 61 72 65 65 72 73 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 0a 2d 2d 3e 0a 3c 21 2d 2d 20 77 64 6f 74 2d 38 30 32 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 73 67 4d 39 74 54 62 51 66 41 6a 59 6b 53 38 22 Data Ascii: 2bca<!DOCTYPE html>...You know you could be getting paid to poke around in our code?We're hiring designers and developers to work in Amsterdam:https://careers.booking.com/-->... wdot-802 --><script type="text/javascript" nonce="sgM9tTbQfAjYkS8"
2024-02-08 18:36:05 UTC	16384	IN	Data Raw: 37 36 39 34 0d 0a 3c 74 69 74 6c 65 3e 0a 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 7c 20 4f 66 66 69 63 69 61 6c 20 73 69 74 65 20 7c 20 54 68 65 20 62 65 73 74 20 68 6f 74 65 6c 73 2c 20 66 6c 69 67 68 74 73 2c 20 63 61 72 20 72 65 6e 74 61 6c 73 20 26 20 61 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 73 20 0a 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 45 78 70 6c 6f 72 65 20 74 68 65 20 77 6f 72 6c 64 20 77 69 74 68 20 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 2e 20 42 69 67 20 73 61 76 69 6e 67 73 20 6f 6e 20 68 6f 6d 65 73 2c 20 68 6f 74 65 6c 73 2c 20 66 6c 69 67 68 74 73 2c 20 63 61 72 20 72 65 6e 74 61 6c 73 2c 20 74 61 78 69 73 2c 20 61 6e 64 20 61 74 74 72 61 63 74 69 6f 6e 73 20 e2 Data Ascii: 7694<title>Booking.com \| Official site \| The best hotels, flights, car rentals & accommodations </title><meta name="description" content="Explore the world with Booking.com. Big savings on homes, hotels, flights, car rentals, taxis, and attractions
2024-02-08 18:36:05 UTC	13980	IN	Data Raw: 20 61 6e 64 20 7b 6d 6f 6e 74 68 5f 6e 61 6d 65 5f 30 5f 75 6e 74 69 6c 7d 2f 7b 64 61 79 5f 6e 61 6d 65 5f 30 5f 75 6e 74 69 6c 7d 2f 7b 66 75 6c 6c 5f 79 65 61 72 5f 75 6e 74 69 6c 7d 22 2c 22 73 68 6f 72 74 5f 64 61 74 65 5f 77 69 74 68 5f 77 65 65 6b 64 61 79 22 3a 22 7b 73 68 6f 72 74 5f 77 65 65 6b 64 61 79 7d 2c 20 7b 73 68 6f 72 74 5f 6d 6f 6e 74 68 5f 6e 61 6d 65 7d 20 7b 64 61 79 5f 6f 66 5f 6d 6f 6e 74 68 7d 2c 20 7b 66 75 6c 6c 5f 79 65 61 72 7d 22 2c 22 64 61 74 65 5f 72 61 6e 67 65 5f 77 69 74 68 5f 73 68 6f 72 74 5f 77 65 65 6b 64 61 79 5f 73 68 6f 72 74 5f 6d 6f 6e 74 68 22 3a 22 7b 73 68 6f 72 74 5f 77 65 65 6b 64 61 79 7d 2c 20 7b 73 68 6f 72 74 5f 6d 6f 6e 74 68 5f 6e 61 6d 65 7d 20 7b 64 61 79 5f 6f 66 5f 6d 6f 6e 74 68 7d 20 e2 80 93 Data Ascii: and {month_name_0_until}/{day_name_0_until}/{full_year_until}","short_date_with_weekday":"{short_weekday}, {short_month_name} {day_of_month}, {full_year}","date_range_with_short_weekday_short_month":"{short_weekday}, {short_month_name} {day_of_month}
2024-02-08 18:36:05 UTC	8951	IN	Data Raw: 32 32 65 66 0d 0a 67 68 74 65 72 3a 20 22 23 46 46 45 42 45 42 22 2c 0a 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 6c 69 67 68 74 65 73 74 3a 20 22 23 46 46 46 30 46 30 22 2c 0a 62 75 69 5f 63 6f 6c 6f 72 5f 63 6f 6e 73 74 72 75 63 74 69 76 65 5f 64 61 72 6b 3a 20 22 23 30 30 36 36 30 37 22 2c 0a 62 75 69 5f 63 6f 6c 6f 72 5f 63 6f 6e 73 74 72 75 63 74 69 76 65 3a 20 22 23 30 30 38 30 30 39 22 2c 0a 62 75 69 5f 63 6f 6c 6f 72 5f 63 6f 6e 73 74 72 75 63 74 69 76 65 5f 6c 69 67 68 74 3a 20 22 23 39 37 45 35 39 43 22 2c 0a 62 75 69 5f 63 6f 6c 6f 72 5f 63 6f 6e 73 74 72 75 63 74 69 76 65 5f 6c 69 67 68 74 65 72 3a 20 22 23 45 37 46 44 45 39 22 2c 0a 62 75 69 5f 63 6f 6c 6f 72 5f 63 6f 6e 73 74 72 75 63 74 69 76 65 5f 6c 69 67 68 74 65 Data Ascii: 22efghter: "#FFEBEB",bui_color_destructive_lightest: "#FFF0F0",bui_color_constructive_dark: "#006607",bui_color_constructive: "#008009",bui_color_constructive_light: "#97E59C",bui_color_constructive_lighter: "#E7FDE9",bui_color_constructive_lighte
2024-02-08 18:36:05 UTC	16384	IN	Data Raw: 33 66 66 61 0d 0a 62 65 72 20 73 68 6f 75 6c 64 20 63 6f 6e 74 61 69 6e 20 39 20 64 69 67 69 74 73 2e 20 50 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 2e 27 2c 0a 62 5f 62 6c 61 6e 6b 5f 6e 75 6d 65 72 69 63 5f 70 69 6e 3a 20 27 50 6c 65 61 73 65 20 65 6e 74 65 72 20 79 6f 75 72 20 62 6f 6f 6b 69 6e 67 5c 27 73 20 50 49 4e 20 63 6f 64 65 2e 27 2c 0a 62 5f 62 6c 61 6e 6b 5f 62 6b 6e 67 5f 6e 72 3a 20 27 50 6c 65 61 73 65 20 65 6e 74 65 72 20 79 6f 75 72 20 62 6f 6f 6b 69 6e 67 20 6e 75 6d 62 65 72 2e 27 2c 0a 70 61 73 73 77 6f 72 64 5f 63 61 6e 74 5f 62 65 5f 75 73 65 72 6e 61 6d 65 3a 20 27 59 6f 75 72 20 70 61 73 73 77 6f 72 64 20 63 61 6e 5c 27 74 20 62 65 20 74 68 65 20 73 61 6d 65 20 61 73 20 79 6f 75 72 20 65 6d 61 69 6c 20 61 64 64 72 65 73 73 27 Data Ascii: 3ffaber should contain 9 digits. Please try again.',b_blank_numeric_pin: 'Please enter your booking\'s PIN code.',b_blank_bkng_nr: 'Please enter your booking number.',password_cant_be_username: 'Your password can\'t be the same as your email address'
2024-02-08 18:36:05 UTC	16384	IN	Data Raw: 0d 0a 38 30 30 30 0d 0a 48 57 41 46 4e 65 4f 59 44 61 64 4a 4a 59 4a 4f 22 3a 31 2c 22 4f 44 52 64 5a 57 64 5a 52 56 4b 61 4d 55 48 63 57 58 54 22 3a 31 2c 22 49 5a 56 54 57 52 47 58 56 57 55 44 44 4a 65 56 47 54 5a 56 4e 57 65 22 3a 31 2c 22 54 66 4e 5a 65 46 4f 42 54 65 4b 53 49 62 45 44 62 45 62 65 41 62 41 55 4d 63 45 55 62 66 4b 65 22 3a 32 2c 22 48 57 41 46 59 4e 46 49 59 4a 4b 56 53 53 56 48 59 44 4a 4f 22 3a 31 2c 22 5a 64 4c 4e 4b 50 51 46 41 65 44 48 52 51 52 46 48 54 22 3a 31 2c 22 4e 56 4e 5a 59 65 4a 4b 54 59 53 66 4f 55 47 66 4e 51 45 4c 45 55 5a 53 48 65 57 61 4d 53 65 4b 65 22 3a 31 2c 22 63 4a 55 4a 44 52 53 4c 51 4b 51 53 63 56 49 51 48 4e 4d 62 5a 66 46 53 66 44 47 59 55 43 22 3a 31 2c 22 49 5a 56 54 57 52 47 45 41 46 63 46 50 49 57 44 Data Ascii: 8000HWAFNeOYDadJJYJO":1,"ODRdZWdZRVKaMUHcWXT":1,"IZVTWRGXVWUDDJeVGTZVNWe":1,"TfNZeFOBTeKSIbEDbEbeAbAUMcEUbfKe":2,"HWAFYNFIYJKVSSVHYDJO":1,"ZdLNKPQFAeDHRQRFHT":1,"NVNZYeJKTYSfOUGfNQELEUZSHeWaMSeKe":1,"cJUJDRSLQKQScVIQHNMbZfFSfDGYUC":1,"IZVTWRGEAFcFPIWD
2024-02-08 18:36:05 UTC	16384	IN	Data Raw: 48 44 64 4c 59 42 4e 57 54 43 55 5a 5a 4f 65 47 44 50 4e 65 46 47 49 59 49 59 65 46 4d 65 41 46 4a 42 45 4a 4b 61 45 63 66 45 43 22 3a 31 2c 22 5a 64 5a 66 44 48 43 4f 4c 5a 4f 54 64 66 64 52 57 53 45 58 41 62 41 4a 51 54 51 50 57 5a 63 59 50 59 4f 22 3a 32 2c 22 66 65 66 53 4b 65 45 46 63 49 41 44 57 48 43 44 55 46 59 51 58 55 5a 43 22 3a 31 2c 22 48 57 41 46 59 42 66 50 44 42 45 44 48 49 57 44 62 4b 49 64 44 5a 42 41 57 54 57 4d 52 48 63 57 49 4d 5a 49 62 59 4f 22 3a 31 2c 22 48 57 41 46 59 54 66 4a 61 41 4b 44 66 57 56 64 61 57 4e 42 65 57 65 22 3a 31 2c 22 56 4f 62 64 5a 5a 61 42 66 43 43 64 44 65 51 66 59 59 54 22 3a 31 2c 22 49 5a 42 54 64 46 50 66 42 4b 53 41 45 4c 53 58 50 43 62 58 62 53 59 62 63 51 63 44 4b 5a 56 46 52 54 4b 65 22 3a 31 2c 22 48 Data Ascii: HDdLYBNWTCUZZOeGDPNeFGIYIYeFMeAFJBEJKaEcfEC":1,"ZdZfDHCOLZOTdfdRWSEXAbAJQTQPWZcYPYO":2,"fefSKeEFcIADWHCDUFYQXUZC":1,"HWAFYBfPDBEDHIWDbKIdDZBAWTWMRHcWIMZIbYO":1,"HWAFYTfJaAKDfWVdaWNBeWe":1,"VObdZZaBfCCdDeQfYYT":1,"IZBTdFPfBKSAELSXPCbXbSYbcQcDKZVFRTKe":1,"H
2024-02-08 18:36:05 UTC	10	IN	Data Raw: 2c 22 59 51 4b 53 58 50 0d 0a Data Ascii: ,"YQKSXP
2024-02-08 18:36:05 UTC	16384	IN	Data Raw: 34 64 61 37 0d 0a 54 4c 4b 47 42 66 53 4f 45 59 66 44 65 5a 4e 4d 4c 54 4b 65 22 3a 31 2c 22 5a 43 4f 42 65 49 54 50 42 52 57 65 22 3a 31 2c 22 4e 41 44 50 46 42 62 53 46 63 46 58 65 55 4e 5a 57 50 50 4c 52 45 4e 5a 46 66 42 4a 66 42 4d 58 54 22 3a 31 2c 22 64 4c 59 48 4d 52 46 65 52 4c 50 59 4b 44 63 64 44 64 4f 4e 56 46 62 4b 43 42 50 51 43 48 54 22 3a 31 2c 22 4f 4f 49 42 54 42 42 4c 58 4f 4c 58 45 4f 42 54 55 53 50 4a 58 43 48 54 22 3a 31 2c 22 4e 41 46 51 51 41 44 5a 51 55 41 49 49 66 4f 64 41 53 55 54 62 43 22 3a 31 2c 22 4e 61 4d 50 4f 46 5a 59 48 55 53 55 48 59 59 66 50 59 61 66 44 65 44 43 22 3a 31 2c 22 61 57 51 4f 63 59 54 42 62 4a 66 45 44 56 61 63 44 64 51 65 52 48 66 56 43 4d 49 4c 61 41 46 5a 4b 58 65 22 3a 31 2c 22 63 43 48 4f 62 49 56 49 Data Ascii: 4da7TLKGBfSOEYfDeZNMLTKe":1,"ZCOBeITPBRWe":1,"NADPFBbSFcFXeUNZWPPLRENZFfBJfBMXT":1,"dLYHMRFeRLPYKDcdDdONVFbKCBPQCHT":1,"OOIBTBBLXOLXEOBTUSPJXCHT":1,"NAFQQADZQUAIIfOdASUTbC":1,"NaMPOFZYHUSUHYYfPYafDeDC":1,"aWQOcYTBbJfEDVacDdQeRHfVCMILaAFZKXe":1,"cCHObIVI
2024-02-08 18:36:05 UTC	3503	IN	Data Raw: 5a 64 4c 48 4e 4c 4c 57 58 46 5a 45 56 43 22 3a 31 2c 22 4f 4d 45 49 5a 45 48 62 61 54 61 54 61 42 64 4a 64 48 50 48 46 41 55 41 44 48 53 64 56 58 53 41 43 22 3a 31 2c 22 65 57 48 4d 63 43 63 43 63 43 4a 56 66 59 63 65 44 46 62 5a 4e 53 48 66 65 52 66 49 58 47 5a 61 54 43 4d 44 65 64 52 54 4b 65 65 48 52 62 64 46 49 4b 65 22 3a 31 2c 22 59 54 42 59 4e 4a 58 43 63 54 46 44 45 52 58 43 22 3a 31 2c 22 48 4d 65 43 4a 48 41 56 58 53 41 44 4f 52 4d 54 66 46 54 64 59 56 50 45 51 44 45 4e 44 64 4e 43 22 3a 31 2c 22 41 45 55 61 59 50 5a 5a 47 62 64 45 4b 51 52 56 4a 63 51 59 49 4d 64 55 54 53 44 50 43 4a 57 58 65 22 3a 32 2c 22 59 64 58 66 43 44 57 4f 4f 53 63 55 53 41 58 4b 64 63 45 49 5a 54 47 53 58 4e 51 42 53 42 62 51 62 43 22 3a 31 2c 22 4f 4d 54 56 42 45 4e Data Ascii: ZdLHNLLWXFZEVC":1,"OMEIZEHbaTaTaBdJdHPHFAUADHSdVXSAC":1,"eWHMcCcCcCJVfYceDFbZNSHfeRfIXGZaTCMDedRTKeeHRbdFIKe":1,"YTBYNJXCcTFDERXC":1,"HMeCJHAVXSADORMTfFTdYVPEQDENDdNC":1,"AEUaYPZZGbdEKQRVJcQYIMdUTSDPCJWXe":2,"YdXfCDWOOScUSAXKdcEIZTGSXNQBSBbQbC":1,"OMTVBEN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
494	192.168.2.5	50305	3.161.193.117	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:04 UTC	2103	OUT	GET /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D
2024-02-08 18:36:04 UTC	513	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html;charset=iso-8859-1 Content-Length: 411 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:04 GMT cache-control: must-revalidate,no-cache,no-store strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 ec79dc4af45a101de582202efa81d03c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P8 X-Amz-Cf-Id: _4YNlQZwcZ3bX1ahrPepGaoRyzaQfhgx52kXb5oAdlsElDOx71Gl6Q==
2024-02-08 18:36:04 UTC	411	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 2f 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 32 3e 48 54 54 50 20 45 52 52 4f 52 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 32 3e 0a 3c 74 61 62 6c 65 3e 0a 3c 74 72 3e 3c 74 68 3e 55 52 49 3a 3c 2f 74 68 3e 3c 74 64 3e 2f 77 65 62 2d 76 69 74 61 6c 73 2f 73 65 6e 64 2d 76 69 74 61 6c 73 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/><title>Error 405 Method Not Allowed</title></head><body><h2>HTTP ERROR 405 Method Not Allowed</h2><table><tr><th>URI:</th><td>/web-vitals/send-vitals</td></tr><tr>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
495	192.168.2.5	50306	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:04 UTC	3333	OUT	GET /js_tracking?aid=304142&pid=2c8482c2544201f4&ver=2&sid=5171fc655664ddf74ab763a094523fb7&ref_action=index&lang=en-us&stype=1&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|69\|1&m=UmFuZG9tSVYkc2RlIyh9YYo1mfebd19Q2WIimWOyIN1gUe4_-JQdNOBTMuHuYCJPue7ik10LWViyRYmmf149m9vSAg2JJTyfAEk9RiEQZejXjro5rDJvxnq57UaGsDKd0iBXLkMuV2sFYEHSFmXZW5zvkIdbv7-B87Oi9zo36Fnq7AU8K4Y8Y-SdtsN1A2dfLiciDUxBuNe45QSxoxZcHhPcdr6v26QamVEbge_7LQ_MDhbvlSKq9Lwf9P11FwHzxPymBNBmu_dZFb8tK9Z3wY0RAyYm7D0hfdu-LCtv4j3isKKp1L_CiYhwCnyC42X_OqimTrSjKXCbKfd3YnkJbQ HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A35%3A53+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAcliCNHMNAAAA:n/cv5VZ9qVNMSvFL0bOQTKuI2OPvTEeFeyhTL7WjwGM0OG/n4w2baTykBBh/YZIH0afPSLTNxnTfx+/G0aiWdeVHZg/Gg5yqOc93MErd93yjeIsWQYtnDgUv4gK4d0shhZpxaBPa+/51H0+sJLfy6r/auQniQkQaNWbowrr4aiuZ1Hxn5YJ1OMhEssxQqS8lSl7lQ+l4Gvg/GzC+glgVIJ7q+Vvd2qNXBU8be/eAJXt3v+IBgPPT7+3k6BIj3HSxrID9I1jb
2024-02-08 18:36:04 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:04 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=d2d382cac98d0101&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejL67P-HfiLbpgi-VGbgzb40kRc8nM9-aJ4 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 6f067a3fd6e721a7db2a2901701a65d8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: z2Hi2ZaK4vNW36rgfbhyjtFwLOxGtsiXcWdcGHo1p0QrUJI8iSM5YA==
2024-02-08 18:36:04 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
496	192.168.2.5	50307	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:04 UTC	791	OUT	GET /recaptcha/api2/reload?k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AJmcDEl4lP7G1sUzlkfo-ph5oEYDaZrMsr87jx805YMBfBXipJ4MvomJQXIF7z5TPrZE7LxvSiQSdmfSY1DEipM; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:04 UTC	518	IN	HTTP/1.1 405 HTTP method GET is not supported by this URL Content-Type: text/html; charset=UTF-8 Date: Thu, 08 Feb 2024 18:36:04 GMT Expires: Thu, 08 Feb 2024 18:36:04 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:36:04 UTC	217	IN	Data Raw: 64 33 0d 0a 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 48 54 54 50 20 6d 65 74 68 6f 64 20 47 45 54 20 69 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 20 62 79 20 74 68 69 73 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 48 31 3e 48 54 54 50 20 6d 65 74 68 6f 64 20 47 45 54 20 69 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 20 62 79 20 74 68 69 73 20 55 52 4c 3c 2f 48 31 3e 0a 3c 48 32 3e 45 72 72 6f 72 20 34 30 35 3c 2f 48 32 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 0d 0a Data Ascii: d3<HTML><HEAD><TITLE>HTTP method GET is not supported by this URL</TITLE></HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000"><H1>HTTP method GET is not supported by this URL</H1><H2>Error 405</H2></BODY></HTML>
2024-02-08 18:36:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
497	192.168.2.5	50308	216.137.45.32	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:04 UTC	2369	OUT	POST /v1/report HTTP/1.1 Host: web-perf.booking.com Connection: keep-alive Content-Length: 1906 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=utf-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCpat0p2POwwhhcTx%2FTQ2oUzdK1GIGeide97ZVfncjktBp7io0mOJ%2BzHKt9NXihJVUQfPcbbNullYXTX%2B6XcKmdM8Xqzg4rnfIe2hEPqvLeH45ncC2eZSbgsTwn%2FWgWuVtiA6pvPROe2VytpvXBiDf49YmRbHP7qWGM%3D; lastSeen=1707417363616
2024-02-08 18:36:04 UTC	1906	OUT	Data Raw: 7b 22 6d 65 74 72 69 63 73 22 3a 7b 22 77 65 62 56 69 74 61 6c 73 22 3a 7b 22 74 74 66 62 22 3a 7b 22 69 64 22 3a 22 76 33 2d 31 37 30 37 34 31 37 33 35 37 33 36 35 2d 38 34 33 32 33 32 39 30 31 38 32 34 36 22 2c 22 76 61 6c 75 65 22 3a 31 30 35 30 2c 22 6e 61 76 69 67 61 74 69 6f 6e 54 79 70 65 22 3a 22 6e 61 76 69 67 61 74 65 22 7d 2c 22 66 63 70 22 3a 7b 22 69 64 22 3a 22 76 33 2d 31 37 30 37 34 31 37 33 35 37 33 36 36 2d 33 30 32 30 37 31 39 31 32 30 32 31 38 22 2c 22 76 61 6c 75 65 22 3a 33 32 33 39 2e 36 30 30 30 30 30 30 30 30 30 30 36 2c 22 6e 61 76 69 67 61 74 69 6f 6e 54 79 70 65 22 3a 22 6e 61 76 69 67 61 74 65 22 7d 2c 22 63 6c 73 22 3a 7b 22 69 64 22 3a 22 76 33 2d 31 37 30 37 34 31 37 33 35 37 37 39 39 2d 35 38 39 36 32 38 32 37 38 34 36 39 Data Ascii: {"metrics":{"webVitals":{"ttfb":{"id":"v3-1707417357365-8432329018246","value":1050,"navigationType":"navigate"},"fcp":{"id":"v3-1707417357366-3020719120218","value":3239.600000000006,"navigationType":"navigate"},"cls":{"id":"v3-1707417357799-589628278469
2024-02-08 18:36:04 UTC	648	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 11 Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:04 GMT vary: Origin access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true referrer-policy: no-referrer x-frame-options: SAMEORIGIN x-content-type-options: nosniff strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 2247c77685f0b6b1314bdef5a95527b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-C2 X-Amz-Cf-Id: Uhva6J9Sst-3VdRcMz-L4XgHVW07HOGKOK8_trdQOGWfsBr8DlUIpw==
2024-02-08 18:36:04 UTC	11	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 7d Data Ascii: {"ok":true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
498	192.168.2.5	50309	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:04 UTC	716	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 955 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:04 UTC	955	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 65 32 63 65 64 30 36 34 2d 33 31 34 64 2d 34 63 62 63 2d 61 61 37 61 2d 35 62 31 66 38 64 36 61 61 34 39 34 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 37 32 33 64 65 39 36 63 2d 66 64 65 64 2d 34 36 64 36 2d 38 65 31 62 2d 32 65 35 31 33 63 63 61 33 35 66 38 22 2c 22 73 73 22 3a 22 32 32 34 65 39 64 61 32 2d 33 65 62 65 2d 34 64 65 30 2d 39 34 62 61 2d 30 64 35 64 32 32 63 39 35 62 37 66 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"e2ced064-314d-4cbc-aa7a-5b1f8d6aa494","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"723de96c-fded-46d6-8e1b-2e513cca35f8","ss":"224e9da2-3ebe-4de0-94ba-0d5d22c95b7f","bg":true,"s
2024-02-08 18:36:04 UTC	523	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:04 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
499	192.168.2.5	50310	18.67.65.100	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:05 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:05 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Thu, 08 Feb 2024 18:36:05 GMT X-Cache: Error from cloudfront Via: 1.1 2a6e657acb4fd3f6aee2e3da45e44642.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: C0TydD65XZccmLbzJIpVw1HDoDQpfmw9BlIGOUzpYyghaXOUjhgBFA==
2024-02-08 18:36:05 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
500	192.168.2.5	50312	18.67.65.100	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:05 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:05 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Thu, 08 Feb 2024 18:36:05 GMT X-Cache: Error from cloudfront Via: 1.1 cea67f5ca1b497624430e599aa6b7c62.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: l6D83gGVzBgmS7bAmzqKsmxujlt_EuwKv4nRh0OyHYdM4LXEZLINOQ==
2024-02-08 18:36:05 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
501	192.168.2.5	50313	172.64.155.119	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:05 UTC	597	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:06 UTC	370	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:36:06 GMT Content-Type: application/json Content-Length: 68 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8525f9ea0af444e5-ATL
2024-02-08 18:36:06 UTC	68	IN	Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 47 41 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 47 65 6f 72 67 69 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d Data Ascii: {"country":"US","state":"GA","stateName":"Georgia","continent":"NA"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
502	192.168.2.5	50314	18.67.65.100	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:06 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:06 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Thu, 08 Feb 2024 18:36:06 GMT X-Cache: Error from cloudfront Via: 1.1 b9d1b307966c2273bf97ed7c681603da.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: 7sW3M2_9gV3DW5EkpR7H61tR1k2Uq_M-WepjPBy6O7RFrpVjmd5hlQ==
2024-02-08 18:36:06 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
503	192.168.2.5	50302	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:06 UTC	668	OUT	GET /psb/capla/static/css/client.38ffee15.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "c9009dc966b4c139ffffe886598ac0c0" If-Modified-Since: Thu, 08 Feb 2024 12:34:07 GMT
2024-02-08 18:36:06 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:36:06 GMT ETag: "c9009dc966b4c139ffffe886598ac0c0" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: eIF2AzqToVz8ZJUSLOnoWnohwEtsxZAT Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 f4c38e024a95b76a27c9f3dc9ff2eda6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: nQgBQiZdenUETaNTXU8UCoZJ-MlHdfzUQQmXzQyVGOURcpkOWL2stg== Age: 20760 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
504	192.168.2.5	50315	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:06 UTC	717	OUT	POST /p HTTP/1.1 Host: tr6.snapchat.com Connection: keep-alive Content-Length: 899 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:06 UTC	899	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 65 32 63 65 64 30 36 34 2d 33 31 34 64 2d 34 63 62 63 2d 61 61 37 61 2d 35 62 31 66 38 64 36 61 61 34 39 34 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 36 66 35 31 61 38 66 35 2d 35 62 32 34 2d 34 37 34 30 2d 62 66 35 37 2d 30 63 34 64 34 38 65 34 65 39 39 34 22 2c 22 73 73 22 3a 22 32 32 34 65 39 64 61 32 2d 33 65 62 65 2d 34 64 65 30 2d 39 34 62 61 2d 30 64 35 64 32 32 63 39 35 62 37 66 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"e2ced064-314d-4cbc-aa7a-5b1f8d6aa494","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"6f51a8f5-5b24-4740-bf57-0c4d48e4e994","ss":"224e9da2-3ebe-4de0-94ba-0d5d22c95b7f","bg":true,"s
2024-02-08 18:36:06 UTC	388	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:06 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: clear Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
505	192.168.2.5	50316	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:06 UTC	717	OUT	POST /p HTTP/1.1 Host: tr6.snapchat.com Connection: keep-alive Content-Length: 890 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:06 UTC	890	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 64 37 33 36 31 61 34 2d 63 63 63 66 2d 34 30 62 39 2d 62 63 31 31 2d 36 36 61 32 35 38 35 32 32 35 33 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 62 61 30 65 31 34 64 36 2d 66 32 38 39 2d 34 36 64 30 2d 61 66 61 31 2d 39 62 34 38 38 34 61 66 32 64 64 33 22 2c 22 73 73 22 3a 22 31 35 65 30 61 36 32 31 2d 31 31 34 34 2d 34 38 35 64 2d 39 30 31 62 2d 30 39 62 62 36 33 38 64 32 39 33 36 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"fd7361a4-cccf-40b9-bc11-66a258522530","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"ba0e14d6-f289-46d0-afa1-9b4884af2dd3","ss":"15e0a621-1144-485d-901b-09bb638d2936","bg":true,"s
2024-02-08 18:36:06 UTC	429	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:06 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
506	192.168.2.5	50318	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:06 UTC	676	OUT	GET /psb/capla/static/css/7bcb015e.5b709f3d.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "8b761ecf11f6b807d0d765ee8cd5851e" If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
2024-02-08 18:36:06 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:36:06 GMT ETag: "8b761ecf11f6b807d0d765ee8cd5851e" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: .wxzOg8QkFu.xibWr3CgHbjp4QG_aTPI Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 086e2cd5d94fa729de58c51b5666e0e4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: oHXAwVa_rJj_Vlv8GC2rpU22pnBmMFweST-SOh9jp9ksLgQNKA0iOg== Age: 19171 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
507	192.168.2.5	50317	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:06 UTC	676	OUT	GET /psb/capla/static/css/eb60141d.cad86b29.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "2980ea90c3f4c27d77bffbd1527870a7" If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
2024-02-08 18:36:06 UTC	514	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:36:06 GMT ETag: "2980ea90c3f4c27d77bffbd1527870a7" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: sAJOuwpsDtZfgppaREh03xaE5gNkW8K5 Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 d125bf8405e840aa51a88ae3d8d91fb2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: JsO4e9eqaJkWPD91vLKsgG8txRSwYQsCbufrrVdsciqXRcc8YkQqhw== Age: 8927 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
508	192.168.2.5	50321	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:06 UTC	676	OUT	GET /psb/capla/static/css/c6a78acb.bffda4a9.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "6f3e8bb7938a05e927b3ca4454f98fa8" If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
2024-02-08 18:36:06 UTC	492	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:36:06 GMT ETag: "6f3e8bb7938a05e927b3ca4454f98fa8" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: b5qwU9Uw68HNRDgalzg4bB9gCMOFsuHv Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 6f067a3fd6e721a7db2a2901701a65d8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 1gEw9jFz1d0cv0_fdJZ1TRQIDCdqIxGldt7WKcTYHXSy8PFoX8zUMA== Age: 24731 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
509	192.168.2.5	50320	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:06 UTC	676	OUT	GET /psb/capla/static/css/f50a2dfc.837540b6.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "fdb620d16ddcb3d874c0d96880365b4d" If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
2024-02-08 18:36:06 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:36:06 GMT ETag: "fdb620d16ddcb3d874c0d96880365b4d" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: gKQ3dko_aeSe7flBYen.8nJ6TCgcueOK Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 c625b1bdde545acdeb26c9f6ad3a8c6e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Im_2Z3JhgCzZLjTF_3aDs5A9BSYrJef9QbcXt5F5l5_50ZXJJ7UQ1Q== Age: 24731 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
510	192.168.2.5	50322	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:06 UTC	676	OUT	GET /psb/capla/static/css/a6a21c13.8939445f.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "e262f92e286a4c74280bd4b3fdee8cbb" If-Modified-Since: Thu, 08 Feb 2024 11:37:53 GMT
2024-02-08 18:36:06 UTC	492	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:36:06 GMT ETag: "e262f92e286a4c74280bd4b3fdee8cbb" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 7G8nAXI18cFrDtj.jVsLGUJVDX12qJHu Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 31113f2f23c4ce8a8af1d88a37137806.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: SUiUathlpqYACx-6rl3T6uaSxDOALJr-U7HVcQOi87B-9w62mI6CYw== Age: 24731 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
511	192.168.2.5	50319	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:06 UTC	676	OUT	GET /psb/capla/static/css/f5d0e2e7.a54d85eb.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "88d8b9631fe60984baabd22260a86e6e" If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
2024-02-08 18:36:06 UTC	514	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:36:06 GMT ETag: "88d8b9631fe60984baabd22260a86e6e" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 45SgOdslZ5ni1p_3JE_2CMeJEvzIw3pO Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 e268ddb03ed9480c5c602c27323a81ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: kIcHrQ0IY9T-V_-jmHfV56CV0YiB_ZQ_9WQgQYPSedq1Basg30mzRw== Age: 8927 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
512	192.168.2.5	50323	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:07 UTC	676	OUT	GET /psb/capla/static/css/d2a738da.079c3b4c.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "1a7c523a95596c5b0b122ad8d8e3b553" If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
2024-02-08 18:36:07 UTC	514	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:36:07 GMT ETag: "1a7c523a95596c5b0b122ad8d8e3b553" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: y6hnIHqnWmWPq9JqZ4Ue_o6YIF6Bl_1N Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 4a91a321d4c2ab7334c6f285093956ae.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: IYZBYJD2bV39CbC3o7HI-kxKdLKhdGfFeXADE2atb3Vy7IRuiDBWiw== Age: 8928 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
513	192.168.2.5	50324	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:07 UTC	676	OUT	GET /psb/capla/static/css/4e596c2c.3a2fb681.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "51be0c43cc481b13fe70d3ba27e2ffd9" If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT
2024-02-08 18:36:07 UTC	514	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:36:07 GMT ETag: "51be0c43cc481b13fe70d3ba27e2ffd9" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: SFV4Wl1bGgrYBAvh1g48Ac217jtyPkYJ Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 3f95374273631adbfd8e0d0a9f6d7b64.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: l1UPD8ebtjWRZgXhyJdWS1fQG2RHn_zEexEuAD5Dv02BmUbfJAh5nw== Age: 8927 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
514	192.168.2.5	50325	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:07 UTC	676	OUT	GET /psb/capla/static/css/53a8d0d3.b1818b84.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "f820477c322829e348f318a453e432a5" If-Modified-Since: Thu, 08 Feb 2024 11:37:52 GMT
2024-02-08 18:36:07 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:36:07 GMT ETag: "f820477c322829e348f318a453e432a5" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: BiPU5vSMYzP0dcXjFNJqaYKjd8Wn7Ys7 Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6f067a3fd6e721a7db2a2901701a65d8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 0LNhVOsOAldG-XdQHIbZBkJjCyKCel6mqTeYXGvavju59ue4P6l4hA== Age: 24732 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
515	192.168.2.5	50328	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:07 UTC	690	OUT	GET /psb/capla/static/js/4a89d2db.6c0ec4b3.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "71d148d7e362a60e9a0c56222e4c1c42" If-Modified-Since: Wed, 07 Feb 2024 05:15:19 GMT
2024-02-08 18:36:07 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:36:07 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 9di50fL8JQhTrzdM_SzIninZxtneOruI Server: AmazonS3 ETag: "71d148d7e362a60e9a0c56222e4c1c42" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 b0c7b942a33f0f4451718aee53f7840c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: fWeuEe_Bu4Tf64hWvrLJrmS-cPI_NxAkRe1SymvRvX-sq3ynrojG4g== Age: 37451 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
516	192.168.2.5	50326	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:07 UTC	640	OUT	GET /psb/capla/static/js/0a098284.df965884.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "47bb1a597dd42cabf5425fe918f725b5"
2024-02-08 18:36:07 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:36:07 GMT ETag: "47bb1a597dd42cabf5425fe918f725b5" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 66kT4AfYW6XFbY2uR01i.yN9iev4sCir Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 14e4300e15854895259e6944bb121ec8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 9ulq9V1FC8l37azdzd76Kq1m3VNEqE5P4kNV9WyDuL0eCuJNonUvsg== Age: 10049 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
517	192.168.2.5	50329	104.18.32.137	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:07 UTC	380	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:07 UTC	249	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:36:07 GMT Content-Type: text/javascript Content-Length: 79 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8525f9f42bd24560-ATL
2024-02-08 18:36:07 UTC	79	IN	Data Raw: 6a 73 6f 6e 46 65 65 64 28 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 47 41 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 47 65 6f 72 67 69 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d 29 3b Data Ascii: jsonFeed({"country":"US","state":"GA","stateName":"Georgia","continent":"NA"});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
518	192.168.2.5	50327	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:07 UTC	690	OUT	GET /psb/capla/static/js/7bcb015e.cf9d45ea.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "762dbdde80c9b4faddafa20df78215de" If-Modified-Since: Thu, 08 Feb 2024 14:53:52 GMT
2024-02-08 18:36:07 UTC	566	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:36:07 GMT ETag: "762dbdde80c9b4faddafa20df78215de" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: zc90J05kqhlmzNDNZXeMr8lu3QU56RZ9 Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 e6c353101750d150139bda8d95719802.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: eZ36TZMX-spY0dduvqq2tKmjyUBc7ZPXfpsfE7krPaI9v-AMWhJQtQ== Age: 8919 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
519	192.168.2.5	50331	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:07 UTC	716	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 955 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:07 UTC	955	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 65 32 63 65 64 30 36 34 2d 33 31 34 64 2d 34 63 62 63 2d 61 61 37 61 2d 35 62 31 66 38 64 36 61 61 34 39 34 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 35 64 39 62 66 31 31 39 2d 37 63 33 61 2d 34 30 38 34 2d 38 39 39 31 2d 39 64 35 38 36 39 30 30 32 34 33 35 22 2c 22 73 73 22 3a 22 32 32 34 65 39 64 61 32 2d 33 65 62 65 2d 34 64 65 30 2d 39 34 62 61 2d 30 64 35 64 32 32 63 39 35 62 37 66 22 2c 22 64 66 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"e2ced064-314d-4cbc-aa7a-5b1f8d6aa494","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"5d9bf119-7c3a-4084-8991-9d5869002435","ss":"224e9da2-3ebe-4de0-94ba-0d5d22c95b7f","df":true,"s
2024-02-08 18:36:07 UTC	482	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:07 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: clear access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
520	192.168.2.5	50330	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:07 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive Content-Length: 3023 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:07 UTC	3023	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 63 6c 69 43 4e 48 4d 4e 41 41 41 41 3a 6e 2f 63 76 35 56 5a 39 71 56 4e 4d 53 76 46 4c 30 62 4f 51 54 4b 75 49 32 4f 50 76 54 45 65 46 65 79 68 54 4c 37 57 6a 77 47 4d 30 4f 47 2f 6e 34 77 32 62 61 54 79 6b 42 42 68 2f 59 5a 49 48 30 61 66 50 53 4c 54 4e 78 6e 54 66 78 2b 2f 47 30 61 69 57 64 65 56 48 5a 67 2f 47 67 35 79 71 4f 63 39 33 4d 45 72 64 39 33 79 6a 65 49 73 57 51 59 74 6e 44 67 55 76 34 67 4b 34 64 30 73 68 68 5a 70 78 61 42 50 61 2b 2f 35 31 48 30 2b 73 4a 4c 66 79 36 72 2f 61 75 51 6e 69 51 6b 51 61 4e 57 62 6f 77 72 72 34 61 69 75 5a 31 48 78 6e 35 59 4a 31 4f 4d Data Ascii: {"existing_token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAcliCNHMNAAAA:n/cv5VZ9qVNMSvFL0bOQTKuI2OPvTEeFeyhTL7WjwGM0OG/n4w2baTykBBh/YZIH0afPSLTNxnTfx+/G0aiWdeVHZg/Gg5yqOc93MErd93yjeIsWQYtnDgUv4gK4d0shhZpxaBPa+/51H0+sJLfy6r/auQniQkQaNWbowrr4aiuZ1Hxn5YJ1OM
2024-02-08 18:36:07 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1653 Connection: close Vary: Accept-Encoding Date: Thu, 08 Feb 2024 18:36:07 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65c51f17-39acb60b18dbce0d013e8894 X-Cache: Miss from cloudfront Via: 1.1 4a050b98a443ca2d3af477f9b4dc39ae.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: ZjD4tOv0jhS5tVfz0XbX3kdLlvtT206jCp2x67ERnlbJoZI8zN4VXg==
2024-02-08 18:36:07 UTC	1653	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 67 33 43 42 33 67 6b 58 41 41 41 41 3a 4d 6a 4b 4f 31 68 72 32 76 47 61 63 74 39 59 65 4a 45 35 57 56 31 53 41 46 5a 53 64 6d 79 58 45 4d 6d 5a 47 54 42 75 4d 50 6f 79 32 68 43 69 48 62 6c 46 45 31 6f 4a 77 71 68 37 34 77 32 77 59 6b 50 51 70 59 6d 5a 6d 35 54 61 4c 67 73 63 79 7a 66 41 65 66 30 62 47 43 56 45 38 34 42 71 44 50 77 79 55 36 75 64 6c 4d 73 38 47 43 47 33 50 7a 73 77 51 39 76 4c 64 4d 4a 33 65 42 4e 78 50 69 65 62 78 73 6d 56 61 65 34 45 46 30 54 2f 6d 38 67 4c 61 34 4a 4e 44 30 53 78 37 77 36 36 33 50 62 7a 38 65 2b 38 70 6a 6f 4d 7a 31 46 61 47 65 55 37 34 30 76 33 48 47 6d 5a 46 61 63 62 Data Ascii: {"token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAg3CB3gkXAAAA:MjKO1hr2vGact9YeJE5WV1SAFZSdmyXEMmZGTBuMPoy2hCiHblFE1oJwqh74w2wYkPQpYmZm5TaLgscyzfAef0bGCVE84BqDPwyU6udlMs8GCG3PzswQ9vLdMJ3eBNxPiebxsmVae4EF0T/m8gLa4JND0Sx7w663Pbz8e+8pjoMz1FaGeU740v3HGmZFacb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
521	192.168.2.5	50333	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:07 UTC	690	OUT	GET /psb/capla/static/js/eb60141d.05ae682b.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "8bd695624a0284c0c75e95e6cf849e19" If-Modified-Since: Mon, 05 Feb 2024 10:15:49 GMT
2024-02-08 18:36:08 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:36:07 GMT ETag: "8bd695624a0284c0c75e95e6cf849e19" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: GxdC2HoWy3SKzPu2JnW5Pb.Aec0Emv2p Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 e268ddb03ed9480c5c602c27323a81ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: yrGYE2GZ_tF3ccOxtf_L-2YbTcajNB4T3bU9_4NYVlq4YSW54zYfVg== Age: 74671 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
522	192.168.2.5	50332	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:07 UTC	690	OUT	GET /psb/capla/static/js/f50a2dfc.854e46ce.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "16cef59d8ed8d631e974161b3405d558" If-Modified-Since: Thu, 08 Feb 2024 10:31:47 GMT
2024-02-08 18:36:08 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:36:08 GMT ETag: "16cef59d8ed8d631e974161b3405d558" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: cG2AdJvzFJaivaHGwS_vd7j4ON5X64Sy Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 9546eb427ef2137803aed00cad4fc426.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: OjB-hCiKlLfUSlgdnT6TuE_ohhzVufo3wntxJhAbZSOFjjUXji8K4A== Age: 25507 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
523	192.168.2.5	50334	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:07 UTC	690	OUT	GET /psb/capla/static/js/a6a21c13.ad9f14d9.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "16323cfbc6f714b70bb4777cc3449e90" If-Modified-Since: Thu, 08 Feb 2024 11:37:54 GMT
2024-02-08 18:36:08 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:36:08 GMT ETag: "16323cfbc6f714b70bb4777cc3449e90" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: kqN2G1a.LgAUJYnNTKfAE6M57bfozxMp Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 b0c7b942a33f0f4451718aee53f7840c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: VDc6d5O3Le-_YAj0I2rHqBOIrElEu_7c_9IrJroczU2V9VxS8j7FlQ== Age: 19172 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
524	192.168.2.5	50301	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:08 UTC	3307	OUT	GET /logo?ver=1&sid=5171fc655664ddf74ab763a094523fb7&t=17074173641 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAcliCNHMNAAAA:n/cv5VZ9qVNMSvFL0bOQTKuI2OPvTEeFeyhTL7WjwGM0OG/n4w2baTykBBh/YZIH0afPSLTNxnTfx+/G0aiWdeVHZg/Gg5yqOc93MErd93yjeIsWQYtnDgUv4gK4d0shhZpxaBPa+/51H0+sJLfy6r/auQniQkQaNWbowrr4aiuZ1Hxn5YJ1OMhEssxQqS8lSl7lQ+l4Gvg/GzC+glgVIJ7q+Vvd2qNXBU8be/eAJXt3v+IBgPPT7+3k6BIj3HSxrID9I1jb; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBII%2FyfgaNcGcNRD%2FSIhmJOq2eq3%2BSsDkjCXhcZUnZ5lZoVH38ibtzR5rmv36AACzoYnyI6DkiXbs1zid0LilInunTzAXjjR4F9cb5ipLEysf66ICkaefY9O8pJ2ZjctKUTfhYUZ2omr4cRil0AUmIKbwrbYnWNYwUU%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A05+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=0
2024-02-08 18:36:08 UTC	780	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:08 GMT vary: User-Agent, Accept-Encoding set-cookie: BJS=-; domain=booking.com; expires=Fri, 09-Feb-2024 18:36:08 GMT; Secure; HTTPOnly strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=118c82cc40f70101&e=UmFuZG9tSVYkc2RlIyh9YbpBYTW1tHKzqViNIK6aBHSsaNIVXgBx-NKoNxk_dM8e x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 c625b1bdde545acdeb26c9f6ad3a8c6e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: _1ys6N4DQaSnrpK5C-BCzGGEq6t2dosjHaFFy6g5AOhIMtkGQsB2IA==
2024-02-08 18:36:08 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
525	192.168.2.5	50335	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:08 UTC	690	OUT	GET /psb/capla/static/js/f5d0e2e7.5cd38fd6.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "2a4be84facf3e21bb4a9ebb12a10a92e" If-Modified-Since: Wed, 07 Feb 2024 09:32:56 GMT
2024-02-08 18:36:09 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:36:08 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 6HKmc0VuwQiz3hwVRPEGNwP114NmNjqR Server: AmazonS3 ETag: "2a4be84facf3e21bb4a9ebb12a10a92e" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 6e0f9dce97fcb3c9b684592a289e4e72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: mCE6nJJuNLTYgMl_2lNM4Nh3s5ONyWTf5Upe9m06GKZpuGaLJlrnWQ== Age: 24758 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
526	192.168.2.5	50336	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:08 UTC	690	OUT	GET /psb/capla/static/js/d2a738da.35cba7bb.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "1aa264da71f354aad6dce94f5a3374d9" If-Modified-Since: Tue, 06 Feb 2024 10:33:56 GMT
2024-02-08 18:36:09 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:36:08 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: psEU8QZUmatvf68kU4tSuAW8A3BMuh.z Server: AmazonS3 ETag: "1aa264da71f354aad6dce94f5a3374d9" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 f588325f7617672d954c4267c8bee1ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: rYesh28-DKayWg_31xdNXo2Smtna31671wAH_wnovESScVMGfzWIrA== Age: 21794 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
527	192.168.2.5	50337	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:08 UTC	690	OUT	GET /psb/capla/static/js/4e596c2c.d3513b52.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "cbed6c40f80b88278fe92b7987f24d10" If-Modified-Since: Thu, 08 Feb 2024 14:16:47 GMT
2024-02-08 18:36:09 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:36:08 GMT ETag: "cbed6c40f80b88278fe92b7987f24d10" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: N9Nsx4DgMqmKhaYxp1E50bp1h3vfmgas Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 7eeed291abf48890d3f36565208941a8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 2Pz19P_4xyncspHksJgxAvO-BziguMyZGRA0W30gHGEz5GhSwwJAIw== Age: 13742 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
528	192.168.2.5	50338	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:09 UTC	690	OUT	GET /psb/capla/static/js/21928fd5.cc39b346.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "32f6cb6519036a5cb6d7245e1f3f4a10" If-Modified-Since: Mon, 05 Feb 2024 10:15:48 GMT
2024-02-08 18:36:09 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:36:09 GMT ETag: "32f6cb6519036a5cb6d7245e1f3f4a10" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 7a98ctKrCWxMZvJTJoQpOhig1fq1QPGC Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 9546eb427ef2137803aed00cad4fc426.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: P3TCu83a6rhwVdPQKGKPFhe9Q4TwzwlY9qUVU_AbNRGw9uGnvxcYug== Age: 85742 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
529	192.168.2.5	50340	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:09 UTC	4612	OUT	GET /js_tracking?sid=5171fc655664ddf74ab763a094523fb7&aid=304142&ref_action=index&ver=2&pid=87e482caf42702d0&lang=en-us&stype=1&ete=&etg=&etcg=&ets=cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YUe5zZbLHt0YNre0CiGBBmP5hKTY_IzZqpWBtitYrnE-ba2NOPqZSPGdnbkQM2vO343hpsChBnayfrRG7jVW0hI1Ke4kKZ85U_m7O1xbR8NLSlv2Zn-4d5ku6anu7qAZgjoLQxWZjIis3cNA3ef3I_aOxDvMotUV5ZQc6OhcEEody8ooGsshLIhRMDad6kRNg_HeFvW36Wr8mOnNh6fMuy8OZ9w095BIb2XL0zt8fY-5SPQHxgI7NWrdI31vzPG5nOwkA1lE2mJxFh3z4YXPwcZPq5z6drlkg3iN9tdtKjt0cXf7rJdLIbIGLmOniyEf0g HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3 X-Booking-CSRF: VFfFZQAAAAA=I0VyxrbmcRsXF8b8667mJSw00zD1jijstj9zA-B31AE-SHf9fwLae-NRdcEvORIZUidJgBp9cG2_VeJ_vvAjE9POdq-3lpUXJKUz5osKhhR_6IWR4vCHyNCN9_lrexSyhyl857y4-aUKLEPdAzHdPtU-69GNk1-tINwO8UxKp7l2RhgisIpi5FvtqY4OOakuCSFjRchHm9pnK7Y6 sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: 87e482caf42702d0 X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,1856870\|1,1912460\|7,1912460\|1,1908890\|1,1912460\|6 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _ga=GA1.1.421694156.1707417338; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAcliCNHMNAAAA:n/cv5VZ9qVNMSvFL0bOQTKuI2OPvTEeFeyhTL7WjwGM0OG/n4w2baTykBBh/YZIH0afPSLTNxnTfx+/G0aiWdeVHZg/Gg5yqOc93MErd93yjeIsWQYtnDgUv4gK4d0shhZpxaBPa+/51H0+sJLfy6r/auQniQkQaNWbowrr4aiuZ1Hxn5YJ1OMhEssxQqS8lSl7lQ+l4Gvg/GzC+glgVIJ7q+Vvd2qNXBU8be/eAJXt3v+IBgPPT7+3k6BIj3HSxrID9I1jb; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBII%2FyfgaNcGcNRD%2FSIhmJOq2eq3%2BSsDkjCXhcZUnZ5lZoVH38ibtzR5rmv36AACzoYnyI6DkiXbs1zid0LilInunTzAXjjR4F9cb5ipLEysf66ICkaefY9O8pJ2ZjctKUTfhYUZ2omr4cRil0AUmIKbwrbYnWNYwUU%3D; lastSeen=0; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false
2024-02-08 18:36:09 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:09 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=5f4c82ccb4fb0079&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejJ812CGYRbKA-CSU4aSRALsF0RfcJ9qtqU x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 4a9f56098c7d51e12b8d2ac77b6f1bcc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 5mn1coV0aBXqNqlQ7h8OLuuVsEXWZk47yf_uyK3LGlq3c7YM2W6k1A==
2024-02-08 18:36:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
530	192.168.2.5	50339	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:09 UTC	4476	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 2136 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6 X-Booking-AID: 304142 X-Booking-Pageview-Id: 87e482caf42702d0 X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,1856870\|1,1912460\|7,1912460\|1,1908890\|1,1912460\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7 sec-ch-ua-platform: "Windows" X-Booking-Language-Code: en-us X-Booking-CSRF: VFfFZQAAAAA=I0VyxrbmcRsXF8b8667mJSw00zD1jijstj9zA-B31AE-SHf9fwLae-NRdcEvORIZUidJgBp9cG2_VeJ_vvAjE9POdq-3lpUXJKUz5osKhhR_6IWR4vCHyNCN9_lrexSyhyl857y4-aUKLEPdAzHdPtU-69GNk1-tINwO8UxKp7l2RhgisIpi5FvtqY4OOakuCSFjRchHm9pnK7Y6 sec-ch-ua-mobile: ?0 X-Partner-Channel-Id: 3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Accept: application/json, text/javascript, /; q=0.01 X-Booking-SiteType-Id: 1 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAcliCNHMNAAAA:n/cv5VZ9qVNMSvFL0bOQTKuI2OPvTEeFeyhTL7WjwGM0OG/n4w2baTykBBh/YZIH0afPSLTNxnTfx+/G0aiWdeVHZg/Gg5yqOc93MErd93yjeIsWQYtnDgUv4gK4d0shhZpxaBPa+/51H0+sJLfy6r/auQniQkQaNWbowrr4aiuZ1Hxn5YJ1OMhEssxQqS8lSl7lQ+l4Gvg/GzC+glgVIJ7q+Vvd2qNXBU8be/eAJXt3v+IBgPPT7+3k6BIj3HSxrID9I1jb; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBII%2FyfgaNcGcNRD%2FSIhmJOq2eq3%2BSsDkjCXhcZUnZ5lZoVH38ibtzR5rmv36AACzoYnyI6DkiXbs1zid0LilInunTzAXjjR4F9cb5ipLEysf66ICkaefY9O8pJ2ZjctKUTfhYUZ2omr4cRil0AUmIKbwrbYnWNYwUU%3D; lastSeen=0; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.421694156.1707417338
2024-02-08 18:36:09 UTC	2136	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 63 33 36 30 5f 74 65 73 74 2e 69 6e 64 65 78 5f 70 61 67 65 5f 6a 73 5f 68 65 61 6c 74 68 63 68 65 63 6b 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 31 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 47 6c 6f 72 79 20 74 6f 20 43 33 36 30 20 66 72 6f 6d 20 6a 73 21 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 69 6e 64 65 78 2e 68 74 6d 6c 3f 61 69 64 3d 33 30 34 31 34 32 26 6c 61 62 65 6c 3d 67 65 6e 31 37 33 6e 72 2d 31 46 43 41 45 6f 67 67 Data Ascii: {"events":[{"action_name":"c360_test.index_page_js_healthcheck","action_version":"1.1.0","content":{"message":"Glory to C360 from js!"},"context":{"page":{"page_referrer":"","page_url":"https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEogg
2024-02-08 18:36:09 UTC	1187	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 91 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:09 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEcx%2FNBSM7hcmxfYRvnB2G9PFWrc9JWtc80%2BB7O9mau%2Fq%2F%2BQmqj8vmO7zmkRYgjc%2BJMYUHnygfC%2FFBh8jDDTeAvsn%2BiKEgv%2FBXfiRGJQAB8jx9PUIZybt6czbgdtg4epkv4DQISO29Dru4mhOYkQiObM%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:09 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=8a4082ccdd130043&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqst3S_FwWxtf8Q27oI1QxotydXBg6BJRmjM x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 309e9e958e8d35f7e17ae8ac267b7dea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: wdYI92eMRn55iaPmf3z0jqQUn8Hs9-ExEEd9UttwQYEzzgc5iJs1bA==
2024-02-08 18:36:09 UTC	91	IN	Data Raw: 5b 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d 2c 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d 2c 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d 5d Data Ascii: [{"status":1,"content":"Sent"},{"content":"Sent","status":1},{"content":"Sent","status":1}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
531	192.168.2.5	50342	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:10 UTC	690	OUT	GET /psb/capla/static/js/3d066b0d.6a5d1f73.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "b9431959d1fba61458d500bc4cba3939" If-Modified-Since: Tue, 06 Feb 2024 05:16:14 GMT
2024-02-08 18:36:10 UTC	567	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:36:10 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: dEnmDEtw.I4qhNxITUcP6I6qsZhacRX8 Server: AmazonS3 ETag: "b9431959d1fba61458d500bc4cba3939" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 fcb94596db202c75ac0e559b3183be72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: CMs8Q8e3UQpXocOgbU0Vf8IsGVT4hGcHNROdcJWcezggoyyLO16RSA== Age: 25508 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
532	192.168.2.5	50343	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:10 UTC	4954	OUT	GET /js_tracking?sid=5171fc655664ddf74ab763a094523fb7&aid=304142&ref_action=index&ver=2&pid=87e482caf42702d0&lang=en-us&stype=1&ete=&etg=&etcg=cCHObKdPHMfFdHMEKdbfZRLRMLFSZaTaTaET\|1&ets=cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YUe5zZbLHt0YNre0CiGBBmP5hKTY_IzZqpWBtitYrnE-ba2NOPqZSPGdnbkQM2vO343hpsChBnayfrRG7jVW0hI1Ke4kKZ85U_m7O1xbR8NLSlv2Zn-4d5ku6anu7qAZgjoLQxWZjIis3cNA3ef3I_aOxDvMotUV5ZQc6OhcEEody8ooGsshLIhRMDad6kRNg_HeFvW36Wr8mOnNh6fMuy8OZ9w095BIb2XL0zt8fY-5SPQHxgI7NWrdI31vzPG5nOwkA1lE2mJxFh3z4YXPwcZPq5z6drlkg3iN9tdtKjt0cXf7rJdLIbIGLmOniyEf0g HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6 X-Booking-CSRF: VFfFZQAAAAA=I0VyxrbmcRsXF8b8667mJSw00zD1jijstj9zA-B31AE-SHf9fwLae-NRdcEvORIZUidJgBp9cG2_VeJ_vvAjE9POdq-3lpUXJKUz5osKhhR_6IWR4vCHyNCN9_lrexSyhyl857y4-aUKLEPdAzHdPtU-69GNk1-tINwO8UxKp7l2RhgisIpi5FvtqY4OOakuCSFjRchHm9pnK7Y6 sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: 87e482caf42702d0 X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,1856870\|1,1912460\|7,1912460\|1,1908890\|1,1912460\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAcliCNHMNAAAA:n/cv5VZ9qVNMSvFL0bOQTKuI2OPvTEeFeyhTL7WjwGM0OG/n4w2baTykBBh/YZIH0afPSLTNxnTfx+/G0aiWdeVHZg/Gg5yqOc93MErd93yjeIsWQYtnDgUv4gK4d0shhZpxaBPa+/51H0+sJLfy6r/auQniQkQaNWbowrr4aiuZ1Hxn5YJ1OMhEssxQqS8lSl7lQ+l4Gvg/GzC+glgVIJ7q+Vvd2qNXBU8be/eAJXt3v+IBgPPT7+3k6BIj3HSxrID9I1jb; lastSeen=0; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.421694156.1707417338; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEcx%2FNBSM7hcmxfYRvnB2G9PFWrc9JWtc80%2BB7O9mau%2Fq%2F%2BQmqj8vmO7zmkRYgjc%2BJMYUHnygfC%2FFBh8jDDTeAvsn%2BiKEgv%2FBXfiRGJQAB8jx9PUIZybt6czbgdtg4epkv4DQISO29Dru4mhOYkQiObM%3D
2024-02-08 18:36:10 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:10 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=800b82cdbe5602ae&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejJ7ntSHZxSOecWllVUUO-Lp607X6as4iNA x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 f4c38e024a95b76a27c9f3dc9ff2eda6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: _hDoRenPDv2CbBk6erseIEr3TKbpJN4MPkST9RG2QHaFYj3ZfVnkOA==
2024-02-08 18:36:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
533	192.168.2.5	50344	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:10 UTC	660	OUT	GET /psb/capla/static/js/4a89d2db.6c0ec4b3.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-None-Match: "71d148d7e362a60e9a0c56222e4c1c42" If-Modified-Since: Wed, 07 Feb 2024 05:15:19 GMT
2024-02-08 18:36:10 UTC	515	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:36:10 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 9di50fL8JQhTrzdM_SzIninZxtneOruI Server: AmazonS3 ETag: "71d148d7e362a60e9a0c56222e4c1c42" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 76f3fedc86826a7b266250e33ee41082.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: JD47EoQHZuG-H5bcAo2Nc836teMblEJWqMNCpeTY_n3QvLP2HYV-xg== Age: 37454 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
534	192.168.2.5	50345	3.162.125.32	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:11 UTC	613	OUT	OPTIONS /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=BXAbRIVE HTTP/1.1 Host: accommodations.booking.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-booking-et-serialized-state Origin: https://www.booking.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:11 UTC	684	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:11 GMT x-frame-options: SAMEORIGIN x-content-type-options: nosniff access-control-allow-headers: x-booking-et-serialized-state vary: Origin access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true access-control-allow-methods: HEAD,OPTIONS,GET,POST strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 18591001335591ffb831001ad8b75762.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P3 X-Amz-Cf-Id: -sA_Pk1rUtxWfWp-T7PPDI6BADmPeHYH9puWunHMp-wa3RPivHYgZQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
535	192.168.2.5	50346	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:11 UTC	1015	OUT	GET /recaptcha/api.js?render=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&onload=onLoadRecaptchaV3Callback&_=1707417367075 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AJmcDEl4lP7G1sUzlkfo-ph5oEYDaZrMsr87jx805YMBfBXipJ4MvomJQXIF7z5TPrZE7LxvSiQSdmfSY1DEipM; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:11 UTC	528	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Thu, 08 Feb 2024 18:36:11 GMT Date: Thu, 08 Feb 2024 18:36:11 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:36:11 UTC	724	IN	Data Raw: 35 32 63 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 52c/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2024-02-08 18:36:11 UTC	607	IN	Data Raw: 69 4f 69 4a 6f 64 48 52 77 63 7a 6f 76 4c 32 64 76 62 32 64 73 5a 53 35 6a 62 32 30 36 4e 44 51 7a 49 69 77 69 5a 6d 56 68 64 48 56 79 5a 53 49 36 49 6b 52 70 63 32 46 69 62 47 56 55 61 47 6c 79 5a 46 42 68 63 6e 52 35 55 33 52 76 63 6d 46 6e 5a 56 42 68 63 6e 52 70 64 47 6c 76 62 6d 6c 75 5a 79 49 73 49 6d 56 34 63 47 6c 79 65 53 49 36 4d 54 63 79 4e 54 51 77 4e 7a 6b 35 4f 53 77 69 61 58 4e 54 64 57 4a 6b 62 32 31 68 61 57 34 69 4f 6e 52 79 64 57 55 73 49 6d 6c 7a 56 47 68 70 63 6d 52 51 59 58 4a 30 65 53 49 36 64 48 4a 31 5a 58 30 3d 27 3b 64 2e 68 65 61 64 2e 70 72 65 70 65 6e 64 28 6d 29 3b 70 6f 2e 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 78 35 57 Data Ascii: iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/x5W
2024-02-08 18:36:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
536	192.168.2.5	50348	3.161.193.117	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:11 UTC	650	OUT	POST /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive Content-Length: 85 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-API-Version: 1 Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:11 UTC	85	OUT	Data Raw: 7b 22 70 69 64 22 3a 22 38 37 65 34 38 32 63 61 66 34 32 37 30 32 64 30 22 2c 22 72 65 66 41 63 74 69 6f 6e 22 3a 22 69 6e 64 65 78 22 2c 22 73 69 74 65 54 79 70 65 22 3a 22 31 22 2c 22 63 6c 73 22 3a 31 2e 37 32 32 37 37 38 35 30 34 32 34 34 32 36 38 7d Data Ascii: {"pid":"87e482caf42702d0","refAction":"index","siteType":"1","cls":1.722778504244268}
2024-02-08 18:36:11 UTC	525	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:11 GMT vary: Origin, Accept-Encoding access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7f23e4136f9a90da4108d0b761f3120e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P8 X-Amz-Cf-Id: UovRcuLeykzO3MNpLVcn6vnAsxHEWwzZ-nfFLxJuhEqyfCVC2sUiFA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
537	192.168.2.5	50347	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:11 UTC	4836	OUT	GET /js_tracking?sid=5171fc655664ddf74ab763a094523fb7&aid=304142&ref_action=index&ver=2&pid=87e482caf42702d0&lang=en-us&stype=1&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|1&m=UmFuZG9tSVYkc2RlIyh9YUe5zZbLHt0YNre0CiGBBmP5hKTY_IzZqpWBtitYrnE-ba2NOPqZSPGdnbkQM2vO343hpsChBnayfrRG7jVW0hI1Ke4kKZ85U_m7O1xbR8NLSlv2Zn-4d5ku6anu7qAZgjoLQxWZjIis3cNA3ef3I_aOxDvMotUV5ZQc6OhcEEody8ooGsshLIhRMDad6kRNg_HeFvW36Wr8mOnNh6fMuy8OZ9w095BIb2XL0zt8fY-5SPQHxgI7NWrdI31vzPG5nOwkA1lE2mJxFh3z4YXPwcZPq5z6drlkg3iN9tdtKjt0cXf7rJdLIbIGLmOniyEf0g HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6 X-Booking-CSRF: VFfFZQAAAAA=I0VyxrbmcRsXF8b8667mJSw00zD1jijstj9zA-B31AE-SHf9fwLae-NRdcEvORIZUidJgBp9cG2_VeJ_vvAjE9POdq-3lpUXJKUz5osKhhR_6IWR4vCHyNCN9_lrexSyhyl857y4-aUKLEPdAzHdPtU-69GNk1-tINwO8UxKp7l2RhgisIpi5FvtqY4OOakuCSFjRchHm9pnK7Y6 sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: 87e482caf42702d0 X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,1856870\|1,1912460\|7,1912460\|1,1908890\|1,1912460\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAcliCNHMNAAAA:n/cv5VZ9qVNMSvFL0bOQTKuI2OPvTEeFeyhTL7WjwGM0OG/n4w2baTykBBh/YZIH0afPSLTNxnTfx+/G0aiWdeVHZg/Gg5yqOc93MErd93yjeIsWQYtnDgUv4gK4d0shhZpxaBPa+/51H0+sJLfy6r/auQniQkQaNWbowrr4aiuZ1Hxn5YJ1OMhEssxQqS8lSl7lQ+l4Gvg/GzC+glgVIJ7q+Vvd2qNXBU8be/eAJXt3v+IBgPPT7+3k6BIj3HSxrID9I1jb; lastSeen=0; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.421694156.1707417338; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEcx%2FNBSM7hcmxfYRvnB2G9PFWrc9JWtc80%2BB7O9mau%2Fq%2F%2BQmqj8vmO7zmkRYgjc%2BJMYUHnygfC%2FFBh8jDDTeAvsn%2BiKEgv%2FBXfiRGJQAB8jx9PUIZybt6czbgdtg4epkv4DQISO29Dru4mhOYkQiObM%3D
2024-02-08 18:36:11 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:11 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=5fe482cdbf1e002f&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejJclTzrnZPa9nV-SOTwAJSg3fVkVZgY1lQ x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 09aa283795aaafe63cbd7c2cbac2c306.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: oV6BLyJmIDDF7O0SrTUF-y46UGLa96AKmcjw9Q-h_S53MBxfOoZaQg==
2024-02-08 18:36:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
538	192.168.2.5	50349	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:11 UTC	4766	OUT	GET /pr_ue?action=index&dest_ufi=-1&user_location=us&ttv_uc=undefined&date_in=-1&date_out=-1&rooms=-1&nights=-1&hr=-1&rid=undefined&p1=undefined&adults=-1&children=-1&city_name=-1&country_name=-1&dest_name=-1&region_name=-1&dest_cc=-1&dest_id=-1&dest_type=-1&lang=en-us&ai=304142&preferred_neighborhoods=undefined&preferred_star_ratings=undefined&seed=Pqit_vbiva0hUfw7CE5adQ&site=bookings2&sid=5171fc655664ddf74ab763a094523fb7&channel_id=3&exp_andy=undefined&stid=304142&exp_rmkt_test=global_on&famem=-1&famfn=-1&fampn=-1&logged_in=0&genis=&gwcur=-1&gwcuc=-1&bem=0&bip=0&book_window=&travel_type=unknown&currency=USD&em_sent=undefined&fn_sent=undefined&pn_sent=undefined&cv=-1&sage=33&atnm=&atnm_en=&pt_en=&cul=-1&mnns=-1&zz_val_eur=EUR&zz_look_action2id=undefined&zz_generic_id=undefined&zz_generic_id2=undefined&cip=81.181.57.74&cua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F117.0.0.0%20Safari%2F537.36&tms=gtm&sid_dyna=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000&rmk_var=-1&euuid=b3b664b2-c332-4da1-a30e-c26f69545b7c&gcem=-1&gcpn=-1&pguai=undefined&ttv=undefined&iamlt=&fbc=undefined&fbp=-1&msclid=undefined&pcid=3&bizp=&istnb=0&genisb=0&as=0&genaspb=1&p=https%3A%2F%2Fwww.booking.com%2Findex.html&r=&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&rbda=-1&tcl=undefined&cto_pld=undefined&cgumid=undefined&gtmcb=1882612592 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAcliCNHMNAAAA:n/cv5VZ9qVNMSvFL0bOQTKuI2OPvTEeFeyhTL7WjwGM0OG/n4w2baTykBBh/YZIH0afPSLTNxnTfx+/G0aiWdeVHZg/Gg5yqOc93MErd93yjeIsWQYtnDgUv4gK4d0shhZpxaBPa+/51H0+sJLfy6r/auQniQkQaNWbowrr4aiuZ1Hxn5YJ1OMhEssxQqS8lSl7lQ+l4Gvg/GzC+glgVIJ7q+Vvd2qNXBU8be/eAJXt3v+IBgPPT7+3k6BIj3HSxrID9I1jb; lastSeen=0; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.421694156.1707417338; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEcx%2FNBSM7hcmxfYRvnB2G9PFWrc9JWtc80%2BB7O9mau%2Fq%2F%2BQmqj8vmO7zmkRYgjc%2BJMYUHnygfC%2FFBh8jDDTeAvsn%2BiKEgv%2FBXfiRGJQAB8jx9PUIZybt6czbgdtg4epkv4DQISO29Dru4mhOYkQiObM%3D
2024-02-08 18:36:11 UTC	651	IN	HTTP/1.1 202 Accepted Content-Length: 0 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:11 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=397382cdeb4c00ff&e=UmFuZG9tSVYkc2RlIyh9YdbeSVtWvtI5AKtW4AZZtgfcdLtDUGcHjkB-nTV4-aJSAxqOFOUGOmIITZ_jnJVQtg x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 309e9e958e8d35f7e17ae8ac267b7dea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: jNJzU0C4q72lNr848YIrUFi6IN2cyUyc8TNVvGuDOyO8_Sv64uDveA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
539	192.168.2.5	50350	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:11 UTC	636	OUT	GET /d8c14d4960ca/a18a4859af9c/challenge.js HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-Modified-Since: Thu, 8 Feb 2024 18:35:46 +0000
2024-02-08 18:36:11 UTC	519	IN	HTTP/1.1 304 Not Modified Content-Type: text/javascript Connection: close Vary: Accept-Encoding Date: Thu, 08 Feb 2024 18:36:11 GMT cache-control: private, max-age=86400 last-modified: Thu, 8 Feb 2024 18:35:46 +0000 pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65c51f1b-327e0fa85d188c8906723c74 X-Cache: Miss from cloudfront Via: 1.1 6f3546b6b501aaa8c1b4750231158188.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: FvEmiZAqRCnNv0ZzriMUglnLnxDWHY-ZBOn7X5yLpH11lhnLqr5-kQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
540	192.168.2.5	50351	172.217.215.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:11 UTC	385	OUT	GET /gsi/fedcm.json HTTP/1.1 Host: accounts.google.com Connection: keep-alive Accept: application/json Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: webidentity User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:11 UTC	1088	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Expires: Thu, 08 Feb 2024 18:36:11 GMT Date: Thu, 08 Feb 2024 18:36:11 GMT Cache-Control: private, max-age=3600 Report-To: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]} Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Content-Security-Policy: script-src 'report-sample' 'nonce-SMb0yt9M1C3LsXrE66lDEQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:36:11 UTC	164	IN	Data Raw: 33 66 64 0d 0a 7b 22 69 64 74 6f 6b 65 6e 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 69 73 73 75 65 22 2c 20 22 69 64 5f 74 6f 6b 65 6e 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 69 73 73 75 65 22 2c 20 22 69 64 5f 61 73 73 65 72 74 69 6f 6e 5f 65 6e 64 70 6f 69 6e 74 22 Data Ascii: 3fd{"idtoken_endpoint": "https://accounts.google.com/gsi/fedcm/issue", "id_token_endpoint": "https://accounts.google.com/gsi/fedcm/issue", "id_assertion_endpoint"
2024-02-08 18:36:11 UTC	864	IN	Data Raw: 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 69 73 73 75 65 22 2c 20 22 61 63 63 6f 75 6e 74 73 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 6c 69 73 74 61 63 63 6f 75 6e 74 73 22 2c 20 22 63 6c 69 65 6e 74 5f 6d 65 74 61 64 61 74 61 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2f 63 6c 69 65 6e 74 6d 65 74 61 64 61 74 61 22 2c 20 22 63 6c 69 65 6e 74 5f 69 64 5f 6d 65 74 61 64 61 74 61 5f 65 6e 64 70 6f 69 6e 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 Data Ascii: : "https://accounts.google.com/gsi/fedcm/issue", "accounts_endpoint": "https://accounts.google.com/gsi/fedcm/listaccounts", "client_metadata_endpoint": "https://accounts.google.com/gsi/fedcm/clientmetadata", "client_id_metadata_endpoint": "https://account
2024-02-08 18:36:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
541	192.168.2.5	50353	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:11 UTC	1513	OUT	GET /td/fls/rul/activityi;fledge=1;src=4228414;type=views;cat=views;ord=4729221658983;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=900727044;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:36:11 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:11 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:36:11 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-08 18:36:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
542	192.168.2.5	50355	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:11 UTC	1673	OUT	GET /td/rul/988382855?random=1707417370534&cv=11&fst=1707417370534&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=qxb_CKLbrYADEIeNptcD&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:36:11 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:11 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:36:11 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-08 18:36:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
543	192.168.2.5	50356	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:11 UTC	1038	OUT	POST /pagead/landing?gcs=G1--&gcd=13l3l3l3l5&rnd=1748118732.1707417371&url=https%3A%2F%2Fwww.booking.com%2Findex.html&dma=0&npa=0&gtm=45He4250n815Q664QZv79615461za200&auid=1592208705.1707417344 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:11 UTC	840	IN	HTTP/1.1 302 Found P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:11 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' Location: https://googleads.g.doubleclick.net/pagead/landing?gcs=G1--&gcd=13l3l3l3l5&rnd=1748118732.1707417371&url=https%3A%2F%2Fwww.booking.com%2Findex.html&dma=0&npa=0&gtm=45He4250n815Q664QZv79615461za200&auid=1592208705.1707417344 X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:11 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
544	192.168.2.5	50358	172.253.124.149	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:11 UTC	1389	OUT	GET /activity;src=4228414;type=views;cat=views;ord=4729221658983;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=900727044;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:36:11 UTC	1331	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:11 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Follow-Only-When-Prerender-Shown: 1 Location: https://ad.doubleclick.net/activity;dc_pre=CMCFs6-xnIQDFbjbuAgdwz4C4g;src=4228414;type=views;cat=views;ord=4729221658983;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=900727044;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
545	192.168.2.5	50359	172.253.124.149	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:11 UTC	1489	OUT	GET /activity;register_conversion=1;src=4228414;type=views;cat=views;ord=4729221658983;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=900727044;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Attribution-Reporting-Eligible: event-source, trigger, not-navigation-source Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:36:11 UTC	2216	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:11 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"2060402006341822591"}],"aggregatable_trigger_data":[{"filters":{"14":["11794238"]},"key_piece":"0x5bdccd6bd67d4e1c","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xa446ee5f5be5ef06","not_filters":{"14":["11794238"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["11794238"]},"key_piece":"0xd3325b43d3d15f8b","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x22c5b735c1232ea8","not_filters":{"14":["11794238"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"13707852588999790205","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"2060402006341822591","filters":{"14":["11794238"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"2060402006341822591","filters":{"14":["11794238"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"2060402006341822591","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"2060402006341822591","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["4228414"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sat, 09-Mar-2024 18:36:11 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
546	192.168.2.5	50357	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:11 UTC	3929	OUT	GET /js_errors?pid=87e482caf42702d0&url=https%3A%2F%2Fwww.booking.com%2Findex.html&m=UmFuZG9tSVYkc2RlIyh9YUe5zZbLHt0YNre0CiGBBmP5hKTY_IzZqpWBtitYrnE-ba2NOPqZSPGdnbkQM2vO343hpsChBnayfrRG7jVW0hI1Ke4kKZ85U_m7O1xbR8NLSlv2Zn-4d5ku6anu7qAZgjoLQxWZjIis3cNA3ef3I_aOxDvMotUV5ZQc6OhcEEody8ooGsshLIhRMDad6kRNg_HeFvW36Wr8mOnNh6fMuy8OZ9w095BIb2XL0zt8fY-5SPQHxgI7NWrdI31vzPG5nOwkA1lE2mJxFh3z4YXPwcZPq5z6drlkg3iN9tdtKjt0cXf7rJdLIbIGLmOniyEf0g&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2Findex.html&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSObZWJFfVDSMePCFYZWFXO&cors=1 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAcliCNHMNAAAA:n/cv5VZ9qVNMSvFL0bOQTKuI2OPvTEeFeyhTL7WjwGM0OG/n4w2baTykBBh/YZIH0afPSLTNxnTfx+/G0aiWdeVHZg/Gg5yqOc93MErd93yjeIsWQYtnDgUv4gK4d0shhZpxaBPa+/51H0+sJLfy6r/auQniQkQaNWbowrr4aiuZ1Hxn5YJ1OMhEssxQqS8lSl7lQ+l4Gvg/GzC+glgVIJ7q+Vvd2qNXBU8be/eAJXt3v+IBgPPT7+3k6BIj3HSxrID9I1jb; lastSeen=0; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEcx%2FNBSM7hcmxfYRvnB2G9PFWrc9JWtc80%2BB7O9mau%2Fq%2F%2BQmqj8vmO7zmkRYgjc%2BJMYUHnygfC%2FFBh8jDDTeAvsn%2BiKEgv%2FBXfiRGJQAB8jx9PUIZybt6czbgdtg4epkv4DQISO29Dru4mhOYkQiObM%3D; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42
2024-02-08 18:36:11 UTC	684	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:11 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=c9c282cd03010198&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQp5Po52pCTBfqSahjJDDfOqEyWVtviKmIh x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7699e4f17e72e42cba0c247c650005d2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: ASqZGd_t4AtVPvkG9d8i0r7xlBEh6eOLtZrdrdykdpKMl6EBlVf7xw==
2024-02-08 18:36:11 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
547	192.168.2.5	50361	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:11 UTC	2244	OUT	GET /td/rul/1060768846?random=1707417370594&cv=11&fst=1707417370594&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=6OEvCKaZ3wMQzpjo-QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nh4qqVoyv2KiIad5kPNddW86jrjYgKSk8&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=page_type%3Dhome%3Bcheckindate%3D-1%3Bcheckoutdate%3D-1%3Bhotelid%3D0%3Bbook_window%3D%3Bweekday%3D-1%3Bdest_cc%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bnights%3D-1%3Brooms%3D-1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Bguestcount%3D-1%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdest_ufi%3D-1%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:36:11 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:11 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:36:11 UTC	606	IN	Data Raw: 33 65 61 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 6f 72 69 67 69 6e 2d 74 72 69 61 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 41 76 68 35 4e 79 30 58 45 46 43 79 51 37 2b 6f 4e 69 65 58 73 6b 55 72 71 59 38 65 64 55 7a 4c 35 2f 58 72 77 4b 6c 47 6a 41 52 51 48 57 34 54 46 52 4b 2b 6a 56 64 35 48 6e 44 49 70 59 32 30 6e 35 4f 4c 48 66 67 55 34 6b 75 37 78 34 38 4e 33 75 68 47 2f 41 30 41 41 41 42 78 65 79 4a 76 63 6d 6c 6e 61 57 34 69 4f 69 4a 6f 64 48 52 77 63 7a 6f 76 4c 32 52 76 64 57 4a 73 5a 57 4e 73 61 57 4e 72 4c 6d 35 6c 64 44 6f 30 4e 44 4d 69 4c 43 4a 6d 5a 57 46 30 64 58 4a 6c 49 6a 6f 69 55 48 4a 70 64 6d 46 6a 65 56 4e 68 62 6d 52 69 62 33 68 42 5a 48 4e 42 55 45 6c 7a 49 69 77 69 5a 58 68 77 61 Data Ascii: 3ea<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwa
2024-02-08 18:36:11 UTC	403	IN	Data Raw: 74 72 79 7b 69 66 28 69 2e 61 63 74 69 6f 6e 3d 3d 30 29 7b 6e 61 76 69 67 61 74 6f 72 2e 6a 6f 69 6e 41 64 49 6e 74 65 72 65 73 74 47 72 6f 75 70 28 69 2e 69 6e 74 65 72 65 73 74 47 72 6f 75 70 41 74 74 72 69 62 75 74 65 73 2c 69 2e 65 78 70 69 72 61 74 69 6f 6e 54 69 6d 65 49 6e 53 65 63 6f 6e 64 73 29 3b 7d 65 6c 73 65 20 69 66 28 69 2e 61 63 74 69 6f 6e 3d 3d 31 29 7b 6e 61 76 69 67 61 74 6f 72 2e 6c 65 61 76 65 41 64 49 6e 74 65 72 65 73 74 47 72 6f 75 70 28 69 2e 69 6e 74 65 72 65 73 74 47 72 6f 75 70 41 74 74 72 69 62 75 74 65 73 29 3b 7d 7d 63 61 74 63 68 28 65 29 7b 6e 61 76 69 67 61 74 6f 72 2e 73 65 6e 64 42 65 61 63 6f 6e 28 60 68 74 74 70 73 3a 2f 2f 70 61 67 65 61 64 32 2e 67 6f 6f 67 6c 65 73 79 6e 64 69 63 61 74 69 6f 6e 2e 63 6f 6d 2f 70 Data Ascii: try{if(i.action==0){navigator.joinAdInterestGroup(i.interestGroupAttributes,i.expirationTimeInSeconds);}else if(i.action==1){navigator.leaveAdInterestGroup(i.interestGroupAttributes);}}catch(e){navigator.sendBeacon(`https://pagead2.googlesyndication.com/p
2024-02-08 18:36:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
548	192.168.2.5	50363	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:11 UTC	1672	OUT	GET /td/rul/973712236?random=1707417370629&cv=11&fst=1707417370629&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=8GRyCJ3Eq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:36:11 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:11 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:36:11 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-08 18:36:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
549	192.168.2.5	50364	3.162.125.32	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:11 UTC	2496	OUT	GET /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=BXAbRIVE HTTP/1.1 Host: accommodations.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json x-booking-et-serialized-state: ESNA6-jww5PiZzyK_LfXmqWii5kpdRkL6a6nI9I91DYrlgCDdZE8nYAOQCA6hUpfE sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; lastSeen=0; _ga=GA1.2.421694156.1707417338; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEcx%2FNBSM7hcmxfYRvnB2G9PFWrc9JWtc80%2BB7O9mau%2Fq%2F%2BQmqj8vmO7zmkRYgjc%2BJMYUHnygfC%2FFBh8jDDTeAvsn%2BiKEgv%2FBXfiRGJQAB8jx9PUIZybt6czbgdtg4epkv4DQISO29Dru4mhOYkQiObM%3D
2024-02-08 18:36:12 UTC	650	IN	HTTP/1.1 200 OK Content-Type: application/json Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:11 GMT x-frame-options: SAMEORIGIN x-content-type-options: nosniff vary: Accept-Encoding access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true referrer-policy: no-referrer strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 b838afd3b92ba725d13555ccc038c6ce.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P3 X-Amz-Cf-Id: QRSWSQeFOqrFMzrqZcICEToCY02p7wLdcUcWIDQ6T7s_73tgChUZVQ==
2024-02-08 18:36:12 UTC	6435	IN	Data Raw: 31 39 31 62 0d 0a 7b 22 63 68 75 6e 6b 73 22 3a 5b 22 62 39 61 38 32 63 62 38 22 5d 2c 22 65 78 70 65 72 69 6d 65 6e 74 54 61 67 73 22 3a 7b 22 59 54 54 48 62 58 65 65 56 65 43 46 5a 41 63 62 52 62 52 4f 66 4c 4d 54 65 43 59 48 44 52 46 63 4f 22 3a 31 2c 22 48 4d 62 4f 48 4e 46 50 42 4a 59 49 59 4b 63 50 4e 53 4e 48 52 55 65 42 4f 46 4f 22 3a 31 7d 2c 22 66 65 61 74 75 72 65 4e 61 6d 65 73 22 3a 7b 22 49 65 5a 58 58 44 4e 46 56 46 4b 4f 55 59 4c 4c 46 4a 59 62 43 63 65 4d 4e 50 56 62 50 53 55 61 62 53 63 63 45 54 4b 65 22 3a 66 61 6c 73 65 2c 22 45 42 44 49 62 49 62 58 44 65 42 47 47 54 63 5a 4a 46 66 48 62 65 4d 50 45 54 22 3a 74 72 75 65 2c 22 49 65 50 46 62 4a 4d 46 56 46 4b 4f 55 59 4c 4c 48 4e 4f 56 52 65 22 3a 74 72 75 65 7d 2c 22 73 65 6f 45 78 70 Data Ascii: 191b{"chunks":["b9a82cb8"],"experimentTags":{"YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO":1,"HMbOHNFPBJYIYKcPNSNHRUeBOFO":1},"featureNames":{"IeZXXDNFVFKOUYLLFJYbCceMNPVbPSUabSccETKe":false,"EBDIbIbXDeBGGTcZJFfHbeMPET":true,"IePFbJMFVFKOUYLLHNOVRe":true},"seoExp
2024-02-08 18:36:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
550	192.168.2.5	50366	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:11 UTC	1672	OUT	GET /td/rul/973712236?random=1707417370647&cv=11&fst=1707417370647&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=LJXqCKDEq1gQ7Nam0AM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:36:11 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:11 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:36:11 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-08 18:36:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
551	192.168.2.5	50365	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:11 UTC	1672	OUT	GET /td/rul/975716499?random=1707417370676&cv=11&fst=1707417370676&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=BcW9COaWsFgQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:36:11 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:11 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:36:11 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-08 18:36:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
552	192.168.2.5	50367	216.239.38.21	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:11 UTC	3252	OUT	GET /g/collect?v=2&tid=G-A12345&gtm=45je4250z879615461za200&_p=1707417370229&gcs=G1--&gcd=13l3l3l3l5&npa=0&dma=0&cid=421694156.1707417338&ul=en-us&sr=1280x1024&ur=US-FL&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pscdl=noapi&sst.uc=US&sst.rnd=1748118732.1707417371&sst.gcd=13l3l3l3l5&sst.tft=1707417370229&_s=1&sid=1707417345&sct=1&seg=1&dl=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=7431&richsstsse HTTP/1.1 Host: gtm-mktg.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEcx%2FNBSM7hcmxfYRvnB2G9PFWrc9JWtc80%2BB7O9mau%2Fq%2F%2BQmqj8vmO7zmkRYgjc%2BJMYUHnygfC%2FFBh8jDDTeAvsn%2BiKEgv%2FBXfiRGJQAB8jx9PUIZybt6czbgdtg4epkv4DQISO29Dru4mhOYkQiObM%3D; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0
2024-02-08 18:36:12 UTC	566	IN	HTTP/1.1 200 OK Content-Type: text/plain Vary: Accept-Encoding set-cookie: FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; Max-Age=63072000; Domain=booking.com; Path=/; Secure; HttpOnly cache-control: no-cache x-content-type-options: nosniff access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true X-Cloud-Trace-Context: 2da7baa13a3d2a70af5cecc7db923eee Date: Thu, 08 Feb 2024 18:36:11 GMT Server: Google Frontend Content-Length: 65 Expires: Thu, 08 Feb 2024 18:36:11 GMT Connection: close
2024-02-08 18:36:12 UTC	65	IN	Data Raw: 65 76 65 6e 74 3a 20 6d 65 73 73 61 67 65 0a 64 61 74 61 3a 20 7b 22 72 65 73 70 6f 6e 73 65 22 3a 7b 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 62 6f 64 79 22 3a 22 22 7d 7d 0a 0a Data Ascii: event: messagedata: {"response":{"status_code":200,"body":""}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
553	192.168.2.5	50368	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:11 UTC	919	OUT	GET /cm/i?pid=54f04dd9-4d34-47ee-87a6-989713215c80&u_scsid=02478874-a277-465c-b9e7-ce2412232e4f&u_sclid=75022d4d-ae50-4a02-8ab1-d3d7e0695f9e HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:12 UTC	454	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:12 GMT content-type: text/html strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
554	192.168.2.5	50369	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:11 UTC	3777	OUT	POST /js_tracking?sid=5171fc655664ddf74ab763a094523fb7&aid=304142&ref_action=index&ver=2&pid=87e482caf42702d0&lang=en-us&stype=1&m=UmFuZG9tSVYkc2RlIyh9YUe5zZbLHt0YNre0CiGBBmP5hKTY_IzZqpWBtitYrnE-ba2NOPqZSPGdnbkQM2vO343hpsChBnayfrRG7jVW0hI1Ke4kKZ85U_m7O1xbR8NLSlv2Zn-4d5ku6anu7qAZgjoLQxWZjIis3cNA3ef3I_aOxDvMotUV5ZQc6OhcEEody8ooGsshLIhRMDad6kRNg_HeFvW36Wr8mOnNh6fMuy8OZ9w095BIb2XL0zt8fY-5SPQHxgI7NWrdI31vzPG5nOwkA1lE2mJxFh3z4YXPwcZPq5z6drlkg3iN9tdtKjt0cXf7rJdLIbIGLmOniyEf0g&etgwv=js_onload_resource_transfer_size%7C67&_=1707417370269 HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417356.49.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _ga_A12345=GS1.1.1707417345.1.1.1707417356.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAcliCNHMNAAAA:n/cv5VZ9qVNMSvFL0bOQTKuI2OPvTEeFeyhTL7WjwGM0OG/n4w2baTykBBh/YZIH0afPSLTNxnTfx+/G0aiWdeVHZg/Gg5yqOc93MErd93yjeIsWQYtnDgUv4gK4d0shhZpxaBPa+/51H0+sJLfy6r/auQniQkQaNWbowrr4aiuZ1Hxn5YJ1OMhEssxQqS8lSl7lQ+l4Gvg/GzC+glgVIJ7q+Vvd2qNXBU8be/eAJXt3v+IBgPPT7+3k6BIj3HSxrID9I1jb; lastSeen=0; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga=GA1.2.421694156.1707417338; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEcx%2FNBSM7hcmxfYRvnB2G9PFWrc9JWtc80%2BB7O9mau%2Fq%2F%2BQmqj8vmO7zmkRYgjc%2BJMYUHnygfC%2FFBh8jDDTeAvsn%2BiKEgv%2FBXfiRGJQAB8jx9PUIZybt6czbgdtg4epkv4DQISO29Dru4mhOYkQiObM%3D
2024-02-08 18:36:12 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:12 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=dd9e82ce301400aa&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejKG_4xyeB7hCi4LaFkKZsFukgy5WHGbo1M x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 09aa283795aaafe63cbd7c2cbac2c306.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: x14hK4xHk6pFypGpQ80shi3T56se1-DyjAoUJtIowoiIX7l2dcIpGg==
2024-02-08 18:36:12 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
555	192.168.2.5	50373	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:11 UTC	1672	OUT	GET /td/rul/975716499?random=1707417370697&cv=11&fst=1707417370697&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&gcd=13l3l3l3l5&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=mzmpCMbAq1gQk4Gh0QM&hn=www.googleadservices.com&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:36:12 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:12 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:36:12 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-08 18:36:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
556	192.168.2.5	50374	64.233.185.104	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:11 UTC	390	OUT	GET /.well-known/web-identity HTTP/1.1 Host: www.google.com Connection: keep-alive Accept: application/json Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: webidentity User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:12 UTC	660	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 78 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 08 Feb 2024 18:35:57 GMT Expires: Fri, 09 Feb 2024 18:35:57 GMT Cache-Control: public, max-age=86400 Last-Modified: Fri, 23 Jun 2023 19:00:00 GMT Content-Type: application/json Vary: Accept-Encoding Age: 15 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:12 UTC	78	IN	Data Raw: 7b 0a 20 20 22 70 72 6f 76 69 64 65 72 5f 75 72 6c 73 22 3a 20 5b 0a 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 67 73 69 2f 66 65 64 63 6d 2e 6a 73 6f 6e 22 0a 20 20 5d 0a 7d 0a Data Ascii: { "provider_urls": [ "https://accounts.google.com/gsi/fedcm.json" ]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
557	192.168.2.5	50377	172.253.124.149	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	1423	OUT	GET /activity;dc_pre=CMCFs6-xnIQDFbjbuAgdwz4C4g;src=4228414;type=views;cat=views;ord=4729221658983;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=900727044;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:36:12 UTC	1276	IN	HTTP/1.1 302 Found P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:12 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Location: https://adservice.google.com/ddm/fls/z/dc_pre=CMCFs6-xnIQDFbjbuAgdwz4C4g;src=4228414;type=views;cat=views;ord=4729221658983;npa=0;auiddc=*;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=900727044;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2 Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
558	192.168.2.5	50378	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	613	OUT	GET /config/com/54f04dd9-4d34-47ee-87a6-989713215c80.js?v=3.9.1-2402072137 HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:12 UTC	564	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:12 GMT access-control-allow-origin: https://www.booking.com content-type: application/javascript strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 186 x-envoy-upstream-service-time: 40 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:12 UTC	186	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 72 79 7b 77 69 6e 64 6f 77 2e 73 6e 61 70 74 72 2e 63 66 67 28 27 35 34 66 30 34 64 64 39 2d 34 64 33 34 2d 34 37 65 65 2d 38 37 61 36 2d 39 38 39 37 31 33 32 31 35 63 38 30 27 2c 7b 22 61 73 63 22 3a 5b 5d 2c 22 61 22 3a 5b 22 50 49 49 22 2c 22 41 56 33 22 5d 2c 22 69 70 67 22 3a 22 34 30 22 2c 22 62 22 3a 5b 5d 2c 22 74 22 3a 22 22 2c 22 76 22 3a 22 33 2e 37 2e 35 2d 32 34 30 31 30 33 32 33 34 37 22 2c 22 65 63 22 3a 5b 5d 7d 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 28 29 3b Data Ascii: !function(){"use strict";try{window.snaptr.cfg('54f04dd9-4d34-47ee-87a6-989713215c80',{"asc":[],"a":["PII","AV3"],"ipg":"40","b":[],"t":"","v":"3.7.5-2401032347","ec":[]})}catch(e){}}();

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
559	192.168.2.5	50379	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	1837	OUT	GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e&u_sclid=75022d4d-ae50-4a02-8ab1-d3d7e0695f9e&u_scsid=02478874-a277-465c-b9e7-ce2412232e4f&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&df=true&huah=true&m_dcl=4149&m_fcps=3889&m_pi=4089&m_pl=6944&m_pv=2&m_rd=7451&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&trackId=c904cd67-c0d8-4a0e-97fd-cc369431aa6a&ts=1707417370842&v=3.9.1-2402072137 HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:12 UTC	526	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:12 GMT access-control-allow-origin: * cache-control: no-cache, no-transform content-type: image/png strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 68 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:12 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 0b 49 44 41 54 78 da 63 60 00 02 00 00 05 00 01 e9 fa dc d8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxc`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
560	192.168.2.5	50382	151.101.128.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	1047	OUT	GET /user/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA%22%7D&cb=1707417371155&dep=2%2CPAGE_LOAD HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZkbWZLdDFSY2k0RytCMHNLTDhuVWhuQit1d1gzb2tkNjRDaHFUR2NwSy9hK25KRVljS2dwMUxocE53VFhBWmNEQUJYSEV6eURmdGtxL29kcXhpTnAyM0d6S1c1NzBROHppc083NktsbU9vZz0mY0M4cWljSXAxaDlIOFVBazhiS3FNM2xZeGtjPQ=="
2024-02-08 18:36:12 UTC	684	IN	HTTP/1.1 200 OK Connection: close Content-Length: 302 access-control-expose-headers: Epik,Pin-Unauth pin-unauth: dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 3 referrer-policy: origin x-pinterest-rid: 4368558822021698 Date: Thu, 08 Feb 2024 18:36:12 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: f9d1c7100d6ab6a9fc70375cea0fca5e275d3fa9
2024-02-08 18:36:12 UTC	302	IN	Data Raw: 7b 22 61 65 6d 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 65 6d 46 6e 4c 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 50 68 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 47 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 44 62 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 4c 6f 63 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 45 78 74 65 72 6e 61 6c 49 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 45 70 69 6b 49 66 72 61 6d 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 68 72 6f 6d 65 4e 65 77 55 73 65 72 41 67 65 6e 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 45 75 22 3a 74 72 75 65 2c 22 69 73 55 74 69 6c 69 7a 69 6e 67 41 64 76 65 72 74 69 73 65 72 31 70 45 6e 61 Data Ascii: {"aemEnabled":true,"aemFnLnEnabled":false,"aemPhEnabled":false,"aemGeEnabled":false,"aemDbEnabled":false,"aemLocEnabled":false,"aemExternalIdEnabled":false,"ctEpikIframeEnabled":true,"chromeNewUserAgentEnabled":true,"isEu":true,"isUtilizingAdvertiser1pEna

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
561	192.168.2.5	50381	151.101.128.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	988	OUT	GET /user/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1707417371157&dep=5%2CEVENT_TAGS_ABSENT HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZkbWZLdDFSY2k0RytCMHNLTDhuVWhuQit1d1gzb2tkNjRDaHFUR2NwSy9hK25KRVljS2dwMUxocE53VFhBWmNEQUJYSEV6eURmdGtxL29kcXhpTnAyM0d6S1c1NzBROHppc083NktsbU9vZz0mY0M4cWljSXAxaDlIOFVBazhiS3FNM2xZeGtjPQ=="
2024-02-08 18:36:12 UTC	684	IN	HTTP/1.1 200 OK Connection: close Content-Length: 302 access-control-expose-headers: Epik,Pin-Unauth pin-unauth: dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 1 referrer-policy: origin x-pinterest-rid: 1102986547970465 Date: Thu, 08 Feb 2024 18:36:12 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: f9d1c7100d6ab6a9fc70375cea0fca5e275d3fa9
2024-02-08 18:36:12 UTC	302	IN	Data Raw: 7b 22 61 65 6d 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 65 6d 46 6e 4c 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 50 68 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 47 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 44 62 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 4c 6f 63 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 45 78 74 65 72 6e 61 6c 49 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 45 70 69 6b 49 66 72 61 6d 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 68 72 6f 6d 65 4e 65 77 55 73 65 72 41 67 65 6e 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 45 75 22 3a 74 72 75 65 2c 22 69 73 55 74 69 6c 69 7a 69 6e 67 41 64 76 65 72 74 69 73 65 72 31 70 45 6e 61 Data Ascii: {"aemEnabled":true,"aemFnLnEnabled":false,"aemPhEnabled":false,"aemGeEnabled":false,"aemDbEnabled":false,"aemLocEnabled":false,"aemExternalIdEnabled":false,"ctEpikIframeEnabled":true,"chromeNewUserAgentEnabled":true,"isEu":true,"isUtilizingAdvertiser1pEna

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
562	192.168.2.5	50383	64.233.177.148	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	523	OUT	POST /.well-known/attribution-reporting/debug/verbose HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive Content-Length: 139 Pragma: no-cache Cache-Control: no-cache Content-Type: application/json Origin: https://ad.doubleclick.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:12 UTC	139	OUT	Data Raw: 5b 7b 22 62 6f 64 79 22 3a 7b 22 61 74 74 72 69 62 75 74 69 6f 6e 5f 64 65 73 74 69 6e 61 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 74 72 69 67 67 65 72 5f 64 65 62 75 67 5f 6b 65 79 22 3a 22 31 33 37 30 37 38 35 32 35 38 38 39 39 39 37 39 30 32 30 35 22 7d 2c 22 74 79 70 65 22 3a 22 74 72 69 67 67 65 72 2d 6e 6f 2d 6d 61 74 63 68 69 6e 67 2d 73 6f 75 72 63 65 22 7d 5d Data Ascii: [{"body":{"attribution_destination":"https://booking.com","trigger_debug_key":"13707852588999790205"},"type":"trigger-no-matching-source"}]
2024-02-08 18:36:12 UTC	493	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Thu, 08 Feb 2024 18:36:12 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
563	192.168.2.5	50385	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	716	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 956 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:12 UTC	956	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 65 32 63 65 64 30 36 34 2d 33 31 34 64 2d 34 63 62 63 2d 61 61 37 61 2d 35 62 31 66 38 64 36 61 61 34 39 34 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 37 62 38 39 65 31 33 35 2d 34 36 34 35 2d 34 65 31 63 2d 62 37 32 34 2d 39 39 62 30 39 35 32 32 65 33 34 30 22 2c 22 73 73 22 3a 22 32 32 34 65 39 64 61 32 2d 33 65 62 65 2d 34 64 65 30 2d 39 34 62 61 2d 30 64 35 64 32 32 63 39 35 62 37 66 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"e2ced064-314d-4cbc-aa7a-5b1f8d6aa494","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"7b89e135-4645-4e1c-b724-99b09522e340","ss":"224e9da2-3ebe-4de0-94ba-0d5d22c95b7f","bg":true,"s
2024-02-08 18:36:12 UTC	523	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:12 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
564	192.168.2.5	50384	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	3552	OUT	POST /navigation_times HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 504 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/x-www-form-urlencoded X-Booking-CSRF: VFfFZQAAAAA=I0VyxrbmcRsXF8b8667mJSw00zD1jijstj9zA-B31AE-SHf9fwLae-NRdcEvORIZUidJgBp9cG2_VeJ_vvAjE9POdq-3lpUXJKUz5osKhhR_6IWR4vCHyNCN9_lrexSyhyl857y4-aUKLEPdAzHdPtU-69GNk1-tINwO8UxKp7l2RhgisIpi5FvtqY4OOakuCSFjRchHm9pnK7Y6 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAcliCNHMNAAAA:n/cv5VZ9qVNMSvFL0bOQTKuI2OPvTEeFeyhTL7WjwGM0OG/n4w2baTykBBh/YZIH0afPSLTNxnTfx+/G0aiWdeVHZg/Gg5yqOc93MErd93yjeIsWQYtnDgUv4gK4d0shhZpxaBPa+/51H0+sJLfy6r/auQniQkQaNWbowrr4aiuZ1Hxn5YJ1OMhEssxQqS8lSl7lQ+l4Gvg/GzC+glgVIJ7q+Vvd2qNXBU8be/eAJXt3v+IBgPPT7+3k6BIj3HSxrID9I1jb; lastSeen=0; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEcx%2FNBSM7hcmxfYRvnB2G9PFWrc9JWtc80%2BB7O9mau%2Fq%2F%2BQmqj8vmO7zmkRYgjc%2BJMYUHnygfC%2FFBh8jDDTeAvsn%2BiKEgv%2FBXfiRGJQAB8jx9PUIZybt6czbgdtg4epkv4DQISO29Dru4mhOYkQiObM%3D; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42
2024-02-08 18:36:12 UTC	504	OUT	Data Raw: 72 65 66 5f 61 63 74 69 6f 6e 3d 69 6e 64 65 78 26 70 69 64 3d 38 37 65 34 38 32 63 61 66 34 32 37 30 32 64 30 26 73 74 79 70 65 3d 31 26 6c 61 6e 67 3d 65 6e 26 66 69 72 73 74 3d 30 26 63 68 3d 64 26 62 6f 3d 33 26 61 69 64 3d 33 30 34 31 34 32 26 63 73 73 5f 6c 6f 61 64 3d 31 26 63 64 6e 3d 63 66 26 64 63 3d 33 32 26 6e 74 73 3d 30 25 32 43 30 25 32 43 31 37 30 37 34 31 37 33 36 33 33 39 31 25 32 43 30 25 32 43 30 25 32 43 30 25 32 43 30 25 32 43 31 37 30 37 34 31 37 33 36 33 33 39 36 25 32 43 31 37 30 37 34 31 37 33 36 33 34 35 30 25 32 43 31 37 30 37 34 31 37 33 36 33 34 35 30 25 32 43 31 37 30 37 34 31 37 33 36 33 34 35 30 25 32 43 31 37 30 37 34 31 37 33 36 33 37 35 39 25 32 43 31 37 30 37 34 31 37 33 36 33 34 36 33 25 32 43 31 37 30 37 34 31 37 33 Data Ascii: ref_action=index&pid=87e482caf42702d0&stype=1&lang=en&first=0&ch=d&bo=3&aid=304142&css_load=1&cdn=cf&dc=32&nts=0%2C0%2C1707417363391%2C0%2C0%2C0%2C0%2C1707417363396%2C1707417363450%2C1707417363450%2C1707417363450%2C1707417363759%2C1707417363463%2C17074173
2024-02-08 18:36:12 UTC	1038	IN	HTTP/1.1 202 Accepted Content-Type: image/jpeg Content-Length: 0 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:12 GMT set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPeeiS3HjtTZXkOelfN%2BTRHp5819aBVKUAWU8d6iXTYJyw%2FIPv4OCtUyuUq%2BVrS0WPtY38QJCqNkBX7o%2B2RRpjlx61DSmT7ufG1ri1CRFdQhX2zgjGT6dOcSaEzhDNd8bC3m%2FEZlK%2BzITAWgJ8rsgX6dWJnl%2BKVPp8Ic%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:12 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=fc9b82ce777b01af&e=UmFuZG9tSVYkc2RlIyh9YfnWSDpdIwKzDzbKZoiCiJtvjj_YohrLVScExqSsbBwKAUZ-m3swx2Y x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 61bbe72b71f7b857c695c31fdeb7b3a6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: I-79phdclcWA26IOC00gk_iTQVj6bDVn4sK0t2GmiYU7CerhCNBEIg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
565	192.168.2.5	50386	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	676	OUT	GET /psb/capla/static/css/4e596c2c.3a2fb681.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" If-None-Match: "51be0c43cc481b13fe70d3ba27e2ffd9" If-Modified-Since: Thu, 08 Feb 2024 14:53:51 GMT sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:12 UTC	514	IN	HTTP/1.1 304 Not Modified Connection: close Date: Thu, 08 Feb 2024 18:36:12 GMT ETag: "51be0c43cc481b13fe70d3ba27e2ffd9" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: SFV4Wl1bGgrYBAvh1g48Ac217jtyPkYJ Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 09aa283795aaafe63cbd7c2cbac2c306.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: bhPosrU1xIz1jmIyR_aXAmKb6KI6tfgWLUIbQrRMxdCnenj6dUyQmw== Age: 8932 Vary: Origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
566	192.168.2.5	50391	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	1025	OUT	GET /pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_gXMMKR8XlWQUw777UtDcji15Fuhz4qxcj8OlguUiWRdNRO6X&random=2004650583 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:12 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:12 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:12 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
567	192.168.2.5	50390	142.250.9.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	576	OUT	GET /gsi/fedcm/listaccounts HTTP/1.1 Host: accounts.google.com Connection: keep-alive Accept: application/json Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: webidentity User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:12 UTC	1300	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 08 Feb 2024 18:36:12 GMT Content-Disposition: attachment; filename="json.txt"; filename*=UTF-8''json.txt Cross-Origin-Resource-Policy: same-site Content-Security-Policy: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Content-Security-Policy: script-src 'report-sample' 'nonce-2nt5hoHDn93r4JY1_KZdJQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1" Report-To: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]} Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site,Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:36:12 UTC	20	IN	Data Raw: 66 0d 0a 7b 22 61 63 63 6f 75 6e 74 73 22 3a 5b 5d 7d 0d 0a Data Ascii: f{"accounts":[]}
2024-02-08 18:36:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
568	192.168.2.5	50393	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive Content-Length: 3100 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:12 UTC	3100	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 63 6c 69 43 4e 48 4d 4e 41 41 41 41 3a 6e 2f 63 76 35 56 5a 39 71 56 4e 4d 53 76 46 4c 30 62 4f 51 54 4b 75 49 32 4f 50 76 54 45 65 46 65 79 68 54 4c 37 57 6a 77 47 4d 30 4f 47 2f 6e 34 77 32 62 61 54 79 6b 42 42 68 2f 59 5a 49 48 30 61 66 50 53 4c 54 4e 78 6e 54 66 78 2b 2f 47 30 61 69 57 64 65 56 48 5a 67 2f 47 67 35 79 71 4f 63 39 33 4d 45 72 64 39 33 79 6a 65 49 73 57 51 59 74 6e 44 67 55 76 34 67 4b 34 64 30 73 68 68 5a 70 78 61 42 50 61 2b 2f 35 31 48 30 2b 73 4a 4c 66 79 36 72 2f 61 75 51 6e 69 51 6b 51 61 4e 57 62 6f 77 72 72 34 61 69 75 5a 31 48 78 6e 35 59 4a 31 4f 4d Data Ascii: {"existing_token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAcliCNHMNAAAA:n/cv5VZ9qVNMSvFL0bOQTKuI2OPvTEeFeyhTL7WjwGM0OG/n4w2baTykBBh/YZIH0afPSLTNxnTfx+/G0aiWdeVHZg/Gg5yqOc93MErd93yjeIsWQYtnDgUv4gK4d0shhZpxaBPa+/51H0+sJLfy6r/auQniQkQaNWbowrr4aiuZ1Hxn5YJ1OM
2024-02-08 18:36:12 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1653 Connection: close Vary: Accept-Encoding Date: Thu, 08 Feb 2024 18:36:12 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65c51f1c-7fabb4cf0bbbd2816ebb1ff8 X-Cache: Miss from cloudfront Via: 1.1 4a050b98a443ca2d3af477f9b4dc39ae.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: _X8qCAeHZsENVAY22a-OHIBEr12rlzJTQVhPisPxGvv5Icw8C8TZ9Q==
2024-02-08 18:36:12 UTC	1653	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 6d 62 36 43 68 47 30 47 41 41 41 41 3a 31 59 66 64 71 54 47 63 7a 35 4e 76 2b 79 53 79 52 34 6c 30 64 63 50 33 70 4d 6f 54 4f 52 46 61 74 69 4e 69 47 57 4a 37 4d 4e 39 59 4e 41 58 6a 72 6a 2b 4a 77 4c 44 53 42 53 65 67 4d 6e 63 48 41 64 79 4e 4e 50 4f 6a 4e 73 61 65 44 6d 39 70 62 6e 62 52 4c 6c 49 59 79 2f 57 73 61 30 6c 33 52 52 64 56 47 5a 4e 77 48 76 43 4c 37 4d 53 78 56 55 65 4f 6f 4c 51 62 6e 41 34 77 73 2f 6f 43 63 63 76 49 6d 4f 77 6f 38 43 56 65 74 68 6e 68 63 5a 38 6a 52 79 4c 6f 6d 39 45 74 52 2b 68 43 6c 65 35 67 33 2f 45 34 74 53 63 71 5a 53 38 37 59 4d 50 72 41 55 6f 4b 70 4c 7a 4c 36 51 5a Data Ascii: {"token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAmb6ChG0GAAAA:1YfdqTGcz5Nv+ySyR4l0dcP3pMoTORFatiNiGWJ7MN9YNAXjrj+JwLDSBSegMncHAdyNNPOjNsaeDm9pbnbRLlIYy/Wsa0l3RRdVGZNwHvCL7MSxVUeOoLQbnA4ws/oCccvImOwo8CVethnhcZ8jRyLom9EtR+hCle5g3/E4tScqZS87YMPrAUoKpLzL6QZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
569	192.168.2.5	50395	64.233.177.157	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	1504	OUT	GET /ddm/fls/z/dc_pre=CMCFs6-xnIQDFbjbuAgdwz4C4g;src=4228414;type=views;cat=views;ord=4729221658983;npa=0;auiddc=;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=900727044;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2 HTTP/1.1 Host: adservice.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:12 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:12 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:12 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
570	192.168.2.5	50396	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	1537	OUT	GET /pagead/1p-user-list/988382855/?random=1707417370534&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=qxb_CKLbrYADEIeNptcD&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_xJXFnZ-QZPYh1oZDyu_TZwxAXJ-Wp-8Ob2qjV2LC1aNJs2H7&random=1370815513&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:12 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:12 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:12 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
571	192.168.2.5	50397	64.233.177.99	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	1238	OUT	GET /recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&cb=k6nv978x042h HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AJmcDEl4lP7G1sUzlkfo-ph5oEYDaZrMsr87jx805YMBfBXipJ4MvomJQXIF7z5TPrZE7LxvSiQSdmfSY1DEipM; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:12 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 08 Feb 2024 18:36:12 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-82W_67pkIdQ5lDPkqsIbjA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:36:12 UTC	361	IN	Data Raw: 32 61 66 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b Data Ascii: 2aff<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face {
2024-02-08 18:36:12 UTC	1252	IN	Data Raw: 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 Data Ascii: o/v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//f
2024-02-08 18:36:12 UTC	1252	IN	Data Raw: 39 2c 20 55 2b 32 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 Data Ascii: 9, U+20AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329,
2024-02-08 18:36:12 UTC	1252	IN	Data Raw: 30 2d 30 34 39 31 2c 20 55 2b 30 34 42 30 2d 30 34 42 31 2c 20 55 2b 32 31 31 36 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a Data Ascii: 0-0491, U+04B0-04B1, U+2116;}/* greek-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}
2024-02-08 18:36:12 UTC	1252	IN	Data Raw: 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c Data Ascii: */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA,
2024-02-08 18:36:12 UTC	1252	IN	Data Raw: 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 42 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 33 37 30 2d 30 33 37 37 2c 20 55 2b 30 33 37 41 2d 30 33 37 46 2c 20 55 2b 30 33 38 34 2d 30 33 38 41 2c 20 55 2b 30 33 38 43 2c 20 55 2b 30 33 38 45 2d 30 33 41 31 2c 20 55 2b 30 33 41 33 2d 30 33 46 46 3b 0a 7d 0a 2f 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b Data Ascii: l(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2) format('woff2'); unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}/* vietnamese */@font-face { font-family: 'Roboto'; font-style: normal;
2024-02-08 18:36:12 UTC	1252	IN	Data Raw: 20 55 2b 46 45 46 46 2c 20 55 2b 46 46 46 44 3b 0a 7d 0a 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 78 35 57 57 6f 45 35 37 46 76 30 64 36 41 54 4b 73 4c 44 49 41 4b 6e 74 2f 73 74 79 6c 65 73 5f 5f 6c 74 72 2e 63 73 73 22 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 38 32 57 5f 36 37 70 6b 49 64 51 35 6c 44 50 6b 71 73 49 62 6a 41 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 Data Ascii: U+FEFF, U+FFFD;}</style><link rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/styles__ltr.css"><script nonce="82W_67pkIdQ5lDPkqsIbjA" type="text/javascript">window['__recaptcha_api'] = 'http
2024-02-08 18:36:12 UTC	1252	IN	Data Raw: 50 79 68 77 55 55 6f 31 6a 70 75 53 54 72 49 75 6e 64 39 33 72 4e 34 38 4c 4f 4d 5f 4f 6c 55 55 38 58 6e 70 47 65 37 56 47 6f 34 45 72 5f 61 64 74 5f 73 31 6e 32 4c 49 35 49 69 78 75 4d 74 6d 63 4c 59 4c 69 6f 53 34 6a 75 59 45 73 46 4d 73 4c 4d 71 33 77 79 5f 45 43 52 34 4c 53 79 4d 5a 4a 45 67 4e 4c 30 73 33 69 53 35 49 65 75 4f 74 52 71 30 5a 37 52 61 5a 35 57 71 6e 55 59 58 34 5a 71 30 35 4f 35 51 79 76 77 38 35 66 6b 4d 43 70 36 37 53 47 34 33 67 58 32 56 41 30 7a 4d 4a 30 34 42 56 76 41 79 6a 36 4f 70 42 68 64 68 78 48 54 52 50 59 30 75 69 76 4f 5a 4a 55 44 58 2d 50 44 73 64 36 37 48 58 6f 45 36 43 66 79 61 62 46 47 77 35 54 6c 33 34 44 57 46 4d 4a 5f 63 55 69 2d 70 70 52 63 72 63 64 52 44 64 6e 71 58 54 73 64 63 61 6c 4d 6a 50 42 64 7a 35 50 56 30 Data Ascii: PyhwUUo1jpuSTrIund93rN48LOM_OlUU8XnpGe7VGo4Er_adt_s1n2LI5IixuMtmcLYLioS4juYEsFMsLMq3wy_ECR4LSyMZJEgNL0s3iS5IeuOtRq0Z7RaZ5WqnUYX4Zq05O5Qyvw85fkMCp67SG43gX2VA0zMJ04BVvAyj6OpBhdhxHTRPY0uivOZJUDX-PDsd67HXoE6CfyabFGw5Tl34DWFMJ_cUi-ppRcrcdRDdnqXTsdcalMjPBdz5PV0
2024-02-08 18:36:12 UTC	1252	IN	Data Raw: 51 6e 59 65 41 49 56 44 4d 42 72 49 4d 75 59 70 6a 43 53 4a 76 49 79 51 4b 22 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 38 32 57 5f 36 37 70 6b 49 64 51 35 6c 44 50 6b 71 73 49 62 6a 41 22 3e 0a 20 20 20 20 20 20 72 65 63 61 70 74 63 68 61 2e 61 6e 63 68 6f 72 2e 4d 61 69 6e 2e 69 6e 69 74 28 22 5b 5c 78 32 32 61 69 6e 70 75 74 5c 78 32 32 2c 5b 5c 78 32 32 62 67 64 61 74 61 5c 78 32 32 2c 5c 78 32 32 4c 79 39 33 64 33 63 75 5a 32 39 76 5a 32 78 6c 4c 6d 4e 76 62 53 39 71 63 79 39 69 5a 79 39 4c 61 31 64 47 5a 56 4e 56 55 6d 56 72 57 45 64 35 59 32 52 77 63 6c 5a 44 4c 56 56 5a 4e 6b 56 45 4c 56 70 47 4e 57 78 73 4d 6b 70 44 54 57 6c 49 61 45 70 46 4d 6c 4a 72 4c 6d 70 7a 5c 78 Data Ascii: QnYeAIVDMBrIMuYpjCSJvIyQK"><script type="text/javascript" nonce="82W_67pkIdQ5lDPkqsIbjA"> recaptcha.anchor.Main.init("[\x22ainput\x22,[\x22bgdata\x22,\x22Ly93d3cuZ29vZ2xlLmNvbS9qcy9iZy9La1dGZVNVUmVrWEd5Y2RwclZDLVVZNkVELVpGNWxsMkpDTWlIaEpFMlJrLmpz\x
2024-02-08 18:36:12 UTC	638	IN	Data Raw: 6d 68 49 54 6a 68 35 5a 31 70 70 61 46 6c 74 59 58 4e 45 4f 46 6c 54 55 47 46 42 4d 33 42 36 4b 31 68 4d 61 69 73 30 63 47 4e 58 65 55 64 5a 65 56 4e 4e 61 31 70 32 65 44 56 54 4c 31 4a 4d 57 58 70 46 56 57 4e 43 56 55 52 6d 62 54 4a 35 4d 6a 52 42 4e 6a 55 30 4e 7a 46 46 57 6c 6c 74 57 58 68 36 62 47 35 4a 53 33 70 57 4e 6b 4d 31 57 6b 6f 77 61 6b 39 74 64 55 74 30 55 6a 68 59 61 32 56 75 62 30 6c 31 62 30 56 75 5a 57 52 53 62 56 49 35 4e 6c 42 30 61 7a 59 78 54 53 39 7a 54 30 74 70 63 54 46 44 59 6b 39 79 62 56 6c 56 61 33 64 6b 52 33 64 74 64 6c 5a 34 4e 6c 63 72 61 56 5a 36 57 45 45 33 57 57 52 5a 57 57 39 71 4d 47 45 33 62 47 4e 4d 63 31 68 6a 52 6a 6c 6d 52 44 4a 57 53 44 42 48 55 30 5a 53 54 58 52 45 61 7a 55 32 64 55 35 52 55 56 6c 51 4d 6d 56 4b Data Ascii: mhITjh5Z1ppaFltYXNEOFlTUGFBM3B6K1hMais0cGNXeUdZeVNNa1p2eDVTL1JMWXpFVWNCVURmbTJ5MjRBNjU0NzFFWlltWXh6bG5JS3pWNkM1Wkowak9tdUt0UjhYa2Vub0l1b0VuZWRSbVI5NlB0azYxTS9zT0tpcTFDYk9ybVlVa3dkR3dtdlZ4NlcraVZ6WEE3WWRZWW9qMGE3bGNMc1hjRjlmRDJWSDBHU0ZSTXREazU2dU5RUVlQMmVK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
572	192.168.2.5	50398	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	2107	OUT	GET /pagead/1p-user-list/1060768846/?random=1707417370594&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=6OEvCKaZ3wMQzpjo-QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nh4qqVoyv2KiIad5kPNddW86jrjYgKSk8&npa=0&data=page_type%3Dhome%3Bcheckindate%3D-1%3Bcheckoutdate%3D-1%3Bhotelid%3D0%3Bbook_window%3D%3Bweekday%3D-1%3Bdest_cc%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bnights%3D-1%3Brooms%3D-1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Bguestcount%3D-1%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdest_ufi%3D-1%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_gb44i39lGLaxfNcCIq_WTyFMLOl4BLrFxZyRf0JgbXaPZfmP&random=569072865&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:12 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:12 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:12 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
573	192.168.2.5	50399	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	716	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 945 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:12 UTC	945	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 65 32 63 65 64 30 36 34 2d 33 31 34 64 2d 34 63 62 63 2d 61 61 37 61 2d 35 62 31 66 38 64 36 61 61 34 39 34 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 61 62 39 33 35 36 36 66 2d 33 65 39 31 2d 34 34 36 30 2d 62 62 63 64 2d 31 65 33 38 65 36 33 32 61 33 62 63 22 2c 22 73 73 22 3a 22 32 32 34 65 39 64 61 32 2d 33 65 62 65 2d 34 64 65 30 2d 39 34 62 61 2d 30 64 35 64 32 32 63 39 35 62 37 66 22 2c 22 73 68 22 3a 31 30 32 34 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"e2ced064-314d-4cbc-aa7a-5b1f8d6aa494","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"ab93566f-3e91-4460-bbcd-1e38e632a3bc","ss":"224e9da2-3ebe-4de0-94ba-0d5d22c95b7f","sh":1024,"s
2024-02-08 18:36:12 UTC	523	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:12 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
574	192.168.2.5	50401	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	2889	OUT	GET /logo?ver=1&sid=5171fc655664ddf74ab763a094523fb7&t=17074173641 HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEcx%2FNBSM7hcmxfYRvnB2G9PFWrc9JWtc80%2BB7O9mau%2Fq%2F%2BQmqj8vmO7zmkRYgjc%2BJMYUHnygfC%2FFBh8jDDTeAvsn%2BiKEgv%2FBXfiRGJQAB8jx9PUIZybt6czbgdtg4epkv4DQISO29Dru4mhOYkQiObM%3D; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAg3CB3gkXAAAA:MjKO1hr2vGact9YeJE5WV1SAFZSdmyXEMmZGTBuMPoy2hCiHblFE1oJwqh74w2wYkPQpYmZm5TaLgscyzfAef0bGCVE84BqDPwyU6udlMs8GCG3PzswQ9vLdMJ3eBNxPiebxsmVae4EF0T/m8gLa4JND0Sx7w663Pbz8e+8pjoMz1FaGeU740v3HGmZFacbuBjwMiyNTkcequ0M6UxFRYtlVfsANbIrqXMaMiCClbaW3s0KrZ1Il53OxMrTfx3gNPFn9DPhd; lastSeen=1707417371728
2024-02-08 18:36:13 UTC	780	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:13 GMT vary: Accept-Encoding, User-Agent set-cookie: BJS=-; domain=booking.com; expires=Fri, 09-Feb-2024 18:36:13 GMT; Secure; HTTPOnly strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=061582ce1ca70188&e=UmFuZG9tSVYkc2RlIyh9YbpBYTW1tHKzncrJRQVXWgcmgoQJ4FnojjdQSzCCK4qM x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 4a91a321d4c2ab7334c6f285093956ae.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: MnJFJgAZbacwa6ceUcpxr0e9fP0LqAnxQXZ6mysrkjr_K5S3cga21g==
2024-02-08 18:36:13 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
575	192.168.2.5	50400	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	3360	OUT	GET /js_tracking?sid=5171fc655664ddf74ab763a094523fb7&aid=304142&ref_action=index&ver=2&pid=87e482caf42702d0&lang=en-us&stype=1&ete=&etg=&etcg=&ets=cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YUe5zZbLHt0YNre0CiGBBmP5hKTY_IzZqpWBtitYrnE-ba2NOPqZSPGdnbkQM2vO343hpsChBnayfrRG7jVW0hI1Ke4kKZ85U_m7O1xbR8NLSlv2Zn-4d5ku6anu7qAZgjoLQxWZjIis3cNA3ef3I_aOxDvMotUV5ZQc6OhcEEody8ooGsshLIhRMDad6kRNg_HeFvW36Wr8mOnNh6fMuy8OZ9w095BIb2XL0zt8fY-5SPQHxgI7NWrdI31vzPG5nOwkA1lE2mJxFh3z4YXPwcZPq5z6drlkg3iN9tdtKjt0cXf7rJdLIbIGLmOniyEf0g HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEcx%2FNBSM7hcmxfYRvnB2G9PFWrc9JWtc80%2BB7O9mau%2Fq%2F%2BQmqj8vmO7zmkRYgjc%2BJMYUHnygfC%2FFBh8jDDTeAvsn%2BiKEgv%2FBXfiRGJQAB8jx9PUIZybt6czbgdtg4epkv4DQISO29Dru4mhOYkQiObM%3D; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAg3CB3gkXAAAA:MjKO1hr2vGact9YeJE5WV1SAFZSdmyXEMmZGTBuMPoy2hCiHblFE1oJwqh74w2wYkPQpYmZm5TaLgscyzfAef0bGCVE84BqDPwyU6udlMs8GCG3PzswQ9vLdMJ3eBNxPiebxsmVae4EF0T/m8gLa4JND0Sx7w663Pbz8e+8pjoMz1FaGeU740v3HGmZFacbuBjwMiyNTkcequ0M6UxFRYtlVfsANbIrqXMaMiCClbaW3s0KrZ1Il53OxMrTfx3gNPFn9DPhd; lastSeen=1707417371728
2024-02-08 18:36:13 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:13 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=b42582ce3c4e005e&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejKWs8hUD6o4HWh5mTBmeI4_e-F8WJeTiE8 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7db19e3781edb64ef4f7023d2c25783e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: wfniB3aD-ITf8GIceqGlgKfqcE7hJt6uBHfNZDrZudKl2VNQ0yGZwA==
2024-02-08 18:36:13 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
576	192.168.2.5	50406	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	1536	OUT	GET /pagead/1p-user-list/973712236/?random=1707417370629&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=8GRyCJ3Eq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_wfHMD_o_GGHspVDwQ0qsVavCvt1YdLyJ8OCUdqTkuws2io1Q&random=3777251294&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:13 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:13 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:13 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
577	192.168.2.5	50403	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	3470	OUT	GET /js_tracking?sid=5171fc655664ddf74ab763a094523fb7&aid=304142&ref_action=index&ver=2&pid=87e482caf42702d0&lang=en-us&stype=1&ete=&etg=&etcg=cCHObKdPHMfFdHMEKdbfZRLRMLFSZaTaTaET\|1&ets=cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6&etgwv=&m=UmFuZG9tSVYkc2RlIyh9YUe5zZbLHt0YNre0CiGBBmP5hKTY_IzZqpWBtitYrnE-ba2NOPqZSPGdnbkQM2vO343hpsChBnayfrRG7jVW0hI1Ke4kKZ85U_m7O1xbR8NLSlv2Zn-4d5ku6anu7qAZgjoLQxWZjIis3cNA3ef3I_aOxDvMotUV5ZQc6OhcEEody8ooGsshLIhRMDad6kRNg_HeFvW36Wr8mOnNh6fMuy8OZ9w095BIb2XL0zt8fY-5SPQHxgI7NWrdI31vzPG5nOwkA1lE2mJxFh3z4YXPwcZPq5z6drlkg3iN9tdtKjt0cXf7rJdLIbIGLmOniyEf0g HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEcx%2FNBSM7hcmxfYRvnB2G9PFWrc9JWtc80%2BB7O9mau%2Fq%2F%2BQmqj8vmO7zmkRYgjc%2BJMYUHnygfC%2FFBh8jDDTeAvsn%2BiKEgv%2FBXfiRGJQAB8jx9PUIZybt6czbgdtg4epkv4DQISO29Dru4mhOYkQiObM%3D; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAg3CB3gkXAAAA:MjKO1hr2vGact9YeJE5WV1SAFZSdmyXEMmZGTBuMPoy2hCiHblFE1oJwqh74w2wYkPQpYmZm5TaLgscyzfAef0bGCVE84BqDPwyU6udlMs8GCG3PzswQ9vLdMJ3eBNxPiebxsmVae4EF0T/m8gLa4JND0Sx7w663Pbz8e+8pjoMz1FaGeU740v3HGmZFacbuBjwMiyNTkcequ0M6UxFRYtlVfsANbIrqXMaMiCClbaW3s0KrZ1Il53OxMrTfx3gNPFn9DPhd; lastSeen=1707417371728
2024-02-08 18:36:13 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:13 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=ed2e82ce5f9f01fa&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejJTCinxt4kka3KGNHd9gyZrHw-Gkhr7HWU x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 ea0f86c249e022d5015ce79f54e723d0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: ga7d6OjcJiIfkU-rH08M1o_L_Hm9_iur9FtWnifCucc0hFiLjcUiZg==
2024-02-08 18:36:13 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
578	192.168.2.5	50405	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	2841	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhBQaaLhV81ZEcx%2FNBSM7hcmxfYRvnB2G9PFWrc9JWtc80%2BB7O9mau%2Fq%2F%2BQmqj8vmO7zmkRYgjc%2BJMYUHnygfC%2FFBh8jDDTeAvsn%2BiKEgv%2FBXfiRGJQAB8jx9PUIZybt6czbgdtg4epkv4DQISO29Dru4mhOYkQiObM%3D; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAg3CB3gkXAAAA:MjKO1hr2vGact9YeJE5WV1SAFZSdmyXEMmZGTBuMPoy2hCiHblFE1oJwqh74w2wYkPQpYmZm5TaLgscyzfAef0bGCVE84BqDPwyU6udlMs8GCG3PzswQ9vLdMJ3eBNxPiebxsmVae4EF0T/m8gLa4JND0Sx7w663Pbz8e+8pjoMz1FaGeU740v3HGmZFacbuBjwMiyNTkcequ0M6UxFRYtlVfsANbIrqXMaMiCClbaW3s0KrZ1Il53OxMrTfx3gNPFn9DPhd; lastSeen=1707417371728
2024-02-08 18:36:13 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:13 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=0d8b82cedd7c0185&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsvxivuPoDMflyP-UGZsI8Og_Rh3OUoBFTE x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 25d9b5959eaa82bb18ee3f35e6bf34b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: -K0tf0-JfPmt7zfsbmkIElectIk9X8ye9JlOCeUaOY9SiRlS81wb9w==
2024-02-08 18:36:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
579	192.168.2.5	50404	18.67.65.100	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:13 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Thu, 08 Feb 2024 18:36:13 GMT X-Cache: Error from cloudfront Via: 1.1 cea67f5ca1b497624430e599aa6b7c62.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: X2sGZFfXGtUWjiqTV0K7gR16qjcHqQ_p1PT8YZ3GgmlT8YArWONcUQ==
2024-02-08 18:36:13 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
580	192.168.2.5	50407	151.101.128.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	1950	OUT	GET /v3/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%226461a31a%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1707417371159 HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZkbWZLdDFSY2k0RytCMHNLTDhuVWhuQit1d1gzb2tkNjRDaHFUR2NwSy9hK25KRVljS2dwMUxocE53VFhBWmNEQUJYSEV6eURmdGtxL29kcXhpTnAyM0d6S1c1NzBROHppc083NktsbU9vZz0mY0M4cWljSXAxaDlIOFVBazhiS3FNM2xZeGtjPQ=="
2024-02-08 18:36:13 UTC	594	IN	HTTP/1.1 200 OK Connection: close Content-Length: 35 cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT content-type: image/gif access-control-allow-origin: * set-cookie: ar_debug=1; Expires=Fri, 07 Feb 2025 18:36:13 GMT; Path=/; Domain=.pinterest.com; Secure; HTTPOnly; SameSite=None x-envoy-upstream-service-time: 1 referrer-policy: origin x-pinterest-rid: 1410450268047529 Date: Thu, 08 Feb 2024 18:36:13 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: f9d1c7100d6ab6a9fc70375cea0fca5e275d3fa9
2024-02-08 18:36:13 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
581	192.168.2.5	50408	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	1536	OUT	GET /pagead/1p-user-list/973712236/?random=1707417370647&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=LJXqCKDEq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_LzMeppNpbu0uxxfgLr4cbwIUIsaW9vg634KHtXqQFMU7_h7j&random=1362733946&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:13 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:13 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:13 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
582	192.168.2.5	50409	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:12 UTC	1534	OUT	GET /pagead/1p-user-list/975716499/?random=1707417370676&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=BcW9COaWsFgQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_CrvmsnkrL4j8rnj7_ZOlfIaZanCgUCGkQWsiv5XQISf9Bc9m&random=76924871&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:13 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:13 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:13 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
583	192.168.2.5	50410	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:13 UTC	1536	OUT	GET /pagead/1p-user-list/975716499/?random=1707417370697&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=mzmpCMbAq1gQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_TZaZIOlEuym-CAVb6ThpCoKygR4gz3I5SBnm0V9VIC71TcTV&random=4201010768&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:13 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:13 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:13 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
584	192.168.2.5	50411	151.101.128.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:13 UTC	2153	OUT	GET /v3/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1707417371889&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA%22%2C%22aem_eligible_list%22%3A%5B%22fn%22%5D%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%226461a31a%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZkbWZLdDFSY2k0RytCMHNLTDhuVWhuQit1d1gzb2tkNjRDaHFUR2NwSy9hK25KRVljS2dwMUxocE53VFhBWmNEQUJYSEV6eURmdGtxL29kcXhpTnAyM0d6S1c1NzBROHppc083NktsbU9vZz0mY0M4cWljSXAxaDlIOFVBazhiS3FNM2xZeGtjPQ=="
2024-02-08 18:36:13 UTC	914	IN	HTTP/1.1 200 OK Connection: close Content-Length: 35 cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT content-type: image/gif access-control-allow-origin: * set-cookie: ar_debug=1; Expires=Fri, 07 Feb 2025 18:36:13 GMT; Path=/; Domain=.pinterest.com; Secure; HTTPOnly; SameSite=None set-cookie: _pinterest_ct_ua="TWc9PSZPbFhNRFVSUkFJRnZXZjRkVnVmUkkrZ1d2TzlKbEJWUUZMeitQeWNQazNzYWVteFJaU3NUZktHY0ZwRlRmTlYzdTdkYU5lU3RFRGdnSGFyOEtJWk5IL2JiakJuWE9hQXVkOFdIcjYvTi9zOD0mRG5sSitYRzNlTjRhYTk0OTFhdVZISDhTUUswPQ=="; Expires=Fri, 07 Feb 2025 18:36:13 GMT; Path=/; Domain=ct.pinterest.com; Secure; SameSite=None x-envoy-upstream-service-time: 3 referrer-policy: origin x-pinterest-rid: 1468354276875033 Date: Thu, 08 Feb 2024 18:36:13 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: f9d1c7100d6ab6a9fc70375cea0fca5e275d3fa9
2024-02-08 18:36:13 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
585	192.168.2.5	50412	64.233.185.138	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:13 UTC	616	OUT	HEAD / HTTP/1.1 Host: www3.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:13 UTC	474	IN	HTTP/1.1 301 Moved Permanently Location: https://marketingplatform.google.com/about/enterprise/ Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff Server: sffe Content-Length: 251 X-XSS-Protection: 0 Date: Thu, 08 Feb 2024 18:14:42 GMT Expires: Thu, 08 Feb 2024 18:44:42 GMT Cache-Control: public, max-age=1800 Content-Type: text/html; charset=UTF-8 Age: 1291 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
586	192.168.2.5	50415	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:13 UTC	4027	OUT	POST /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 351 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNzQxNzM2NSwiZXhwIjoxNzA3NTAzNzY1fQ.IxZs5q4mHH8jrJaIRLcnINpQipyjA8tJVAcTBmMxb-iUTxayqCNH7M9Yb-qC3txr1MR-MztiIYI4VYNV7sXWUw x-booking-et-serialized-state: ESNA6-jww5PiZzyK_LfXmqWii5kpdRkL6a6nI9I91DYrlgCDdZE8nYAOQCA6hUpfE x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: 87e482caf42702d0 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAg3CB3gkXAAAA:MjKO1hr2vGact9YeJE5WV1SAFZSdmyXEMmZGTBuMPoy2hCiHblFE1oJwqh74w2wYkPQpYmZm5TaLgscyzfAef0bGCVE84BqDPwyU6udlMs8GCG3PzswQ9vLdMJ3eBNxPiebxsmVae4EF0T/m8gLa4JND0Sx7w663Pbz8e+8pjoMz1FaGeU740v3HGmZFacbuBjwMiyNTkcequ0M6UxFRYtlVfsANbIrqXMaMiCClbaW3s0KrZ1Il53OxMrTfx3gNPFn9DPhd; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPeeiS3HjtTZXkOelfN%2BTRHp5819aBVKUAWU8d6iXTYJyw%2FIPv4OCtUyuUq%2BVrS0WPtY38QJCqNkBX7o%2B2RRpjlx61DSmT7ufG1ri1CRFdQhX2zgjGT6dOcSaEzhDNd8bC3m%2FEZlK%2BzITAWgJ8rsgX6dWJnl%2BKVPp8Ic%3D
2024-02-08 18:36:13 UTC	351	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 5f 73 74 61 67 65 22 3a 22 61 64 5f 73 6c 6f 74 5f 63 72 65 61 74 65 64 22 2c 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 55 4e 4b 4e 4f 57 4e 22 2c 22 73 69 74 65 5f 74 79 70 65 22 3a 22 57 57 57 22 2c 22 76 69 73 69 74 6f 72 5f 63 63 22 3a 22 75 73 22 2c 22 61 64 5f 70 6f 73 69 74 69 6f 6e 22 3a 22 49 4e 44 45 58 5f 50 52 49 4d 41 52 59 22 2c 22 70 61 67 65 6e 61 6d 65 22 3a 22 49 4e 44 45 58 22 2c 22 76 65 72 74 69 63 61 6c 22 3a 22 41 43 43 4f 4d 4d 4f 44 41 54 49 4f 4e 53 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 6d 75 74 Data Ascii: {"operationName":"trackAdStatus","variables":{"input":{"action_stage":"ad_slot_created","campaign_id":"UNKNOWN","site_type":"WWW","visitor_cc":"us","ad_position":"INDEX_PRIMARY","pagename":"INDEX","vertical":"ACCOMMODATIONS"}},"extensions":{},"query":"mut
2024-02-08 18:36:13 UTC	1097	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 361 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:13 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPefAa3RNRy8D5EaUijXn8pYZ0AdPv4%2BMbriobJ67L2stqv7YU5QJ1fjxGFYP4mT0bbLasX7gLSHb9mxztI6dJsxhftnQinMc1eB1dMX4Ttz%2FBD9eJec%2FNi9qUJKL%2BpvGgrObH04Tp%2F6ybzTmlJLj9QPP5IZLSP3enVE%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:13 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=26dd82ce9d59010b&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGbCSIgozB-titOWRvNnpMeR6QdjEUWgk5w x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 fcb94596db202c75ac0e559b3183be72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: PlxzySM7RwEVU-5hkCrR8hqXxKZsCniqvboDGqFhfPjFb5bnO1atOQ==
2024-02-08 18:36:13 UTC	361	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 3a 7b 22 65 78 74 65 6e 73 69 6f 6e 44 65 66 69 6e 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 61 6c 6c 41 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 41 20 4a 53 4f 4e 20 73 63 61 6c 61 72 22 2c 22 63 68 69 6c 64 72 65 6e 57 69 74 68 54 79 70 65 52 65 66 65 72 65 6e 63 65 73 22 3a 7b 22 63 68 69 6c 64 72 65 6e 41 73 4c 69 73 74 22 3a 5b 5d 2c 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 7d 2c 22 65 6d 70 74 79 22 3a 66 61 6c 73 65 7d 2c 22 63 6f 65 72 63 69 6e 67 22 3a 7b 7d 2c 22 61 6c 6c 44 69 72 65 63 74 Data Ascii: {"data":{"trackAdStatus":{"extensionDefinitions":[],"allAppliedDirectivesByName":{},"description":"A JSON scalar","childrenWithTypeReferences":{"childrenAsList":[],"children":{"appliedDirectives":[],"directives":[]},"empty":false},"coercing":{},"allDirect

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
587	192.168.2.5	50413	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:13 UTC	4129	OUT	POST /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 6889 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNzQxNzM2NSwiZXhwIjoxNzA3NTAzNzY1fQ.IxZs5q4mHH8jrJaIRLcnINpQipyjA8tJVAcTBmMxb-iUTxayqCNH7M9Yb-qC3txr1MR-MztiIYI4VYNV7sXWUw x-booking-et-serialized-state: ESNA6-jww5PiZzyK_LfXmqWii5kpdRkL6a6nI9I91DYrlgCDdZE8nYAOQCA6hUpfE x-booking-site-type-id: 1 x-booking-pageview-id: 87e482caf42702d0 x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAg3CB3gkXAAAA:MjKO1hr2vGact9YeJE5WV1SAFZSdmyXEMmZGTBuMPoy2hCiHblFE1oJwqh74w2wYkPQpYmZm5TaLgscyzfAef0bGCVE84BqDPwyU6udlMs8GCG3PzswQ9vLdMJ3eBNxPiebxsmVae4EF0T/m8gLa4JND0Sx7w663Pbz8e+8pjoMz1FaGeU740v3HGmZFacbuBjwMiyNTkcequ0M6UxFRYtlVfsANbIrqXMaMiCClbaW3s0KrZ1Il53OxMrTfx3gNPFn9DPhd; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPeeiS3HjtTZXkOelfN%2BTRHp5819aBVKUAWU8d6iXTYJyw%2FIPv4OCtUyuUq%2BVrS0WPtY38QJCqNkBX7o%2B2RRpjlx61DSmT7ufG1ri1CRFdQhX2zgjGT6dOcSaEzhDNd8bC3m%2FEZlK%2BzITAWgJ8rsgX6dWJnl%2BKVPp8Ic%3D
2024-02-08 18:36:13 UTC	6889	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 4d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6d 61 67 65 57 69 64 74 68 22 3a 33 32 30 2c 22 69 6d 61 67 65 48 65 69 67 68 74 22 3a 34 30 30 2c 22 69 6e 70 75 74 22 3a 7b 22 74 65 73 74 43 61 6d 70 61 69 67 6e 49 64 73 22 3a 5b 5d 2c 22 63 61 6d 70 61 69 67 6e 49 64 73 22 3a 5b 22 64 65 38 37 30 65 33 61 2d 62 61 39 31 2d 34 36 30 35 2d 39 62 62 31 2d 36 31 65 61 64 31 61 66 63 36 38 34 22 5d 2c 22 63 61 72 6f 75 73 65 6c 49 6e 70 75 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 49 6e 70 75 74 22 3a 5b 7b 22 63 61 6d 70 61 69 67 6e 49 64 22 3a 22 64 65 38 37 30 65 33 61 2d 62 61 39 31 2d 34 36 30 35 2d 39 62 62 31 2d 36 31 65 61 64 31 61 66 63 36 Data Ascii: {"operationName":"MerchComponentsData","variables":{"imageWidth":320,"imageHeight":400,"input":{"testCampaignIds":[],"campaignIds":["de870e3a-ba91-4605-9bb1-61ead1afc684"],"carouselInput":{"campaignInput":[{"campaignId":"de870e3a-ba91-4605-9bb1-61ead1afc6
2024-02-08 18:36:13 UTC	1103	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 16332 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:13 GMT vary: Accept-Encoding, User-Agent set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbnmKTRaewPBtrc9jcR8FHAZMgVsPDpO7k61zYzfvcAjZN%2BRki3c7UB3918wAejvzi2%2F5u%2FpvyO2PgFPLNBQ%2FO3kErbxP1JjxhVSuQYLDnGm5hmNE%2BRaEGrzpKQ2bGC6w5bwvj7%2Fkp%2BnEttpDl7mjDoqa0w904IausV0pKTNkr6FA%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:13 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=e47382ce4ada00a9&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGfrfXpydJjhkMVpn1rYDfd5pmam3MGt3Rw x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 31113f2f23c4ce8a8af1d88a37137806.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: exlJeiakTQq-TLmy-8koTdPEnaqg4UGh3j5tual1Ym6c4QMPsqlFKg==
2024-02-08 18:36:13 UTC	15125	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 6d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 22 3a 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 4d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 52 65 73 75 6c 74 22 2c 22 63 6f 6d 70 6f 6e 65 6e 74 73 22 3a 5b 7b 22 73 75 62 48 65 61 64 69 6e 67 22 3a 6e 75 6c 6c 2c 22 63 61 72 6f 75 73 65 6c 43 61 6d 70 61 69 67 6e 49 64 22 3a 22 64 65 38 37 30 65 33 61 2d 62 61 39 31 2d 34 36 30 35 2d 39 62 62 31 2d 36 31 65 61 64 31 61 66 63 36 38 34 22 2c 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 4d 65 72 63 68 43 61 72 6f 75 73 65 6c 22 2c 22 68 65 61 64 69 6e 67 22 3a 22 42 72 6f 77 73 65 20 62 79 20 70 72 6f 70 65 72 74 79 20 74 79 70 65 22 2c 22 66 69 6c 74 65 72 73 49 6e 66 6f 22 3a 6e 75 6c 6c 2c 22 64 65 73 69 Data Ascii: {"data":{"merchComponentsData":{"__typename":"MerchComponentsDataResult","components":[{"subHeading":null,"carouselCampaignId":"de870e3a-ba91-4605-9bb1-61ead1afc684","__typename":"MerchCarousel","heading":"Browse by property type","filtersInfo":null,"desi
2024-02-08 18:36:13 UTC	1207	IN	Data Raw: 69 74 6c 65 22 3a 22 22 2c 22 69 6d 61 67 65 22 3a 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 4d 65 72 63 68 43 61 72 6f 75 73 65 6c 49 74 65 6d 49 6d 61 67 65 22 2c 22 75 72 6c 54 65 6d 70 6c 61 74 65 22 3a 22 68 74 74 70 73 3a 2f 2f 71 2d 78 78 2e 62 73 74 61 74 69 63 2e 63 6f 6d 2f 78 64 61 74 61 2f 69 6d 61 67 65 73 2f 78 70 68 6f 74 6f 2f 3c 53 49 5a 45 3e 2f 34 35 34 35 30 30 37 35 2e 6a 70 65 67 3f 6b 3d 64 32 33 63 66 38 34 34 33 37 38 30 61 63 30 39 66 34 36 66 35 39 65 34 30 33 39 33 64 37 35 64 62 65 36 34 62 30 36 30 32 39 62 34 39 35 39 63 36 30 62 38 31 62 37 66 64 65 66 63 39 62 65 30 26 6f 3d 22 2c 22 69 64 22 3a 34 35 34 35 30 30 37 35 2c 22 61 6c 74 22 3a 22 53 65 6c 66 2d 63 61 74 65 72 69 6e 67 20 41 63 63 6f 6d 6d 6f 64 61 74 69 6f Data Ascii: itle":"","image":{"__typename":"MerchCarouselItemImage","urlTemplate":"https://q-xx.bstatic.com/xdata/images/xphoto/<SIZE>/45450075.jpeg?k=d23cf8443780ac09f46f59e40393d75dbe64b06029b4959c60b81b7fdefc9be0&o=","id":45450075,"alt":"Self-catering Accommodatio

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
588	192.168.2.5	50414	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:13 UTC	4129	OUT	POST /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 6889 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNzQxNzM2NSwiZXhwIjoxNzA3NTAzNzY1fQ.IxZs5q4mHH8jrJaIRLcnINpQipyjA8tJVAcTBmMxb-iUTxayqCNH7M9Yb-qC3txr1MR-MztiIYI4VYNV7sXWUw x-booking-et-serialized-state: ESNA6-jww5PiZzyK_LfXmqWii5kpdRkL6a6nI9I91DYrlgCDdZE8nYAOQCA6hUpfE x-booking-site-type-id: 1 x-booking-pageview-id: 87e482caf42702d0 x-booking-topic: capla_browser_b-index-lp-web-mfe x-booking-timeout-ms: 1500 x-booking-context-action-name: index sec-ch-ua-platform: "Windows" x-booking-context-aid: 304142 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json accept: / x-booking-timeout-budget-ms: 1500 x-envoy-expected-rq-timeout-ms: 1500 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAg3CB3gkXAAAA:MjKO1hr2vGact9YeJE5WV1SAFZSdmyXEMmZGTBuMPoy2hCiHblFE1oJwqh74w2wYkPQpYmZm5TaLgscyzfAef0bGCVE84BqDPwyU6udlMs8GCG3PzswQ9vLdMJ3eBNxPiebxsmVae4EF0T/m8gLa4JND0Sx7w663Pbz8e+8pjoMz1FaGeU740v3HGmZFacbuBjwMiyNTkcequ0M6UxFRYtlVfsANbIrqXMaMiCClbaW3s0KrZ1Il53OxMrTfx3gNPFn9DPhd; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPeeiS3HjtTZXkOelfN%2BTRHp5819aBVKUAWU8d6iXTYJyw%2FIPv4OCtUyuUq%2BVrS0WPtY38QJCqNkBX7o%2B2RRpjlx61DSmT7ufG1ri1CRFdQhX2zgjGT6dOcSaEzhDNd8bC3m%2FEZlK%2BzITAWgJ8rsgX6dWJnl%2BKVPp8Ic%3D
2024-02-08 18:36:13 UTC	6889	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 4d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6d 61 67 65 57 69 64 74 68 22 3a 33 32 30 2c 22 69 6d 61 67 65 48 65 69 67 68 74 22 3a 34 30 30 2c 22 69 6e 70 75 74 22 3a 7b 22 74 65 73 74 43 61 6d 70 61 69 67 6e 49 64 73 22 3a 5b 5d 2c 22 63 61 6d 70 61 69 67 6e 49 64 73 22 3a 5b 22 32 35 33 31 32 61 36 65 2d 34 66 61 32 2d 34 61 65 61 2d 39 31 64 34 2d 64 39 64 66 32 35 63 33 32 63 61 64 22 5d 2c 22 63 61 72 6f 75 73 65 6c 49 6e 70 75 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 49 6e 70 75 74 22 3a 5b 7b 22 63 61 6d 70 61 69 67 6e 49 64 22 3a 22 32 35 33 31 32 61 36 65 2d 34 66 61 32 2d 34 61 65 61 2d 39 31 64 34 2d 64 39 64 66 32 35 63 33 32 63 Data Ascii: {"operationName":"MerchComponentsData","variables":{"imageWidth":320,"imageHeight":400,"input":{"testCampaignIds":[],"campaignIds":["25312a6e-4fa2-4aea-91d4-d9df25c32cad"],"carouselInput":{"campaignInput":[{"campaignId":"25312a6e-4fa2-4aea-91d4-d9df25c32c
2024-02-08 18:36:13 UTC	1100	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 8061 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:13 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWznlSlRZNNCt3uSEWppJCYH5UGl9iFAS0hRvnoDzV%2F9%2F%2BfyMxxnuDboJByeQy4QpAWQ1n9MnXYEPV54RzFUrR9t3krXybyAVo2ERA%2B6pdxEq4eTdq%2B9i9ZsUX1zgn%2BEjrZExYPzAVPsjdEqlkIqPnaSwp41dgr4jOaU%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:13 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=a1aa82ced5d401a6&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGbwC-NOeKiIXOQAipAQFqpL2Zg8FcYW4Hg x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 6e0f9dce97fcb3c9b684592a289e4e72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: LfipHr_KMwq92Kdqph4kvD-8y-86bY4y3kzNOl3c8hBbtIrPKr2CHw==
2024-02-08 18:36:13 UTC	8061	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 6d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 22 3a 7b 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 4d 65 72 63 68 43 6f 6d 70 6f 6e 65 6e 74 73 44 61 74 61 52 65 73 75 6c 74 22 2c 22 63 6f 6d 70 6f 6e 65 6e 74 73 22 3a 5b 7b 22 68 65 61 64 69 6e 67 22 3a 22 45 78 70 6c 6f 72 65 20 55 6e 69 74 65 64 20 53 74 61 74 65 73 20 6f 66 20 41 6d 65 72 69 63 61 22 2c 22 66 69 6c 74 65 72 73 49 6e 66 6f 22 3a 6e 75 6c 6c 2c 22 63 61 72 6f 75 73 65 6c 43 61 6d 70 61 69 67 6e 49 64 22 3a 22 32 35 33 31 32 61 36 65 2d 34 66 61 32 2d 34 61 65 61 2d 39 31 64 34 2d 64 39 64 66 32 35 63 33 32 63 61 64 22 2c 22 73 75 62 48 65 61 64 69 6e 67 22 3a 22 54 68 65 73 65 20 70 6f 70 75 6c 61 72 20 64 65 73 74 69 6e 61 74 69 6f 6e 73 20 68 61 Data Ascii: {"data":{"merchComponentsData":{"__typename":"MerchComponentsDataResult","components":[{"heading":"Explore United States of America","filtersInfo":null,"carouselCampaignId":"25312a6e-4fa2-4aea-91d4-d9df25c32cad","subHeading":"These popular destinations ha

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
589	192.168.2.5	50416	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:13 UTC	718	OUT	POST /p HTTP/1.1 Host: tr6.snapchat.com Connection: keep-alive Content-Length: 1091 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:13 UTC	1091	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 36 39 37 39 39 62 31 2d 62 32 62 32 2d 34 30 66 38 2d 38 65 36 66 2d 32 38 30 39 62 39 63 36 66 31 61 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 63 36 34 61 61 33 37 30 2d 63 33 34 33 2d 34 36 65 34 2d 62 31 61 34 2d 33 30 61 37 64 63 39 63 33 31 36 39 22 2c 22 73 73 22 3a 22 30 32 34 37 38 38 37 34 2d 61 32 37 37 2d 34 36 35 63 2d 62 39 65 37 2d 63 65 32 34 31 32 32 33 32 65 34 66 22 2c 22 64 66 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"f69799b1-b2b2-40f8-8e6f-2809b9c6f1a0","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"c64aa370-c343-46e4-b1a4-30a7dc9c3169","ss":"02478874-a277-465c-b9e7-ce2412232e4f","df":true,"s
2024-02-08 18:36:13 UTC	429	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:13 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
590	192.168.2.5	50418	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:13 UTC	4819	OUT	GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=87e482caf42702d0&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|4,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|2,cCHObKdBdUHINPSXeHDALOLOLMO\|5,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-ET-Serialized-State: ESNA6-jww5PiZzyK_LfXmqWii5kpdRkL6a6nI9I91DYrlgCDdZE8nYAOQCA6hUpfE X-Booking-Language-Code: en-us X-Booking-Client-Info: sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: 87e482caf42702d0 X-Booking-Info: X-Booking-SiteType-Id: 1 X-Booking-Session-Id: db6e5bbb32eac0e80cfcae9b22f5390d sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAg3CB3gkXAAAA:MjKO1hr2vGact9YeJE5WV1SAFZSdmyXEMmZGTBuMPoy2hCiHblFE1oJwqh74w2wYkPQpYmZm5TaLgscyzfAef0bGCVE84BqDPwyU6udlMs8GCG3PzswQ9vLdMJ3eBNxPiebxsmVae4EF0T/m8gLa4JND0Sx7w663Pbz8e+8pjoMz1FaGeU740v3HGmZFacbuBjwMiyNTkcequ0M6UxFRYtlVfsANbIrqXMaMiCClbaW3s0KrZ1Il53OxMrTfx3gNPFn9DPhd; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPeeiS3HjtTZXkOelfN%2BTRHp5819aBVKUAWU8d6iXTYJyw%2FIPv4OCtUyuUq%2BVrS0WPtY38QJCqNkBX7o%2B2RRpjlx61DSmT7ufG1ri1CRFdQhX2zgjGT6dOcSaEzhDNd8bC3m%2FEZlK%2BzITAWgJ8rsgX6dWJnl%2BKVPp8Ic%3D
2024-02-08 18:36:13 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:13 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=52dc82ced7f5030f&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejIzc69jyapHhEmiGg42OilRieYm8FERs5I x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7db19e3781edb64ef4f7023d2c25783e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: HWMV7kPN9ALhwclxyVTJfGH5GXpYbQyN_22_3f50PSgP5bWPB-ngBw==
2024-02-08 18:36:13 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
591	192.168.2.5	50420	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:13 UTC	4027	OUT	POST /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 423 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNzQxNzM2NSwiZXhwIjoxNzA3NTAzNzY1fQ.IxZs5q4mHH8jrJaIRLcnINpQipyjA8tJVAcTBmMxb-iUTxayqCNH7M9Yb-qC3txr1MR-MztiIYI4VYNV7sXWUw x-booking-et-serialized-state: ESNA6-jww5PiZzyK_LfXmqWii5kpdRkL6a6nI9I91DYrlgCDdZE8nYAOQCA6hUpfE x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: 87e482caf42702d0 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAg3CB3gkXAAAA:MjKO1hr2vGact9YeJE5WV1SAFZSdmyXEMmZGTBuMPoy2hCiHblFE1oJwqh74w2wYkPQpYmZm5TaLgscyzfAef0bGCVE84BqDPwyU6udlMs8GCG3PzswQ9vLdMJ3eBNxPiebxsmVae4EF0T/m8gLa4JND0Sx7w663Pbz8e+8pjoMz1FaGeU740v3HGmZFacbuBjwMiyNTkcequ0M6UxFRYtlVfsANbIrqXMaMiCClbaW3s0KrZ1Il53OxMrTfx3gNPFn9DPhd; lastSeen=0; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPeeiS3HjtTZXkOelfN%2BTRHp5819aBVKUAWU8d6iXTYJyw%2FIPv4OCtUyuUq%2BVrS0WPtY38QJCqNkBX7o%2B2RRpjlx61DSmT7ufG1ri1CRFdQhX2zgjGT6dOcSaEzhDNd8bC3m%2FEZlK%2BzITAWgJ8rsgX6dWJnl%2BKVPp8Ic%3D
2024-02-08 18:36:13 UTC	423	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 47 65 6e 69 75 73 53 69 67 6e 49 6e 53 68 65 65 74 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 50 61 67 65 22 3a 22 69 6e 64 65 78 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 47 65 6e 69 75 73 53 69 67 6e 49 6e 53 68 65 65 74 28 24 69 6e 70 75 74 3a 20 47 65 6e 69 75 73 53 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 49 6e 70 75 74 21 29 20 7b 5c 6e 20 20 67 65 6e 69 75 73 47 75 65 73 74 44 61 74 61 20 7b 5c 6e 20 20 20 20 73 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 28 69 6e 70 75 74 3a 20 24 69 6e 70 75 74 29 20 7b 5c 6e 20 20 20 20 20 20 74 69 74 6c 65 5c 6e 20 20 20 20 20 20 73 75 Data Ascii: {"operationName":"GeniusSignInSheet","variables":{"input":{"actionPage":"index"}},"extensions":{},"query":"query GeniusSignInSheet($input: GeniusSignInBottomSheetInput!) {\n geniusGuestData {\n signInBottomSheet(input: $input) {\n title\n su
2024-02-08 18:36:13 UTC	1102	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 89 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:13 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZj4oP0EZv%2FxYqexdp6tFywzXVcF0ngF4tz2JSGUyf3WdYfq6Hm9RX6L9KB7%2BAy6I7K5fOizc8JLtTV2qKNY0uP5YlBIvHtTWMUsFythle%2BMqRKa%2BPBTt%2BBw%2FQndkL4Jypf6vKcrbId3WJRfOl959l%2F8%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:13 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=c37b82ce6c9800ba&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGUtaFx2Yev_KXSWwPSl6DsL6AbyNTBigLw x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 61bbe72b71f7b857c695c31fdeb7b3a6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: R7ufgqHxH2ah9gFTn7OiTNR03quwfa-A3w5c6KyL1MvYuY4xlN0mbw==
2024-02-08 18:36:13 UTC	89	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 67 65 6e 69 75 73 47 75 65 73 74 44 61 74 61 22 3a 7b 22 73 69 67 6e 49 6e 42 6f 74 74 6f 6d 53 68 65 65 74 22 3a 6e 75 6c 6c 2c 22 5f 5f 74 79 70 65 6e 61 6d 65 22 3a 22 47 65 6e 69 75 73 47 75 65 73 74 51 75 65 72 69 65 73 22 7d 7d 7d Data Ascii: {"data":{"geniusGuestData":{"signInBottomSheet":null,"__typename":"GeniusGuestQueries"}}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
592	192.168.2.5	50421	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:13 UTC	717	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 8742 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:13 UTC	8742	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 36 39 37 39 39 62 31 2d 62 32 62 32 2d 34 30 66 38 2d 38 65 36 66 2d 32 38 30 39 62 39 63 36 66 31 61 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 34 61 65 61 61 30 36 66 2d 35 62 36 30 2d 34 63 65 30 2d 38 36 34 34 2d 35 63 36 38 38 65 33 34 38 61 66 39 22 2c 22 73 73 22 3a 22 30 32 34 37 38 38 37 34 2d 61 32 37 37 2d 34 36 35 63 2d 62 39 65 37 2d 63 65 32 34 31 32 32 33 32 65 34 66 22 2c 22 64 66 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"f69799b1-b2b2-40f8-8e6f-2809b9c6f1a0","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"4aeaa06f-5b60-4ce0-8644-5c688e348af9","ss":"02478874-a277-465c-b9e7-ce2412232e4f","df":true,"s
2024-02-08 18:36:13 UTC	523	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:13 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 2 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
593	192.168.2.5	50422	142.250.9.132	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:13 UTC	859	OUT	GET /safeframe/1-0-40/html/container.html HTTP/1.1 Host: 8ef290e4a40aabf645d441eeb66eb6e1.safeframe.googlesyndication.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:13 UTC	707	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/html Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="ads-gpt-scs" Report-To: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} Timing-Allow-Origin: * Content-Length: 6162 Date: Thu, 08 Feb 2024 18:36:13 GMT Expires: Fri, 07 Feb 2025 18:36:13 GMT Cache-Control: public, immutable, max-age=31536000 Last-Modified: Thu, 03 Nov 2022 19:10:08 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:13 UTC	545	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 61 66 65 46 72 61 6d 65 20 43 6f 6e 74 61 69 6e 65 72 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 2f 2a 0a 0a 20 43 6f 70 79 72 69 67 68 74 20 54 68 65 20 43 6c 6f 73 75 72 65 20 4c 69 62 72 61 72 79 20 41 75 74 68 6f 72 73 2e 0a 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 0a 2a 2f 0a 76 61 72 20 66 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 68 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7d 3b 76 61 72 20 6e 3d 66 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="UTF-8"> <title>SafeFrame Container</title> <script>(function(){/* Copyright The Closure Library Authors. SPDX-License-Identifier: Apache-2.0*/var f=this\|\|self,h=function(a){return a};var n=f
2024-02-08 18:36:13 UTC	1252	IN	Data Raw: 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 67 6f 6f 67 23 68 74 6d 6c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 68 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 68 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 68 7d 29 7d 63 61 74 63 68 28 63 29 7b 66 2e 63 6f 6e 73 6f 6c 65 26 26 66 2e 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 63 2e 6d 65 73 73 61 67 65 29 7d 74 3d 61 7d 65 6c 73 65 20 74 3d 61 7d 72 65 74 75 72 6e 20 74 7d 3b 76 61 72 20 63 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 67 3d 62 61 3d 3d 3d 62 61 3f 61 3a 22 22 7d 3b 63 61 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 67 2b 22 22 7d 3b 76 61 72 20 62 61 3d 7b 7d 2c 64 61 3d 66 75 6e 63 74 69 Data Ascii: .createPolicy("goog#html",{createHTML:h,createScript:h,createScriptURL:h})}catch(c){f.console&&f.console.error(c.message)}t=a}else t=a}return t};var ca=function(a){this.g=ba===ba?a:""};ca.prototype.toString=function(){return this.g+""};var ba={},da=functi
2024-02-08 18:36:13 UTC	1252	IN	Data Raw: 74 68 69 73 2e 69 3d 22 26 22 3b 74 68 69 73 2e 68 3d 7b 7d 3b 74 68 69 73 2e 6f 3d 30 3b 74 68 69 73 2e 67 3d 5b 5d 7d 2c 7a 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 3d 7b 7d 3b 63 5b 61 5d 3d 62 3b 72 65 74 75 72 6e 5b 63 5d 7d 2c 71 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 29 7b 76 61 72 20 6b 3d 5b 5d 3b 6a 61 28 61 2c 66 75 6e 63 74 69 6f 6e 28 67 2c 41 29 7b 28 67 3d 70 61 28 67 2c 62 2c 63 2c 64 2c 65 29 29 26 26 6b 2e 70 75 73 68 28 41 2b 22 3d 22 2b 67 29 7d 29 3b 72 65 74 75 72 6e 20 6b 2e 6a 6f 69 6e 28 62 29 7d 2c 70 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 2c 65 29 7b 69 66 28 6e 75 6c 6c 3d 3d 61 29 72 65 74 75 72 6e 22 22 3b 62 3d 62 7c 7c 22 26 22 3b 63 3d 63 7c 7c 22 2c 24 22 3b 22 73 74 Data Ascii: this.i="&";this.h={};this.o=0;this.g=[]},z=function(a,b){var c={};c[a]=b;return[c]},qa=function(a,b,c,d,e){var k=[];ja(a,function(g,A){(g=pa(g,b,c,d,e))&&k.push(A+"="+g)});return k.join(b)},pa=function(a,b,c,d,e){if(null==a)return"";b=b\|\|"&";c=c\|\|",$";"st
2024-02-08 18:36:13 UTC	1252	IN	Data Raw: 28 29 3b 61 2e 6e 61 6d 65 26 26 2d 31 3d 3d 62 2e 69 6e 64 65 78 4f 66 28 61 2e 6e 61 6d 65 29 26 26 28 62 2b 3d 22 3a 20 22 2b 61 2e 6e 61 6d 65 29 3b 61 2e 6d 65 73 73 61 67 65 26 26 2d 31 3d 3d 62 2e 69 6e 64 65 78 4f 66 28 61 2e 6d 65 73 73 61 67 65 29 26 26 28 62 2b 3d 22 3a 20 22 2b 61 2e 6d 65 73 73 61 67 65 29 3b 69 66 28 61 2e 73 74 61 63 6b 29 7b 61 3d 61 2e 73 74 61 63 6b 3b 76 61 72 20 63 3d 62 3b 74 72 79 7b 2d 31 3d 3d 61 2e 69 6e 64 65 78 4f 66 28 63 29 26 26 28 61 3d 63 2b 22 5c 6e 22 2b 61 29 3b 66 6f 72 28 76 61 72 20 64 3b 61 21 3d 64 3b 29 64 3d 61 2c 61 3d 61 2e 72 65 70 6c 61 63 65 28 52 65 67 45 78 70 28 22 28 28 68 74 74 70 73 3f 3a 2f 2e 2e 2a 2f 29 5b 5e 2f 3a 5d 2a 3a 5c 5c 64 2b 28 3f 3a 2e 7c 5c 6e 29 2a 29 5c 5c 32 22 29 2c Data Ascii: ();a.name&&-1==b.indexOf(a.name)&&(b+=": "+a.name);a.message&&-1==b.indexOf(a.message)&&(b+=": "+a.message);if(a.stack){a=a.stack;var c=b;try{-1==a.indexOf(c)&&(a=c+"\n"+a);for(var d;a!=d;)d=a,a=a.replace(RegExp("((https?:/../)[^/:]:\\d+(?:.\|\n)*)\\2"),
2024-02-08 18:36:13 UTC	1252	IN	Data Raw: 5b 32 5d 2c 45 3d 43 5b 33 5d 3b 69 66 28 44 3e 45 2e 6c 65 6e 67 74 68 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 50 61 72 73 65 64 20 63 6f 6e 74 65 6e 74 20 73 69 7a 65 20 64 6f 65 73 6e 27 74 20 6d 61 74 63 68 2e 20 22 2b 44 2b 22 3a 22 2b 45 2e 6c 65 6e 67 74 68 29 3b 42 3d 7b 6d 3a 43 5b 31 5d 2c 63 6f 6e 74 65 6e 74 3a 45 2e 73 75 62 73 74 72 28 30 2c 44 29 2c 6c 3a 45 2e 73 75 62 73 74 72 28 44 29 7d 3b 76 61 72 20 46 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 42 2e 6c 29 3b 77 69 6e 64 6f 77 2e 6e 61 6d 65 3d 22 22 3b 76 61 72 20 42 61 3d 42 2e 63 6f 6e 74 65 6e 74 3b 46 2e 67 6f 6f 67 5f 73 61 66 65 66 72 61 6d 65 5f 68 6c 74 26 26 28 66 2e 67 6f 6f 67 5f 73 61 66 65 66 72 61 6d 65 5f 68 6c 74 3d 46 2e 67 6f 6f 67 5f 73 61 66 65 66 72 61 6d 65 5f 68 6c Data Ascii: [2],E=C[3];if(D>E.length)throw Error("Parsed content size doesn't match. "+D+":"+E.length);B={m:C[1],content:E.substr(0,D),l:E.substr(D)};var F=JSON.parse(B.l);window.name="";var Ba=B.content;F.goog_safeframe_hlt&&(f.goog_safeframe_hlt=F.goog_safeframe_hl
2024-02-08 18:36:13 UTC	609	IN	Data Raw: 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2c 21 31 29 2c 46 61 3d 6e 75 6c 6c 2c 55 3d 4b 2e 6c 65 6e 67 74 68 2d 31 2c 56 3d 55 3b 30 3c 3d 56 3b 2d 2d 56 29 7b 76 61 72 20 57 3d 4b 5b 56 5d 3b 21 46 61 26 26 6b 61 2e 74 65 73 74 28 57 2e 75 72 6c 29 26 26 28 46 61 3d 57 29 3b 69 66 28 57 2e 75 72 6c 26 26 21 57 2e 6a 29 7b 78 3d 57 3b 62 72 65 61 6b 7d 7d 76 61 72 20 6c 61 3d 6e 75 6c 6c 2c 47 61 3d 4b 2e 6c 65 6e 67 74 68 26 26 4b 5b 55 5d 2e 75 72 6c 3b 30 21 3d 78 2e 64 65 70 74 68 26 26 47 61 26 26 28 6c 61 3d 4b 5b 55 5d 29 3b 48 3d 6e 65 77 20 6d 61 3b 69 66 28 48 2e 68 29 7b 76 61 72 20 48 61 3d 48 2e 68 2e 75 72 6c 7c 7c 22 22 3b 49 2e 67 2e 70 75 73 68 28 34 29 3b 49 2e 68 5b 34 5d 3d 7a 28 22 74 6f 70 22 2c 48 61 29 7d 76 61 72 20 49 61 3d 7b Data Ascii: .location.href,!1),Fa=null,U=K.length-1,V=U;0<=V;--V){var W=K[V];!Fa&&ka.test(W.url)&&(Fa=W);if(W.url&&!W.j){x=W;break}}var la=null,Ga=K.length&&K[U].url;0!=x.depth&&Ga&&(la=K[U]);H=new ma;if(H.h){var Ha=H.h.url\|\|"";I.g.push(4);I.h[4]=z("top",Ha)}var Ia={

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
594	192.168.2.5	50424	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:13 UTC	716	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 956 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:13 UTC	956	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 65 32 63 65 64 30 36 34 2d 33 31 34 64 2d 34 63 62 63 2d 61 61 37 61 2d 35 62 31 66 38 64 36 61 61 34 39 34 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 66 65 31 61 33 37 33 62 2d 36 37 38 32 2d 34 33 35 36 2d 62 39 35 38 2d 32 39 34 63 30 30 66 37 33 66 62 64 22 2c 22 73 73 22 3a 22 32 32 34 65 39 64 61 32 2d 33 65 62 65 2d 34 64 65 30 2d 39 34 62 61 2d 30 64 35 64 32 32 63 39 35 62 37 66 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"e2ced064-314d-4cbc-aa7a-5b1f8d6aa494","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"fe1a373b-6782-4356-b958-294c00f73fbd","ss":"224e9da2-3ebe-4de0-94ba-0d5d22c95b7f","bg":true,"s
2024-02-08 18:36:13 UTC	482	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:13 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: clear access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
595	192.168.2.5	50425	3.161.193.117	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:13 UTC	2121	OUT	GET /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPeeiS3HjtTZXkOelfN%2BTRHp5819aBVKUAWU8d6iXTYJyw%2FIPv4OCtUyuUq%2BVrS0WPtY38QJCqNkBX7o%2B2RRpjlx61DSmT7ufG1ri1CRFdQhX2zgjGT6dOcSaEzhDNd8bC3m%2FEZlK%2BzITAWgJ8rsgX6dWJnl%2BKVPp8Ic%3D; lastSeen=1707417372663
2024-02-08 18:36:13 UTC	513	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html;charset=iso-8859-1 Content-Length: 411 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:13 GMT cache-control: must-revalidate,no-cache,no-store strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 e11dfec6520bcf70c11577990ce8efea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P8 X-Amz-Cf-Id: aJBlr-rl9qknWccuZE3Xhkwu9w3YRbbmQZJedFZ3q3FonbVAwM0BQg==
2024-02-08 18:36:13 UTC	411	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 2f 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 32 3e 48 54 54 50 20 45 52 52 4f 52 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 32 3e 0a 3c 74 61 62 6c 65 3e 0a 3c 74 72 3e 3c 74 68 3e 55 52 49 3a 3c 2f 74 68 3e 3c 74 64 3e 2f 77 65 62 2d 76 69 74 61 6c 73 2f 73 65 6e 64 2d 76 69 74 61 6c 73 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/><title>Error 405 Method Not Allowed</title></head><body><h2>HTTP ERROR 405 Method Not Allowed</h2><table><tr><th>URI:</th><td>/web-vitals/send-vitals</td></tr><tr>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
596	192.168.2.5	50427	108.177.122.148	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:13 UTC	1176	OUT	GET /activity;register_conversion=1;src=4228414;type=views;cat=views;ord=4729221658983;npa=0;auiddc=1592208705.1707417344;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=900727044;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2? HTTP/1.1 Host: ad.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:36:13 UTC	2216	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:13 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Attribution-Reporting-Register-Trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"2060402006341822591"}],"aggregatable_trigger_data":[{"filters":{"14":["11794238"]},"key_piece":"0x5bdccd6bd67d4e1c","source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"key_piece":"0xa446ee5f5be5ef06","not_filters":{"14":["11794238"]},"source_keys":["1","3","4","5","6","7","8","9","10","11"]},{"filters":{"14":["11794238"]},"key_piece":"0xd3325b43d3d15f8b","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x22c5b735c1232ea8","not_filters":{"14":["11794238"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"1":327,"10":327,"11":5570,"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356,"3":327,"4":327,"5":5570,"6":327,"7":327,"8":5570,"9":327},"debug_key":"13707852588999790205","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"2060402006341822591","filters":{"14":["11794238"],"source_type":["event"]},"priority":"10","trigger_data":"1"},{"deduplication_key":"2060402006341822591","filters":{"14":["11794238"],"source_type":["navigation"]},"priority":"10","trigger_data":"6"},{"deduplication_key":"2060402006341822591","filters":{"source_type":["event"]},"priority":"0","trigger_data":"0"},{"deduplication_key":"2060402006341822591","filters":{"source_type":["navigation"]},"priority":"0","trigger_data":"7"}],"filters":{"8":["4228414"]}} Content-Type: image/png Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Server: cafe Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: ar_debug=1; expires=Sat, 09-Mar-2024 18:36:13 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
597	192.168.2.5	50429	216.239.32.21	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:13 UTC	3057	OUT	GET /g/collect?v=2&tid=G-A12345&gtm=45je4250z879615461za200&_p=1707417370229&gcs=G1--&gcd=13l3l3l3l5&npa=0&dma=0&cid=421694156.1707417338&ul=en-us&sr=1280x1024&ur=US-FL&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pscdl=noapi&sst.uc=US&sst.rnd=1748118732.1707417371&sst.gcd=13l3l3l3l5&sst.tft=1707417370229&_s=1&sid=1707417345&sct=1&seg=1&dl=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&ep.is_aid_mcc_level_tracked=&ep.cd_action=index&ep.n_b=&ep.hashed_email=-1&ep.partner_channel_id=3&tfd=7431&richsstsse HTTP/1.1 Host: gtm-mktg.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPeeiS3HjtTZXkOelfN%2BTRHp5819aBVKUAWU8d6iXTYJyw%2FIPv4OCtUyuUq%2BVrS0WPtY38QJCqNkBX7o%2B2RRpjlx61DSmT7ufG1ri1CRFdQhX2zgjGT6dOcSaEzhDNd8bC3m%2FEZlK%2BzITAWgJ8rsgX6dWJnl%2BKVPp8Ic%3D; lastSeen=1707417372663
2024-02-08 18:36:13 UTC	472	IN	HTTP/1.1 200 OK Content-Type: text/plain Vary: Accept-Encoding set-cookie: FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; Max-Age=63072000; Domain=booking.com; Path=/; Secure; HttpOnly cache-control: no-cache x-content-type-options: nosniff X-Cloud-Trace-Context: 8eae5072108ca61466e60657a1e371c6 Date: Thu, 08 Feb 2024 18:36:13 GMT Server: Google Frontend Content-Length: 65 Expires: Thu, 08 Feb 2024 18:36:13 GMT Connection: close
2024-02-08 18:36:13 UTC	65	IN	Data Raw: 65 76 65 6e 74 3a 20 6d 65 73 73 61 67 65 0a 64 61 74 61 3a 20 7b 22 72 65 73 70 6f 6e 73 65 22 3a 7b 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 62 6f 64 79 22 3a 22 22 7d 7d 0a 0a Data Ascii: event: messagedata: {"response":{"status_code":200,"body":""}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
598	192.168.2.5	50426	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:13 UTC	3348	OUT	GET /js_tracking?sid=5171fc655664ddf74ab763a094523fb7&aid=304142&ref_action=index&ver=2&pid=87e482caf42702d0&lang=en-us&stype=1&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|1&m=UmFuZG9tSVYkc2RlIyh9YUe5zZbLHt0YNre0CiGBBmP5hKTY_IzZqpWBtitYrnE-ba2NOPqZSPGdnbkQM2vO343hpsChBnayfrRG7jVW0hI1Ke4kKZ85U_m7O1xbR8NLSlv2Zn-4d5ku6anu7qAZgjoLQxWZjIis3cNA3ef3I_aOxDvMotUV5ZQc6OhcEEody8ooGsshLIhRMDad6kRNg_HeFvW36Wr8mOnNh6fMuy8OZ9w095BIb2XL0zt8fY-5SPQHxgI7NWrdI31vzPG5nOwkA1lE2mJxFh3z4YXPwcZPq5z6drlkg3iN9tdtKjt0cXf7rJdLIbIGLmOniyEf0g HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPeeiS3HjtTZXkOelfN%2BTRHp5819aBVKUAWU8d6iXTYJyw%2FIPv4OCtUyuUq%2BVrS0WPtY38QJCqNkBX7o%2B2RRpjlx61DSmT7ufG1ri1CRFdQhX2zgjGT6dOcSaEzhDNd8bC3m%2FEZlK%2BzITAWgJ8rsgX6dWJnl%2BKVPp8Ic%3D; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAmb6ChG0GAAAA:1YfdqTGcz5Nv+ySyR4l0dcP3pMoTORFatiNiGWJ7MN9YNAXjrj+JwLDSBSegMncHAdyNNPOjNsaeDm9pbnbRLlIYy/Wsa0l3RRdVGZNwHvCL7MSxVUeOoLQbnA4ws/oCccvImOwo8CVethnhcZ8jRyLom9EtR+hCle5g3/E4tScqZS87YMPrAUoKpLzL6QZghMKuNcinEXGdtGGXi/+Tn/jd1osZzUxtKgagCgVNA7aglFhxkvVLvhbzVj9tZG3VnoD+k6IF; lastSeen=1707417372663
2024-02-08 18:36:14 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:13 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=96e782ce875e0071&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejJjKFQoxr5yj03_3wUc8QLHqGEFWGc7EtI x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 25d9b5959eaa82bb18ee3f35e6bf34b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: K5AyHXeKpd2d0uskcAX9BjsJ03jrjXIy01_yv1vJsDjIHQIXotBHLw==
2024-02-08 18:36:14 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
599	192.168.2.5	50430	3.162.125.41	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:13 UTC	2190	OUT	GET /orca/chunk-metadata?chunk=b9a82cb8&mfe=b-index-lp-web-mfe&lang=en-us&namespace=BXAbRIVE HTTP/1.1 Host: accommodations.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPeeiS3HjtTZXkOelfN%2BTRHp5819aBVKUAWU8d6iXTYJyw%2FIPv4OCtUyuUq%2BVrS0WPtY38QJCqNkBX7o%2B2RRpjlx61DSmT7ufG1ri1CRFdQhX2zgjGT6dOcSaEzhDNd8bC3m%2FEZlK%2BzITAWgJ8rsgX6dWJnl%2BKVPp8Ic%3D; lastSeen=1707417372663
2024-02-08 18:36:14 UTC	556	IN	HTTP/1.1 200 OK Content-Type: application/json Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:13 GMT x-frame-options: SAMEORIGIN x-content-type-options: nosniff vary: Accept-Encoding referrer-policy: no-referrer strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 91e0db6ff3a77218c7993c4fa2b04cf6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P3 X-Amz-Cf-Id: rhesadsDkxhpJR6NFU90QaD6Qoe3RvvwdkS2lq_oavOIr0HHRDhXwg==
2024-02-08 18:36:14 UTC	6435	IN	Data Raw: 31 39 31 62 0d 0a 7b 22 63 68 75 6e 6b 73 22 3a 5b 22 62 39 61 38 32 63 62 38 22 5d 2c 22 65 78 70 65 72 69 6d 65 6e 74 54 61 67 73 22 3a 7b 22 59 54 54 48 62 58 65 65 56 65 43 46 5a 41 63 62 52 62 52 4f 66 4c 4d 54 65 43 59 48 44 52 46 63 4f 22 3a 31 2c 22 48 4d 62 4f 48 4e 46 50 42 4a 59 49 59 4b 63 50 4e 53 4e 48 52 55 65 42 4f 46 4f 22 3a 31 7d 2c 22 66 65 61 74 75 72 65 4e 61 6d 65 73 22 3a 7b 22 49 65 5a 58 58 44 4e 46 56 46 4b 4f 55 59 4c 4c 46 4a 59 62 43 63 65 4d 4e 50 56 62 50 53 55 61 62 53 63 63 45 54 4b 65 22 3a 66 61 6c 73 65 2c 22 45 42 44 49 62 49 62 58 44 65 42 47 47 54 63 5a 4a 46 66 48 62 65 4d 50 45 54 22 3a 74 72 75 65 2c 22 49 65 50 46 62 4a 4d 46 56 46 4b 4f 55 59 4c 4c 48 4e 4f 56 52 65 22 3a 74 72 75 65 7d 2c 22 73 65 6f 45 78 70 Data Ascii: 191b{"chunks":["b9a82cb8"],"experimentTags":{"YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO":1,"HMbOHNFPBJYIYKcPNSNHRUeBOFO":1},"featureNames":{"IeZXXDNFVFKOUYLLFJYbCceMNPVbPSUabSccETKe":false,"EBDIbIbXDeBGGTcZJFfHbeMPET":true,"IePFbJMFVFKOUYLLHNOVRe":true},"seoExp
2024-02-08 18:36:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
600	192.168.2.5	50428	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:13 UTC	3510	OUT	GET /js_errors?pid=87e482caf42702d0&url=https%3A%2F%2Fwww.booking.com%2Findex.html&m=UmFuZG9tSVYkc2RlIyh9YUe5zZbLHt0YNre0CiGBBmP5hKTY_IzZqpWBtitYrnE-ba2NOPqZSPGdnbkQM2vO343hpsChBnayfrRG7jVW0hI1Ke4kKZ85U_m7O1xbR8NLSlv2Zn-4d5ku6anu7qAZgjoLQxWZjIis3cNA3ef3I_aOxDvMotUV5ZQc6OhcEEody8ooGsshLIhRMDad6kRNg_HeFvW36Wr8mOnNh6fMuy8OZ9w095BIb2XL0zt8fY-5SPQHxgI7NWrdI31vzPG5nOwkA1lE2mJxFh3z4YXPwcZPq5z6drlkg3iN9tdtKjt0cXf7rJdLIbIGLmOniyEf0g&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=index&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2Findex.html&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSObZWJFfVDSMePCFYZWFXO&cors=1 HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPeeiS3HjtTZXkOelfN%2BTRHp5819aBVKUAWU8d6iXTYJyw%2FIPv4OCtUyuUq%2BVrS0WPtY38QJCqNkBX7o%2B2RRpjlx61DSmT7ufG1ri1CRFdQhX2zgjGT6dOcSaEzhDNd8bC3m%2FEZlK%2BzITAWgJ8rsgX6dWJnl%2BKVPp8Ic%3D; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAmb6ChG0GAAAA:1YfdqTGcz5Nv+ySyR4l0dcP3pMoTORFatiNiGWJ7MN9YNAXjrj+JwLDSBSegMncHAdyNNPOjNsaeDm9pbnbRLlIYy/Wsa0l3RRdVGZNwHvCL7MSxVUeOoLQbnA4ws/oCccvImOwo8CVethnhcZ8jRyLom9EtR+hCle5g3/E4tScqZS87YMPrAUoKpLzL6QZghMKuNcinEXGdtGGXi/+Tn/jd1osZzUxtKgagCgVNA7aglFhxkvVLvhbzVj9tZG3VnoD+k6IF; lastSeen=1707417372663
2024-02-08 18:36:14 UTC	684	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:13 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=03b382cee99b012c&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpdDM8X8IUb_VNatlx1uddXq1W4pxx6yfw x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 c625b1bdde545acdeb26c9f6ad3a8c6e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: TjKbE7tRqbJnAwFQT2dBmAXern5BwE9xMdVldy4TE7sqnL9R8skMCA==
2024-02-08 18:36:14 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
601	192.168.2.5	50431	3.161.193.117	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:13 UTC	650	OUT	POST /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive Content-Length: 85 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-API-Version: 1 Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:13 UTC	85	OUT	Data Raw: 7b 22 70 69 64 22 3a 22 38 37 65 34 38 32 63 61 66 34 32 37 30 32 64 30 22 2c 22 72 65 66 41 63 74 69 6f 6e 22 3a 22 69 6e 64 65 78 22 2c 22 73 69 74 65 54 79 70 65 22 3a 22 31 22 2c 22 6c 63 70 22 3a 33 38 38 39 2e 38 39 39 39 39 39 39 39 39 39 39 34 7d Data Ascii: {"pid":"87e482caf42702d0","refAction":"index","siteType":"1","lcp":3889.899999999994}
2024-02-08 18:36:14 UTC	525	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:13 GMT vary: Origin, Accept-Encoding access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 bc606b150a2a1ad01a254dcc3462c692.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P8 X-Amz-Cf-Id: lr-YrZ5Y1F8uCU4wQvQU9oI7Y5S5X9TZHAusGlRFNppAWcFkVDW37g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
602	192.168.2.5	50432	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:13 UTC	6079	OUT	GET /js_tracking?sid=5171fc655664ddf74ab763a094523fb7&aid=304142&ref_action=index&ver=2&pid=87e482caf42702d0&lang=en-us&stype=1&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|3889&m=UmFuZG9tSVYkc2RlIyh9YUe5zZbLHt0YNre0CiGBBmP5hKTY_IzZqpWBtitYrnE-ba2NOPqZSPGdnbkQM2vO343hpsChBnayfrRG7jVW0hI1Ke4kKZ85U_m7O1xbR8NLSlv2Zn-4d5ku6anu7qAZgjoLQxWZjIis3cNA3ef3I_aOxDvMotUV5ZQc6OhcEEody8ooGsshLIhRMDad6kRNg_HeFvW36Wr8mOnNh6fMuy8OZ9w095BIb2XL0zt8fY-5SPQHxgI7NWrdI31vzPG5nOwkA1lE2mJxFh3z4YXPwcZPq5z6drlkg3iN9tdtKjt0cXf7rJdLIbIGLmOniyEf0g HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6 X-Booking-CSRF: VFfFZQAAAAA=I0VyxrbmcRsXF8b8667mJSw00zD1jijstj9zA-B31AE-SHf9fwLae-NRdcEvORIZUidJgBp9cG2_VeJ_vvAjE9POdq-3lpUXJKUz5osKhhR_6IWR4vCHyNCN9_lrexSyhyl857y4-aUKLEPdAzHdPtU-69GNk1-tINwO8UxKp7l2RhgisIpi5FvtqY4OOakuCSFjRchHm9pnK7Y6 sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: 87e482caf42702d0 X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,1856870\|1,1912460\|7,1912460\|1,1908890\|1,1912460\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|4,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|2,cCHObKdBdUHINPSXeHDALOLOLMO\|5,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,cCHObKdBdUHINPSXeHDALOLOLMO\|3 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPeeiS3HjtTZXkOelfN%2BTRHp5819aBVKUAWU8d6iXTYJyw%2FIPv4OCtUyuUq%2BVrS0WPtY38QJCqNkBX7o%2B2RRpjlx61DSmT7ufG1ri1CRFdQhX2zgjGT6dOcSaEzhDNd8bC3m%2FEZlK%2BzITAWgJ8rsgX6dWJnl%2BKVPp8Ic%3D; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAmb6ChG0GAAAA:1YfdqTGcz5Nv+ySyR4l0dcP3pMoTORFatiNiGWJ7MN9YNAXjrj+JwLDSBSegMncHAdyNNPOjNsaeDm9pbnbRLlIYy/Wsa0l3RRdVGZNwHvCL7MSxVUeOoLQbnA4ws/oCccvImOwo8CVethnhcZ8jRyLom9EtR+hCle5g3/E4tScqZS87YMPrAUoKpLzL6QZghMKuNcinEXGdtGGXi/+Tn/jd1osZzUxtKgagCgVNA7aglFhxkvVLvhbzVj9tZG3VnoD+k6IF; lastSeen=1707417372663
2024-02-08 18:36:14 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:13 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=b3d482ce3576021d&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejKlDf-gtlhj6zrZHW_TGVoynzpMwog61h4 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 a1a074529ccb9ea97acd7d95c506f336.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: qZ5ArgzmLhp4jSsximHB4QcLC4nnXiHp0mdLpaI61yb2jge9GcEorA==
2024-02-08 18:36:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
603	192.168.2.5	50433	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:13 UTC	3813	OUT	GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=87e482caf42702d0&ete=&etg=&etcg=cCHObEfEITNPfbeQMIaWYUQJFFQccCcCcCC\|5&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,cCHObKdBdUHINPSXeHDALOLOLMO\|3&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-ET-Serialized-State: ESNA6-jww5PiZzyK_LfXmqWii5kpdRkL6a6nI9I91DYrlgCDdZE8nYAOQCA6hUpfE X-Booking-Language-Code: en-us X-Booking-Client-Info: sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: 87e482caf42702d0 X-Booking-Info: X-Booking-SiteType-Id: 1 X-Booking-Session-Id: db6e5bbb32eac0e80cfcae9b22f5390d sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPeeiS3HjtTZXkOelfN%2BTRHp5819aBVKUAWU8d6iXTYJyw%2FIPv4OCtUyuUq%2BVrS0WPtY38QJCqNkBX7o%2B2RRpjlx61DSmT7ufG1ri1CRFdQhX2zgjGT6dOcSaEzhDNd8bC3m%2FEZlK%2BzITAWgJ8rsgX6dWJnl%2BKVPp8Ic%3D; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAmb6ChG0GAAAA:1YfdqTGcz5Nv+ySyR4l0dcP3pMoTORFatiNiGWJ7MN9YNAXjrj+JwLDSBSegMncHAdyNNPOjNsaeDm9pbnbRLlIYy/Wsa0l3RRdVGZNwHvCL7MSxVUeOoLQbnA4ws/oCccvImOwo8CVethnhcZ8jRyLom9EtR+hCle5g3/E4tScqZS87YMPrAUoKpLzL6QZghMKuNcinEXGdtGGXi/+Tn/jd1osZzUxtKgagCgVNA7aglFhxkvVLvhbzVj9tZG3VnoD+k6IF; lastSeen=1707417372663
2024-02-08 18:36:14 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:14 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=813482cf59f700de&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejJir3j19rFmXHpdxpZxFBXpCQA1BEOEAdo x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7db19e3781edb64ef4f7023d2c25783e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 7dgOYxgkIyxw8QgpLL5WoTk54zPOGuIoj4eFxWqXnoPx8UeSFe8--Q==
2024-02-08 18:36:14 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
604	192.168.2.5	50434	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:14 UTC	4035	OUT	POST /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 359 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNzQxNzM2NSwiZXhwIjoxNzA3NTAzNzY1fQ.IxZs5q4mHH8jrJaIRLcnINpQipyjA8tJVAcTBmMxb-iUTxayqCNH7M9Yb-qC3txr1MR-MztiIYI4VYNV7sXWUw x-booking-et-serialized-state: ESNA6-jww5PiZzyK_LfXmqWii5kpdRkL6a6nI9I91DYrlgCDdZE8nYAOQCA6hUpfE x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: 87e482caf42702d0 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAmb6ChG0GAAAA:1YfdqTGcz5Nv+ySyR4l0dcP3pMoTORFatiNiGWJ7MN9YNAXjrj+JwLDSBSegMncHAdyNNPOjNsaeDm9pbnbRLlIYy/Wsa0l3RRdVGZNwHvCL7MSxVUeOoLQbnA4ws/oCccvImOwo8CVethnhcZ8jRyLom9EtR+hCle5g3/E4tScqZS87YMPrAUoKpLzL6QZghMKuNcinEXGdtGGXi/+Tn/jd1osZzUxtKgagCgVNA7aglFhxkvVLvhbzVj9tZG3VnoD+k6IF; lastSeen=1707417372663; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPefAa3RNRy8D5EaUijXn8pYZ0AdPv4%2BMbriobJ67L2stqv7YU5QJ1fjxGFYP4mT0bbLasX7gLSHb9mxztI6dJsxhftnQinMc1eB1dMX4Ttz%2FBD9eJec%2FNi9qUJKL%2BpvGgrObH04Tp%2F6ybzTmlJLj9QPP5IZLSP3enVE%3D
2024-02-08 18:36:14 UTC	359	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 5f 73 74 61 67 65 22 3a 22 61 64 5f 62 6c 6f 63 6b 65 72 5f 6e 6f 74 5f 64 65 74 65 63 74 65 64 22 2c 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 55 4e 4b 4e 4f 57 4e 22 2c 22 73 69 74 65 5f 74 79 70 65 22 3a 22 57 57 57 22 2c 22 76 69 73 69 74 6f 72 5f 63 63 22 3a 22 75 73 22 2c 22 61 64 5f 70 6f 73 69 74 69 6f 6e 22 3a 22 49 4e 44 45 58 5f 50 52 49 4d 41 52 59 22 2c 22 70 61 67 65 6e 61 6d 65 22 3a 22 49 4e 44 45 58 22 2c 22 76 65 72 74 69 63 61 6c 22 3a 22 41 43 43 4f 4d 4d 4f 44 41 54 49 4f 4e 53 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 Data Ascii: {"operationName":"trackAdStatus","variables":{"input":{"action_stage":"ad_blocker_not_detected","campaign_id":"UNKNOWN","site_type":"WWW","visitor_cc":"us","ad_position":"INDEX_PRIMARY","pagename":"INDEX","vertical":"ACCOMMODATIONS"}},"extensions":{},"que
2024-02-08 18:36:14 UTC	1093	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 361 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:14 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3WQpqzfgRBbWzkPDYJmy1lx8P6NQoXxXqIednomLUO1sC1OhfUBMmT7Kz7RDcQ3tEqtC9lXmCFETEAf4E1pw%2FXDdt7YUWgc0LCLOkFiavgh6BGruFRJXyJE0%2Bo3g3N1d1qcrjTUQKQ6Qnv6sP95vmrJNk1FUGnCkQA%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:14 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=b45c82cf3a3903ac&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGe_OwZ4yurrTg4kkP_7-9ZJnn20sFXe1Tg x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 ea0f86c249e022d5015ce79f54e723d0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: bpHtMEID3o1x9NjRUQ6wSAzKIr9Qxm7RzsEe_2aCYSwGJFdeopq8_w==
2024-02-08 18:36:14 UTC	361	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 3a 7b 22 6e 61 6d 65 22 3a 22 4a 53 4f 4e 22 2c 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 41 20 4a 53 4f 4e 20 73 63 61 6c 61 72 22 2c 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 63 68 69 6c 64 72 65 6e 57 69 74 68 54 79 70 65 52 65 66 65 72 65 6e 63 65 73 22 3a 7b 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 7d 2c 22 65 6d 70 74 79 22 3a 66 61 6c 73 65 2c 22 63 68 69 6c 64 72 65 6e 41 73 4c 69 73 74 22 3a 5b 5d 7d 2c 22 63 6f 65 72 63 69 6e 67 22 3a 7b 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 44 65 66 69 6e Data Ascii: {"data":{"trackAdStatus":{"name":"JSON","directives":[],"description":"A JSON scalar","appliedDirectives":[],"childrenWithTypeReferences":{"children":{"directives":[],"appliedDirectives":[]},"empty":false,"childrenAsList":[]},"coercing":{},"extensionDefin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
605	192.168.2.5	50435	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:14 UTC	681	OUT	GET /xdata/images/city/170x136/977416.jpg?k=ea06e0b572ff052f4fe4fcf35ac3616e8d1b7300f0402756c460a4e9c19e54ed&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:14 UTC	542	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 5928 Connection: close Server: nginx Date: Tue, 30 Jan 2024 12:58:53 GMT ETag: "ebc0243ff8aead66390fde60c468bfa6fd8034d9" Content-Language: 5928 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 d7734ec5e5fca10fcc695a29ed943462.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: 38UEYvqlV8fPq-7W4wPv1X7UBCS-0UGqazPRR8ZImUeSy8-2nK48qg== Age: 797841
2024-02-08 18:36:14 UTC	5928	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
606	192.168.2.5	50436	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:14 UTC	4041	OUT	POST /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 714 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNzQxNzM2NSwiZXhwIjoxNzA3NTAzNzY1fQ.IxZs5q4mHH8jrJaIRLcnINpQipyjA8tJVAcTBmMxb-iUTxayqCNH7M9Yb-qC3txr1MR-MztiIYI4VYNV7sXWUw x-booking-et-serialized-state: ESNA6-jww5PiZzyK_LfXmqWii5kpdRkL6a6nI9I91DYrlgCDdZE8nYAOQCA6hUpfE x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: 87e482caf42702d0 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAmb6ChG0GAAAA:1YfdqTGcz5Nv+ySyR4l0dcP3pMoTORFatiNiGWJ7MN9YNAXjrj+JwLDSBSegMncHAdyNNPOjNsaeDm9pbnbRLlIYy/Wsa0l3RRdVGZNwHvCL7MSxVUeOoLQbnA4ws/oCccvImOwo8CVethnhcZ8jRyLom9EtR+hCle5g3/E4tScqZS87YMPrAUoKpLzL6QZghMKuNcinEXGdtGGXi/+Tn/jd1osZzUxtKgagCgVNA7aglFhxkvVLvhbzVj9tZG3VnoD+k6IF; lastSeen=1707417372663; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZj4oP0EZv%2FxYqexdp6tFywzXVcF0ngF4tz2JSGUyf3WdYfq6Hm9RX6L9KB7%2BAy6I7K5fOizc8JLtTV2qKNY0uP5YlBIvHtTWMUsFythle%2BMqRKa%2BPBTt%2BBw%2FQndkL4Jypf6vKcrbId3WJRfOl959l%2F8%3D
2024-02-08 18:36:14 UTC	714	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 74 72 61 63 6b 47 6f 6f 67 6c 65 41 64 4c 6f 61 64 65 64 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 74 72 61 63 6b 69 6e 67 5f 69 6e 66 6f 22 3a 7b 22 6e 64 69 73 70 6c 61 79 5f 61 64 5f 69 64 22 3a 22 30 39 30 65 30 65 38 31 2d 39 31 35 63 2d 34 36 64 35 2d 38 63 61 32 2d 64 37 30 33 35 32 39 62 66 65 38 62 22 2c 22 72 65 6e 64 65 72 65 64 5f 61 64 5f 70 61 67 65 76 69 65 77 5f 69 64 22 3a 22 38 37 65 34 38 32 63 61 66 34 32 37 30 32 64 30 22 2c 22 72 65 6e 64 65 72 65 64 5f 61 64 5f 70 61 67 65 6e 61 6d 65 22 3a 22 49 4e 44 45 58 22 2c 22 72 65 6e 64 65 72 65 64 5f 61 64 5f 70 6f 73 69 74 69 6f 6e 22 3a 22 49 4e 44 45 58 5f 50 52 49 4d 41 52 59 22 2c 22 76 65 72 74 69 Data Ascii: {"operationName":"trackGoogleAdLoaded","variables":{"input":{"tracking_info":{"ndisplay_ad_id":"090e0e81-915c-46d5-8ca2-d703529bfe8b","rendered_ad_pageview_id":"87e482caf42702d0","rendered_ad_pagename":"INDEX","rendered_ad_position":"INDEX_PRIMARY","verti
2024-02-08 18:36:14 UTC	1099	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 367 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:14 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzlo5PAuvmqlPAuWvRRFqvn0RWCWn4ryvUw9O9Wk%2FRuHBJ9Ofnf8f6Oc5uPI7OCbEe5ZJlOBYHcQQbTusrdfTyybRbrGGxjvIMW%2FNkBLg%2BEuv%2FcKK5amVV79FNDgeyb9SU3Q0xx%2FXH8KwY%2FEoWdpiU8EQ1SDxIAFMQw%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:14 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=6fe382cf87ad02c8&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGVnvOSzNGCt3PQbcwNFlDG34OAPNuxOD0w x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 a01680a1fee7e35f1738191420d98822.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: djmWE1_9ie53oyyCVbrxupE4r_YP1BYzALVzRgMe1Wsr_rwi-SjOAA==
2024-02-08 18:36:14 UTC	367	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 74 72 61 63 6b 47 6f 6f 67 6c 65 41 64 4c 6f 61 64 65 64 22 3a 7b 22 61 6c 6c 41 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 63 68 69 6c 64 72 65 6e 22 3a 5b 5d 2c 22 65 78 74 65 6e 73 69 6f 6e 44 65 66 69 6e 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 6e 61 6d 65 22 3a 22 4a 53 4f 4e 22 2c 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 41 20 4a 53 4f 4e 20 73 63 61 6c 61 72 22 2c 22 63 6f 65 72 63 69 6e 67 22 3a 7b 7d 2c 22 61 6c 6c 44 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 64 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 63 68 69 6c 64 72 Data Ascii: {"data":{"trackGoogleAdLoaded":{"allAppliedDirectivesByName":{},"children":[],"extensionDefinitions":[],"name":"JSON","appliedDirectives":[],"description":"A JSON scalar","coercing":{},"allDirectivesByName":{},"directivesByName":{},"directives":[],"childr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
607	192.168.2.5	50438	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:14 UTC	4041	OUT	POST /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 355 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-context-aid: 304142 x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTcwNzQxNzM2NSwiZXhwIjoxNzA3NTAzNzY1fQ.IxZs5q4mHH8jrJaIRLcnINpQipyjA8tJVAcTBmMxb-iUTxayqCNH7M9Yb-qC3txr1MR-MztiIYI4VYNV7sXWUw x-booking-et-serialized-state: ESNA6-jww5PiZzyK_LfXmqWii5kpdRkL6a6nI9I91DYrlgCDdZE8nYAOQCA6hUpfE x-booking-context-action-name: index x-booking-site-type-id: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 content-type: application/json x-booking-pageview-id: 87e482caf42702d0 accept: / x-booking-topic: capla_browser_b-index-lp-web-mfe sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAmb6ChG0GAAAA:1YfdqTGcz5Nv+ySyR4l0dcP3pMoTORFatiNiGWJ7MN9YNAXjrj+JwLDSBSegMncHAdyNNPOjNsaeDm9pbnbRLlIYy/Wsa0l3RRdVGZNwHvCL7MSxVUeOoLQbnA4ws/oCccvImOwo8CVethnhcZ8jRyLom9EtR+hCle5g3/E4tScqZS87YMPrAUoKpLzL6QZghMKuNcinEXGdtGGXi/+Tn/jd1osZzUxtKgagCgVNA7aglFhxkvVLvhbzVj9tZG3VnoD+k6IF; lastSeen=1707417372663; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZj4oP0EZv%2FxYqexdp6tFywzXVcF0ngF4tz2JSGUyf3WdYfq6Hm9RX6L9KB7%2BAy6I7K5fOizc8JLtTV2qKNY0uP5YlBIvHtTWMUsFythle%2BMqRKa%2BPBTt%2BBw%2FQndkL4Jypf6vKcrbId3WJRfOl959l%2F8%3D
2024-02-08 18:36:14 UTC	355	OUT	Data Raw: 7b 22 6f 70 65 72 61 74 69 6f 6e 4e 61 6d 65 22 3a 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 2c 22 76 61 72 69 61 62 6c 65 73 22 3a 7b 22 69 6e 70 75 74 22 3a 7b 22 61 63 74 69 6f 6e 5f 73 74 61 67 65 22 3a 22 61 64 5f 73 6c 6f 74 5f 72 65 6e 64 65 72 65 64 22 2c 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 33 32 35 39 39 36 37 36 38 30 22 2c 22 73 69 74 65 5f 74 79 70 65 22 3a 22 57 57 57 22 2c 22 76 69 73 69 74 6f 72 5f 63 63 22 3a 22 75 73 22 2c 22 61 64 5f 70 6f 73 69 74 69 6f 6e 22 3a 22 49 4e 44 45 58 5f 50 52 49 4d 41 52 59 22 2c 22 70 61 67 65 6e 61 6d 65 22 3a 22 49 4e 44 45 58 22 2c 22 76 65 72 74 69 63 61 6c 22 3a 22 41 43 43 4f 4d 4d 4f 44 41 54 49 4f 4e 53 22 7d 7d 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 7d 2c 22 71 75 65 72 79 22 3a Data Ascii: {"operationName":"trackAdStatus","variables":{"input":{"action_stage":"ad_slot_rendered","campaign_id":"3259967680","site_type":"WWW","visitor_cc":"us","ad_position":"INDEX_PRIMARY","pagename":"INDEX","vertical":"ACCOMMODATIONS"}},"extensions":{},"query":
2024-02-08 18:36:14 UTC	1093	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 361 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:14 GMT vary: User-Agent, Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPefqrk0SdRFLrOiLuENo13S4wke26C1OQ4lYDBsQwuYPagmIo0IMRCfk2c9GgFzFOB0ggcQXjvYgcko6amVKHhU7mqQ7KBdgyCn%2FJPoiKhFpKudq5l%2BGffCsriXc4Xs3fS0Og1NF7bK1jVr%2BCG8U0cOhKIYH5mLrOOc%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:14 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=24bd82cfccdf02dc&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGXfhwk6QZBhZ4q2aqjYl8xdIfHOq_D9L-w x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 f4c38e024a95b76a27c9f3dc9ff2eda6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: ehczOKTJvuKyxOm2dvr1AKTDI5hrQl-d_2g4LgQsvdZ_XehjuYTy8Q==
2024-02-08 18:36:14 UTC	361	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 74 72 61 63 6b 41 64 53 74 61 74 75 73 22 3a 7b 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 63 6f 65 72 63 69 6e 67 22 3a 7b 7d 2c 22 63 68 69 6c 64 72 65 6e 57 69 74 68 54 79 70 65 52 65 66 65 72 65 6e 63 65 73 22 3a 7b 22 63 68 69 6c 64 72 65 6e 41 73 4c 69 73 74 22 3a 5b 5d 2c 22 65 6d 70 74 79 22 3a 66 61 6c 73 65 2c 22 63 68 69 6c 64 72 65 6e 22 3a 7b 22 64 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 2c 22 61 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 73 22 3a 5b 5d 7d 7d 2c 22 63 68 69 6c 64 72 65 6e 22 3a 5b 5d 2c 22 65 78 74 65 6e 73 69 6f 6e 44 65 66 69 6e 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 64 69 72 65 63 74 69 76 65 73 42 79 4e 61 6d 65 22 3a 7b 7d 2c 22 61 6c 6c 41 70 70 6c 69 65 64 44 69 72 65 63 74 69 76 65 Data Ascii: {"data":{"trackAdStatus":{"directives":[],"coercing":{},"childrenWithTypeReferences":{"childrenAsList":[],"empty":false,"children":{"directives":[],"appliedDirectives":[]}},"children":[],"extensionDefinitions":[],"directivesByName":{},"allAppliedDirective

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
608	192.168.2.5	50437	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:14 UTC	3570	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 3059 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: 87e482caf42702d0 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAmb6ChG0GAAAA:1YfdqTGcz5Nv+ySyR4l0dcP3pMoTORFatiNiGWJ7MN9YNAXjrj+JwLDSBSegMncHAdyNNPOjNsaeDm9pbnbRLlIYy/Wsa0l3RRdVGZNwHvCL7MSxVUeOoLQbnA4ws/oCccvImOwo8CVethnhcZ8jRyLom9EtR+hCle5g3/E4tScqZS87YMPrAUoKpLzL6QZghMKuNcinEXGdtGGXi/+Tn/jd1osZzUxtKgagCgVNA7aglFhxkvVLvhbzVj9tZG3VnoD+k6IF; lastSeen=1707417372663; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZj4oP0EZv%2FxYqexdp6tFywzXVcF0ngF4tz2JSGUyf3WdYfq6Hm9RX6L9KB7%2BAy6I7K5fOizc8JLtTV2qKNY0uP5YlBIvHtTWMUsFythle%2BMqRKa%2BPBTt%2BBw%2FQndkL4Jypf6vKcrbId3WJRfOl959l%2F8%3D
2024-02-08 18:36:14 UTC	3059	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 68 65 61 64 65 72 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 73 65 72 76 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 32 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 70 72 6f 64 75 63 74 5f 76 65 72 74 69 63 61 6c 73 5f 6c 6f 61 64 65 64 22 3a 5b 7b 22 69 74 65 6d 5f 74 79 70 65 22 3a 22 61 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 73 22 2c 22 69 74 65 6d 5f 70 6f 73 69 74 69 6f 6e 22 3a 31 2c 22 69 73 5f 69 74 65 6d 5f 70 72 65 73 65 6c 65 63 74 65 64 22 3a 31 7d 2c 7b 22 69 74 65 6d 5f 74 79 70 65 22 3a 22 66 6c 69 67 68 74 73 22 2c 22 69 74 65 6d 5f 70 6f 73 69 74 69 6f 6e 22 3a 32 2c 22 69 73 5f 69 74 65 6d 5f 70 72 65 73 65 6c Data Ascii: {"events":[{"action_name":"webcoreux.header_component_served","action_version":"2.0.0","content":{"product_verticals_loaded":[{"item_type":"accommodations","item_position":1,"is_item_preselected":1},{"item_type":"flights","item_position":2,"is_item_presel
2024-02-08 18:36:14 UTC	1187	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 83 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:14 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbca8KLfxLPefqrk0SdRFLrACDwienmx21F34%2BQGxuCZMQkdKxCcAYfFqpu9wfg17sd1%2FfD2FWu3NmpTFB%2FDo7EcMfd0g8oo1tt%2BcLzXgwTV%2BECkQMnooOSFZcPhM%2F7Dg%2FJF5akYHC%2Bg1fZrkICgKyxCTBlnuvxti4Bx4oIMgiO%2Fc%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:14 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=bbff82cf647300f0&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsskQ0X-oRbCfiVjn72pvKRkETEa-0T3XUo x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 6e0f9dce97fcb3c9b684592a289e4e72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Axv-U44V0YDwG7Iokdh-GEailYbgneWYhf5ihUx6xKmfGtf5WVaBZw==
2024-02-08 18:36:14 UTC	83	IN	Data Raw: 5b 7b 22 63 6f 64 65 22 3a 39 2c 22 73 74 61 74 75 73 22 3a 30 7d 2c 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d 2c 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d 5d Data Ascii: [{"code":9,"status":0},{"status":1,"content":"Sent"},{"status":1,"content":"Sent"}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
609	192.168.2.5	50440	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:14 UTC	686	OUT	GET /xdata/images/xphoto/263x210/45450084.jpeg?k=f8c2954e867a1dd4b479909c49528531dcfb676d8fbc0d60f51d7b51bb32d1d9&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:14 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sun, 21 Jan 2024 16:24:01 GMT ETag: "581d7d6f2cc7c0efc5bd54aa0a1fa4c3bdb259f4" Content-Language: 10257 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 d6a35bbafad9c6ab102b2f66ffd65942.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: fUvBe6Ou4byclYRW8impx46mzXHB0ZiIKIkvZh8BG12JctZ07r_t5Q== Age: 1563133
2024-02-08 18:36:14 UTC	10265	IN	Data Raw: 32 38 31 31 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 2811JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:36:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
610	192.168.2.5	50445	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:14 UTC	3570	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 2100 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-CSRF: undefined sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: undefined Content-Type: application/json X-Booking-Pageview-Id: 87e482caf42702d0 X-Booking-SiteType-Id: 1 X-Booking-ET-Seed: undefined X-Booking-Session-Id: undefined X-Booking-Platform: www sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAmb6ChG0GAAAA:1YfdqTGcz5Nv+ySyR4l0dcP3pMoTORFatiNiGWJ7MN9YNAXjrj+JwLDSBSegMncHAdyNNPOjNsaeDm9pbnbRLlIYy/Wsa0l3RRdVGZNwHvCL7MSxVUeOoLQbnA4ws/oCccvImOwo8CVethnhcZ8jRyLom9EtR+hCle5g3/E4tScqZS87YMPrAUoKpLzL6QZghMKuNcinEXGdtGGXi/+Tn/jd1osZzUxtKgagCgVNA7aglFhxkvVLvhbzVj9tZG3VnoD+k6IF; lastSeen=1707417372663; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBKVqLf6YN%2BOZj4oP0EZv%2FxYqexdp6tFywzXVcF0ngF4tz2JSGUyf3WdYfq6Hm9RX6L9KB7%2BAy6I7K5fOizc8JLtTV2qKNY0uP5YlBIvHtTWMUsFythle%2BMqRKa%2BPBTt%2BBw%2FQndkL4Jypf6vKcrbId3WJRfOl959l%2F8%3D
2024-02-08 18:36:14 UTC	2100	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 77 65 62 63 6f 72 65 75 78 2e 68 65 72 6f 5f 63 6f 6d 70 6f 6e 65 6e 74 5f 76 69 65 77 65 64 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 6d 70 61 69 67 6e 5f 69 64 22 3a 22 31 63 65 30 36 32 65 66 2d 62 30 33 33 2d 34 33 30 34 2d 39 34 62 65 2d 31 35 61 31 64 33 38 65 32 64 63 31 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 6c 6f 63 61 6c 22 3a 7b 22 6c 61 6e 67 75 61 67 65 22 3a 22 65 6e 2d 75 73 22 7d 2c 22 70 61 67 65 22 3a 7b 22 70 61 67 65 5f 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 70 61 67 65 5f 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 69 6e Data Ascii: {"events":[{"action_name":"webcoreux.hero_component_viewed","action_version":"1.0.0","content":{"campaign_id":"1ce062ef-b033-4304-94be-15a1d38e2dc1"},"context":{"local":{"language":"en-us"},"page":{"page_referrer":"","page_url":"https://www.booking.com/in
2024-02-08 18:36:14 UTC	1179	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 91 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:14 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:14 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=f38382cf4ac200a8&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqstMUOBenFUuhA1N5OSRS1Ysub_d1dnan3s x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 d125bf8405e840aa51a88ae3d8d91fb2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: uAi5Ezo85tSNbRz2ObrmjRK_4Qhe5RVzlKrcgsA6tH5ZQIJWqMgcRw==
2024-02-08 18:36:14 UTC	91	IN	Data Raw: 5b 7b 22 73 74 61 74 75 73 22 3a 31 2c 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 7d 2c 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d 2c 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d 5d Data Ascii: [{"status":1,"content":"Sent"},{"content":"Sent","status":1},{"content":"Sent","status":1}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
611	192.168.2.5	50446	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:14 UTC	1602	OUT	GET /p?pid=54f04dd9-4d34-47ee-87a6-989713215c80&ev=PAGE_VIEW&intg=gtm&u_hem=FFF1bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464&e_ni=1&u_hpn=6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b&e_iids=%5B0%5D&e_cur=EUR&pids=54f04dd9-4d34-47ee-87a6-989713215c80&e_ic=hotel&u_c1=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e&u_sclid=75022d4d-ae50-4a02-8ab1-d3d7e0695f9e&u_scsid=02478874-a277-465c-b9e7-ce2412232e4f&bt=1d53c387&d_a=x86&d_bvs=%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.132%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.132%22%7D%5D&d_os=10.0.0&d_ot=Windows&df=true&huah=true&m_dcl=4149&m_fcps=3889&m_pi=4089&m_pl=6944&m_pv=2&m_rd=7451&m_sh=1024&m_sl=0&m_sw=1280&pl=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&trackId=c904cd67-c0d8-4a0e-97fd-cc369431aa6a&ts=1707417370842&v=3.9.1-2402072137 HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:14 UTC	485	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:14 GMT access-control-allow-origin: * cache-control: no-cache, no-transform content-type: image/png strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 68 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: clear Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:14 UTC	68	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 0b 49 44 41 54 78 da 63 60 00 02 00 00 05 00 01 e9 fa dc d8 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRIDATxc`IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
612	192.168.2.5	50447	151.101.192.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:14 UTC	784	OUT	GET /user/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1707417371157&dep=5%2CEVENT_TAGS_ABSENT HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZPbFhNRFVSUkFJRnZXZjRkVnVmUkkrZ1d2TzlKbEJWUUZMeitQeWNQazNzYWVteFJaU3NUZktHY0ZwRlRmTlYzdTdkYU5lU3RFRGdnSGFyOEtJWk5IL2JiakJuWE9hQXVkOFdIcjYvTi9zOD0mRG5sSitYRzNlTjRhYTk0OTFhdVZISDhTUUswPQ=="
2024-02-08 18:36:14 UTC	622	IN	HTTP/1.1 200 OK Connection: close Content-Length: 302 access-control-expose-headers: Epik,Pin-Unauth pin-unauth: dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT access-control-allow-origin: * content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 2 referrer-policy: origin x-pinterest-rid: 1849875061658049 Date: Thu, 08 Feb 2024 18:36:14 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: f9d1c7100d6ab6a9fc70375cea0fca5e275d3fa9
2024-02-08 18:36:14 UTC	302	IN	Data Raw: 7b 22 61 65 6d 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 65 6d 46 6e 4c 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 50 68 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 47 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 44 62 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 4c 6f 63 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 45 78 74 65 72 6e 61 6c 49 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 45 70 69 6b 49 66 72 61 6d 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 68 72 6f 6d 65 4e 65 77 55 73 65 72 41 67 65 6e 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 45 75 22 3a 74 72 75 65 2c 22 69 73 55 74 69 6c 69 7a 69 6e 67 41 64 76 65 72 74 69 73 65 72 31 70 45 6e 61 Data Ascii: {"aemEnabled":true,"aemFnLnEnabled":false,"aemPhEnabled":false,"aemGeEnabled":false,"aemDbEnabled":false,"aemLocEnabled":false,"aemExternalIdEnabled":false,"ctEpikIframeEnabled":true,"chromeNewUserAgentEnabled":true,"isEu":true,"isUtilizingAdvertiser1pEna

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
613	192.168.2.5	50448	151.101.192.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:14 UTC	843	OUT	GET /user/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA%22%7D&cb=1707417371155&dep=2%2CPAGE_LOAD HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZPbFhNRFVSUkFJRnZXZjRkVnVmUkkrZ1d2TzlKbEJWUUZMeitQeWNQazNzYWVteFJaU3NUZktHY0ZwRlRmTlYzdTdkYU5lU3RFRGdnSGFyOEtJWk5IL2JiakJuWE9hQXVkOFdIcjYvTi9zOD0mRG5sSitYRzNlTjRhYTk0OTFhdVZISDhTUUswPQ=="
2024-02-08 18:36:14 UTC	622	IN	HTTP/1.1 200 OK Connection: close Content-Length: 302 access-control-expose-headers: Epik,Pin-Unauth pin-unauth: dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT access-control-allow-origin: * content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 2 referrer-policy: origin x-pinterest-rid: 1316670930659660 Date: Thu, 08 Feb 2024 18:36:14 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: f9d1c7100d6ab6a9fc70375cea0fca5e275d3fa9
2024-02-08 18:36:14 UTC	302	IN	Data Raw: 7b 22 61 65 6d 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 61 65 6d 46 6e 4c 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 50 68 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 47 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 44 62 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 4c 6f 63 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 61 65 6d 45 78 74 65 72 6e 61 6c 49 64 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 63 74 45 70 69 6b 49 66 72 61 6d 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 63 68 72 6f 6d 65 4e 65 77 55 73 65 72 41 67 65 6e 74 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 69 73 45 75 22 3a 74 72 75 65 2c 22 69 73 55 74 69 6c 69 7a 69 6e 67 41 64 76 65 72 74 69 73 65 72 31 70 45 6e 61 Data Ascii: {"aemEnabled":true,"aemFnLnEnabled":false,"aemPhEnabled":false,"aemGeEnabled":false,"aemDbEnabled":false,"aemLocEnabled":false,"aemExternalIdEnabled":false,"ctEpikIframeEnabled":true,"chromeNewUserAgentEnabled":true,"isEu":true,"isUtilizingAdvertiser1pEna

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
614	192.168.2.5	50449	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:14 UTC	790	OUT	GET /pagead/1p-user-list/1060768846/value=1.00&guid=ON&script=0&label=undefined?is_vtc=1&cid=CAQSKQAvHhf_gXMMKR8XlWQUw777UtDcji15Fuhz4qxcj8OlguUiWRdNRO6X&random=2004650583 HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:14 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:14 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:14 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
615	192.168.2.5	50450	18.67.65.100	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:14 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:14 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Thu, 08 Feb 2024 18:36:14 GMT X-Cache: Error from cloudfront Via: 1.1 b9d1b307966c2273bf97ed7c681603da.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: 6B6oAeFlUrxTRgKpk-_UdxnIhlhvZo3cXYq_LxBq0M57hUozuXkFPw==
2024-02-08 18:36:14 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
616	192.168.2.5	50451	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:14 UTC	1302	OUT	GET /pagead/1p-user-list/988382855/?random=1707417370534&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=qxb_CKLbrYADEIeNptcD&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_xJXFnZ-QZPYh1oZDyu_TZwxAXJ-Wp-8Ob2qjV2LC1aNJs2H7&random=1370815513&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:14 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:14 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:14 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
617	192.168.2.5	50453	142.251.15.154	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:14 UTC	1269	OUT	GET /ddm/fls/z/dc_pre=CMCFs6-xnIQDFbjbuAgdwz4C4g;src=4228414;type=views;cat=views;ord=4729221658983;npa=0;auiddc=;u1=-1;u2=;u3=3;u4=304142;u5=USD;u6=-1;u7=-1;u9=-1;u10=-1;u11=-1;u12=-1;u13=0;u14=-1;u15=en-us;u16=-1;u17=Pqit_vbiva0hUfw7CE5adQ;u18=-1;u19=0;u20=index;u21=;u23=;u24=undefined;u25=undefined;u26=;u27=2;u28=1;u34=global_on;u35=-1;u36=-1;u42=0065c51ef33dfec91d329a0fcf8b31a21c_1707417000;ps=1;pcor=900727044;pscdl=noapi;gtm=45He4250v79615461za200;gcd=13l3l3l3l1;dma=0;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132;uamb=0;uam=;uap=Windows;uapv=10.0.0;uaw=0;epver=2 HTTP/1.1 Host: adservice.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:14 UTC	529	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:14 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:14 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
618	192.168.2.5	50454	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:14 UTC	1872	OUT	GET /pagead/1p-user-list/1060768846/?random=1707417370594&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&hl=en&gl=us&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=6OEvCKaZ3wMQzpjo-QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&currency_code=USD&userId=UmFuZG9tSVYkc2RlIyh9YeXKWxo4vn0nh4qqVoyv2KiIad5kPNddW86jrjYgKSk8&npa=0&data=page_type%3Dhome%3Bcheckindate%3D-1%3Bcheckoutdate%3D-1%3Bhotelid%3D0%3Bbook_window%3D%3Bweekday%3D-1%3Bdest_cc%3D-1%3Bdest_id%3D-1%3Bdest_type%3D-1%3Bchannel_id%3D3%3Bpartner_id%3D1%3Bnights%3D-1%3Brooms%3D-1%3Bis_international%3D-1%3Bhr%3D-1%3Busercountry%3Dus%3Bguestcount%3D-1%3Brecent%3D%5B%5D%3Blogin%3D0%3Bdest_ufi%3D-1%3Bdynx_pagetype%3D%3Brisa%3D0%3Bsplittest%3D%3Bdynx_itemid%3D0%3Bsite%3Dbookings2%3Batid%3D%3Bbiz_p%3D%3Bbiz_s%3D2%3Bgenis%3D%3Bnr%3DNaN&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_gb44i39lGLaxfNcCIq_WTyFMLOl4BLrFxZyRf0JgbXaPZfmP&random=569072865&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:14 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:14 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:14 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
619	192.168.2.5	50456	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:14 UTC	1301	OUT	GET /pagead/1p-user-list/973712236/?random=1707417370629&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=8GRyCJ3Eq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_wfHMD_o_GGHspVDwQ0qsVavCvt1YdLyJ8OCUdqTkuws2io1Q&random=3777251294&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:14 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:14 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:14 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
620	192.168.2.5	50457	151.101.192.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:14 UTC	1715	OUT	GET /v3/?tid=2612507394325&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA%22%7D&event=init&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%226461a31a%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D&cb=1707417371159 HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZPbFhNRFVSUkFJRnZXZjRkVnVmUkkrZ1d2TzlKbEJWUUZMeitQeWNQazNzYWVteFJaU3NUZktHY0ZwRlRmTlYzdTdkYU5lU3RFRGdnSGFyOEtJWk5IL2JiakJuWE9hQXVkOFdIcjYvTi9zOD0mRG5sSitYRzNlTjRhYTk0OTFhdVZISDhTUUswPQ=="
2024-02-08 18:36:15 UTC	594	IN	HTTP/1.1 200 OK Connection: close Content-Length: 35 cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT content-type: image/gif access-control-allow-origin: * set-cookie: ar_debug=1; Expires=Fri, 07 Feb 2025 18:36:15 GMT; Path=/; Domain=.pinterest.com; Secure; HTTPOnly; SameSite=None x-envoy-upstream-service-time: 2 referrer-policy: origin x-pinterest-rid: 6760320056467169 Date: Thu, 08 Feb 2024 18:36:15 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: f9d1c7100d6ab6a9fc70375cea0fca5e275d3fa9
2024-02-08 18:36:15 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
621	192.168.2.5	50452	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:14 UTC	1301	OUT	GET /pagead/1p-user-list/973712236/?random=1707417370647&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=LJXqCKDEq1gQ7Nam0AM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_LzMeppNpbu0uxxfgLr4cbwIUIsaW9vg634KHtXqQFMU7_h7j&random=1362733946&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:14 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:14 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:14 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
622	192.168.2.5	50458	151.101.192.84	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:14 UTC	1918	OUT	GET /v3/?event=pagevisit&ed=%7B%22np%22%3A%22gtm%22%2C%22line_items%22%3A%5B%7B%22product_id%22%3A%220%22%2C%22product_category%22%3A%22hotel%22%7D%5D%7D&tid=2612507394325&cb=1707417371889&dep=5%2CEVENT_TAGS_ABSENT&pd=%7B%22np%22%3A%22gtm%22%2C%22em%22%3A%221bad6b8cf97131fceab8543e81f7757195fbb1d36b376ee994ad1cf17699c464%22%2C%22pin_unauth%22%3A%22dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA%22%2C%22aem_eligible_list%22%3A%5B%22fn%22%5D%7D&ad=%7B%22loc%22%3A%22https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d%22%2C%22ref%22%3A%22%22%2C%22if%22%3Afalse%2C%22sh%22%3A1024%2C%22sw%22%3A1280%2C%22mh%22%3A%226461a31a%22%2C%22is_eu%22%3Atrue%2C%22architecture%22%3A%22x86%22%2C%22bitness%22%3A%2264%22%2C%22brands%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%2C%22uaFullVersion%22%3A%22117.0.5938.132%22%2C%22ecm_enabled%22%3Atrue%7D HTTP/1.1 Host: ct.pinterest.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: ar_debug=1; _pinterest_ct_ua="TWc9PSZPbFhNRFVSUkFJRnZXZjRkVnVmUkkrZ1d2TzlKbEJWUUZMeitQeWNQazNzYWVteFJaU3NUZktHY0ZwRlRmTlYzdTdkYU5lU3RFRGdnSGFyOEtJWk5IL2JiakJuWE9hQXVkOFdIcjYvTi9zOD0mRG5sSitYRzNlTjRhYTk0OTFhdVZISDhTUUswPQ=="
2024-02-08 18:36:14 UTC	914	IN	HTTP/1.1 200 OK Connection: close Content-Length: 35 cache-control: no-cache,no-store,must-revalidate,max-age=0 pragma: no-cache expires: Sat, 01 Jan 2000 00:00:00 GMT content-type: image/gif access-control-allow-origin: * set-cookie: ar_debug=1; Expires=Fri, 07 Feb 2025 18:36:14 GMT; Path=/; Domain=.pinterest.com; Secure; HTTPOnly; SameSite=None set-cookie: _pinterest_ct_ua="TWc9PSYwQVJpWVpuUlYyYUhaM3RibDlmVUljT0YwRFQ2bUd6M0RwK2UzS2xOZVMyR2xGdS9FdTVDcitTL3ZycWFJOEF4ZW9YeVZpWmhGMGVRNDdJYkt2eHdKK1N4RSsxc0x5WU5yNFhQOGc2Z1ZEaz0mNmErM0FWR2ZWazUrbk5WZmVYR0Qzb1dlVUd3PQ=="; Expires=Fri, 07 Feb 2025 18:36:14 GMT; Path=/; Domain=ct.pinterest.com; Secure; SameSite=None x-envoy-upstream-service-time: 2 referrer-policy: origin x-pinterest-rid: 5326856773082095 Date: Thu, 08 Feb 2024 18:36:14 GMT X-CDN: fastly alt-svc: h3=":443";ma=600 Pinterest-Version: f9d1c7100d6ab6a9fc70375cea0fca5e275d3fa9
2024-02-08 18:36:14 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 f0 01 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b Data Ascii: GIF89a,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
623	192.168.2.5	50455	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:14 UTC	1299	OUT	GET /pagead/1p-user-list/975716499/?random=1707417370676&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=BcW9COaWsFgQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_CrvmsnkrL4j8rnj7_ZOlfIaZanCgUCGkQWsiv5XQISf9Bc9m&random=76924871&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:15 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:15 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:15 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
624	192.168.2.5	50463	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:15 UTC	1301	OUT	GET /pagead/1p-user-list/975716499/?random=1707417370697&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v79615461za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&label=mzmpCMbAq1gQk4Gh0QM&frm=0&tiba=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_TZaZIOlEuym-CAVb6ThpCoKygR4gz3I5SBnm0V9VIC71TcTV&random=4201010768&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:15 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:15 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:15 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
625	192.168.2.5	50464	216.137.45.32	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:16 UTC	2371	OUT	POST /v1/report HTTP/1.1 Host: web-perf.booking.com Connection: keep-alive Content-Length: 1913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=utf-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; lastSeen=1707417375276
2024-02-08 18:36:16 UTC	1913	OUT	Data Raw: 7b 22 6d 65 74 72 69 63 73 22 3a 7b 22 77 65 62 56 69 74 61 6c 73 22 3a 7b 22 74 74 66 62 22 3a 7b 22 69 64 22 3a 22 76 33 2d 31 37 30 37 34 31 37 33 37 32 31 38 37 2d 33 32 37 35 35 34 32 30 32 36 35 31 32 22 2c 22 76 61 6c 75 65 22 3a 31 30 37 35 2c 22 6e 61 76 69 67 61 74 69 6f 6e 54 79 70 65 22 3a 22 6e 61 76 69 67 61 74 65 22 7d 2c 22 66 63 70 22 3a 7b 22 69 64 22 3a 22 76 33 2d 31 37 30 37 34 31 37 33 37 32 31 38 37 2d 38 34 39 33 31 33 33 35 39 39 32 33 39 22 2c 22 76 61 6c 75 65 22 3a 33 38 38 39 2e 38 39 39 39 39 39 39 39 39 39 39 34 2c 22 6e 61 76 69 67 61 74 69 6f 6e 54 79 70 65 22 3a 22 6e 61 76 69 67 61 74 65 22 7d 2c 22 63 6c 73 22 3a 7b 22 69 64 22 3a 22 76 33 2d 31 37 30 37 34 31 37 33 37 32 33 34 31 2d 32 36 30 36 30 31 33 39 37 33 36 36 Data Ascii: {"metrics":{"webVitals":{"ttfb":{"id":"v3-1707417372187-3275542026512","value":1075,"navigationType":"navigate"},"fcp":{"id":"v3-1707417372187-8493133599239","value":3889.899999999994,"navigationType":"navigate"},"cls":{"id":"v3-1707417372341-260601397366
2024-02-08 18:36:16 UTC	648	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 11 Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:16 GMT vary: Origin access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true referrer-policy: no-referrer x-frame-options: SAMEORIGIN x-content-type-options: nosniff strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 b4790a738b783de30820c68685c1da3a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-C2 X-Amz-Cf-Id: Lw11EkekW3jxyNtqH1L7pY_wypyY55gu2bGHxUV6qAjhmmiw7J6v3Q==
2024-02-08 18:36:16 UTC	11	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 7d Data Ascii: {"ok":true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
626	192.168.2.5	50466	13.32.208.75	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:16 UTC	3023	OUT	GET /auth/oauth2?client_id=vO1Kblk7xX9tUn2cpZLS&redirect_uri=https%3A%2F%2Fsecure.booking.com%2Flogin.html%3Fop%3Doauth_return&response_type=code&lang=en-us&aid=304142&bkng_action=index&prompt=signin&state=UrMBgkQNS1KiqaarhO6u8GC5pLvbDzh05Jv3O7fBVre6Nq4fPbBeTIEnVM3oarUsKJ_zmYJwP7hj2rzLKwHaucbz6cOiW6TMT2BoYQhI0E_OB8HcQpKUqnRkDABT1Fkn1G5_tqsYKNgKxwnCle9VWbm7sPUHFgkeTFM66Gm2zmKaFmeoqOY3vXIeOTBoWkkxDkiRQjBZqiN0i357B9QuByZ951RdWcagGjko7SwvUPhzQPaMKc0%3DeyJpZCI6InRyYXZlbGxlcl9oZWFkZXIifQ%3D%3D HTTP/1.1 Host: account.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJlNTJkY2Q1MS02OTliLTQ1ZTgtODA3MC03Y2M5MWE1NzM1NmIiLCJzZXNzaW9ucyI6W119fQ; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; lastSeen=1707417375258
2024-02-08 18:36:16 UTC	3865	IN	HTTP/1.1 302 Found Transfer-Encoding: chunked Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:16 GMT location: /sign-in?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA content-security-policy: base-uri 'none'; frame-ancestors https://.booking.com https://.booking.cn; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=block&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UM2tEFs8WDzZlGp4vxZwS2FvjTla19z45qAFiwjtZD_CLfFmeqrclVq6jdMVZDJVLOxB8QsWVfRHPZt2y7Pxzoqw; script-src 'report-sample' 'nonce-5mMwcOMkDMOk7sQ' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com content-security-policy-report-only: connect-src 'self' .perimeterx.net .px-cdn.net .px-client.net .px-cloud.net .pxchk.net .token.awswaf.com cdn.cookielaw.org geolocation.onetrust.com privacyportal-eu.onetrust.com saa.booking.com secure.booking.com www.google-analytics.com; default-src 'self' .bstatic.com bstatic.com; frame-src .booking.com .bstatic.com bstatic.com paymentcomponent.booking.com secure.booking.com www.booking.com; img-src 'self' data: .bstatic.com .perimeterx.net .px-cloud.net .static.booking.cn account.booking.com bstatic.com cdn.cookielaw.org graph.facebook.com stats.g.doubleclick.net www.booking.com www.google-analytics.com www.google.com www.gstatic.com; report-uri https://nellie.booking.com/csp-report-uri?type=report&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UM2tEFs8WDzZlGp4vxZwS2FvjTla19z45qAFiwjtZD_CLfFmeqrclVq6jdMVZDJVLOxB8QsWVfRHPZt2y7Pxzoqw; script-src 'report-sample' 'nonce-5mMwcOMkDMOk7sQ' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com; style-src 'self' 'unsafe-inline' .bstatic.com *.static.booking.cn bstatic.com set-cookie: bkng_ap_lang=en-us; domain=account.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:16 GMT; secure; HttpOnly set-cookie: bkng_sso_session=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:16 GMT; secure; HttpOnly set-cookie: bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; domain=.booking.com; path=/; expires=Fri, 09-Feb-2024 18:36:16 GMT; secure; HttpOnly set-cookie: bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJlNTJkY2Q1MS02OTliLTQ1ZTgtODA3MC03Y2M5MWE1NzM1NmIiLCJzZXNzaW9ucyI6W119fQ; domain=account.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:16 GMT; SameSite=Lax; secure; HttpOnly set-cookie: bkng_sso_ses=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:16 GMT; secure; HttpOnly x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 9e18259ccc98f7a9dcd0fe17b60688c2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD66-C1 X-Amz-Cf-Id: ZEuoZi2m0hTsJ9mzovwr3mvRynaANNQLMEZ6kGw24F3MKSfrXOHC9A==
2024-02-08 18:36:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
627	192.168.2.5	50471	3.161.193.117	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:16 UTC	2117	OUT	GET /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; lastSeen=1707417375276
2024-02-08 18:36:16 UTC	513	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html;charset=iso-8859-1 Content-Length: 411 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:16 GMT cache-control: must-revalidate,no-cache,no-store strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 d3b019645d09c89af6e150e75be90942.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P8 X-Amz-Cf-Id: zDv2_mSvwYrSb6eObwZhPpESq06vBpPZwkKUsuahqXzwjusb6kebSw==
2024-02-08 18:36:16 UTC	411	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 2f 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 32 3e 48 54 54 50 20 45 52 52 4f 52 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 32 3e 0a 3c 74 61 62 6c 65 3e 0a 3c 74 72 3e 3c 74 68 3e 55 52 49 3a 3c 2f 74 68 3e 3c 74 64 3e 2f 77 65 62 2d 76 69 74 61 6c 73 2f 73 65 6e 64 2d 76 69 74 61 6c 73 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/><title>Error 405 Method Not Allowed</title></head><body><h2>HTTP ERROR 405 Method Not Allowed</h2><table><tr><th>URI:</th><td>/web-vitals/send-vitals</td></tr><tr>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
628	192.168.2.5	50472	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:16 UTC	4130	OUT	GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=87e482caf42702d0&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in&etcg=cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3&ets=cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|4,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|2,cCHObKdBdUHINPSXeHDALOLOLMO\|5,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAmb6ChG0GAAAA:1YfdqTGcz5Nv+ySyR4l0dcP3pMoTORFatiNiGWJ7MN9YNAXjrj+JwLDSBSegMncHAdyNNPOjNsaeDm9pbnbRLlIYy/Wsa0l3RRdVGZNwHvCL7MSxVUeOoLQbnA4ws/oCccvImOwo8CVethnhcZ8jRyLom9EtR+hCle5g3/E4tScqZS87YMPrAUoKpLzL6QZghMKuNcinEXGdtGGXi/+Tn/jd1osZzUxtKgagCgVNA7aglFhxkvVLvhbzVj9tZG3VnoD+k6IF; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; lastSeen=1707417375276
2024-02-08 18:36:16 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:16 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=5ea182d0f6770083&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejKYY-jEXCIT-7AvK7SIuQwJ5XEUtQTBOQ4 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 6f067a3fd6e721a7db2a2901701a65d8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: ziNCn8vEO2msiZPnVjhHjBgunVx8Xf3vH1pbCyKGNXSR2u169Ocveg==
2024-02-08 18:36:16 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
629	192.168.2.5	50469	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:16 UTC	3038	OUT	GET /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAmb6ChG0GAAAA:1YfdqTGcz5Nv+ySyR4l0dcP3pMoTORFatiNiGWJ7MN9YNAXjrj+JwLDSBSegMncHAdyNNPOjNsaeDm9pbnbRLlIYy/Wsa0l3RRdVGZNwHvCL7MSxVUeOoLQbnA4ws/oCccvImOwo8CVethnhcZ8jRyLom9EtR+hCle5g3/E4tScqZS87YMPrAUoKpLzL6QZghMKuNcinEXGdtGGXi/+Tn/jd1osZzUxtKgagCgVNA7aglFhxkvVLvhbzVj9tZG3VnoD+k6IF; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; lastSeen=1707417375276
2024-02-08 18:36:16 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:16 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=cfd982d0b2e4014b&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGf6Nl5ZeVgJA_R9hsp5wRrOsmZTKhCCVBQ x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 b0c7b942a33f0f4451718aee53f7840c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Q3rDP1GghID8q3u3rXWB_dKwDN7fhlNZ9QZmJUuWEGZlcrYB7Sa6ew==
2024-02-08 18:36:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
630	192.168.2.5	50468	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:16 UTC	3340	OUT	GET /js_tracking?sid=5171fc655664ddf74ab763a094523fb7&aid=304142&ref_action=index&ver=2&pid=87e482caf42702d0&lang=en-us&stype=1&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_lcp_ms\|3889&m=UmFuZG9tSVYkc2RlIyh9YUe5zZbLHt0YNre0CiGBBmP5hKTY_IzZqpWBtitYrnE-ba2NOPqZSPGdnbkQM2vO343hpsChBnayfrRG7jVW0hI1Ke4kKZ85U_m7O1xbR8NLSlv2Zn-4d5ku6anu7qAZgjoLQxWZjIis3cNA3ef3I_aOxDvMotUV5ZQc6OhcEEody8ooGsshLIhRMDad6kRNg_HeFvW36Wr8mOnNh6fMuy8OZ9w095BIb2XL0zt8fY-5SPQHxgI7NWrdI31vzPG5nOwkA1lE2mJxFh3z4YXPwcZPq5z6drlkg3iN9tdtKjt0cXf7rJdLIbIGLmOniyEf0g HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAmb6ChG0GAAAA:1YfdqTGcz5Nv+ySyR4l0dcP3pMoTORFatiNiGWJ7MN9YNAXjrj+JwLDSBSegMncHAdyNNPOjNsaeDm9pbnbRLlIYy/Wsa0l3RRdVGZNwHvCL7MSxVUeOoLQbnA4ws/oCccvImOwo8CVethnhcZ8jRyLom9EtR+hCle5g3/E4tScqZS87YMPrAUoKpLzL6QZghMKuNcinEXGdtGGXi/+Tn/jd1osZzUxtKgagCgVNA7aglFhxkvVLvhbzVj9tZG3VnoD+k6IF; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; lastSeen=1707417375276
2024-02-08 18:36:16 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:16 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=17e282d024510036&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejLYYZX75cAvekNJ_f_R2rkq9SSbbLX48vo x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 76f3fedc86826a7b266250e33ee41082.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 6pCxW2xFm5B8mCt-5iLv1_1mxysmy0otsYfYly05nLSNeNTslUtezw==
2024-02-08 18:36:16 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
631	192.168.2.5	50465	13.32.208.75	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:16 UTC	3219	OUT	GET /sign-in?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA HTTP/1.1 Host: account.booking.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJlNTJkY2Q1MS02OTliLTQ1ZTgtODA3MC03Y2M5MWE1NzM1NmIiLCJzZXNzaW9ucyI6W119fQ; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; lastSeen=1707417375276; bkng_ap_lang=en-us; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16
2024-02-08 18:36:17 UTC	3094	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:17 GMT content-security-policy: base-uri 'none'; frame-ancestors https://.booking.com https://.booking.cn; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=block&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgc98bqahgr47O5fWUs4jdc0-6HVbNVAp-lO2kOQ0_4HywKHPhrGxBbI; script-src 'report-sample' 'nonce-8AAdJYFHxQuvYgO' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com content-security-policy-report-only: connect-src 'self' .perimeterx.net .px-cdn.net .px-client.net .px-cloud.net .pxchk.net .token.awswaf.com cdn.cookielaw.org geolocation.onetrust.com privacyportal-eu.onetrust.com saa.booking.com secure.booking.com www.google-analytics.com; default-src 'self' .bstatic.com bstatic.com; frame-src .booking.com .bstatic.com bstatic.com paymentcomponent.booking.com secure.booking.com www.booking.com; img-src 'self' data: .bstatic.com .perimeterx.net .px-cloud.net .static.booking.cn account.booking.com bstatic.com cdn.cookielaw.org graph.facebook.com stats.g.doubleclick.net www.booking.com www.google-analytics.com www.google.com www.gstatic.com; report-uri https://nellie.booking.com/csp-report-uri?type=report&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgc98bqahgr47O5fWUs4jdc0-6HVbNVAp-lO2kOQ0_4HywKHPhrGxBbI; script-src 'report-sample' 'nonce-8AAdJYFHxQuvYgO' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com; style-src 'self' 'unsafe-inline' .bstatic.com *.static.booking.cn bstatic.com set-cookie: bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJzZXNzaW9ucyI6W10sImRhdGFfc3ViamVjdF9pZCI6ImU1MmRjZDUxLTY5OWItNDVlOC04MDcwLTdjYzkxYTU3MzU2YiJ9fQ; domain=account.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:17 GMT; SameSite=Lax; secure; HttpOnly set-cookie: bkng_ap=U2FsdGVkX19Oh1T4TMhfk3ZcugI8eRbAeWa9oHLG9diWo4MPNQFGV5mUt%2FwqVJIQw%2F1M2NSGb5TS%0AqvFsettmzw%3D%3D%0A; domain=account.booking.com; path=/; secure; HttpOnly set-cookie: bkng_sso_ses=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:17 GMT; secure; HttpOnly set-cookie: bkng_sso_session=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:17 GMT; secure; HttpOnly x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 69e952c7b08727f752b5559b0b6d2108.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD66-C1 X-Amz-Cf-Id: AkJ4N8xlk33O_UqxbJtafX5w2FI71E87gvoIPBGXQBhd26o0-BChBA==
2024-02-08 18:36:17 UTC	13290	IN	Data Raw: 31 37 30 33 31 0d 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 0a 20 20 20 20 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 38 41 41 64 4a 59 46 48 78 51 75 76 59 67 4f 22 3e 0a 20 20 20 20 20 20 20 20 0a 28 66 75 6e 63 74 69 6f 6e 28 20 77 69 6e 2c 20 64 6f 63 20 29 20 7b 0a 0a 20 20 20 20 76 61 72 20 65 72 72 6f 72 73 20 20 20 20 20 3d 20 5b 5d 2c 0a 20 20 20 20 20 20 20 20 65 72 72 6f 72 43 6f 75 6e 74 20 3d 20 30 2c 0a 20 20 20 20 20 20 20 20 63 61 6e 50 61 Data Ascii: 17031<!DOCTYPE html><html class="no-js" lang="en-us"><head><meta http-equiv="X-UA-Compatible" content="IE=edge" /> <script nonce="8AAdJYFHxQuvYgO"> (function( win, doc ) { var errors = [], errorCount = 0, canPa
2024-02-08 18:36:17 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 65 72 72 6f 72 3a 20 20 73 65 72 69 61 6c 69 7a 65 28 20 65 72 72 6f 72 20 29 0a 0a 20 20 20 20 20 20 20 20 7d 2c 20 66 75 6e 63 74 69 6f 6e 28 20 72 65 73 70 6f 6e 73 65 54 65 78 74 2c 20 72 65 73 70 6f 6e 73 65 53 74 61 74 75 73 20 29 20 7b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 20 2b 72 65 73 70 6f 6e 73 65 53 74 61 74 75 73 20 3d 3d 3d 20 35 30 33 20 7c 7c 20 72 65 73 70 6f 6e 73 65 54 65 78 74 20 3d 3d 3d 20 27 73 68 75 74 20 75 70 27 20 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 53 45 52 56 45 52 5f 41 53 4b 45 44 5f 54 4f 5f 42 4c 4f 43 4b 20 3d 20 74 72 75 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 72 65 61 74 65 43 6f 6f 6b 69 65 28 20 27 65 72 72 6f 72 5f 63 61 Data Ascii: error: serialize( error ) }, function( responseText, responseStatus ) { if ( +responseStatus === 503 \|\| responseText === 'shut up' ) { SERVER_ASKED_TO_BLOCK = true; createCookie( 'error_ca
2024-02-08 18:36:17 UTC	16384	IN	Data Raw: 65 72 72 6f 72 4f 62 6a 2e 61 73 53 74 72 69 6e 67 20 3d 20 20 20 27 33 72 64 5f 50 61 72 74 79 5f 45 78 74 65 72 6e 61 6c 5f 53 63 72 69 70 74 5f 45 72 72 6f 72 27 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 65 72 72 6f 72 4f 62 6a 2e 74 68 69 72 64 50 61 72 74 79 4b 65 79 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 74 68 69 72 64 50 61 72 74 79 42 72 65 61 6b 44 6f 77 6e 4c 61 62 65 6c 28 20 65 72 72 6f 72 4f 62 6a 2e 74 68 69 72 64 50 61 72 74 79 4b 65 79 20 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 65 72 72 6f 72 4f 62 6a 2e 73 74 61 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 65 6c 73 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 Data Ascii: errorObj.asString = '3rd_Party_External_Script_Error' + errorObj.thirdPartyKey + thirdPartyBreakDownLabel( errorObj.thirdPartyKey ) + errorObj.stack; } else {
2024-02-08 18:36:17 UTC	16384	IN	Data Raw: 74 69 74 79 5f 61 63 63 6f 75 6e 74 5f 73 69 67 6e 5f 69 6e 5f 61 70 70 6c 65 22 7d 5d 2c 22 70 68 6f 6e 65 5f 63 6f 75 6e 74 72 69 65 73 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 41 6e 64 6f 72 72 61 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 61 64 22 2c 22 70 72 65 66 69 78 22 3a 22 2b 33 37 36 22 7d 2c 7b 22 70 72 65 66 69 78 22 3a 22 2b 39 37 31 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 61 65 22 2c 22 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 41 72 61 62 20 45 6d 69 72 61 74 65 73 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 41 66 67 68 61 6e 69 73 74 61 6e 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 61 66 22 2c 22 70 72 65 66 69 78 22 3a 22 2b 39 33 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 41 6e 74 69 67 75 61 20 26 20 42 61 72 62 75 64 Data Ascii: tity_account_sign_in_apple"}],"phone_countries":[{"name":"Andorra","country_code":"ad","prefix":"+376"},{"prefix":"+971","country_code":"ae","name":"United Arab Emirates"},{"name":"Afghanistan","country_code":"af","prefix":"+93"},{"name":"Antigua & Barbud
2024-02-08 18:36:17 UTC	16384	IN	Data Raw: 6d 22 3a 22 4b 65 65 70 20 69 6e 20 6d 69 6e 64 20 74 68 61 74 20 66 6f 72 20 73 65 63 75 72 69 74 79 20 72 65 61 73 6f 6e 73 20 77 65 20 63 61 6e 20 6f 6e 6c 79 20 61 75 74 68 6f 72 69 7a 65 20 6c 6f 67 69 6e 73 20 76 65 72 69 66 69 65 64 20 62 79 20 61 20 63 61 6c 6c 2f 74 65 78 74 20 6d 65 73 73 61 67 65 2e 20 49 66 20 79 6f 75 20 63 61 6e 27 74 20 75 73 65 20 61 6e 79 20 6f 66 20 79 6f 75 72 20 73 61 76 65 64 20 70 68 6f 6e 65 20 6e 75 6d 62 65 72 73 20 72 69 67 68 74 20 6e 6f 77 2c 20 74 72 79 20 77 61 69 74 69 6e 67 20 75 6e 74 69 6c 20 79 6f 75 20 63 61 6e 20 75 73 65 20 74 68 65 6d 2e 20 49 66 20 79 6f 75 20 68 61 76 65 20 61 6e 20 75 72 67 65 6e 74 20 69 73 73 75 65 20 62 75 74 20 64 6f 6e 27 74 20 68 61 76 65 20 61 63 63 65 73 73 20 74 6f 20 74 Data Ascii: m":"Keep in mind that for security reasons we can only authorize logins verified by a call/text message. If you can't use any of your saved phone numbers right now, try waiting until you can use them. If you have an urgent issue but don't have access to t
2024-02-08 18:36:17 UTC	15440	IN	Data Raw: 73 22 2c 22 61 63 63 6f 75 6e 74 5f 63 72 65 61 74 65 5f 61 63 63 6f 75 6e 74 5f 68 65 61 64 65 72 22 3a 22 43 72 65 61 74 65 20 79 6f 75 72 20 61 63 63 6f 75 6e 74 22 2c 22 69 61 6d 5f 61 70 5f 6a 6f 69 6e 61 70 70 5f 68 65 61 64 65 72 22 3a 22 53 69 67 6e 20 75 70 22 2c 22 61 63 63 5f 73 65 63 5f 69 6e 63 69 64 65 6e 74 5f 72 65 70 6f 72 74 5f 63 68 65 63 6b 62 6f 78 5f 70 68 69 73 68 69 6e 67 5f 63 61 6c 6c 22 3a 22 49 20 6d 69 67 68 74 20 68 61 76 65 20 61 63 63 69 64 65 6e 74 61 6c 6c 79 20 72 65 76 65 61 6c 65 64 20 6d 79 20 6c 6f 67 69 6e 20 64 65 74 61 69 6c 73 20 74 68 72 6f 75 67 68 20 61 20 70 68 69 73 68 69 6e 67 20 6c 69 6e 6b 20 6f 72 20 64 75 72 69 6e 67 20 61 20 70 68 6f 6e 65 20 63 61 6c 6c 22 2c 22 61 63 63 6f 75 6e 74 5f 74 61 62 73 5f Data Ascii: s","account_create_account_header":"Create your account","iam_ap_joinapp_header":"Sign up","acc_sec_incident_report_checkbox_phishing_call":"I might have accidentally revealed my login details through a phishing link or during a phone call","account_tabs_
2024-02-08 18:36:17 UTC	16384	IN	Data Raw: 31 66 66 37 61 0d 0a 74 61 72 74 5f 6c 69 6e 6b 7d 4e 6f 74 20 79 6f 75 72 20 6e 75 6d 62 65 72 3f 7b 65 6e 64 5f 6c 69 6e 6b 7d 22 2c 22 61 63 63 5f 73 65 63 5f 69 6e 63 69 64 65 6e 74 5f 72 65 70 6f 72 74 5f 77 61 72 6e 69 6e 67 5f 63 72 65 64 65 6e 74 69 61 6c 5f 72 65 71 75 69 72 65 64 22 3a 22 45 6e 74 65 72 20 65 69 74 68 65 72 20 79 6f 75 72 20 50 72 6f 70 65 72 74 79 20 49 44 20 6f 72 20 75 73 65 72 6e 61 6d 65 20 74 6f 20 68 65 6c 70 20 75 73 20 73 6f 6c 76 65 20 79 6f 75 72 20 69 73 73 75 65 20 66 61 73 74 65 72 2e 22 2c 22 61 63 63 6f 75 6e 74 5f 76 61 6c 69 64 61 74 69 6f 6e 5f 6e 65 77 5f 70 61 73 73 77 6f 72 64 5f 65 6d 70 74 79 22 3a 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 79 6f 75 72 20 6e 65 77 20 70 61 73 73 77 6f 72 64 22 2c 22 69 64 Data Ascii: 1ff7atart_link}Not your number?{end_link}","acc_sec_incident_report_warning_credential_required":"Enter either your Property ID or username to help us solve your issue faster.","account_validation_new_password_empty":"Please enter your new password","id
2024-02-08 18:36:17 UTC	16384	IN	Data Raw: 67 6e 20 69 6e 22 2c 22 61 63 63 5f 73 65 63 5f 69 6e 63 69 64 65 6e 74 5f 72 65 70 6f 72 74 5f 6e 65 77 5f 73 69 67 6e 5f 69 6e 5f 74 69 74 6c 65 22 3a 22 4e 65 77 20 73 69 67 6e 2d 69 6e 20 74 6f 20 79 6f 75 72 20 61 63 63 6f 75 6e 74 21 22 2c 22 6f 61 75 74 68 5f 73 63 6f 70 65 5f 74 69 74 6c 65 5f 67 65 6e 69 75 73 22 3a 22 47 65 6e 69 75 73 20 73 74 61 74 75 73 22 2c 22 61 63 63 6f 75 6e 74 5f 63 72 65 61 74 65 5f 62 6f 74 5f 63 68 61 6c 6c 65 6e 67 65 5f 64 65 73 63 22 3a 22 54 6f 20 63 6f 6e 66 69 72 6d 20 79 6f 75 27 72 65 20 61 20 68 75 6d 61 6e 2c 20 70 72 65 73 73 20 61 6e 64 20 68 6f 6c 64 20 74 68 65 20 62 75 74 74 6f 6e 20 62 65 6c 6f 77 2e 22 2c 22 69 61 6d 5f 65 6d 61 69 6c 5f 72 65 73 74 6f 72 65 64 5f 6c 6f 63 6b 65 64 5f 64 65 73 63 22 Data Ascii: gn in","acc_sec_incident_report_new_sign_in_title":"New sign-in to your account!","oauth_scope_title_genius":"Genius status","account_create_bot_challenge_desc":"To confirm you're a human, press and hold the button below.","iam_email_restored_locked_desc"
2024-02-08 18:36:17 UTC	16384	IN	Data Raw: 65 72 69 66 69 63 61 74 69 6f 6e 5f 73 63 72 65 65 6e 5f 68 65 61 64 65 72 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 57 65 20 73 65 6e 74 20 61 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 63 6f 64 65 20 74 6f 20 74 68 65 20 70 68 6f 6e 65 20 6e 75 6d 62 65 72 20 61 74 74 61 63 68 65 64 20 74 6f 20 79 6f 75 72 20 61 63 63 6f 75 6e 74 2e 20 20 22 2c 22 69 61 6d 5f 70 75 6c 73 65 5f 74 66 61 5f 76 69 61 5f 65 78 74 72 61 6e 65 74 5f 6f 74 68 65 72 5f 6f 70 74 69 6f 6e 73 5f 63 74 61 22 3a 22 4e 6f 74 20 77 6f 72 6b 69 6e 67 3f 20 7b 73 74 61 72 74 5f 6c 69 6e 6b 7d 56 65 72 69 66 79 20 61 6e 6f 74 68 65 72 20 77 61 79 7b 65 6e 64 5f 6c 69 6e 6b 7d 22 2c 22 61 63 63 5f 73 65 63 5f 69 6e 63 69 64 65 6e 74 5f 72 65 70 6f 72 74 5f 63 75 73 74 6f 6d 65 72 5f 73 Data Ascii: erification_screen_header_description":"We sent a verification code to the phone number attached to your account. ","iam_pulse_tfa_via_extranet_other_options_cta":"Not working? {start_link}Verify another way{end_link}","acc_sec_incident_report_customer_s
2024-02-08 18:36:17 UTC	16384	IN	Data Raw: 5f 69 6e 66 6f 22 3a 22 49 20 70 72 6f 76 69 64 65 64 20 67 75 65 73 74 20 72 65 73 65 72 76 61 74 69 6f 6e 20 69 6e 66 6f 22 2c 22 61 63 63 6f 75 6e 74 5f 64 65 6c 65 74 69 6f 6e 5f 6c 70 5f 68 65 61 64 69 6e 67 22 3a 22 59 6f 75 72 20 61 63 63 6f 75 6e 74 20 68 61 73 20 62 65 65 6e 20 64 65 6c 65 74 65 64 22 2c 22 70 61 72 74 6e 65 72 5f 69 64 6d 5f 66 65 64 65 72 61 74 65 64 5f 61 63 63 6f 75 6e 74 5f 75 6e 6c 6f 63 6b 5f 76 65 72 69 66 69 63 61 74 69 6f 6e 5f 6c 69 6e 6b 5f 65 6d 61 69 6c 5f 65 78 70 6c 61 6e 61 74 69 6f 6e 22 3a 22 4f 6e 63 65 20 79 6f 75 20 63 6f 6d 70 6c 65 74 65 20 74 68 65 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 70 72 6f 63 65 73 73 2c 20 77 65 27 6c 6c 20 75 6e 6c 6f 63 6b 20 79 6f 75 72 20 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 Data Ascii: _info":"I provided guest reservation info","account_deletion_lp_heading":"Your account has been deleted","partner_idm_federated_account_unlock_verification_link_email_explanation":"Once you complete the verification process, we'll unlock your Booking.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
632	192.168.2.5	50475	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:17 UTC	3038	OUT	GET /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAmb6ChG0GAAAA:1YfdqTGcz5Nv+ySyR4l0dcP3pMoTORFatiNiGWJ7MN9YNAXjrj+JwLDSBSegMncHAdyNNPOjNsaeDm9pbnbRLlIYy/Wsa0l3RRdVGZNwHvCL7MSxVUeOoLQbnA4ws/oCccvImOwo8CVethnhcZ8jRyLom9EtR+hCle5g3/E4tScqZS87YMPrAUoKpLzL6QZghMKuNcinEXGdtGGXi/+Tn/jd1osZzUxtKgagCgVNA7aglFhxkvVLvhbzVj9tZG3VnoD+k6IF; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; lastSeen=1707417375276
2024-02-08 18:36:17 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:17 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=5ccb82d0edd40297&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGezNygyoHuzW6aANo7KW89AJkRHb9bB81A x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 9546eb427ef2137803aed00cad4fc426.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: XIyB_yjR7E6i6nlqNqo4osHOiykgTCWHZOYMfPJsGVIUL6hG_pwF_w==
2024-02-08 18:36:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
633	192.168.2.5	50477	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:17 UTC	446	OUT	GET /xdata/images/city/170x136/977416.jpg?k=ea06e0b572ff052f4fe4fcf35ac3616e8d1b7300f0402756c460a4e9c19e54ed&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:17 UTC	542	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 5928 Connection: close Server: nginx Date: Tue, 30 Jan 2024 12:58:53 GMT ETag: "ebc0243ff8aead66390fde60c468bfa6fd8034d9" Content-Language: 5928 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 31341771a4bfa40d7b1f61883ffb56c6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: AQ6VnaQwwts0Ti6SMaq5jlj__epCaMLfBQUpksR0hIkwrmSFZYhDTw== Age: 797844
2024-02-08 18:36:17 UTC	5928	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 88 00 aa 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
634	192.168.2.5	50479	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:17 UTC	451	OUT	GET /xdata/images/xphoto/263x210/45450084.jpeg?k=f8c2954e867a1dd4b479909c49528531dcfb676d8fbc0d60f51d7b51bb32d1d9&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:17 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sun, 21 Jan 2024 16:24:01 GMT ETag: "581d7d6f2cc7c0efc5bd54aa0a1fa4c3bdb259f4" Content-Language: 10257 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 d125bf8405e840aa51a88ae3d8d91fb2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: GcFHwFk483vAEBF8PVwm05zipSB5xeUaTs4WU67aKSxn2PqycTzgMg== Age: 1563136
2024-02-08 18:36:17 UTC	9596	IN	Data Raw: 32 35 37 34 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 01 07 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 2574JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:36:17 UTC	676	IN	Data Raw: 32 39 64 0d 0a 08 1a f2 ea 35 88 95 c9 c9 2b fd de f9 ae ea 08 d6 38 95 47 40 31 55 14 4b 22 bb b8 8e ce d2 5b 89 4e 12 35 2c df 85 78 ae a9 77 71 a8 ea 13 dd ca 1c 34 8c 4e 37 7d d1 d8 7e 55 da 78 f7 5c 42 cb a5 45 24 58 18 69 c3 12 79 ea 07 1f 9f e5 5c 11 31 67 9f b3 7e 11 b1 ae 98 47 4b 9c 95 67 77 64 42 55 87 73 ff 00 7f 68 08 e7 fb df f7 f2 a4 de 9f de 83 fe fc b5 34 b2 1e 33 6d f8 a3 56 96 32 b8 08 df 3d 1f fe fa a3 63 ff 00 b5 ff 00 7d d2 86 8d 47 fc bb 7f df 0c 7f ad 29 92 33 fc 56 df f7 e9 a8 00 c3 a8 e4 b0 ff 00 b6 d8 a4 08 fc 13 bb fe fe d2 99 53 a6 e8 31 ed 13 52 f9 b1 91 f7 ed ff 00 ef c3 50 17 02 8e 7a 6f fc 25 06 94 23 8e bb c7 fd b5 c5 37 7c 78 fb d6 c7 eb 0b 53 d6 48 c1 fb d6 ff 00 84 0c 68 01 08 1d 0b 27 fc 0a e0 1a 6e d4 ff 00 a6 27 f1 Data Ascii: 29d5+8G@1UK"[N5,xwq4N7}~Ux\BE$Xiy\1g~GKgwdBUsh43mV2=c}G)3VS1RPzo%#7\|xSHh'n'
2024-02-08 18:36:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
635	192.168.2.5	50480	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:17 UTC	3173	OUT	GET /js_tracking?ref_action=index&ver=2&stype=1&lang=en-us&pid=87e482caf42702d0&ete=&etg=&etcg=cCHObEfEITNPfbeQMIaWYUQJFFQccCcCcCC\|5&ets=NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,cCHObKdBdUHINPSXeHDALOLOLMO\|3&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAmb6ChG0GAAAA:1YfdqTGcz5Nv+ySyR4l0dcP3pMoTORFatiNiGWJ7MN9YNAXjrj+JwLDSBSegMncHAdyNNPOjNsaeDm9pbnbRLlIYy/Wsa0l3RRdVGZNwHvCL7MSxVUeOoLQbnA4ws/oCccvImOwo8CVethnhcZ8jRyLom9EtR+hCle5g3/E4tScqZS87YMPrAUoKpLzL6QZghMKuNcinEXGdtGGXi/+Tn/jd1osZzUxtKgagCgVNA7aglFhxkvVLvhbzVj9tZG3VnoD+k6IF; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; lastSeen=1707417375276; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16
2024-02-08 18:36:17 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:17 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=a51882d032af0028&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejJmPYSDTqrbdnEMrxcwigvlLAaxSoe_Tzo x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 d125bf8405e840aa51a88ae3d8d91fb2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 91MPaiCjVSkViD76Dt1Z4sMubalf2z80EIfZWuUDBjbdgp9za-okNw==
2024-02-08 18:36:17 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
636	192.168.2.5	50478	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:17 UTC	2894	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAmb6ChG0GAAAA:1YfdqTGcz5Nv+ySyR4l0dcP3pMoTORFatiNiGWJ7MN9YNAXjrj+JwLDSBSegMncHAdyNNPOjNsaeDm9pbnbRLlIYy/Wsa0l3RRdVGZNwHvCL7MSxVUeOoLQbnA4ws/oCccvImOwo8CVethnhcZ8jRyLom9EtR+hCle5g3/E4tScqZS87YMPrAUoKpLzL6QZghMKuNcinEXGdtGGXi/+Tn/jd1osZzUxtKgagCgVNA7aglFhxkvVLvhbzVj9tZG3VnoD+k6IF; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; lastSeen=1707417375276; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16
2024-02-08 18:36:17 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:17 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=dc5782d0a96801d8&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsv5AZ19OexiKfVhA39B92_52d0RazC61Ic x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 25d9b5959eaa82bb18ee3f35e6bf34b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: URf4TP14kOCGF9UWK8HrOJLfitWqnTtcpUA00sO_qF91lp-0gFjGTQ==
2024-02-08 18:36:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
637	192.168.2.5	50482	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:17 UTC	3038	OUT	GET /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAmb6ChG0GAAAA:1YfdqTGcz5Nv+ySyR4l0dcP3pMoTORFatiNiGWJ7MN9YNAXjrj+JwLDSBSegMncHAdyNNPOjNsaeDm9pbnbRLlIYy/Wsa0l3RRdVGZNwHvCL7MSxVUeOoLQbnA4ws/oCccvImOwo8CVethnhcZ8jRyLom9EtR+hCle5g3/E4tScqZS87YMPrAUoKpLzL6QZghMKuNcinEXGdtGGXi/+Tn/jd1osZzUxtKgagCgVNA7aglFhxkvVLvhbzVj9tZG3VnoD+k6IF; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; lastSeen=1707417375276
2024-02-08 18:36:17 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:17 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=73a282d0343400dc&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGTecE7auO1ujcif9c0U7UoLTuKJgIb3J2g x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 6f067a3fd6e721a7db2a2901701a65d8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 1a07w1oEfzyPgTXsp7SU5TSLD8aGHschP8-68peMrPHL665pw5oFHw==
2024-02-08 18:36:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
638	192.168.2.5	50483	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:17 UTC	584	OUT	GET /psb/accountsportal/assets/45_1975cbc2f7eaad75f590.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:17 UTC	606	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 92562 Connection: close Last-Modified: Tue, 06 Feb 2024 12:55:16 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 1f13962ed2aa130897d600c5ba6398edd4d254622ce0a1b5a9c68a325e5687ca Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 14:45:36 GMT ETag: "d2e841cb3b0b0274a4196fd767d65edb" X-Cache: Hit from cloudfront Via: 1.1 a1a074529ccb9ea97acd7d95c506f336.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: QuPtii5SpXIClzSAGehyfj437yIgAS1mFq5gM7_6RQBApRB3KGbvvQ== Age: 13842 Vary: Origin
2024-02-08 18:36:17 UTC	15778	IN	Data Raw: 2e 71 4e 79 53 5f 50 4a 73 44 6c 37 71 4c 71 33 36 32 44 65 34 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 2e 51 5a 62 45 5f 52 4c 36 5f 45 59 58 31 38 71 4e 69 6e 4e 4d 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 67 32 50 37 76 5a 64 4f 56 67 38 41 34 30 54 6d 51 41 43 77 7b 6f 70 61 63 69 74 79 3a 30 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 76 61 72 28 2d 2d 62 75 69 5f 74 69 6d 69 6e 67 2d 64 65 6c 69 62 65 72 61 74 65 29 20 76 61 72 28 2d 2d 62 75 69 5f 65 61 73 69 6e 67 2d 73 6c 6f 77 2d 6f 75 74 29 3b 74 72 61 6e 73 69 74 69 6f 6e 2d 70 72 6f 70 65 72 74 79 3a 6f 70 61 63 69 74 79 2c 74 72 61 6e 73 66 6f Data Ascii: .qNyS_PJsDl7qLq362De4{display:inline-block;vertical-align:middle}.QZbE_RL6_EYX18qNinNM{display:block}.g2P7vZdOVg8A40TmQACw{opacity:0;pointer-events:none;transition:var(--bui_timing-deliberate) var(--bui_easing-slow-out);transition-property:opacity,transfo
2024-02-08 18:36:17 UTC	16384	IN	Data Raw: 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6c 61 72 67 65 5f 66 6f 6e 74 5f 68 65 61 64 6c 69 6e 65 5f 32 5f 6c 69 6e 65 2d 68 65 69 67 68 74 29 7d 2e 5f 4c 52 5a 38 30 78 6c 55 72 75 6d 6f 51 52 44 62 51 6d 53 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6c 61 72 67 65 5f 66 6f 6e 74 5f 68 65 61 64 6c 69 6e 65 5f 33 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6c 61 72 67 65 5f 66 6f 6e 74 5f 68 65 61 64 6c 69 6e 65 5f 33 5f 66 6f 6e 74 2d 73 69 7a 65 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6c 61 72 67 65 5f 66 6f 6e 74 5f 68 65 61 64 6c Data Ascii: --DO_NOT_USE_bui_large_font_headline_2_line-height)}._LRZ80xlUrumoQRDbQmS{font-family:var(--DO_NOT_USE_bui_large_font_headline_3_font-family);font-size:var(--DO_NOT_USE_bui_large_font_headline_3_font-size);font-weight:var(--DO_NOT_USE_bui_large_font_headl
2024-02-08 18:36:18 UTC	11069	IN	Data Raw: 49 68 6a 47 73 62 48 53 36 53 41 59 46 34 42 5f 58 6c 56 6a 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 62 61 73 69 73 3a 31 30 30 25 3b 66 6c 65 78 2d 66 6c 6f 77 3a 72 6f 77 20 77 72 61 70 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 66 6c 65 78 2d 73 74 61 72 74 3b 6c 69 73 74 2d 73 74 79 6c 65 2d 74 79 70 65 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 2a 2d 31 29 20 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 2a 2d 31 2f 32 29 20 30 20 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 2a 2d 31 2f 32 29 Data Ascii: IhjGsbHS6SAYF4B_XlVj{box-sizing:border-box;clear:both;display:flex;flex-basis:100%;flex-flow:row wrap;justify-content:flex-start;list-style-type:none;margin:calc(var(--bui_spacing_4x)-1) calc(var(--bui_spacing_4x)-1/2) 0 calc(var(--bui_spacing_4x)*-1/2)
2024-02-08 18:36:18 UTC	16384	IN	Data Raw: 67 5f 33 78 29 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 2e 79 71 4f 38 67 54 43 45 61 79 39 4b 76 79 58 70 49 72 41 56 2e 6c 71 39 6c 59 55 70 38 78 71 59 45 35 5f 63 44 69 4f 39 59 7b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 36 78 29 7d 40 2d 77 65 62 6b 69 74 2d 6b 65 79 66 72 61 6d 65 73 20 4d 32 4d 36 6f 4b 75 7a 69 52 44 58 58 5f 4b 70 6f 30 72 38 7b 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 32 74 75 72 6e 29 7d 7d 40 6b 65 79 66 72 61 6d 65 73 20 4d 32 4d 36 6f 4b 75 7a 69 52 44 58 58 5f 4b 70 6f 30 72 38 7b 30 25 7b 74 72 61 Data Ascii: g_3x) var(--bui_spacing_4x)}.yqO8gTCEay9KvyXpIrAV.lq9lYUp8xqYE5_cDiO9Y{padding:var(--bui_spacing_4x) var(--bui_spacing_6x)}@-webkit-keyframes M2M6oKuziRDXX_Kpo0r8{0%{transform:rotate(0deg)}to{transform:rotate(2turn)}}@keyframes M2M6oKuziRDXX_Kpo0r8{0%{tra
2024-02-08 18:36:18 UTC	16384	IN	Data Raw: 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6c 61 63 6b 29 7d 2e 65 43 62 48 54 33 58 44 6f 72 53 30 5a 6a 32 4d 37 56 67 54 3a 62 65 66 6f 72 65 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 2e 65 43 62 48 54 33 58 44 6f 72 53 30 5a 6a 32 4d 37 56 67 54 2e 78 33 33 43 36 6e 4f 73 43 57 6e 55 48 31 61 39 4f 34 32 31 2c 2e 65 43 62 48 54 33 58 44 6f 72 53 30 5a 6a 32 4d 37 56 67 54 3a 61 63 74 69 76 65 2c 2e 65 43 62 48 54 33 58 44 6f 72 53 30 5a 6a 32 4d 37 56 67 54 3a 66 6f 63 75 73 2c 2e 65 43 62 48 54 33 58 44 6f 72 53 30 5a 6a 32 4d 37 56 67 54 3a 68 6f 76 65 72 2c 2e 65 43 62 48 54 33 58 44 6f 72 53 30 5a 6a 32 4d 37 56 67 Data Ascii: :var(--bui_color_white);color:var(--bui_color_black)}.eCbHT3XDorS0Zj2M7VgT:before{border-color:transparent}.eCbHT3XDorS0Zj2M7VgT.x33C6nOsCWnUH1a9O421,.eCbHT3XDorS0Zj2M7VgT:active,.eCbHT3XDorS0Zj2M7VgT:focus,.eCbHT3XDorS0Zj2M7VgT:hover,.eCbHT3XDorS0Zj2M7Vg
2024-02-08 18:36:18 UTC	16384	IN	Data Raw: 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 75 70 70 65 72 63 61 73 65 7d 2e 56 49 66 4e 6d 66 75 56 59 35 47 59 33 58 4d 63 64 4d 4e 5f 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 61 6c 74 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 35 30 25 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 76 65 72 3b 62 6f 74 74 6f 6d 3a 30 3b 6c 65 66 74 3a 30 3b 2d 6f 2d 6f 62 6a 65 63 74 2d 66 69 74 3a 63 6f 76 65 72 3b 6f 62 6a 65 63 74 2d 66 69 74 3a 63 6f 76 65 72 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 Data Ascii: sition:relative;text-transform:uppercase}.VIfNmfuVY5GY3XMcdMN_{background-color:var(--bui_color_background_alt);background-position:50%;background-repeat:no-repeat;background-size:cover;bottom:0;left:0;-o-object-fit:cover;object-fit:cover;position:absolut
2024-02-08 18:36:18 UTC	179	IN	Data Raw: 72 75 63 74 69 76 65 5f 62 61 63 6b 67 72 6f 75 6e 64 29 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 6f 6e 5f 64 65 73 74 72 75 63 74 69 76 65 5f 62 61 63 6b 67 72 6f 75 6e 64 29 7d 2e 79 37 72 59 31 62 72 75 35 70 4b 6e 4d 65 4f 33 68 47 4d 5f 3a 65 6d 70 74 79 7b 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 3b 6d 69 6e 2d 77 69 64 74 68 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 3b 77 69 64 74 68 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 7d Data Ascii: ructive_background);color:var(--bui_color_on_destructive_background)}.y7rY1bru5pKnMeO3hGM_:empty{height:var(--bui_spacing_2x);min-width:auto;padding:0;width:var(--bui_spacing_2x)}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
639	192.168.2.5	50484	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:17 UTC	585	OUT	GET /psb/accountsportal/assets/336_afde72b9aaa8302ff017.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:17 UTC	606	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 74745 Connection: close Last-Modified: Tue, 06 Feb 2024 12:55:16 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 1f13962ed2aa130897d600c5ba6398edd4d254622ce0a1b5a9c68a325e5687ca Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 14:45:36 GMT ETag: "41a6ba0fb726b17a45f26570565ea765" X-Cache: Hit from cloudfront Via: 1.1 7699e4f17e72e42cba0c247c650005d2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: MZ4XwArqpiBOxqSACxNBMKJZwTlQg-OOp0R4CMXax3AkITRPYQ94tQ== Age: 13842 Vary: Origin
2024-02-08 18:36:17 UTC	16384	IN	Data Raw: 2e 77 6b 54 4e 64 51 6a 41 66 52 56 62 4b 76 46 42 69 52 31 54 7b 62 6f 72 64 65 72 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 2e 5f 6e 77 47 70 72 66 4c 5a 66 5a 67 4d 46 6a 73 6d 61 70 37 7b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 65 6e 64 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 70 61 64 64 69 6e 67 3a 30 20 30 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 7d 2e 5a 47 79 37 42 4c 43 58 34 58 4f 76 66 41 44 42 46 6a 31 31 2c 2e 62 71 57 37 67 72 61 48 68 30 39 43 54 4e 41 4e 4f 72 58 74 7b 2d 77 65 62 6b 69 74 2d 6d 61 72 67 69 6e 2d 73 74 61 72 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 2d Data Ascii: .wkTNdQjAfRVbKvFBiR1T{border:0;margin:0;padding:0}._nwGprfLZfZgMFjsmap7{align-items:flex-end;display:flex;padding:0 0 var(--bui_spacing_1x)}.ZGy7BLCX4XOvfADBFj11,.bqW7graHh09CTNANOrXt{-webkit-margin-start:var(--bui_spacing_1x);display:inline-block;margin-
2024-02-08 18:36:17 UTC	16384	IN	Data Raw: 46 39 5f 56 37 41 6c 6b 6e 4b 68 55 49 4d 32 64 44 20 2e 4f 6a 70 4e 6d 6a 71 65 66 39 6c 38 4d 4d 6a 67 6e 51 54 58 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 2d 31 38 30 64 65 67 2c 72 67 62 61 28 30 2c 30 2c 30 2c 2e 33 34 39 29 2c 72 67 62 61 28 30 2c 30 2c 30 2c 2e 34 32 34 29 20 31 33 2e 38 31 25 2c 72 67 62 61 28 30 2c 30 2c 30 2c 2e 34 39 34 29 20 32 38 2e 32 37 25 2c 72 67 62 61 28 30 2c 30 2c 30 2c 2e 35 36 31 29 20 34 32 2e 31 32 25 2c 72 67 62 61 28 30 2c 30 2c 30 2c 2e 36 31 36 29 20 35 36 2e 32 38 25 2c 72 67 62 61 28 30 2c 30 2c 30 2c 2e 36 36 33 29 20 37 30 2e 31 33 25 2c 72 67 62 61 28 30 2c 30 2c 30 2c 2e 36 39 29 20 38 34 2e 38 38 25 2c 72 67 62 61 28 30 2c 30 2c 30 2c 2e 37 30 32 29 29 7d 2e 53 Data Ascii: F9_V7AlknKhUIM2dD .OjpNmjqef9l8MMjgnQTX{background:linear-gradient(-180deg,rgba(0,0,0,.349),rgba(0,0,0,.424) 13.81%,rgba(0,0,0,.494) 28.27%,rgba(0,0,0,.561) 42.12%,rgba(0,0,0,.616) 56.28%,rgba(0,0,0,.663) 70.13%,rgba(0,0,0,.69) 84.88%,rgba(0,0,0,.702))}.S
2024-02-08 18:36:18 UTC	10463	IN	Data Raw: 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 64 69 73 61 62 6c 65 64 3a 23 34 37 34 37 34 37 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 63 65 6e 74 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 61 6c 74 3a 23 34 36 33 33 30 31 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 61 6c 74 3a 23 30 34 31 62 34 33 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 61 6c 6c 6f 75 74 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 61 6c 74 3a 23 34 31 31 62 30 31 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 62 61 63 6b 67 72 6f 75 6e 64 3a 23 64 34 31 31 31 65 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 64 69 73 61 62 6c 65 64 5f 61 6c 74 3a 23 32 62 32 62 32 62 3b 2d 2d 62 75 69 5f 63 6f Data Ascii: olor_background_disabled:#474747;--bui_color_accent_background_alt:#463301;--bui_color_action_background_alt:#041b43;--bui_color_callout_background_alt:#411b01;--bui_color_destructive_background:#d4111e;--bui_color_background_disabled_alt:#2b2b2b;--bui_co
2024-02-08 18:36:18 UTC	16384	IN	Data Raw: 64 69 75 6d 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 33 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 76 65 6e 69 72 20 4e 65 78 74 2c 4e 6f 74 6f 20 53 61 6e 73 20 53 43 20 42 6f 6c 64 2c 4e 6f 74 6f 20 53 61 6e 73 20 54 43 20 42 6f 6c 64 2c 4e 6f 74 6f 20 53 61 6e 73 20 4a 50 20 42 6f 6c 64 2c 4e 6f 74 6f 20 53 61 6e 73 20 4b 52 20 42 6f 6c 64 2c 54 61 6a 61 77 61 6c 20 45 78 74 72 61 42 6f 6c 64 2c 41 72 69 6d 6f 20 42 6f 6c 64 2c 4b 61 6e 69 74 20 53 65 6d 69 42 6f 6c 64 2c 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 53 65 67 6f 65 20 55 49 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6d 65 Data Ascii: dium_font_display_3_font-family:Avenir Next,Noto Sans SC Bold,Noto Sans TC Bold,Noto Sans JP Bold,Noto Sans KR Bold,Tajawal ExtraBold,Arimo Bold,Kanit SemiBold,BlinkMacSystemFont,-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;--DO_NOT_USE_bui_me
2024-02-08 18:36:18 UTC	15130	IN	Data Raw: 65 67 75 6c 61 72 2c 4e 6f 74 6f 20 53 61 6e 73 20 4a 50 20 52 65 67 75 6c 61 72 2c 4e 6f 74 6f 20 53 61 6e 73 20 4b 52 20 52 65 67 75 6c 61 72 2c 54 61 6a 61 77 61 6c 20 52 65 67 75 6c 61 72 2c 41 72 69 6d 6f 20 52 65 67 75 6c 61 72 2c 4b 61 6e 69 74 20 52 65 67 75 6c 61 72 2c 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 53 65 67 6f 65 20 55 49 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 32 5f 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 73 6d 61 6c 6c 5f 66 6f 6e 74 5f 66 65 61 74 Data Ascii: egular,Noto Sans JP Regular,Noto Sans KR Regular,Tajawal Regular,Arimo Regular,Kanit Regular,BlinkMacSystemFont,-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;--DO_NOT_USE_bui_small_font_featured_2_font-size:20px;--DO_NOT_USE_bui_small_font_feat

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
640	192.168.2.5	50485	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:17 UTC	585	OUT	GET /psb/accountsportal/assets/826_0d1737e180931a217647.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:17 UTC	606	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 61251 Connection: close Last-Modified: Tue, 06 Feb 2024 12:55:17 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 1f13962ed2aa130897d600c5ba6398edd4d254622ce0a1b5a9c68a325e5687ca Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 07 Feb 2024 19:25:45 GMT ETag: "c23712fdf141e24db80e23cb329d9b13" X-Cache: Hit from cloudfront Via: 1.1 e6c353101750d150139bda8d95719802.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: nWF-BgfkqTthSuF1ziA8cpmGvfTEoclJC9iBrYib38BKX5u_vgDVRg== Age: 83433 Vary: Origin
2024-02-08 18:36:17 UTC	16384	IN	Data Raw: 3a 72 6f 6f 74 7b 2d 2d 62 75 69 5f 6c 61 72 67 65 5f 62 72 65 61 6b 70 6f 69 6e 74 3a 39 39 32 70 78 3b 2d 2d 62 75 69 5f 68 75 67 65 5f 62 72 65 61 6b 70 6f 69 6e 74 3a 31 32 30 30 70 78 7d 2e 70 61 72 74 6e 65 72 2d 68 65 61 64 65 72 3e 68 65 61 64 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 70 72 69 6d 61 72 79 29 7d 3a 72 6f 6f 74 7b 2d 2d 74 72 61 6e 73 69 74 69 6f 6e 2d 74 69 6d 65 3a 33 30 30 6d 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 36 34 35 2c 30 2e 30 34 35 2c 30 2e 33 35 35 2c 31 29 7d 2e 74 72 61 6e 73 69 74 69 6f 6e 2d 63 6f 6e 74 61 69 6e 65 72 7b 6d 61 72 67 69 6e 3a 30 20 2d 34 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 70 61 64 64 69 6e 67 3a 30 20 34 70 78 20 31 30 Data Ascii: :root{--bui_large_breakpoint:992px;--bui_huge_breakpoint:1200px}.partner-header>header{background:var(--bui_color_primary)}:root{--transition-time:300ms cubic-bezier(0.645,0.045,0.355,1)}.transition-container{margin:0 -4px;overflow:hidden;padding:0 4px 10
2024-02-08 18:36:17 UTC	16384	IN	Data Raw: 6e 73 65 74 28 35 30 25 29 3b 68 65 69 67 68 74 3a 31 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 70 61 64 64 69 6e 67 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 77 69 64 74 68 3a 31 70 78 7d 2e 46 64 38 66 6f 66 79 68 50 6e 41 31 33 67 57 6a 6e 69 6d 36 3a 61 63 74 69 76 65 2c 2e 46 64 38 66 6f 66 79 68 50 6e 41 31 33 67 57 6a 6e 69 6d 36 3a 66 6f 63 75 73 7b 63 6c 69 70 3a 61 75 74 6f 3b 2d 77 65 62 6b 69 74 2d 63 6c 69 70 2d 70 61 74 68 3a 6e 6f 6e 65 3b 63 6c 69 70 2d 70 61 74 68 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 61 75 74 6f 3b 6f 76 65 72 66 6c 6f 77 3a 76 69 73 69 62 6c 65 3b 70 6f 73 69 74 69 6f 6e 3a 73 74 61 74 69 63 3b 77 68 69 74 65 2d 73 70 61 63 65 Data Ascii: nset(50%);height:1px;overflow:hidden;padding:0;position:absolute;white-space:nowrap;width:1px}.Fd8fofyhPnA13gWjnim6:active,.Fd8fofyhPnA13gWjnim6:focus{clip:auto;-webkit-clip-path:none;clip-path:none;height:auto;overflow:visible;position:static;white-space
2024-02-08 18:36:18 UTC	16384	IN	Data Raw: 74 5f 73 6d 61 6c 6c 65 72 5f 6c 69 6e 65 5f 68 65 69 67 68 74 3a 31 38 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 5f 73 69 7a 65 3a 31 34 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 5f 6c 69 6e 65 5f 68 65 69 67 68 74 3a 32 30 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 6d 65 64 69 75 6d 5f 73 69 7a 65 3a 31 36 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 6d 65 64 69 75 6d 5f 6c 69 6e 65 5f 68 65 69 67 68 74 3a 32 34 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 6c 61 72 67 65 5f 73 69 7a 65 3a 32 30 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 6c 61 72 67 65 5f 6c 69 6e 65 5f 68 65 69 67 68 74 3a 32 38 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 6c 61 72 67 65 72 5f 73 69 7a 65 3a 32 34 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 6c 61 72 67 Data Ascii: t_smaller_line_height:18px;--bui_font_small_size:14px;--bui_font_small_line_height:20px;--bui_font_medium_size:16px;--bui_font_medium_line_height:24px;--bui_font_large_size:20px;--bui_font_large_line_height:28px;--bui_font_larger_size:24px;--bui_font_larg
2024-02-08 18:36:18 UTC	12099	IN	Data Raw: 62 75 69 5f 75 6e 69 74 5f 6d 65 64 69 75 6d 29 21 69 6d 70 6f 72 74 61 6e 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 62 75 69 2d 75 2d 70 61 64 64 69 6e 67 2d 65 6e 64 2d 2d 31 36 7b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 75 6e 69 74 5f 6c 61 72 67 65 29 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 72 74 6c 20 2e 62 75 69 2d 75 2d 70 61 64 64 69 6e 67 2d 65 6e 64 2d 2d 31 36 2c 5b 64 69 72 3d 72 74 6c 5d 20 2e 62 75 69 2d 75 2d 70 61 64 64 69 6e 67 2d 65 6e 64 2d 2d 31 36 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 76 61 72 28 2d 2d 62 75 69 5f 75 6e 69 74 5f 6c 61 72 67 65 29 21 69 6d 70 6f 72 74 61 6e 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 21 69 6d 70 6f 72 74 61 6e 74 7d 2e Data Ascii: bui_unit_medium)!important;padding-right:0!important}.bui-u-padding-end--16{padding-right:var(--bui_unit_large)!important}.rtl .bui-u-padding-end--16,[dir=rtl] .bui-u-padding-end--16{padding-left:var(--bui_unit_large)!important;padding-right:0!important}.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
641	192.168.2.5	50486	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:17 UTC	2894	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAmb6ChG0GAAAA:1YfdqTGcz5Nv+ySyR4l0dcP3pMoTORFatiNiGWJ7MN9YNAXjrj+JwLDSBSegMncHAdyNNPOjNsaeDm9pbnbRLlIYy/Wsa0l3RRdVGZNwHvCL7MSxVUeOoLQbnA4ws/oCccvImOwo8CVethnhcZ8jRyLom9EtR+hCle5g3/E4tScqZS87YMPrAUoKpLzL6QZghMKuNcinEXGdtGGXi/+Tn/jd1osZzUxtKgagCgVNA7aglFhxkvVLvhbzVj9tZG3VnoD+k6IF; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; lastSeen=1707417375276; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16
2024-02-08 18:36:18 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:18 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=a06d82d16eef0082&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsskiEautJcykJ4MQjPX1-Xjzjz_hvlVjmc x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 c1bfc7dbcf7f9782aa3be590b7ce3d6a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: BZiIccHBzJdlOw97BNsE9ZbsUSTvcfLF6oEsCbJ6gU_9aBHY2Z6WRw==
2024-02-08 18:36:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
642	192.168.2.5	50303	104.18.131.236	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:18 UTC	579	OUT	GET /consent/a387750c-a080-4dd0-b2d1-7dbdb601bb14/OtAutoBlock.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:18 UTC	901	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:36:18 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8525fa35899eb099-ATL CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 7244 Cache-Control: public, max-age=86400 Expires: Fri, 09 Feb 2024 18:36:18 GMT Last-Modified: Fri, 02 Feb 2024 16:31:18 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: 49POeekKpn73Z/k/QUioRg== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: f86bc8ff-401e-0073-2cf5-556110000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-02-08 18:36:18 UTC	468	IN	Data Raw: 31 33 37 37 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 71 28 61 29 7b 76 61 72 20 63 3d 5b 5d 2c 62 3d 5b 5d 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 66 29 7b 66 6f 72 28 76 61 72 20 67 3d 7b 7d 2c 68 3d 30 3b 68 3c 75 2e 6c 65 6e 67 74 68 3b 68 2b 2b 29 7b 76 61 72 20 64 3d 75 5b 68 5d 3b 69 66 28 64 2e 54 61 67 3d 3d 3d 66 29 7b 67 3d 64 3b 62 72 65 61 6b 7d 76 61 72 20 6c 3d 76 6f 69 64 20 30 2c 6b 3d 64 2e 54 61 67 3b 76 61 72 20 43 3d 28 6b 3d 2d 31 21 3d 3d 6b 2e 69 6e 64 65 78 4f 66 28 22 68 74 74 70 3a 22 29 3f 6b 2e 72 65 70 6c 61 63 65 28 22 68 74 74 70 3a 22 2c 22 22 29 3a 6b 2e 72 65 70 6c 61 63 65 28 22 68 74 74 70 73 3a 22 2c 22 22 29 2c 2d 31 21 3d 3d 28 6c 3d 6b 2e 69 6e 64 65 78 4f 66 28 22 3f 22 29 29 3f 6b 2e 72 65 Data Ascii: 1377!function(){function q(a){var c=[],b=[],e=function(f){for(var g={},h=0;h<u.length;h++){var d=u[h];if(d.Tag===f){g=d;break}var l=void 0,k=d.Tag;var C=(k=-1!==k.indexOf("http:")?k.replace("http:",""):k.replace("https:",""),-1!==(l=k.indexOf("?"))?k.re
2024-02-08 18:36:18 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 64 29 7b 76 61 72 20 6c 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 61 22 29 3b 0a 72 65 74 75 72 6e 20 6c 2e 68 72 65 66 3d 64 2c 2d 31 21 3d 3d 28 64 3d 6c 2e 68 6f 73 74 6e 61 6d 65 2e 73 70 6c 69 74 28 22 2e 22 29 29 2e 69 6e 64 65 78 4f 66 28 22 77 77 77 22 29 7c 7c 32 3c 64 2e 6c 65 6e 67 74 68 3f 64 2e 73 6c 69 63 65 28 31 29 2e 6a 6f 69 6e 28 22 2e 22 29 3a 6c 2e 68 6f 73 74 6e 61 6d 65 7d 28 66 29 3b 76 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 64 29 7b 72 65 74 75 72 6e 20 64 3d 3d 3d 68 7d 29 26 26 28 67 3d 5b 22 43 30 30 30 34 22 5d 29 3b 72 65 74 75 72 6e 20 67 7d 28 61 29 29 2c 7b 63 61 74 65 67 6f 72 79 49 64 73 3a 63 2c 76 73 43 61 74 49 64 73 3a 62 7d 7d 66 75 6e 63 74 69 6f 6e Data Ascii: function(d){var l=document.createElement("a");return l.href=d,-1!==(d=l.hostname.split(".")).indexOf("www")\|\|2<d.length?d.slice(1).join("."):l.hostname}(f);v.some(function(d){return d===h})&&(g=["C0004"]);return g}(a)),{categoryIds:c,vsCatIds:b}}function
2024-02-08 18:36:18 UTC	1369	IN	Data Raw: 72 63 7c 7c 22 22 29 3b 28 62 2e 63 61 74 65 67 6f 72 79 49 64 73 2e 6c 65 6e 67 74 68 7c 7c 62 2e 76 73 43 61 74 49 64 73 2e 6c 65 6e 67 74 68 29 26 26 28 78 28 62 2e 63 61 74 65 67 6f 72 79 49 64 73 2c 61 2c 62 2e 76 73 43 61 74 49 64 73 29 2c 6d 28 62 2e 63 61 74 65 67 6f 72 79 49 64 73 2c 62 2e 76 73 43 61 74 49 64 73 29 7c 7c 28 61 2e 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 29 2c 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 62 65 66 6f 72 65 73 63 72 69 70 74 65 78 65 63 75 74 65 22 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 74 65 78 74 2f 70 6c 61 69 6e 22 3d 3d 3d 0a 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 29 26 26 65 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 61 2e 72 65 6d 6f 76 65 Data Ascii: rc\|\|"");(b.categoryIds.length\|\|b.vsCatIds.length)&&(x(b.categoryIds,a,b.vsCatIds),m(b.categoryIds,b.vsCatIds)\|\|(a.type="text/plain"),a.addEventListener("beforescriptexecute",c=function(e){"text/plain"===a.getAttribute("type")&&e.preventDefault();a.remove
2024-02-08 18:36:18 UTC	1369	IN	Data Raw: 21 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 2d 31 3d 3d 3d 74 2e 69 6e 64 65 78 4f 66 28 65 2e 74 61 67 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 7c 7c 6e 28 65 29 7c 7c 70 28 65 29 7c 7c 28 22 73 63 72 69 70 74 22 3d 3d 3d 65 2e 74 61 67 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3f 7a 3a 41 29 28 65 29 7d 29 3b 76 61 72 20 62 3d 63 2e 74 61 72 67 65 74 3b 21 63 2e 61 74 74 72 69 62 75 74 65 4e 61 6d 65 7c 7c 6e 28 62 29 26 26 70 28 62 29 7c 7c 28 22 73 63 72 69 70 74 22 3d 3d 3d 62 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3f 7a 28 62 29 3a 2d 31 21 3d 3d 74 2e 69 6e 64 65 78 4f 66 28 63 2e 74 61 72 67 65 74 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 26 26 41 28 62 29 29 Data Ascii: !==e.nodeType\|\|-1===t.indexOf(e.tagName.toLowerCase())\|\|n(e)\|\|p(e)\|\|("script"===e.tagName.toLowerCase()?z:A)(e)});var b=c.target;!c.attributeName\|\|n(b)&&p(b)\|\|("script"===b.nodeName.toLowerCase()?z(b):-1!==t.indexOf(c.target.nodeName.toLowerCase())&&A(b))
2024-02-08 18:36:18 UTC	416	IN	Data Raw: 6c 65 6e 67 74 68 26 26 0a 21 64 2e 76 73 43 61 74 49 64 73 2e 6c 65 6e 67 74 68 7c 7c 6e 28 67 29 7c 7c 6d 28 64 2e 63 61 74 65 67 6f 72 79 49 64 73 2c 64 2e 76 73 43 61 74 49 64 73 29 7c 7c 70 28 67 29 3f 66 3a 22 74 65 78 74 2f 70 6c 61 69 6e 22 29 2c 21 30 3b 76 61 72 20 67 2c 68 2c 64 7d 7d 2c 63 6c 61 73 73 3a 7b 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 66 29 7b 72 65 74 75 72 6e 20 68 3d 63 2c 21 28 64 3d 71 28 28 67 3d 61 29 2e 73 72 63 29 29 2e 63 61 74 65 67 6f 72 79 49 64 73 2e 6c 65 6e 67 74 68 26 26 21 64 2e 76 73 43 61 74 49 64 73 2e 6c 65 6e 67 74 68 7c 7c 6e 28 67 29 7c 7c 6d 28 64 2e 63 61 74 65 67 6f 72 79 49 64 73 2c 64 2e 76 73 43 61 74 49 64 73 29 7c 7c 70 28 67 29 3f 68 28 22 63 6c 61 73 73 22 2c 66 29 3a 68 28 22 63 6c 61 73 73 22 2c Data Ascii: length&&!d.vsCatIds.length\|\|n(g)\|\|m(d.categoryIds,d.vsCatIds)\|\|p(g)?f:"text/plain"),!0;var g,h,d}},class:{set:function(f){return h=c,!(d=q((g=a).src)).categoryIds.length&&!d.vsCatIds.length\|\|n(g)\|\|m(d.categoryIds,d.vsCatIds)\|\|p(g)?h("class",f):h("class",
2024-02-08 18:36:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
643	192.168.2.5	50487	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:18 UTC	3038	OUT	GET /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAmb6ChG0GAAAA:1YfdqTGcz5Nv+ySyR4l0dcP3pMoTORFatiNiGWJ7MN9YNAXjrj+JwLDSBSegMncHAdyNNPOjNsaeDm9pbnbRLlIYy/Wsa0l3RRdVGZNwHvCL7MSxVUeOoLQbnA4ws/oCccvImOwo8CVethnhcZ8jRyLom9EtR+hCle5g3/E4tScqZS87YMPrAUoKpLzL6QZghMKuNcinEXGdtGGXi/+Tn/jd1osZzUxtKgagCgVNA7aglFhxkvVLvhbzVj9tZG3VnoD+k6IF; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; lastSeen=1707417375276
2024-02-08 18:36:18 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:18 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=033682d185be001f&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGXUSQSgAoO9rZPMVZgyooG99LHFduv32WQ x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 45893c5ff2aa24fa7dce9573a0274642.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: tc0XI4bIgOM5-KJzEbeW_HDWvN6WWJpKyXI4BM72Bl4rt3R9a4Ox_A==
2024-02-08 18:36:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
644	192.168.2.5	50488	3.161.193.117	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:18 UTC	650	OUT	POST /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive Content-Length: 85 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-API-Version: 1 Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:18 UTC	85	OUT	Data Raw: 7b 22 70 69 64 22 3a 22 38 37 65 34 38 32 63 61 66 34 32 37 30 32 64 30 22 2c 22 72 65 66 41 63 74 69 6f 6e 22 3a 22 69 6e 64 65 78 22 2c 22 73 69 74 65 54 79 70 65 22 3a 22 31 22 2c 22 63 6c 73 22 3a 36 2e 34 30 30 35 32 32 38 36 33 37 32 37 31 37 39 7d Data Ascii: {"pid":"87e482caf42702d0","refAction":"index","siteType":"1","cls":6.400522863727179}
2024-02-08 18:36:18 UTC	525	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:18 GMT vary: Origin, Accept-Encoding access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7f23e4136f9a90da4108d0b761f3120e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P8 X-Amz-Cf-Id: CjlBqvKvvg43lR8UGt2BgO-J6kPTGnPLsk1SCGZeJ-uzaFQqvxlcvQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
645	192.168.2.5	50490	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:18 UTC	717	OUT	POST /p HTTP/1.1 Host: tr6.snapchat.com Connection: keep-alive Content-Length: 900 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:18 UTC	900	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 65 32 63 65 64 30 36 34 2d 33 31 34 64 2d 34 63 62 63 2d 61 61 37 61 2d 35 62 31 66 38 64 36 61 61 34 39 34 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 35 61 62 35 33 31 64 36 2d 62 32 38 64 2d 34 36 35 62 2d 62 31 34 66 2d 61 36 32 62 61 30 36 39 37 61 37 36 22 2c 22 73 73 22 3a 22 32 32 34 65 39 64 61 32 2d 33 65 62 65 2d 34 64 65 30 2d 39 34 62 61 2d 30 64 35 64 32 32 63 39 35 62 37 66 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"e2ced064-314d-4cbc-aa7a-5b1f8d6aa494","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"5ab531d6-b28d-465b-b14f-a62ba0697a76","ss":"224e9da2-3ebe-4de0-94ba-0d5d22c95b7f","bg":true,"s
2024-02-08 18:36:18 UTC	429	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:18 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
646	192.168.2.5	50489	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:18 UTC	717	OUT	POST /p HTTP/1.1 Host: tr6.snapchat.com Connection: keep-alive Content-Length: 889 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:18 UTC	889	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 64 37 33 36 31 61 34 2d 63 63 63 66 2d 34 30 62 39 2d 62 63 31 31 2d 36 36 61 32 35 38 35 32 32 35 33 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 65 65 38 32 31 32 31 61 2d 66 30 30 32 2d 34 63 65 33 2d 38 35 39 38 2d 64 32 38 37 30 64 35 38 64 39 33 65 22 2c 22 73 73 22 3a 22 31 35 65 30 61 36 32 31 2d 31 31 34 34 2d 34 38 35 64 2d 39 30 31 62 2d 30 39 62 62 36 33 38 64 32 39 33 36 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"fd7361a4-cccf-40b9-bc11-66a258522530","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"ee82121a-f002-4ce3-8598-d2870d58d93e","ss":"15e0a621-1144-485d-901b-09bb638d2936","bg":true,"s
2024-02-08 18:36:18 UTC	429	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:18 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
647	192.168.2.5	50491	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:18 UTC	717	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 1152 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:18 UTC	1152	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 36 39 37 39 39 62 31 2d 62 32 62 32 2d 34 30 66 38 2d 38 65 36 66 2d 32 38 30 39 62 39 63 36 66 31 61 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 37 65 37 61 61 31 31 36 2d 30 33 35 66 2d 34 36 62 35 2d 38 37 61 39 2d 66 35 65 66 31 38 34 64 33 66 34 32 22 2c 22 73 73 22 3a 22 30 32 34 37 38 38 37 34 2d 61 32 37 37 2d 34 36 35 63 2d 62 39 65 37 2d 63 65 32 34 31 32 32 33 32 65 34 66 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"f69799b1-b2b2-40f8-8e6f-2809b9c6f1a0","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"7e7aa116-035f-46b5-87a9-f5ef184d3f42","ss":"02478874-a277-465c-b9e7-ce2412232e4f","bg":true,"s
2024-02-08 18:36:18 UTC	523	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:18 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
648	192.168.2.5	50492	216.239.34.181	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:18 UTC	1983	OUT	POST /g/collect?v=2&tid=G-FPD6YLJCJ7&gtm=45je4250v888381215z879615461za200&_p=1707417370229&gcs=G1--&gcd=13l3l3l3l5&npa=0&dma=0&cid=421694156.1707417338&ul=en-us&sr=1280x1024&ir=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pae=1&pscdl=noapi&_eu=EA&_s=1&cu=EUR&dl=https%3A%2F%2Fwww.booking.com%2Findex.html&sid=1707417345&sct=1&seg=1&dt=Booking.com%20%7C%20Official%20site%20%7C%20The%20best%20hotels%2C%20flights%2C%20car%20rentals%20%26%20accommodations&en=page_view&ep.cd_action=index&ep.cd_adults=-1&ep.cd_page_url=https%3A%2F%2Fwww.booking.com%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&ep.cd_ai=304142&ep.cd_book_window=&ep.cd_full_referrer=&ep.cd_glev=&ep.cd_language=en-us&ep.cd_logged_in=0&ep.cd_tsmp=1707417364&ep.cd_user_location=us&_et=2&up.up_ga_client_id=421694156.1707417338&up.up_is_subscribed_to_newsletter=&tfd=13146 HTTP/1.1 Host: analytics.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:18 UTC	449	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: https://www.booking.com Date: Thu, 08 Feb 2024 18:36:18 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Credentials: true Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
649	192.168.2.5	50493	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:18 UTC	718	OUT	POST /p HTTP/1.1 Host: tr6.snapchat.com Connection: keep-alive Content-Length: 1092 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:18 UTC	1092	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 36 39 37 39 39 62 31 2d 62 32 62 32 2d 34 30 66 38 2d 38 65 36 66 2d 32 38 30 39 62 39 63 36 66 31 61 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 64 63 36 31 63 35 30 34 2d 38 65 35 39 2d 34 61 31 65 2d 39 66 35 65 2d 35 37 61 36 33 36 36 36 39 65 33 39 22 2c 22 73 73 22 3a 22 30 32 34 37 38 38 37 34 2d 61 32 37 37 2d 34 36 35 63 2d 62 39 65 37 2d 63 65 32 34 31 32 32 33 32 65 34 66 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"f69799b1-b2b2-40f8-8e6f-2809b9c6f1a0","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"dc61c504-8e59-4a1e-9f5e-57a636669e39","ss":"02478874-a277-465c-b9e7-ce2412232e4f","bg":true,"s
2024-02-08 18:36:18 UTC	429	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:18 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
650	192.168.2.5	50494	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:18 UTC	6142	OUT	GET /js_tracking?sid=5171fc655664ddf74ab763a094523fb7&aid=304142&ref_action=index&ver=2&pid=87e482caf42702d0&lang=en-us&stype=1&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|6\|1&m=UmFuZG9tSVYkc2RlIyh9YUe5zZbLHt0YNre0CiGBBmP5hKTY_IzZqpWBtitYrnE-ba2NOPqZSPGdnbkQM2vO343hpsChBnayfrRG7jVW0hI1Ke4kKZ85U_m7O1xbR8NLSlv2Zn-4d5ku6anu7qAZgjoLQxWZjIis3cNA3ef3I_aOxDvMotUV5ZQc6OhcEEody8ooGsshLIhRMDad6kRNg_HeFvW36Wr8mOnNh6fMuy8OZ9w095BIb2XL0zt8fY-5SPQHxgI7NWrdI31vzPG5nOwkA1lE2mJxFh3z4YXPwcZPq5z6drlkg3iN9tdtKjt0cXf7rJdLIbIGLmOniyEf0g HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6 X-Booking-CSRF: VFfFZQAAAAA=I0VyxrbmcRsXF8b8667mJSw00zD1jijstj9zA-B31AE-SHf9fwLae-NRdcEvORIZUidJgBp9cG2_VeJ_vvAjE9POdq-3lpUXJKUz5osKhhR_6IWR4vCHyNCN9_lrexSyhyl857y4-aUKLEPdAzHdPtU-69GNk1-tINwO8UxKp7l2RhgisIpi5FvtqY4OOakuCSFjRchHm9pnK7Y6 sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: 87e482caf42702d0 X-Booking-Info: 1856820,1856870,1865390,1901030,1901290,1905350,1908890,1912460,1914530,1916800,1917480,1917580,cCHObTULHfAFFQZcfHSdFaLbFFRURURHe\|1,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|3,1856870\|1,1912460\|7,1912460\|1,1908890\|1,1912460\|6,cCHObTULHfAFFQZcNHFXbEIdAJOdKNKNKWe\|2,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|1,cCGaYSddOEGcHNAXIeITIGBSQNLOLOLMO\|6,YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|4,dDfPWPHDDZSOBJbKYfNIfPTDWe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|1,YTTHbXeeVJWcFKJPFNJQVVEbMKXe\|5,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|1,bPFPOKZfHfVaAFZKVHJbdYeNeHT\|2,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|1,aXTfOFJZMYeKTcABVYUfFdHMPVWCGTQJQJET\|2,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|1,aXTfMZMYeKTcNGEcfFdHMPVUPHET\|3,NVFVcfTbdNNWNVZMYCMXFfHBcCcCcCC\|2,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|1,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|3,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|7,OJVZAAURAfPMTcZJFeDBRcFPLDEZRdLOLOLMO\|8,cCHObVZMYCMKdFEVJTNIKdFHaO\|1,cCHObVZMYCMKdFEVJTNIKdFHaO\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|1,cCHObKdBdUHINPSXeHDALOLOLMO\|2,cCHObKdBdUHINPSXeHDALOLOLMO\|5,YTTHbXeeVeCFZAcbRbROfLMTeCYHDRFcO\|4,BHDTJdReQLOLOLOVZMYCVCMILRVVPKLZZOJNET\|1,dLYdCeYBFVedKNKNKPMPSXPUEKdDXFZMIbdYeNYT\|1,cCHObdRdJJXRDVMDTEREHGURXZALOLOLMO\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|1,cCHObdRdJJVdfUSCEcdNHMddKNKNKWe\|2,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|1,cCHObdRdJJVdfUJGFDSeBcZFLMFRURURHe\|3,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|2,NAFLeOeJEcJFQbMWKZETTeMcCcCcCC\|3,cCHObVZMYCMKdFEVJTNIKdFHaO\|4,cCHObVZMYCMKdFEVJTNIKdFHaO\|6,cCHObKdBdUHINPSXeHDALOLOLMO\|3 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAmb6ChG0GAAAA:1YfdqTGcz5Nv+ySyR4l0dcP3pMoTORFatiNiGWJ7MN9YNAXjrj+JwLDSBSegMncHAdyNNPOjNsaeDm9pbnbRLlIYy/Wsa0l3RRdVGZNwHvCL7MSxVUeOoLQbnA4ws/oCccvImOwo8CVethnhcZ8jRyLom9EtR+hCle5g3/E4tScqZS87YMPrAUoKpLzL6QZghMKuNcinEXGdtGGXi/+Tn/jd1osZzUxtKgagCgVNA7aglFhxkvVLvhbzVj9tZG3VnoD+k6IF; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; lastSeen=1707417375276; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16
2024-02-08 18:36:18 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:18 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=577c82d19692030d&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejIP_9g5S8VJlrbL9BmtvzlB_FORO8NYDrQ x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 e6c353101750d150139bda8d95719802.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: rXb13Zb_QE_4iRGuX4G0oWQH2aJPVb9QeLTs17BY_lxGnrHEP9Eb0A==
2024-02-08 18:36:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
651	192.168.2.5	50495	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:18 UTC	580	OUT	GET /psb/accountsportal/assets/runtime~index_9239c9c6cbeb2a77c28f.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:18 UTC	619	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 4651 Connection: close Last-Modified: Tue, 06 Feb 2024 12:55:17 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 1f13962ed2aa130897d600c5ba6398edd4d254622ce0a1b5a9c68a325e5687ca Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 07 Feb 2024 20:03:04 GMT ETag: "486dbfc2509a5b7f573cbe21281bacd7" X-Cache: Hit from cloudfront Via: 1.1 25d9b5959eaa82bb18ee3f35e6bf34b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: q7xN_Y5gSbt4b9YGkenEJ8Ckwrp8P9w3fVsrEEWja1msX3ave6hX8w== Age: 81195 Vary: Origin
2024-02-08 18:36:18 UTC	4651	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 2c 74 2c 72 2c 6e 2c 6f 2c 69 3d 7b 7d 2c 75 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 61 28 65 29 7b 76 61 72 20 74 3d 75 5b 65 5d 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 74 29 72 65 74 75 72 6e 20 74 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 75 5b 65 5d 3d 7b 69 64 3a 65 2c 6c 6f 61 64 65 64 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 69 5b 65 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 61 29 2c 72 2e 6c 6f 61 64 65 64 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 61 2e 6d 3d 69 2c 65 3d 5b 5d 2c 61 2e 4f 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 2c 6f 29 7b 69 66 28 21 72 29 7b 76 61 72 20 69 3d 31 Data Ascii: !function(){"use strict";var e,t,r,n,o,i={},u={};function a(e){var t=u[e];if(void 0!==t)return t.exports;var r=u[e]={id:e,loaded:!1,exports:{}};return i[e].call(r.exports,r,r.exports,a),r.loaded=!0,r.exports}a.m=i,e=[],a.O=function(t,r,n,o){if(!r){var i=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
652	192.168.2.5	50496	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:18 UTC	570	OUT	GET /psb/accountsportal/assets/326_4e98a27a96e8aa0e2044.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:18 UTC	620	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 32162 Connection: close Last-Modified: Fri, 02 Feb 2024 10:06:31 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 1f13962ed2aa130897d600c5ba6398edd4d254622ce0a1b5a9c68a325e5687ca Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 10:57:49 GMT ETag: "c87fba85f4e94843af93e4f6a1819b4b" X-Cache: Hit from cloudfront Via: 1.1 7eeed291abf48890d3f36565208941a8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: FIzeJlWVoScdV1dJPGGr1GDrRf1ZYsc7LmvLnrG1__Usox0VRBTybg== Age: 27510 Vary: Origin
2024-02-08 18:36:18 UTC	16384	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 33 32 36 5d 2c 7b 32 34 39 36 33 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 74 29 74 68 72 6f 77 20 54 79 70 65 45 72 72 6f 72 28 74 2b 22 20 69 73 20 6e 6f 74 20 61 20 66 75 6e 63 74 69 6f 6e 21 22 29 3b 72 65 74 75 72 6e 20 74 7d 7d 2c 31 37 37 32 32 3a Data Ascii: (self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[326],{24963:function(t){t.exports=function(t){if("function"!=typeof t)throw TypeError(t+" is not a function!");return t}},17722:
2024-02-08 18:36:18 UTC	15778	IN	Data Raw: 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 72 65 74 75 72 6e 2b 72 7d 66 6f 72 28 76 61 72 20 75 2c 73 3d 72 2e 73 6c 69 63 65 28 32 29 2c 61 3d 30 2c 66 3d 73 2e 6c 65 6e 67 74 68 3b 61 3c 66 3b 61 2b 2b 29 69 66 28 28 75 3d 73 2e 63 68 61 72 43 6f 64 65 41 74 28 61 29 29 3c 34 38 7c 7c 75 3e 6f 29 72 65 74 75 72 6e 20 4e 61 4e 3b 72 65 74 75 72 6e 20 70 61 72 73 65 49 6e 74 28 73 2c 65 29 7d 7d 72 65 74 75 72 6e 2b 72 7d 3b 69 66 28 21 79 28 22 20 30 6f 31 22 29 7c 7c 21 79 28 22 30 62 31 22 29 7c 7c 79 28 22 2b 30 78 31 22 29 29 7b 79 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 72 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3c 31 3f 30 3a 74 2c 6e 3d 74 68 69 73 3b 72 65 74 75 72 6e 20 6e 20 69 6e 73 74 61 6e 63 65 6f 66 20 79 26 26 28 62 3f Data Ascii: reak;default:return+r}for(var u,s=r.slice(2),a=0,f=s.length;a<f;a++)if((u=s.charCodeAt(a))<48\|\|u>o)return NaN;return parseInt(s,e)}}return+r};if(!y(" 0o1")\|\|!y("0b1")\|\|y("+0x1")){y=function(t){var r=arguments.length<1?0:t,n=this;return n instanceof y&&(b?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
653	192.168.2.5	50497	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:18 UTC	569	OUT	GET /psb/accountsportal/assets/45_de7f4b7ce86eab041180.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:18 UTC	621	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 329657 Connection: close Last-Modified: Tue, 06 Feb 2024 12:55:16 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 1f13962ed2aa130897d600c5ba6398edd4d254622ce0a1b5a9c68a325e5687ca Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 15:17:35 GMT ETag: "2eaec1ded279befb01f731d7bc109b01" X-Cache: Hit from cloudfront Via: 1.1 61bbe72b71f7b857c695c31fdeb7b3a6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: qR4O9aDqv6ikDosBamGuqJYwori2PpsY4ro3m4yOs19o0HiOFnB_VQ== Age: 11924 Vary: Origin
2024-02-08 18:36:18 UTC	15763	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 34 35 5f 64 65 37 66 34 62 37 63 65 38 36 65 61 62 30 34 31 31 38 30 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 34 35 5d 2c 7b 34 34 32 36 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b Data Ascii: /! For license information please see 45_de7f4b7ce86eab041180.js.LICENSE.txt /(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[45],{44268:function(e,t,n){"use strict";n.d(t,{
2024-02-08 18:36:18 UTC	16384	IN	Data Raw: 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 28 36 37 32 39 34 29 7d 2c 32 30 30 38 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 28 36 37 32 39 34 29 7d 2c 38 34 37 37 30 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 28 36 37 32 39 34 29 7d 2c 31 39 32 31 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 28 36 37 32 39 34 29 7d 2c 36 33 34 31 30 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 28 36 37 32 39 34 29 7d 2c 39 38 65 33 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 28 36 37 32 39 34 29 7d 2c 33 30 31 34 31 3a 66 Data Ascii: ){"use strict";n(67294)},20086:function(e,t,n){"use strict";n(67294)},84770:function(e,t,n){"use strict";n(67294)},1921:function(e,t,n){"use strict";n(67294)},63410:function(e,t,n){"use strict";n(67294)},98e3:function(e,t,n){"use strict";n(67294)},30141:f
2024-02-08 18:36:18 UTC	16384	IN	Data Raw: 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 28 36 37 32 39 34 29 7d 2c 37 34 39 38 39 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 28 36 37 32 39 34 29 7d 2c 34 35 37 37 35 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 28 36 37 32 39 34 29 7d 2c 33 38 38 35 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 28 36 37 32 39 34 29 7d 2c 38 31 31 39 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 28 36 37 32 39 34 29 7d 2c 38 33 36 30 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 28 36 37 32 39 34 29 7d 2c 31 Data Ascii: ,t,n){"use strict";n(67294)},74989:function(e,t,n){"use strict";n(67294)},45775:function(e,t,n){"use strict";n(67294)},38852:function(e,t,n){"use strict";n(67294)},81198:function(e,t,n){"use strict";n(67294)},83606:function(e,t,n){"use strict";n(67294)},1
2024-02-08 18:36:18 UTC	3649	IN	Data Raw: 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 74 68 69 73 26 26 74 68 69 73 2e 5f 5f 73 70 72 65 61 64 41 72 72 61 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 74 2e 6c 65 6e 67 74 68 2c 69 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 2c 69 2b 2b 29 65 5b 69 5d 3d 74 5b 6e 5d 3b 72 65 74 75 72 6e 20 65 7d 2c 69 3d 74 68 69 73 26 26 74 68 69 73 2e 5f 5f 69 6d 70 6f 72 74 44 65 66 61 75 6c 74 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 65 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3f 65 3a 7b 64 65 66 61 75 6c 74 3a 65 7d 7d 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d Data Ascii: n){"use strict";var r=this&&this.__spreadArray\|\|function(e,t){for(var n=0,r=t.length,i=e.length;n<r;n++,i++)e[i]=t[n];return e},i=this&&this.__importDefault\|\|function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 66 29 2c 68 7d 7d 2c 35 37 33 33 31 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 74 68 69 73 26 26 74 68 69 73 2e 5f 5f 73 70 72 65 61 64 41 72 72 61 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 2c 72 3d 74 2e 6c 65 6e 67 74 68 2c 69 3d 65 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 2c 69 2b 2b 29 65 5b 69 5d 3d 74 5b 6e 5d 3b 72 65 74 75 72 6e 20 65 7d 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 6e 28 39 37 32 37 34 29 3b 76 61 72 20 69 3d 5b 22 74 6f 70 2d 73 74 61 72 74 22 2c 22 74 6f 70 Data Ascii: entNode.removeChild(f),h}},57331:function(e,t,n){"use strict";var r=this&&this.__spreadArray\|\|function(e,t){for(var n=0,r=t.length,i=e.length;n<r;n++,i++)e[i]=t[n];return e};Object.defineProperty(t,"__esModule",{value:!0}),n(97274);var i=["top-start","top
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 72 65 74 75 72 6e 20 65 26 26 65 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3f 65 3a 7b 64 65 66 61 75 6c 74 3a 65 7d 7d 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 2c 74 2e 64 65 66 61 75 6c 74 3d 76 6f 69 64 20 30 3b 76 61 72 20 69 3d 6e 28 35 30 35 33 30 29 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 64 65 66 61 75 6c 74 22 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 28 69 29 2e 64 65 66 61 75 6c 74 7d 7d 29 7d 2c 34 30 38 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 74 68 69 73 26 26 74 68 Data Ascii: return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.default=void 0;var i=n(50530);Object.defineProperty(t,"default",{enumerable:!0,get:function(){return r(i).default}})},4087:function(e,t,n){"use strict";var r=this&&th
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 5f 5f 69 6d 70 6f 72 74 44 65 66 61 75 6c 74 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 65 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3f 65 3a 7b 64 65 66 61 75 6c 74 3a 65 7d 7d 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 3b 76 61 72 20 6c 3d 61 28 6e 28 36 37 32 39 34 29 29 2c 73 3d 61 28 6e 28 37 33 39 33 35 29 29 2c 63 3d 6e 28 31 36 31 37 35 29 2c 66 3d 6e 28 39 33 34 33 33 29 2c 64 3d 6e 28 35 32 30 32 33 29 2c 70 3d 61 28 6e 28 36 30 39 30 39 29 29 2c 6d 3d 61 28 6e 28 32 30 37 31 34 29 29 2c 76 3d 61 28 6e 28 38 34 32 32 37 29 29 2c 68 3d 61 28 6e 28 33 35 30 37 38 29 29 2c 67 3d 61 28 6e 28 36 32 38 32 31 29 29 2c 62 3d 75 28 Data Ascii: __importDefault\|\|function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0});var l=a(n(67294)),s=a(n(73935)),c=n(16175),f=n(93433),d=n(52023),p=a(n(60909)),m=a(n(20714)),v=a(n(84227)),h=a(n(35078)),g=a(n(62821)),b=u(
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 65 73 3a 74 2e 6c 69 6e 6b 41 74 74 72 69 62 75 74 65 73 7d 7d 29 29 2c 5a 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 4f 2e 6c 65 6e 67 74 68 2d 31 2c 6e 3d 54 3d 3d 3d 74 3f 30 3a 54 2b 31 2c 72 3d 30 3d 3d 3d 54 3f 74 3a 54 2d 31 3b 69 66 28 21 28 4f 2e 66 69 6c 74 65 72 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 70 72 6f 70 73 2e 6e 61 74 69 76 65 7d 29 29 2e 6c 65 6e 67 74 68 3e 30 29 29 73 77 69 74 63 68 28 61 2e 6e 6f 72 6d 61 6c 69 7a 65 4b 65 79 28 65 2e 6b 65 79 29 29 7b 63 61 73 65 20 6c 2e 64 65 66 61 75 6c 74 2e 52 49 47 48 54 3a 43 28 4f 5b 6e 5d 2e 70 72 6f 70 73 2e 69 64 2c 6e 2c 7b 66 6f 63 75 73 3a 21 30 7d 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 6c 2e 64 65 66 61 75 6c 74 2e 4c 45 46 54 3a 43 28 4f Data Ascii: es:t.linkAttributes}})),Z=function(e){var t=O.length-1,n=T===t?0:T+1,r=0===T?t:T-1;if(!(O.filter((function(e){return e.props.native})).length>0))switch(a.normalizeKey(e.key)){case l.default.RIGHT:C(O[n].props.id,n,{focus:!0});break;case l.default.LEFT:C(O
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 3d 31 2c 72 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 66 6f 72 28 76 61 72 20 69 20 69 6e 20 74 3d 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 69 29 26 26 28 65 5b 69 5d 3d 74 5b 69 5d 29 3b 72 65 74 75 72 6e 20 65 7d 2c 72 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 2c 69 3d 74 68 69 73 26 26 74 68 69 73 2e 5f 5f 69 6d 70 6f 72 74 44 65 66 61 75 6c 74 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 65 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3f 65 3a 7b 64 65 66 61 75 6c 74 3a 65 7d 7d 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f Data Ascii: =1,r=arguments.length;n<r;n++)for(var i in t=arguments[n])Object.prototype.hasOwnProperty.call(t,i)&&(e[i]=t[i]);return e},r.apply(this,arguments)},i=this&&this.__importDefault\|\|function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 73 65 74 54 68 65 6d 65 4d 6f 64 65 2c 72 3d 65 2e 69 6e 76 65 72 74 54 68 65 6d 65 4d 6f 64 65 3b 72 65 74 75 72 6e 20 69 2e 64 65 66 61 75 6c 74 2e 75 73 65 4d 65 6d 6f 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 7b 6d 6f 64 65 3a 74 2c 73 65 74 4d 6f 64 65 3a 6e 2c 69 6e 76 65 72 74 4d 6f 64 65 3a 72 7d 7d 29 2c 5b 74 2c 6e 2c 72 5d 29 7d 7d 2c 37 31 35 37 32 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 74 68 69 73 26 26 74 68 69 73 2e 5f 5f 69 6d 70 6f 72 74 44 65 66 61 75 6c 74 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 65 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3f 65 3a 7b 64 65 66 61 75 6c 74 3a 65 7d 7d 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 Data Ascii: setThemeMode,r=e.invertThemeMode;return i.default.useMemo((function(){return{mode:t,setMode:n,invertMode:r}}),[t,n,r])}},71572:function(e,t,n){"use strict";var r=this&&this.__importDefault\|\|function(e){return e&&e.__esModule?e:{default:e}};Object.definePr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
654	192.168.2.5	50500	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:18 UTC	570	OUT	GET /psb/accountsportal/assets/903_0c38bb6dddbae47eeeea.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:18 UTC	620	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 145280 Connection: close Date: Thu, 08 Feb 2024 16:55:30 GMT Last-Modified: Thu, 08 Feb 2024 14:12:31 GMT ETag: "f6acacb27a21a12ec4799883592c8ab8" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 87c5062af370e04c01cd2248e9cf3c0fc4df5d5ac110f782e9bf186a298d7040 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 4a9f56098c7d51e12b8d2ac77b6f1bcc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 2F_vhwtflUrBzvV948KOu2ewlQC4OOlL49M3SUOYFi-3cNM_XWIECQ== Age: 6049 Vary: Origin
2024-02-08 18:36:18 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 39 30 33 5f 30 63 33 38 62 62 36 64 64 64 62 61 65 34 37 65 65 65 65 61 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 39 30 33 5d 2c 7b 37 33 38 31 30 3a 66 75 6e 63 74 69 6f 6e 28 64 2c 74 2c 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e Data Ascii: /! For license information please see 903_0c38bb6dddbae47eeeea.js.LICENSE.txt /(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[903],{73810:function(d,t,e){"use strict";var n
2024-02-08 18:36:18 UTC	16384	IN	Data Raw: 3b 3b 29 7b 66 6f 72 28 76 61 72 20 61 3d 30 3b 61 3c 32 3b 61 2b 2b 29 69 66 28 6e 75 6c 6c 3d 3d 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 6e 5d 5b 69 2d 61 5d 29 7b 76 61 72 20 75 3d 21 31 3b 24 3c 64 2e 6c 65 6e 67 74 68 26 26 28 75 3d 31 3d 3d 28 64 5b 24 5d 3e 3e 3e 72 26 31 29 29 2c 6f 2e 67 65 74 4d 61 73 6b 28 74 2c 6e 2c 69 2d 61 29 26 26 28 75 3d 21 75 29 2c 74 68 69 73 2e 6d 6f 64 75 6c 65 73 5b 6e 5d 5b 69 2d 61 5d 3d 75 2c 2d 31 3d 3d 2d 2d 72 26 26 28 24 2b 2b 2c 72 3d 37 29 7d 69 66 28 28 6e 2b 3d 65 29 3c 30 7c 7c 74 68 69 73 2e 6d 6f 64 75 6c 65 43 6f 75 6e 74 3c 3d 6e 29 7b 6e 2d 3d 65 2c 65 3d 2d 65 3b 62 72 65 61 6b 7d 7d 7d 2c 61 2e 50 41 44 30 3d 32 33 36 2c 61 2e 50 41 44 31 3d 31 37 2c 61 2e 63 72 65 61 74 65 44 61 74 61 3d 66 75 6e Data Ascii: ;;){for(var a=0;a<2;a++)if(null==this.modules[n][i-a]){var u=!1;$<d.length&&(u=1==(d[$]>>>r&1)),o.getMask(t,n,i-a)&&(u=!u),this.modules[n][i-a]=u,-1==--r&&($++,r=7)}if((n+=e)<0\|\|this.moduleCount<=n){n-=e,e=-e;break}}},a.PAD0=236,a.PAD1=17,a.createData=fun
2024-02-08 18:36:18 UTC	16384	IN	Data Raw: 53 79 6d 62 6f 6c 26 26 64 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 26 26 64 21 3d 3d 53 79 6d 62 6f 6c 2e 70 72 6f 74 6f 74 79 70 65 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 64 7d 2c 72 28 64 29 7d 66 75 6e 63 74 69 6f 6e 20 24 28 64 2c 74 29 7b 69 66 28 21 28 64 20 69 6e 73 74 61 6e 63 65 6f 66 20 74 29 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 43 61 6e 6e 6f 74 20 63 61 6c 6c 20 61 20 63 6c 61 73 73 20 61 73 20 61 20 66 75 6e 63 74 69 6f 6e 22 29 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 64 2c 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 30 3b 65 3c 74 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 7b 76 61 72 20 6e 3d 74 5b 65 5d 3b 6e 2e 65 6e 75 6d 65 72 61 62 6c 65 3d 6e 2e 65 6e 75 6d 65 72 61 62 6c 65 7c 7c 21 31 Data Ascii: Symbol&&d.constructor===Symbol&&d!==Symbol.prototype?"symbol":typeof d},r(d)}function $(d,t){if(!(d instanceof t))throw new TypeError("Cannot call a class as a function")}function o(d,t){for(var e=0;e<t.length;e++){var n=t[e];n.enumerable=n.enumerable\|\|!1
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 7d 7d 3b 66 75 6e 63 74 69 6f 6e 20 53 28 64 2c 74 2c 65 2c 72 2c 24 29 7b 76 61 72 20 6f 3d 66 75 6e 63 74 69 6f 6e 28 64 2c 74 29 7b 66 6f 72 28 76 61 72 20 65 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 64 2c 74 29 7b 76 61 72 20 65 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 64 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 7c 7c 64 5b 22 40 40 69 74 65 72 61 74 6f 72 22 5d 3b 69 66 28 65 29 72 65 74 75 72 6e 28 65 3d 65 2e 63 61 6c 6c 28 64 29 29 2e 6e 65 78 74 2e 62 69 6e 64 28 65 29 3b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 64 29 7c 7c 28 65 3d 66 75 6e 63 74 69 6f 6e 28 64 2c 74 29 7b 69 66 28 64 29 7b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 64 29 72 65 74 75 72 6e 20 41 28 64 Data Ascii: }};function S(d,t,e,r,$){var o=function(d,t){for(var e,n=function(d,t){var e="undefined"!=typeof Symbol&&d[Symbol.iterator]\|\|d["@@iterator"];if(e)return(e=e.call(d)).next.bind(e);if(Array.isArray(d)\|\|(e=function(d,t){if(d){if("string"==typeof d)return A(d
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 5d 2c 32 39 39 3a 5b 22 47 4c 22 5d 2c 33 35 30 3a 5b 22 47 49 22 5d 2c 33 35 31 3a 5b 22 50 54 22 5d 2c 33 35 32 3a 5b 22 4c 55 22 5d 2c 33 35 33 3a 5b 22 49 45 22 5d 2c 33 35 34 3a 5b 22 49 53 22 5d 2c 33 35 35 3a 5b 22 41 4c 22 5d 2c 33 35 36 3a 5b 22 4d 54 22 5d 2c 33 35 37 3a 5b 22 43 59 22 5d 2c 33 35 38 3a 5b 22 46 49 22 2c 22 41 58 22 5d 2c 33 35 39 3a 5b 22 42 47 22 5d 2c 33 37 30 3a 5b 22 4c 54 22 5d 2c 33 37 31 3a 5b 22 4c 56 22 5d 2c 33 37 32 3a 5b 22 45 45 22 5d 2c 33 37 33 3a 5b 22 4d 44 22 5d 2c 33 37 34 3a 5b 22 41 4d 22 5d 2c 33 37 35 3a 5b 22 42 59 22 5d 2c 33 37 36 3a 5b 22 41 44 22 5d 2c 33 37 37 3a 5b 22 4d 43 22 5d 2c 33 37 38 3a 5b 22 53 4d 22 5d 2c 33 38 30 3a 5b 22 55 41 22 5d 2c 33 38 31 3a 5b 22 52 53 22 5d 2c 33 38 32 3a 5b 22 Data Ascii: ],299:["GL"],350:["GI"],351:["PT"],352:["LU"],353:["IE"],354:["IS"],355:["AL"],356:["MT"],357:["CY"],358:["FI","AX"],359:["BG"],370:["LT"],371:["LV"],372:["EE"],373:["MD"],374:["AM"],375:["BY"],376:["AD"],377:["MC"],378:["SM"],380:["UA"],381:["RS"],382:["
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 37 2d 39 5d 7c 38 5b 32 33 5d 29 7c 35 28 3f 3a 5b 31 33 35 37 5d 7c 32 5b 33 37 5d 7c 34 5b 33 36 5d 7c 36 5b 31 2d 34 36 5d 7c 38 30 29 7c 36 28 3f 3a 33 5b 31 2d 35 5d 7c 36 5b 30 32 33 38 5d 7c 39 5b 31 32 5d 29 7c 37 28 3f 3a 30 31 7c 5b 31 35 37 39 5d 7c 32 5b 32 34 38 5d 7c 33 5b 30 31 34 2d 39 5d 7c 34 5b 33 2d 36 5d 7c 36 5b 30 32 33 36 38 39 5d 29 7c 38 28 3f 3a 31 5b 32 33 36 2d 38 5d 7c 32 5b 35 2d 37 5d 7c 5b 33 37 5d 7c 38 5b 33 36 2d 38 5d 7c 39 5b 31 2d 38 5d 29 7c 39 28 3f 3a 30 5b 31 2d 33 36 38 39 5d 7c 31 5b 31 2d 37 39 5d 7c 5b 33 37 39 5d 7c 34 5b 31 33 5d 7c 35 5b 31 2d 35 5d 29 7c 28 3f 3a 34 5b 33 35 5d 7c 35 39 7c 38 35 29 5b 31 2d 39 5d 22 2c 22 28 3f 3a 33 28 3f 3a 5b 31 35 37 5d 5c 5c 64 7c 33 35 7c 34 39 7c 39 5b 31 2d 36 38 Data Ascii: 7-9]\|8[23])\|5(?:[1357]\|2[37]\|4[36]\|6[1-46]\|80)\|6(?:3[1-5]\|6[0238]\|9[12])\|7(?:01\|[1579]\|2[248]\|3[014-9]\|4[3-6]\|6[023689])\|8(?:1[236-8]\|2[5-7]\|[37]\|8[36-8]\|9[1-8])\|9(?:0[1-3689]\|1[1-79]\|[379]\|4[13]\|5[1-5])\|(?:4[35]\|59\|85)[1-9]","(?:3(?:[157]\\d\|35\|49\|9[1-68
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 38 5b 31 2d 33 35 2d 39 5d 22 5d 2c 22 30 24 31 22 5d 2c 5b 22 28 5c 5c 64 7b 33 7d 29 28 5c 5c 64 7b 36 2c 38 7d 29 22 2c 22 24 31 20 24 32 22 2c 5b 22 31 22 5d 2c 22 30 24 31 22 5d 2c 5b 22 28 5c 5c 64 7b 33 7d 29 28 5c 5c 64 7b 33 7d 29 28 5c 5c 64 7b 34 7d 29 22 2c 22 24 31 20 24 32 20 24 33 22 2c 5b 22 38 30 34 22 5d 2c 22 30 24 31 22 5d 2c 5b 22 28 5c 5c 64 7b 33 7d 29 28 5c 5c 64 29 28 5c 5c 64 7b 33 7d 29 28 5c 5c 64 7b 33 7d 29 22 2c 22 24 31 20 24 32 20 24 33 20 24 34 22 2c 5b 22 38 30 22 5d 2c 22 30 24 31 22 5d 2c 5b 22 28 5c 5c 64 7b 33 7d 29 28 5c 5c 64 7b 34 7d 29 28 5c 5c 64 7b 34 2c 35 7d 29 22 2c 22 24 31 2d 24 32 2d 24 33 22 2c 5b 22 38 22 5d 2c 22 30 24 31 22 5d 5d 2c 22 30 22 5d 2c 49 45 3a 5b 22 33 35 33 22 2c 22 30 30 22 2c 22 28 3f Data Ascii: 8[1-35-9]"],"0$1"],["(\\d{3})(\\d{6,8})","$1 $2",["1"],"0$1"],["(\\d{3})(\\d{3})(\\d{4})","$1 $2 $3",["804"],"0$1"],["(\\d{3})(\\d)(\\d{3})(\\d{3})","$1 $2 $3 $4",["80"],"0$1"],["(\\d{3})(\\d{4})(\\d{4,5})","$1-$2-$3",["8"],"0$1"]],"0"],IE:["353","00","(?
2024-02-08 18:36:19 UTC	13606	IN	Data Raw: 5b 22 38 22 5d 2c 22 30 24 31 22 5d 2c 5b 22 28 5c 5c 64 7b 33 7d 29 28 5c 5c 64 7b 36 7d 29 22 2c 22 24 31 2d 24 32 22 2c 5b 22 5b 35 2d 37 5d 22 5d 2c 22 30 24 31 22 5d 5d 2c 22 30 22 2c 30 2c 30 2c 30 2c 30 2c 30 2c 5b 5b 22 35 28 3f 3a 32 39 28 3f 3a 5b 31 38 39 5d 5b 30 35 5d 7c 32 5b 32 39 5d 7c 33 5b 30 31 5d 29 7c 33 38 39 5b 30 35 5d 29 5c 5c 64 7b 34 7d 7c 35 28 3f 3a 32 28 3f 3a 5b 30 2d 32 35 2d 37 5d 5c 5c 64 7c 33 5b 31 2d 35 37 38 5d 7c 34 5b 30 32 2d 34 36 2d 38 5d 7c 38 5b 30 32 33 35 2d 37 5d 7c 39 30 29 7c 33 28 3f 3a 5b 30 2d 34 37 5d 5c 5c 64 7c 35 5b 30 32 2d 39 5d 7c 36 5b 30 32 2d 38 5d 7c 38 5b 30 38 5d 7c 39 5b 33 2d 39 5d 29 7c 28 3f 3a 34 5b 30 36 37 5d 7c 35 5b 30 33 5d 29 5c 5c 64 29 5c 5c 64 7b 35 7d 22 5d 2c 5b 22 28 3f 3a Data Ascii: ["8"],"0$1"],["(\\d{3})(\\d{6})","$1-$2",["[5-7]"],"0$1"]],"0",0,0,0,0,0,[["5(?:29(?:[189][05]\|2[29]\|3[01])\|389[05])\\d{4}\|5(?:2(?:[0-25-7]\\d\|3[1-578]\|4[02-46-8]\|8[0235-7]\|90)\|3(?:[0-47]\\d\|5[02-9]\|6[02-8]\|8[08]\|9[3-9])\|(?:4[067]\|5[03])\\d)\\d{5}"],["(?:
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 29 30 7c 5b 37 2d 39 5d 22 5d 2c 22 30 24 31 22 5d 2c 5b 22 28 5c 5c 64 7b 32 7d 29 28 5c 5c 64 7b 35 2c 31 30 7d 29 22 2c 22 24 31 20 24 32 22 2c 5b 22 5b 31 2d 33 36 5d 22 5d 2c 22 30 24 31 22 5d 5d 2c 22 30 22 5d 2c 52 55 3a 5b 22 37 22 2c 22 38 31 30 22 2c 22 38 5c 5c 64 7b 31 33 7d 7c 5b 33 34 37 2d 39 5d 5c 5c 64 7b 39 7d 22 2c 5b 31 30 2c 31 34 5d 2c 5b 5b 22 28 5c 5c 64 7b 34 7d 29 28 5c 5c 64 7b 32 7d 29 28 5c 5c 64 7b 32 7d 29 28 5c 5c 64 7b 32 7d 29 22 2c 22 24 31 20 24 32 20 24 33 20 24 34 22 2c 5b 22 37 28 3f 3a 31 5b 30 2d 38 5d 7c 32 5b 31 2d 39 5d 29 22 2c 22 37 28 3f 3a 31 28 3f 3a 5b 30 2d 36 5d 32 7c 37 7c 38 5b 32 37 5d 29 7c 32 28 3f 3a 31 5b 32 33 5d 7c 5b 32 2d 39 5d 32 29 29 22 2c 22 37 28 3f 3a 31 28 3f 3a 5b 30 2d 36 5d 32 7c 37 Data Ascii: )0\|[7-9]"],"0$1"],["(\\d{2})(\\d{5,10})","$1 $2",["[1-36]"],"0$1"]],"0"],RU:["7","810","8\\d{13}\|[347-9]\\d{9}",[10,14],[["(\\d{4})(\\d{2})(\\d{2})(\\d{2})","$1 $2 $3 $4",["7(?:1[0-8]\|2[1-9])","7(?:1(?:[0-6]2\|7\|8[27])\|2(?:1[23]\|[2-9]2))","7(?:1(?:[0-6]2\|7
2024-02-08 18:36:19 UTC	602	IN	Data Raw: 28 5c 5c 64 7b 33 7d 29 28 5c 5c 64 7b 33 7d 29 22 2c 22 24 31 20 24 32 20 24 33 22 2c 5b 22 35 31 30 22 5d 5d 2c 5b 22 28 5c 5c 64 7b 33 7d 29 28 5c 5c 64 7b 33 7d 29 28 5c 5c 64 7b 34 7d 29 22 2c 22 24 31 20 24 32 20 24 33 22 2c 5b 22 32 22 5d 5d 2c 5b 22 28 5c 5c 64 7b 34 7d 29 28 5c 5c 64 7b 34 7d 29 28 5c 5c 64 7b 34 7d 29 22 2c 22 24 31 20 24 32 20 24 33 22 2c 5b 22 35 31 5b 31 33 5d 22 5d 5d 2c 5b 22 28 5c 5c 64 7b 33 7d 29 28 5c 5c 64 7b 33 7d 29 28 5c 5c 64 7b 33 7d 29 28 5c 5c 64 7b 33 7d 29 22 2c 22 24 31 20 24 32 20 24 33 20 24 34 22 2c 5b 22 5b 33 35 5d 22 5d 5d 5d 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 5b 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 30 2c 5b 22 28 3f 3a 32 31 30 7c 28 3f 3a 33 37 30 5b 31 2d 39 5d 7c 35 31 5b 30 31 33 5d 30 29 Data Ascii: (\\d{3})(\\d{3})","$1 $2 $3",["510"]],["(\\d{3})(\\d{3})(\\d{4})","$1 $2 $3",["2"]],["(\\d{4})(\\d{4})(\\d{4})","$1 $2 $3",["51[13]"]],["(\\d{3})(\\d{3})(\\d{3})(\\d{3})","$1 $2 $3 $4",["[35]"]]],0,0,0,0,0,0,[0,0,0,0,0,0,0,0,["(?:210\|(?:370[1-9]\|51[013]0)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
655	192.168.2.5	50501	13.32.208.75	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:18 UTC	3284	OUT	GET /_/fvtrpw.gif HTTP/1.1 Host: account.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://account.booking.com/sign-in?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; lastSeen=1707417375276; bkng_ap_lang=en-us; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJzZXNzaW9ucyI6W10sImRhdGFfc3ViamVjdF9pZCI6ImU1MmRjZDUxLTY5OWItNDVlOC04MDcwLTdjYzkxYTU3MzU2YiJ9fQ; bkng_ap=U2FsdGVkX19Oh1T4TMhfk3ZcugI8eRbAeWa9oHLG9diWo4MPNQFGV5mUt%2FwqVJIQw%2F1M2NSGb5TS%0AqvFsettmzw%3D%3D%0A
2024-02-08 18:36:19 UTC	3140	IN	HTTP/1.1 200 OK Content-Type: image/gif Transfer-Encoding: chunked Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:18 GMT content-disposition: attachment; filename=etnht.gif content-security-policy: base-uri 'none'; frame-ancestors https://.booking.com https://.booking.cn; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=block&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgRvqAg3-UlCb1qLTaSWs19YnbAHaubjXL09iRKR5udj-VkcsLlgA9NY; script-src 'report-sample' 'nonce-JX3qxf4CesEzvda' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com content-security-policy-report-only: connect-src 'self' .perimeterx.net .px-cdn.net .px-client.net .px-cloud.net .pxchk.net .token.awswaf.com cdn.cookielaw.org geolocation.onetrust.com privacyportal-eu.onetrust.com saa.booking.com secure.booking.com www.google-analytics.com; default-src 'self' .bstatic.com bstatic.com; frame-src .booking.com .bstatic.com bstatic.com paymentcomponent.booking.com secure.booking.com www.booking.com; img-src 'self' data: .bstatic.com .perimeterx.net .px-cloud.net .static.booking.cn account.booking.com bstatic.com cdn.cookielaw.org graph.facebook.com stats.g.doubleclick.net www.booking.com www.google-analytics.com www.google.com www.gstatic.com; report-uri https://nellie.booking.com/csp-report-uri?type=report&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgRvqAg3-UlCb1qLTaSWs19YnbAHaubjXL09iRKR5udj-VkcsLlgA9NY; script-src 'report-sample' 'nonce-JX3qxf4CesEzvda' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com; style-src 'self' 'unsafe-inline' .bstatic.com *.static.booking.cn bstatic.com set-cookie: bkng_ap=U2FsdGVkX19jt27u%2BWY9%2F8h%2BujLeHMQ01J16gfRmQgoWlCDSxx9IhoyWk%2BdAKMHCJDT%2FF8yW52%2FK%0AbitOSWAITA%3D%3D%0A; domain=account.booking.com; path=/; secure; HttpOnly set-cookie: bkng_sso_ses=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:18 GMT; secure; HttpOnly set-cookie: bkng_sso_session=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:18 GMT; secure; HttpOnly set-cookie: bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJzZXNzaW9ucyI6W10sImRhdGFfc3ViamVjdF9pZCI6ImU1MmRjZDUxLTY5OWItNDVlOC04MDcwLTdjYzkxYTU3MzU2YiJ9fQ; domain=account.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:18 GMT; SameSite=Lax; secure; HttpOnly x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 4e3880ea97e52abcc2c96cf65b515f10.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD66-C1 X-Amz-Cf-Id: dDjxREQXLIz9ULvO6gg4siSvo3w3wJAjWNnrylEHI3Yk-LyFb9zNEA==
2024-02-08 18:36:19 UTC	41	IN	Data Raw: 32 33 0d 0a 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b 0d 0a Data Ascii: 23GIF89a,;
2024-02-08 18:36:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
656	192.168.2.5	50499	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:18 UTC	570	OUT	GET /psb/accountsportal/assets/431_7f56befa4bbedcba65c8.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:18 UTC	620	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 59904 Connection: close Last-Modified: Tue, 06 Feb 2024 12:55:17 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 1f13962ed2aa130897d600c5ba6398edd4d254622ce0a1b5a9c68a325e5687ca Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 11:00:37 GMT ETag: "983bd6c8ed27a19cd0d72e94be13c827" X-Cache: Hit from cloudfront Via: 1.1 f588325f7617672d954c4267c8bee1ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: kb-UYgyQD4GUYr8ZkBId3mIR0RTDEdoNxEiyu5MCB3UNvWdamH25ag== Age: 27342 Vary: Origin
2024-02-08 18:36:18 UTC	15764	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 34 33 31 5f 37 66 35 36 62 65 66 61 34 62 62 65 64 63 62 61 36 35 63 38 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 34 33 31 5d 2c 7b 37 30 30 33 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 65 Data Ascii: /! For license information please see 431_7f56befa4bbedcba65c8.js.LICENSE.txt /(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[431],{70039:function(t,e,n){"use strict";n.d(e
2024-02-08 18:36:18 UTC	16384	IN	Data Raw: 76 38 2e 32 35 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 31 2e 35 20 30 7a 4d 32 32 2e 35 20 31 32 63 30 20 35 2e 37 39 39 2d 34 2e 37 30 31 20 31 30 2e 35 2d 31 30 2e 35 20 31 30 2e 35 53 31 2e 35 20 31 37 2e 37 39 39 20 31 2e 35 20 31 32 20 36 2e 32 30 31 20 31 2e 35 20 31 32 20 31 2e 35 20 32 32 2e 35 20 36 2e 32 30 31 20 32 32 2e 35 20 31 32 7a 6d 31 2e 35 20 30 63 30 2d 36 2e 36 32 37 2d 35 2e 33 37 33 2d 31 32 2d 31 32 2d 31 32 53 30 20 35 2e 33 37 33 20 30 20 31 32 73 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 20 31 32 2d 35 2e 33 37 33 20 31 32 2d 31 32 7a 22 7d 29 29 7d 7d 2c 39 35 32 35 37 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 37 30 36 35 35 29 2c 6f 3d 6e 28 36 37 32 39 Data Ascii: v8.25a.75.75 0 0 0 1.5 0zM22.5 12c0 5.799-4.701 10.5-10.5 10.5S1.5 17.799 1.5 12 6.201 1.5 12 1.5 22.5 6.201 22.5 12zm1.5 0c0-6.627-5.373-12-12-12S0 5.373 0 12s5.373 12 12 12 12-5.373 12-12z"}))}},95257:function(t,e,n){"use strict";var r=n(70655),o=n(6729
2024-02-08 18:36:18 UTC	16384	IN	Data Raw: 3d 74 2e 70 61 74 68 6e 61 6d 65 2c 6e 3d 74 2e 73 65 61 72 63 68 2c 72 3d 74 2e 68 61 73 68 2c 6f 3d 65 7c 7c 22 2f 22 3b 72 65 74 75 72 6e 20 6e 26 26 22 3f 22 21 3d 3d 6e 26 26 28 6f 2b 3d 22 3f 22 3d 3d 3d 6e 2e 63 68 61 72 41 74 28 30 29 3f 6e 3a 22 3f 22 2b 6e 29 2c 72 26 26 22 23 22 21 3d 3d 72 26 26 28 6f 2b 3d 22 23 22 3d 3d 3d 72 2e 63 68 61 72 41 74 28 30 29 3f 72 3a 22 23 22 2b 72 29 2c 6f 7d 66 75 6e 63 74 69 6f 6e 20 73 28 74 2c 65 2c 6e 2c 69 29 7b 76 61 72 20 61 3b 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 3f 28 61 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 7c 7c 22 2f 22 2c 6e 3d 22 22 2c 72 3d 22 22 2c 6f 3d 65 2e 69 6e 64 65 78 4f 66 28 22 23 22 29 3b 2d 31 21 3d 3d 6f 26 26 28 72 3d 65 2e 73 75 62 73 74 72 Data Ascii: =t.pathname,n=t.search,r=t.hash,o=e\|\|"/";return n&&"?"!==n&&(o+="?"===n.charAt(0)?n:"?"+n),r&&"#"!==r&&(o+="#"===r.charAt(0)?r:"#"+r),o}function s(t,e,n,i){var a;"string"==typeof t?(a=function(t){var e=t\|\|"/",n="",r="",o=e.indexOf("#");-1!==o&&(r=e.substr
2024-02-08 18:36:19 UTC	11372	IN	Data Raw: 65 22 2c 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2e 74 6f 53 74 72 69 6e 67 28 33 36 29 2e 73 75 62 73 74 72 69 6e 67 28 37 29 2e 73 70 6c 69 74 28 22 22 29 2e 6a 6f 69 6e 28 22 2e 22 29 7d 2c 75 3d 7b 49 4e 49 54 3a 22 40 40 72 65 64 75 78 2f 49 4e 49 54 22 2b 61 28 29 2c 52 45 50 4c 41 43 45 3a 22 40 40 72 65 64 75 78 2f 52 45 50 4c 41 43 45 22 2b 61 28 29 2c 50 52 4f 42 45 5f 55 4e 4b 4e 4f 57 4e 5f 41 43 54 49 4f 4e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 40 40 72 65 64 75 78 2f 50 52 4f 42 45 5f 55 4e 4b 4e 4f 57 4e 5f 41 43 54 49 4f 4e 22 2b 61 28 29 7d 7d 3b 66 75 6e 63 74 69 6f 6e 20 63 28 74 29 7b 69 66 28 22 6f 62 6a 65 63 74 22 21 3d 74 79 70 65 6f 66 20 74 7c 7c 6e 75 Data Ascii: e",a=function(){return Math.random().toString(36).substring(7).split("").join(".")},u={INIT:"@@redux/INIT"+a(),REPLACE:"@@redux/REPLACE"+a(),PROBE_UNKNOWN_ACTION:function(){return"@@redux/PROBE_UNKNOWN_ACTION"+a()}};function c(t){if("object"!=typeof t\|\|nu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
657	192.168.2.5	50498	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:18 UTC	570	OUT	GET /psb/accountsportal/assets/336_0efd436088eca267c0aa.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:18 UTC	621	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 191217 Connection: close Date: Thu, 08 Feb 2024 15:17:35 GMT Last-Modified: Thu, 08 Feb 2024 14:12:31 GMT ETag: "e0b407117276d5446a94e49bb05ddf0c" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 87c5062af370e04c01cd2248e9cf3c0fc4df5d5ac110f782e9bf186a298d7040 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 b0c7b942a33f0f4451718aee53f7840c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: bbAAFOYy4tayyImmScePMmb8ZZvavMr3qLdG1bV_WPuer7l5bf9DEQ== Age: 11924 Vary: Origin
2024-02-08 18:36:18 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 33 33 36 5f 30 65 66 64 34 33 36 30 38 38 65 63 61 32 36 37 63 30 61 61 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 33 33 36 5d 2c 7b 31 34 39 33 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 28 36 37 32 39 Data Ascii: /! For license information please see 336_0efd436088eca267c0aa.js.LICENSE.txt /(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[336],{1493:function(e,t,n){"use strict";n(6729
2024-02-08 18:36:18 UTC	16384	IN	Data Raw: 72 6b 22 3a 22 6c 69 67 68 74 22 29 7d 7d 7d 29 2c 5b 62 2c 53 2c 64 2c 78 2c 52 2c 4e 2c 41 2c 76 5d 29 3b 6c 2e 64 65 66 61 75 6c 74 28 29 3b 76 61 72 20 77 3d 72 2e 64 65 66 61 75 6c 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 63 2e 64 65 66 61 75 6c 74 5b 22 62 75 69 2d 70 72 6f 76 69 64 65 72 22 5d 7d 2c 74 29 3b 72 65 74 75 72 6e 20 72 2e 64 65 66 61 75 6c 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 69 2e 45 78 70 65 72 69 6d 65 6e 74 50 72 6f 76 69 64 65 72 2c 7b 76 61 6c 75 65 3a 79 7d 2c 72 2e 64 65 66 61 75 6c 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 75 2e 64 65 66 61 75 6c 74 2e 50 72 6f 76 69 64 65 72 2c 7b 76 61 6c 75 65 3a 43 7d 2c 67 3f 72 2e 64 65 66 61 75 6c 74 2e 63 72 65 Data Ascii: rk":"light")}}}),[b,S,d,x,R,N,A,v]);l.default();var w=r.default.createElement("div",{className:c.default["bui-provider"]},t);return r.default.createElement(i.ExperimentProvider,{value:y},r.default.createElement(u.default.Provider,{value:C},g?r.default.cre
2024-02-08 18:36:18 UTC	12288	IN	Data Raw: 7b 76 61 72 20 74 3d 65 2e 69 64 2c 6e 3d 65 2e 76 61 6c 75 65 2c 72 3d 65 2e 64 65 66 61 75 6c 74 56 61 6c 75 65 2c 63 3d 65 2e 6f 6e 43 68 61 6e 67 65 2c 66 3d 65 2e 6c 61 62 65 6c 2c 64 3d 65 2e 6e 61 6d 65 2c 70 3d 65 2e 72 65 76 65 72 73 65 64 2c 68 3d 65 2e 64 69 73 61 62 6c 65 64 2c 6d 3d 65 2e 63 6c 61 73 73 4e 61 6d 65 2c 79 3d 65 2e 61 72 69 61 4c 61 62 65 6c 2c 67 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 76 3d 65 2e 69 6e 70 75 74 41 74 74 72 69 62 75 74 65 73 2c 5f 3d 65 2e 6f 6e 4c 61 62 65 6c 2c 62 3d 65 2e 6f 66 66 4c 61 62 65 6c 2c 53 3d 73 2e 64 65 66 61 75 6c 74 28 74 29 2c 45 3d 61 2e 63 6c 61 73 73 4e 61 6d 65 73 28 75 2e 64 65 66 61 75 6c 74 2e 72 6f 6f 74 2c 6d 2c 70 26 26 75 2e 64 65 66 61 75 6c 74 5b 22 72 6f 6f 74 2d 2d 72 65 76 Data Ascii: {var t=e.id,n=e.value,r=e.defaultValue,c=e.onChange,f=e.label,d=e.name,p=e.reversed,h=e.disabled,m=e.className,y=e.ariaLabel,g=e.attributes,v=e.inputAttributes,_=e.onLabel,b=e.offLabel,S=s.default(t),E=a.classNames(u.default.root,m,p&&u.default["root--rev
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 61 6c 6c 5f 32 3a 7b 66 6f 6e 74 53 69 7a 65 3a 22 31 32 70 78 22 2c 66 6f 6e 74 57 65 69 67 68 74 3a 35 30 30 2c 6c 69 6e 65 48 65 69 67 68 74 3a 22 31 38 70 78 22 2c 66 6f 6e 74 46 61 6d 69 6c 79 3a 22 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 53 65 67 6f 65 20 55 49 2c 20 52 6f 62 6f 74 6f 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 22 7d 2c 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 31 3a 7b 66 6f 6e 74 53 69 7a 65 3a 22 31 36 70 78 22 2c 66 6f 6e 74 57 65 69 67 68 74 3a 37 30 30 2c 6c 69 6e 65 48 65 69 67 68 74 3a 22 32 34 70 78 22 2c 66 6f 6e 74 46 61 6d 69 6c 79 3a 22 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 2d 61 70 70 6c 65 2d Data Ascii: all_2:{fontSize:"12px",fontWeight:500,lineHeight:"18px",fontFamily:"BlinkMacSystemFont, -apple-system, Segoe UI, Roboto, Helvetica, Arial, sans-serif"},font_strong_1:{fontSize:"16px",fontWeight:700,lineHeight:"24px",fontFamily:"BlinkMacSystemFont, -apple-
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 3a 37 30 30 2c 6c 69 6e 65 48 65 69 67 68 74 3a 22 37 32 70 78 22 2c 66 6f 6e 74 46 61 6d 69 6c 79 3a 22 41 76 65 6e 69 72 20 4e 65 78 74 2c 20 4e 6f 74 6f 20 53 61 6e 73 20 53 43 20 42 6f 6c 64 2c 20 4e 6f 74 6f 20 53 61 6e 73 20 54 43 20 42 6f 6c 64 2c 20 4e 6f 74 6f 20 53 61 6e 73 20 4a 50 20 42 6f 6c 64 2c 20 4e 6f 74 6f 20 53 61 6e 73 20 4b 52 20 42 6f 6c 64 2c 20 54 61 6a 61 77 61 6c 20 45 78 74 72 61 42 6f 6c 64 2c 20 41 72 69 6d 6f 20 42 6f 6c 64 2c 20 4b 61 6e 69 74 20 53 65 6d 69 42 6f 6c 64 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 53 65 67 6f 65 20 55 49 2c 20 52 6f 62 6f 74 6f 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 22 7d 2c Data Ascii: :700,lineHeight:"72px",fontFamily:"Avenir Next, Noto Sans SC Bold, Noto Sans TC Bold, Noto Sans JP Bold, Noto Sans KR Bold, Tajawal ExtraBold, Arimo Bold, Kanit SemiBold, BlinkMacSystemFont, -apple-system, Segoe UI, Roboto, Helvetica, Arial, sans-serif"},
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 79 79 22 2c 66 69 3a 22 64 2e 4d 2e 79 79 79 79 22 2c 73 76 3a 22 79 79 79 79 2d 4d 4d 2d 64 64 22 2c 64 61 3a 22 64 64 2f 4d 4d 2f 79 79 79 79 22 2c 63 73 3a 22 64 64 2e 4d 4d 2e 79 79 79 79 22 2c 68 75 3a 22 79 79 79 79 2e 20 4d 4d 2e 20 64 64 2e 22 2c 72 6f 3a 22 64 64 2e 4d 4d 2e 79 79 79 79 22 2c 6a 61 3a 22 79 79 79 79 2f 4d 4d 2f 64 64 22 2c 22 7a 68 2d 63 6e 22 3a 22 79 79 2d 4d 4d 2d 64 64 22 2c 22 7a 68 2d 74 77 22 3a 22 79 79 2d 4d 4d 2d 64 64 22 2c 70 6c 3a 22 64 64 2e 4d 4d 2e 79 79 79 79 22 2c 65 6c 3a 22 64 2f 4d 2f 79 79 22 2c 72 75 3a 22 64 64 2e 4d 4d 2e 79 79 79 79 22 2c 74 72 3a 22 64 64 2e 4d 4d 2e 79 79 79 79 22 2c 62 67 3a 22 64 64 2f 4d 4d 2f 79 79 79 79 22 2c 61 72 3a 22 64 64 2f 4d 4d 2f 79 79 79 79 22 2c 6b 61 3a 22 64 64 2f 4d Data Ascii: yy",fi:"d.M.yyyy",sv:"yyyy-MM-dd",da:"dd/MM/yyyy",cs:"dd.MM.yyyy",hu:"yyyy. MM. dd.",ro:"dd.MM.yyyy",ja:"yyyy/MM/dd","zh-cn":"yy-MM-dd","zh-tw":"yy-MM-dd",pl:"dd.MM.yyyy",el:"d/M/yy",ru:"dd.MM.yyyy",tr:"dd.MM.yyyy",bg:"dd/MM/yyyy",ar:"dd/MM/yyyy",ka:"dd/M
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 45 51 55 49 52 45 44 2c 6d 65 73 73 61 67 65 3a 6f 2e 52 45 51 55 49 52 45 44 7d 5d 2c 79 3d 6e 28 39 34 33 37 37 29 2c 67 3d 6e 28 38 35 31 34 32 29 2c 76 3d 6e 28 34 30 37 39 32 29 2c 5f 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 73 77 69 74 63 68 28 65 29 7b 63 61 73 65 22 49 4e 56 41 4c 49 44 5f 43 4f 55 4e 54 52 59 22 3a 72 65 74 75 72 6e 7b 69 73 56 61 6c 69 64 3a 21 31 2c 65 72 72 6f 72 3a 6f 2e 43 4f 55 4e 54 52 59 5f 43 4f 44 45 5f 49 4e 56 41 4c 49 44 7d 3b 63 61 73 65 22 54 4f 4f 5f 53 48 4f 52 54 22 3a 72 65 74 75 72 6e 7b 69 73 56 61 6c 69 64 3a 21 31 2c 65 72 72 6f 72 3a 6f 2e 54 4f 4f 5f 53 48 4f 52 54 7d 3b 63 61 73 65 22 54 4f 4f 5f 4c 4f 4e 47 22 3a 72 65 74 75 72 6e 7b 69 73 56 61 6c 69 64 3a 21 31 2c 65 72 72 6f 72 3a 6f 2e 54 4f 4f 5f 4c Data Ascii: EQUIRED,message:o.REQUIRED}],y=n(94377),g=n(85142),v=n(40792),_=function(e){switch(e){case"INVALID_COUNTRY":return{isValid:!1,error:o.COUNTRY_CODE_INVALID};case"TOO_SHORT":return{isValid:!1,error:o.TOO_SHORT};case"TOO_LONG":return{isValid:!1,error:o.TOO_L
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 29 2c 75 3d 6e 28 39 32 38 31 31 29 2c 63 3d 6e 28 36 39 30 30 32 29 3b 72 28 72 2e 53 2b 72 2e 46 2a 21 6e 28 37 34 36 32 29 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 41 72 72 61 79 2e 66 72 6f 6d 28 65 29 7d 29 29 2c 22 41 72 72 61 79 22 2c 7b 66 72 6f 6d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 2c 72 2c 66 2c 64 3d 69 28 65 29 2c 70 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 68 69 73 3f 74 68 69 73 3a 41 72 72 61 79 2c 68 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 6d 3d 68 3e 31 3f 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3a 76 6f 69 64 20 30 2c 79 3d 76 6f 69 64 20 30 21 3d 3d 6d 2c 67 3d 30 2c 76 3d 63 28 64 29 3b 69 66 28 79 26 26 28 6d 3d 6f 28 6d 2c 68 3e 32 3f 61 72 67 75 6d 65 6e 74 73 5b 32 5d 3a 76 Data Ascii: ),u=n(92811),c=n(69002);r(r.S+r.F*!n(7462)((function(e){Array.from(e)})),"Array",{from:function(e){var t,n,r,f,d=i(e),p="function"==typeof this?this:Array,h=arguments.length,m=h>1?arguments[1]:void 0,y=void 0!==m,g=0,v=c(d);if(y&&(m=o(m,h>2?arguments[2]:v
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 6f 7a 76 52 75 64 4b 22 2c 22 72 6f 6f 74 2d 2d 73 69 7a 65 2d 6d 65 64 69 75 6d 22 3a 22 7a 6f 34 61 30 63 6a 38 5f 4b 76 6d 46 63 56 78 6f 79 59 42 22 2c 22 72 6f 6f 74 2d 2d 73 69 7a 65 2d 6c 61 72 67 65 22 3a 22 67 36 43 4d 31 42 7a 5a 46 75 7a 6e 63 50 62 69 72 44 35 78 22 2c 22 72 6f 6f 74 2d 2d 64 69 73 61 62 6c 65 64 22 3a 22 63 69 51 51 64 62 70 79 58 59 79 62 62 50 74 52 76 49 71 6f 22 2c 22 72 6f 6f 74 2d 2d 70 6c 61 63 65 68 6f 6c 64 65 72 22 3a 22 41 65 45 31 73 47 72 43 77 79 54 47 72 72 61 39 47 5f 6b 7a 22 2c 22 72 6f 6f 74 2d 2d 73 74 61 74 75 73 2d 65 72 72 6f 72 22 3a 22 5a 77 32 35 37 45 46 52 37 5f 52 52 31 67 46 63 30 52 59 76 22 2c 22 72 6f 6f 74 2d 2d 68 61 73 2d 73 74 61 72 74 2d 69 63 6f 6e 22 3a 22 50 69 50 44 39 45 56 6a 70 34 Data Ascii: ozvRudK","root--size-medium":"zo4a0cj8_KvmFcVxoyYB","root--size-large":"g6CM1BzZFuzncPbirD5x","root--disabled":"ciQQdbpyXYybbPtRvIqo","root--placeholder":"AeE1sGrCwyTGrra9G_kz","root--status-error":"Zw257EFR7_RR1gFc0RYv","root--has-start-icon":"PiPD9EVjp4
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 66 6f 72 28 6f 3d 30 3b 6f 3c 69 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 6e 3d 69 5b 6f 5d 2c 74 2e 69 6e 64 65 78 4f 66 28 6e 29 3e 3d 30 7c 7c 28 72 5b 6e 5d 3d 65 5b 6e 5d 29 3b 72 65 74 75 72 6e 20 72 7d 28 65 2c 5b 22 63 68 69 6c 64 72 65 6e 22 2c 22 69 6e 22 5d 29 2c 61 3d 6f 2e 64 65 66 61 75 6c 74 2e 43 68 69 6c 64 72 65 6e 2e 74 6f 41 72 72 61 79 28 74 29 2c 73 3d 61 5b 30 5d 2c 6c 3d 61 5b 31 5d 3b 72 65 74 75 72 6e 20 64 65 6c 65 74 65 20 72 2e 6f 6e 45 6e 74 65 72 2c 64 65 6c 65 74 65 20 72 2e 6f 6e 45 6e 74 65 72 69 6e 67 2c 64 65 6c 65 74 65 20 72 2e 6f 6e 45 6e 74 65 72 65 64 2c 64 65 6c 65 74 65 20 72 2e 6f 6e 45 78 69 74 2c 64 65 6c 65 74 65 20 72 2e 6f 6e 45 78 69 74 69 6e 67 2c 64 65 6c 65 74 65 Data Ascii: Object.keys(e);for(o=0;o<i.length;o++)n=i[o],t.indexOf(n)>=0\|\|(r[n]=e[n]);return r}(e,["children","in"]),a=o.default.Children.toArray(t),s=a[0],l=a[1];return delete r.onEnter,delete r.onEntering,delete r.onEntered,delete r.onExit,delete r.onExiting,delete

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
658	192.168.2.5	50503	18.64.236.100	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:18 UTC	574	OUT	GET /libs/privacy-consent/1.0.0/customer/cookie-banner.min.js HTTP/1.1 Host: www.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:18 UTC	805	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 3863 Connection: close Server: nginx Date: Thu, 01 Feb 2024 12:05:07 GMT Last-Modified: Wed, 31 Jan 2024 09:24:57 GMT ETag: "65ba11e9-f17" Expires: Sat, 02 Mar 2024 12:05:07 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 2814ce14efad43b3b417e8d65a22cbb6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: uRulPls4UAAZ7TnZOd2R-5Jsc2o2rHA-3TiUbwX1bTpMH1voCcly0w== Age: 628271
2024-02-08 18:36:18 UTC	3863	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 4f 70 74 61 6e 6f 6e 57 72 61 70 70 65 72 28 29 7b 77 69 6e 64 6f 77 2e 50 43 4d 2e 4d 61 72 6b 65 74 69 6e 67 3d 4f 70 74 61 6e 6f 6e 41 63 74 69 76 65 47 72 6f 75 70 73 26 26 2d 31 3c 4f 70 74 61 6e 6f 6e 41 63 74 69 76 65 47 72 6f 75 70 73 2e 69 6e 64 65 78 4f 66 28 22 2c 43 30 30 30 34 2c 22 29 2c 77 69 6e 64 6f 77 2e 50 43 4d 2e 41 6e 61 6c 79 74 69 63 61 6c 3d 4f 70 74 61 6e 6f 6e 41 63 74 69 76 65 47 72 6f 75 70 73 26 26 2d 31 3c 4f 70 74 61 6e 6f 6e 41 63 74 69 76 65 47 72 6f 75 70 73 2e 69 6e 64 65 78 4f 66 28 22 2c 43 30 30 30 32 2c 22 29 3b 76 61 72 20 74 2c 65 2c 6e 3d 77 69 6e 64 6f 77 2e 50 43 4d 2e 5f 5f 67 65 74 43 6f 6f 6b 69 65 28 22 4f 70 74 61 6e 6f 6e 41 6c 65 72 74 42 6f 78 43 6c 6f 73 65 64 22 29 3b 69 66 Data Ascii: function OptanonWrapper(){window.PCM.Marketing=OptanonActiveGroups&&-1<OptanonActiveGroups.indexOf(",C0004,"),window.PCM.Analytical=OptanonActiveGroups&&-1<OptanonActiveGroups.indexOf(",C0002,");var t,e,n=window.PCM.__getCookie("OptanonAlertBoxClosed");if

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
659	192.168.2.5	50506	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:18 UTC	3099	OUT	GET /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAmb6ChG0GAAAA:1YfdqTGcz5Nv+ySyR4l0dcP3pMoTORFatiNiGWJ7MN9YNAXjrj+JwLDSBSegMncHAdyNNPOjNsaeDm9pbnbRLlIYy/Wsa0l3RRdVGZNwHvCL7MSxVUeOoLQbnA4ws/oCccvImOwo8CVethnhcZ8jRyLom9EtR+hCle5g3/E4tScqZS87YMPrAUoKpLzL6QZghMKuNcinEXGdtGGXi/+Tn/jd1osZzUxtKgagCgVNA7aglFhxkvVLvhbzVj9tZG3VnoD+k6IF; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; lastSeen=1707417375276; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16
2024-02-08 18:36:19 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:19 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=282782d1e21d0161&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGdbKCYEVwVkEjB0ZskH4gVs6aQBh7NqBKA x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 b0c7b942a33f0f4451718aee53f7840c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: l-w-0KUyjx-lTXMss0uug_VG3SFzj0HUfeCIlslfDdlAaX8bJxNe3Q==
2024-02-08 18:36:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
660	192.168.2.5	50508	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:19 UTC	569	OUT	GET /psb/accountsportal/assets/48_a501036cafaf1b1b6586.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:19 UTC	620	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 13479 Connection: close Last-Modified: Tue, 06 Feb 2024 12:55:16 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 1f13962ed2aa130897d600c5ba6398edd4d254622ce0a1b5a9c68a325e5687ca Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 07 Feb 2024 20:03:05 GMT ETag: "88389331fbabfe4a679dcbfc3e2cc56d" X-Cache: Hit from cloudfront Via: 1.1 7eeed291abf48890d3f36565208941a8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: gSrOt4T6DHogTIVYrizrUuHbc5ThWfBKafLDXiTKlneF2kiO-O92Iw== Age: 81195 Vary: Origin
2024-02-08 18:36:19 UTC	13479	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 34 38 5d 2c 7b 36 31 37 38 36 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 65 29 7b 76 61 72 20 72 2c 6f 2c 69 2c 73 2c 75 2c 61 2c 66 2c 63 2c 6c 3b 66 75 6e 63 74 69 6f 6e 20 70 28 74 29 7b 72 65 74 75 72 6e 20 70 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 22 73 79 6d 62 6f 6c 22 3d 3d 74 79 70 65 6f 66 Data Ascii: "use strict";(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[48],{61786:function(t,n,e){var r,o,i,s,u,a,f,c,l;function p(t){return p="function"==typeof Symbol&&"symbol"==typeof

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
661	192.168.2.5	50507	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:19 UTC	572	OUT	GET /psb/accountsportal/assets/index_f26add0f1ee6ed4ed8de.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:19 UTC	621	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 498537 Connection: close Date: Wed, 07 Feb 2024 20:03:05 GMT Last-Modified: Tue, 06 Feb 2024 12:55:17 GMT ETag: "ae43b8d72cd3132bcb061df36f217784" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 1f13962ed2aa130897d600c5ba6398edd4d254622ce0a1b5a9c68a325e5687ca Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 145bb9cba9e12350510f02ee9ab6ca22.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 3gRkfNLi6zcmT3YFl8elfqCNeBpIMBLnMiaz7Swj-7eLvS03wCjtjg== Age: 81195 Vary: Origin
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 38 32 36 5d 2c 7b 33 30 30 33 39 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 65 2c 74 29 7b 76 61 72 20 6e 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 65 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 29 7b 76 61 72 20 72 3d 4f 62 6a 65 63 Data Ascii: "use strict";(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[826],{30039:function(e,t,n){var r;function o(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Objec
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 53 55 42 4d 49 54 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 74 7d 2c 53 54 45 50 5f 50 48 4f 4e 45 5f 5f 50 41 53 53 57 4f 52 44 5f 52 45 43 4f 56 45 52 59 5f 5f 49 44 45 4e 54 49 46 49 45 52 5f 5f 53 55 42 4d 49 54 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 74 7d 2c 53 54 45 50 5f 50 48 4f 4e 45 5f 5f 50 41 53 53 57 4f 52 44 5f 52 45 43 4f 56 45 52 59 5f 5f 50 41 53 53 57 4f 52 44 5f 5f 53 55 42 4d 49 54 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 74 7d 2c 53 54 45 50 5f 50 48 4f 4e 45 5f 5f 50 41 53 53 57 4f 52 44 5f 52 45 43 4f 56 45 52 59 5f 5f 52 45 51 55 45 53 54 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 74 7d 2c 53 54 45 50 5f 50 48 4f 4e 45 5f 5f 50 41 53 53 57 4f 52 44 5f 5f 53 Data Ascii: SUBMIT:function(){return nt},STEP_PHONE__PASSWORD_RECOVERY__IDENTIFIER__SUBMIT:function(){return et},STEP_PHONE__PASSWORD_RECOVERY__PASSWORD__SUBMIT:function(){return tt},STEP_PHONE__PASSWORD_RECOVERY__REQUEST:function(){return rt},STEP_PHONE__PASSWORD__S
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 63 2d 32 2e 34 38 37 2d 2e 37 35 31 2d 33 2e 39 34 37 2d 2e 31 32 38 2d 34 2e 39 33 34 20 32 2e 33 37 35 6c 2d 2e 39 33 38 20 32 2e 33 30 35 2d 31 2e 33 32 32 20 33 2e 33 37 34 2e 38 31 39 2e 34 33 35 61 33 31 2e 39 33 39 20 33 31 2e 39 33 39 20 30 20 30 20 30 20 31 34 2e 33 34 39 20 33 2e 34 37 32 63 39 2e 39 38 37 20 30 20 32 31 2e 36 35 32 2d 35 2e 31 32 34 20 32 31 2e 36 35 32 2d 31 39 2e 35 34 39 56 31 37 2e 36 6c 2d 35 2e 34 30 38 2d 2e 30 31 7a 6d 2d 31 34 2e 31 36 32 20 33 30 2e 32 32 34 63 2d 36 2e 33 39 35 20 30 2d 38 2e 36 38 34 2d 35 2e 36 32 2d 38 2e 36 38 34 2d 31 30 2e 38 38 33 20 30 2d 32 2e 33 31 35 2e 35 37 32 2d 39 2e 38 39 33 20 38 2e 30 36 33 2d 39 2e 38 39 33 20 33 2e 37 32 20 30 20 38 2e 37 30 34 20 31 2e 30 36 38 20 38 2e 37 30 34 Data Ascii: c-2.487-.751-3.947-.128-4.934 2.375l-.938 2.305-1.322 3.374.819.435a31.939 31.939 0 0 0 14.349 3.472c9.987 0 21.652-5.124 21.652-19.549V17.6l-5.408-.01zm-14.162 30.224c-6.395 0-8.684-5.62-8.684-10.883 0-2.315.572-9.893 8.063-9.893 3.72 0 8.704 1.068 8.704
2024-02-08 18:36:19 UTC	15178	IN	Data Raw: 69 6c 2f 73 75 62 6d 69 74 22 2c 48 65 3d 22 2f 73 6f 63 69 61 6c 2f 70 61 73 73 77 6f 72 64 2f 73 75 62 6d 69 74 22 2c 56 65 3d 22 2f 73 6f 63 69 61 6c 2f 32 66 61 5f 70 69 6e 2f 73 75 62 6d 69 74 22 2c 55 65 3d 22 2f 73 6f 63 69 61 6c 2f 32 66 61 5f 70 69 6e 2f 72 65 71 75 65 73 74 5f 72 65 73 65 6e 64 22 2c 7a 65 3d 22 2f 73 6f 63 69 61 6c 2f 32 66 61 5f 72 65 63 6f 76 65 72 79 2f 70 68 6f 6e 65 2f 73 75 62 6d 69 74 22 2c 57 65 3d 22 2f 73 6f 63 69 61 6c 2f 32 66 61 5f 72 65 63 6f 76 65 72 79 2f 76 65 72 69 66 69 63 61 74 69 6f 6e 5f 63 6f 64 65 2f 73 75 62 6d 69 74 22 2c 46 65 3d 22 2f 73 6f 63 69 61 6c 2f 63 6f 6e 66 69 72 6d 61 74 69 6f 6e 2f 73 75 62 6d 69 74 22 2c 42 65 3d 22 2f 73 6f 63 69 61 6c 2f 70 61 73 73 77 6f 72 64 5f 72 65 63 6f 76 65 72 Data Ascii: il/submit",He="/social/password/submit",Ve="/social/2fa_pin/submit",Ue="/social/2fa_pin/request_resend",ze="/social/2fa_recovery/phone/submit",We="/social/2fa_recovery/verification_code/submit",Fe="/social/confirmation/submit",Be="/social/password_recover
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 73 74 72 75 63 74 6f 72 3a 7b 76 61 6c 75 65 3a 65 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 7d 29 2c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 22 70 72 6f 74 6f 74 79 70 65 22 2c 7b 77 72 69 74 61 62 6c 65 3a 21 31 7d 29 2c 74 26 26 50 74 28 65 2c 74 29 7d 28 69 2c 65 29 3b 76 61 72 20 74 2c 6e 2c 72 2c 6f 2c 61 3d 28 72 3d 69 2c 6f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 74 79 70 65 6f 66 20 52 65 66 6c 65 63 74 7c 7c 21 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 29 72 65 74 75 72 6e 21 31 3b 69 66 28 52 65 66 6c 65 63 74 2e 63 6f 6e 73 74 72 75 63 74 2e 73 68 61 6d 29 72 65 74 75 72 6e 21 31 3b 69 66 28 22 66 75 6e 63 74 69 6f Data Ascii: structor:{value:e,writable:!0,configurable:!0}}),Object.defineProperty(e,"prototype",{writable:!1}),t&&Pt(e,t)}(i,e);var t,n,r,o,a=(r=i,o=function(){if("undefined"==typeof Reflect\|\|!Reflect.construct)return!1;if(Reflect.construct.sham)return!1;if("functio
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 65 73 2e 65 6e 61 62 6c 65 64 5f 69 6e 74 65 67 72 61 74 69 6f 6e 3f 22 67 75 65 73 74 22 3a 22 70 61 72 74 6e 65 72 22 29 2c 74 6f 3a 4e 2e 5a 2e 70 72 69 76 61 63 79 7d 2c 7b 63 68 69 6c 64 72 65 6e 3a 65 7d 29 2c 22 70 72 69 76 61 63 79 5f 6c 69 6e 6b 22 29 7d 7d 7d 29 7d 29 29 2c 74 26 26 22 75 73 22 3d 3d 3d 72 2e 65 6e 76 2e 63 63 31 26 26 28 30 2c 61 2e 6a 73 78 29 28 22 64 69 76 22 2c 6d 6e 28 7b 63 6c 61 73 73 4e 61 6d 65 3a 22 66 6f 6f 74 65 72 2d 62 6c 6f 63 6b 22 7d 2c 7b 63 68 69 6c 64 72 65 6e 3a 28 30 2c 61 2e 6a 73 78 29 28 43 2e 5a 2c 6d 6e 28 7b 74 79 70 65 3a 22 65 78 74 65 72 6e 61 6c 22 2c 63 6c 61 73 73 4e 61 6d 65 3a 22 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 22 2c 74 6f 3a 4e 2e 5a 2e 63 63 70 61 2c 22 64 61 74 61 2d 67 61 Data Ascii: es.enabled_integration?"guest":"partner"),to:N.Z.privacy},{children:e}),"privacy_link")}}})})),t&&"us"===r.env.cc1&&(0,a.jsx)("div",mn({className:"footer-block"},{children:(0,a.jsx)(C.Z,mn({type:"external",className:"bui_color_action",to:N.Z.ccpa,"data-ga
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 65 29 7d 2c 68 72 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 76 72 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 74 20 69 6e 20 65 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 7b 76 61 6c 75 65 3a 6e 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 65 5b 74 5d 3d 6e 2c 65 7d 76 61 72 20 6d 72 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 74 26 26 6e 75 6c 6c 21 3d 3d 74 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 53 75 70 65 72 20 65 78 70 72 65 73 73 69 6f 6e 20 6d Data Ascii: t.getPrototypeOf(e)},hr(e)}function vr(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}var mr=function(e){!function(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Super expression m
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 20 69 6e 20 65 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 7b 76 61 6c 75 65 3a 6e 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 65 5b 74 5d 3d 6e 2c 65 7d 76 61 72 20 66 6f 3d 75 6f 28 28 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 70 6f 28 74 68 69 73 2c 65 29 7d 29 29 3b 5f 6f 28 66 6f 2c 22 52 45 51 55 45 53 54 45 44 22 2c 22 31 22 29 2c 5f 6f 28 66 6f 2c 22 45 52 52 4f 52 22 2c 22 32 22 29 2c 5f 6f 28 66 6f 2c 22 53 55 43 43 45 53 53 22 2c 22 33 22 29 2c 5f 6f 28 66 6f 2c 22 55 4e 45 58 50 45 43 54 45 44 5f 45 52 52 4f 52 22 2c 22 34 22 29 3b 76 61 72 20 68 6f 3d 75 6f 28 28 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 70 6f 28 74 68 69 Data Ascii: in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}var fo=uo((function e(){po(this,e)}));_o(fo,"REQUESTED","1"),_o(fo,"ERROR","2"),_o(fo,"SUCCESS","3"),_o(fo,"UNEXPECTED_ERROR","4");var ho=uo((function e(){po(thi
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 6f 29 26 26 28 65 5b 6f 5d 3d 74 5b 6f 5d 29 3b 72 65 74 75 72 6e 20 65 7d 2c 59 6f 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 2c 58 6f 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 73 74 61 74 65 2c 6e 3d 65 2e 6f 6e 43 68 61 6e 67 65 2c 72 3d 65 2e 6f 6e 53 75 62 6d 69 74 3b 72 65 74 75 72 6e 20 73 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 22 74 72 61 6e 73 69 74 69 6f 6e 20 62 75 69 2d 70 61 6e 65 6c 2d 62 6f 64 79 22 7d 2c 73 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 2c 6e 75 6c 6c 2c 73 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 68 34 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 Data Ascii: asOwnProperty.call(t,o)&&(e[o]=t[o]);return e},Yo.apply(this,arguments)},Xo=function(e){var t=e.state,n=e.onChange,r=e.onSubmit;return s.createElement("div",{className:"transition bui-panel-body"},s.createElement("div",null,s.createElement("h4",{className
2024-02-08 18:36:19 UTC	16384	IN	Data Raw: 6e 63 74 69 6f 6e 20 42 61 28 65 29 7b 72 65 74 75 72 6e 20 42 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 22 73 79 6d 62 6f 6c 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 3f 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 65 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 53 79 6d 62 6f 6c 26 26 65 21 3d 3d 53 79 6d 62 6f 6c 2e 70 72 6f 74 6f 74 79 70 65 3f 22 73 79 6d 62 6f 6c 22 3a 74 79 70 65 6f 66 20 65 7d 2c 42 61 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 47 61 28 65 2c 74 29 7b 69 66 28 21 28 65 20 Data Ascii: nction Ba(e){return Ba="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},Ba(e)}function Ga(e,t){if(!(e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
662	192.168.2.5	50509	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:19 UTC	717	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 1150 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:19 UTC	1150	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 36 39 37 39 39 62 31 2d 62 32 62 32 2d 34 30 66 38 2d 38 65 36 66 2d 32 38 30 39 62 39 63 36 66 31 61 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 31 35 65 37 34 61 30 38 2d 33 31 30 39 2d 34 66 30 30 2d 62 39 66 35 2d 39 62 63 31 36 61 38 34 66 31 37 61 22 2c 22 73 73 22 3a 22 30 32 34 37 38 38 37 34 2d 61 32 37 37 2d 34 36 35 63 2d 62 39 65 37 2d 63 65 32 34 31 32 32 33 32 65 34 66 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"f69799b1-b2b2-40f8-8e6f-2809b9c6f1a0","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"15e74a08-3109-4f00-b9f5-9bc16a84f17a","ss":"02478874-a277-465c-b9e7-ce2412232e4f","bg":true,"s
2024-02-08 18:36:19 UTC	523	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:19 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
663	192.168.2.5	50510	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:19 UTC	717	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 1225 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:19 UTC	1225	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 36 39 37 39 39 62 31 2d 62 32 62 32 2d 34 30 66 38 2d 38 65 36 66 2d 32 38 30 39 62 39 63 36 66 31 61 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 63 33 38 34 36 63 62 65 2d 34 38 63 37 2d 34 37 38 62 2d 61 34 30 39 2d 31 35 62 30 33 66 61 39 35 35 37 37 22 2c 22 73 73 22 3a 22 30 32 34 37 38 38 37 34 2d 61 32 37 37 2d 34 36 35 63 2d 62 39 65 37 2d 63 65 32 34 31 32 32 33 32 65 34 66 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"f69799b1-b2b2-40f8-8e6f-2809b9c6f1a0","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"c3846cbe-48c7-478b-a409-15b03fa95577","ss":"02478874-a277-465c-b9e7-ce2412232e4f","bg":true,"s
2024-02-08 18:36:19 UTC	482	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:19 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: clear access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
664	192.168.2.5	50511	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:19 UTC	717	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 1226 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:19 UTC	1226	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 36 39 37 39 39 62 31 2d 62 32 62 32 2d 34 30 66 38 2d 38 65 36 66 2d 32 38 30 39 62 39 63 36 66 31 61 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 62 62 35 61 39 33 33 33 2d 61 30 34 34 2d 34 31 34 65 2d 39 33 30 39 2d 31 31 61 33 38 36 35 38 35 32 30 63 22 2c 22 73 73 22 3a 22 30 32 34 37 38 38 37 34 2d 61 32 37 37 2d 34 36 35 63 2d 62 39 65 37 2d 63 65 32 34 31 32 32 33 32 65 34 66 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"f69799b1-b2b2-40f8-8e6f-2809b9c6f1a0","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"bb5a9333-a044-414e-9309-11a38658520c","ss":"02478874-a277-465c-b9e7-ce2412232e4f","bg":true,"s
2024-02-08 18:36:19 UTC	482	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:19 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: clear access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
665	192.168.2.5	50513	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:19 UTC	717	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 1150 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:19 UTC	1150	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 36 39 37 39 39 62 31 2d 62 32 62 32 2d 34 30 66 38 2d 38 65 36 66 2d 32 38 30 39 62 39 63 36 66 31 61 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 62 32 39 66 66 62 33 62 2d 38 35 37 31 2d 34 65 35 38 2d 61 32 37 62 2d 34 32 61 39 36 66 62 30 39 64 31 31 22 2c 22 73 73 22 3a 22 30 32 34 37 38 38 37 34 2d 61 32 37 37 2d 34 36 35 63 2d 62 39 65 37 2d 63 65 32 34 31 32 32 33 32 65 34 66 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"f69799b1-b2b2-40f8-8e6f-2809b9c6f1a0","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"b29ffb3b-8571-4e58-a27b-42a96fb09d11","ss":"02478874-a277-465c-b9e7-ce2412232e4f","bg":true,"s
2024-02-08 18:36:19 UTC	523	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:19 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
666	192.168.2.5	50512	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:19 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive Content-Length: 3251 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:19 UTC	3251	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 6d 62 36 43 68 47 30 47 41 41 41 41 3a 31 59 66 64 71 54 47 63 7a 35 4e 76 2b 79 53 79 52 34 6c 30 64 63 50 33 70 4d 6f 54 4f 52 46 61 74 69 4e 69 47 57 4a 37 4d 4e 39 59 4e 41 58 6a 72 6a 2b 4a 77 4c 44 53 42 53 65 67 4d 6e 63 48 41 64 79 4e 4e 50 4f 6a 4e 73 61 65 44 6d 39 70 62 6e 62 52 4c 6c 49 59 79 2f 57 73 61 30 6c 33 52 52 64 56 47 5a 4e 77 48 76 43 4c 37 4d 53 78 56 55 65 4f 6f 4c 51 62 6e 41 34 77 73 2f 6f 43 63 63 76 49 6d 4f 77 6f 38 43 56 65 74 68 6e 68 63 5a 38 6a 52 79 4c 6f 6d 39 45 74 52 2b 68 43 6c 65 35 67 33 2f 45 34 74 53 63 71 5a 53 38 37 59 4d 50 72 41 55 Data Ascii: {"existing_token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAmb6ChG0GAAAA:1YfdqTGcz5Nv+ySyR4l0dcP3pMoTORFatiNiGWJ7MN9YNAXjrj+JwLDSBSegMncHAdyNNPOjNsaeDm9pbnbRLlIYy/Wsa0l3RRdVGZNwHvCL7MSxVUeOoLQbnA4ws/oCccvImOwo8CVethnhcZ8jRyLom9EtR+hCle5g3/E4tScqZS87YMPrAU
2024-02-08 18:36:19 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1653 Connection: close Vary: Accept-Encoding Date: Thu, 08 Feb 2024 18:36:19 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65c51f23-4eb3980c049ca835235f1b9c X-Cache: Miss from cloudfront Via: 1.1 e418fd5667de46c635f0321ea814c2e0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: sUxirWGj1ShmYu6BRAEj5JQn8OyfBQ1s6InWQ7gFyxxoKUs704RWPQ==
2024-02-08 18:36:19 UTC	1653	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 71 32 36 43 78 35 67 41 41 41 41 41 3a 56 2b 67 32 71 54 71 72 55 43 37 34 42 42 48 46 42 54 77 5a 33 33 4d 62 4d 58 38 2b 71 6f 6f 56 66 6c 59 79 36 2b 4b 76 53 4b 45 59 54 50 63 43 30 39 49 49 50 6a 62 70 47 51 30 34 55 6d 76 54 65 6e 77 53 65 76 4b 50 32 4d 59 69 47 62 71 71 5a 79 71 30 78 74 79 64 6c 49 6c 2b 62 79 38 39 6f 54 77 47 41 4d 4c 2f 75 6b 41 47 4d 56 34 61 41 6a 51 4a 33 57 30 39 34 59 35 2f 66 4b 57 4a 75 32 43 61 51 2b 6c 64 56 2f 55 58 34 67 33 6b 66 34 65 67 6e 44 4e 44 59 53 62 33 59 42 76 57 74 47 65 61 32 74 44 4f 34 30 30 68 43 69 4e 65 35 4b 68 46 52 30 55 67 44 71 5a 47 61 6d 73 Data Ascii: {"token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAq26Cx5gAAAAA:V+g2qTqrUC74BBHFBTwZ33MbMX8+qooVflYy6+KvSKEYTPcC09IIPjbpGQ04UmvTenwSevKP2MYiGbqqZyq0xtydlIl+by89oTwGAML/ukAGMV4aAjQJ3W094Y5/fKWJu2CaQ+ldV/UX4g3kf4egnDNDYSb3YBvWtGea2tDO400hCiNe5KhFR0UgDqZGams

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
667	192.168.2.5	50514	64.233.177.99	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:19 UTC	1231	OUT	POST /recaptcha/api2/reload?k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 8300 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-protobuffer Accept: / Origin: https://www.google.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&cb=k6nv978x042h Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AJmcDEl4lP7G1sUzlkfo-ph5oEYDaZrMsr87jx805YMBfBXipJ4MvomJQXIF7z5TPrZE7LxvSiQSdmfSY1DEipM; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:19 UTC	8300	OUT	Data Raw: 0a 18 78 35 57 57 6f 45 35 37 46 76 30 64 36 41 54 4b 73 4c 44 49 41 4b 6e 74 12 8e 0f 30 33 41 46 63 57 65 41 36 42 6d 75 36 32 56 74 72 4b 63 52 36 52 52 32 4d 5a 58 70 6c 50 50 44 79 6c 46 54 2d 5f 30 54 6b 62 70 53 41 76 6f 32 5a 74 4c 65 74 4f 6f 61 4a 4d 6c 44 76 4b 38 43 6a 54 45 37 49 42 65 42 4a 68 44 32 72 69 55 63 52 4e 6f 54 31 31 79 6b 35 75 46 59 6b 6d 62 33 46 53 54 32 52 7a 69 5a 36 39 78 6f 70 66 78 2d 35 36 63 71 67 44 42 58 4d 55 4f 56 35 55 38 38 69 67 56 65 51 53 39 49 67 43 4e 48 5a 4a 41 65 4e 6b 59 5f 4c 73 46 7a 36 2d 73 79 51 49 44 4f 72 42 6a 49 6a 71 67 6b 4c 69 54 44 6c 44 58 33 52 55 2d 59 57 58 63 66 46 73 34 62 73 66 6f 50 52 77 6b 5f 6e 6e 46 39 32 46 45 34 4c 32 32 64 67 69 72 2d 45 75 46 4d 53 58 32 4a 30 74 70 4a 6e 57 Data Ascii: x5WWoE57Fv0d6ATKsLDIAKnt03AFcWeA6Bmu62VtrKcR6RR2MZXplPPDylFT-_0TkbpSAvo2ZtLetOoaJMlDvK8CjTE7IBeBJhD2riUcRNoT11yk5uFYkmb3FST2RziZ69xopfx-56cqgDBXMUOV5U88igVeQS9IgCNHZJAeNkY_LsFz6-syQIDOrBjIjqgkLiTDlDX3RU-YWXcfFs4bsfoPRwk_nnF92FE4L22dgir-EuFMSX2J0tpJnW
2024-02-08 18:36:19 UTC	696	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Date: Thu, 08 Feb 2024 18:36:19 GMT Expires: Thu, 08 Feb 2024 18:36:19 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Set-Cookie: _GRECAPTCHA=09AJmcDEluwtSp57QJSmQQzbcGIOozbHSebG52sNz1noRw0W0Uj5MlmO6jPWiPivfFDy1ady_Qtnfk7_9aHN-OBpc;Path=/recaptcha;Expires=Tue, 06-Aug-2024 18:36:19 GMT;Secure;HttpOnly;Priority=HIGH;SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:36:19 UTC	556	IN	Data Raw: 61 37 64 0d 0a 29 5d 7d 27 0a 5b 22 72 72 65 73 70 22 2c 22 30 33 41 46 63 57 65 41 35 51 68 6b 64 5a 39 5f 48 57 57 50 44 67 49 4a 57 4e 30 50 44 46 45 59 79 4c 47 43 56 56 4f 53 77 5a 45 53 77 33 32 4c 39 74 44 42 4d 57 58 56 34 71 61 33 48 70 44 51 2d 56 31 61 55 79 4b 78 38 6c 56 42 62 6a 6b 2d 65 53 68 4f 77 68 76 65 67 68 62 34 72 50 33 54 45 6c 5f 39 32 70 34 54 38 46 33 7a 46 4a 5f 47 74 7a 39 6b 5f 57 55 50 6f 61 66 78 55 54 67 65 54 63 37 50 75 42 32 59 5a 44 69 34 59 75 50 5a 59 65 56 4f 51 58 70 47 68 44 65 47 66 4b 6b 74 72 6e 61 32 43 4a 73 61 54 33 2d 42 53 65 58 33 54 6c 54 69 4e 4f 56 61 6c 68 71 53 35 37 65 52 66 42 46 69 6e 45 41 42 72 32 51 63 79 34 39 4e 4b 65 59 75 70 6b 74 77 55 63 72 35 51 41 35 34 78 42 66 57 31 4f 45 77 79 6b 38 Data Ascii: a7d)]}'["rresp","03AFcWeA5QhkdZ9_HWWPDgIJWN0PDFEYyLGCVVOSwZESw32L9tDBMWXV4qa3HpDQ-V1aUyKx8lVBbjk-eShOwhveghb4rP3TEl_92p4T8F3zFJ_Gtz9k_WUPoafxUTgeTc7PuB2YZDi4YuPZYeVOQXpGhDeGfKktrna2CJsaT3-BSeX3TlTiNOValhqS57eRfBFinEABr2Qcy49NKeYupktwUcr5QA54xBfW1OEwyk8
2024-02-08 18:36:19 UTC	1252	IN	Data Raw: 31 47 34 59 78 58 65 33 7a 57 58 5f 54 4e 6b 6c 4b 56 5f 75 77 4f 31 6f 6d 74 47 6c 48 33 6b 7a 54 69 4e 66 30 68 4b 72 66 70 34 75 70 39 32 33 57 6c 37 4f 64 55 36 32 39 53 67 64 6f 41 5a 61 42 4f 6b 39 46 6e 41 4c 77 54 52 6f 43 64 31 76 59 48 4f 33 4f 78 66 67 44 42 46 47 38 78 78 79 2d 7a 33 5a 57 63 70 5f 31 44 44 6f 39 39 5a 56 72 63 31 4f 48 73 22 2c 6e 75 6c 6c 2c 31 32 30 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 22 62 67 64 61 74 61 22 2c 22 4c 79 39 33 64 33 63 75 5a 32 39 76 5a 32 78 6c 4c 6d 4e 76 62 53 39 71 63 79 39 69 5a 79 39 4c 61 31 64 47 5a 56 4e 56 55 6d 56 72 57 45 64 35 59 32 52 77 63 6c 5a 44 4c 56 56 5a 4e 6b 56 45 4c 56 70 47 4e 57 78 73 4d 6b 70 44 54 57 6c 49 61 45 70 46 4d 6c 4a 72 4c 6d 70 7a 22 2c 22 22 2c 22 62 30 Data Ascii: 1G4YxXe3zWX_TNklKV_uwO1omtGlH3kzTiNf0hKrfp4up923Wl7OdU629SgdoAZaBOk9FnALwTRoCd1vYHO3OxfgDBFG8xxy-z3ZWcp_1DDo99ZVrc1OHs",null,120,null,null,null,["bgdata","Ly93d3cuZ29vZ2xlLmNvbS9qcy9iZy9La1dGZVNVUmVrWEd5Y2RwclZDLVVZNkVELVpGNWxsMkpDTWlIaEpFMlJrLmpz","","b0
2024-02-08 18:36:19 UTC	884	IN	Data Raw: 72 5a 31 4e 74 53 79 39 76 59 55 52 33 53 30 31 45 53 47 51 33 55 58 70 58 4e 6e 56 58 57 6c 6f 33 5a 48 52 75 62 32 31 61 62 47 70 59 59 79 74 69 53 7a 68 47 62 58 4e 6f 51 32 64 79 53 45 52 49 52 6b 5a 51 61 32 5a 74 53 43 39 47 61 7a 5a 33 5a 6b 39 6f 55 47 4e 5a 63 7a 52 72 63 30 56 54 51 57 59 72 4e 47 5a 71 54 45 30 32 4b 31 46 76 53 33 6b 76 63 55 5a 7a 59 33 4e 68 63 6d 46 35 64 48 42 43 4e 48 68 68 64 6d 78 45 59 56 56 50 5a 47 70 4a 61 57 46 59 52 6d 78 48 59 53 39 75 5a 47 4e 44 63 47 74 6e 5a 69 74 4a 56 6d 31 61 55 53 39 68 63 32 78 32 55 6c 5a 78 4d 30 4d 33 59 7a 42 31 4e 32 77 33 4d 58 56 4f 65 58 42 55 59 55 6c 58 4d 31 46 6f 53 32 70 56 62 6b 4a 46 4d 30 74 74 55 46 67 30 63 46 4e 44 4c 33 46 79 55 43 39 78 54 6d 52 70 61 45 64 36 56 6d Data Ascii: rZ1NtSy9vYUR3S01ESGQ3UXpXNnVXWlo3ZHRub21abGpYYytiSzhGbXNoQ2dySERIRkZQa2ZtSC9GazZ3Zk9oUGNZczRrc0VTQWYrNGZqTE02K1FvS3kvcUZzY3NhcmF5dHBCNHhhdmxEYVVPZGpJaWFYRmxHYS9uZGNDcGtnZitJVm1aUS9hc2x2UlZxM0M3YzB1N2w3MXVOeXBUYUlXM1FoS2pVbkJFM0ttUFg0cFNDL3FyUC9xTmRpaEd6Vm
2024-02-08 18:36:19 UTC	1252	IN	Data Raw: 31 36 36 63 0d 0a 6e 5a 48 64 6d 63 34 5a 30 6c 7a 55 48 5a 36 65 57 68 76 54 55 52 49 4d 44 4e 59 5a 56 6c 72 4b 7a 56 50 4f 45 59 78 54 32 51 34 51 30 70 70 62 33 70 61 4b 30 64 5a 63 6e 41 34 4d 31 46 32 54 30 39 61 53 6a 6c 6c 63 55 67 32 4f 56 41 77 61 32 68 6b 61 55 38 7a 65 55 6f 76 4c 32 38 30 61 6c 59 35 5a 56 4e 78 54 43 74 61 63 32 39 70 65 44 41 72 57 6d 31 48 57 54 45 72 5a 55 56 4f 4d 33 56 30 65 45 5a 46 61 69 39 43 59 57 68 6b 59 55 73 77 4d 7a 68 34 52 57 4a 6f 53 6d 56 34 51 6d 39 46 54 44 59 34 4d 6b 73 35 62 55 52 45 4d 6c 5a 72 65 6a 6c 73 54 31 4a 54 56 32 6c 32 54 44 4e 4d 62 58 6b 32 4b 31 6b 32 65 57 39 55 53 48 6f 30 57 6b 31 77 53 44 68 47 5a 7a 52 6a 54 58 5a 71 57 48 63 79 61 6e 6c 4b 54 33 70 57 55 58 59 76 63 31 4e 4d 65 57 Data Ascii: 166cnZHdmc4Z0lzUHZ6eWhvTURIMDNYZVlrKzVPOEYxT2Q4Q0ppb3paK0dZcnA4M1F2T09aSjllcUg2OVAwa2hkaU8zeUovL280alY5ZVNxTCtac29peDArWm1HWTErZUVOM3V0eEZFai9CYWhkYUswMzh4RWJoSmV4Qm9FTDY4Mks5bUREMlZrejlsT1JTV2l2TDNMbXk2K1k2eW9USHo0Wk1wSDhGZzRjTXZqWHcyanlKT3pWUXYvc1NMeW
2024-02-08 18:36:19 UTC	1252	IN	Data Raw: 7a 4e 6c 6c 4f 4f 48 68 49 65 6c 4a 43 57 57 4a 57 54 57 74 56 4c 30 70 42 5a 48 4a 5a 55 53 74 74 57 47 74 34 4d 6d 56 49 62 48 56 70 59 32 6f 7a 54 30 70 70 54 6b 39 52 4e 6d 74 50 51 6b 46 7a 51 55 63 31 52 6c 49 34 5a 57 55 32 55 55 4e 50 56 48 6c 45 5a 6c 4a 32 61 55 64 30 63 33 55 77 54 46 4e 68 55 32 6b 7a 62 57 5a 4d 63 31 4e 7a 56 32 38 72 65 6b 56 77 4f 55 73 77 5a 46 56 4a 51 32 64 30 63 56 70 77 52 33 70 51 54 48 64 6b 52 48 46 55 53 30 30 34 52 6b 39 57 4d 33 42 53 4e 44 4e 4c 4c 30 64 78 54 7a 45 31 52 44 6c 7a 57 58 4a 70 4d 69 74 6b 51 55 6b 31 5a 48 42 52 51 6d 52 4f 64 48 56 49 62 32 31 54 55 58 59 33 64 56 42 42 51 56 46 6a 53 46 56 48 61 48 51 72 64 31 56 4c 56 47 70 6b 61 6c 46 56 64 6b 5a 5a 55 32 4a 4e 4e 47 74 43 61 32 74 77 63 31 Data Ascii: zNllOOHhIelJCWWJWTWtVL0pBZHJZUSttWGt4MmVIbHVpY2ozT0ppTk9RNmtPQkFzQUc1RlI4ZWU2UUNPVHlEZlJ2aUd0c3UwTFNhU2kzbWZMc1NzV28rekVwOUswZFVJQ2d0cVpwR3pQTHdkRHFUS004Rk9WM3BSNDNLL0dxTzE1RDlzWXJpMitkQUk1ZHBRQmROdHVIb21TUXY3dVBBQVFjSFVHaHQrd1VLVGpkalFVdkZZU2JNNGtCa2twc1
2024-02-08 18:36:19 UTC	1252	IN	Data Raw: 6b 53 6d 52 50 53 30 70 7a 56 32 51 31 4d 31 42 72 5a 45 46 44 52 33 4a 77 56 6c 56 30 63 31 42 56 64 32 46 6e 5a 30 70 73 53 58 45 35 61 6d 70 6c 61 6c 56 34 64 57 56 42 53 43 74 6f 56 7a 46 71 62 57 46 61 52 33 70 51 63 7a 63 34 54 32 52 58 65 58 4a 73 51 6d 39 6b 4b 30 56 70 65 47 4a 5a 5a 32 6b 32 54 30 78 4f 4e 30 78 68 56 48 42 7a 51 6c 52 35 52 30 31 74 52 48 52 72 4b 7a 51 77 4d 32 67 72 53 6d 45 30 51 30 39 68 53 46 70 50 5a 54 64 56 56 45 4a 6a 56 55 31 74 53 32 64 4e 4f 47 64 51 61 6e 51 33 62 44 68 74 61 33 6c 42 54 46 46 35 64 57 35 4f 54 7a 5a 56 59 69 74 4b 52 33 56 6e 62 6d 4d 79 53 47 70 45 62 55 35 49 54 32 55 35 4e 32 5a 79 55 56 70 59 4e 6c 6c 6d 57 54 64 4f 56 32 31 5a 63 6d 68 4b 53 58 70 33 54 45 39 75 52 58 5a 44 65 6a 42 56 51 57 Data Ascii: kSmRPS0pzV2Q1M1BrZEFDR3JwVlV0c1BVd2FnZ0psSXE5amplalV4dWVBSCtoVzFqbWFaR3pQczc4T2RXeXJsQm9kK0VpeGJZZ2k2T0xON0xhVHBzQlR5R01tRHRrKzQwM2grSmE0Q09hSFpPZTdVVEJjVU1tS2dNOGdQanQ3bDhta3lBTFF5dW5OTzZVYitKR3VnbmMySGpEbU5IT2U5N2ZyUVpYNllmWTdOV21ZcmhKSXp3TE9uRXZDejBVQW
2024-02-08 18:36:19 UTC	1252	IN	Data Raw: 36 63 30 35 4c 51 56 6c 70 4d 58 5a 6b 55 56 63 78 56 54 5a 74 53 46 68 77 56 6e 70 43 5a 58 52 30 56 6d 46 6c 5a 53 39 44 52 31 63 32 55 45 56 49 59 31 5a 55 63 47 39 72 4e 6b 64 68 4c 32 78 69 62 58 59 78 51 31 70 30 57 6b 70 79 61 57 68 59 55 48 4e 4d 4d 56 4e 35 55 48 52 4a 56 30 49 78 59 55 52 49 5a 6a 52 46 65 47 6c 74 4c 32 55 76 56 6c 64 4d 4f 46 64 6e 54 33 6c 42 65 54 55 35 5a 44 4a 74 59 53 39 54 57 6c 45 31 56 33 56 4e 51 57 46 4e 65 6d 52 78 54 6b 5a 33 63 57 70 75 61 55 35 34 51 31 70 70 4d 53 74 52 62 58 41 7a 64 6c 5a 42 61 7a 5a 79 63 57 56 71 63 57 78 7a 59 56 70 4d 5a 6d 6f 33 4f 55 34 78 4e 30 4a 7a 61 44 5a 75 4d 45 64 55 4d 54 55 30 59 57 70 36 4d 54 6c 71 52 45 46 77 5a 58 68 4d 62 47 35 46 53 6c 64 4b 4e 57 46 49 51 58 42 4a 57 6a Data Ascii: 6c05LQVlpMXZkUVcxVTZtSFhwVnpCZXR0VmFlZS9DR1c2UEVIY1ZUcG9rNkdhL2xibXYxQ1p0WkpyaWhYUHNMMVN5UHRJV0IxYURIZjRFeGltL2UvVldMOFdnT3lBeTU5ZDJtYS9TWlE1V3VNQWFNemRxTkZ3cWpuaU54Q1ppMStRbXAzdlZBazZycWVqcWxzYVpMZmo3OU4xN0JzaDZuMEdUMTU0YWp6MTlqREFwZXhMbG5FSldKNWFIQXBJWj
2024-02-08 18:36:19 UTC	740	IN	Data Raw: 78 4c 7a 5a 61 64 30 6c 36 65 6d 4a 70 52 56 70 44 64 58 56 69 63 31 52 36 53 33 63 31 56 44 51 34 53 30 6f 33 64 54 5a 54 64 32 78 34 51 6e 56 4d 56 56 56 33 54 32 70 4b 63 45 31 56 4d 54 49 33 5a 30 39 36 62 31 70 7a 65 55 5a 45 52 55 70 44 62 57 4e 73 57 6a 41 7a 62 48 5a 45 55 6a 4e 70 61 58 63 30 4d 45 39 32 56 30 6b 35 52 30 5a 6b 4e 47 46 71 5a 47 35 56 65 6d 70 68 64 58 41 33 64 6e 64 47 61 32 64 32 64 7a 42 50 5a 6d 6f 32 61 6b 35 44 63 33 46 30 55 6b 4a 69 63 47 35 6d 4d 6e 42 59 51 30 4a 42 57 6a 51 34 52 45 46 75 4d 31 4e 52 53 46 52 72 62 6d 4a 78 65 57 46 45 4d 33 41 30 4d 6c 42 6f 4e 47 6f 32 56 31 70 55 59 56 42 61 4d 30 49 30 53 56 4e 69 4d 54 68 75 4e 32 5a 4c 62 33 68 75 55 6d 70 51 56 6a 68 75 55 54 68 79 52 32 52 35 61 6c 64 58 4e 6a Data Ascii: xLzZad0l6emJpRVpDdXVic1R6S3c1VDQ4S0o3dTZTd2x4QnVMVVV3T2pKcE1VMTI3Z096b1pzeUZERUpDbWNsWjAzbHZEUjNpaXc0ME92V0k5R0ZkNGFqZG5VemphdXA3dndGa2d2dzBPZmo2ak5Dc3F0UkJicG5mMnBYQ0JBWjQ4REFuM1NRSFRrbmJxeWFEM3A0MlBoNGo2V1pUYVBaM0I0SVNiMThuN2ZLb3huUmpQVjhuUThyR2R5aldXNj
2024-02-08 18:36:19 UTC	1252	IN	Data Raw: 31 32 66 39 0d 0a 30 70 56 55 48 5a 6d 57 47 45 32 53 32 46 77 4e 54 4e 68 63 57 35 6d 62 58 70 78 4f 56 64 56 4f 55 31 30 52 54 4a 45 52 46 55 72 62 58 4e 53 4b 30 70 58 56 32 73 76 55 6d 31 59 52 54 64 48 54 31 52 44 54 6e 42 76 62 58 6c 77 51 57 5a 58 56 54 52 30 57 56 42 59 52 46 64 78 64 6d 73 34 4d 55 78 59 64 56 6f 78 5a 6a 4d 79 61 45 35 75 62 54 46 5a 63 7a 4a 55 51 6b 5a 49 62 46 64 4e 64 32 46 55 62 31 56 43 61 30 68 79 64 45 56 36 54 6b 39 70 51 6d 4a 59 4e 6d 39 51 4d 33 4d 76 52 30 78 4e 4c 32 52 77 54 55 5a 73 55 57 74 7a 52 32 31 78 64 57 70 52 63 47 5a 31 56 6e 5a 6d 54 56 4d 34 54 30 74 61 53 44 4a 32 55 6b 70 33 64 55 68 50 4d 31 5a 69 52 30 4e 56 51 56 70 53 61 48 4a 55 59 55 5a 72 57 54 55 77 55 46 4a 54 5a 6d 46 76 53 43 74 30 54 45 Data Ascii: 12f90pVUHZmWGE2S2FwNTNhcW5mbXpxOVdVOU10RTJERFUrbXNSK0pXV2svUm1YRTdHT1RDTnBvbXlwQWZXVTR0WVBYRFdxdms4MUxYdVoxZjMyaE5ubTFZczJUQkZIbFdNd2FUb1VCa0hydEV6Tk9pQmJYNm9QM3MvR0xNL2RwTUZsUWtzR21xdWpRcGZ1VnZmTVM4T0taSDJ2Ukp3dUhPM1ZiR0NVQVpSaHJUYUZrWTUwUFJTZmFvSCt0TE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
668	192.168.2.5	50515	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:19 UTC	3099	OUT	GET /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAmb6ChG0GAAAA:1YfdqTGcz5Nv+ySyR4l0dcP3pMoTORFatiNiGWJ7MN9YNAXjrj+JwLDSBSegMncHAdyNNPOjNsaeDm9pbnbRLlIYy/Wsa0l3RRdVGZNwHvCL7MSxVUeOoLQbnA4ws/oCccvImOwo8CVethnhcZ8jRyLom9EtR+hCle5g3/E4tScqZS87YMPrAUoKpLzL6QZghMKuNcinEXGdtGGXi/+Tn/jd1osZzUxtKgagCgVNA7aglFhxkvVLvhbzVj9tZG3VnoD+k6IF; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; lastSeen=1707417375276; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16
2024-02-08 18:36:19 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:19 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=24bd82d1f5ab01b4&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGXfhwk6QZBhZCzTd1pi3dYtUcAd5DTWH7g x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 9546eb427ef2137803aed00cad4fc426.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: frLnZZT2j-E34BuT_Nr7smDCa_yUf5kw-YUpP4-YsXcvCIq8zxFIlw==
2024-02-08 18:36:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
669	192.168.2.5	50517	3.161.193.117	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:19 UTC	2166	OUT	GET /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=0
2024-02-08 18:36:19 UTC	513	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html;charset=iso-8859-1 Content-Length: 411 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:19 GMT cache-control: must-revalidate,no-cache,no-store strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 052215bfd8d35ecb703b208e875bd350.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P8 X-Amz-Cf-Id: Y45fz2CvDE8kqbByhWGWgxntA2hMISfXaP69et2PqfM-3fqS584GRg==
2024-02-08 18:36:19 UTC	411	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 2f 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 32 3e 48 54 54 50 20 45 52 52 4f 52 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 32 3e 0a 3c 74 61 62 6c 65 3e 0a 3c 74 72 3e 3c 74 68 3e 55 52 49 3a 3c 2f 74 68 3e 3c 74 64 3e 2f 77 65 62 2d 76 69 74 61 6c 73 2f 73 65 6e 64 2d 76 69 74 61 6c 73 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/><title>Error 405 Method Not Allowed</title></head><body><h2>HTTP ERROR 405 Method Not Allowed</h2><table><tr><th>URI:</th><td>/web-vitals/send-vitals</td></tr><tr>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
670	192.168.2.5	50519	3.161.150.72	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:19 UTC	2437	OUT	GET /_/fvtrpw.gif HTTP/1.1 Host: account.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; bkng_ap_lang=en-us; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJzZXNzaW9ucyI6W10sImRhdGFfc3ViamVjdF9pZCI6ImU1MmRjZDUxLTY5OWItNDVlOC04MDcwLTdjYzkxYTU3MzU2YiJ9fQ; bkng_ap=U2FsdGVkX19jt27u%2BWY9%2F8h%2BujLeHMQ01J16gfRmQgoWlCDSxx9IhoyWk%2BdAKMHCJDT%2FF8yW52%2FK%0AbitOSWAITA%3D%3D%0A; lastSeen=0
2024-02-08 18:36:20 UTC	3138	IN	HTTP/1.1 200 OK Content-Type: image/gif Transfer-Encoding: chunked Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:19 GMT content-disposition: attachment; filename=etnht.gif content-security-policy: base-uri 'none'; frame-ancestors https://.booking.com https://.booking.cn; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=block&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgRvqAg3-UlCb1qLTaSWs19Ycz7HZqMCUcreR7_4P6rZqLjuQnm5OQe0; script-src 'report-sample' 'nonce-t4lBR4C84FTostF' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com content-security-policy-report-only: connect-src 'self' .perimeterx.net .px-cdn.net .px-client.net .px-cloud.net .pxchk.net .token.awswaf.com cdn.cookielaw.org geolocation.onetrust.com privacyportal-eu.onetrust.com saa.booking.com secure.booking.com www.google-analytics.com; default-src 'self' .bstatic.com bstatic.com; frame-src .booking.com .bstatic.com bstatic.com paymentcomponent.booking.com secure.booking.com www.booking.com; img-src 'self' data: .bstatic.com .perimeterx.net .px-cloud.net .static.booking.cn account.booking.com bstatic.com cdn.cookielaw.org graph.facebook.com stats.g.doubleclick.net www.booking.com www.google-analytics.com www.google.com www.gstatic.com; report-uri https://nellie.booking.com/csp-report-uri?type=report&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgRvqAg3-UlCb1qLTaSWs19Ycz7HZqMCUcreR7_4P6rZqLjuQnm5OQe0; script-src 'report-sample' 'nonce-t4lBR4C84FTostF' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com; style-src 'self' 'unsafe-inline' .bstatic.com *.static.booking.cn bstatic.com set-cookie: bkng_sso_session=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:19 GMT; secure; HttpOnly set-cookie: bkng_sso_ses=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:19 GMT; secure; HttpOnly set-cookie: bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJlNTJkY2Q1MS02OTliLTQ1ZTgtODA3MC03Y2M5MWE1NzM1NmIiLCJzZXNzaW9ucyI6W119fQ; domain=account.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:19 GMT; SameSite=Lax; secure; HttpOnly set-cookie: bkng_ap=U2FsdGVkX19%2FWj7MIxTQoew6fVzm%2FavdeeT6w7Tou9chqgq42LIpRPd4nN%2B0lIRr6YV3VFQvOPJJ%0A%2FMglth7v%2BQ%3D%3D%0A; domain=account.booking.com; path=/; secure; HttpOnly x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 cf815e48514b90d59fa790be38ee8ffc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P5 X-Amz-Cf-Id: EFxG2xiLuuP5KluB23YJF67HY0EdLyjgFUQqzqVSCjkMtvioAx5xBg==
2024-02-08 18:36:20 UTC	41	IN	Data Raw: 32 33 0d 0a 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b 0d 0a Data Ascii: 23GIF89a,;
2024-02-08 18:36:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
671	192.168.2.5	50518	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:19 UTC	3395	OUT	GET /js_tracking?sid=5171fc655664ddf74ab763a094523fb7&aid=304142&ref_action=index&ver=2&pid=87e482caf42702d0&lang=en-us&stype=1&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|6\|1&m=UmFuZG9tSVYkc2RlIyh9YUe5zZbLHt0YNre0CiGBBmP5hKTY_IzZqpWBtitYrnE-ba2NOPqZSPGdnbkQM2vO343hpsChBnayfrRG7jVW0hI1Ke4kKZ85U_m7O1xbR8NLSlv2Zn-4d5ku6anu7qAZgjoLQxWZjIis3cNA3ef3I_aOxDvMotUV5ZQc6OhcEEody8ooGsshLIhRMDad6kRNg_HeFvW36Wr8mOnNh6fMuy8OZ9w095BIb2XL0zt8fY-5SPQHxgI7NWrdI31vzPG5nOwkA1lE2mJxFh3z4YXPwcZPq5z6drlkg3iN9tdtKjt0cXf7rJdLIbIGLmOniyEf0g HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAmb6ChG0GAAAA:1YfdqTGcz5Nv+ySyR4l0dcP3pMoTORFatiNiGWJ7MN9YNAXjrj+JwLDSBSegMncHAdyNNPOjNsaeDm9pbnbRLlIYy/Wsa0l3RRdVGZNwHvCL7MSxVUeOoLQbnA4ws/oCccvImOwo8CVethnhcZ8jRyLom9EtR+hCle5g3/E4tScqZS87YMPrAUoKpLzL6QZghMKuNcinEXGdtGGXi/+Tn/jd1osZzUxtKgagCgVNA7aglFhxkvVLvhbzVj9tZG3VnoD+k6IF; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=0
2024-02-08 18:36:20 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:20 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=9d2382d1d26b010c&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejKr2jYoUgso6Z7SM-TeGTUbXjtSdC_IDu4 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7eeed291abf48890d3f36565208941a8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 3IuYfbO14C0R21vIqIRuke9qbdjYI0w6QSDdATOPxn3deGN0YaVw-g==
2024-02-08 18:36:20 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
672	192.168.2.5	50520	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:19 UTC	717	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 1140 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:19 UTC	1140	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 36 39 37 39 39 62 31 2d 62 32 62 32 2d 34 30 66 38 2d 38 65 36 66 2d 32 38 30 39 62 39 63 36 66 31 61 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 65 65 39 34 65 39 31 35 2d 37 61 33 32 2d 34 36 34 64 2d 39 35 65 32 2d 34 61 34 31 64 35 38 39 39 63 33 34 22 2c 22 73 73 22 3a 22 30 32 34 37 38 38 37 34 2d 61 32 37 37 2d 34 36 35 63 2d 62 39 65 37 2d 63 65 32 34 31 32 32 33 32 65 34 66 22 2c 22 73 68 22 3a 31 30 32 34 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"f69799b1-b2b2-40f8-8e6f-2809b9c6f1a0","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"ee94e915-7a32-464d-95e2-4a41d5899c34","ss":"02478874-a277-465c-b9e7-ce2412232e4f","sh":1024,"s
2024-02-08 18:36:20 UTC	523	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:19 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
673	192.168.2.5	50521	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:19 UTC	717	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 1224 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:19 UTC	1224	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 36 39 37 39 39 62 31 2d 62 32 62 32 2d 34 30 66 38 2d 38 65 36 66 2d 32 38 30 39 62 39 63 36 66 31 61 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 33 65 36 37 34 62 61 39 2d 32 66 63 63 2d 34 37 66 66 2d 62 37 37 63 2d 37 39 66 33 33 63 64 37 31 31 35 35 22 2c 22 73 73 22 3a 22 30 32 34 37 38 38 37 34 2d 61 32 37 37 2d 34 36 35 63 2d 62 39 65 37 2d 63 65 32 34 31 32 32 33 32 65 34 66 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"f69799b1-b2b2-40f8-8e6f-2809b9c6f1a0","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"3e674ba9-2fcc-47ff-b77c-79f33cd71155","ss":"02478874-a277-465c-b9e7-ce2412232e4f","bg":true,"s
2024-02-08 18:36:20 UTC	482	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:20 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: clear access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
674	192.168.2.5	50522	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:20 UTC	3099	OUT	GET /dml/graphql?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d&lang=en-us HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAmb6ChG0GAAAA:1YfdqTGcz5Nv+ySyR4l0dcP3pMoTORFatiNiGWJ7MN9YNAXjrj+JwLDSBSegMncHAdyNNPOjNsaeDm9pbnbRLlIYy/Wsa0l3RRdVGZNwHvCL7MSxVUeOoLQbnA4ws/oCccvImOwo8CVethnhcZ8jRyLom9EtR+hCle5g3/E4tScqZS87YMPrAUoKpLzL6QZghMKuNcinEXGdtGGXi/+Tn/jd1osZzUxtKgagCgVNA7aglFhxkvVLvhbzVj9tZG3VnoD+k6IF; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; lastSeen=1707417375276; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16
2024-02-08 18:36:20 UTC	671	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:20 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=27c082d274680257&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGZq7Y_KRgjEB-B5wJ-eKa52R56ac3Vy_6g x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 c625b1bdde545acdeb26c9f6ad3a8c6e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: qy-4gBDYJ8wFwtiZe3_U8y4GR3viASRkqXY98-m03UKc3So2nhPe9g==
2024-02-08 18:36:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
675	192.168.2.5	50523	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:20 UTC	717	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 1227 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:20 UTC	1227	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 36 39 37 39 39 62 31 2d 62 32 62 32 2d 34 30 66 38 2d 38 65 36 66 2d 32 38 30 39 62 39 63 36 66 31 61 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 36 63 30 66 32 35 37 31 2d 38 39 30 36 2d 34 61 64 34 2d 62 34 36 31 2d 38 32 39 62 34 33 30 37 64 35 31 34 22 2c 22 73 73 22 3a 22 30 32 34 37 38 38 37 34 2d 61 32 37 37 2d 34 36 35 63 2d 62 39 65 37 2d 63 65 32 34 31 32 32 33 32 65 34 66 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"f69799b1-b2b2-40f8-8e6f-2809b9c6f1a0","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"6c0f2571-8906-4ad4-b461-829b4307d514","ss":"02478874-a277-465c-b9e7-ce2412232e4f","bg":true,"s
2024-02-08 18:36:20 UTC	523	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:20 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 2 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
676	192.168.2.5	50524	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:20 UTC	717	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 1150 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:20 UTC	1150	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 36 39 37 39 39 62 31 2d 62 32 62 32 2d 34 30 66 38 2d 38 65 36 66 2d 32 38 30 39 62 39 63 36 66 31 61 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 64 36 36 61 35 36 39 39 2d 30 39 38 62 2d 34 66 33 38 2d 39 37 33 38 2d 65 35 39 64 38 34 37 31 62 64 64 64 22 2c 22 73 73 22 3a 22 30 32 34 37 38 38 37 34 2d 61 32 37 37 2d 34 36 35 63 2d 62 39 65 37 2d 63 65 32 34 31 32 32 33 32 65 34 66 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"f69799b1-b2b2-40f8-8e6f-2809b9c6f1a0","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"d66a5699-098b-4f38-9738-e59d8471bddd","ss":"02478874-a277-465c-b9e7-ce2412232e4f","bg":true,"s
2024-02-08 18:36:21 UTC	523	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:20 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 1 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
677	192.168.2.5	50526	13.32.208.75	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:21 UTC	3969	OUT	POST /js-metric?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA HTTP/1.1 Host: account.booking.com Connection: keep-alive Content-Length: 48 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://account.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/sign-in?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; bkng_ap_lang=en-us; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417379065; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJlNTJkY2Q1MS02OTliLTQ1ZTgtODA3MC03Y2M5MWE1NzM1NmIiLCJzZXNzaW9ucyI6W119fQ; bkng_ap=U2FsdGVkX19%2FWj7MIxTQoew6fVzm%2FavdeeT6w7Tou9chqgq42LIpRPd4nN%2B0lIRr6YV3VFQvOPJJ%0A%2FMglth7v%2BQ%3D%3D%0A
2024-02-08 18:36:21 UTC	48	OUT	Data Raw: 7b 22 70 61 74 68 22 3a 22 61 75 74 68 5f 66 75 6e 6e 65 6c 2f 70 61 67 65 5f 72 65 61 64 79 2f 73 69 67 6e 69 6e 2f 64 65 73 6b 74 6f 70 22 7d Data Ascii: {"path":"auth_funnel/page_ready/signin/desktop"}
2024-02-08 18:36:21 UTC	2987	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:21 GMT content-security-policy: base-uri 'none'; frame-ancestors https://.booking.com https://.booking.cn; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=block&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMlertjpTp0dBkoiU97ub-lntLbh6x__iwZQ692sYmt80Zfw_G3ys1ALNunl6s4OHeoflyDLewG2g; script-src 'report-sample' 'nonce-VqlvLWVwMtz6ZdF' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com content-security-policy-report-only: connect-src 'self' .perimeterx.net .px-cdn.net .px-client.net .px-cloud.net .pxchk.net .token.awswaf.com cdn.cookielaw.org geolocation.onetrust.com privacyportal-eu.onetrust.com saa.booking.com secure.booking.com www.google-analytics.com; default-src 'self' .bstatic.com bstatic.com; frame-src .booking.com .bstatic.com bstatic.com paymentcomponent.booking.com secure.booking.com www.booking.com; img-src 'self' data: .bstatic.com .perimeterx.net .px-cloud.net .static.booking.cn account.booking.com bstatic.com cdn.cookielaw.org graph.facebook.com stats.g.doubleclick.net www.booking.com www.google-analytics.com www.google.com www.gstatic.com; report-uri https://nellie.booking.com/csp-report-uri?type=report&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMlertjpTp0dBkoiU97ub-lntLbh6x__iwZQ692sYmt80Zfw_G3ys1ALNunl6s4OHeoflyDLewG2g; script-src 'report-sample' 'nonce-VqlvLWVwMtz6ZdF' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com; style-src 'self' 'unsafe-inline' .bstatic.com *.static.booking.cn bstatic.com set-cookie: bkng_sso_session=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:21 GMT; secure; HttpOnly set-cookie: bkng_sso_ses=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:21 GMT; secure; HttpOnly set-cookie: bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJzZXNzaW9ucyI6W10sImRhdGFfc3ViamVjdF9pZCI6ImU1MmRjZDUxLTY5OWItNDVlOC04MDcwLTdjYzkxYTU3MzU2YiJ9fQ; domain=account.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:21 GMT; SameSite=Lax; secure; HttpOnly x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 90a702a7e21c444d32e69f4d93b07bb4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD66-C1 X-Amz-Cf-Id: qL-lTtngn3y723HuXtII3uxSZSYSGbASVxiI3Kj3KXadPJ-65dFYcw==
2024-02-08 18:36:21 UTC	17	IN	Data Raw: 63 0d 0a 7b 22 72 65 73 75 6c 74 22 3a 31 7d 0d 0a Data Ascii: c{"result":1}
2024-02-08 18:36:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
678	192.168.2.5	50530	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:21 UTC	3239	OUT	GET /cookiebanner.html HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417379065; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAq26Cx5gAAAAA:V+g2qTqrUC74BBHFBTwZ33MbMX8+qooVflYy6+KvSKEYTPcC09IIPjbpGQ04UmvTenwSevKP2MYiGbqqZyq0xtydlIl+by89oTwGAML/ukAGMV4aAjQJ3W094Y5/fKWJu2CaQ+ldV/UX4g3kf4egnDNDYSb3YBvWtGea2tDO400hCiNe5KhFR0UgDqZGamseObEGSHgGqN3KUpMXDAHZibwJIv3AwjgQof3IUvkXNCC9Xu7OUkqkuqQ1b58uXIa4peynNNJL
2024-02-08 18:36:21 UTC	1292	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Content-Length: 2407 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:21 GMT vary: User-Agent, Accept-Encoding nel: {"report_to":"default","max_age":604800} report-to: {"group":"default","endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":604800} set-cookie: _implmdnbl=2__1__0; path=/; expires=Sat, 09-Feb-2019 18:36:21 GMT; HttpOnly set-cookie: px_init=0; domain=booking.com; expires=Tue, 17-May-2078 13:12:42 GMT; SameSite=Strict; secure; HttpOnly set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXbnXawFhv%2Bov5qX2t%2BkjDX%2FSNhQS8UMKXEgF7SbTMk5lZRjRk40eE9ZIStvqAVmgL%2Fkvzh5mdRnhcUtlo5tJUKE0vMfULCoEeprAELqi%2FDgNs1lACo93R0nAlWUa3%2BA7gG0DsR2aw5zKj4nbG7Xq7OwI%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:21 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-type-options: nosniff x-recruiting: Like HTTP headers? Come write ours: https://careers.booking.com x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 9546eb427ef2137803aed00cad4fc426.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: eroDkhGChJRMu5bmMr-BPGUT-zrBi3rzz1PLEY57LG9Kst5FV0dZBw==
2024-02-08 18:36:21 UTC	2407	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 4f 54 5f 43 4f 4e 53 45 4e 54 5f 43 4f 4f 4b 49 45 20 3d 20 27 4f 70 74 61 6e 6f 6e 43 6f 6e 73 65 6e 74 27 3b 0a 76 61 72 20 4f 54 5f 41 4c 45 52 54 5f 43 4c 4f 53 45 44 5f 43 4f 4f 4b 49 45 20 3d 20 27 4f 70 74 61 6e 6f 6e 41 6c 65 72 74 42 6f 78 43 6c 6f 73 65 64 27 3b 0a 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6d 65 73 73 61 67 65 22 2c 20 72 65 63 65 69 76 65 4d 65 73 73 61 67 65 2c 20 66 61 6c 73 65 29 3b 0a 66 75 6e 63 74 69 6f 6e 20 72 65 63 65 69 76 65 4d 65 73 73 61 67 65 28 65 76 65 6e 74 29 20 7b 0a 69 66 20 28 65 76 65 6e 74 20 26 26 20 65 76 65 6e 74 Data Ascii: <!DOCTYPE html><html lang="en"><head><script>var OT_CONSENT_COOKIE = 'OptanonConsent';var OT_ALERT_CLOSED_COOKIE = 'OptanonAlertBoxClosed';window.addEventListener("message", receiveMessage, false);function receiveMessage(event) {if (event && event

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
679	192.168.2.5	50532	18.165.98.45	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:21 UTC	573	OUT	GET /d8c14d4960ca/c2181391033f/challenge.js HTTP/1.1 Host: d8c14d4960ca.edge.sdk.awswaf.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:21 UTC	614	IN	HTTP/1.1 307 Temporary Redirect Server: CloudFront Date: Thu, 08 Feb 2024 18:36:21 GMT Content-Length: 0 Connection: close Access-Control-Allow-Headers: * Access-Control-Allow-Methods: * Access-Control-Allow-Origin: * Access-Control-Max-Age: 86400 Cache-Control: max-age=86400 Location: https://d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com/d8c14d4960ca/c2181391033f/challenge.js X-Cache: FunctionGeneratedResponse from cloudfront Via: 1.1 4f3476fc0ed69f4f9209b2ccb91b0050.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD55-P4 X-Amz-Cf-Id: 6NofDha40IRdNaovA-r84B5Kj_pgpQequSlqrBL4kybmvnC1IFVM_A==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
680	192.168.2.5	50528	13.32.208.75	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:21 UTC	3969	OUT	POST /js-metric?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA HTTP/1.1 Host: account.booking.com Connection: keep-alive Content-Length: 75 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://account.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/sign-in?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; bkng_ap_lang=en-us; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417379065; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJlNTJkY2Q1MS02OTliLTQ1ZTgtODA3MC03Y2M5MWE1NzM1NmIiLCJzZXNzaW9ucyI6W119fQ; bkng_ap=U2FsdGVkX19%2FWj7MIxTQoew6fVzm%2FavdeeT6w7Tou9chqgq42LIpRPd4nN%2B0lIRr6YV3VFQvOPJJ%0A%2FMglth7v%2BQ%3D%3D%0A
2024-02-08 18:36:21 UTC	75	OUT	Data Raw: 7b 22 70 61 74 68 22 3a 22 61 75 74 68 5f 66 75 6e 6e 65 6c 5f 6c 6f 67 69 6e 5f 6c 69 6e 6b 2f 64 65 73 6b 74 6f 70 2f 69 6e 64 65 78 2f 74 72 61 76 65 6c 6c 65 72 5f 68 65 61 64 65 72 2f 70 61 67 65 5f 72 65 61 64 79 22 7d Data Ascii: {"path":"auth_funnel_login_link/desktop/index/traveller_header/page_ready"}
2024-02-08 18:36:21 UTC	2987	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:21 GMT content-security-policy: base-uri 'none'; frame-ancestors https://.booking.com https://.booking.cn; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=block&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMlertjpTp0dBkoiU97ub-lntLbh6x__iwZQ692sYmt83IR_Y7Nz6ELemAJcSPdnk-RgmRnSaPz58; script-src 'report-sample' 'nonce-LVTkauviEpePcGV' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com content-security-policy-report-only: connect-src 'self' .perimeterx.net .px-cdn.net .px-client.net .px-cloud.net .pxchk.net .token.awswaf.com cdn.cookielaw.org geolocation.onetrust.com privacyportal-eu.onetrust.com saa.booking.com secure.booking.com www.google-analytics.com; default-src 'self' .bstatic.com bstatic.com; frame-src .booking.com .bstatic.com bstatic.com paymentcomponent.booking.com secure.booking.com www.booking.com; img-src 'self' data: .bstatic.com .perimeterx.net .px-cloud.net .static.booking.cn account.booking.com bstatic.com cdn.cookielaw.org graph.facebook.com stats.g.doubleclick.net www.booking.com www.google-analytics.com www.google.com www.gstatic.com; report-uri https://nellie.booking.com/csp-report-uri?type=report&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMlertjpTp0dBkoiU97ub-lntLbh6x__iwZQ692sYmt83IR_Y7Nz6ELemAJcSPdnk-RgmRnSaPz58; script-src 'report-sample' 'nonce-LVTkauviEpePcGV' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com; style-src 'self' 'unsafe-inline' .bstatic.com *.static.booking.cn bstatic.com set-cookie: bkng_sso_session=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:21 GMT; secure; HttpOnly set-cookie: bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJzZXNzaW9ucyI6W10sImRhdGFfc3ViamVjdF9pZCI6ImU1MmRjZDUxLTY5OWItNDVlOC04MDcwLTdjYzkxYTU3MzU2YiJ9fQ; domain=account.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:21 GMT; SameSite=Lax; secure; HttpOnly set-cookie: bkng_sso_ses=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:21 GMT; secure; HttpOnly x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 fc1cc7c682d30bba517abb52ab524f90.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD66-C1 X-Amz-Cf-Id: _JH_EBhpO4Dp01NYK5mUTmVBRsK6NQVYLmaYK1Fg4k2gmUA_IAUqSw==
2024-02-08 18:36:21 UTC	17	IN	Data Raw: 63 0d 0a 7b 22 72 65 73 75 6c 74 22 3a 31 7d 0d 0a Data Ascii: c{"result":1}
2024-02-08 18:36:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
681	192.168.2.5	50527	13.32.208.75	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:21 UTC	3968	OUT	POST /js-track?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA HTTP/1.1 Host: account.booking.com Connection: keep-alive Content-Length: 60 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://account.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/sign-in?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; bkng_ap_lang=en-us; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417379065; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJlNTJkY2Q1MS02OTliLTQ1ZTgtODA3MC03Y2M5MWE1NzM1NmIiLCJzZXNzaW9ucyI6W119fQ; bkng_ap=U2FsdGVkX19%2FWj7MIxTQoew6fVzm%2FavdeeT6w7Tou9chqgq42LIpRPd4nN%2B0lIRr6YV3VFQvOPJJ%0A%2FMglth7v%2BQ%3D%3D%0A
2024-02-08 18:36:21 UTC	60	OUT	Data Raw: 7b 22 69 64 22 3a 22 64 44 66 50 44 58 62 61 54 61 54 61 42 61 4d 59 54 46 58 53 41 56 63 55 4a 44 4b 65 22 2c 22 74 79 70 65 22 3a 22 65 74 73 22 2c 22 76 61 6c 75 65 22 3a 36 7d Data Ascii: {"id":"dDfPDXbaTaTaBaMYTFXSAVcUJDKe","type":"ets","value":6}
2024-02-08 18:36:21 UTC	2987	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:21 GMT content-security-policy: base-uri 'none'; frame-ancestors https://.booking.com https://.booking.cn; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=block&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMlertjpTp0dBkoiU97ub-lntLbh6x__iwLUXNyXeayYXY5sBf_k88TZwm7ePM3dR3aPWy4ro5Vmo; script-src 'report-sample' 'nonce-uesPVzOwbtQPnls' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com content-security-policy-report-only: connect-src 'self' .perimeterx.net .px-cdn.net .px-client.net .px-cloud.net .pxchk.net .token.awswaf.com cdn.cookielaw.org geolocation.onetrust.com privacyportal-eu.onetrust.com saa.booking.com secure.booking.com www.google-analytics.com; default-src 'self' .bstatic.com bstatic.com; frame-src .booking.com .bstatic.com bstatic.com paymentcomponent.booking.com secure.booking.com www.booking.com; img-src 'self' data: .bstatic.com .perimeterx.net .px-cloud.net .static.booking.cn account.booking.com bstatic.com cdn.cookielaw.org graph.facebook.com stats.g.doubleclick.net www.booking.com www.google-analytics.com www.google.com www.gstatic.com; report-uri https://nellie.booking.com/csp-report-uri?type=report&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMlertjpTp0dBkoiU97ub-lntLbh6x__iwLUXNyXeayYXY5sBf_k88TZwm7ePM3dR3aPWy4ro5Vmo; script-src 'report-sample' 'nonce-uesPVzOwbtQPnls' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com; style-src 'self' 'unsafe-inline' .bstatic.com *.static.booking.cn bstatic.com set-cookie: bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJzZXNzaW9ucyI6W10sImRhdGFfc3ViamVjdF9pZCI6ImU1MmRjZDUxLTY5OWItNDVlOC04MDcwLTdjYzkxYTU3MzU2YiJ9fQ; domain=account.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:21 GMT; SameSite=Lax; secure; HttpOnly set-cookie: bkng_sso_ses=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:21 GMT; secure; HttpOnly set-cookie: bkng_sso_session=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:21 GMT; secure; HttpOnly x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 90a702a7e21c444d32e69f4d93b07bb4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD66-C1 X-Amz-Cf-Id: s8Ny88kAqfLrLUAgYDoG5zkdOvBhWJEW4fSPUQKgIACo8QavN4YLyg==
2024-02-08 18:36:21 UTC	17	IN	Data Raw: 63 0d 0a 7b 22 72 65 73 75 6c 74 22 3a 31 7d 0d 0a Data Ascii: c{"result":1}
2024-02-08 18:36:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
682	192.168.2.5	50525	13.32.208.75	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:21 UTC	3968	OUT	POST /js-track?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA HTTP/1.1 Host: account.booking.com Connection: keep-alive Content-Length: 61 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://account.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/sign-in?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBLEZFslKnMOVE2YaLTWKBdwCx7sxYpqhnTEVtdF5pRlCubX7C6U5UKMMHK0KovNgRh8EOJhcTK5dIxlPuNn2dngoDSCL3oNd5ZFLYzLQXCKpZ%2FHm%2FBjcA%2FLp7mipNOt%2FduLfPKHFe5WMV%2BLdfetgk1cIqWVhD9HhO0%3D; bkng_ap_lang=en-us; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417379065; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJlNTJkY2Q1MS02OTliLTQ1ZTgtODA3MC03Y2M5MWE1NzM1NmIiLCJzZXNzaW9ucyI6W119fQ; bkng_ap=U2FsdGVkX19%2FWj7MIxTQoew6fVzm%2FavdeeT6w7Tou9chqgq42LIpRPd4nN%2B0lIRr6YV3VFQvOPJJ%0A%2FMglth7v%2BQ%3D%3D%0A
2024-02-08 18:36:21 UTC	61	OUT	Data Raw: 7b 22 69 64 22 3a 22 64 44 66 50 44 58 62 61 54 61 54 61 42 61 4d 59 54 46 58 53 41 56 63 55 4a 44 4b 65 22 2c 22 74 79 70 65 22 3a 22 65 74 63 67 22 2c 22 76 61 6c 75 65 22 3a 32 7d Data Ascii: {"id":"dDfPDXbaTaTaBaMYTFXSAVcUJDKe","type":"etcg","value":2}
2024-02-08 18:36:21 UTC	2987	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:21 GMT content-security-policy: base-uri 'none'; frame-ancestors https://.booking.com https://.booking.cn; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=block&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMlertjpTp0dBkoiU97ub-lntLbh6x__iwLUXNyXeayYWodjQVVPmGegpwcDcGpGApldYDx3mAXoQ; script-src 'report-sample' 'nonce-ov81Z6QMU95Oxg6' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com content-security-policy-report-only: connect-src 'self' .perimeterx.net .px-cdn.net .px-client.net .px-cloud.net .pxchk.net .token.awswaf.com cdn.cookielaw.org geolocation.onetrust.com privacyportal-eu.onetrust.com saa.booking.com secure.booking.com www.google-analytics.com; default-src 'self' .bstatic.com bstatic.com; frame-src .booking.com .bstatic.com bstatic.com paymentcomponent.booking.com secure.booking.com www.booking.com; img-src 'self' data: .bstatic.com .perimeterx.net .px-cloud.net .static.booking.cn account.booking.com bstatic.com cdn.cookielaw.org graph.facebook.com stats.g.doubleclick.net www.booking.com www.google-analytics.com www.google.com www.gstatic.com; report-uri https://nellie.booking.com/csp-report-uri?type=report&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMlertjpTp0dBkoiU97ub-lntLbh6x__iwLUXNyXeayYWodjQVVPmGegpwcDcGpGApldYDx3mAXoQ; script-src 'report-sample' 'nonce-ov81Z6QMU95Oxg6' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com; style-src 'self' 'unsafe-inline' .bstatic.com *.static.booking.cn bstatic.com set-cookie: bkng_sso_session=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:21 GMT; secure; HttpOnly set-cookie: bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJlNTJkY2Q1MS02OTliLTQ1ZTgtODA3MC03Y2M5MWE1NzM1NmIiLCJzZXNzaW9ucyI6W119fQ; domain=account.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:21 GMT; SameSite=Lax; secure; HttpOnly set-cookie: bkng_sso_ses=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:21 GMT; secure; HttpOnly x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 93db32d5347403a3ab35b40dbb40e860.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD66-C1 X-Amz-Cf-Id: Uu5ET8Zt2Zbudxb5gvJ4wdOPtMyhJ2v8Qr7TrcJyLYr9i2AvMu9RmA==
2024-02-08 18:36:21 UTC	17	IN	Data Raw: 63 0d 0a 7b 22 72 65 73 75 6c 74 22 3a 31 7d 0d 0a Data Ascii: c{"result":1}
2024-02-08 18:36:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
683	192.168.2.5	50529	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:21 UTC	628	OUT	GET /backend_static/common/flags/new/48-squared/us.png HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:21 UTC	769	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 642 Connection: close Server: nginx Date: Sat, 13 Jan 2024 16:39:54 GMT Last-Modified: Mon, 07 Sep 2020 09:08:23 GMT ETag: "5f55f887-282" Expires: Mon, 12 Feb 2024 16:39:54 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 dfd828b2c103ff2899b6b2f2946f1e2e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: fYTz0VfkieQLprcko31SyvYaUU37vmWDkonCiY_Z5EP139Rm6jKQqw== Age: 2253387
2024-02-08 18:36:21 UTC	642	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 08 03 00 00 00 60 dc 09 b5 00 00 00 75 50 4c 54 45 b4 1f 30 3c 39 70 b4 1f 30 97 27 40 ff ff ff b4 1f 30 3c 3a 70 d0 73 7d 54 53 82 ec c7 cb e3 ab b1 61 5f 8b 48 46 79 6d 6b 94 49 46 79 be 3b 49 91 90 ae c2 c2 d2 79 78 9c 85 84 a6 48 47 79 9d 9c b7 aa a9 c0 b6 b5 c9 c7 57 64 f3 f3 f6 db da e4 ce cd db 96 26 40 e7 e7 ed 6d 6b 93 9e 9d b7 ce ce db a1 47 5e b5 b5 c9 9e 9c b8 c0 a4 b4 b7 87 9a ae 6c 81 d6 1f 19 b1 00 00 00 04 74 52 4e 53 df bf bf bf 3b 25 6a 12 00 00 01 b8 49 44 41 54 48 c7 8c d4 61 93 94 30 0c 06 60 d4 f5 35 9a 14 4b 69 41 38 d9 dd bb 53 ff ff 4f b4 79 b9 b9 ce c0 ce 68 3e 3c d3 81 09 34 a4 a1 fb f0 1f f1 e9 63 8b 0e 30 83 87 50 6d eb 76 e5 e7 e7 16 1d fa 69 10 bc 89 69 Data Ascii: PNGIHDR00`uPLTE0<9p0'@0<:ps}TSa_HFymkIFy;IyxHGyWd&@mkG^ltRNS;%jIDATHa0`5KiA8SOyh><4c0Pmvii

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
684	192.168.2.5	50533	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:21 UTC	589	OUT	GET /d8c14d4960ca/c2181391033f/challenge.js HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:21 UTC	534	IN	HTTP/1.1 200 OK Content-Type: text/javascript Content-Length: 1093410 Connection: close Vary: Accept-Encoding Date: Thu, 08 Feb 2024 18:36:21 GMT cache-control: private, max-age=86400 last-modified: Thu, 8 Feb 2024 18:36:21 +0000 pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65c51f25-1f8078a83fd730e62b8d76c6 X-Cache: Miss from cloudfront Via: 1.1 68261aebcfc232344da2ef3bf1d3f9ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: sIoA9LDtbupHAMWajZ9i_93iOfmeqcQN8--mJAnoeg4tsvROljQvaA==
2024-02-08 18:36:21 UTC	15850	IN	Data Raw: 2f 2a 21 20 3c 21 2d 40 70 72 65 73 65 72 76 65 20 41 57 53 20 57 41 46 20 49 6e 74 65 67 72 61 74 69 6f 6e 20 44 65 76 65 6c 6f 70 65 72 20 47 75 69 64 65 20 3c 68 74 74 70 73 3a 2f 2f 64 6f 63 73 2e 61 77 73 2e 61 6d 61 7a 6f 6e 2e 63 6f 6d 2f 77 61 66 2f 6c 61 74 65 73 74 2f 64 65 76 65 6c 6f 70 65 72 67 75 69 64 65 2f 77 61 66 2d 6a 61 76 61 73 63 72 69 70 74 2d 73 64 6b 2e 68 74 6d 6c 3e 2d 2d 3e 20 2a 2f 0a 76 61 72 20 61 32 5f 30 78 33 33 66 33 3d 5b 27 4f 6e 6c 79 5c 78 32 30 50 4b 43 53 23 31 32 5c 78 32 30 50 46 58 5c 78 32 30 69 6e 5c 78 32 30 70 61 73 73 77 6f 72 64 5c 78 32 30 69 6e 74 65 67 72 69 74 79 5c 78 32 30 6d 6f 64 65 5c 78 32 30 73 75 70 70 6f 72 74 65 64 2e 27 2c 27 41 72 69 61 6c 5c 78 32 30 54 55 52 27 2c 27 70 61 67 65 58 27 2c Data Ascii: /! <!-@preserve AWS WAF Integration Developer Guide <https://docs.aws.amazon.com/waf/latest/developerguide/waf-javascript-sdk.html>--> /var a2_0x33f3=['Only\x20PKCS#12\x20PFX\x20in\x20password\x20integrity\x20mode\x20supported.','Arial\x20TUR','pageX',
2024-02-08 18:36:21 UTC	1753	IN	Data Raw: 45 6e 63 72 79 70 74 65 64 50 72 69 76 61 74 65 4b 65 79 49 6e 66 6f 2e 27 2c 27 70 61 67 65 49 64 27 2c 27 34 38 34 32 38 57 63 44 68 52 6f 27 2c 27 66 72 6f 6d 49 6e 74 27 2c 27 73 74 72 69 6e 67 27 2c 27 66 6f 72 6d 61 74 4e 75 6d 62 65 72 27 2c 27 5c 78 32 30 28 45 78 74 65 72 6e 61 6c 5c 78 32 30 6f 72 5c 78 32 30 49 6e 73 74 61 6e 63 65 5c 78 32 30 6f 66 29 27 2c 27 69 6e 69 74 27 2c 27 31 31 65 75 6b 64 54 69 27 2c 27 62 65 68 61 76 69 6f 72 27 2c 27 6d 61 63 41 6c 67 6f 72 69 74 68 6d 27 2c 27 32 2e 31 36 2e 38 34 30 2e 31 2e 31 30 31 2e 33 2e 34 2e 32 2e 36 27 2c 27 76 6f 75 63 68 65 72 41 6e 64 55 70 64 61 74 65 54 6f 6b 65 6e 27 2c 27 74 69 74 6c 65 27 2c 27 72 65 64 75 63 65 27 2c 27 67 65 74 43 69 70 68 65 72 46 6f 72 50 4b 43 53 31 32 50 42 Data Ascii: EncryptedPrivateKeyInfo.','pageId','48428WcDhRo','fromInt','string','formatNumber','\x20(External\x20or\x20Instance\x20of)','init','11eukdTi','behavior','macAlgorithm','2.16.840.1.101.3.4.2.6','voucherAndUpdateToken','title','reduce','getCipherForPKCS12PB
2024-02-08 18:36:21 UTC	16384	IN	Data Raw: 6e 43 6f 6e 73 74 72 61 69 6e 74 27 2c 27 5c 78 32 32 6d 64 35 5c 78 32 32 5c 78 32 30 68 61 73 68 5c 78 32 30 61 6c 67 6f 72 69 74 68 6d 5c 78 32 30 75 6e 61 76 61 69 6c 61 62 6c 65 2e 27 2c 27 31 42 58 6b 59 42 70 27 2c 27 33 5a 77 73 79 57 78 27 2c 27 32 34 37 37 32 51 4d 6d 57 6c 69 27 2c 27 4c 65 65 6c 61 77 61 64 65 65 27 2c 27 46 6f 72 6d 49 6e 70 75 74 54 65 6c 65 6d 65 74 72 79 43 6f 6c 6c 65 63 74 6f 72 27 2c 27 42 61 64 5c 78 32 30 72 65 63 6f 72 64 5c 78 32 30 4d 41 43 2e 27 2c 27 42 72 6f 77 61 6c 6c 69 61 5c 78 32 30 4e 65 77 27 2c 27 74 61 62 6c 65 4d 75 6c 74 69 70 6c 79 27 2c 27 70 72 66 4f 69 64 27 2c 27 63 61 70 73 45 6c 27 2c 27 68 61 6e 64 6c 65 43 6c 69 65 6e 74 4b 65 79 45 78 63 68 61 6e 67 65 27 2c 27 70 72 66 5f 74 6c 73 31 27 2c Data Ascii: nConstraint','\x22md5\x22\x20hash\x20algorithm\x20unavailable.','1BXkYBp','3ZwsyWx','24772QMmWli','Leelawadee','FormInputTelemetryCollector','Bad\x20record\x20MAC.','Browallia\x20New','tableMultiply','prfOid','capsEl','handleClientKeyExchange','prf_tls1',
2024-02-08 18:36:21 UTC	16384	IN	Data Raw: 27 67 65 74 49 73 73 75 65 72 27 2c 27 6e 75 6d 27 2c 27 46 72 65 65 73 69 61 55 50 43 27 2c 27 63 6f 6d 27 2c 27 68 61 6e 64 6c 65 48 65 61 72 74 62 65 61 74 27 2c 27 72 73 61 45 6e 63 72 79 70 74 69 6f 6e 27 2c 27 46 57 43 49 4d 43 6f 6d 70 6f 75 6e 64 43 6f 6c 6c 65 63 74 6f 72 27 2c 27 69 64 6c 65 54 69 6d 65 6f 75 74 27 2c 27 74 65 78 74 27 2c 27 55 4e 4d 41 53 4b 45 44 5f 52 45 4e 44 45 52 45 52 5f 57 45 42 47 4c 27 2c 27 75 74 63 54 69 6d 65 54 6f 44 61 74 65 27 2c 27 63 6f 6d 70 6f 73 65 64 27 2c 27 41 63 74 69 76 65 58 50 6c 75 67 69 6e 43 6f 6c 6c 65 63 74 6f 72 27 2c 27 6d 6f 75 73 65 75 70 27 2c 27 52 65 63 69 70 69 65 6e 74 49 6e 66 6f 2e 76 65 72 73 69 6f 6e 27 2c 27 53 68 6f 75 6c 64 52 65 66 72 65 73 68 54 6f 6b 65 6e 3f 5c 78 32 30 54 69 Data Ascii: 'getIssuer','num','FreesiaUPC','com','handleHeartbeat','rsaEncryption','FWCIMCompoundCollector','idleTimeout','text','UNMASKED_RENDERER_WEBGL','utcTimeToDate','composed','ActiveXPluginCollector','mouseup','RecipientInfo.version','ShouldRefreshToken?\x20Ti
2024-02-08 18:36:21 UTC	16384	IN	Data Raw: 4c 57 55 35 4e 6a 67 35 4f 54 49 7a 59 6a 49 7a 4f 53 49 73 49 6d 4e 79 5a 57 46 30 5a 56 39 30 61 57 31 6c 49 6a 6f 69 4d 6a 41 79 4e 43 30 77 4d 69 30 77 4f 46 51 78 4f 44 6f 7a 4e 6a 6f 79 4d 53 34 33 4d 44 51 34 4d 54 63 7a 4e 6a 46 61 49 69 77 69 5a 47 6c 6d 5a 6d 6c 6a 64 57 78 30 65 53 49 36 4f 43 77 69 59 32 68 68 62 47 78 6c 62 6d 64 6c 58 33 52 35 63 47 55 69 4f 69 4a 49 59 58 4e 6f 59 32 46 7a 61 46 4e 49 51 54 49 69 66 51 3d 3d 27 2c 27 57 50 5c 78 32 30 4d 75 6c 74 69 6e 61 74 69 6f 6e 61 6c 42 5c 78 32 30 52 6f 6d 61 6e 27 2c 27 63 65 72 74 42 61 67 27 2c 27 43 6f 75 6c 64 5c 78 32 30 6e 6f 74 5c 78 32 30 64 65 63 6f 6d 70 72 65 73 73 5c 78 32 30 72 65 63 6f 72 64 2e 27 2c 27 31 38 33 35 70 5a 76 61 63 62 27 2c 27 63 65 72 74 69 66 69 63 61 Data Ascii: LWU5Njg5OTIzYjIzOSIsImNyZWF0ZV90aW1lIjoiMjAyNC0wMi0wOFQxODozNjoyMS43MDQ4MTczNjFaIiwiZGlmZmljdWx0eSI6OCwiY2hhbGxlbmdlX3R5cGUiOiJIYXNoY2FzaFNIQTIifQ==','WP\x20MultinationalB\x20Roman','certBag','Could\x20not\x20decompress\x20record.','1835pZvacb','certifica
2024-02-08 18:36:21 UTC	16384	IN	Data Raw: 3a 5f 30 78 31 34 31 63 33 63 28 5f 30 78 62 34 32 33 36 37 2c 5f 30 78 34 35 66 39 37 30 29 29 7c 7c 5f 30 78 33 37 31 31 64 32 29 3b 7d 72 65 74 75 72 6e 20 5f 30 78 61 65 32 39 62 35 3e 30 78 33 26 26 5f 30 78 33 37 31 31 64 32 26 26 4f 62 6a 65 63 74 5b 27 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 27 5d 28 5f 30 78 62 34 32 33 36 37 2c 5f 30 78 34 35 66 39 37 30 2c 5f 30 78 33 37 31 31 64 32 29 2c 5f 30 78 33 37 31 31 64 32 3b 7d 66 75 6e 63 74 69 6f 6e 20 5f 30 78 31 63 62 34 62 33 28 5f 30 78 35 31 31 31 33 63 2c 5f 30 78 33 35 30 32 66 33 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 5f 30 78 35 62 35 62 61 36 2c 5f 30 78 34 35 33 36 34 66 29 7b 5f 30 78 33 35 30 32 66 33 28 5f 30 78 35 62 35 62 61 36 2c 5f 30 78 34 35 33 36 34 66 2c 5f 30 Data Ascii: :_0x141c3c(_0xb42367,_0x45f970))\|\|_0x3711d2);}return _0xae29b5>0x3&&_0x3711d2&&Object['defineProperty'](_0xb42367,_0x45f970,_0x3711d2),_0x3711d2;}function _0x1cb4b3(_0x51113c,_0x3502f3){return function(_0x5b5ba6,_0x45364f){_0x3502f3(_0x5b5ba6,_0x45364f,_0
2024-02-08 18:36:21 UTC	16384	IN	Data Raw: 5d 3b 66 75 6e 63 74 69 6f 6e 20 5f 30 78 34 62 31 61 39 64 28 5f 30 78 32 37 61 63 62 62 29 7b 76 61 72 20 5f 30 78 31 33 65 62 63 38 3d 28 30 78 30 2c 5f 30 78 35 64 39 35 64 64 5b 5f 30 78 33 33 39 30 63 61 5b 30 78 32 5d 5d 29 28 28 30 78 30 2c 5f 30 78 35 64 39 35 64 64 5b 5f 30 78 33 33 39 30 63 61 5b 30 78 32 5d 5d 29 28 7b 7d 2c 5f 30 78 33 37 65 38 38 31 29 2c 5f 30 78 32 37 61 63 62 62 29 2c 5f 30 78 35 62 66 35 63 32 3d 5f 30 78 31 33 65 62 63 38 5b 5f 30 78 33 33 39 30 63 61 5b 30 78 35 5d 5d 2c 5f 30 78 34 30 36 35 35 30 3d 5f 30 78 31 33 65 62 63 38 5b 5f 30 78 33 33 39 30 63 61 5b 30 78 64 5d 5d 2c 5f 30 78 34 31 39 39 65 36 3d 5f 30 78 31 33 65 62 63 38 5b 5f 30 78 33 33 39 30 63 61 5b 30 78 39 5d 5d 2c 5f 30 78 34 30 38 62 34 65 3d 5f 30 Data Ascii: ];function _0x4b1a9d(_0x27acbb){var _0x13ebc8=(0x0,_0x5d95dd[_0x3390ca[0x2]])((0x0,_0x5d95dd[_0x3390ca[0x2]])({},_0x37e881),_0x27acbb),_0x5bf5c2=_0x13ebc8[_0x3390ca[0x5]],_0x406550=_0x13ebc8[_0x3390ca[0xd]],_0x4199e6=_0x13ebc8[_0x3390ca[0x9]],_0x408b4e=_0
2024-02-08 18:36:21 UTC	7570	IN	Data Raw: 75 72 6e 20 5f 30 78 31 37 62 34 35 31 5b 5f 30 78 33 65 61 35 32 38 5b 30 78 31 5d 5d 3d 6e 65 77 20 44 61 74 65 28 29 5b 5f 30 78 33 65 61 35 32 38 5b 30 78 30 5d 5d 28 29 3b 7d 29 2c 5f 30 78 32 61 65 32 32 36 5b 5f 30 78 33 34 33 37 62 34 5b 30 78 34 5d 5d 28 5f 30 78 33 34 33 37 62 34 5b 30 78 33 5d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 30 78 34 33 34 31 39 32 3d 5f 30 78 31 30 33 34 39 31 2c 5f 30 78 34 31 65 66 64 33 3d 5b 27 74 6f 74 61 6c 46 6f 63 75 73 54 69 6d 65 27 2c 5f 30 78 34 33 34 31 39 32 28 30 78 63 35 66 29 2c 6e 75 6c 6c 2c 5f 30 78 34 33 34 31 39 32 28 30 78 35 37 37 29 5d 3b 5f 30 78 31 37 62 34 35 31 5b 5f 30 78 34 31 65 66 64 33 5b 30 78 33 5d 5d 26 26 28 5f 30 78 31 37 62 34 35 31 5b 5f 30 78 34 31 65 66 64 33 5b 30 Data Ascii: urn _0x17b451[_0x3ea528[0x1]]=new Date()[_0x3ea528[0x0]]();}),_0x2ae226[_0x3437b4[0x4]](_0x3437b4[0x3],function(){var _0x434192=_0x103491,_0x41efd3=['totalFocusTime',_0x434192(0xc5f),null,_0x434192(0x577)];_0x17b451[_0x41efd3[0x3]]&&(_0x17b451[_0x41efd3[0
2024-02-08 18:36:22 UTC	16384	IN	Data Raw: 69 64 20 30 78 30 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 30 78 35 61 36 32 61 62 3d 5f 30 78 32 39 64 65 63 38 2c 5f 30 78 35 63 36 35 64 39 2c 5f 30 78 34 37 64 33 30 63 2c 5f 30 78 33 31 39 35 38 30 3d 5b 5f 30 78 35 61 36 32 61 62 28 30 78 39 35 61 29 2c 30 78 30 2c 27 5f 5f 67 65 6e 65 72 61 74 6f 72 27 2c 30 78 61 33 66 36 5d 3b 72 65 74 75 72 6e 28 30 78 30 2c 5f 30 78 32 30 38 31 31 34 5b 5f 30 78 33 31 39 35 38 30 5b 30 78 32 5d 5d 29 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 5f 30 78 61 36 30 39 36 63 29 7b 76 61 72 20 5f 30 78 36 32 36 34 63 62 3d 5f 30 78 35 61 36 32 61 62 2c 5f 30 78 35 30 37 37 32 31 3d 5b 5f 30 78 36 32 36 34 63 62 28 30 78 61 37 64 29 2c 5f 30 78 36 32 36 34 63 62 28 30 78 63 37 63 29 2c 5f 30 78 36 32 36 34 Data Ascii: id 0x0,function(){var _0x5a62ab=_0x29dec8,_0x5c65d9,_0x47d30c,_0x319580=[_0x5a62ab(0x95a),0x0,'__generator',0xa3f6];return(0x0,_0x208114[_0x319580[0x2]])(this,function(_0xa6096c){var _0x6264cb=_0x5a62ab,_0x507721=[_0x6264cb(0xa7d),_0x6264cb(0xc7c),_0x6264
2024-02-08 18:36:22 UTC	16384	IN	Data Raw: 39 35 66 63 3d 5f 30 78 62 31 36 64 38 30 2c 5f 30 78 35 63 31 32 62 64 3d 5b 30 78 30 2c 5f 30 78 33 38 39 35 66 63 28 30 78 38 39 35 29 5d 3b 72 65 74 75 72 6e 28 30 78 30 2c 5f 30 78 35 33 61 62 66 39 5b 5f 30 78 35 63 31 32 62 64 5b 30 78 31 5d 5d 29 28 74 68 69 73 2c 76 6f 69 64 20 30 78 30 2c 76 6f 69 64 20 30 78 30 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 30 78 35 65 38 37 35 36 3d 5f 30 78 33 38 39 35 66 63 2c 5f 30 78 34 30 64 66 36 65 2c 5f 30 78 32 34 32 61 32 35 2c 5f 30 78 31 38 66 66 34 34 3d 5b 30 78 30 2c 5f 30 78 35 65 38 37 35 36 28 30 78 64 32 63 29 5d 3b 72 65 74 75 72 6e 28 30 78 30 2c 5f 30 78 35 33 61 62 66 39 5b 5f 30 78 31 38 66 66 34 34 5b 30 78 31 5d 5d 29 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 5f 30 78 34 63 63 Data Ascii: 95fc=_0xb16d80,_0x5c12bd=[0x0,_0x3895fc(0x895)];return(0x0,_0x53abf9[_0x5c12bd[0x1]])(this,void 0x0,void 0x0,function(){var _0x5e8756=_0x3895fc,_0x40df6e,_0x242a25,_0x18ff44=[0x0,_0x5e8756(0xd2c)];return(0x0,_0x53abf9[_0x18ff44[0x1]])(this,function(_0x4cc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
685	192.168.2.5	50535	18.67.65.100	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:21 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:22 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Thu, 08 Feb 2024 18:36:22 GMT X-Cache: Error from cloudfront Via: 1.1 aa6e16f47d6a0519f52b8dcfca2d841a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: ZG7ls2vzGTVGncHNXJ5_-8FBux7pN7zPt53VqTeFLnH7y5_Yaz5fDA==
2024-02-08 18:36:22 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
686	192.168.2.5	50534	104.18.131.236	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:21 UTC	639	OUT	GET /consent/a387750c-a080-4dd0-b2d1-7dbdb601bb14/a387750c-a080-4dd0-b2d1-7dbdb601bb14.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://account.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:22 UTC	901	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:36:22 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8525fa4db9626753-ATL CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 7399 Cache-Control: public, max-age=86400 Expires: Fri, 09 Feb 2024 18:36:22 GMT Last-Modified: Fri, 02 Feb 2024 16:31:18 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: 0+JgRsdjEhmuq1b70Gr11w== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 74340130-201e-0007-5df5-5555e0000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-02-08 18:36:22 UTC	468	IN	Data Raw: 31 61 30 39 0d 0a 7b 22 43 6f 6f 6b 69 65 53 50 41 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 53 61 6d 65 53 69 74 65 4e 6f 6e 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 56 32 43 53 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 4d 75 6c 74 69 56 61 72 69 61 6e 74 54 65 73 74 69 6e 67 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 55 73 65 56 32 22 3a 74 72 75 65 2c 22 4d 6f 62 69 6c 65 53 44 4b 22 3a 66 61 6c 73 65 2c 22 53 6b 69 70 47 65 6f 6c 6f 63 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 53 63 72 69 70 74 54 79 70 65 22 3a 22 50 52 4f 44 55 43 54 49 4f 4e 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 32 30 32 33 30 35 2e 31 2e 30 22 2c 22 4f 70 74 61 6e 6f 6e 44 61 74 61 4a 53 4f 4e 22 3a 22 61 33 38 37 Data Ascii: 1a09{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202305.1.0","OptanonDataJSON":"a387
2024-02-08 18:36:22 UTC	1369	IN	Data Raw: 22 3a 5b 7b 22 49 64 22 3a 22 39 37 37 38 66 34 61 62 2d 36 62 34 61 2d 34 65 30 33 2d 62 64 66 38 2d 38 36 61 35 63 30 33 37 63 34 62 66 22 2c 22 4e 61 6d 65 22 3a 22 55 53 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 75 73 22 5d 2c 22 53 74 61 74 65 73 22 3a 7b 7d 2c 22 4c 61 6e 67 75 61 67 65 53 77 69 74 63 68 65 72 50 6c 61 63 65 68 6f 6c 64 65 72 22 3a 7b 22 6e 6f 22 3a 22 6e 6f 22 2c 22 68 69 22 3a 22 68 69 22 2c 22 64 65 22 3a 22 64 65 22 2c 22 72 75 22 3a 22 72 75 22 2c 22 66 69 22 3a 22 66 69 22 2c 22 65 6e 2d 55 53 22 3a 22 65 6e 2d 55 53 22 2c 22 62 67 22 3a 22 62 67 22 2c 22 6c 74 22 3a 22 6c 74 22 2c 22 6c 76 22 3a 22 6c 76 22 2c 22 68 72 22 3a 22 68 72 22 2c 22 66 72 22 3a 22 66 72 22 2c 22 68 75 22 3a 22 68 75 22 2c 22 64 65 66 61 75 6c Data Ascii: ":[{"Id":"9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf","Name":"US","Countries":["us"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","en-US":"en-US","bg":"bg","lt":"lt","lv":"lv","hr":"hr","fr":"fr","hu":"hu","defaul
2024-02-08 18:36:22 UTC	1369	IN	Data Raw: 48 61 6e 74 22 2c 22 75 6b 22 3a 22 75 6b 22 2c 22 73 6b 22 3a 22 73 6b 22 2c 22 73 6c 22 3a 22 73 6c 22 2c 22 69 64 22 3a 22 69 64 22 2c 22 63 61 22 3a 22 63 61 22 2c 22 73 72 22 3a 22 73 72 22 2c 22 73 76 22 3a 22 73 76 22 2c 22 6b 6f 22 3a 22 6b 6f 22 2c 22 70 74 2d 42 52 22 3a 22 70 74 2d 42 52 22 2c 22 6d 73 22 3a 22 6d 73 22 2c 22 65 6c 22 3a 22 65 6c 22 2c 22 69 73 22 3a 22 69 73 22 2c 22 69 74 22 3a 22 69 74 22 2c 22 65 73 2d 4d 58 22 3a 22 65 73 2d 4d 58 22 2c 22 65 73 22 3a 22 65 73 22 2c 22 7a 68 22 3a 22 7a 68 22 2c 22 65 74 22 3a 22 65 74 22 2c 22 63 73 22 3a 22 63 73 22 2c 22 61 72 22 3a 22 61 72 22 2c 22 70 74 2d 50 54 22 3a 22 70 74 2d 50 54 22 2c 22 76 69 22 3a 22 76 69 22 2c 22 74 68 22 3a 22 74 68 22 2c 22 65 73 2d 41 52 22 3a 22 65 73 Data Ascii: Hant","uk":"uk","sk":"sk","sl":"sl","id":"id","ca":"ca","sr":"sr","sv":"sv","ko":"ko","pt-BR":"pt-BR","ms":"ms","el":"el","is":"is","it":"it","es-MX":"es-MX","es":"es","zh":"zh","et":"et","cs":"cs","ar":"ar","pt-PT":"pt-PT","vi":"vi","th":"th","es-AR":"es
2024-02-08 18:36:22 UTC	1369	IN	Data Raw: 61 22 2c 22 73 72 22 2c 22 63 63 22 2c 22 73 73 22 2c 22 63 64 22 2c 22 73 74 22 2c 22 63 66 22 2c 22 73 76 22 2c 22 63 67 22 2c 22 73 78 22 2c 22 63 68 22 2c 22 63 69 22 2c 22 73 79 22 2c 22 73 7a 22 2c 22 63 6b 22 2c 22 63 6c 22 2c 22 63 6d 22 2c 22 63 6f 22 2c 22 63 72 22 2c 22 74 63 22 2c 22 74 64 22 2c 22 74 66 22 2c 22 63 75 22 2c 22 74 67 22 2c 22 63 76 22 2c 22 63 77 22 2c 22 74 68 22 2c 22 63 78 22 2c 22 74 6a 22 2c 22 74 6b 22 2c 22 74 6c 22 2c 22 74 6d 22 2c 22 74 6e 22 2c 22 74 6f 22 2c 22 74 72 22 2c 22 74 74 22 2c 22 74 76 22 2c 22 74 77 22 2c 22 64 6a 22 2c 22 74 7a 22 2c 22 64 6d 22 2c 22 64 6f 22 2c 22 75 61 22 2c 22 75 67 22 2c 22 64 7a 22 2c 22 75 6d 22 2c 22 65 63 22 2c 22 65 67 22 2c 22 65 68 22 2c 22 75 79 22 2c 22 75 7a 22 2c 22 76 Data Ascii: a","sr","cc","ss","cd","st","cf","sv","cg","sx","ch","ci","sy","sz","ck","cl","cm","co","cr","tc","td","tf","cu","tg","cv","cw","th","cx","tj","tk","tl","tm","tn","to","tr","tt","tv","tw","dj","tz","dm","do","ua","ug","dz","um","ec","eg","eh","uy","uz","v
2024-02-08 18:36:22 UTC	1369	IN	Data Raw: 22 3a 74 72 75 65 2c 22 47 6c 6f 62 61 6c 22 3a 74 72 75 65 2c 22 54 79 70 65 22 3a 22 47 44 50 52 22 2c 22 55 73 65 47 6f 6f 67 6c 65 56 65 6e 64 6f 72 73 22 3a 66 61 6c 73 65 2c 22 56 61 72 69 61 6e 74 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 54 65 73 74 45 6e 64 54 69 6d 65 22 3a 6e 75 6c 6c 2c 22 56 61 72 69 61 6e 74 73 22 3a 5b 5d 2c 22 54 65 6d 70 6c 61 74 65 4e 61 6d 65 22 3a 22 43 75 73 74 6f 6d 65 72 20 2d 20 41 63 63 65 70 74 2f 44 65 63 6c 69 6e 65 22 2c 22 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 47 43 45 6e 61 62 6c 65 22 3a 66 61 6c 73 65 2c 22 49 73 47 50 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 7d 5d 2c 22 49 61 62 44 61 74 61 22 3a 7b 22 63 6f 6f 6b 69 65 56 65 72 73 69 6f 6e 22 3a 22 31 22 2c 22 63 72 65 61 74 65 64 54 Data Ascii: ":true,"Global":true,"Type":"GDPR","UseGoogleVendors":false,"VariantEnabled":false,"TestEndTime":null,"Variants":[],"TemplateName":"Customer - Accept/Decline","Conditions":[],"GCEnable":false,"IsGPPEnabled":false}],"IabData":{"cookieVersion":"1","createdT
2024-02-08 18:36:22 UTC	729	IN	Data Raw: 73 22 3a 7b 22 43 6f 6f 6b 69 65 56 32 42 61 6e 6e 65 72 46 6f 63 75 73 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 50 43 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 41 73 73 69 67 6e 54 65 6d 70 6c 61 74 65 52 75 6c 65 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6f 6c 6f 63 61 74 69 6f 6e 4a 73 6f 6e 41 70 69 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 43 4d 44 4d 41 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 54 43 46 32 31 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 52 65 6d 6f 76 65 53 65 74 74 69 6e 67 73 49 63 6f 6e 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 42 61 6e 6e 65 72 4c 6f 67 6f 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6e 65 72 61 6c 56 65 6e 64 6f 72 73 22 3a 74 72 75 65 2c 22 43 6f 6f Data Ascii: s":{"CookieV2BannerFocus":true,"CookieV2GPC":true,"CookieV2AssignTemplateRule":true,"CookieV2GeolocationJsonApi":true,"CookieV2GCMDMA":true,"CookieV2TCF21":true,"CookieV2RemoveSettingsIcon":true,"CookieV2BannerLogo":true,"CookieV2GeneralVendors":true,"Coo
2024-02-08 18:36:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
687	192.168.2.5	50536	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:21 UTC	791	OUT	GET /recaptcha/api2/reload?k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AJmcDEluwtSp57QJSmQQzbcGIOozbHSebG52sNz1noRw0W0Uj5MlmO6jPWiPivfFDy1ady_Qtnfk7_9aHN-OBpc; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:22 UTC	518	IN	HTTP/1.1 405 HTTP method GET is not supported by this URL Content-Type: text/html; charset=UTF-8 Date: Thu, 08 Feb 2024 18:36:22 GMT Expires: Thu, 08 Feb 2024 18:36:22 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:36:22 UTC	217	IN	Data Raw: 64 33 0d 0a 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 48 54 54 50 20 6d 65 74 68 6f 64 20 47 45 54 20 69 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 20 62 79 20 74 68 69 73 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 48 31 3e 48 54 54 50 20 6d 65 74 68 6f 64 20 47 45 54 20 69 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 20 62 79 20 74 68 69 73 20 55 52 4c 3c 2f 48 31 3e 0a 3c 48 32 3e 45 72 72 6f 72 20 34 30 35 3c 2f 48 32 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a 0d 0a Data Ascii: d3<HTML><HEAD><TITLE>HTTP method GET is not supported by this URL</TITLE></HEAD><BODY BGCOLOR="#FFFFFF" TEXT="#000000"><H1>HTTP method GET is not supported by this URL</H1><H2>Error 405</H2></BODY></HTML>
2024-02-08 18:36:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
688	192.168.2.5	50538	172.64.155.119	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:22 UTC	605	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://account.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:22 UTC	370	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:36:22 GMT Content-Type: application/json Content-Length: 68 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8525fa5178eeb04a-ATL
2024-02-08 18:36:22 UTC	68	IN	Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 47 41 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 47 65 6f 72 67 69 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d Data Ascii: {"country":"US","state":"GA","stateName":"Georgia","continent":"NA"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
689	192.168.2.5	50539	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:23 UTC	679	OUT	POST /d8c14d4960ca/c2181391033f/verify HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive Content-Length: 9817 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://account.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:23 UTC	9817	OUT	Data Raw: 7b 22 63 68 61 6c 6c 65 6e 67 65 22 3a 7b 22 69 6e 70 75 74 22 3a 22 65 79 4a 32 5a 58 4a 7a 61 57 39 75 49 6a 6f 78 4c 43 4a 31 59 6d 6c 6b 49 6a 6f 69 4d 7a 67 34 4d 57 51 35 59 7a 67 74 4e 57 46 6c 5a 43 30 30 59 6d 49 31 4c 57 49 30 4d 57 45 74 59 6d 59 33 4e 44 41 79 4d 32 5a 69 5a 47 51 79 49 69 77 69 59 58 52 30 5a 57 31 77 64 46 39 70 5a 43 49 36 49 6a 51 32 4e 54 59 35 4d 7a 42 6c 4c 54 4d 31 5a 47 49 74 4e 44 52 6d 4f 43 30 34 5a 54 4a 6a 4c 57 55 35 4e 6a 67 35 4f 54 49 7a 59 6a 49 7a 4f 53 49 73 49 6d 4e 79 5a 57 46 30 5a 56 39 30 61 57 31 6c 49 6a 6f 69 4d 6a 41 79 4e 43 30 77 4d 69 30 77 4f 46 51 78 4f 44 6f 7a 4e 6a 6f 79 4d 53 34 33 4d 44 51 34 4d 54 63 7a 4e 6a 46 61 49 69 77 69 5a 47 6c 6d 5a 6d 6c 6a 64 57 78 30 65 53 49 36 4f 43 77 69 Data Ascii: {"challenge":{"input":"eyJ2ZXJzaW9uIjoxLCJ1YmlkIjoiMzg4MWQ5YzgtNWFlZC00YmI1LWI0MWEtYmY3NDAyM2ZiZGQyIiwiYXR0ZW1wdF9pZCI6IjQ2NTY5MzBlLTM1ZGItNDRmOC04ZTJjLWU5Njg5OTIzYjIzOSIsImNyZWF0ZV90aW1lIjoiMjAyNC0wMi0wOFQxODozNjoyMS43MDQ4MTczNjFaIiwiZGlmZmljdWx0eSI6OCwi
2024-02-08 18:36:23 UTC	585	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 300 Connection: close Date: Thu, 08 Feb 2024 18:36:23 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65c51f27-07a254f84de763015dae700c X-Cache: Miss from cloudfront Via: 1.1 a7a1b4c19abc42d237405ce4c4069f10.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: Op5OeIK_TfgbroKk4vcEH-hAv_kfi0ee9fqDJLZsOjgiP8I-nYoDkQ==
2024-02-08 18:36:23 UTC	300	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 5a 2f 79 42 34 73 73 57 41 41 41 41 3a 37 6c 46 6e 51 71 6d 59 57 4a 37 70 37 44 5a 74 4a 4e 76 2b 6f 46 6c 76 64 31 32 2f 77 36 69 74 53 6c 41 43 44 57 63 4c 34 6f 58 59 2f 75 61 71 44 50 59 72 71 4d 59 4e 52 44 30 39 54 51 55 4f 36 2f 6b 63 6d 45 6a 57 32 6d 46 64 31 30 72 61 42 6c 53 65 55 73 5a 4a 59 6c 56 6f 37 42 6f 69 4d 54 34 7a 54 52 41 6f 7a 35 6a 49 4b 69 61 7a 79 64 6c 6b 56 4a 67 4c 37 58 61 59 50 46 32 66 6a 59 57 4c 6c 6d 4a 4e 70 6d 4f 6f 52 68 50 47 2b 36 72 68 33 67 6b 79 78 56 48 64 6d 38 4b 7a 4f 62 4d 51 78 79 63 53 6f 4d 51 2b 2f 51 2b 72 73 32 49 78 31 6f 76 55 68 64 58 59 55 76 32 Data Ascii: {"token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAZ/yB4ssWAAAA:7lFnQqmYWJ7p7DZtJNv+oFlvd12/w6itSlACDWcL4oXY/uaqDPYrqMYNRD09TQUO6/kcmEjW2mFd10raBlSeUsZJYlVo7BoiMT4zTRAoz5jIKiazydlkVJgL7XaYPF2fjYWLlmJNpmOoRhPG+6rh3gkyxVHdm8KzObMQxycSoMQ+/Q+rs2Ix1ovUhdXYUv2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
690	192.168.2.5	50540	104.18.131.236	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:23 UTC	561	OUT	GET /scripttemplates/202305.1.0/otBannerSdk.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:23 UTC	815	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:36:23 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Content-MD5: fuN6EZWNAh2xn3yE+0HSRQ== Last-Modified: Tue, 11 Jul 2023 02:35:48 GMT x-ms-request-id: bb61c14c-801e-006c-0ac6-0bd214000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 40580 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8525fa562d436779-ATL
2024-02-08 18:36:23 UTC	554	IN	Data Raw: 37 63 36 66 0d 0a 2f 2a 2a 20 0a 20 2a 20 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 0a 20 2a 20 76 32 30 32 33 30 35 2e 31 2e 30 0a 20 2a 20 62 79 20 4f 6e 65 54 72 75 73 74 20 4c 4c 43 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 32 33 20 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 41 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 41 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 28 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 5b 5d 7d 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 74 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6f 20 69 6e Data Ascii: 7c6f/** * onetrust-banner-sdk * v202305.1.0 * by OneTrust LLC * Copyright 2023 */!function(){"use strict";var A=function(e,t){return(A=Object.setPrototypeOf\|\|({__proto__:[]}instanceof Array?function(e,t){e.__proto__=t}:function(e,t){for(var o in
2024-02-08 18:36:23 UTC	1369	IN	Data Raw: 6f 74 79 70 65 2c 6e 65 77 20 6f 29 7d 76 61 72 20 4c 2c 5f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 28 5f 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6f 3d 31 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6f 3c 6e 3b 6f 2b 2b 29 66 6f 72 28 76 61 72 20 72 20 69 6e 20 74 3d 61 72 67 75 6d 65 6e 74 73 5b 6f 5d 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 72 29 26 26 28 65 5b 72 5d 3d 74 5b 72 5d 29 3b 72 65 74 75 72 6e 20 65 7d 29 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 64 28 65 2c 73 2c 61 2c 6c 29 7b 72 65 74 75 72 6e 20 6e 65 Data Ascii: otype,new o)}var L,_=function(){return(_=Object.assign\|\|function(e){for(var t,o=1,n=arguments.length;o<n;o++)for(var r in t=arguments[o])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e}).apply(this,arguments)};function d(e,s,a,l){return ne
2024-02-08 18:36:23 UTC	1369	IN	Data Raw: 6c 2e 6c 61 62 65 6c 3c 61 5b 32 5d 29 29 7b 61 5b 32 5d 26 26 6c 2e 6f 70 73 2e 70 6f 70 28 29 2c 6c 2e 74 72 79 73 2e 70 6f 70 28 29 3b 63 6f 6e 74 69 6e 75 65 7d 6c 2e 6c 61 62 65 6c 3d 61 5b 32 5d 2c 6c 2e 6f 70 73 2e 70 75 73 68 28 74 29 7d 7d 74 3d 72 2e 63 61 6c 6c 28 6e 2c 6c 29 7d 63 61 74 63 68 28 65 29 7b 74 3d 5b 36 2c 65 5d 2c 73 3d 30 7d 66 69 6e 61 6c 6c 79 7b 69 3d 61 3d 30 7d 69 66 28 35 26 74 5b 30 5d 29 74 68 72 6f 77 20 74 5b 31 5d 3b 72 65 74 75 72 6e 7b 76 61 6c 75 65 3a 74 5b 30 5d 3f 74 5b 31 5d 3a 76 6f 69 64 20 30 2c 64 6f 6e 65 3a 21 30 7d 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 71 28 29 7b 66 6f 72 28 76 61 72 20 65 3d 30 2c 74 3d 30 2c 6f 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 74 3c 6f 3b 74 2b 2b 29 65 2b 3d 61 72 Data Ascii: l.label<a[2])){a[2]&&l.ops.pop(),l.trys.pop();continue}l.label=a[2],l.ops.push(t)}}t=r.call(n,l)}catch(e){t=[6,e],s=0}finally{i=a=0}if(5&t[0])throw t[1];return{value:t[0]?t[1]:void 0,done:!0}}}}function q(){for(var e=0,t=0,o=arguments.length;t<o;t++)e+=ar
2024-02-08 18:36:23 UTC	1369	IN	Data Raw: 63 65 6f 66 20 7a 29 72 65 74 75 72 6e 20 74 2e 5f 73 74 61 74 65 3d 33 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 76 6f 69 64 20 59 28 74 29 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6f 29 72 65 74 75 72 6e 20 76 6f 69 64 20 51 28 28 6e 3d 6f 2c 72 3d 65 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 61 70 70 6c 79 28 72 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2c 74 29 7d 74 2e 5f 73 74 61 74 65 3d 31 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 59 28 74 29 7d 63 61 74 63 68 28 65 29 7b 4a 28 74 2c 65 29 7d 76 61 72 20 6e 2c 72 7d 66 75 6e 63 74 69 6f 6e 20 4a 28 65 2c 74 29 7b 65 2e 5f 73 74 61 74 65 3d 32 2c 65 2e 5f 76 61 6c 75 65 3d 74 2c 59 28 65 29 7d 66 75 6e 63 74 69 6f 6e 20 59 28 65 29 7b 32 3d 3d 3d 65 2e 5f 73 74 61 74 65 26 26 30 3d 3d Data Ascii: ceof z)return t._state=3,t._value=e,void Y(t);if("function"==typeof o)return void Q((n=o,r=e,function(){n.apply(r,arguments)}),t)}t._state=1,t._value=e,Y(t)}catch(e){J(t,e)}var n,r}function J(e,t){e._state=2,e._value=t,Y(e)}function Y(e){2===e._state&&0==
2024-02-08 18:36:23 UTC	1369	IN	Data Raw: 65 74 75 72 6e 20 76 6f 69 64 20 6e 2e 63 61 6c 6c 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 28 6f 2c 65 29 7d 2c 69 29 7d 73 5b 6f 5d 3d 65 2c 30 3d 3d 2d 2d 61 26 26 72 28 73 29 7d 63 61 74 63 68 28 65 29 7b 69 28 65 29 7d 7d 28 65 2c 73 5b 65 5d 29 7d 29 7d 2c 7a 2e 72 65 73 6f 6c 76 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 7a 3f 74 3a 6e 65 77 20 7a 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 28 74 29 7d 29 7d 2c 7a 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 7a 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 28 6f 29 7d 29 7d 2c 7a 2e 72 61 63 65 3d 66 75 6e 63 Data Ascii: eturn void n.call(e,function(e){t(o,e)},i)}s[o]=e,0==--a&&r(s)}catch(e){i(e)}}(e,s[e])})},z.resolve=function(t){return t&&"object"==typeof t&&t.constructor===z?t:new z(function(e){e(t)})},z.reject=function(o){return new z(function(e,t){t(o)})},z.race=func
2024-02-08 18:36:23 UTC	1369	IN	Data Raw: 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 7d 2c 24 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 69 74 45 6e 64 73 57 69 74 68 50 6f 6c 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 64 73 57 69 74 68 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2c 22 65 6e 64 73 57 69 74 68 22 2c 7b 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 74 3e 74 68 69 73 2e 6c 65 6e 67 74 68 29 26 26 28 74 3d 74 68 69 73 2e 6c 65 6e 67 74 68 29 2c 74 68 69 73 2e 73 75 62 73 74 72 69 6e 67 28 74 2d 65 2e 6c 65 6e 67 74 68 2c 74 29 3d 3d 3d 65 7d 2c 77 72 69 74 61 62 6c 65 Data Ascii: e:!0,configurable:!0})},$.prototype.initEndsWithPoly=function(){String.prototype.endsWith\|\|Object.defineProperty(String.prototype,"endsWith",{value:function(e,t){return(void 0===t\|\|t>this.length)&&(t=this.length),this.substring(t-e.length,t)===e},writable
2024-02-08 18:36:23 UTC	1369	IN	Data Raw: 2e 69 6e 69 74 41 72 72 61 79 46 69 6c 6c 50 6f 6c 79 66 69 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6c 6c 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2c 22 66 69 6c 6c 22 2c 7b 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 6e 75 6c 6c 3d 3d 74 68 69 73 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 74 68 69 73 20 69 73 20 6e 75 6c 6c 20 6f 72 20 6e 6f 74 20 64 65 66 69 6e 65 64 22 29 3b 66 6f 72 28 76 61 72 20 74 3d 4f 62 6a 65 63 74 28 74 68 69 73 29 2c 6f 3d 74 2e 6c 65 6e 67 74 68 3e 3e 3e 30 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3e 3e 30 2c 72 3d 6e 3c 30 3f 4d 61 74 68 2e 6d 61 78 Data Ascii: .initArrayFillPolyfill=function(){Array.prototype.fill\|\|Object.defineProperty(Array.prototype,"fill",{value:function(e){if(null==this)throw new TypeError("this is null or not defined");for(var t=Object(this),o=t.length>>>0,n=arguments[1]>>0,r=n<0?Math.max
2024-02-08 18:36:23 UTC	1369	IN	Data Raw: 2e 43 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 69 6e 67 42 75 74 74 6f 6e 3d 36 5d 3d 22 43 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 69 6e 67 42 75 74 74 6f 6e 22 2c 28 65 3d 65 65 3d 65 65 7c 7c 7b 7d 29 5b 65 2e 42 61 6e 6e 65 72 3d 31 5d 3d 22 42 61 6e 6e 65 72 22 2c 65 5b 65 2e 50 43 3d 32 5d 3d 22 50 43 22 2c 65 5b 65 2e 41 50 49 3d 33 5d 3d 22 41 50 49 22 2c 28 65 3d 74 65 3d 74 65 7c 7c 7b 7d 29 2e 41 63 63 65 70 74 41 6c 6c 3d 22 41 63 63 65 70 74 41 6c 6c 22 2c 65 2e 52 65 6a 65 63 74 41 6c 6c 3d 22 52 65 6a 65 63 74 41 6c 6c 22 2c 65 2e 55 70 64 61 74 65 43 6f 6e 73 65 6e 74 3d 22 55 70 64 61 74 65 43 6f 6e 73 65 6e 74 22 2c 28 65 3d 6f 65 3d 6f 65 7c 7c 7b 7d 29 5b 65 2e 50 75 72 70 6f 73 65 3d 31 5d 3d 22 Data Ascii: .ContinueWithoutAcceptingButton=6]="ContinueWithoutAcceptingButton",(e=ee=ee\|\|{})[e.Banner=1]="Banner",e[e.PC=2]="PC",e[e.API=3]="API",(e=te=te\|\|{}).AcceptAll="AcceptAll",e.RejectAll="RejectAll",e.UpdateConsent="UpdateConsent",(e=oe=oe\|\|{})[e.Purpose=1]="
2024-02-08 18:36:23 UTC	1369	IN	Data Raw: 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 43 6f 6e 66 69 72 6d 22 5d 3d 36 5d 3d 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 43 6f 6e 66 69 72 6d 22 2c 28 65 3d 68 65 3d 68 65 7c 7c 7b 7d 29 2e 41 63 74 69 76 65 3d 22 31 22 2c 65 2e 49 6e 41 63 74 69 76 65 3d 22 30 22 2c 28 65 3d 67 65 3d 67 65 7c 7c 7b 7d 29 2e 48 6f 73 74 3d 22 48 6f 73 74 22 2c 65 2e 47 65 6e 56 65 6e 64 6f 72 3d 22 47 65 6e 56 65 6e 22 2c 28 65 3d 43 65 3d 43 65 7c 7c 7b 7d 29 5b 65 2e 48 6f 73 74 3d 31 5d 3d 22 48 6f 73 74 22 2c 65 5b 65 2e 47 65 6e 56 65 6e 3d 32 5d 3d 22 47 65 6e 56 65 6e 22 2c 65 5b 65 2e 48 6f 73 74 41 6e 64 47 65 6e 56 65 6e 3d 33 5d 3d 22 48 6f 73 74 41 6e 64 47 65 6e 56 65 6e 22 2c 28 65 3d 79 65 3d 79 65 7c 7c 7b 7d 29 5b 65 Data Ascii: reference Center - Confirm"]=6]="Preference Center - Confirm",(e=he=he\|\|{}).Active="1",e.InActive="0",(e=ge=ge\|\|{}).Host="Host",e.GenVendor="GenVen",(e=Ce=Ce\|\|{})[e.Host=1]="Host",e[e.GenVen=2]="GenVen",e[e.HostAndGenVen=3]="HostAndGenVen",(e=ye=ye\|\|{})[e
2024-02-08 18:36:23 UTC	1369	IN	Data Raw: 73 3d 22 76 65 6e 64 6f 72 73 22 2c 28 65 3d 5f 65 3d 5f 65 7c 7c 7b 7d 29 2e 47 44 50 52 3d 22 47 44 50 52 22 2c 65 2e 49 41 42 3d 22 49 41 42 22 2c 65 2e 43 43 50 41 3d 22 43 43 50 41 22 2c 65 2e 49 41 42 32 3d 22 49 41 42 32 22 2c 65 2e 47 45 4e 45 52 49 43 3d 22 47 45 4e 45 52 49 43 22 2c 65 2e 4c 47 50 44 3d 22 4c 47 50 44 22 2c 65 2e 47 45 4e 45 52 49 43 5f 50 52 4f 4d 50 54 3d 22 47 45 4e 45 52 49 43 5f 50 52 4f 4d 50 54 22 2c 65 2e 43 50 52 41 3d 22 43 50 52 41 22 2c 65 2e 43 44 50 41 3d 22 43 44 50 41 22 2c 65 2e 55 53 4e 41 54 49 4f 4e 41 4c 3d 22 55 53 4e 41 54 49 4f 4e 41 4c 22 2c 65 2e 43 55 53 54 4f 4d 3d 22 43 55 53 54 4f 4d 22 2c 65 2e 43 4f 4c 4f 52 41 44 4f 3d 22 43 4f 4c 4f 52 41 44 4f 22 2c 65 2e 43 4f 4e 4e 45 43 54 49 43 55 54 3d 22 Data Ascii: s="vendors",(e=_e=_e\|\|{}).GDPR="GDPR",e.IAB="IAB",e.CCPA="CCPA",e.IAB2="IAB2",e.GENERIC="GENERIC",e.LGPD="LGPD",e.GENERIC_PROMPT="GENERIC_PROMPT",e.CPRA="CPRA",e.CDPA="CDPA",e.USNATIONAL="USNATIONAL",e.CUSTOM="CUSTOM",e.COLORADO="COLORADO",e.CONNECTICUT="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
691	192.168.2.5	50542	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:23 UTC	583	OUT	GET /libs/asec/btmgmt/px.v7.5.3.min.js HTTP/1.1 Host: r.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://account.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:23 UTC	809	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 275294 Connection: close Server: nginx Date: Mon, 05 Feb 2024 17:31:44 GMT Last-Modified: Wed, 31 Jan 2024 09:24:57 GMT ETag: "65ba11e9-4335e" Expires: Wed, 06 Mar 2024 17:31:44 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 09aa283795aaafe63cbd7c2cbac2c306.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: BM-TaJSHr0RzKcWBWaY_ABjkcxdDHYY6buCwnh8Fge0usD9JnB9aKw== Age: 263079
2024-02-08 18:36:23 UTC	16384	IN	Data Raw: 2f 2f 20 40 6c 69 63 65 6e 73 65 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 32 30 31 34 2d 32 30 32 32 20 50 65 72 69 6d 65 74 65 72 58 2c 20 49 6e 63 20 28 77 77 77 2e 70 65 72 69 6d 65 74 65 72 78 2e 63 6f 6d 29 2e 20 20 43 6f 6e 74 65 6e 74 20 6f 66 20 74 68 69 73 20 66 69 6c 65 20 63 61 6e 20 6e 6f 74 20 62 65 20 63 6f 70 69 65 64 20 61 6e 64 2f 6f 72 20 64 69 73 74 72 69 62 75 74 65 64 2e 0a 74 72 79 7b 77 69 6e 64 6f 77 2e 5f 70 78 41 70 70 49 64 3d 22 50 58 69 6b 4b 75 4c 32 52 4d 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 26 26 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 3f 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d Data Ascii: // @license Copyright (C) 2014-2022 PerimeterX, Inc (www.perimeterx.com). Content of this file can not be copied and/or distributed.try{window._pxAppId="PXikKuL2RM",function(){function t(){return window.performance&&window.performance.now?window.perform
2024-02-08 18:36:23 UTC	16384	IN	Data Raw: 74 28 22 6f 6e 22 2b 65 2c 72 29 29 7d 63 61 74 63 68 28 74 29 7b 7d 64 65 28 6f 28 22 4e 47 42 62 64 77 52 4c 63 77 22 29 29 7d 66 75 6e 63 74 69 6f 6e 20 58 74 28 74 29 7b 72 65 74 75 72 6e 20 74 3f 74 2e 72 65 70 6c 61 63 65 28 2f 5c 73 7b 32 2c 31 30 30 7d 2f 67 2c 22 20 22 29 2e 72 65 70 6c 61 63 65 28 2f 5b 5c 72 5c 6e 5c 74 5d 2b 2f 67 2c 22 5c 6e 22 29 3a 22 22 7d 66 75 6e 63 74 69 6f 6e 20 57 74 28 74 29 7b 76 61 72 20 65 3d 5b 5d 3b 69 66 28 21 74 29 72 65 74 75 72 6e 20 65 3b 66 6f 72 28 76 61 72 20 6e 3d 74 2e 73 70 6c 69 74 28 22 5c 6e 22 29 2c 72 3d 76 6f 69 64 20 30 2c 6f 3d 6e 75 6c 6c 2c 69 3d 2f 5e 5c 73 2a 61 74 20 28 2e 2a 3f 29 20 3f 5c 28 3f 28 28 3f 3a 66 69 6c 65 3a 5c 2f 5c 2f 7c 68 74 74 70 73 3f 3a 5c 2f 5c 2f 7c 62 6c 6f 62 7c Data Ascii: t("on"+e,r))}catch(t){}de(o("NGBbdwRLcw"))}function Xt(t){return t?t.replace(/\s{2,100}/g," ").replace(/[\r\n\t]+/g,"\n"):""}function Wt(t){var e=[];if(!t)return e;for(var n=t.split("\n"),r=void 0,o=null,i=/^\sat (.?) ?\(?((?:file:\/\/\|https?:\/\/\|blob\|
2024-02-08 18:36:23 UTC	16384	IN	Data Raw: 49 63 67 22 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 64 6e 28 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 29 7d 2c 22 22 29 29 2c 78 65 28 6f 6c 2e 69 29 29 7b 61 65 28 65 28 22 4e 47 42 62 64 67 64 41 63 41 22 29 29 3b 76 61 72 20 72 3d 51 65 28 51 6c 29 3b 74 5b 65 28 22 4e 47 42 62 64 67 31 42 63 41 22 29 5d 3d 72 5b 4c 6c 5d 2c 74 5b 65 28 22 4e 47 42 62 64 67 31 4f 63 67 22 29 5d 3d 21 21 72 5b 5a 6c 5d 2c 74 65 28 74 2c 65 28 22 4e 47 42 62 64 67 4a 49 64 51 22 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 72 5b 6b 6c 5d 2e 63 61 6c 6c 28 74 68 69 73 2c 4f 62 6a 65 63 74 2e 67 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 28 79 75 29 2c 4a 6c 29 3b 69 66 28 74 29 72 65 74 75 72 Data Ascii: Icg"),function(){return dn(Object.prototype.hasOwnProperty)},"")),xe(ol.i)){ae(e("NGBbdgdAcA"));var r=Qe(Ql);t[e("NGBbdg1BcA")]=r[Ll],t[e("NGBbdg1Ocg")]=!!r[Zl],te(t,e("NGBbdgJIdQ"),function(){var t=r[kl].call(this,Object.getPrototypeOf(yu),Jl);if(t)retur
2024-02-08 18:36:23 UTC	15118	IN	Data Raw: 69 66 28 4d 72 28 29 29 7b 76 61 72 20 69 3d 52 72 28 29 2c 63 3d 69 26 26 69 5b 6f 28 22 4e 47 42 62 64 77 64 4d 22 29 5d 3b 63 26 26 63 28 74 2c 65 2c 72 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 54 72 28 74 2c 65 2c 72 2c 6f 29 7b 76 61 72 20 69 3d 6e 2c 63 3d 52 72 28 29 2c 61 3d 63 26 26 63 5b 69 28 22 4e 47 42 64 63 41 41 22 29 5d 3b 61 26 26 61 28 74 2c 65 2c 72 2c 6f 29 7d 66 75 6e 63 74 69 6f 6e 20 4d 72 28 29 7b 72 65 74 75 72 6e 20 54 69 28 29 3d 3d 3d 56 73 7d 66 75 6e 63 74 69 6f 6e 20 52 72 28 29 7b 76 61 72 20 74 3d 55 72 28 29 3b 72 65 74 75 72 6e 20 4e 75 5b 74 5d 7d 66 75 6e 63 74 69 6f 6e 20 50 72 28 29 7b 76 61 72 20 74 3d 6e 2c 65 3d 47 72 28 29 3b 72 65 74 75 72 6e 20 65 3d 3d 3d 74 28 22 4e 47 42 62 64 67 4a 41 65 67 22 29 7c 7c 65 3d 3d Data Ascii: if(Mr()){var i=Rr(),c=i&&i[o("NGBbdwdM")];c&&c(t,e,r)}}function Tr(t,e,r,o){var i=n,c=Rr(),a=c&&c[i("NGBdcAA")];a&&a(t,e,r,o)}function Mr(){return Ti()===Vs}function Rr(){var t=Ur();return Nu[t]}function Pr(){var t=n,e=Gr();return e===t("NGBbdgJAeg")\|\|e==
2024-02-08 18:36:23 UTC	16384	IN	Data Raw: 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 65 2c 7b 76 61 6c 75 65 3a 6e 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 74 5b 65 5d 3d 6e 2c 74 7d 66 75 6e 63 74 69 6f 6e 20 69 63 28 74 2c 65 2c 72 2c 6f 29 7b 74 72 79 7b 69 66 28 21 74 7c 7c 21 65 7c 7c 21 72 26 26 21 6f 7c 7c 2d 31 21 3d 3d 42 28 6a 62 2c 74 29 29 72 65 74 75 72 6e 3b 69 66 28 6a 62 2e 70 75 73 68 28 74 29 2c 72 26 26 76 75 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 28 72 29 2e 6c 65 6e 67 74 68 3e 30 29 72 65 74 75 72 6e 3b 69 66 28 6f 26 26 76 75 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 6f 29 2e 6c 65 6e 67 74 68 3e 30 29 72 65 74 75 72 6e 3b 76 61 Data Ascii: defineProperty(t,e,{value:n,enumerable:!0,configurable:!0,writable:!0}):t[e]=n,t}function ic(t,e,r,o){try{if(!t\|\|!e\|\|!r&&!o\|\|-1!==B(jb,t))return;if(jb.push(t),r&&vu.getElementsByName(r).length>0)return;if(o&&vu.getElementsByClassName(o).length>0)return;va
2024-02-08 18:36:23 UTC	16384	IN	Data Raw: 69 7d 66 75 6e 63 74 69 6f 6e 20 67 64 28 74 29 7b 72 65 74 75 72 6e 21 31 3d 3d 3d 74 5b 58 67 5d 7d 66 75 6e 63 74 69 6f 6e 20 62 64 28 74 29 7b 69 66 28 5a 6d 21 3d 3d 74 29 7b 53 74 28 74 29 28 76 75 2c 22 63 6c 69 63 6b 22 2c 6c 64 29 2c 5a 6d 3d 74 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 64 28 29 7b 74 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 62 64 28 21 30 29 7d 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 64 28 74 2c 65 2c 6e 29 7b 72 65 74 75 72 6e 20 65 20 69 6e 20 74 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 65 2c 7b 76 61 6c 75 65 3a 6e 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 74 5b 65 5d 3d 6e 2c 74 7d 66 75 6e 63 74 69 6f 6e 20 68 Data Ascii: i}function gd(t){return!1===t[Xg]}function bd(t){if(Zm!==t){St(t)(vu,"click",ld),Zm=t}}function pd(){tt(function(){bd(!0)})}function md(t,e,n){return e in t?Object.defineProperty(t,e,{value:n,enumerable:!0,configurable:!0,writable:!0}):t[e]=n,t}function h
2024-02-08 18:36:23 UTC	16384	IN	Data Raw: 69 6f 6e 20 63 74 28 74 29 7b 76 61 72 20 72 3d 6e 3b 69 66 28 74 5b 61 74 5d 29 72 65 74 75 72 6e 20 74 5b 61 74 5d 3b 76 61 72 20 66 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 72 3d 6e 3b 4a 28 22 66 30 78 34 30 39 66 63 35 36 61 22 29 3b 76 61 72 20 66 3d 69 74 28 74 29 3b 69 66 28 74 5b 72 28 22 35 49 4b 57 68 59 6d 42 6f 59 69 42 69 59 47 4b 6b 41 22 29 5d 29 7b 76 61 72 20 6f 3d 66 74 28 74 5b 72 28 22 66 52 73 50 48 42 41 59 4f 42 45 59 45 42 67 54 43 51 22 29 5d 5b 72 28 22 73 39 54 57 78 2f 4c 48 78 38 48 61 30 63 62 48 31 67 22 29 5d 28 22 73 72 63 22 29 7c 7c 72 28 22 43 57 68 72 5a 6e 78 39 4d 32 74 6c 61 47 64 69 22 29 29 2c 61 3d 66 74 28 74 5b 72 28 22 62 51 6b 43 44 68 67 41 43 41 4d 5a 22 29 5d 5b 72 28 22 6a 65 2f 73 2f 75 6a 59 Data Ascii: ion ct(t){var r=n;if(t[at])return t[at];var f=function(t){var r=n;J("f0x409fc56a");var f=it(t);if(t[r("5IKWhYmBoYiBiYGKkA")]){var o=ft(t[r("fRsPHBAYOBEYEBgTCQ")][r("s9TWx/LHx8Ha0cbH1g")]("src")\|\|r("CWhrZnx9M2tlaGdi")),a=ft(t[r("bQkCDhgACAMZ")][r("je/s/ujY
2024-02-08 18:36:23 UTC	16384	IN	Data Raw: 39 31 31 34 29 3a 6f 7d 63 61 74 63 68 28 6e 29 7b 50 28 6e 2c 31 36 29 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 4f 66 28 6e 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 66 29 7b 72 3d 66 75 6e 63 74 69 6f 6e 28 6e 2c 74 29 7b 76 61 72 20 72 3d 7b 7d 3b 72 2e 66 30 78 37 30 61 33 39 31 31 34 3d 6e 2c 74 26 26 28 72 2e 66 30 78 32 34 66 37 63 62 31 3d 74 29 3b 72 65 74 75 72 6e 20 72 7d 28 72 2c 66 29 3b 74 72 79 7b 6e 2e 73 65 74 49 74 65 6d 28 74 2c 4c 6e 28 55 72 28 72 29 29 29 7d 63 61 74 63 68 28 6e 29 7b 50 28 6e 2c 31 37 29 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 57 66 28 6e 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 72 79 7b 6e 2e 72 65 6d 6f 76 65 49 74 65 6d 28 46 66 28 74 29 29 7d 63 61 74 63 68 28 6e 29 7b 50 Data Ascii: 9114):o}catch(n){P(n,16)}}}function Of(n){return function(t,r,f){r=function(n,t){var r={};r.f0x70a39114=n,t&&(r.f0x24f7cb1=t);return r}(r,f);try{n.setItem(t,Ln(Ur(r)))}catch(n){P(n,17)}}}function Wf(n){return function(t){try{n.removeItem(Ff(t))}catch(n){P
2024-02-08 18:36:23 UTC	16384	IN	Data Raw: 6f 6e 28 6e 29 7b 63 61 3d 21 30 2c 75 61 3d 6e 7d 2c 65 6e 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 72 3d 6e 2c 66 3d 7b 74 6e 3a 7b 4a 3a 74 2c 50 3a 21 30 2c 54 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 69 66 28 63 61 29 7b 4a 28 22 66 30 78 37 32 62 62 31 63 61 36 22 29 3b 76 61 72 20 72 3d 7b 69 6e 3a 76 74 28 74 29 2c 56 3a 6e 2e 56 7d 2c 66 3d 46 6f 28 22 66 30 78 35 34 37 61 31 62 33 34 22 2c 22 66 30 78 37 35 31 66 34 35 39 61 22 2c 72 2c 45 6e 29 3b 66 26 26 66 28 76 61 2e 62 69 6e 64 28 6e 2e 59 2c 6e 2e 5a 2c 72 29 29 2c 42 28 22 66 30 78 37 32 62 62 31 63 61 36 22 29 7d 7d 7d 7d 3b 4f 74 28 74 5b 72 28 22 4c 57 6c 43 54 6c 68 41 53 45 4e 5a 22 29 5d 2c 72 28 22 75 4e 76 58 31 39 50 52 33 51 22 29 2c 66 29 7d 2c 63 6e 3a 66 75 6e 63 74 Data Ascii: on(n){ca=!0,ua=n},en:function(t){var r=n,f={tn:{J:t,P:!0,T:function(n){if(ca){J("f0x72bb1ca6");var r={in:vt(t),V:n.V},f=Fo("f0x547a1b34","f0x751f459a",r,En);f&&f(va.bind(n.Y,n.Z,r)),B("f0x72bb1ca6")}}}};Ot(t[r("LWlCTlhASENZ")],r("uNvX19PR3Q"),f)},cn:funct
2024-02-08 18:36:23 UTC	16384	IN	Data Raw: 2c 6e 7d 28 29 2c 6f 65 3d 6e 65 77 20 24 61 28 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6a 6f 28 6e 29 7d 29 29 2c 5a 6e 3d 6e 65 77 20 57 65 61 6b 4d 61 70 2c 42 6e 3d 30 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 6e 3b 53 74 3d 41 6e 28 74 28 22 44 55 4a 76 5a 32 68 75 65 53 4e 71 61 48 6c 43 65 6d 4e 64 66 32 4a 39 61 48 39 35 64 45 6c 6f 66 6d 35 2f 5a 48 31 35 59 6e 38 22 29 29 2c 6a 74 3d 41 6e 28 74 28 22 68 63 72 6e 37 2b 44 6d 38 61 76 68 34 4f 50 73 36 2b 44 56 39 2b 72 31 34 50 66 78 2f 41 22 29 29 2c 45 74 28 46 75 6e 63 74 69 6f 6e 2c 74 28 22 6c 2b 50 34 78 4f 50 6c 2f 76 6e 77 22 29 2c 7b 54 3a 51 74 7d 29 7d 28 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 6e 3d 30 3b 6e 3c 66 65 2e 6c 65 6e 67 74 68 3b 6e 2b 2b Data Ascii: ,n}(),oe=new $a((function(n){jo(n)})),Zn=new WeakMap,Bn=0,function(){var t=n;St=An(t("DUJvZ2hueSNqaHlCemNdf2J9aH95dElofm5/ZH15Yn8")),jt=An(t("hcrn7+Dm8avh4OPs6+DV9+r14Pfx/A")),Et(Function,t("l+P4xOPl/vnw"),{T:Qt})}(),function(){for(var n=0;n<fe.length;n++

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
692	192.168.2.5	50541	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:23 UTC	599	OUT	GET /static/img/favicon.svg HTTP/1.1 Host: xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:23 UTC	797	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-Length: 1197 Connection: close Server: nginx Date: Sun, 21 Jan 2024 12:36:07 GMT Last-Modified: Tue, 21 Mar 2023 13:15:52 GMT ETag: "6419ae08-4ad" Expires: Tue, 20 Feb 2024 12:36:07 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 f588325f7617672d954c4267c8bee1ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 8cNCQ3Gfy5hG8F-pNpQt61N_Ih9ZXDvDvCioLmalMSjKp2o1g2avNw== Age: 1576816
2024-02-08 18:36:23 UTC	1197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0a 3c 21 2d 2d 20 4c 6f 76 69 6e 67 6c 79 20 65 78 70 6f 72 74 65 64 20 62 79 20 4a 65 73 73 20 53 74 75 62 65 6e 62 6f 72 64 20 66 6f 72 20 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 69 6e 20 41 6d 73 74 65 72 64 61 6d 20 31 36 2d 30 33 2d 32 30 32 33 20 2d 2d 3e 0a 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 69 64 3d 22 62 64 6f 74 2d 66 61 76 69 63 6f 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 78 3d 22 30 70 78 22 20 79 3d 22 30 70 78 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?>... Lovingly exported by Jess Stubenbord for Booking.com in Amsterdam 16-03-2023 --><svg version="1.1" id="bdot-favicon" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
693	192.168.2.5	50544	3.161.150.72	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:23 UTC	3439	OUT	GET /js-track?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA HTTP/1.1 Host: account.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_ap_lang=en-us; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417379065; bkng_ap=U2FsdGVkX19%2FWj7MIxTQoew6fVzm%2FavdeeT6w7Tou9chqgq42LIpRPd4nN%2B0lIRr6YV3VFQvOPJJ%0A%2FMglth7v%2BQ%3D%3D%0A; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXbnXawFhv%2Bov5qX2t%2BkjDX%2FSNhQS8UMKXEgF7SbTMk5lZRjRk40eE9ZIStvqAVmgL%2Fkvzh5mdRnhcUtlo5tJUKE0vMfULCoEeprAELqi%2FDgNs1lACo93R0nAlWUa3%2BA7gG0DsR2aw5zKj4nbG7Xq7OwI%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJzZXNzaW9ucyI6W10sImRhdGFfc3ViamVjdF9pZCI6ImU1MmRjZDUxLTY5OWItNDVlOC04MDcwLTdjYzkxYTU3MzU2YiJ9fQ
2024-02-08 18:36:23 UTC	2028	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:23 GMT allow: POST content-security-policy: frame-ancestors https://.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=200a82d30431004a&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgQ7uy0HoGirSz-5LBDvsXKeGljkYRlL1sTRiJYIU1RcL content-security-policy-report-only: base-uri 'none'; connect-src saa.booking.com secure.booking.com reports.booking.com privacyportal-eu.onetrust.com geolocation.onetrust.com cdn.cookielaw.org www.google-analytics.com .perimeterx.net .pxchk.net .px-cdn.net .px-client.net .px-cloud.net 'self' 'report-sample'; default-src .bstatic.com bstatic.com 'self'; frame-src https://www.youtube.com/embed/Vv4w5SmRkss .bstatic.com https://www.google.com bstatic.com www.booking.com secure.booking.com paymentcomponent.booking.com 'self'; img-src 'self' data: www.booking.com graph.facebook.com cdn.cookielaw.org account.booking.com .bstatic.com bstatic.com .static.booking.cn www.google-analytics.com www.google.com stats.g.doubleclick.net .px-cloud.net .perimeterx.net www.gstatic.com; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=213&pid=200a82d30431004a&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgQ7uy0HoGirSz-5LBDvsXKeGljkYRlL1sTRiJYIU1RcL; script-src saa.booking.com .bstatic.com bstatic.com .static.booking.cn www.google.com www.google-analytics.com cdn.cookielaw.org geolocation.onetrust.com 'self' 'nonce-b7D0G4EqAbJQ3h3' 'report-sample'; style-src .bstatic.com bstatic.com .static.booking.cn 'self' 'unsafe-inline' x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Error from cloudfront Via: 1.1 5f78e55d372ee583de2e188ca26950e8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P5 X-Amz-Cf-Id: -ykDOuBoC6EPCcd5mKLpZlhB82yut3vcbClDqzGU8kE6Mg4HYpcCjg==
2024-02-08 18:36:23 UTC	1621	IN	Data Raw: 36 34 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 2d 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 Data Ascii: 64e<!DOCTYPE html><html lang="en"><head><title>405 - Method Not Allowed</title><meta http-equiv="content-type" content="text/html; charset=utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta http-equiv="X-UA-Compat
2024-02-08 18:36:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
694	192.168.2.5	50543	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:23 UTC	389	OUT	GET /backend_static/common/flags/new/48-squared/us.png HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:23 UTC	768	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 642 Connection: close Server: nginx Date: Mon, 05 Feb 2024 18:29:08 GMT Last-Modified: Mon, 07 Sep 2020 10:40:08 GMT ETag: "5f560e08-282" Expires: Wed, 06 Mar 2024 18:29:08 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 f588325f7617672d954c4267c8bee1ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: tTc1ywZ9-xcNJks5rIrDVvqVfZ4M55DYMvCjJ5Nsx_FgJNmZs1OQ0g== Age: 259635
2024-02-08 18:36:23 UTC	642	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 08 03 00 00 00 60 dc 09 b5 00 00 00 75 50 4c 54 45 b4 1f 30 3c 39 70 b4 1f 30 97 27 40 ff ff ff b4 1f 30 3c 3a 70 d0 73 7d 54 53 82 ec c7 cb e3 ab b1 61 5f 8b 48 46 79 6d 6b 94 49 46 79 be 3b 49 91 90 ae c2 c2 d2 79 78 9c 85 84 a6 48 47 79 9d 9c b7 aa a9 c0 b6 b5 c9 c7 57 64 f3 f3 f6 db da e4 ce cd db 96 26 40 e7 e7 ed 6d 6b 93 9e 9d b7 ce ce db a1 47 5e b5 b5 c9 9e 9c b8 c0 a4 b4 b7 87 9a ae 6c 81 d6 1f 19 b1 00 00 00 04 74 52 4e 53 df bf bf bf 3b 25 6a 12 00 00 01 b8 49 44 41 54 48 c7 8c d4 61 93 94 30 0c 06 60 d4 f5 35 9a 14 4b 69 41 38 d9 dd bb 53 ff ff 4f b4 79 b9 b9 ce c0 ce 68 3e 3c d3 81 09 34 a4 a1 fb f0 1f f1 e9 63 8b 0e 30 83 87 50 6d eb 76 e5 e7 e7 16 1d fa 69 10 bc 89 69 Data Ascii: PNGIHDR00`uPLTE0<9p0'@0<:ps}TSa_HFymkIFy;IyxHGyWd&@mkG^ltRNS;%jIDATHa0`5KiA8SOyh><4c0Pmvii

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
695	192.168.2.5	50546	13.32.208.75	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:23 UTC	4369	OUT	POST /js-metric?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA HTTP/1.1 Host: account.booking.com Connection: keep-alive Content-Length: 49 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://account.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/sign-in?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_ap_lang=en-us; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417379065; bkng_ap=U2FsdGVkX19%2FWj7MIxTQoew6fVzm%2FavdeeT6w7Tou9chqgq42LIpRPd4nN%2B0lIRr6YV3VFQvOPJJ%0A%2FMglth7v%2BQ%3D%3D%0A; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXbnXawFhv%2Bov5qX2t%2BkjDX%2FSNhQS8UMKXEgF7SbTMk5lZRjRk40eE9ZIStvqAVmgL%2Fkvzh5mdRnhcUtlo5tJUKE0vMfULCoEeprAELqi%2FDgNs1lACo93R0nAlWUa3%2BA7gG0DsR2aw5zKj4nbG7Xq7OwI%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJzZXNzaW9ucyI6W10sImRhdGFfc3ViamVjdF9pZCI6ImU1MmRjZDUxLTY5OWItNDVlOC04MDcwLTdjYzkxYTU3MzU2YiJ9fQ
2024-02-08 18:36:23 UTC	49	OUT	Data Raw: 7b 22 70 61 74 68 22 3a 22 61 75 74 68 5f 66 75 6e 6e 65 6c 2f 69 6e 74 65 72 61 63 74 69 6f 6e 2f 73 69 67 6e 69 6e 2f 64 65 73 6b 74 6f 70 22 7d Data Ascii: {"path":"auth_funnel/interaction/signin/desktop"}
2024-02-08 18:36:23 UTC	2987	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:23 GMT content-security-policy: base-uri 'none'; frame-ancestors https://.booking.com https://.booking.cn; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=block&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMlertjpTp0dBkoiU97ub-lntLbh6x__iwZQ692sYmt83IR_Y7Nz6ELR-OYm3GXQ25TwNbaO3oaA0; script-src 'report-sample' 'nonce-i0f1rhaLsUfzduM' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com content-security-policy-report-only: connect-src 'self' .perimeterx.net .px-cdn.net .px-client.net .px-cloud.net .pxchk.net .token.awswaf.com cdn.cookielaw.org geolocation.onetrust.com privacyportal-eu.onetrust.com saa.booking.com secure.booking.com www.google-analytics.com; default-src 'self' .bstatic.com bstatic.com; frame-src .booking.com .bstatic.com bstatic.com paymentcomponent.booking.com secure.booking.com www.booking.com; img-src 'self' data: .bstatic.com .perimeterx.net .px-cloud.net .static.booking.cn account.booking.com bstatic.com cdn.cookielaw.org graph.facebook.com stats.g.doubleclick.net www.booking.com www.google-analytics.com www.google.com www.gstatic.com; report-uri https://nellie.booking.com/csp-report-uri?type=report&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMlertjpTp0dBkoiU97ub-lntLbh6x__iwZQ692sYmt83IR_Y7Nz6ELR-OYm3GXQ25TwNbaO3oaA0; script-src 'report-sample' 'nonce-i0f1rhaLsUfzduM' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com; style-src 'self' 'unsafe-inline' .bstatic.com *.static.booking.cn bstatic.com set-cookie: bkng_sso_session=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:23 GMT; secure; HttpOnly set-cookie: bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJlNTJkY2Q1MS02OTliLTQ1ZTgtODA3MC03Y2M5MWE1NzM1NmIiLCJzZXNzaW9ucyI6W119fQ; domain=account.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:23 GMT; SameSite=Lax; secure; HttpOnly set-cookie: bkng_sso_ses=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:23 GMT; secure; HttpOnly x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 7154e2f13d02d1cc12281ca90f1bd47e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD66-C1 X-Amz-Cf-Id: EhxGo8viUIgchghQ9PN3eXQ8CJ69O1hVZ6nUqrL2FYamJqdv0_EQNQ==
2024-02-08 18:36:23 UTC	17	IN	Data Raw: 63 0d 0a 7b 22 72 65 73 75 6c 74 22 3a 31 7d 0d 0a Data Ascii: c{"result":1}
2024-02-08 18:36:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
696	192.168.2.5	50545	13.32.208.75	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:23 UTC	4369	OUT	POST /js-metric?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA HTTP/1.1 Host: account.booking.com Connection: keep-alive Content-Length: 76 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://account.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/sign-in?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_ap_lang=en-us; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417379065; bkng_ap=U2FsdGVkX19%2FWj7MIxTQoew6fVzm%2FavdeeT6w7Tou9chqgq42LIpRPd4nN%2B0lIRr6YV3VFQvOPJJ%0A%2FMglth7v%2BQ%3D%3D%0A; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXbnXawFhv%2Bov5qX2t%2BkjDX%2FSNhQS8UMKXEgF7SbTMk5lZRjRk40eE9ZIStvqAVmgL%2Fkvzh5mdRnhcUtlo5tJUKE0vMfULCoEeprAELqi%2FDgNs1lACo93R0nAlWUa3%2BA7gG0DsR2aw5zKj4nbG7Xq7OwI%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJzZXNzaW9ucyI6W10sImRhdGFfc3ViamVjdF9pZCI6ImU1MmRjZDUxLTY5OWItNDVlOC04MDcwLTdjYzkxYTU3MzU2YiJ9fQ
2024-02-08 18:36:23 UTC	76	OUT	Data Raw: 7b 22 70 61 74 68 22 3a 22 61 75 74 68 5f 66 75 6e 6e 65 6c 5f 6c 6f 67 69 6e 5f 6c 69 6e 6b 2f 64 65 73 6b 74 6f 70 2f 69 6e 64 65 78 2f 74 72 61 76 65 6c 6c 65 72 5f 68 65 61 64 65 72 2f 69 6e 74 65 72 61 63 74 69 6f 6e 22 7d Data Ascii: {"path":"auth_funnel_login_link/desktop/index/traveller_header/interaction"}
2024-02-08 18:36:23 UTC	2987	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:23 GMT content-security-policy: base-uri 'none'; frame-ancestors https://.booking.com https://.booking.cn; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=block&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMlertjpTp0dBkoiU97ub-lntLbh6x__iwZQ692sYmt83a63dYxm4wkUFovnqG5w5mgiBH_SGmQLU; script-src 'report-sample' 'nonce-jPw4H0x4kodUbSf' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com content-security-policy-report-only: connect-src 'self' .perimeterx.net .px-cdn.net .px-client.net .px-cloud.net .pxchk.net .token.awswaf.com cdn.cookielaw.org geolocation.onetrust.com privacyportal-eu.onetrust.com saa.booking.com secure.booking.com www.google-analytics.com; default-src 'self' .bstatic.com bstatic.com; frame-src .booking.com .bstatic.com bstatic.com paymentcomponent.booking.com secure.booking.com www.booking.com; img-src 'self' data: .bstatic.com .perimeterx.net .px-cloud.net .static.booking.cn account.booking.com bstatic.com cdn.cookielaw.org graph.facebook.com stats.g.doubleclick.net www.booking.com www.google-analytics.com www.google.com www.gstatic.com; report-uri https://nellie.booking.com/csp-report-uri?type=report&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMlertjpTp0dBkoiU97ub-lntLbh6x__iwZQ692sYmt83a63dYxm4wkUFovnqG5w5mgiBH_SGmQLU; script-src 'report-sample' 'nonce-jPw4H0x4kodUbSf' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com; style-src 'self' 'unsafe-inline' .bstatic.com *.static.booking.cn bstatic.com set-cookie: bkng_sso_session=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:23 GMT; secure; HttpOnly set-cookie: bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJlNTJkY2Q1MS02OTliLTQ1ZTgtODA3MC03Y2M5MWE1NzM1NmIiLCJzZXNzaW9ucyI6W119fQ; domain=account.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:23 GMT; SameSite=Lax; secure; HttpOnly set-cookie: bkng_sso_ses=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:23 GMT; secure; HttpOnly x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 bc90ecfdcecca714ae795dbc461f470c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD66-C1 X-Amz-Cf-Id: 1fvCszBTPzPrhuhes53XMa3nJHUCdKWXhDoZeg0Prg9hNIyYH3XIEA==
2024-02-08 18:36:23 UTC	17	IN	Data Raw: 63 0d 0a 7b 22 72 65 73 75 6c 74 22 3a 31 7d 0d 0a Data Ascii: c{"result":1}
2024-02-08 18:36:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
697	192.168.2.5	50548	13.32.208.75	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:23 UTC	4368	OUT	POST /js-track?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA HTTP/1.1 Host: account.booking.com Connection: keep-alive Content-Length: 60 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://account.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/sign-in?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_ap_lang=en-us; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417379065; bkng_ap=U2FsdGVkX19%2FWj7MIxTQoew6fVzm%2FavdeeT6w7Tou9chqgq42LIpRPd4nN%2B0lIRr6YV3VFQvOPJJ%0A%2FMglth7v%2BQ%3D%3D%0A; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXbnXawFhv%2Bov5qX2t%2BkjDX%2FSNhQS8UMKXEgF7SbTMk5lZRjRk40eE9ZIStvqAVmgL%2Fkvzh5mdRnhcUtlo5tJUKE0vMfULCoEeprAELqi%2FDgNs1lACo93R0nAlWUa3%2BA7gG0DsR2aw5zKj4nbG7Xq7OwI%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJzZXNzaW9ucyI6W10sImRhdGFfc3ViamVjdF9pZCI6ImU1MmRjZDUxLTY5OWItNDVlOC04MDcwLTdjYzkxYTU3MzU2YiJ9fQ
2024-02-08 18:36:23 UTC	60	OUT	Data Raw: 7b 22 69 64 22 3a 22 64 44 66 50 44 58 62 61 54 61 54 61 42 61 4d 59 54 46 58 53 41 56 63 55 4a 44 4b 65 22 2c 22 74 79 70 65 22 3a 22 65 74 73 22 2c 22 76 61 6c 75 65 22 3a 37 7d Data Ascii: {"id":"dDfPDXbaTaTaBaMYTFXSAVcUJDKe","type":"ets","value":7}
2024-02-08 18:36:23 UTC	2987	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:23 GMT content-security-policy: base-uri 'none'; frame-ancestors https://.booking.com https://.booking.cn; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=block&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMlertjpTp0dBkoiU97ub-lntLbh6x__iwLUXNyXeayYUBn1TYh9MZPV1j3ZEiZfFtredkvri9Mp8; script-src 'report-sample' 'nonce-R2K6EgW7PZuVNhF' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com content-security-policy-report-only: connect-src 'self' .perimeterx.net .px-cdn.net .px-client.net .px-cloud.net .pxchk.net .token.awswaf.com cdn.cookielaw.org geolocation.onetrust.com privacyportal-eu.onetrust.com saa.booking.com secure.booking.com www.google-analytics.com; default-src 'self' .bstatic.com bstatic.com; frame-src .booking.com .bstatic.com bstatic.com paymentcomponent.booking.com secure.booking.com www.booking.com; img-src 'self' data: .bstatic.com .perimeterx.net .px-cloud.net .static.booking.cn account.booking.com bstatic.com cdn.cookielaw.org graph.facebook.com stats.g.doubleclick.net www.booking.com www.google-analytics.com www.google.com www.gstatic.com; report-uri https://nellie.booking.com/csp-report-uri?type=report&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMlertjpTp0dBkoiU97ub-lntLbh6x__iwLUXNyXeayYUBn1TYh9MZPV1j3ZEiZfFtredkvri9Mp8; script-src 'report-sample' 'nonce-R2K6EgW7PZuVNhF' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com; style-src 'self' 'unsafe-inline' .bstatic.com *.static.booking.cn bstatic.com set-cookie: bkng_sso_ses=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:23 GMT; secure; HttpOnly set-cookie: bkng_sso_session=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:23 GMT; secure; HttpOnly set-cookie: bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJlNTJkY2Q1MS02OTliLTQ1ZTgtODA3MC03Y2M5MWE1NzM1NmIiLCJzZXNzaW9ucyI6W119fQ; domain=account.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:23 GMT; SameSite=Lax; secure; HttpOnly x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 f63a9bb4aae02f02eec90d4f5c360d60.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD66-C1 X-Amz-Cf-Id: WIlVI06VUX9tP2CP-lvGh47HwYL0uVpYXs3e0jhRrQfdDVeCMSRg7g==
2024-02-08 18:36:23 UTC	17	IN	Data Raw: 63 0d 0a 7b 22 72 65 73 75 6c 74 22 3a 31 7d 0d 0a Data Ascii: c{"result":1}
2024-02-08 18:36:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
698	192.168.2.5	50547	13.32.208.75	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:23 UTC	4368	OUT	POST /js-track?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA HTTP/1.1 Host: account.booking.com Connection: keep-alive Content-Length: 61 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://account.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/sign-in?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_ap_lang=en-us; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417379065; bkng_ap=U2FsdGVkX19%2FWj7MIxTQoew6fVzm%2FavdeeT6w7Tou9chqgq42LIpRPd4nN%2B0lIRr6YV3VFQvOPJJ%0A%2FMglth7v%2BQ%3D%3D%0A; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXbnXawFhv%2Bov5qX2t%2BkjDX%2FSNhQS8UMKXEgF7SbTMk5lZRjRk40eE9ZIStvqAVmgL%2Fkvzh5mdRnhcUtlo5tJUKE0vMfULCoEeprAELqi%2FDgNs1lACo93R0nAlWUa3%2BA7gG0DsR2aw5zKj4nbG7Xq7OwI%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJzZXNzaW9ucyI6W10sImRhdGFfc3ViamVjdF9pZCI6ImU1MmRjZDUxLTY5OWItNDVlOC04MDcwLTdjYzkxYTU3MzU2YiJ9fQ
2024-02-08 18:36:23 UTC	61	OUT	Data Raw: 7b 22 69 64 22 3a 22 64 44 66 50 44 58 62 61 54 61 54 61 42 61 4d 59 54 46 58 53 41 56 63 55 4a 44 4b 65 22 2c 22 74 79 70 65 22 3a 22 65 74 63 67 22 2c 22 76 61 6c 75 65 22 3a 33 7d Data Ascii: {"id":"dDfPDXbaTaTaBaMYTFXSAVcUJDKe","type":"etcg","value":3}
2024-02-08 18:36:23 UTC	2987	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:23 GMT content-security-policy: base-uri 'none'; frame-ancestors https://.booking.com https://.booking.cn; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=block&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMlertjpTp0dBkoiU97ub-lntLbh6x__iwLUXNyXeayYV6_-X6JCWKGN4DzBJBUjHF2dc--y3tjXs; script-src 'report-sample' 'nonce-bwsteZBfqeJLEvt' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com content-security-policy-report-only: connect-src 'self' .perimeterx.net .px-cdn.net .px-client.net .px-cloud.net .pxchk.net .token.awswaf.com cdn.cookielaw.org geolocation.onetrust.com privacyportal-eu.onetrust.com saa.booking.com secure.booking.com www.google-analytics.com; default-src 'self' .bstatic.com bstatic.com; frame-src .booking.com .bstatic.com bstatic.com paymentcomponent.booking.com secure.booking.com www.booking.com; img-src 'self' data: .bstatic.com .perimeterx.net .px-cloud.net .static.booking.cn account.booking.com bstatic.com cdn.cookielaw.org graph.facebook.com stats.g.doubleclick.net www.booking.com www.google-analytics.com www.google.com www.gstatic.com; report-uri https://nellie.booking.com/csp-report-uri?type=report&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMlertjpTp0dBkoiU97ub-lntLbh6x__iwLUXNyXeayYV6_-X6JCWKGN4DzBJBUjHF2dc--y3tjXs; script-src 'report-sample' 'nonce-bwsteZBfqeJLEvt' 'strict-dynamic' 'unsafe-eval' 'unsafe-hashes' 'sha256-kDPclFJFa/cNUGjyb73Olq+78jkIsu1rN4zPFoE3YaY=' 'sha256-tgo/x/FZ7h93dD78jEbhg4dXrRyROp1eZvekoHdStrw=' 'self' 'unsafe-inline' .bstatic.com .static.booking.cn bstatic.com cdn.cookielaw.org geolocation.onetrust.com saa.booking.com www.google-analytics.com; style-src 'self' 'unsafe-inline' .bstatic.com *.static.booking.cn bstatic.com set-cookie: bkng_sso_ses=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:23 GMT; secure; HttpOnly set-cookie: bkng_sso_session=e30; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:23 GMT; secure; HttpOnly set-cookie: bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJlNTJkY2Q1MS02OTliLTQ1ZTgtODA3MC03Y2M5MWE1NzM1NmIiLCJzZXNzaW9ucyI6W119fQ; domain=account.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:23 GMT; SameSite=Lax; secure; HttpOnly x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 7154e2f13d02d1cc12281ca90f1bd47e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD66-C1 X-Amz-Cf-Id: 3wksv1aD5z9tKfnBeBH-XSLxg4o_HOzdit7nQtgcfRLv2sh2jRDvlw==
2024-02-08 18:36:23 UTC	17	IN	Data Raw: 63 0d 0a 7b 22 72 65 73 75 6c 74 22 3a 31 7d 0d 0a Data Ascii: c{"result":1}
2024-02-08 18:36:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
699	192.168.2.5	50549	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:23 UTC	717	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 1149 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:23 UTC	1149	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 36 39 37 39 39 62 31 2d 62 32 62 32 2d 34 30 66 38 2d 38 65 36 66 2d 32 38 30 39 62 39 63 36 66 31 61 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 33 35 65 63 30 35 31 32 2d 39 33 38 65 2d 34 64 63 65 2d 38 38 39 63 2d 63 61 30 61 39 62 37 38 65 37 62 65 22 2c 22 73 73 22 3a 22 30 32 34 37 38 38 37 34 2d 61 32 37 37 2d 34 36 35 63 2d 62 39 65 37 2d 63 65 32 34 31 32 32 33 32 65 34 66 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"f69799b1-b2b2-40f8-8e6f-2809b9c6f1a0","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"35ec0512-938e-4dce-889c-ca0a9b78e7be","ss":"02478874-a277-465c-b9e7-ce2412232e4f","bg":true,"s
2024-02-08 18:36:23 UTC	523	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:23 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
700	192.168.2.5	50551	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:23 UTC	717	OUT	POST /p HTTP/1.1 Host: tr.snapchat.com Connection: keep-alive Content-Length: 1150 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:23 UTC	1150	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 36 39 37 39 39 62 31 2d 62 32 62 32 2d 34 30 66 38 2d 38 65 36 66 2d 32 38 30 39 62 39 63 36 66 31 61 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 33 36 63 61 65 62 33 30 2d 37 32 33 32 2d 34 37 36 61 2d 39 37 33 33 2d 32 32 36 63 65 32 62 34 61 33 62 37 22 2c 22 73 73 22 3a 22 30 32 34 37 38 38 37 34 2d 61 32 37 37 2d 34 36 35 63 2d 62 39 65 37 2d 63 65 32 34 31 32 32 33 32 65 34 66 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"f69799b1-b2b2-40f8-8e6f-2809b9c6f1a0","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"36caeb30-7232-476a-9733-226ce2b4a3b7","ss":"02478874-a277-465c-b9e7-ce2412232e4f","bg":true,"s
2024-02-08 18:36:23 UTC	523	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:23 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
701	192.168.2.5	50552	3.161.150.72	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:23 UTC	3440	OUT	GET /js-metric?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA HTTP/1.1 Host: account.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_ap_lang=en-us; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; bkng_ap=U2FsdGVkX19%2FWj7MIxTQoew6fVzm%2FavdeeT6w7Tou9chqgq42LIpRPd4nN%2B0lIRr6YV3VFQvOPJJ%0A%2FMglth7v%2BQ%3D%3D%0A; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXbnXawFhv%2Bov5qX2t%2BkjDX%2FSNhQS8UMKXEgF7SbTMk5lZRjRk40eE9ZIStvqAVmgL%2Fkvzh5mdRnhcUtlo5tJUKE0vMfULCoEeprAELqi%2FDgNs1lACo93R0nAlWUa3%2BA7gG0DsR2aw5zKj4nbG7Xq7OwI%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJzZXNzaW9ucyI6W10sImRhdGFfc3ViamVjdF9pZCI6ImU1MmRjZDUxLTY5OWItNDVlOC04MDcwLTdjYzkxYTU3MzU2YiJ9fQ; lastSeen=1707417382595
2024-02-08 18:36:23 UTC	2028	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:23 GMT allow: POST content-security-policy: frame-ancestors https://.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=601482d30116115d&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgcqlyvtE53jUReOowkwvWgdnFghPAeIf-Gl7u2frTD9J content-security-policy-report-only: base-uri 'none'; connect-src saa.booking.com secure.booking.com reports.booking.com privacyportal-eu.onetrust.com geolocation.onetrust.com cdn.cookielaw.org www.google-analytics.com .perimeterx.net .pxchk.net .px-cdn.net .px-client.net .px-cloud.net 'self' 'report-sample'; default-src .bstatic.com bstatic.com 'self'; frame-src https://www.youtube.com/embed/Vv4w5SmRkss .bstatic.com https://www.google.com bstatic.com www.booking.com secure.booking.com paymentcomponent.booking.com 'self'; img-src 'self' data: www.booking.com graph.facebook.com cdn.cookielaw.org account.booking.com .bstatic.com bstatic.com .static.booking.cn www.google-analytics.com www.google.com stats.g.doubleclick.net .px-cloud.net .perimeterx.net www.gstatic.com; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=213&pid=601482d30116115d&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgcqlyvtE53jUReOowkwvWgdnFghPAeIf-Gl7u2frTD9J; script-src saa.booking.com .bstatic.com bstatic.com .static.booking.cn www.google.com www.google-analytics.com cdn.cookielaw.org geolocation.onetrust.com 'self' 'nonce-wevfBP2Hgr0gB6C' 'report-sample'; style-src .bstatic.com bstatic.com .static.booking.cn 'self' 'unsafe-inline' x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Error from cloudfront Via: 1.1 f2e8d9fac4aa59028883db592f3b2594.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P5 X-Amz-Cf-Id: WePUli9cjDN08f1XLej16m1Jc5MffNMo16az6rIcFS3jeRzN5bOQOw==
2024-02-08 18:36:23 UTC	1621	IN	Data Raw: 36 34 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 2d 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 Data Ascii: 64e<!DOCTYPE html><html lang="en"><head><title>405 - Method Not Allowed</title><meta http-equiv="content-type" content="text/html; charset=utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta http-equiv="X-UA-Compat
2024-02-08 18:36:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
702	192.168.2.5	50550	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:23 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive Content-Length: 3110 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:23 UTC	3110	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 71 32 36 43 78 35 67 41 41 41 41 41 3a 56 2b 67 32 71 54 71 72 55 43 37 34 42 42 48 46 42 54 77 5a 33 33 4d 62 4d 58 38 2b 71 6f 6f 56 66 6c 59 79 36 2b 4b 76 53 4b 45 59 54 50 63 43 30 39 49 49 50 6a 62 70 47 51 30 34 55 6d 76 54 65 6e 77 53 65 76 4b 50 32 4d 59 69 47 62 71 71 5a 79 71 30 78 74 79 64 6c 49 6c 2b 62 79 38 39 6f 54 77 47 41 4d 4c 2f 75 6b 41 47 4d 56 34 61 41 6a 51 4a 33 57 30 39 34 59 35 2f 66 4b 57 4a 75 32 43 61 51 2b 6c 64 56 2f 55 58 34 67 33 6b 66 34 65 67 6e 44 4e 44 59 53 62 33 59 42 76 57 74 47 65 61 32 74 44 4f 34 30 30 68 43 69 4e 65 35 4b 68 46 52 30 Data Ascii: {"existing_token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAq26Cx5gAAAAA:V+g2qTqrUC74BBHFBTwZ33MbMX8+qooVflYy6+KvSKEYTPcC09IIPjbpGQ04UmvTenwSevKP2MYiGbqqZyq0xtydlIl+by89oTwGAML/ukAGMV4aAjQJ3W094Y5/fKWJu2CaQ+ldV/UX4g3kf4egnDNDYSb3YBvWtGea2tDO400hCiNe5KhFR0
2024-02-08 18:36:23 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1653 Connection: close Vary: Accept-Encoding Date: Thu, 08 Feb 2024 18:36:23 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65c51f27-53c702773ce67df13c1129b2 X-Cache: Miss from cloudfront Via: 1.1 4a050b98a443ca2d3af477f9b4dc39ae.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: p2BV7XQ33MLBwejnQU0anE1H6Htd0JaGWwFpl7h6tcPrH98slNlKBQ==
2024-02-08 18:36:23 UTC	1653	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 66 6b 36 42 56 4a 55 6a 41 41 41 41 3a 57 44 66 58 67 32 72 79 2b 48 76 62 6e 78 54 7a 74 4c 6e 65 70 46 76 68 66 33 64 70 58 34 53 64 51 66 4d 34 47 63 7a 52 72 63 50 77 36 4d 57 41 5a 48 38 4d 45 72 6e 2b 61 66 32 59 39 53 76 41 74 73 37 79 53 6a 4d 2f 54 39 6e 43 51 57 61 78 54 57 4a 2b 45 43 53 52 59 41 44 43 67 47 46 70 36 67 38 6e 77 71 41 41 70 34 75 5a 75 65 73 62 6e 50 4e 4d 42 39 56 57 4d 4d 54 52 2f 36 4f 71 70 69 46 49 31 6c 6d 36 63 38 48 54 58 30 65 74 38 75 54 5a 54 44 76 45 6f 76 55 70 65 2f 5a 4a 50 6a 2b 45 76 6e 5a 77 70 4c 31 68 64 71 39 4e 4b 68 46 7a 46 5a 62 36 6e 6b 31 6b 63 79 77 Data Ascii: {"token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAfk6BVJUjAAAA:WDfXg2ry+HvbnxTztLnepFvhf3dpX4SdQfM4GczRrcPw6MWAZH8MErn+af2Y9SvAts7ySjM/T9nCQWaxTWJ+ECSRYADCgGFp6g8nwqAAp4uZuesbnPNMB9VWMMTR/6OqpiFI1lm6c8HTX0et8uTZTDvEovUpe/ZJPj+EvnZwpL1hdq9NKhFzFZb6nk1kcyw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
703	192.168.2.5	50554	104.18.32.137	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:23 UTC	380	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:23 UTC	249	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:36:23 GMT Content-Type: text/javascript Content-Length: 79 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8525fa589bf712da-ATL
2024-02-08 18:36:23 UTC	79	IN	Data Raw: 6a 73 6f 6e 46 65 65 64 28 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 47 41 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 47 65 6f 72 67 69 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d 29 3b Data Ascii: jsonFeed({"country":"US","state":"GA","stateName":"Georgia","continent":"NA"});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
704	192.168.2.5	50553	104.18.130.236	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:23 UTC	427	OUT	GET /consent/a387750c-a080-4dd0-b2d1-7dbdb601bb14/a387750c-a080-4dd0-b2d1-7dbdb601bb14.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:23 UTC	902	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:36:23 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8525fa58bc517bd0-ATL CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 35659 Cache-Control: public, max-age=86400 Expires: Fri, 09 Feb 2024 18:36:23 GMT Last-Modified: Fri, 02 Feb 2024 16:31:18 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: 0+JgRsdjEhmuq1b70Gr11w== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 8a187bef-601e-0074-43f5-550d73000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-02-08 18:36:23 UTC	467	IN	Data Raw: 31 61 30 39 0d 0a 7b 22 43 6f 6f 6b 69 65 53 50 41 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 53 61 6d 65 53 69 74 65 4e 6f 6e 65 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 56 32 43 53 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 4d 75 6c 74 69 56 61 72 69 61 6e 74 54 65 73 74 69 6e 67 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 55 73 65 56 32 22 3a 74 72 75 65 2c 22 4d 6f 62 69 6c 65 53 44 4b 22 3a 66 61 6c 73 65 2c 22 53 6b 69 70 47 65 6f 6c 6f 63 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 53 63 72 69 70 74 54 79 70 65 22 3a 22 50 52 4f 44 55 43 54 49 4f 4e 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 32 30 32 33 30 35 2e 31 2e 30 22 2c 22 4f 70 74 61 6e 6f 6e 44 61 74 61 4a 53 4f 4e 22 3a 22 61 33 38 37 Data Ascii: 1a09{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":false,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202305.1.0","OptanonDataJSON":"a387
2024-02-08 18:36:23 UTC	1369	IN	Data Raw: 74 22 3a 5b 7b 22 49 64 22 3a 22 39 37 37 38 66 34 61 62 2d 36 62 34 61 2d 34 65 30 33 2d 62 64 66 38 2d 38 36 61 35 63 30 33 37 63 34 62 66 22 2c 22 4e 61 6d 65 22 3a 22 55 53 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 75 73 22 5d 2c 22 53 74 61 74 65 73 22 3a 7b 7d 2c 22 4c 61 6e 67 75 61 67 65 53 77 69 74 63 68 65 72 50 6c 61 63 65 68 6f 6c 64 65 72 22 3a 7b 22 6e 6f 22 3a 22 6e 6f 22 2c 22 68 69 22 3a 22 68 69 22 2c 22 64 65 22 3a 22 64 65 22 2c 22 72 75 22 3a 22 72 75 22 2c 22 66 69 22 3a 22 66 69 22 2c 22 65 6e 2d 55 53 22 3a 22 65 6e 2d 55 53 22 2c 22 62 67 22 3a 22 62 67 22 2c 22 6c 74 22 3a 22 6c 74 22 2c 22 6c 76 22 3a 22 6c 76 22 2c 22 68 72 22 3a 22 68 72 22 2c 22 66 72 22 3a 22 66 72 22 2c 22 68 75 22 3a 22 68 75 22 2c 22 64 65 66 61 75 Data Ascii: t":[{"Id":"9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf","Name":"US","Countries":["us"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","en-US":"en-US","bg":"bg","lt":"lt","lv":"lv","hr":"hr","fr":"fr","hu":"hu","defau
2024-02-08 18:36:23 UTC	1369	IN	Data Raw: 2d 48 61 6e 74 22 2c 22 75 6b 22 3a 22 75 6b 22 2c 22 73 6b 22 3a 22 73 6b 22 2c 22 73 6c 22 3a 22 73 6c 22 2c 22 69 64 22 3a 22 69 64 22 2c 22 63 61 22 3a 22 63 61 22 2c 22 73 72 22 3a 22 73 72 22 2c 22 73 76 22 3a 22 73 76 22 2c 22 6b 6f 22 3a 22 6b 6f 22 2c 22 70 74 2d 42 52 22 3a 22 70 74 2d 42 52 22 2c 22 6d 73 22 3a 22 6d 73 22 2c 22 65 6c 22 3a 22 65 6c 22 2c 22 69 73 22 3a 22 69 73 22 2c 22 69 74 22 3a 22 69 74 22 2c 22 65 73 2d 4d 58 22 3a 22 65 73 2d 4d 58 22 2c 22 65 73 22 3a 22 65 73 22 2c 22 7a 68 22 3a 22 7a 68 22 2c 22 65 74 22 3a 22 65 74 22 2c 22 63 73 22 3a 22 63 73 22 2c 22 61 72 22 3a 22 61 72 22 2c 22 70 74 2d 50 54 22 3a 22 70 74 2d 50 54 22 2c 22 76 69 22 3a 22 76 69 22 2c 22 74 68 22 3a 22 74 68 22 2c 22 65 73 2d 41 52 22 3a 22 65 Data Ascii: -Hant","uk":"uk","sk":"sk","sl":"sl","id":"id","ca":"ca","sr":"sr","sv":"sv","ko":"ko","pt-BR":"pt-BR","ms":"ms","el":"el","is":"is","it":"it","es-MX":"es-MX","es":"es","zh":"zh","et":"et","cs":"cs","ar":"ar","pt-PT":"pt-PT","vi":"vi","th":"th","es-AR":"e
2024-02-08 18:36:23 UTC	1369	IN	Data Raw: 63 61 22 2c 22 73 72 22 2c 22 63 63 22 2c 22 73 73 22 2c 22 63 64 22 2c 22 73 74 22 2c 22 63 66 22 2c 22 73 76 22 2c 22 63 67 22 2c 22 73 78 22 2c 22 63 68 22 2c 22 63 69 22 2c 22 73 79 22 2c 22 73 7a 22 2c 22 63 6b 22 2c 22 63 6c 22 2c 22 63 6d 22 2c 22 63 6f 22 2c 22 63 72 22 2c 22 74 63 22 2c 22 74 64 22 2c 22 74 66 22 2c 22 63 75 22 2c 22 74 67 22 2c 22 63 76 22 2c 22 63 77 22 2c 22 74 68 22 2c 22 63 78 22 2c 22 74 6a 22 2c 22 74 6b 22 2c 22 74 6c 22 2c 22 74 6d 22 2c 22 74 6e 22 2c 22 74 6f 22 2c 22 74 72 22 2c 22 74 74 22 2c 22 74 76 22 2c 22 74 77 22 2c 22 64 6a 22 2c 22 74 7a 22 2c 22 64 6d 22 2c 22 64 6f 22 2c 22 75 61 22 2c 22 75 67 22 2c 22 64 7a 22 2c 22 75 6d 22 2c 22 65 63 22 2c 22 65 67 22 2c 22 65 68 22 2c 22 75 79 22 2c 22 75 7a 22 2c 22 Data Ascii: ca","sr","cc","ss","cd","st","cf","sv","cg","sx","ch","ci","sy","sz","ck","cl","cm","co","cr","tc","td","tf","cu","tg","cv","cw","th","cx","tj","tk","tl","tm","tn","to","tr","tt","tv","tw","dj","tz","dm","do","ua","ug","dz","um","ec","eg","eh","uy","uz","
2024-02-08 18:36:23 UTC	1369	IN	Data Raw: 74 22 3a 74 72 75 65 2c 22 47 6c 6f 62 61 6c 22 3a 74 72 75 65 2c 22 54 79 70 65 22 3a 22 47 44 50 52 22 2c 22 55 73 65 47 6f 6f 67 6c 65 56 65 6e 64 6f 72 73 22 3a 66 61 6c 73 65 2c 22 56 61 72 69 61 6e 74 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 54 65 73 74 45 6e 64 54 69 6d 65 22 3a 6e 75 6c 6c 2c 22 56 61 72 69 61 6e 74 73 22 3a 5b 5d 2c 22 54 65 6d 70 6c 61 74 65 4e 61 6d 65 22 3a 22 43 75 73 74 6f 6d 65 72 20 2d 20 41 63 63 65 70 74 2f 44 65 63 6c 69 6e 65 22 2c 22 43 6f 6e 64 69 74 69 6f 6e 73 22 3a 5b 5d 2c 22 47 43 45 6e 61 62 6c 65 22 3a 66 61 6c 73 65 2c 22 49 73 47 50 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 7d 5d 2c 22 49 61 62 44 61 74 61 22 3a 7b 22 63 6f 6f 6b 69 65 56 65 72 73 69 6f 6e 22 3a 22 31 22 2c 22 63 72 65 61 74 65 64 Data Ascii: t":true,"Global":true,"Type":"GDPR","UseGoogleVendors":false,"VariantEnabled":false,"TestEndTime":null,"Variants":[],"TemplateName":"Customer - Accept/Decline","Conditions":[],"GCEnable":false,"IsGPPEnabled":false}],"IabData":{"cookieVersion":"1","created
2024-02-08 18:36:23 UTC	730	IN	Data Raw: 65 73 22 3a 7b 22 43 6f 6f 6b 69 65 56 32 42 61 6e 6e 65 72 46 6f 63 75 73 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 50 43 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 41 73 73 69 67 6e 54 65 6d 70 6c 61 74 65 52 75 6c 65 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6f 6c 6f 63 61 74 69 6f 6e 4a 73 6f 6e 41 70 69 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 43 4d 44 4d 41 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 54 43 46 32 31 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 52 65 6d 6f 76 65 53 65 74 74 69 6e 67 73 49 63 6f 6e 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 42 61 6e 6e 65 72 4c 6f 67 6f 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6e 65 72 61 6c 56 65 6e 64 6f 72 73 22 3a 74 72 75 65 2c 22 43 6f Data Ascii: es":{"CookieV2BannerFocus":true,"CookieV2GPC":true,"CookieV2AssignTemplateRule":true,"CookieV2GeolocationJsonApi":true,"CookieV2GCMDMA":true,"CookieV2TCF21":true,"CookieV2RemoveSettingsIcon":true,"CookieV2BannerLogo":true,"CookieV2GeneralVendors":true,"Co
2024-02-08 18:36:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
705	192.168.2.5	50555	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:23 UTC	599	OUT	GET /static/img/favicon.ico HTTP/1.1 Host: xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:23 UTC	772	IN	HTTP/1.1 200 OK Content-Type: image/x-icon Content-Length: 610 Connection: close Server: nginx Date: Sun, 21 Jan 2024 10:44:37 GMT Last-Modified: Tue, 21 Mar 2023 13:15:51 GMT ETag: "6419ae07-262" Expires: Tue, 20 Feb 2024 10:44:37 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 5988b4ae4648c0fec3c60a3cca580092.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: bR1ySKww_kAWfPm_WNleIKuzXlA99Cu6Ie-ylwVr5qmOkm_9UAs2Vg== Age: 1583506
2024-02-08 18:36:23 UTC	610	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 02 29 49 44 41 54 58 85 d5 97 3f 4c 1a 61 18 c6 7f 77 31 b0 1c 82 c9 0d 12 13 4b 53 89 9d 5a 18 ba 68 4d 8c 5d a4 8b ba d0 c1 10 b1 63 5d ba 52 17 16 db b9 31 76 a3 68 4c 17 bb c0 74 53 5b 5b aa 8b 83 d0 cd 48 83 31 69 5d 18 6c 64 b1 21 b1 03 70 70 78 fc b9 e3 e0 d2 67 e3 7b 73 f7 fc ee 7d bf ef 21 9f 40 4d d3 5b e3 c0 2e 30 05 0c d1 1f 95 81 43 20 c2 c1 da 39 80 50 35 0f 03 1f fa 68 ac 07 b2 cc c1 da 9e 50 fd f2 9f 03 34 6f 84 b8 27 52 69 fb a0 cd a9 7a ee 8a 54 66 6e 97 a6 44 ec f9 fa 9a 86 ba 32 f7 79 5d f8 46 87 35 6b fb c7 bf ac 21 e8 c6 3c 9b 7c 86 5b 72 e8 d6 d3 99 02 f1 f7 47 64 4f 8b a6 00 c4 76 45 8f e4 24 f5 26 d4 d2 1c 60 61 e6 2e fb 9b 8b Data Ascii: PNGIHDR szz)IDATX?Law1KSZhM]c]R1vhLtS[[H1i]ld!ppxg{s}!@M[.0C 9P5hP4o'RizTfnD2y]F5k!<\|[rGdOvE$&`a.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
706	192.168.2.5	50556	18.67.65.100	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:23 UTC	404	OUT	GET /d8c14d4960ca/c2181391033f/verify HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:24 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Thu, 08 Feb 2024 18:36:23 GMT X-Cache: Error from cloudfront Via: 1.1 bfba2464a75a65b0c6568afe15f68b4c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: YYuy1y8Nzn8HuNBx3lpVH_S-CvOWUx2MzMp6w3CMghiHy88NzX7ZtA==
2024-02-08 18:36:24 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
707	192.168.2.5	50557	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:23 UTC	360	OUT	GET /static/img/favicon.svg HTTP/1.1 Host: xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:24 UTC	797	IN	HTTP/1.1 200 OK Content-Type: image/svg+xml Content-Length: 1197 Connection: close Server: nginx Date: Sun, 21 Jan 2024 12:36:07 GMT Last-Modified: Tue, 21 Mar 2023 13:15:52 GMT ETag: "6419ae08-4ad" Expires: Tue, 20 Feb 2024 12:36:07 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 31341771a4bfa40d7b1f61883ffb56c6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: BvN_nvfBT1HCbp_pp9j4BTKlonDl8JkhQgZi0uO6cD8e94V-CPlacQ== Age: 1576817
2024-02-08 18:36:24 UTC	1197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0a 3c 21 2d 2d 20 4c 6f 76 69 6e 67 6c 79 20 65 78 70 6f 72 74 65 64 20 62 79 20 4a 65 73 73 20 53 74 75 62 65 6e 62 6f 72 64 20 66 6f 72 20 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 69 6e 20 41 6d 73 74 65 72 64 61 6d 20 31 36 2d 30 33 2d 32 30 32 33 20 2d 2d 3e 0a 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 69 64 3d 22 62 64 6f 74 2d 66 61 76 69 63 6f 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 78 3d 22 30 70 78 22 20 79 3d 22 30 70 78 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?>... Lovingly exported by Jess Stubenbord for Booking.com in Amsterdam 16-03-2023 --><svg version="1.1" id="bdot-favicon" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
708	192.168.2.5	50558	13.32.208.75	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:23 UTC	4434	OUT	POST /navigation_times?sid=&pid=8fbf82d0042700d2&nts=0,1,1707417375247,0,0,1707417375251,1707417376098,1707417376098,1707417376098,1707417376098,1707417376098,1707417376098,0,1707417376103,1707417376574,1707417376933,1707417376583,1707417379976,1707417379976,1707417379990,1707417382025,1707417382025,1707417382026,0&first=&cdn=cf&dc=4&bo=3&lang=en-us&ref_action=Signin_Index&aid=304142&stype=&route=&ua=&ch=&lt= HTTP/1.1 Host: account.booking.com Connection: keep-alive Content-Length: 8 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/x-www-form-urlencoded X-Booking-CSRF: sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://account.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/sign-in?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_ap_lang=en-us; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; bkng_ap=U2FsdGVkX19%2FWj7MIxTQoew6fVzm%2FavdeeT6w7Tou9chqgq42LIpRPd4nN%2B0lIRr6YV3VFQvOPJJ%0A%2FMglth7v%2BQ%3D%3D%0A; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXbnXawFhv%2Bov5qX2t%2BkjDX%2FSNhQS8UMKXEgF7SbTMk5lZRjRk40eE9ZIStvqAVmgL%2Fkvzh5mdRnhcUtlo5tJUKE0vMfULCoEeprAELqi%2FDgNs1lACo93R0nAlWUa3%2BA7gG0DsR2aw5zKj4nbG7Xq7OwI%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJzZXNzaW9ucyI6W10sImRhdGFfc3ViamVjdF9pZCI6ImU1MmRjZDUxLTY5OWItNDVlOC04MDcwLTdjYzkxYTU3MzU2YiJ9fQ; lastSeen=1707417382595; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAZ/yB4ssWAAAA:7lFnQqmYWJ7p7DZtJNv+oFlvd12/w6itSlACDWcL4oXY/uaqDPYrqMYNRD09TQUO6/kcmEjW2mFd10raBlSeUsZJYlVo7BoiMT4zTRAoz5jIKiazydlkVJgL7XaYPF2fjYWLlmJNpmOoRhPG+6rh3gkyxVHdm8KzObMQxycSoMQ+/Q+rs2Ix1ovUhdXYUv2/gbY3fdQ4CD5sUmFKy/0fSMQOpP0=
2024-02-08 18:36:23 UTC	8	OUT	Data Raw: 75 74 69 6d 69 6e 67 3d Data Ascii: utiming=
2024-02-08 18:36:24 UTC	2003	IN	HTTP/1.1 202 Accepted Content-Type: image/jpeg Content-Length: 0 Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:24 GMT content-security-policy: frame-ancestors https://.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=ab7382d4047201b6&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgfuR0e-iymiWdq6DtsFT8A4N8KSyKAAQzVA7cgt-NPTB2_t0ffzNXl4 content-security-policy-report-only: base-uri 'none'; connect-src saa.booking.com secure.booking.com reports.booking.com privacyportal-eu.onetrust.com geolocation.onetrust.com cdn.cookielaw.org www.google-analytics.com .perimeterx.net .pxchk.net .px-cdn.net .px-client.net .px-cloud.net 'self' 'report-sample'; default-src .bstatic.com bstatic.com 'self'; frame-src https://www.youtube.com/embed/Vv4w5SmRkss .bstatic.com https://www.google.com bstatic.com www.booking.com secure.booking.com paymentcomponent.booking.com 'self'; img-src 'self' data: www.booking.com graph.facebook.com cdn.cookielaw.org account.booking.com .bstatic.com bstatic.com .static.booking.cn www.google-analytics.com www.google.com stats.g.doubleclick.net .px-cloud.net .perimeterx.net www.gstatic.com; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=213&pid=ab7382d4047201b6&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgfuR0e-iymiWdq6DtsFT8A4N8KSyKAAQzVA7cgt-NPTB2_t0ffzNXl4; script-src saa.booking.com .bstatic.com bstatic.com .static.booking.cn www.google.com www.google-analytics.com cdn.cookielaw.org geolocation.onetrust.com 'self' 'nonce-IjQfKGJm5qT6XG9' 'report-sample'; style-src .bstatic.com bstatic.com .static.booking.cn 'self' 'unsafe-inline' x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 076da3643179565aba2eda873738d6b6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD66-C1 X-Amz-Cf-Id: zMrfb6b0NgOuLncTZCxCYFouT0VIxUVnHRCF9gPkRk9U2fbdz7iU4w==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
709	192.168.2.5	50559	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:24 UTC	682	OUT	POST /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive Content-Length: 2267 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://account.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:24 UTC	2267	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 5a 2f 79 42 34 73 73 57 41 41 41 41 3a 37 6c 46 6e 51 71 6d 59 57 4a 37 70 37 44 5a 74 4a 4e 76 2b 6f 46 6c 76 64 31 32 2f 77 36 69 74 53 6c 41 43 44 57 63 4c 34 6f 58 59 2f 75 61 71 44 50 59 72 71 4d 59 4e 52 44 30 39 54 51 55 4f 36 2f 6b 63 6d 45 6a 57 32 6d 46 64 31 30 72 61 42 6c 53 65 55 73 5a 4a 59 6c 56 6f 37 42 6f 69 4d 54 34 7a 54 52 41 6f 7a 35 6a 49 4b 69 61 7a 79 64 6c 6b 56 4a 67 4c 37 58 61 59 50 46 32 66 6a 59 57 4c 6c 6d 4a 4e 70 6d 4f 6f 52 68 50 47 2b 36 72 68 33 67 6b 79 78 56 48 64 6d 38 4b 7a 4f 62 4d 51 78 79 63 53 6f 4d 51 2b 2f 51 2b 72 73 32 49 78 31 6f Data Ascii: {"existing_token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAZ/yB4ssWAAAA:7lFnQqmYWJ7p7DZtJNv+oFlvd12/w6itSlACDWcL4oXY/uaqDPYrqMYNRD09TQUO6/kcmEjW2mFd10raBlSeUsZJYlVo7BoiMT4zTRAoz5jIKiazydlkVJgL7XaYPF2fjYWLlmJNpmOoRhPG+6rh3gkyxVHdm8KzObMQxycSoMQ+/Q+rs2Ix1o
2024-02-08 18:36:24 UTC	585	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 868 Connection: close Date: Thu, 08 Feb 2024 18:36:24 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65c51f28-692590be3f13b642517ecab7 X-Cache: Miss from cloudfront Via: 1.1 040f8a2cdffe1cf7a35d28e06c3ed574.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: zM0GW29uu3o2xspYhfBYLx8h-FLZh_V9Lr1yeSY5RYjtKZsBdFPUqg==
2024-02-08 18:36:24 UTC	868	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 74 71 69 43 73 72 30 43 41 41 41 41 3a 43 75 30 42 76 75 48 72 51 59 4e 35 41 44 45 75 7a 5a 66 47 30 56 69 2f 44 30 4a 58 67 6f 67 47 61 67 4f 58 2f 4d 73 6c 6b 37 4c 58 4c 65 78 70 2f 62 31 72 55 54 62 69 75 4c 5a 4e 6f 69 66 6b 67 55 4d 56 75 37 72 43 73 44 41 4c 78 4b 74 41 50 73 41 6f 70 46 62 45 6f 62 63 36 49 2b 57 4d 7a 6a 58 2f 48 63 6f 66 39 59 67 58 6a 59 5a 52 58 76 50 32 54 42 39 6f 4e 69 32 2f 58 41 74 4b 51 46 75 6d 47 56 43 44 68 32 32 43 41 71 35 58 66 43 33 65 52 59 6b 61 39 47 6c 39 41 56 79 56 6b 58 44 4b 4b 59 75 66 38 53 33 76 57 43 30 2b 79 54 68 4e 54 55 67 76 48 65 55 33 76 62 58 Data Ascii: {"token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAtqiCsr0CAAAA:Cu0BvuHrQYN5ADEuzZfG0Vi/D0JXgogGagOX/Mslk7LXLexp/b1rUTbiuLZNoifkgUMVu7rCsDALxKtAPsAopFbEobc6I+WMzjX/Hcof9YgXjYZRXvP2TB9oNi2/XAtKQFumGVCDh22CAq5XfC3eRYka9Gl9AVyVkXDKKYuf8S3vWC0+yThNTUgvHeU3vbX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
710	192.168.2.5	50560	3.161.150.72	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:24 UTC	3439	OUT	GET /js-track?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA HTTP/1.1 Host: account.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_ap_lang=en-us; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; bkng_ap=U2FsdGVkX19%2FWj7MIxTQoew6fVzm%2FavdeeT6w7Tou9chqgq42LIpRPd4nN%2B0lIRr6YV3VFQvOPJJ%0A%2FMglth7v%2BQ%3D%3D%0A; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXbnXawFhv%2Bov5qX2t%2BkjDX%2FSNhQS8UMKXEgF7SbTMk5lZRjRk40eE9ZIStvqAVmgL%2Fkvzh5mdRnhcUtlo5tJUKE0vMfULCoEeprAELqi%2FDgNs1lACo93R0nAlWUa3%2BA7gG0DsR2aw5zKj4nbG7Xq7OwI%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJzZXNzaW9ucyI6W10sImRhdGFfc3ViamVjdF9pZCI6ImU1MmRjZDUxLTY5OWItNDVlOC04MDcwLTdjYzkxYTU3MzU2YiJ9fQ; lastSeen=1707417382595
2024-02-08 18:36:24 UTC	2028	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:24 GMT allow: POST content-security-policy: frame-ancestors https://.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=57ea82d403f1059a&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgQ7uy0HoGirS3HuUk5flxD3A-WQniBGK6vqzxjm30y4L content-security-policy-report-only: base-uri 'none'; connect-src saa.booking.com secure.booking.com reports.booking.com privacyportal-eu.onetrust.com geolocation.onetrust.com cdn.cookielaw.org www.google-analytics.com .perimeterx.net .pxchk.net .px-cdn.net .px-client.net .px-cloud.net 'self' 'report-sample'; default-src .bstatic.com bstatic.com 'self'; frame-src https://www.youtube.com/embed/Vv4w5SmRkss .bstatic.com https://www.google.com bstatic.com www.booking.com secure.booking.com paymentcomponent.booking.com 'self'; img-src 'self' data: www.booking.com graph.facebook.com cdn.cookielaw.org account.booking.com .bstatic.com bstatic.com .static.booking.cn www.google-analytics.com www.google.com stats.g.doubleclick.net .px-cloud.net .perimeterx.net www.gstatic.com; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=213&pid=57ea82d403f1059a&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgQ7uy0HoGirS3HuUk5flxD3A-WQniBGK6vqzxjm30y4L; script-src saa.booking.com .bstatic.com bstatic.com .static.booking.cn www.google.com www.google-analytics.com cdn.cookielaw.org geolocation.onetrust.com 'self' 'nonce-sQL5E9ImiTJrEnP' 'report-sample'; style-src .bstatic.com bstatic.com .static.booking.cn 'self' 'unsafe-inline' x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Error from cloudfront Via: 1.1 e9b0912bfb25a87d9798160f6315bd3a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P5 X-Amz-Cf-Id: EKcRRqlocn9-SgpHCrKN5Bep0KHIIQufakyNnwo2MfIY92Pb1mh8Pg==
2024-02-08 18:36:24 UTC	1621	IN	Data Raw: 36 34 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 2d 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 Data Ascii: 64e<!DOCTYPE html><html lang="en"><head><title>405 - Method Not Allowed</title><meta http-equiv="content-type" content="text/html; charset=utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta http-equiv="X-UA-Compat
2024-02-08 18:36:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
711	192.168.2.5	50561	104.18.131.236	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:24 UTC	645	OUT	GET /consent/a387750c-a080-4dd0-b2d1-7dbdb601bb14/9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf/en-us.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://account.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:24 UTC	901	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:36:24 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8525fa5bddbe53de-ATL CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 7393 Cache-Control: public, max-age=86400 Expires: Fri, 09 Feb 2024 18:36:24 GMT Last-Modified: Fri, 02 Feb 2024 16:31:40 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: k5rB685rNBgtKMPUY0Zs1w== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 65f8e57a-c01e-007d-0bf5-5548a0000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-02-08 18:36:24 UTC	468	IN	Data Raw: 37 63 31 61 0d 0a 7b 22 44 6f 6d 61 69 6e 44 61 74 61 22 3a 7b 22 70 63 6c 69 66 65 53 70 61 6e 59 72 22 3a 22 59 65 61 72 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 59 72 73 22 3a 22 59 65 61 72 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 53 65 63 73 22 3a 22 41 20 66 65 77 20 73 65 63 6f 6e 64 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 22 3a 22 57 65 65 6b 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 73 22 3a 22 57 65 65 6b 73 22 2c 22 70 63 63 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 54 65 78 74 22 3a 22 43 6f 6e 74 69 6e 75 65 20 77 69 74 68 6f 75 74 20 41 63 63 65 70 74 69 6e 67 22 2c 22 70 63 63 6c 6f 73 65 42 75 74 74 6f 6e 54 79 70 65 22 3a 22 49 63 6f 6e 22 2c 22 4d 61 69 6e 54 65 78 74 22 3a 22 4d 61 6e 61 67 65 20 79 6f 75 72 Data Ascii: 7c1a{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","pccloseButtonType":"Icon","MainText":"Manage your
2024-02-08 18:36:24 UTC	1369	IN	Data Raw: 69 65 73 54 65 78 74 22 3a 22 59 6f 75 72 20 50 72 69 76 61 63 79 22 2c 22 43 6f 6e 66 69 72 6d 54 65 78 74 22 3a 22 41 6c 6c 6f 77 20 41 6c 6c 22 2c 22 41 6c 6c 6f 77 41 6c 6c 54 65 78 74 22 3a 22 53 61 76 65 20 53 65 74 74 69 6e 67 73 22 2c 22 43 6f 6f 6b 69 65 73 55 73 65 64 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 75 73 65 64 22 2c 22 43 6f 6f 6b 69 65 73 44 65 73 63 54 65 78 74 22 3a 22 44 65 73 63 72 69 70 74 69 6f 6e 22 2c 22 41 62 6f 75 74 4c 69 6e 6b 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 67 65 6e 65 72 61 6c 2e 68 74 6d 6c 3f 74 6d 70 6c 3d 64 6f 63 73 2f 70 72 69 76 61 63 79 2d 70 6f 6c 69 63 79 22 2c 22 41 63 74 69 76 65 54 65 78 74 22 3a 22 41 63 74 69 76 65 22 2c 22 41 6c 77 61 79 73 41 63 74 69 Data Ascii: iesText":"Your Privacy","ConfirmText":"Allow All","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","CookiesDescText":"Description","AboutLink":"https://www.booking.com/general.html?tmpl=docs/privacy-policy","ActiveText":"Active","AlwaysActi
2024-02-08 18:36:24 UTC	1369	IN	Data Raw: 72 69 70 74 41 72 63 68 69 76 65 22 3a 66 61 6c 73 65 2c 22 42 61 6e 6e 65 72 50 6f 73 69 74 69 6f 6e 22 3a 22 62 6f 74 74 6f 6d 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 50 6f 73 69 74 69 6f 6e 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 43 6f 6e 66 69 72 6d 54 65 78 74 22 3a 22 43 6f 6e 66 69 72 6d 20 4d 79 20 43 68 6f 69 63 65 73 22 2c 22 56 65 6e 64 6f 72 4c 69 73 74 54 65 78 74 22 3a 22 4c 69 73 74 20 6f 66 20 49 41 42 20 56 65 6e 64 6f 72 73 22 2c 22 54 68 69 72 64 50 61 72 74 79 43 6f 6f 6b 69 65 4c 69 73 74 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 77 65 20 75 73 65 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 4d 61 6e 61 67 65 50 72 65 66 65 72 65 6e 63 65 73 54 65 78 74 22 Data Ascii: riptArchive":false,"BannerPosition":"bottom","PreferenceCenterPosition":"default","PreferenceCenterConfirmText":"Confirm My Choices","VendorListText":"List of IAB Vendors","ThirdPartyCookieListText":"Cookies we use","PreferenceCenterManagePreferencesText"
2024-02-08 18:36:24 UTC	1369	IN	Data Raw: 2c 20 61 6e 64 20 6f 74 68 65 72 20 70 72 65 66 65 72 65 6e 63 65 73 2e 20 54 68 65 73 65 20 74 65 63 68 6e 69 63 61 6c 20 63 6f 6f 6b 69 65 73 20 6d 75 73 74 20 62 65 20 65 6e 61 62 6c 65 64 20 74 6f 20 75 73 65 20 6f 75 72 20 73 69 74 65 20 61 6e 64 20 73 65 72 76 69 63 65 73 2e 22 2c 22 47 72 6f 75 70 44 65 73 63 72 69 70 74 69 6f 6e 4f 54 54 22 3a 22 46 75 6e 63 74 69 6f 6e 61 6c 20 63 6f 6f 6b 69 65 73 20 65 6e 61 62 6c 65 20 6f 75 72 20 77 65 62 73 69 74 65 20 74 6f 20 77 6f 72 6b 20 70 72 6f 70 65 72 6c 79 2c 20 73 6f 20 79 6f 75 20 63 61 6e 20 63 72 65 61 74 65 20 61 6e 20 61 63 63 6f 75 6e 74 2c 20 73 69 67 6e 20 69 6e 2c 20 61 6e 64 20 6d 61 6e 61 67 65 20 62 6f 6f 6b 69 6e 67 73 2e 20 54 68 65 79 20 61 6c 73 6f 20 72 65 6d 65 6d 62 65 72 20 79 Data Ascii: , and other preferences. These technical cookies must be enabled to use our site and services.","GroupDescriptionOTT":"Functional cookies enable our website to work properly, so you can create an account, sign in, and manage bookings. They also remember y
2024-02-08 18:36:24 UTC	1369	IN	Data Raw: 61 73 20 70 61 72 74 20 6f 66 20 50 65 72 69 6d 65 74 65 72 58 20 73 65 63 75 72 69 74 79 20 73 65 72 76 69 63 65 73 2e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 63 63 39 34 37 39 61 35 2d 30 39 32 31 2d 34 38 33 35 2d 38 37 39 64 2d 65 64 39 39 34 39 64 31 66 38 30 37 22 2c 22 4e 61 6d 65 22 3a 22 62 6b 6e 67 5f 66 72 6f 6e 74 65 6e 64 5f 73 65 73 65 5f 65 78 70 22 2c 22 48 6f 73 74 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 32 39 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 69 73 20 63 6f 6f 6b 69 65 20 69 Data Ascii: as part of PerimeterX security services.","DurationType":1,"category":null,"isThirdParty":false},{"id":"cc9479a5-0921-4835-879d-ed9949d1f807","Name":"bkng_frontend_sese_exp","Host":"booking.com","IsSession":false,"Length":"29","description":"This cookie i
2024-02-08 18:36:24 UTC	1369	IN	Data Raw: 72 69 70 74 69 6f 6e 22 3a 22 44 72 6f 70 70 65 64 20 62 79 20 53 65 63 75 72 69 74 79 20 74 65 61 6d 20 61 73 20 70 61 72 74 20 6f 66 20 50 65 72 69 6d 65 74 65 72 58 20 73 65 63 75 72 69 74 79 20 73 65 72 76 69 63 65 73 2e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 30 31 64 35 35 36 37 63 2d 33 34 30 35 2d 34 39 31 62 2d 61 66 36 61 2d 35 65 61 36 63 34 37 30 63 32 35 63 22 2c 22 4e 61 6d 65 22 3a 22 5f 70 78 76 69 64 22 2c 22 48 6f 73 74 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 37 33 30 22 2c 22 64 65 73 63 72 69 70 Data Ascii: ription":"Dropped by Security team as part of PerimeterX security services.","DurationType":1,"category":null,"isThirdParty":false},{"id":"01d5567c-3405-491b-af6a-5ea6c470c25c","Name":"_pxvid","Host":"booking.com","IsSession":false,"Length":"730","descrip
2024-02-08 18:36:24 UTC	1369	IN	Data Raw: 79 20 26 20 43 6f 6e 73 65 6e 74 20 46 72 61 6d 65 77 6f 72 6b 20 74 6f 20 73 74 6f 72 65 20 74 68 65 20 75 73 65 72 27 73 20 63 6f 6e 73 65 6e 74 20 74 6f 20 74 68 65 20 64 61 74 61 20 63 6f 6c 6c 65 63 74 69 6f 6e 20 50 75 72 70 6f 73 65 73 2e 20 54 68 65 20 63 6f 6f 6b 69 65 20 68 6f 6c 64 73 20 61 6e 20 65 6e 63 72 79 70 74 65 64 20 63 6f 6e 73 65 6e 74 20 73 74 72 69 6e 67 20 74 68 61 74 20 76 65 6e 64 6f 72 73 20 70 61 72 74 69 63 69 70 61 74 69 6e 67 20 69 6e 20 74 68 65 20 66 72 61 6d 65 77 6f 72 6b 20 63 61 6e 20 72 65 61 64 20 61 6e 64 20 64 65 74 65 72 6d 69 6e 65 20 74 68 65 20 75 73 65 72 27 73 20 63 6f 6e 73 65 6e 74 2e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 Data Ascii: y & Consent Framework to store the user's consent to the data collection Purposes. The cookie holds an encrypted consent string that vendors participating in the framework can read and determine the user's consent.","DurationType":1,"category":null,"isThi
2024-02-08 18:36:24 UTC	1369	IN	Data Raw: 6d 65 22 3a 22 70 78 63 74 73 22 2c 22 48 6f 73 74 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 74 72 75 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 73 65 64 20 62 79 20 50 65 72 69 6d 65 74 65 72 58 20 74 6f 20 64 65 74 65 63 74 20 66 72 61 75 64 20 61 6e 64 20 62 6f 74 20 61 63 74 69 76 69 74 79 2e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 33 37 33 37 36 30 64 64 2d 35 34 62 61 2d 34 61 32 61 2d 38 61 36 65 2d 33 34 36 63 33 63 37 31 37 39 36 65 22 2c 22 4e 61 6d 65 22 3a 22 62 6b 6e 67 22 2c 22 48 6f 73 74 22 3a 22 62 Data Ascii: me":"pxcts","Host":"booking.com","IsSession":true,"Length":"0","description":"Used by PerimeterX to detect fraud and bot activity.","DurationType":1,"category":null,"isThirdParty":false},{"id":"373760dd-54ba-4a2a-8a6e-346c3c71796e","Name":"bkng","Host":"b
2024-02-08 18:36:24 UTC	1369	IN	Data Raw: 3a 22 61 35 63 38 65 63 32 61 2d 31 31 66 62 2d 34 37 38 36 2d 39 36 33 66 2d 36 65 33 66 39 36 66 38 66 34 63 33 22 2c 22 4e 61 6d 65 22 3a 22 70 63 6d 5f 63 6f 6e 73 65 6e 74 22 2c 22 48 6f 73 74 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 36 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 69 73 20 63 6f 6f 6b 69 65 20 69 73 20 73 65 74 20 62 79 20 74 68 65 20 70 72 69 76 61 63 79 20 63 6f 6d 70 6c 69 61 6e 63 65 20 73 6f 6c 75 74 69 6f 6e 20 66 72 6f 6d 20 42 6f 6f 6b 69 6e 67 2e 20 49 74 20 73 74 6f 72 65 73 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 65 20 63 61 74 65 67 6f 72 69 65 73 20 6f 66 20 70 72 69 76 61 63 79 20 74 68 65 20 73 Data Ascii: :"a5c8ec2a-11fb-4786-963f-6e3f96f8f4c3","Name":"pcm_consent","Host":"booking.com","IsSession":false,"Length":"6","description":"This cookie is set by the privacy compliance solution from Booking. It stores information about the categories of privacy the s
2024-02-08 18:36:24 UTC	1369	IN	Data Raw: 20 69 74 20 69 73 20 61 20 72 65 61 6c 20 75 73 65 72 20 6f 72 20 6d 61 6c 69 63 69 6f 75 73 20 62 6f 74 2e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 5d 2c 22 48 6f 73 74 73 22 3a 5b 7b 22 48 6f 73 74 4e 61 6d 65 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 44 69 73 70 6c 61 79 4e 61 6d 65 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 48 6f 73 74 49 64 22 3a 22 61 6e 7a 22 2c 22 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 50 72 69 76 61 63 79 50 6f 6c 69 63 79 22 3a 22 22 2c 22 43 6f 6f 6b 69 65 73 22 3a 5b 7b 22 69 64 22 3a 22 64 39 37 38 61 64 39 39 2d 65 62 32 65 2d 34 34 64 62 2d 39 30 31 35 2d 30 39 63 36 33 Data Ascii: it is a real user or malicious bot.","DurationType":1,"category":null,"isThirdParty":false}],"Hosts":[{"HostName":"booking.com","DisplayName":"booking.com","HostId":"anz","Description":"","PrivacyPolicy":"","Cookies":[{"id":"d978ad99-eb2e-44db-9015-09c63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
712	192.168.2.5	50562	18.67.65.100	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:24 UTC	407	OUT	GET /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:24 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Thu, 08 Feb 2024 18:36:24 GMT X-Cache: Error from cloudfront Via: 1.1 199b065e4c1253c9590e1b5e57083906.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: -ho0QXyUuyMJb8KnfGu-QokTvsNblanW5PqDqtoreokzAiWdLAPvSQ==
2024-02-08 18:36:24 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
713	192.168.2.5	50563	3.161.150.72	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:24 UTC	3440	OUT	GET /js-metric?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA HTTP/1.1 Host: account.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_ap_lang=en-us; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; bkng_ap=U2FsdGVkX19%2FWj7MIxTQoew6fVzm%2FavdeeT6w7Tou9chqgq42LIpRPd4nN%2B0lIRr6YV3VFQvOPJJ%0A%2FMglth7v%2BQ%3D%3D%0A; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXbnXawFhv%2Bov5qX2t%2BkjDX%2FSNhQS8UMKXEgF7SbTMk5lZRjRk40eE9ZIStvqAVmgL%2Fkvzh5mdRnhcUtlo5tJUKE0vMfULCoEeprAELqi%2FDgNs1lACo93R0nAlWUa3%2BA7gG0DsR2aw5zKj4nbG7Xq7OwI%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJzZXNzaW9ucyI6W10sImRhdGFfc3ViamVjdF9pZCI6ImU1MmRjZDUxLTY5OWItNDVlOC04MDcwLTdjYzkxYTU3MzU2YiJ9fQ; lastSeen=1707417382595
2024-02-08 18:36:24 UTC	2028	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:24 GMT allow: POST content-security-policy: frame-ancestors https://.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=4aee82d404fe00e5&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgcqlyvtE53jUMkIP6IX-ZMVWwpO81iGs6Zp0dKHz9nB4 content-security-policy-report-only: base-uri 'none'; connect-src saa.booking.com secure.booking.com reports.booking.com privacyportal-eu.onetrust.com geolocation.onetrust.com cdn.cookielaw.org www.google-analytics.com .perimeterx.net .pxchk.net .px-cdn.net .px-client.net .px-cloud.net 'self' 'report-sample'; default-src .bstatic.com bstatic.com 'self'; frame-src https://www.youtube.com/embed/Vv4w5SmRkss .bstatic.com https://www.google.com bstatic.com www.booking.com secure.booking.com paymentcomponent.booking.com 'self'; img-src 'self' data: www.booking.com graph.facebook.com cdn.cookielaw.org account.booking.com .bstatic.com bstatic.com .static.booking.cn www.google-analytics.com www.google.com stats.g.doubleclick.net .px-cloud.net .perimeterx.net www.gstatic.com; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=213&pid=4aee82d404fe00e5&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgcqlyvtE53jUMkIP6IX-ZMVWwpO81iGs6Zp0dKHz9nB4; script-src saa.booking.com .bstatic.com bstatic.com .static.booking.cn www.google.com www.google-analytics.com cdn.cookielaw.org geolocation.onetrust.com 'self' 'nonce-JNd1qUX2haPHCcO' 'report-sample'; style-src .bstatic.com bstatic.com .static.booking.cn 'self' 'unsafe-inline' x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Error from cloudfront Via: 1.1 837baeb3003427e58f2f96283f64c760.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P5 X-Amz-Cf-Id: AKjHjU5Uv63zRRz11ha0cFSP2yYoRri39WrUl3EfdQHLWWNe7WG-UQ==
2024-02-08 18:36:24 UTC	1621	IN	Data Raw: 36 34 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 2d 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 Data Ascii: 64e<!DOCTYPE html><html lang="en"><head><title>405 - Method Not Allowed</title><meta http-equiv="content-type" content="text/html; charset=utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta http-equiv="X-UA-Compat
2024-02-08 18:36:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
714	192.168.2.5	50564	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:24 UTC	360	OUT	GET /static/img/favicon.ico HTTP/1.1 Host: xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:24 UTC	772	IN	HTTP/1.1 200 OK Content-Type: image/x-icon Content-Length: 610 Connection: close Server: nginx Date: Sun, 21 Jan 2024 10:44:37 GMT Last-Modified: Tue, 21 Mar 2023 13:15:51 GMT ETag: "6419ae07-262" Expires: Tue, 20 Feb 2024 10:44:37 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 76f3fedc86826a7b266250e33ee41082.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: QhnXIduJlqpuuihmRmqyK3KhbTXBPbSvBvf9NQYpucsXS8LLfTpnWw== Age: 1583507
2024-02-08 18:36:24 UTC	610	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 02 29 49 44 41 54 58 85 d5 97 3f 4c 1a 61 18 c6 7f 77 31 b0 1c 82 c9 0d 12 13 4b 53 89 9d 5a 18 ba 68 4d 8c 5d a4 8b ba d0 c1 10 b1 63 5d ba 52 17 16 db b9 31 76 a3 68 4c 17 bb c0 74 53 5b 5b aa 8b 83 d0 cd 48 83 31 69 5d 18 6c 64 b1 21 b1 03 70 70 78 fc b9 e3 e0 d2 67 e3 7b 73 f7 fc ee 7d bf ef 21 9f 40 4d d3 5b e3 c0 2e 30 05 0c d1 1f 95 81 43 20 c2 c1 da 39 80 50 35 0f 03 1f fa 68 ac 07 b2 cc c1 da 9e 50 fd f2 9f 03 34 6f 84 b8 27 52 69 fb a0 cd a9 7a ee 8a 54 66 6e 97 a6 44 ec f9 fa 9a 86 ba 32 f7 79 5d f8 46 87 35 6b fb c7 bf ac 21 e8 c6 3c 9b 7c 86 5b 72 e8 d6 d3 99 02 f1 f7 47 64 4f 8b a6 00 c4 76 45 8f e4 24 f5 26 d4 d2 1c 60 61 e6 2e fb 9b 8b Data Ascii: PNGIHDR szz)IDATX?Law1KSZhM]c]R1vhLtS[[H1i]ld!ppxg{s}!@M[.0C 9P5hP4o'RizTfnD2y]F5k!<\|[rGdOvE$&`a.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
715	192.168.2.5	50565	35.190.10.96	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:24 UTC	657	OUT	POST /api/v2/collector HTTP/1.1 Host: collector-pxikkul2rm.px-cloud.net Connection: keep-alive Content-Length: 1291 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Origin: https://account.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:24 UTC	1291	OUT	Data Raw: 70 61 79 6c 6f 61 64 3d 61 55 6b 51 52 68 41 49 45 47 4a 71 41 77 49 4b 41 77 51 51 48 68 42 57 45 41 68 4a 45 47 4a 71 41 77 49 42 42 41 49 51 43 42 42 61 52 6b 5a 43 51 51 67 64 48 56 4e 52 55 56 31 48 58 45 59 63 55 46 31 64 57 56 74 63 56 52 78 52 58 56 38 64 51 56 74 56 58 42 39 62 58 41 31 64 51 6d 31 47 58 56 6c 58 58 41 39 33 56 57 52 45 61 32 70 6b 41 6c 4e 78 66 67 52 7a 56 56 31 6e 56 6c 6b 4b 53 6d 45 41 65 45 46 54 53 46 59 47 5a 58 5a 65 41 6d 52 6c 42 6b 74 72 41 58 42 54 5a 6e 52 2f 59 58 46 6c 64 41 4e 57 64 56 70 45 55 56 39 65 42 47 68 67 58 51 4e 54 65 6d 41 43 55 58 70 2f 42 48 35 4c 43 30 68 6f 5a 58 77 44 55 56 39 6e 52 32 74 66 43 30 52 54 41 46 35 48 61 45 73 48 57 46 41 41 41 6b 52 51 64 51 74 63 55 32 55 47 52 31 4e 36 59 45 5a Data Ascii: payload=aUkQRhAIEGJqAwIKAwQQHhBWEAhJEGJqAwIBBAIQCBBaRkZCQQgdHVNRUV1HXEYcUF1dWVtcVRxRXV8dQVtVXB9bXA1dQm1GXVlXXA93VWREa2pkAlNxfgRzVV1nVlkKSmEAeEFTSFYGZXZeAmRlBktrAXBTZnR/YXFldANWdVpEUV9eBGhgXQNTemACUXp/BH5LC0hoZXwDUV9nR2tfC0RTAF5HaEsHWFAAAkRQdQtcU2UGR1N6YEZ
2024-02-08 18:36:24 UTC	401	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:36:24 GMT Content-Type: application/json; charset=utf-8 Content-Length: 553 Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE Access-Control-Allow-Origin: https://account.booking.com Timing-Allow-Origin: * Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:24 UTC	553	IN	Data Raw: 7b 22 64 6f 22 3a 5b 22 73 69 64 7c 66 36 35 30 30 31 63 65 2d 63 36 62 30 2d 31 31 65 65 2d 61 39 62 66 2d 30 64 35 32 38 38 65 65 30 36 61 35 22 2c 22 70 6e 66 7c 63 75 22 2c 22 63 6c 73 7c 31 34 36 38 37 30 34 35 36 37 34 31 31 37 34 33 39 33 34 31 22 2c 22 73 74 73 7c 31 37 30 37 34 31 37 33 38 34 34 32 36 22 2c 22 77 63 73 7c 63 6e 32 68 75 61 34 71 31 38 35 6f 73 67 73 35 74 63 35 67 22 2c 22 64 72 63 7c 33 31 33 38 22 2c 22 63 74 73 7c 66 36 35 30 30 39 39 66 2d 63 36 62 30 2d 31 31 65 65 2d 61 39 62 66 2d 30 64 35 32 38 38 65 65 30 36 61 35 7c 74 72 75 65 22 2c 22 63 73 7c 37 61 36 66 37 36 61 37 66 61 63 64 31 63 62 39 33 63 39 65 64 36 65 63 63 65 65 39 34 37 33 35 64 66 38 66 33 66 62 64 32 39 36 32 36 30 30 37 63 39 33 63 65 32 66 36 66 62 64 Data Ascii: {"do":["sid\|f65001ce-c6b0-11ee-a9bf-0d5288ee06a5","pnf\|cu","cls\|14687045674117439341","sts\|1707417384426","wcs\|cn2hua4q185osgs5tc5g","drc\|3138","cts\|f650099f-c6b0-11ee-a9bf-0d5288ee06a5\|true","cs\|7a6f76a7facd1cb93c9ed6eccee94735df8f3fbd29626007c93ce2f6fbd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
716	192.168.2.5	50566	18.67.65.100	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:24 UTC	407	OUT	GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:24 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Thu, 08 Feb 2024 18:36:24 GMT X-Cache: Error from cloudfront Via: 1.1 cea67f5ca1b497624430e599aa6b7c62.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: TInr7L83WHzu-gmPLdNjnjWegfalo8Y_tfBNz3qRJwtYzgV-vAflSw==
2024-02-08 18:36:24 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
717	192.168.2.5	50567	3.161.150.72	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:24 UTC	3729	OUT	GET /js-track?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA HTTP/1.1 Host: account.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_ap_lang=en-us; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; bkng_ap=U2FsdGVkX19%2FWj7MIxTQoew6fVzm%2FavdeeT6w7Tou9chqgq42LIpRPd4nN%2B0lIRr6YV3VFQvOPJJ%0A%2FMglth7v%2BQ%3D%3D%0A; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXbnXawFhv%2Bov5qX2t%2BkjDX%2FSNhQS8UMKXEgF7SbTMk5lZRjRk40eE9ZIStvqAVmgL%2Fkvzh5mdRnhcUtlo5tJUKE0vMfULCoEeprAELqi%2FDgNs1lACo93R0nAlWUa3%2BA7gG0DsR2aw5zKj4nbG7Xq7OwI%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=1707417382595; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAZ/yB4ssWAAAA:7lFnQqmYWJ7p7DZtJNv+oFlvd12/w6itSlACDWcL4oXY/uaqDPYrqMYNRD09TQUO6/kcmEjW2mFd10raBlSeUsZJYlVo7BoiMT4zTRAoz5jIKiazydlkVJgL7XaYPF2fjYWLlmJNpmOoRhPG+6rh3gkyxVHdm8KzObMQxycSoMQ+/Q+rs2Ix1ovUhdXYUv2/gbY3fdQ4CD5sUmFKy/0fSMQOpP0=; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJlNTJkY2Q1MS02OTliLTQ1ZTgtODA3MC03Y2M5MWE1NzM1NmIiLCJzZXNzaW9ucyI6W119fQ
2024-02-08 18:36:24 UTC	2028	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:24 GMT allow: POST content-security-policy: frame-ancestors https://.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=9bea82d4016b0953&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgQ7uy0HoGirStr59gJ6ED-355NuDMPwN_MRvR8TurbSU content-security-policy-report-only: base-uri 'none'; connect-src saa.booking.com secure.booking.com reports.booking.com privacyportal-eu.onetrust.com geolocation.onetrust.com cdn.cookielaw.org www.google-analytics.com .perimeterx.net .pxchk.net .px-cdn.net .px-client.net .px-cloud.net 'self' 'report-sample'; default-src .bstatic.com bstatic.com 'self'; frame-src https://www.youtube.com/embed/Vv4w5SmRkss .bstatic.com https://www.google.com bstatic.com www.booking.com secure.booking.com paymentcomponent.booking.com 'self'; img-src 'self' data: www.booking.com graph.facebook.com cdn.cookielaw.org account.booking.com .bstatic.com bstatic.com .static.booking.cn www.google-analytics.com www.google.com stats.g.doubleclick.net .px-cloud.net .perimeterx.net www.gstatic.com; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=213&pid=9bea82d4016b0953&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgQ7uy0HoGirStr59gJ6ED-355NuDMPwN_MRvR8TurbSU; script-src saa.booking.com .bstatic.com bstatic.com .static.booking.cn www.google.com www.google-analytics.com cdn.cookielaw.org geolocation.onetrust.com 'self' 'nonce-GGHiIoAlgjziPBW' 'report-sample'; style-src .bstatic.com bstatic.com .static.booking.cn 'self' 'unsafe-inline' x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Error from cloudfront Via: 1.1 f2e8d9fac4aa59028883db592f3b2594.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P5 X-Amz-Cf-Id: 7xtlnQwsUtMHYDmIkxTe3nM9GhANksJ7uQlew2C63Y97h2UQ08n9Tw==
2024-02-08 18:36:24 UTC	1621	IN	Data Raw: 36 34 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 2d 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 Data Ascii: 64e<!DOCTYPE html><html lang="en"><head><title>405 - Method Not Allowed</title><meta http-equiv="content-type" content="text/html; charset=utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta http-equiv="X-UA-Compat
2024-02-08 18:36:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
718	192.168.2.5	50568	104.18.131.236	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:24 UTC	605	OUT	GET /scripttemplates/202305.1.0/assets/otCommonStyles.css HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://account.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:24 UTC	826	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:36:24 GMT Content-Type: text/css Content-Length: 21608 Connection: close Content-MD5: oWkBTLgDDXvrUsd93y/Zxg== Last-Modified: Tue, 11 Jul 2023 02:35:52 GMT ETag: 0x8DB81B78BA27559 x-ms-request-id: f89b2d60-f01e-002e-25fc-b35821000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 19507 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8525fa5f6b5369f8-ATL
2024-02-08 18:36:24 UTC	543	IN	Data Raw: 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 7b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 74 72 75 73 74 2d 76 65 6e 64 6f 72 73 2d 6c 69 73 74 2d 68 61 6e 64 6c 65 72 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 63 6f 6c 6f 72 3a 23 31 66 39 36 64 62 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 Data Ascii: #onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .one
2024-02-08 18:36:24 UTC	1369	IN	Data Raw: 6b 20 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 7b 6f 75 74 6c 69 6e 65 2d 6f 66 66 73 65 74 3a 31 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 62 6e 72 2d 77 2d 6c 6f 67 6f 20 2e 6f 74 2d 62 6e 72 2d 6c 6f 67 6f 7b 68 65 69 67 68 74 3a 36 34 70 78 3b 77 69 64 74 68 3a 36 34 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 Data Ascii: k #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk.ot-bnr-w-logo .ot-bnr-logo{height:64px;width:64px}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-icon,#ot-sync-ntfy .ot-close-icon{background-size:contain;background-repeat
2024-02-08 18:36:24 UTC	1369	IN	Data Raw: 74 2d 77 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 68 69 64 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 68 69 64 65 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 6f 74 2d 68 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 62 75 74 74 6f 6e 2e 6f 74 2d 6c 69 6e 6b 2d 62 74 6e 3a 68 6f 76 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 62 75 74 74 6f 6e 2e 6f 74 2d 6c 69 6e 6b 2d 62 74 6e 3a 68 6f 76 65 72 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 62 75 74 74 6f 6e 2e 6f 74 2d 6c 69 6e 6b 2d 62 74 6e 3a Data Ascii: t-weight:inherit;color:inherit}#onetrust-banner-sdk .ot-hide,#onetrust-pc-sdk .ot-hide,#ot-sync-ntfy .ot-hide{display:none !important}#onetrust-banner-sdk button.ot-link-btn:hover,#onetrust-pc-sdk button.ot-link-btn:hover,#ot-sync-ntfy button.ot-link-btn:
2024-02-08 18:36:24 UTC	1369	IN	Data Raw: 70 65 61 74 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 70 63 2d 6c 6f 67 6f 20 69 6d 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 70 63 2d 6c 6f 67 6f 20 69 6d 67 7b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 73 63 72 65 65 6e 2d 72 65 61 64 65 72 2d 6f 6e 6c 79 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 63 72 6e 2d 72 64 72 2c 2e 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 73 63 72 65 Data Ascii: peat;display:inline-flex;justify-content:center;align-items:center}#onetrust-pc-sdk .pc-logo img,#onetrust-pc-sdk .ot-pc-logo img{max-height:100%;max-width:100%}#onetrust-pc-sdk .screen-reader-only,#onetrust-pc-sdk .ot-scrn-rdr,.ot-sdk-cookie-policy .scre
2024-02-08 18:36:24 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 34 32 36 70 78 29 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 38 39 36 70 78 29 61 6e 64 20 28 6f 72 69 65 6e 74 61 74 69 6f 6e 3a 20 6c 61 6e 64 73 63 61 70 65 29 7b 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 35 65 6d 7d 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 2d 69 6e 70 75 74 3a 66 6f 63 75 73 2b 6c 61 62 65 6c 7b 6f 75 74 6c 69 6e 65 3a 31 70 78 20 73 6f 6c 69 64 20 23 30 30 30 3b 6f 75 74 6c 69 6e 65 2d 73 74 79 6c 65 3a 61 75 74 6f 7d 2e 63 61 74 65 67 6f 72 79 2d 76 65 6e 64 6f 72 Data Ascii: tion:underline}@media only screen and (min-width: 426px)and (max-width: 896px)and (orientation: landscape){#onetrust-pc-sdk p{font-size:.75em}}#onetrust-banner-sdk .banner-option-input:focus+label{outline:1px solid #000;outline-style:auto}.category-vendor
2024-02-08 18:36:24 UTC	1369	IN	Data Raw: 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 20 70 61 74 68 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 20 70 61 74 68 7b 66 69 6c 6c 3a 23 33 32 61 65 38 38 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2a 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 3a 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 3a 3a 62 65 66 Data Ascii: sdk .ot-optout-signal svg path,#onetrust-pc-sdk .ot-optout-signal svg path{fill:#32ae88}#onetrust-banner-sdk,#onetrust-pc-sdk,#ot-sdk-cookie-policy,#ot-sync-ntfy{font-size:16px}#onetrust-banner-sdk *,#onetrust-banner-sdk ::after,#onetrust-banner-sdk ::bef
2024-02-08 18:36:24 UTC	1369	IN	Data Raw: 73 70 61 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 31 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 32 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 33 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 34 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 35 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 36 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 70 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 69 6d 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 73 76 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 62 75 74 74 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 73 65 63 74 69 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 61 2c 23 Data Ascii: span,#onetrust-pc-sdk h1,#onetrust-pc-sdk h2,#onetrust-pc-sdk h3,#onetrust-pc-sdk h4,#onetrust-pc-sdk h5,#onetrust-pc-sdk h6,#onetrust-pc-sdk p,#onetrust-pc-sdk img,#onetrust-pc-sdk svg,#onetrust-pc-sdk button,#onetrust-pc-sdk section,#onetrust-pc-sdk a,#
2024-02-08 18:36:24 UTC	1369	IN	Data Raw: 70 6f 6c 69 63 79 20 23 6f 74 2d 70 63 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 63 68 65 63 6b 62 6f 78 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 64 69 76 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 73 70 61 6e 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 31 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 32 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 33 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 34 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 35 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 36 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 70 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 69 6d 67 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 73 76 67 2c 23 6f 74 2d 73 79 6e 63 2d 6e Data Ascii: policy #ot-pc-content,#ot-sdk-cookie-policy .checkbox,#ot-sync-ntfy div,#ot-sync-ntfy span,#ot-sync-ntfy h1,#ot-sync-ntfy h2,#ot-sync-ntfy h3,#ot-sync-ntfy h4,#ot-sync-ntfy h5,#ot-sync-ntfy h6,#ot-sync-ntfy p,#ot-sync-ntfy img,#ot-sync-ntfy svg,#ot-sync-n
2024-02-08 18:36:24 UTC	1369	IN	Data Raw: 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 74 2d 73 79 Data Ascii: .checkbox:after,#onetrust-pc-sdk .checkbox:before,#ot-sdk-cookie-policy label:before,#ot-sdk-cookie-policy label:after,#ot-sdk-cookie-policy .checkbox:after,#ot-sdk-cookie-policy .checkbox:before,#ot-sync-ntfy label:before,#ot-sync-ntfy label:after,#ot-sy
2024-02-08 18:36:24 UTC	1369	IN	Data Raw: 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 Data Ascii: rust-banner-sdk .ot-sdk-column:first-child,#onetrust-banner-sdk .ot-sdk-columns:first-child,#onetrust-pc-sdk .ot-sdk-column:first-child,#onetrust-pc-sdk .ot-sdk-columns:first-child,#ot-sdk-cookie-policy .ot-sdk-column:first-child,#ot-sdk-cookie-policy .ot

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
719	192.168.2.5	50569	104.18.130.236	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:24 UTC	433	OUT	GET /consent/a387750c-a080-4dd0-b2d1-7dbdb601bb14/9778f4ab-6b4a-4e03-bdf8-86a5c037c4bf/en-us.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:25 UTC	890	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:36:24 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8525fa5f7879457e-ATL CF-Cache-Status: HIT Access-Control-Allow-Origin: * Cache-Control: public, max-age=86400 Expires: Fri, 09 Feb 2024 18:36:24 GMT Last-Modified: Fri, 02 Feb 2024 16:31:40 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: k5rB685rNBgtKMPUY0Zs1w== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 088e6143-d01e-004e-19f5-55170b000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-02-08 18:36:25 UTC	479	IN	Data Raw: 37 63 32 35 0d 0a 7b 22 44 6f 6d 61 69 6e 44 61 74 61 22 3a 7b 22 70 63 6c 69 66 65 53 70 61 6e 59 72 22 3a 22 59 65 61 72 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 59 72 73 22 3a 22 59 65 61 72 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 53 65 63 73 22 3a 22 41 20 66 65 77 20 73 65 63 6f 6e 64 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 22 3a 22 57 65 65 6b 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 73 22 3a 22 57 65 65 6b 73 22 2c 22 70 63 63 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 54 65 78 74 22 3a 22 43 6f 6e 74 69 6e 75 65 20 77 69 74 68 6f 75 74 20 41 63 63 65 70 74 69 6e 67 22 2c 22 70 63 63 6c 6f 73 65 42 75 74 74 6f 6e 54 79 70 65 22 3a 22 49 63 6f 6e 22 2c 22 4d 61 69 6e 54 65 78 74 22 3a 22 4d 61 6e 61 67 65 20 79 6f 75 72 Data Ascii: 7c25{"DomainData":{"pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","pccloseButtonType":"Icon","MainText":"Manage your
2024-02-08 18:36:25 UTC	1369	IN	Data Raw: 6f 75 72 20 50 72 69 76 61 63 79 22 2c 22 43 6f 6e 66 69 72 6d 54 65 78 74 22 3a 22 41 6c 6c 6f 77 20 41 6c 6c 22 2c 22 41 6c 6c 6f 77 41 6c 6c 54 65 78 74 22 3a 22 53 61 76 65 20 53 65 74 74 69 6e 67 73 22 2c 22 43 6f 6f 6b 69 65 73 55 73 65 64 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 75 73 65 64 22 2c 22 43 6f 6f 6b 69 65 73 44 65 73 63 54 65 78 74 22 3a 22 44 65 73 63 72 69 70 74 69 6f 6e 22 2c 22 41 62 6f 75 74 4c 69 6e 6b 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 67 65 6e 65 72 61 6c 2e 68 74 6d 6c 3f 74 6d 70 6c 3d 64 6f 63 73 2f 70 72 69 76 61 63 79 2d 70 6f 6c 69 63 79 22 2c 22 41 63 74 69 76 65 54 65 78 74 22 3a 22 41 63 74 69 76 65 22 2c 22 41 6c 77 61 79 73 41 63 74 69 76 65 54 65 78 74 22 3a 22 41 6c Data Ascii: our Privacy","ConfirmText":"Allow All","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","CookiesDescText":"Description","AboutLink":"https://www.booking.com/general.html?tmpl=docs/privacy-policy","ActiveText":"Active","AlwaysActiveText":"Al
2024-02-08 18:36:25 UTC	1369	IN	Data Raw: 22 3a 66 61 6c 73 65 2c 22 42 61 6e 6e 65 72 50 6f 73 69 74 69 6f 6e 22 3a 22 62 6f 74 74 6f 6d 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 50 6f 73 69 74 69 6f 6e 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 43 6f 6e 66 69 72 6d 54 65 78 74 22 3a 22 43 6f 6e 66 69 72 6d 20 4d 79 20 43 68 6f 69 63 65 73 22 2c 22 56 65 6e 64 6f 72 4c 69 73 74 54 65 78 74 22 3a 22 4c 69 73 74 20 6f 66 20 49 41 42 20 56 65 6e 64 6f 72 73 22 2c 22 54 68 69 72 64 50 61 72 74 79 43 6f 6f 6b 69 65 4c 69 73 74 54 65 78 74 22 3a 22 43 6f 6f 6b 69 65 73 20 77 65 20 75 73 65 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 4d 61 6e 61 67 65 50 72 65 66 65 72 65 6e 63 65 73 54 65 78 74 22 3a 22 4d 61 6e 61 67 65 20 63 6f Data Ascii: ":false,"BannerPosition":"bottom","PreferenceCenterPosition":"default","PreferenceCenterConfirmText":"Confirm My Choices","VendorListText":"List of IAB Vendors","ThirdPartyCookieListText":"Cookies we use","PreferenceCenterManagePreferencesText":"Manage co
2024-02-08 18:36:25 UTC	1369	IN	Data Raw: 20 70 72 65 66 65 72 65 6e 63 65 73 2e 20 54 68 65 73 65 20 74 65 63 68 6e 69 63 61 6c 20 63 6f 6f 6b 69 65 73 20 6d 75 73 74 20 62 65 20 65 6e 61 62 6c 65 64 20 74 6f 20 75 73 65 20 6f 75 72 20 73 69 74 65 20 61 6e 64 20 73 65 72 76 69 63 65 73 2e 22 2c 22 47 72 6f 75 70 44 65 73 63 72 69 70 74 69 6f 6e 4f 54 54 22 3a 22 46 75 6e 63 74 69 6f 6e 61 6c 20 63 6f 6f 6b 69 65 73 20 65 6e 61 62 6c 65 20 6f 75 72 20 77 65 62 73 69 74 65 20 74 6f 20 77 6f 72 6b 20 70 72 6f 70 65 72 6c 79 2c 20 73 6f 20 79 6f 75 20 63 61 6e 20 63 72 65 61 74 65 20 61 6e 20 61 63 63 6f 75 6e 74 2c 20 73 69 67 6e 20 69 6e 2c 20 61 6e 64 20 6d 61 6e 61 67 65 20 62 6f 6f 6b 69 6e 67 73 2e 20 54 68 65 79 20 61 6c 73 6f 20 72 65 6d 65 6d 62 65 72 20 79 6f 75 72 20 73 65 6c 65 63 74 65 Data Ascii: preferences. These technical cookies must be enabled to use our site and services.","GroupDescriptionOTT":"Functional cookies enable our website to work properly, so you can create an account, sign in, and manage bookings. They also remember your selecte
2024-02-08 18:36:25 UTC	1369	IN	Data Raw: 50 65 72 69 6d 65 74 65 72 58 20 73 65 63 75 72 69 74 79 20 73 65 72 76 69 63 65 73 2e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 63 63 39 34 37 39 61 35 2d 30 39 32 31 2d 34 38 33 35 2d 38 37 39 64 2d 65 64 39 39 34 39 64 31 66 38 30 37 22 2c 22 4e 61 6d 65 22 3a 22 62 6b 6e 67 5f 66 72 6f 6e 74 65 6e 64 5f 73 65 73 65 5f 65 78 70 22 2c 22 48 6f 73 74 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 32 39 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 69 73 20 63 6f 6f 6b 69 65 20 69 73 20 75 73 65 64 20 61 73 20 61 Data Ascii: PerimeterX security services.","DurationType":1,"category":null,"isThirdParty":false},{"id":"cc9479a5-0921-4835-879d-ed9949d1f807","Name":"bkng_frontend_sese_exp","Host":"booking.com","IsSession":false,"Length":"29","description":"This cookie is used as a
2024-02-08 18:36:25 UTC	1369	IN	Data Raw: 72 6f 70 70 65 64 20 62 79 20 53 65 63 75 72 69 74 79 20 74 65 61 6d 20 61 73 20 70 61 72 74 20 6f 66 20 50 65 72 69 6d 65 74 65 72 58 20 73 65 63 75 72 69 74 79 20 73 65 72 76 69 63 65 73 2e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 30 31 64 35 35 36 37 63 2d 33 34 30 35 2d 34 39 31 62 2d 61 66 36 61 2d 35 65 61 36 63 34 37 30 63 32 35 63 22 2c 22 4e 61 6d 65 22 3a 22 5f 70 78 76 69 64 22 2c 22 48 6f 73 74 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 37 33 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 44 72 6f 70 Data Ascii: ropped by Security team as part of PerimeterX security services.","DurationType":1,"category":null,"isThirdParty":false},{"id":"01d5567c-3405-491b-af6a-5ea6c470c25c","Name":"_pxvid","Host":"booking.com","IsSession":false,"Length":"730","description":"Drop
2024-02-08 18:36:25 UTC	1369	IN	Data Raw: 20 46 72 61 6d 65 77 6f 72 6b 20 74 6f 20 73 74 6f 72 65 20 74 68 65 20 75 73 65 72 27 73 20 63 6f 6e 73 65 6e 74 20 74 6f 20 74 68 65 20 64 61 74 61 20 63 6f 6c 6c 65 63 74 69 6f 6e 20 50 75 72 70 6f 73 65 73 2e 20 54 68 65 20 63 6f 6f 6b 69 65 20 68 6f 6c 64 73 20 61 6e 20 65 6e 63 72 79 70 74 65 64 20 63 6f 6e 73 65 6e 74 20 73 74 72 69 6e 67 20 74 68 61 74 20 76 65 6e 64 6f 72 73 20 70 61 72 74 69 63 69 70 61 74 69 6e 67 20 69 6e 20 74 68 65 20 66 72 61 6d 65 77 6f 72 6b 20 63 61 6e 20 72 65 61 64 20 61 6e 64 20 64 65 74 65 72 6d 69 6e 65 20 74 68 65 20 75 73 65 72 27 73 20 63 6f 6e 73 65 6e 74 2e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 Data Ascii: Framework to store the user's consent to the data collection Purposes. The cookie holds an encrypted consent string that vendors participating in the framework can read and determine the user's consent.","DurationType":1,"category":null,"isThirdParty":fa
2024-02-08 18:36:25 UTC	1369	IN	Data Raw: 2c 22 48 6f 73 74 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 74 72 75 65 2c 22 4c 65 6e 67 74 68 22 3a 22 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 55 73 65 64 20 62 79 20 50 65 72 69 6d 65 74 65 72 58 20 74 6f 20 64 65 74 65 63 74 20 66 72 61 75 64 20 61 6e 64 20 62 6f 74 20 61 63 74 69 76 69 74 79 2e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 33 37 33 37 36 30 64 64 2d 35 34 62 61 2d 34 61 32 61 2d 38 61 36 65 2d 33 34 36 63 33 63 37 31 37 39 36 65 22 2c 22 4e 61 6d 65 22 3a 22 62 6b 6e 67 22 2c 22 48 6f 73 74 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 Data Ascii: ,"Host":"booking.com","IsSession":true,"Length":"0","description":"Used by PerimeterX to detect fraud and bot activity.","DurationType":1,"category":null,"isThirdParty":false},{"id":"373760dd-54ba-4a2a-8a6e-346c3c71796e","Name":"bkng","Host":"booking.com"
2024-02-08 18:36:25 UTC	1369	IN	Data Raw: 31 31 66 62 2d 34 37 38 36 2d 39 36 33 66 2d 36 65 33 66 39 36 66 38 66 34 63 33 22 2c 22 4e 61 6d 65 22 3a 22 70 63 6d 5f 63 6f 6e 73 65 6e 74 22 2c 22 48 6f 73 74 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 36 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 68 69 73 20 63 6f 6f 6b 69 65 20 69 73 20 73 65 74 20 62 79 20 74 68 65 20 70 72 69 76 61 63 79 20 63 6f 6d 70 6c 69 61 6e 63 65 20 73 6f 6c 75 74 69 6f 6e 20 66 72 6f 6d 20 42 6f 6f 6b 69 6e 67 2e 20 49 74 20 73 74 6f 72 65 73 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 65 20 63 61 74 65 67 6f 72 69 65 73 20 6f 66 20 70 72 69 76 61 63 79 20 74 68 65 20 73 69 74 65 20 75 73 65 73 20 61 6e Data Ascii: 11fb-4786-963f-6e3f96f8f4c3","Name":"pcm_consent","Host":"booking.com","IsSession":false,"Length":"6","description":"This cookie is set by the privacy compliance solution from Booking. It stores information about the categories of privacy the site uses an
2024-02-08 18:36:25 UTC	1369	IN	Data Raw: 61 6c 20 75 73 65 72 20 6f 72 20 6d 61 6c 69 63 69 6f 75 73 20 62 6f 74 2e 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 5d 2c 22 48 6f 73 74 73 22 3a 5b 7b 22 48 6f 73 74 4e 61 6d 65 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 44 69 73 70 6c 61 79 4e 61 6d 65 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 48 6f 73 74 49 64 22 3a 22 61 6e 7a 22 2c 22 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 50 72 69 76 61 63 79 50 6f 6c 69 63 79 22 3a 22 22 2c 22 43 6f 6f 6b 69 65 73 22 3a 5b 7b 22 69 64 22 3a 22 64 39 37 38 61 64 39 39 2d 65 62 32 65 2d 34 34 64 62 2d 39 30 31 35 2d 30 39 63 36 33 66 32 34 30 65 34 38 22 2c 22 4e Data Ascii: al user or malicious bot.","DurationType":1,"category":null,"isThirdParty":false}],"Hosts":[{"HostName":"booking.com","DisplayName":"booking.com","HostId":"anz","Description":"","PrivacyPolicy":"","Cookies":[{"id":"d978ad99-eb2e-44db-9015-09c63f240e48","N

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
720	192.168.2.5	50570	3.161.150.72	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:24 UTC	3730	OUT	GET /js-metric?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA HTTP/1.1 Host: account.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_ap_lang=en-us; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; bkng_ap=U2FsdGVkX19%2FWj7MIxTQoew6fVzm%2FavdeeT6w7Tou9chqgq42LIpRPd4nN%2B0lIRr6YV3VFQvOPJJ%0A%2FMglth7v%2BQ%3D%3D%0A; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXbnXawFhv%2Bov5qX2t%2BkjDX%2FSNhQS8UMKXEgF7SbTMk5lZRjRk40eE9ZIStvqAVmgL%2Fkvzh5mdRnhcUtlo5tJUKE0vMfULCoEeprAELqi%2FDgNs1lACo93R0nAlWUa3%2BA7gG0DsR2aw5zKj4nbG7Xq7OwI%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=1707417382595; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAZ/yB4ssWAAAA:7lFnQqmYWJ7p7DZtJNv+oFlvd12/w6itSlACDWcL4oXY/uaqDPYrqMYNRD09TQUO6/kcmEjW2mFd10raBlSeUsZJYlVo7BoiMT4zTRAoz5jIKiazydlkVJgL7XaYPF2fjYWLlmJNpmOoRhPG+6rh3gkyxVHdm8KzObMQxycSoMQ+/Q+rs2Ix1ovUhdXYUv2/gbY3fdQ4CD5sUmFKy/0fSMQOpP0=; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJlNTJkY2Q1MS02OTliLTQ1ZTgtODA3MC03Y2M5MWE1NzM1NmIiLCJzZXNzaW9ucyI6W119fQ
2024-02-08 18:36:25 UTC	2028	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:25 GMT allow: POST content-security-policy: frame-ancestors https://.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=f12082d401ed0146&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgcqlyvtE53jUHcE-7MqwWHveeJU5Jwd0o-XGmlcJK-s8 content-security-policy-report-only: base-uri 'none'; connect-src saa.booking.com secure.booking.com reports.booking.com privacyportal-eu.onetrust.com geolocation.onetrust.com cdn.cookielaw.org www.google-analytics.com .perimeterx.net .pxchk.net .px-cdn.net .px-client.net .px-cloud.net 'self' 'report-sample'; default-src .bstatic.com bstatic.com 'self'; frame-src https://www.youtube.com/embed/Vv4w5SmRkss .bstatic.com https://www.google.com bstatic.com www.booking.com secure.booking.com paymentcomponent.booking.com 'self'; img-src 'self' data: www.booking.com graph.facebook.com cdn.cookielaw.org account.booking.com .bstatic.com bstatic.com .static.booking.cn www.google-analytics.com www.google.com stats.g.doubleclick.net .px-cloud.net .perimeterx.net www.gstatic.com; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=213&pid=f12082d401ed0146&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgcqlyvtE53jUHcE-7MqwWHveeJU5Jwd0o-XGmlcJK-s8; script-src saa.booking.com .bstatic.com bstatic.com .static.booking.cn www.google.com www.google-analytics.com cdn.cookielaw.org geolocation.onetrust.com 'self' 'nonce-U9vNDfxIBZhbb7y' 'report-sample'; style-src .bstatic.com bstatic.com .static.booking.cn 'self' 'unsafe-inline' x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Error from cloudfront Via: 1.1 f2e8d9fac4aa59028883db592f3b2594.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P5 X-Amz-Cf-Id: 1pIqxYJ6g5H8P4c2-KkbZnpIfpLT5VP9kE3lGkl3um2QN_ZkRnI3VA==
2024-02-08 18:36:25 UTC	1621	IN	Data Raw: 36 34 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 2d 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 Data Ascii: 64e<!DOCTYPE html><html lang="en"><head><title>405 - Method Not Allowed</title><meta http-equiv="content-type" content="text/html; charset=utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta http-equiv="X-UA-Compat
2024-02-08 18:36:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
721	192.168.2.5	50571	35.190.10.96	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:24 UTC	373	OUT	GET /api/v2/collector HTTP/1.1 Host: collector-pxikkul2rm.px-cloud.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:25 UTC	284	IN	HTTP/1.1 405 Method Not Allowed Date: Thu, 08 Feb 2024 18:36:24 GMT Content-Type: application/json; charset=utf-8 Content-Length: 31 Allow: HEAD, POST, OPTIONS Timing-Allow-Origin: * Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:25 UTC	31	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 22 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 22 7d 0a Data Ascii: {"error":"Method Not Allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
722	192.168.2.5	50572	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:24 UTC	682	OUT	POST /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive Content-Length: 2787 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://account.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:24 UTC	2787	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 74 71 69 43 73 72 30 43 41 41 41 41 3a 43 75 30 42 76 75 48 72 51 59 4e 35 41 44 45 75 7a 5a 66 47 30 56 69 2f 44 30 4a 58 67 6f 67 47 61 67 4f 58 2f 4d 73 6c 6b 37 4c 58 4c 65 78 70 2f 62 31 72 55 54 62 69 75 4c 5a 4e 6f 69 66 6b 67 55 4d 56 75 37 72 43 73 44 41 4c 78 4b 74 41 50 73 41 6f 70 46 62 45 6f 62 63 36 49 2b 57 4d 7a 6a 58 2f 48 63 6f 66 39 59 67 58 6a 59 5a 52 58 76 50 32 54 42 39 6f 4e 69 32 2f 58 41 74 4b 51 46 75 6d 47 56 43 44 68 32 32 43 41 71 35 58 66 43 33 65 52 59 6b 61 39 47 6c 39 41 56 79 56 6b 58 44 4b 4b 59 75 66 38 53 33 76 57 43 30 2b 79 54 68 4e 54 55 Data Ascii: {"existing_token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAtqiCsr0CAAAA:Cu0BvuHrQYN5ADEuzZfG0Vi/D0JXgogGagOX/Mslk7LXLexp/b1rUTbiuLZNoifkgUMVu7rCsDALxKtAPsAopFbEobc6I+WMzjX/Hcof9YgXjYZRXvP2TB9oNi2/XAtKQFumGVCDh22CAq5XfC3eRYka9Gl9AVyVkXDKKYuf8S3vWC0+yThNTU
2024-02-08 18:36:25 UTC	585	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 956 Connection: close Date: Thu, 08 Feb 2024 18:36:25 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65c51f29-22d79ab1303b5c293d83f838 X-Cache: Miss from cloudfront Via: 1.1 4a050b98a443ca2d3af477f9b4dc39ae.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: OKmXk9Z_NBfmuIo4l3tI82maSRFR3993Zvi_kqtWn8TTWeNfWrpBmw==
2024-02-08 18:36:25 UTC	956	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 5a 4f 4f 43 6e 79 73 45 41 41 41 41 3a 73 69 45 74 69 52 47 58 2f 52 30 2b 39 48 59 32 62 61 64 71 4b 34 73 55 74 69 38 56 78 57 49 4b 64 54 34 52 47 68 2f 73 6b 51 37 72 70 6d 52 35 6d 73 48 57 49 65 6a 38 43 46 6e 5a 4c 5a 6d 53 4f 6a 5a 70 64 4f 4e 42 48 49 7a 67 7a 2b 30 72 73 6e 77 6d 41 78 6f 4c 47 2f 66 64 35 70 4b 4e 39 50 4b 62 4e 59 78 4a 5a 72 36 6c 75 7a 33 73 35 2b 65 6c 51 38 79 44 6c 63 52 66 49 6a 62 2b 4c 39 54 79 49 30 61 7a 4b 43 73 47 76 4a 39 41 64 62 2f 68 4c 57 7a 2f 34 76 33 47 41 34 6c 76 45 43 6d 43 38 37 4d 4a 52 43 2f 2f 44 50 35 4e 57 6f 6b 67 76 6d 73 48 33 35 6f 73 44 56 70 Data Ascii: {"token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAZOOCnysEAAAA:siEtiRGX/R0+9HY2badqK4sUti8VxWIKdT4RGh/skQ7rpmR5msHWIej8CFnZLZmSOjZpdONBHIzgz+0rsnwmAxoLG/fd5pKN9PKbNYxJZr6luz3s5+elQ8yDlcRfIjb+L9TyI0azKCsGvJ9Adb/hLWz/4v3GA4lvECmC87MJRC//DP5NWokgvmsH35osDVp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
723	192.168.2.5	50573	108.138.64.67	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:25 UTC	3519	OUT	GET /pxgo?aid=304142&url=https%3A%2F%2Fbooking.kayak.com%2Fin%3Fsid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d%26mc%3DUSD%26bdclc%3Den-us%26p%3Dsearchbox_link%26a%3Dbdc%252Fsearchbox&lang=en-us&token=UmFuZG9tSVYkc2RlIyh9YWktmrwAPG7d0xk8r8arn9uxQCG04RxbSQCG3Kyo3zIaNexHWMoKu0qbl3rRCWS9daSJZv4LhXctU_el3FE0vNgKJ8hNlWe9qJoXT5IhePG9dCyDOzJbnuHCaAGOCzeet0EOLiq91dkwzC3ofHESfaCoiRkvryR2KY9hMMMCEaSQbh42JWjprUVJgsytEbxWusKdmBV920vtDV0Qc4vKU6CWH5hM7ZIoyur88Q_Up5rVMrYTkwsOl8QIoeAGx-hxYwGnLLjiUSzuVu3HgAX40_N1KLIQ1pNmFuICDyi7Ok9OPeLqkFj305jGZy2W4qXbtafIffpjnJ_uHn5mJ1Oj19alqdXhZU4hYg2HAvm4g9WxCgjTS-qOIOywGNnYDMS-CUucLD6aezL-JbdWUx7y2nkZnDUbV898LDag3xjKOkNdisznqEjxMnvrsW4ZtxuQ6nmIsQrBtErZBrHZaWEJOLUGKwAwfV0VyghAdsJCXRGr&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ HTTP/1.1 Host: booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXbnXawFhv%2Bov5qX2t%2BkjDX%2FSNhQS8UMKXEgF7SbTMk5lZRjRk40eE9ZIStvqAVmgL%2Fkvzh5mdRnhcUtlo5tJUKE0vMfULCoEeprAELqi%2FDgNs1lACo93R0nAlWUa3%2BA7gG0DsR2aw5zKj4nbG7Xq7OwI%3D; lastSeen=1707417382595; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _pxde=d5dadf87f7b6e46f5b193d46f8dee8a8ecca3afa2b41dfe76f695b43127f2ce3:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODQ0MjcsImZfa2IiOjAsImlwY19pZCI6W119
2024-02-08 18:36:25 UTC	1375	IN	HTTP/1.1 302 Found Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:25 GMT location: /flights/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=5171fc655664ddf74ab763a094523fb7&locale=en-us&from=booking&country=us&redirectToken=2deab0a6349fff61159693f590c6c1d5f46ceb1261688978697b77f22eea0dda set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5uElLJFy%2FMpu16BIgp6rCoG4mgRczGdZftU%2BjepkveHX7h8traIpPgim9Q7ViQ%2BSiKQ3KbSZTWDle%2Bi8elu9E7o9j%2Bvu6USdOOcmIPU4uuP%2BxCBp%2BpTb7VnlRQo9e1AwucHpui3GzN5TbohTtB0OKBn5%2FCGDe4Yawc%3D; domain=booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:25 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=b0ab82d4fe760023&e=UmFuZG9tSVYkc2RlIyh9YffsnAlzKnmyVvRIhTVoqR876gzxo32RbLLkyRvCfCdbGz44f0QPvcP93iWCt8ki4w x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 ea0f86c249e022d5015ce79f54e723d0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: p3vRO7PbCDgWfz0toQ-TxkmyuMe-uCRRorEaQhcdVUkHhB_eaap4vw==
2024-02-08 18:36:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
724	192.168.2.5	50577	3.161.150.72	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:25 UTC	3729	OUT	GET /js-track?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA HTTP/1.1 Host: account.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_ap_lang=en-us; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; bkng_ap=U2FsdGVkX19%2FWj7MIxTQoew6fVzm%2FavdeeT6w7Tou9chqgq42LIpRPd4nN%2B0lIRr6YV3VFQvOPJJ%0A%2FMglth7v%2BQ%3D%3D%0A; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXbnXawFhv%2Bov5qX2t%2BkjDX%2FSNhQS8UMKXEgF7SbTMk5lZRjRk40eE9ZIStvqAVmgL%2Fkvzh5mdRnhcUtlo5tJUKE0vMfULCoEeprAELqi%2FDgNs1lACo93R0nAlWUa3%2BA7gG0DsR2aw5zKj4nbG7Xq7OwI%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=1707417382595; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAZ/yB4ssWAAAA:7lFnQqmYWJ7p7DZtJNv+oFlvd12/w6itSlACDWcL4oXY/uaqDPYrqMYNRD09TQUO6/kcmEjW2mFd10raBlSeUsZJYlVo7BoiMT4zTRAoz5jIKiazydlkVJgL7XaYPF2fjYWLlmJNpmOoRhPG+6rh3gkyxVHdm8KzObMQxycSoMQ+/Q+rs2Ix1ovUhdXYUv2/gbY3fdQ4CD5sUmFKy/0fSMQOpP0=; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJlNTJkY2Q1MS02OTliLTQ1ZTgtODA3MC03Y2M5MWE1NzM1NmIiLCJzZXNzaW9ucyI6W119fQ
2024-02-08 18:36:25 UTC	2028	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:25 GMT allow: POST content-security-policy: frame-ancestors https://.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=340082d403aa0856&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgQ7uy0HoGirSBHxQkvc0a8b7dSlk3UnZ8Hl07F4DfKaD content-security-policy-report-only: base-uri 'none'; connect-src saa.booking.com secure.booking.com reports.booking.com privacyportal-eu.onetrust.com geolocation.onetrust.com cdn.cookielaw.org www.google-analytics.com .perimeterx.net .pxchk.net .px-cdn.net .px-client.net .px-cloud.net 'self' 'report-sample'; default-src .bstatic.com bstatic.com 'self'; frame-src https://www.youtube.com/embed/Vv4w5SmRkss .bstatic.com https://www.google.com bstatic.com www.booking.com secure.booking.com paymentcomponent.booking.com 'self'; img-src 'self' data: www.booking.com graph.facebook.com cdn.cookielaw.org account.booking.com .bstatic.com bstatic.com .static.booking.cn www.google-analytics.com www.google.com stats.g.doubleclick.net .px-cloud.net .perimeterx.net www.gstatic.com; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=213&pid=340082d403aa0856&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgQ7uy0HoGirSBHxQkvc0a8b7dSlk3UnZ8Hl07F4DfKaD; script-src saa.booking.com .bstatic.com bstatic.com .static.booking.cn www.google.com www.google-analytics.com cdn.cookielaw.org geolocation.onetrust.com 'self' 'nonce-f1jlp4ZmkrxDEAv' 'report-sample'; style-src .bstatic.com bstatic.com .static.booking.cn 'self' 'unsafe-inline' x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Error from cloudfront Via: 1.1 cc32f91d3d591d364f0c4e44eaf6525e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P5 X-Amz-Cf-Id: vdO7jRl0K-x-T1EKct5cZeeKOXzzqcHKpa6c74YMfEKx1TBmrZt_Ng==
2024-02-08 18:36:25 UTC	1621	IN	Data Raw: 36 34 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 2d 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 Data Ascii: 64e<!DOCTYPE html><html lang="en"><head><title>405 - Method Not Allowed</title><meta http-equiv="content-type" content="text/html; charset=utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta http-equiv="X-UA-Compat
2024-02-08 18:36:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
725	192.168.2.5	50575	104.18.130.236	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:25 UTC	393	OUT	GET /scripttemplates/202305.1.0/assets/otCommonStyles.css HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:25 UTC	826	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:36:25 GMT Content-Type: text/css Content-Length: 21608 Connection: close Content-MD5: oWkBTLgDDXvrUsd93y/Zxg== Last-Modified: Tue, 11 Jul 2023 02:35:52 GMT ETag: 0x8DB81B78BA27559 x-ms-request-id: f596e3ce-801e-0088-7b90-17dc8a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 34201 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8525fa62edbd674b-ATL
2024-02-08 18:36:25 UTC	543	IN	Data Raw: 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 7b 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 74 72 75 73 74 2d 76 65 6e 64 6f 72 73 2d 6c 69 73 74 2d 68 61 6e 64 6c 65 72 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 63 6f 6c 6f 72 3a 23 31 66 39 36 64 62 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 Data Ascii: #onetrust-banner-sdk{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:bold;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .one
2024-02-08 18:36:25 UTC	1369	IN	Data Raw: 6b 20 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 7b 6f 75 74 6c 69 6e 65 2d 6f 66 66 73 65 74 3a 31 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 62 6e 72 2d 77 2d 6c 6f 67 6f 20 2e 6f 74 2d 62 6e 72 2d 6c 6f 67 6f 7b 68 65 69 67 68 74 3a 36 34 70 78 3b 77 69 64 74 68 3a 36 34 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 Data Ascii: k #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk.ot-bnr-w-logo .ot-bnr-logo{height:64px;width:64px}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-icon,#ot-sync-ntfy .ot-close-icon{background-size:contain;background-repeat
2024-02-08 18:36:25 UTC	1369	IN	Data Raw: 74 2d 77 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 68 69 64 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 68 69 64 65 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 6f 74 2d 68 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 62 75 74 74 6f 6e 2e 6f 74 2d 6c 69 6e 6b 2d 62 74 6e 3a 68 6f 76 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 62 75 74 74 6f 6e 2e 6f 74 2d 6c 69 6e 6b 2d 62 74 6e 3a 68 6f 76 65 72 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 62 75 74 74 6f 6e 2e 6f 74 2d 6c 69 6e 6b 2d 62 74 6e 3a Data Ascii: t-weight:inherit;color:inherit}#onetrust-banner-sdk .ot-hide,#onetrust-pc-sdk .ot-hide,#ot-sync-ntfy .ot-hide{display:none !important}#onetrust-banner-sdk button.ot-link-btn:hover,#onetrust-pc-sdk button.ot-link-btn:hover,#ot-sync-ntfy button.ot-link-btn:
2024-02-08 18:36:25 UTC	1369	IN	Data Raw: 70 65 61 74 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 70 63 2d 6c 6f 67 6f 20 69 6d 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 70 63 2d 6c 6f 67 6f 20 69 6d 67 7b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 73 63 72 65 65 6e 2d 72 65 61 64 65 72 2d 6f 6e 6c 79 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 63 72 6e 2d 72 64 72 2c 2e 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 73 63 72 65 Data Ascii: peat;display:inline-flex;justify-content:center;align-items:center}#onetrust-pc-sdk .pc-logo img,#onetrust-pc-sdk .ot-pc-logo img{max-height:100%;max-width:100%}#onetrust-pc-sdk .screen-reader-only,#onetrust-pc-sdk .ot-scrn-rdr,.ot-sdk-cookie-policy .scre
2024-02-08 18:36:25 UTC	1369	IN	Data Raw: 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 34 32 36 70 78 29 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 38 39 36 70 78 29 61 6e 64 20 28 6f 72 69 65 6e 74 61 74 69 6f 6e 3a 20 6c 61 6e 64 73 63 61 70 65 29 7b 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 35 65 6d 7d 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 2d 69 6e 70 75 74 3a 66 6f 63 75 73 2b 6c 61 62 65 6c 7b 6f 75 74 6c 69 6e 65 3a 31 70 78 20 73 6f 6c 69 64 20 23 30 30 30 3b 6f 75 74 6c 69 6e 65 2d 73 74 79 6c 65 3a 61 75 74 6f 7d 2e 63 61 74 65 67 6f 72 79 2d 76 65 6e 64 6f 72 Data Ascii: tion:underline}@media only screen and (min-width: 426px)and (max-width: 896px)and (orientation: landscape){#onetrust-pc-sdk p{font-size:.75em}}#onetrust-banner-sdk .banner-option-input:focus+label{outline:1px solid #000;outline-style:auto}.category-vendor
2024-02-08 18:36:25 UTC	1369	IN	Data Raw: 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 20 70 61 74 68 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 20 70 61 74 68 7b 66 69 6c 6c 3a 23 33 32 61 65 38 38 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2a 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 3a 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 3a 3a 62 65 66 Data Ascii: sdk .ot-optout-signal svg path,#onetrust-pc-sdk .ot-optout-signal svg path{fill:#32ae88}#onetrust-banner-sdk,#onetrust-pc-sdk,#ot-sdk-cookie-policy,#ot-sync-ntfy{font-size:16px}#onetrust-banner-sdk *,#onetrust-banner-sdk ::after,#onetrust-banner-sdk ::bef
2024-02-08 18:36:25 UTC	1369	IN	Data Raw: 73 70 61 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 31 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 32 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 33 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 34 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 35 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 68 36 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 70 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 69 6d 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 73 76 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 62 75 74 74 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 73 65 63 74 69 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 61 2c 23 Data Ascii: span,#onetrust-pc-sdk h1,#onetrust-pc-sdk h2,#onetrust-pc-sdk h3,#onetrust-pc-sdk h4,#onetrust-pc-sdk h5,#onetrust-pc-sdk h6,#onetrust-pc-sdk p,#onetrust-pc-sdk img,#onetrust-pc-sdk svg,#onetrust-pc-sdk button,#onetrust-pc-sdk section,#onetrust-pc-sdk a,#
2024-02-08 18:36:25 UTC	1369	IN	Data Raw: 70 6f 6c 69 63 79 20 23 6f 74 2d 70 63 2d 63 6f 6e 74 65 6e 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 63 68 65 63 6b 62 6f 78 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 64 69 76 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 73 70 61 6e 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 31 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 32 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 33 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 34 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 35 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 68 36 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 70 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 69 6d 67 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 73 76 67 2c 23 6f 74 2d 73 79 6e 63 2d 6e Data Ascii: policy #ot-pc-content,#ot-sdk-cookie-policy .checkbox,#ot-sync-ntfy div,#ot-sync-ntfy span,#ot-sync-ntfy h1,#ot-sync-ntfy h2,#ot-sync-ntfy h3,#ot-sync-ntfy h4,#ot-sync-ntfy h5,#ot-sync-ntfy h6,#ot-sync-ntfy p,#ot-sync-ntfy img,#ot-sync-ntfy svg,#ot-sync-n
2024-02-08 18:36:25 UTC	1369	IN	Data Raw: 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 63 68 65 63 6b 62 6f 78 3a 61 66 74 65 72 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 63 68 65 63 6b 62 6f 78 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 6c 61 62 65 6c 3a 62 65 66 6f 72 65 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 6c 61 62 65 6c 3a 61 66 74 65 72 2c 23 6f 74 2d 73 79 Data Ascii: .checkbox:after,#onetrust-pc-sdk .checkbox:before,#ot-sdk-cookie-policy label:before,#ot-sdk-cookie-policy label:after,#ot-sdk-cookie-policy .checkbox:after,#ot-sdk-cookie-policy .checkbox:before,#ot-sync-ntfy label:before,#ot-sync-ntfy label:after,#ot-sy
2024-02-08 18:36:25 UTC	1369	IN	Data Raw: 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 73 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 2d 73 64 6b 2d 63 6f 6c 75 6d 6e 3a 66 69 72 73 74 2d 63 68 69 6c 64 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 2e 6f 74 Data Ascii: rust-banner-sdk .ot-sdk-column:first-child,#onetrust-banner-sdk .ot-sdk-columns:first-child,#onetrust-pc-sdk .ot-sdk-column:first-child,#onetrust-pc-sdk .ot-sdk-columns:first-child,#ot-sdk-cookie-policy .ot-sdk-column:first-child,#ot-sdk-cookie-policy .ot

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
726	192.168.2.5	50578	3.161.150.72	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:25 UTC	3730	OUT	GET /js-metric?op_token=EgVvYXV0aCL6AgoUdk8xS2Jsazd4WDl0VW4yY3BaTFMSCWF1dGhvcml6ZRo1aHR0cHM6Ly9zZWN1cmUuYm9va2luZy5jb20vbG9naW4uaHRtbD9vcD1vYXV0aF9yZXR1cm4qmQJVck1CZ2tRTlMxS2lxYWFyaE82dThHQzVwTHZiRHpoMDVKdjNPN2ZCVnJlNk5xNGZQYkJlVElFblZNM29hclVzS0pfem1ZSndQN2hqMnJ6TEt3SGF1Y2J6NmNPaVc2VE1UMkJvWVFoSTBFX09COEhjUXBLVXFuUmtEQUJUMUZrbjFHNV90cXNZS05nS3h3bkNsZTlWV2JtN3NQVUhGZ2tlVEZNNjZHbTJ6bUthRm1lb3FPWTN2WEllT1RCb1dra3hEa2lSUWpCWnFpTjBpMzU3QjlRdUJ5Wjk1MVJkV2NhZ0dqa283U3d2VVBoelFQYU1LYzA9KmV5SnBaQ0k2SW5SeVlYWmxiR3hsY2w5b1pXRmtaWElpZlE9PUIEY29kZSoxCI7IEjCKuoKOuukmOgBCAFigvpSuBpIBEHRyYXZlbGxlcl9oZWFkZXKaAQVpbmRleA HTTP/1.1 Host: account.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_ap_lang=en-us; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; bkng_ap=U2FsdGVkX19%2FWj7MIxTQoew6fVzm%2FavdeeT6w7Tou9chqgq42LIpRPd4nN%2B0lIRr6YV3VFQvOPJJ%0A%2FMglth7v%2BQ%3D%3D%0A; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkZ0wPxc0LXbnXawFhv%2Bov5qX2t%2BkjDX%2FSNhQS8UMKXEgF7SbTMk5lZRjRk40eE9ZIStvqAVmgL%2Fkvzh5mdRnhcUtlo5tJUKE0vMfULCoEeprAELqi%2FDgNs1lACo93R0nAlWUa3%2BA7gG0DsR2aw5zKj4nbG7Xq7OwI%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; lastSeen=1707417382595; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAZ/yB4ssWAAAA:7lFnQqmYWJ7p7DZtJNv+oFlvd12/w6itSlACDWcL4oXY/uaqDPYrqMYNRD09TQUO6/kcmEjW2mFd10raBlSeUsZJYlVo7BoiMT4zTRAoz5jIKiazydlkVJgL7XaYPF2fjYWLlmJNpmOoRhPG+6rh3gkyxVHdm8KzObMQxycSoMQ+/Q+rs2Ix1ovUhdXYUv2/gbY3fdQ4CD5sUmFKy/0fSMQOpP0=; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJlNTJkY2Q1MS02OTliLTQ1ZTgtODA3MC03Y2M5MWE1NzM1NmIiLCJzZXNzaW9ucyI6W119fQ
2024-02-08 18:36:25 UTC	2028	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:25 GMT allow: POST content-security-policy: frame-ancestors https://.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=1fe182d40436007d&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgcqlyvtE53jUv7zZDG9A52CoHkfRpkkvX2_sWfJPUPT3 content-security-policy-report-only: base-uri 'none'; connect-src saa.booking.com secure.booking.com reports.booking.com privacyportal-eu.onetrust.com geolocation.onetrust.com cdn.cookielaw.org www.google-analytics.com .perimeterx.net .pxchk.net .px-cdn.net .px-client.net .px-cloud.net 'self' 'report-sample'; default-src .bstatic.com bstatic.com 'self'; frame-src https://www.youtube.com/embed/Vv4w5SmRkss .bstatic.com https://www.google.com bstatic.com www.booking.com secure.booking.com paymentcomponent.booking.com 'self'; img-src 'self' data: www.booking.com graph.facebook.com cdn.cookielaw.org account.booking.com .bstatic.com bstatic.com .static.booking.cn www.google-analytics.com www.google.com stats.g.doubleclick.net .px-cloud.net .perimeterx.net www.gstatic.com; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=213&pid=1fe182d40436007d&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgcqlyvtE53jUv7zZDG9A52CoHkfRpkkvX2_sWfJPUPT3; script-src saa.booking.com .bstatic.com bstatic.com .static.booking.cn www.google.com www.google-analytics.com cdn.cookielaw.org geolocation.onetrust.com 'self' 'nonce-uHWYmn9KMEOy0M9' 'report-sample'; style-src .bstatic.com bstatic.com .static.booking.cn 'self' 'unsafe-inline' x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Error from cloudfront Via: 1.1 837baeb3003427e58f2f96283f64c760.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P5 X-Amz-Cf-Id: Di772Dr6239tDNkDQBPld-rJdIComx3Mx7aIFd9eKgQg98vnFp_EIw==
2024-02-08 18:36:25 UTC	1621	IN	Data Raw: 36 34 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 2d 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 Data Ascii: 64e<!DOCTYPE html><html lang="en"><head><title>405 - Method Not Allowed</title><meta http-equiv="content-type" content="text/html; charset=utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta http-equiv="X-UA-Compat
2024-02-08 18:36:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
727	192.168.2.5	50579	18.67.65.100	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:25 UTC	407	OUT	GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:25 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Thu, 08 Feb 2024 18:36:25 GMT X-Cache: Error from cloudfront Via: 1.1 9557da2570df16242f84a67f254d7f30.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: Vkp3XLxuRQ5LqWrv81rOK983w82Py7LC_UDgyrUk08A-CmnS8bKzAg==
2024-02-08 18:36:25 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
728	192.168.2.5	50581	35.190.10.96	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:25 UTC	657	OUT	POST /api/v2/collector HTTP/1.1 Host: collector-pxikkul2rm.px-cloud.net Connection: keep-alive Content-Length: 6758 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Origin: https://account.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:25 UTC	6758	OUT	Data Raw: 70 61 79 6c 6f 61 64 3d 61 55 6b 51 52 68 41 49 45 47 4a 71 41 77 49 42 41 67 45 51 48 68 42 57 45 41 68 4a 45 47 4a 71 41 77 4d 43 42 77 63 51 43 42 41 44 41 67 74 4f 42 41 52 4f 42 41 52 4f 42 51 4a 4f 43 67 49 51 48 68 42 69 61 67 4d 43 42 67 41 41 45 41 67 44 42 67 59 44 48 68 42 69 61 67 4d 43 42 41 63 4c 45 41 68 47 51 45 64 58 48 68 42 69 61 67 4d 43 41 51 4d 45 45 41 68 47 51 45 64 58 48 68 42 69 61 67 4d 43 42 51 59 41 45 41 67 51 56 46 4e 65 51 56 63 51 48 68 42 69 61 67 4d 44 41 77 59 4b 45 41 67 51 56 46 4e 65 51 56 63 51 48 68 42 69 61 67 4d 43 43 67 59 45 45 41 67 44 48 68 42 69 61 67 4d 43 41 51 41 42 45 41 67 44 48 68 42 69 61 67 4d 44 41 67 4d 48 45 41 67 51 45 42 34 51 59 6d 6f 44 41 67 63 4c 43 78 41 49 61 52 42 65 58 56 4e 57 5a 6c 74 Data Ascii: payload=aUkQRhAIEGJqAwIBAgEQHhBWEAhJEGJqAwMCBwcQCBADAgtOBAROBAROBQJOCgIQHhBiagMCBgAAEAgDBgYDHhBiagMCBAcLEAhGQEdXHhBiagMCAQMEEAhGQEdXHhBiagMCBQYAEAgQVFNeQVcQHhBiagMDAwYKEAgQVFNeQVcQHhBiagMCCgYEEAgDHhBiagMCAQABEAgDHhBiagMDAgMHEAgQEB4QYmoDAgcLCxAIaRBeXVNWZlt
2024-02-08 18:36:25 UTC	401	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:36:25 GMT Content-Type: application/json; charset=utf-8 Content-Length: 593 Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE Access-Control-Allow-Origin: https://account.booking.com Timing-Allow-Origin: * Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:25 UTC	593	IN	Data Raw: 7b 22 64 6f 22 3a 5b 22 62 61 6b 65 7c 5f 70 78 33 7c 33 33 30 7c 37 32 35 34 61 36 30 64 37 61 38 65 38 62 31 36 62 32 39 63 39 32 34 37 35 64 62 65 65 38 65 66 39 32 30 63 62 63 30 61 64 32 37 65 64 35 38 32 34 38 32 36 65 64 63 30 32 32 39 64 66 64 33 35 3a 4b 6d 67 2b 52 66 34 6a 58 66 42 39 62 76 49 72 6d 4d 79 4e 6a 51 4b 36 4f 45 64 6a 4e 74 34 65 73 4d 56 36 50 73 2b 63 54 6d 69 44 44 41 48 30 52 75 65 35 55 63 32 6b 6c 41 69 78 57 2f 48 52 54 6f 33 76 71 51 58 54 64 57 65 36 6f 4b 4b 39 74 35 44 38 4a 77 3d 3d 3a 31 30 30 30 3a 4a 7a 77 71 67 71 34 4b 4c 73 58 76 49 74 75 35 4a 56 54 49 44 79 35 65 6a 6a 72 71 73 6a 69 4f 56 7a 71 37 6f 38 31 67 4d 50 78 65 62 68 70 75 44 6b 78 66 6e 4d 4e 59 47 59 38 42 4f 65 42 63 68 7a 70 55 4f 4a 73 55 47 6c Data Ascii: {"do":["bake\|_px3\|330\|7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
729	192.168.2.5	50574	108.138.64.67	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:25 UTC	3008	OUT	GET /flights/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=5171fc655664ddf74ab763a094523fb7&locale=en-us&from=booking&country=us&redirectToken=2deab0a6349fff61159693f590c6c1d5f46ceb1261688978697b77f22eea0dda HTTP/1.1 Host: booking.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _pxde=d5dadf87f7b6e46f5b193d46f8dee8a8ecca3afa2b41dfe76f695b43127f2ce3:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODQ0MjcsImZfa2IiOjAsImlwY19pZCI6W119; _ga=GA1.2.421694156.1707417338; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5uElLJFy%2FMpu16BIgp6rCoG4mgRczGdZftU%2BjepkveHX7h8traIpPgim9Q7ViQ%2BSiKQ3KbSZTWDle%2Bi8elu9E7o9j%2Bvu6USdOOcmIPU4uuP%2BxCBp%2BpTb7VnlRQo9e1AwucHpui3GzN5TbohTtB0OKBn5%2FCGDe4Yawc%3D
2024-02-08 18:36:26 UTC	1178	IN	HTTP/1.1 301 Moved Permanently Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:26 GMT location: https://www.booking.com/flights/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=5171fc655664ddf74ab763a094523fb7&locale=en-us&from=booking&country=us&redirectToken=2deab0a6349fff61159693f590c6c1d5f46ceb1261688978697b77f22eea0dda nel: {"max_age":604800,"report_to":"default"} report-to: {"group":"default","endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":604800} strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=e8ae82d5655c02a7&e=UmFuZG9tSVYkc2RlIyh9YdPFJGDFjZSqK4Z-4dNTMVsc1HdgGoH-9v9RSKVXI3pxPx8Z7kup7tQ x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 c1bfc7dbcf7f9782aa3be590b7ce3d6a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 0-Op2YQtyWqBriJIXedtacQjAgoidisTf-0DJcy1QJTPUmq3e2NN3w==
2024-02-08 18:36:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
730	192.168.2.5	50582	35.190.10.96	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:26 UTC	373	OUT	GET /api/v2/collector HTTP/1.1 Host: collector-pxikkul2rm.px-cloud.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:26 UTC	284	IN	HTTP/1.1 405 Method Not Allowed Date: Thu, 08 Feb 2024 18:36:25 GMT Content-Type: application/json; charset=utf-8 Content-Length: 31 Allow: HEAD, POST, OPTIONS Timing-Allow-Origin: * Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:26 UTC	31	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 22 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 22 7d 0a Data Ascii: {"error":"Method Not Allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
731	192.168.2.5	50584	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:26 UTC	4146	OUT	GET /flights/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=5171fc655664ddf74ab763a094523fb7&locale=en-us&from=booking&country=us&redirectToken=2deab0a6349fff61159693f590c6c1d5f46ceb1261688978697b77f22eea0dda HTTP/1.1 Host: www.booking.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAfk6BVJUjAAAA:WDfXg2ry+HvbnxTztLnepFvhf3dpX4SdQfM4GczRrcPw6MWAZH8MErn+af2Y9SvAts7ySjM/T9nCQWaxTWJ+ECSRYADCgGFp6g8nwqAAp4uZuesbnPNMB9VWMMTR/6OqpiFI1lm6c8HTX0et8uTZTDvEovUpe/ZJPj+EvnZwpL1hdq9NKhFzFZb6nk1kcyw+S5Gmb0WW/JMfQvkBUX6FX8nHd2pkcvntEKFlkhvMXyaXZ+ocI5s4XxhjbVLG6yziJfNgBxF+; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLblgO%2Fz4BDP5uElLJFy%2FMpu16BIgp6rCoG4mgRczGdZftU%2BjepkveHX7h8traIpPgim9Q7ViQ%2BSiKQ3KbSZTWDle%2Bi8elu9E7o9j%2Bvu6USdOOcmIPU4uuP%2BxCBp%2BpTb7VnlRQo9e1AwucHpui3GzN5TbohTtB0OKBn5%2FCGDe4Yawc%3D; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119
2024-02-08 18:36:27 UTC	1682	IN	HTTP/1.1 302 Found Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:27 GMT location: /flights/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=5171fc655664ddf74ab763a094523fb7&from=booking& nel: {"max_age":604800,"report_to":"default"} report-to: {"group":"default","max_age":604800,"endpoints":[{"url":"https://nellie.booking.com/report"}]} set-cookie: _implmdnbl=2__1__0; path=/; expires=Sat, 09-Feb-2019 18:36:27 GMT; HttpOnly set-cookie: px_init=0; domain=booking.com; expires=Tue, 17-May-2078 13:12:54 GMT; SameSite=Strict; secure; HttpOnly set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhAzvMPWDzJgs6iNsykksowC0CgL60EDoIr88zzWjbHOM2kwqJ5bbIwanEAFY2ymu2dEBLidqoBVwTKbHkoMj1O%2BLocrziMCfA4oFKuUOCqQrVqfxFfuIkqtO1GsT9wf7lam%2FuBEtDrgo2okEfjnp1LW7AihyAX3ysY%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:27 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-type-options: nosniff x-recruiting: Like HTTP headers? Come write ours: https://careers.booking.com content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=587182d510ab0241&e=UmFuZG9tSVYkc2RlIyh9YWNWlKLi8IutTGI88Ci54-gXSWVJt-NgVB4jZ4wUafBq x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 c625b1bdde545acdeb26c9f6ad3a8c6e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: wAsXbgi4CVTAoY91dJU3wbU58FNsP-DvLbeYnFtIQYfBPx9Ec-KJIw==
2024-02-08 18:36:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
732	192.168.2.5	50585	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:27 UTC	4041	OUT	GET /flights/index.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=5171fc655664ddf74ab763a094523fb7&from=booking& HTTP/1.1 Host: www.booking.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAfk6BVJUjAAAA:WDfXg2ry+HvbnxTztLnepFvhf3dpX4SdQfM4GczRrcPw6MWAZH8MErn+af2Y9SvAts7ySjM/T9nCQWaxTWJ+ECSRYADCgGFp6g8nwqAAp4uZuesbnPNMB9VWMMTR/6OqpiFI1lm6c8HTX0et8uTZTDvEovUpe/ZJPj+EvnZwpL1hdq9NKhFzFZb6nk1kcyw+S5Gmb0WW/JMfQvkBUX6FX8nHd2pkcvntEKFlkhvMXyaXZ+ocI5s4XxhjbVLG6yziJfNgBxF+; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbXpFeYC4TUhAzvMPWDzJgs6iNsykksowC0CgL60EDoIr88zzWjbHOM2kwqJ5bbIwanEAFY2ymu2dEBLidqoBVwTKbHkoMj1O%2BLocrziMCfA4oFKuUOCqQrVqfxFfuIkqtO1GsT9wf7lam%2FuBEtDrgo2okEfjnp1LW7AihyAX3ysY%3D
2024-02-08 18:36:28 UTC	2668	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Content-Length: 901725 Connection: close date: Thu, 08 Feb 2024 18:36:28 GMT server: envoy vary: User-Agent, Accept-Encoding content-security-policy: base-uri 'none'; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=block&e=UmFuZG9tSVYkc2RlIyh9YYX-8qB8sBWzju5WmDl7IHU&pid=feba38c8c78949209e6dc34689f0c290; script-src 'nonce-c776b0b3cbec011672a1' 'report-sample' 'self' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' https: content-security-policy-report-only: frame-ancestors 'none'; frame-src https://.booking.com https://.doubleclick.net; report-uri https://nellie.booking.com/csp-report-uri?type=report&e=UmFuZG9tSVYkc2RlIyh9YYX-8qB8sBWzju5WmDl7IHU&pid=feba38c8c78949209e6dc34689f0c290 nel: {"report_to":"default","max_age":604800} reason: referrer-policy: no-referrer report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":604800,"group":"default"} set-cookie: _implmdnbl=2__1__0; path=/; expires=Sat, 09-Feb-2019 18:36:27 GMT; HttpOnly set-cookie: px_init=0; domain=booking.com; expires=Tue, 17-May-2078 13:12:54 GMT; SameSite=Strict; secure; HttpOnly set-cookie: fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; Max-Age=86400; Domain=.booking.com; Path=/; Expires=Fri, 09 Feb 2024 18:36:27 GMT; HttpOnly; Secure set-cookie: pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; Max-Age=31536000; Domain=.booking.com; Path=/; Expires=Fri, 07 Feb 2025 18:36:27 GMT; HttpOnly; Secure; SameSite=Strict set-cookie: fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; Domain=.booking.com; Path=/; Expires=Fri, 07 Feb 2025 18:36:28 GMT; HttpOnly; Secure set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3W%2BNL4quFW42Tdgsr2lQmhkj%2Fk4mI%2BTrnhecMjFPG%2FDvcPMlrXQlThAlGgTjgpGFFCJGfzukHp6ArijaWBMwPVZP%2FesWLKFmsG86c0W8fSjSVGEzYHJFRgb5uOXqsIPNgXjkQJaikxJpyece9f8XeEAvu0lzqDd7nY%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:28 GMT; Secure; HTTPOnly; SameSite=None status: 200 strict-transport-security: max-age=86400; includeSubDomains x-bookings-http-multivalue: HASH(0x7fd546d83ac8) x-content-type-options: nosniff x-content-type-options: nosniff x-envoy-upstream-service-time: 799 x-frame-options: SAMEORIGIN x-recruiting: Like HTTP headers? Come write ours: https://careers.booking.com x-request-id: feba38c8-c789-4920-9e6d-c34689f0c290 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 ea0f86c249e022d5015ce79f54e723d0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Yb6gPbaRnczjMc08k8xfjmSOh_ReYljnNAORJBFjTgBloulv_EXaYQ==
2024-02-08 18:36:28 UTC	16384	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 20 20 20 20 20 20 3c 21 2d 2d 0a 0a 20 20 20 20 20 20 59 6f 75 20 6b 6e 6f 77 20 79 6f 75 20 63 6f 75 6c 64 20 62 65 20 67 65 74 74 69 6e 67 20 70 61 69 64 20 74 6f 20 70 6f 6b 65 20 61 72 6f 75 6e 64 20 69 6e 20 6f 75 72 20 63 6f 64 65 3f 0a 20 20 20 20 20 20 57 65 27 72 65 20 68 69 72 69 6e 67 20 64 65 73 69 67 6e 65 72 73 20 61 6e 64 20 64 65 76 65 6c 6f 70 65 72 73 20 74 6f 20 77 6f 72 6b 20 69 6e 20 41 6d 73 74 65 72 64 61 6d 3a 0a 20 20 20 20 20 20 68 74 74 70 73 3a 2f 2f 63 61 72 65 65 72 73 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 0a 0a 20 20 20 20 20 20 2d 2d 3e 0a 0a 20 20 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 20 64 69 72 3d 22 6c 74 72 22 20 64 61 74 61 2d 64 65 76 69 63 65 3d 22 64 Data Ascii: <!doctype html> ... You know you could be getting paid to poke around in our code? We're hiring designers and developers to work in Amsterdam: https://careers.booking.com/ --> <html lang="en-us" dir="ltr" data-device="d
2024-02-08 18:36:28 UTC	11504	IN	Data Raw: 20 31 33 37 2e 30 35 35 20 31 32 2e 30 36 39 39 43 31 33 36 2e 34 32 32 20 31 33 2e 36 33 33 37 20 31 33 36 2e 32 36 35 20 31 35 2e 33 34 39 39 20 31 33 36 2e 36 30 35 20 31 37 2e 30 30 32 35 43 31 33 36 2e 39 34 35 20 31 38 2e 36 35 35 31 20 31 33 37 2e 37 36 37 20 32 30 2e 31 37 30 31 20 31 33 38 2e 39 36 36 20 32 31 2e 33 35 36 39 43 31 34 30 2e 31 36 35 20 32 32 2e 35 34 33 36 20 31 34 31 2e 36 38 39 20 32 33 2e 33 34 39 20 31 34 33 2e 33 34 35 20 32 33 2e 36 37 31 37 43 31 34 35 2e 30 30 31 20 32 33 2e 39 39 34 34 20 31 34 36 2e 37 31 35 20 32 33 2e 38 31 39 39 20 31 34 38 2e 32 37 32 20 32 33 2e 31 37 30 32 43 31 34 39 2e 38 32 39 20 32 32 2e 35 32 30 35 20 31 35 31 2e 31 36 20 32 31 2e 34 32 34 37 20 31 35 32 2e 30 39 35 20 32 30 2e 30 32 30 36 43 Data Ascii: 137.055 12.0699C136.422 13.6337 136.265 15.3499 136.605 17.0025C136.945 18.6551 137.767 20.1701 138.966 21.3569C140.165 22.5436 141.689 23.349 143.345 23.6717C145.001 23.9944 146.715 23.8199 148.272 23.1702C149.829 22.5205 151.16 21.4247 152.095 20.0206C
2024-02-08 18:36:28 UTC	16384	IN	Data Raw: 6c 75 65 3d 22 52 4f 55 4e 44 54 52 49 50 22 2f 3e 3c 6c 61 62 65 6c 20 66 6f 72 3d 22 73 65 61 72 63 68 5f 74 79 70 65 5f 6f 70 74 69 6f 6e 5f 52 4f 55 4e 44 54 52 49 50 22 20 63 6c 61 73 73 3d 22 53 74 61 63 6b 2d 72 65 61 63 74 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 6f 74 5f 5f 5f 32 44 42 6b 69 20 53 74 61 63 6b 2d 72 65 61 63 74 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 6f 74 2d 2d 67 61 70 2d 32 5f 5f 5f 6a 79 42 59 2b 20 53 74 61 63 6b 2d 72 65 61 63 74 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 6f 74 2d 2d 64 69 72 65 63 74 69 6f 6e 2d 72 6f 77 5f 5f 5f 53 4a 6f 2b 2b 20 53 74 61 63 6b 2d 72 65 61 63 74 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 6f 74 2d 2d 6e 6f 77 72 61 70 5f 5f 5f 4f 43 65 59 32 20 49 6e 70 75 74 52 61 64 69 6f 2d 6d 6f 64 75 6c 65 5f 5f 63 6f 6e 74 61 69 6e 65 Data Ascii: lue="ROUNDTRIP"/><label for="search_type_option_ROUNDTRIP" class="Stack-react-module__root___2DBki Stack-react-module__root--gap-2___jyBY+ Stack-react-module__root--direction-row___SJo++ Stack-react-module__root--nowrap___OCeY2 InputRadio-module__containe
2024-02-08 18:36:28 UTC	16384	IN	Data Raw: 33 20 32 2e 38 30 32 6c 33 2e 36 31 38 20 31 2e 38 2d 2e 31 31 37 2d 31 2e 32 37 2d 34 2e 34 36 31 20 33 2e 33 35 39 61 31 2e 38 35 20 31 2e 38 35 20 30 20 30 20 30 20 2e 32 38 39 20 33 2e 31 33 6c 31 2e 38 38 33 2e 39 33 33 61 31 2e 38 35 20 31 2e 38 35 20 30 20 30 20 30 20 31 2e 35 36 34 2e 30 33 37 6c 37 2e 33 38 31 2d 33 2e 32 34 38 2d 2e 36 33 36 2d 2e 30 31 34 20 33 2e 34 34 20 31 2e 37 31 61 33 2e 34 39 34 20 33 2e 34 39 34 20 30 20 31 20 30 20 33 2e 31 31 2d 36 2e 32 35 39 2e 37 35 2e 37 35 20 30 20 30 20 30 2d 2e 33 33 34 2d 2e 30 37 38 68 2d 2e 30 30 35 76 2e 37 35 6c 2e 33 32 39 2d 2e 36 37 34 7a 6d 2d 2e 36 35 38 20 31 2e 33 34 38 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 2e 33 32 39 2e 30 37 36 68 2e 30 30 35 76 2d 2e 37 35 6c 2d 2e 33 33 34 Data Ascii: 3 2.802l3.618 1.8-.117-1.27-4.461 3.359a1.85 1.85 0 0 0 .289 3.13l1.883.933a1.85 1.85 0 0 0 1.564.037l7.381-3.248-.636-.014 3.44 1.71a3.494 3.494 0 1 0 3.11-6.259.75.75 0 0 0-.334-.078h-.005v.75l.329-.674zm-.658 1.348a.75.75 0 0 0 .329.076h.005v-.75l-.334
2024-02-08 18:36:28 UTC	16384	IN	Data Raw: 36 31 5a 22 3e 3c 2f 70 61 74 68 3e 3c 2f 73 76 67 3e 3c 2f 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 3c 2f 62 75 74 74 6f 6e 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 6e 61 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 33 32 70 78 20 61 75 74 6f 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 73 74 61 72 74 3b 77 69 64 74 68 3a 31 30 30 25 22 20 63 6c 61 73 73 3d 22 46 72 61 6d 65 2d 6d 6f 64 75 6c 65 5f 5f 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 5f 63 65 6e 74 65 72 5f 5f 5f 64 5a 42 77 4c 20 46 72 61 6d 65 2d 6d 6f 64 75 6c 65 5f 5f 61 6c 69 67 6e 2d 69 74 65 6d 73 5f 73 74 61 72 74 5f 5f 5f 66 70 63 71 64 20 46 72 61 6d 65 2d 6d 6f 64 Data Ascii: 61Z"></path></svg></span></span></button></div></div></div></div></div></nav></div></div></div><div style="margin:32px auto;align-items:start;width:100%" class="Frame-module__justify-content_center___dZBwL Frame-module__align-items_start___fpcqd Frame-mod
2024-02-08 18:36:28 UTC	16384	IN	Data Raw: 53 68 47 51 20 49 6d 61 67 65 2d 6d 6f 64 75 6c 65 5f 5f 69 6d 61 67 65 2d 2d 63 6f 6e 74 65 6e 74 2d 6d 6f 64 65 2d 66 69 6c 6c 5f 5f 5f 78 36 46 66 33 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 71 2d 78 78 2e 62 73 74 61 74 69 63 2e 63 6f 6d 2f 78 64 61 74 61 2f 69 6d 61 67 65 73 2f 63 69 74 79 2f 73 71 75 61 72 65 32 31 30 2f 36 38 39 37 34 34 2e 6a 70 67 3f 6b 3d 33 63 37 63 36 64 35 39 64 39 36 38 63 32 62 61 64 65 39 30 30 33 64 39 65 62 66 38 61 31 33 34 36 34 35 35 63 65 39 32 61 62 65 39 34 66 66 61 61 32 39 32 34 37 38 33 39 31 36 31 66 30 39 65 26 61 6d 70 3b 6f 3d 22 20 61 6c 74 3d 22 43 68 69 63 61 67 6f 2c 20 55 6e 69 74 65 64 20 53 74 61 74 65 73 20 6f 66 20 41 6d 65 72 69 63 61 22 20 6c 6f 61 64 69 6e 67 3d 22 6c 61 7a 79 22 2f 3e 3c 2f Data Ascii: ShGQ Image-module__image--content-mode-fill___x6Ff3" src="https://q-xx.bstatic.com/xdata/images/city/square210/689744.jpg?k=3c7c6d59d968c2bade9003d9ebf8a1346455ce92abe94ffaa29247839161f09e&o=" alt="Chicago, United States of America" loading="lazy"/></
2024-02-08 18:36:29 UTC	16384	IN	Data Raw: 32 20 64 37 39 65 37 31 34 35 37 61 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 66 64 34 63 63 33 33 36 33 22 3e 3c 70 69 63 74 75 72 65 20 63 6c 61 73 73 3d 22 65 35 61 33 38 31 32 61 37 35 20 65 65 35 34 34 39 64 62 64 39 22 20 73 74 79 6c 65 3d 22 2d 2d 62 75 69 5f 69 6d 61 67 65 5f 77 69 64 74 68 2d 2d 73 3a 36 34 70 78 3b 2d 2d 62 75 69 5f 69 6d 61 67 65 5f 68 65 69 67 68 74 2d 2d 73 3a 36 34 70 78 22 3e 3c 69 6d 67 20 63 6c 61 73 73 3d 22 65 33 66 61 39 31 37 35 65 65 20 61 63 35 39 30 34 35 64 61 65 20 62 61 36 64 37 39 32 66 64 34 20 62 31 61 35 65 32 38 31 65 37 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 71 2d 63 66 2e 62 73 74 61 74 69 63 2e 63 6f 6d 2f 78 64 61 74 61 2f 69 6d 61 67 65 73 2f 63 69 74 79 2f 73 71 75 61 72 65 31 30 30 2f 39 37 Data Ascii: 2 d79e71457a"><div class="afd4cc3363"><picture class="e5a3812a75 ee5449dbd9" style="--bui_image_width--s:64px;--bui_image_height--s:64px"><img class="e3fa9175ee ac59045dae ba6d792fd4 b1a5e281e7" src="https://q-cf.bstatic.com/xdata/images/city/square100/97
2024-02-08 18:36:29 UTC	16384	IN	Data Raw: 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 35 33 63 62 66 61 36 64 65 20 66 34 35 64 38 65 34 63 33 32 20 63 63 36 30 61 37 63 32 34 37 22 3e 53 68 6f 72 74 65 73 74 20 66 6c 69 67 68 74 20 74 69 6d 65 3a 20 38 68 20 32 34 6d 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 38 31 37 30 39 30 35 35 30 20 61 37 63 66 31 61 36 62 31 64 22 3e 3c 61 20 64 61 74 61 2d 74 65 73 74 69 64 3d 22 69 6e 2d 70 72 6f 64 75 63 74 2d 69 6e 74 65 72 6c 69 6e 6b 69 6e 67 2d 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 66 6c 69 67 68 74 73 2f 72 6f 75 74 65 2f 61 74 6c 61 6e 74 61 2d 61 74 6c 2d 6d 61 64 72 69 64 2d 6d 61 64 Data Ascii: </div><div class="a53cbfa6de f45d8e4c32 cc60a7c247">Shortest flight time: 8h 24m</div></div></div></a></div><div class="b817090550 a7cf1a6b1d"><a data-testid="in-product-interlinking-item" href="https://www.booking.com/flights/route/atlanta-atl-madrid-mad
2024-02-08 18:36:29 UTC	16384	IN	Data Raw: 65 34 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 38 31 37 30 39 30 35 35 30 20 61 37 63 66 31 61 36 62 31 64 22 3e 3c 61 20 64 61 74 61 2d 74 65 73 74 69 64 3d 22 69 6e 2d 70 72 6f 64 75 63 74 2d 69 6e 74 65 72 6c 69 6e 6b 69 6e 67 2d 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 66 6c 69 67 68 74 73 2f 72 6f 75 74 65 2f 61 74 6c 61 6e 74 61 2d 61 74 6c 2d 63 61 69 72 6f 2d 63 61 69 2e 68 74 6d 6c 3f 6c 61 62 65 6c 3d 67 65 6e 31 37 33 6e 72 2d 31 46 43 41 45 6f 67 67 49 34 36 41 64 49 4d 31 67 45 61 49 38 43 69 41 45 42 6d 41 45 78 75 41 45 58 79 41 45 4d 32 41 45 42 36 41 45 42 2d 41 45 43 69 41 49 42 71 41 49 44 75 41 4c 7a 76 5a 53 75 42 73 41 43 41 64 49 43 4a 44 49 31 4e 6a 4d 30 5a 44 Data Ascii: e4"><div class="b817090550 a7cf1a6b1d"><a data-testid="in-product-interlinking-item" href="https://www.booking.com/flights/route/atlanta-atl-cairo-cai.html?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZD
2024-02-08 18:36:29 UTC	16384	IN	Data Raw: 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 6f 74 2d 2d 76 61 72 69 61 6e 74 2d 62 6f 64 79 5f 32 5f 5f 5f 2d 44 48 78 36 22 3e 59 65 73 2c 20 79 6f 75 20 63 61 6e 20 62 6f 6f 6b 20 6f 6e 65 2d 77 61 79 2c 20 72 6f 75 6e 64 2d 74 72 69 70 2c 20 61 6e 64 20 6d 75 6c 74 69 2d 63 69 74 79 20 66 6c 69 67 68 74 73 20 6f 6e 20 6f 75 72 20 73 69 74 65 2e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 47 72 69 64 2d 6d 6f 64 75 6c 65 5f 5f 63 6f 6c 75 6d 6e 5f 5f 5f 74 5a 2b 55 69 20 47 72 69 64 2d 6d 6f 64 75 6c 65 5f 5f 63 6f 6c 75 6d 6e 2d 2d 73 69 7a 65 2d 34 5f 5f 5f 2d 67 35 52 7a 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 46 72 65 71 75 65 6e 74 6c 79 41 73 6b 65 64 51 75 65 73 74 69 6f 6e Data Ascii: -module__root--variant-body_2___-DHx6">Yes, you can book one-way, round-trip, and multi-city flights on our site.</div></div></div></div></div><div class="Grid-module__column___tZ+Ui Grid-module__column--size-4___-g5Rz"><div class="FrequentlyAskedQuestion

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
733	192.168.2.5	50586	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:29 UTC	536	OUT	GET /flights/web/static/css/client.223e5f6f.css HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:29 UTC	529	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 320202 Connection: close Last-Modified: Tue, 06 Feb 2024 17:01:10 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 18:36:30 GMT ETag: "cbb6fd23baa5369c6e3c1c1e1f946d85" Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront Via: 1.1 18b5f66f1eab2d7dcc6c4816ba711386.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: _wItJ411v-5buPM990Rep2U-b46XmSz-0XIiKxAJLFTmCGZYchx6Kw== Vary: Origin
2024-02-08 18:36:29 UTC	15855	IN	Data Raw: 2e 49 63 6f 6e 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 6f 74 5f 5f 5f 74 69 59 6c 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 66 69 6c 6c 3a 63 75 72 72 65 6e 74 63 6f 6c 6f 72 7d 2e 49 63 6f 6e 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 6f 74 5f 5f 5f 74 69 59 6c 6f 20 73 76 67 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 6f 70 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 61 75 74 6f 7d 5b 64 69 72 3d 72 74 6c 5d 20 2e 49 63 6f 6e 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 6f 74 5f 5f 5f 74 69 59 6c 6f 20 73 76 67 5b 64 61 74 61 2d 72 74 6c 2d 66 6c 69 70 5d 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 58 28 2d 31 29 7d 2e 49 63 6f 6e 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 6f 74 Data Ascii: .Icon-module__root___tiYlo{display:inline-block;fill:currentcolor}.Icon-module__root___tiYlo svg{display:inline-block;vertical-align:top;height:100%;width:auto}[dir=rtl] .Icon-module__root___tiYlo svg[data-rtl-flip]{transform:scaleX(-1)}.Icon-module__root
2024-02-08 18:36:29 UTC	16384	IN	Data Raw: 74 6f 6e 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 6f 74 2d 2d 76 61 72 69 61 6e 74 2d 70 72 69 6d 61 72 79 2d 61 63 74 69 6f 6e 5f 5f 5f 33 5a 64 78 4a 2e 42 75 74 74 6f 6e 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 6f 74 2d 2d 61 63 74 69 76 65 5f 5f 5f 44 6c 56 54 4c 3a 62 65 66 6f 72 65 2c 2e 42 75 74 74 6f 6e 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 6f 74 2d 2d 76 61 72 69 61 6e 74 2d 70 72 69 6d 61 72 79 2d 61 63 74 69 6f 6e 5f 5f 5f 33 5a 64 78 4a 3a 6e 6f 74 28 2e 42 75 74 74 6f 6e 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 6f 74 2d 2d 6c 6f 61 64 69 6e 67 5f 5f 5f 61 32 57 45 72 29 3a 61 63 74 69 76 65 3a 62 65 66 6f 72 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 74 61 5f 68 69 67 68 6c 69 67 68 74 65 64 29 3b 62 6f 72 Data Ascii: ton-module__root--variant-primary-action___3ZdxJ.Button-module__root--active___DlVTL:before,.Button-module__root--variant-primary-action___3ZdxJ:not(.Button-module__root--loading___a2WEr):active:before{background-color:var(--bui_color_cta_highlighted);bor
2024-02-08 18:36:29 UTC	16384	IN	Data Raw: 7a 65 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 65 6d 70 68 61 73 69 7a 65 64 5f 32 5f 66 6f 6e 74 2d 77 65 69 67 68 74 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 65 6d 70 68 61 73 69 7a 65 64 5f 32 5f 6c 69 6e 65 2d 68 65 69 67 68 74 29 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 65 6d 70 68 61 73 69 7a 65 64 5f 32 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 29 7d 2e 42 75 74 74 6f 6e 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 6f 74 2d 2d 73 69 7a 65 2d 6c 61 72 67 65 5f 5f 5f 70 6e 44 5c 2b 48 7b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 20 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 Data Ascii: ze);font-weight:var(--bui_font_emphasized_2_font-weight);line-height:var(--bui_font_emphasized_2_line-height);font-family:var(--bui_font_emphasized_2_font-family)}.Button-module__root--size-large___pnD\+H{padding:var(--bui_spacing_2x) calc(var(--bui_spaci
2024-02-08 18:36:29 UTC	15917	IN	Data Raw: 67 5f 32 78 29 7d 2e 53 74 61 63 6b 2d 72 65 61 63 74 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 6f 74 2d 2d 67 61 70 2d 33 2d 2d 6c 5f 5f 5f 4e 78 38 4d 38 3e 2a 7b 2d 2d 62 75 69 5f 73 74 61 63 6b 5f 67 61 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 33 78 29 7d 2e 53 74 61 63 6b 2d 72 65 61 63 74 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 6f 74 2d 2d 67 61 70 2d 34 2d 2d 6c 5f 5f 5f 6a 33 62 62 7a 3e 2a 7b 2d 2d 62 75 69 5f 73 74 61 63 6b 5f 67 61 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 2e 53 74 61 63 6b 2d 72 65 61 63 74 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 6f 74 2d 2d 67 61 70 2d 36 2d 2d 6c 5f 5f 5f 33 46 4f 6d 68 3e 2a 7b 2d 2d 62 75 69 5f 73 74 61 63 6b 5f 67 61 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 36 Data Ascii: g_2x)}.Stack-react-module__root--gap-3--l___Nx8M8>{--bui_stack_gap:var(--bui_spacing_3x)}.Stack-react-module__root--gap-4--l___j3bbz>{--bui_stack_gap:var(--bui_spacing_4x)}.Stack-react-module__root--gap-6--l___3FOmh>*{--bui_stack_gap:var(--bui_spacing_6
2024-02-08 18:36:29 UTC	16384	IN	Data Raw: 6f 6f 74 2d 2d 64 69 72 65 63 74 69 6f 6e 2d 72 6f 77 2d 2d 6c 5f 5f 5f 67 58 67 72 4b 3a 6e 74 68 2d 63 68 69 6c 64 28 6e 29 7b 2d 77 65 62 6b 69 74 2d 6d 61 72 67 69 6e 2d 73 74 61 72 74 3a 69 6e 69 74 69 61 6c 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 30 3b 2d 77 65 62 6b 69 74 2d 6d 61 72 67 69 6e 2d 65 6e 64 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 74 61 63 6b 5f 63 6f 6d 70 65 6e 73 61 74 69 6f 6e 2c 20 30 29 2a 2d 31 29 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 74 61 63 6b 5f 63 6f 6d 70 65 6e 73 61 74 69 6f 6e 2c 20 30 29 2a 2d 31 29 3b 2d 77 65 62 6b 69 74 2d 6d 61 72 67 69 6e 2d 62 65 66 6f 72 65 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 74 61 Data Ascii: oot--direction-row--l___gXgrK:nth-child(n){-webkit-margin-start:initial;margin-inline-start:0;-webkit-margin-end:calc(var(--bui_stack_compensation, 0)-1);margin-inline-end:calc(var(--bui_stack_compensation, 0)-1);-webkit-margin-before:calc(var(--bui_sta
2024-02-08 18:36:29 UTC	16384	IN	Data Raw: 63 6f 6c 6f 72 5f 66 6f 72 65 67 72 6f 75 6e 64 29 3b 62 6f 72 64 65 72 3a 76 61 72 28 2d 2d 62 75 69 5f 61 6c 65 72 74 5f 62 6f 72 64 65 72 29 3b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 32 38 30 70 78 29 7b 2e 41 6c 65 72 74 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 6f 74 2d 2d 69 6e 6c 69 6e 65 2d 74 72 75 65 2d 2d 78 6c 5f 5f 5f 63 4d 54 45 57 7b 2d 2d 62 75 69 5f 61 6c 65 72 74 5f 74 69 74 6c 65 5f 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 2d 2d 62 75 69 5f 61 6c 65 72 74 5f 69 63 6f 6e 5f 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 62 6f 64 79 5f 32 5f 6c 69 6e 65 2d 68 65 69 67 68 74 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c Data Ascii: color_foreground);border:var(--bui_alert_border);padding:var(--bui_spacing_4x)}}@media (min-width:1280px){.Alert-module__root--inline-true--xl___cMTEW{--bui_alert_title_display:none;--bui_alert_icon_height:var(--bui_font_body_2_line-height);background-col
2024-02-08 18:36:29 UTC	16384	IN	Data Raw: 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 35 37 36 70 78 29 7b 2e 48 69 64 64 65 6e 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 6f 74 2d 2d 76 69 73 69 62 6c 65 2d 2d 6d 65 64 69 75 6d 5f 5f 5f 62 76 4d 7a 5c 2b 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 48 69 64 64 65 6e 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 6f 74 2d 2d 68 69 64 64 65 6e 2d 2d 6d 65 64 69 75 6d 5f 5f 5f 78 55 62 54 4b 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 30 32 34 70 78 29 7b 2e 48 69 64 64 65 6e 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 6f 74 2d 2d 76 69 73 69 62 6c 65 2d 2d 6c 61 72 67 65 5f 5f 5f 61 31 48 5a 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 48 69 64 64 65 6e 2d 6d 6f 64 75 Data Ascii: isplay:none}}@media (min-width:576px){.Hidden-module__root--visible--medium___bvMz\+{display:block}.Hidden-module__root--hidden--medium___xUbTK{display:none}}@media (min-width:1024px){.Hidden-module__root--visible--large___a1HZt{display:block}.Hidden-modu
2024-02-08 18:36:29 UTC	16384	IN	Data Raw: 2d 6d 6f 64 75 6c 65 5f 5f 69 63 6f 6e 5f 5f 5f 50 34 77 34 6f 7b 2d 77 65 62 6b 69 74 2d 6d 61 72 67 69 6e 2d 65 6e 64 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 68 61 6c 66 29 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 68 61 6c 66 29 7d 2e 43 61 6c 65 6e 64 61 72 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 6f 74 5f 5f 5f 75 79 56 50 68 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 43 61 6c 65 6e 64 61 72 2d 6d 6f 64 75 6c 65 5f 5f 6d 6f 6e 74 68 5f 5f 5f 43 74 36 67 67 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 Data Ascii: -module__icon___P4w4o{-webkit-margin-end:var(--bui_spacing_half);margin-inline-end:var(--bui_spacing_half)}.Calendar-module__root___uyVPh{position:relative}.Calendar-module__month___Ct6gg{display:flex;align-items:center;justify-content:center;text-align:c
2024-02-08 18:36:29 UTC	16384	IN	Data Raw: 72 5f 77 69 64 74 68 5f 31 30 30 29 3b 77 69 64 74 68 3a 61 75 74 6f 7d 2e 44 69 76 69 64 65 72 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 6f 74 2d 2d 76 65 72 74 69 63 61 6c 2d 74 72 75 65 5f 5f 5f 72 6e 6b 4f 4f 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 77 69 64 74 68 5f 31 30 30 29 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 35 37 36 70 78 29 7b 2e 44 69 76 69 64 65 72 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 6f 74 2d 2d 76 65 72 74 69 63 61 6c 2d 66 61 6c 73 65 2d 2d 6d 5f 5f 5f 44 4e 52 57 6f 7b 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 77 69 64 74 68 5f 31 30 30 29 3b 77 69 64 74 68 3a 61 75 74 6f 7d 2e 44 69 76 69 64 65 72 2d 6d 6f 64 75 6c 65 5f 5f 72 6f 6f Data Ascii: r_width_100);width:auto}.Divider-module__root--vertical-true___rnkOO{height:100%;width:var(--bui_border_width_100)}@media (min-width:576px){.Divider-module__root--vertical-false--m___DNRWo{height:var(--bui_border_width_100);width:auto}.Divider-module__roo
2024-02-08 18:36:29 UTC	16384	IN	Data Raw: 36 2d 2d 6c 5f 5f 5f 46 68 6a 70 5c 2b 2c 2e 47 72 69 64 2d 6d 6f 64 75 6c 65 5f 5f 63 6f 6c 75 6d 6e 2d 2d 73 69 7a 65 2d 68 61 6c 66 2d 2d 6c 5f 5f 5f 77 32 50 33 4a 7b 77 69 64 74 68 3a 63 61 6c 63 28 35 30 25 20 2d 20 76 61 72 28 2d 2d 62 75 69 5f 73 74 61 63 6b 5f 67 61 70 29 29 7d 2e 47 72 69 64 2d 6d 6f 64 75 6c 65 5f 5f 63 6f 6c 75 6d 6e 2d 2d 73 69 7a 65 2d 37 2d 2d 6c 5f 5f 5f 53 59 73 48 62 7b 77 69 64 74 68 3a 63 61 6c 63 28 35 38 2e 33 33 33 33 33 25 20 2d 20 76 61 72 28 2d 2d 62 75 69 5f 73 74 61 63 6b 5f 67 61 70 29 29 7d 2e 47 72 69 64 2d 6d 6f 64 75 6c 65 5f 5f 63 6f 6c 75 6d 6e 2d 2d 73 69 7a 65 2d 38 2d 2d 6c 5f 5f 5f 75 30 75 79 73 7b 77 69 64 74 68 3a 63 61 6c 63 28 36 36 2e 36 36 36 36 37 25 20 2d 20 76 61 72 28 2d 2d 62 75 69 5f 73 Data Ascii: 6--l___Fhjp\+,.Grid-module__column--size-half--l___w2P3J{width:calc(50% - var(--bui_stack_gap))}.Grid-module__column--size-7--l___SYsHb{width:calc(58.33333% - var(--bui_stack_gap))}.Grid-module__column--size-8--l___u0uys{width:calc(66.66667% - var(--bui_s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
734	192.168.2.5	50587	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:29 UTC	548	OUT	GET /flights/web/static/css/screens-Home.54999444.chunk.css HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:29 UTC	522	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 12379 Connection: close Date: Thu, 08 Feb 2024 18:36:30 GMT Last-Modified: Thu, 08 Feb 2024 14:27:04 GMT ETag: "42cab72a22bdacd7ea326dc6c8422bbc" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 a2f0bd0d8556fec697d62cda3ca8b386.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: tSG97m96vgPaQyvapcQi9Nq2b_rqLkpbrd7CuXOEwiKXhgNsrh34Hg== Vary: Origin
2024-02-08 18:36:29 UTC	12379	IN	Data Raw: 2e 43 68 65 61 70 46 6c 69 67 68 74 73 49 74 65 6d 2d 6d 6f 64 75 6c 65 5f 5f 61 6e 63 68 6f 72 43 6f 6e 74 61 69 6e 65 72 5f 5f 5f 48 55 7a 65 54 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 2e 43 68 65 61 70 46 6c 69 67 68 74 73 49 74 65 6d 2d 6d 6f 64 75 6c 65 5f 5f 69 6d 61 67 65 5f 5f 5f 6e 68 49 75 6d 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 72 61 64 69 75 73 5f 32 30 30 29 7d 2e 43 68 65 61 70 46 6c 69 67 68 74 73 49 74 65 6d 2d 6d 6f 64 75 6c 65 5f 5f 74 65 78 74 43 6f 6e 74 61 69 6e 65 72 5f 5f 5f 43 70 6c 32 4c 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 2e 43 68 65 61 70 Data Ascii: .CheapFlightsItem-module__anchorContainer___HUzeT{text-decoration:none;color:inherit}.CheapFlightsItem-module__image___nhIum{border-radius:var(--bui_border_radius_200)}.CheapFlightsItem-module__textContainer___Cpl2L{margin-top:var(--bui_spacing_4x)}.Cheap

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
735	192.168.2.5	50588	104.18.131.236	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:29 UTC	540	OUT	GET /consent/3ea94870-d4b1-483a-b1d2-faf1d982bb31/OtAutoBlock.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:29 UTC	902	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:36:29 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8525fa7af9d269ec-ATL CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 19587 Cache-Control: public, max-age=86400 Expires: Fri, 09 Feb 2024 18:36:29 GMT Last-Modified: Fri, 02 Feb 2024 12:54:10 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: a8doWUPDHagW0bVtce4Fxg== X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 6e74082e-b01e-0058-7fd7-55e1dc000000 x-ms-version: 2009-09-19 Server: cloudflare
2024-02-08 18:36:29 UTC	467	IN	Data Raw: 32 35 32 65 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 71 28 61 29 7b 76 61 72 20 63 3d 5b 5d 2c 62 3d 5b 5d 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 66 29 7b 66 6f 72 28 76 61 72 20 67 3d 7b 7d 2c 68 3d 30 3b 68 3c 75 2e 6c 65 6e 67 74 68 3b 68 2b 2b 29 7b 76 61 72 20 64 3d 75 5b 68 5d 3b 69 66 28 64 2e 54 61 67 3d 3d 3d 66 29 7b 67 3d 64 3b 62 72 65 61 6b 7d 76 61 72 20 6c 3d 76 6f 69 64 20 30 2c 6b 3d 64 2e 54 61 67 3b 76 61 72 20 43 3d 28 6b 3d 2d 31 21 3d 3d 6b 2e 69 6e 64 65 78 4f 66 28 22 68 74 74 70 3a 22 29 3f 6b 2e 72 65 70 6c 61 63 65 28 22 68 74 74 70 3a 22 2c 22 22 29 3a 6b 2e 72 65 70 6c 61 63 65 28 22 68 74 74 70 73 3a 22 2c 22 22 29 2c 2d 31 21 3d 3d 28 6c 3d 6b 2e 69 6e 64 65 78 4f 66 28 22 3f 22 29 29 3f 6b 2e 72 65 Data Ascii: 252e!function(){function q(a){var c=[],b=[],e=function(f){for(var g={},h=0;h<u.length;h++){var d=u[h];if(d.Tag===f){g=d;break}var l=void 0,k=d.Tag;var C=(k=-1!==k.indexOf("http:")?k.replace("http:",""):k.replace("https:",""),-1!==(l=k.indexOf("?"))?k.re
2024-02-08 18:36:29 UTC	1369	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 64 29 7b 76 61 72 20 6c 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 61 22 29 3b 0a 72 65 74 75 72 6e 20 6c 2e 68 72 65 66 3d 64 2c 2d 31 21 3d 3d 28 64 3d 6c 2e 68 6f 73 74 6e 61 6d 65 2e 73 70 6c 69 74 28 22 2e 22 29 29 2e 69 6e 64 65 78 4f 66 28 22 77 77 77 22 29 7c 7c 32 3c 64 2e 6c 65 6e 67 74 68 3f 64 2e 73 6c 69 63 65 28 31 29 2e 6a 6f 69 6e 28 22 2e 22 29 3a 6c 2e 68 6f 73 74 6e 61 6d 65 7d 28 66 29 3b 76 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 64 29 7b 72 65 74 75 72 6e 20 64 3d 3d 3d 68 7d 29 26 26 28 67 3d 5b 22 43 30 30 30 34 22 5d 29 3b 72 65 74 75 72 6e 20 67 7d 28 61 29 29 2c 7b 63 61 74 65 67 6f 72 79 49 64 73 3a 63 2c 76 73 43 61 74 49 64 73 3a 62 7d 7d 66 75 6e 63 74 69 6f Data Ascii: =function(d){var l=document.createElement("a");return l.href=d,-1!==(d=l.hostname.split(".")).indexOf("www")\|\|2<d.length?d.slice(1).join("."):l.hostname}(f);v.some(function(d){return d===h})&&(g=["C0004"]);return g}(a)),{categoryIds:c,vsCatIds:b}}functio
2024-02-08 18:36:29 UTC	1369	IN	Data Raw: 73 72 63 7c 7c 22 22 29 3b 28 62 2e 63 61 74 65 67 6f 72 79 49 64 73 2e 6c 65 6e 67 74 68 7c 7c 62 2e 76 73 43 61 74 49 64 73 2e 6c 65 6e 67 74 68 29 26 26 28 78 28 62 2e 63 61 74 65 67 6f 72 79 49 64 73 2c 61 2c 62 2e 76 73 43 61 74 49 64 73 29 2c 6d 28 62 2e 63 61 74 65 67 6f 72 79 49 64 73 2c 62 2e 76 73 43 61 74 49 64 73 29 7c 7c 28 61 2e 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 29 2c 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 62 65 66 6f 72 65 73 63 72 69 70 74 65 78 65 63 75 74 65 22 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 22 74 65 78 74 2f 70 6c 61 69 6e 22 3d 3d 3d 0a 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 29 26 26 65 2e 70 72 65 76 65 6e 74 44 65 66 61 75 6c 74 28 29 3b 61 2e 72 65 6d 6f 76 Data Ascii: src\|\|"");(b.categoryIds.length\|\|b.vsCatIds.length)&&(x(b.categoryIds,a,b.vsCatIds),m(b.categoryIds,b.vsCatIds)\|\|(a.type="text/plain"),a.addEventListener("beforescriptexecute",c=function(e){"text/plain"===a.getAttribute("type")&&e.preventDefault();a.remov
2024-02-08 18:36:29 UTC	1369	IN	Data Raw: 22 68 74 74 70 73 3a 2f 2f 6f 70 65 6e 2e 73 70 6f 74 69 66 79 2e 63 6f 6d 2f 65 6d 62 65 64 2f 70 6c 61 79 6c 69 73 74 2f 33 67 6c 6e 4a 33 74 70 4b 51 67 52 46 36 51 53 66 68 4b 4f 75 5a 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 6f 70 65 6e 2e 73 70 6f 74 69 66 79 2e 63 6f 6d 2f 65 6d 62 65 64 2f 70 6c 61 79 6c 69 73 74 2f 34 58 77 79 56 34 79 33 33 30 35 58 66 49 50 50 34 65 58 33 72 56 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6c 69 6e 6b 65 64 69 6e 2e 63 6f 6d 2f 70 78 2f 6c 69 5f 73 79 6e Data Ascii: "https://open.spotify.com/embed/playlist/3glnJ3tpKQgRF6QSfhKOuZ","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://open.spotify.com/embed/playlist/4XwyV4y3305XfIPP4eX3rV","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.linkedin.com/px/li_syn
2024-02-08 18:36:29 UTC	1369	IN	Data Raw: 2f 70 6c 75 67 69 6e 73 2f 75 61 2f 65 63 2e 6a 73 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 32 22 2c 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 6f 70 65 6e 2e 73 70 6f 74 69 66 79 2e 63 6f 6d 2f 65 6d 62 65 64 2f 70 6c 61 79 6c 69 73 74 2f 32 70 78 64 6a 32 58 50 67 35 39 39 49 5a 51 42 70 49 30 65 44 6d 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 66 6c 69 67 68 74 73 2f 73 69 74 65 6d 61 70 2f 63 6f 75 6e 74 72 79 2f 70 72 2e 68 74 6d 6c 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 Data Ascii: /plugins/ua/ec.js","CategoryId":["C0002","C0004"],"Vendor":null},{"Tag":"https://open.spotify.com/embed/playlist/2pxdj2XPg599IZQBpI0eDm","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://www.booking.com/flights/sitemap/country/pr.html","CategoryId":["
2024-02-08 18:36:29 UTC	1369	IN	Data Raw: 43 30 30 30 32 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 32 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 6f 70 65 6e 2e 73 70 6f 74 69 66 79 2e 63 6f 6d 2f 65 6d 62 65 64 2f 70 6c 61 79 6c 69 73 74 2f 35 71 6b 4f 67 59 55 35 78 4b 65 6a 67 46 6b 71 65 6c 54 63 58 41 22 2c 22 43 61 74 65 67 6f 72 79 49 64 22 3a 5b 22 43 30 30 30 34 22 5d 2c 22 56 65 6e 64 6f 72 22 3a 6e 75 6c 6c 7d 2c 7b 22 54 61 67 22 3a 22 68 74 74 70 73 3a 2f 2f 62 61 74 2e 62 69 6e 67 2e 63 6f 6d 2f 61 63 74 69 6f Data Ascii: C0002"],"Vendor":null},{"Tag":"https://www.googletagmanager.com/gtag/js","CategoryId":["C0002"],"Vendor":null},{"Tag":"https://open.spotify.com/embed/playlist/5qkOgYU5xKejgFkqelTcXA","CategoryId":["C0004"],"Vendor":null},{"Tag":"https://bat.bing.com/actio
2024-02-08 18:36:29 UTC	1369	IN	Data Raw: 6b 2e 6e 65 74 20 67 6f 6f 67 6c 65 61 64 73 65 72 76 69 63 65 73 2e 63 6f 6d 20 67 6f 6f 67 6c 65 73 79 6e 64 69 63 61 74 69 6f 6e 2e 63 6f 6d 20 6b 72 78 64 2e 6e 65 74 20 6c 69 61 64 6d 2e 63 6f 6d 20 6c 69 6e 6b 65 64 69 6e 2e 63 6f 6d 20 6f 75 74 62 72 61 69 6e 2e 63 6f 6d 20 72 75 62 69 63 6f 6e 70 72 6f 6a 65 63 74 2e 63 6f 6d 20 73 68 61 72 65 74 68 69 73 2e 63 6f 6d 20 74 61 62 6f 6f 6c 61 2e 63 6f 6d 20 74 77 69 74 74 65 72 2e 63 6f 6d 20 76 69 6d 65 6f 2e 63 6f 6d 20 79 61 68 6f 6f 2e 63 6f 6d 20 79 6f 75 74 75 62 65 2e 63 6f 6d 22 2e 73 70 6c 69 74 28 22 20 22 29 29 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 22 6e 75 6c 6c 22 21 3d 3d 61 26 26 61 2e 74 72 69 6d 28 29 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 20 61 7d Data Ascii: k.net googleadservices.com googlesyndication.com krxd.net liadm.com linkedin.com outbrain.com rubiconproject.com sharethis.com taboola.com twitter.com vimeo.com yahoo.com youtube.com".split(" ")).filter(function(a){if("null"!==a&&a.trim().length)return a}
2024-02-08 18:36:29 UTC	845	IN	Data Raw: 72 79 49 64 73 2c 68 2e 76 73 43 61 74 49 64 73 29 7c 7c 70 28 6c 29 3f 28 64 3d 67 2c 68 3d 61 2c 21 28 6c 3d 6b 29 2e 63 61 74 65 67 6f 72 79 49 64 73 2e 6c 65 6e 67 74 68 7c 7c 2d 31 3d 3d 3d 74 2e 69 6e 64 65 78 4f 66 28 64 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 7c 7c 6e 28 68 29 7c 7c 6d 28 6c 2e 63 61 74 65 67 6f 72 79 49 64 73 2c 6c 2e 76 73 43 61 74 49 64 73 29 7c 7c 70 28 68 29 3f 63 28 22 73 72 63 22 2c 66 29 3a 28 61 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 29 2c 63 28 22 64 61 74 61 2d 73 72 63 22 2c 66 29 2c 28 67 3d 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 63 6c 61 73 73 22 29 29 7c 7c 63 28 22 63 6c 61 73 73 22 2c 79 28 6b 2e 63 61 74 65 67 6f 72 79 49 64 73 2c 67 7c 7c 22 22 2c 6b 2e 76 73 43 61 74 49 Data Ascii: ryIds,h.vsCatIds)\|\|p(l)?(d=g,h=a,!(l=k).categoryIds.length\|\|-1===t.indexOf(d.toLowerCase())\|\|n(h)\|\|m(l.categoryIds,l.vsCatIds)\|\|p(h)?c("src",f):(a.removeAttribute("src"),c("data-src",f),(g=a.getAttribute("class"))\|\|c("class",y(k.categoryIds,g\|\|"",k.vsCatI
2024-02-08 18:36:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
736	192.168.2.5	50591	18.64.236.64	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:29 UTC	542	OUT	GET /psb/capla/static/css/6197bcab.88b5a402.chunk.css HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:29 UTC	584	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 890 Connection: close Date: Thu, 08 Feb 2024 18:36:30 GMT Last-Modified: Thu, 08 Feb 2024 17:18:51 GMT ETag: "607eac3f1dd66bfb5fc2869c5563e4d0" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 0gFAErdvzJpEYVvHcoNkteObor9NcXy. Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 190f65eebc0c7e2a61e00850eb7dae6a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: UKfAcC9PPmqHBlUZQDnOVp4xIdTVBMV0IAW29cqTgWohWWdRh0sWfQ== Vary: Origin
2024-02-08 18:36:29 UTC	890	IN	Data Raw: 2e 61 64 63 66 37 30 66 35 33 36 7b 2d 2d 62 75 69 5f 73 74 61 63 6b 5f 67 61 70 5f 6c 61 73 74 5f 63 68 69 6c 64 3a 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 2e 65 62 38 63 30 64 65 30 34 31 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 2e 62 62 34 32 64 34 30 61 31 35 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 20 2b 20 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 36 78 29 29 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 61 3a 6c 69 6e 6b 2e 62 62 34 32 64 34 30 61 31 35 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 2e 63 32 Data Ascii: .adcf70f536{--bui_stack_gap_last_child:0px;margin-top:var(--bui_spacing_4x)}.eb8c0de041{margin-top:var(--bui_spacing_4x)}.bb42d40a15{margin-bottom:calc(var(--bui_spacing_4x) + var(--bui_spacing_6x));display:block}a:link.bb42d40a15{text-decoration:none}.c2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
737	192.168.2.5	50590	18.64.236.64	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:29 UTC	534	OUT	GET /psb/capla/static/css/client.38ffee15.css HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:29 UTC	621	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 194527 Connection: close Date: Thu, 08 Feb 2024 12:50:07 GMT Last-Modified: Thu, 08 Feb 2024 12:34:07 GMT ETag: "c9009dc966b4c139ffffe886598ac0c0" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: eIF2AzqToVz8ZJUSLOnoWnohwEtsxZAT Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 2085ab9d73b5dc26e367fd24649672c2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: jnK1MZuhvMSbSsrzieQ_ETvJC440bEXOeoV3NvMEVu6nhuQv_2xWwQ== Age: 20783 Vary: Origin
2024-02-08 18:36:29 UTC	16384	IN	Data Raw: 3a 72 6f 6f 74 2c 5b 64 61 74 61 2d 62 75 69 2d 74 68 65 6d 65 3d 74 72 61 76 65 6c 6c 65 72 2d 6c 69 67 68 74 5d 7b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 3a 23 38 36 38 36 38 36 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 5f 61 6c 74 3a 23 65 37 65 37 65 37 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 62 6f 72 64 65 72 3a 23 30 30 36 63 65 34 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 5f 64 69 73 61 62 6c 65 64 3a 23 64 39 64 39 64 39 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 62 6f 72 64 65 72 3a 23 64 34 31 31 31 65 3b 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 6f 6e 73 74 72 75 63 74 69 76 65 5f 62 6f 72 64 65 72 3a 23 30 30 38 32 33 34 3b 2d 2d 62 75 69 5f 63 6f 6c Data Ascii: :root,[data-bui-theme=traveller-light]{--bui_color_border:#868686;--bui_color_border_alt:#e7e7e7;--bui_color_action_border:#006ce4;--bui_color_border_disabled:#d9d9d9;--bui_color_destructive_border:#d4111e;--bui_color_constructive_border:#008234;--bui_col
2024-02-08 18:36:29 UTC	10463	IN	Data Raw: 67 68 74 3a 34 30 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 31 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 41 76 65 6e 69 72 20 4e 65 78 74 22 2c 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 53 65 67 6f 65 20 55 49 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 32 5f 66 6f 6e 74 2d 73 69 7a 65 3a 32 34 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 32 5f 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 66 65 61 74 75 72 65 64 5f 32 5f 6c 69 6e 65 2d 68 65 69 67 68 74 3a 33 32 70 78 3b 2d 2d 62 75 69 5f 66 6f Data Ascii: ght:40px;--bui_font_featured_1_font-family:"Avenir Next",BlinkMacSystemFont,-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;--bui_font_featured_2_font-size:24px;--bui_font_featured_2_font-weight:400;--bui_font_featured_2_line-height:32px;--bui_fo
2024-02-08 18:36:29 UTC	16384	IN	Data Raw: 6f 6c 75 74 65 3b 6c 65 66 74 3a 30 3b 72 69 67 68 74 3a 30 3b 74 6f 70 3a 30 3b 62 6f 74 74 6f 6d 3a 30 3b 62 6f 72 64 65 72 3a 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 69 6e 6e 65 72 5f 69 6e 6e 65 72 5f 61 66 74 65 72 5f 62 6f 72 64 65 72 5f 77 69 64 74 68 29 7d 2e 64 65 63 30 30 37 38 65 37 63 3a 61 66 74 65 72 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 2d 34 35 64 65 67 29 7d 2e 65 32 39 63 31 66 39 33 38 32 3a 61 66 74 65 72 2c 2e 65 32 39 63 31 66 39 33 38 32 3a 62 65 66 6f 72 65 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 7d 2e 65 32 39 63 Data Ascii: olute;left:0;right:0;top:0;bottom:0;border:solid transparent;border-radius:50%;border-width:var(--bui_spinner_inner_after_border_width)}.dec0078e7c:after{transform:rotate(-45deg)}.e29c1f9382:after,.e29c1f9382:before{background:var(--bui_color_white)}.e29c
2024-02-08 18:36:29 UTC	1825	IN	Data Raw: 65 69 67 68 74 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 65 6d 70 68 61 73 69 7a 65 64 5f 32 5f 6c 69 6e 65 2d 68 65 69 67 68 74 29 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 65 6d 70 68 61 73 69 7a 65 64 5f 32 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 29 7d 2e 62 61 32 64 32 36 38 66 65 34 7b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 20 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 20 2b 20 76 61 72 28 2d 2d 62 75 69 5f 62 75 74 74 6f 6e 5f 69 6e 6c 69 6e 65 5f 70 61 64 64 69 6e 67 5f 65 78 74 72 61 2c 20 30 70 78 29 29 3b 6d 61 72 67 69 6e 2d 62 6c 6f 63 6b 2d 73 74 61 72 74 3a 76 61 72 28 2d 2d 62 Data Ascii: eight);line-height:var(--bui_font_emphasized_2_line-height);font-family:var(--bui_font_emphasized_2_font-family)}.ba2d268fe4{padding:var(--bui_spacing_2x) calc(var(--bui_spacing_4x) + var(--bui_button_inline_padding_extra, 0px));margin-block-start:var(--b
2024-02-08 18:36:29 UTC	16384	IN	Data Raw: 69 74 69 61 6c 29 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 76 61 72 28 2d 2d 62 75 69 5f 62 75 74 74 6f 6e 5f 6c 61 72 67 65 5f 6d 61 72 67 69 6e 5f 69 6e 6c 69 6e 65 5f 65 6e 64 2c 69 6e 69 74 69 61 6c 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 2a 31 32 29 3b 6d 69 6e 2d 77 69 64 74 68 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 2a 31 32 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 65 6d 70 68 61 73 69 7a 65 64 5f 31 5f 66 6f 6e 74 2d 73 69 7a 65 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 65 6d 70 68 61 73 69 7a 65 64 5f 31 5f 66 6f 6e 74 2d 77 65 69 Data Ascii: itial);margin-inline-end:var(--bui_button_large_margin_inline_end,initial);min-height:calc(var(--bui_spacing_1x)12);min-width:calc(var(--bui_spacing_1x)12);font-size:var(--bui_font_emphasized_1_font-size);font-weight:var(--bui_font_emphasized_1_font-wei
2024-02-08 18:36:29 UTC	3015	IN	Data Raw: 78 2d 77 72 61 70 3a 77 72 61 70 7d 2e 61 64 35 36 61 32 36 32 30 36 7b 66 6c 65 78 2d 77 72 61 70 3a 77 72 61 70 2d 72 65 76 65 72 73 65 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 30 32 34 70 78 29 7b 2e 66 63 37 39 30 63 35 30 35 39 7b 66 6c 65 78 2d 77 72 61 70 3a 6e 6f 77 72 61 70 7d 2e 64 66 30 38 34 61 61 64 36 35 7b 66 6c 65 78 2d 77 72 61 70 3a 77 72 61 70 7d 2e 64 66 61 66 39 62 34 37 33 33 7b 66 6c 65 78 2d 77 72 61 70 3a 77 72 61 70 2d 72 65 76 65 72 73 65 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 32 38 30 70 78 29 7b 2e 62 31 38 65 62 61 33 32 39 65 7b 66 6c 65 78 2d 77 72 61 70 3a 6e 6f 77 72 61 70 7d 2e 66 38 66 33 61 31 36 34 65 66 7b 66 6c 65 78 2d 77 72 61 70 3a 77 72 61 70 7d 2e 64 61 37 38 63 32 Data Ascii: x-wrap:wrap}.ad56a26206{flex-wrap:wrap-reverse}}@media (min-width:1024px){.fc790c5059{flex-wrap:nowrap}.df084aad65{flex-wrap:wrap}.dfaf9b4733{flex-wrap:wrap-reverse}}@media (min-width:1280px){.b18eba329e{flex-wrap:nowrap}.f8f3a164ef{flex-wrap:wrap}.da78c2
2024-02-08 18:36:29 UTC	16384	IN	Data Raw: 62 75 69 5f 61 63 74 69 6f 6e 5f 62 61 72 5f 63 6f 6e 74 61 69 6e 65 72 5f 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 65 6c 65 76 61 74 69 6f 6e 5f 74 77 6f 0a 20 20 20 20 29 3b 2d 2d 62 75 69 5f 61 63 74 69 6f 6e 5f 62 61 72 5f 63 6f 6e 74 61 69 6e 65 72 5f 62 6f 72 64 65 72 5f 62 6c 6f 63 6b 5f 73 74 61 72 74 3a 30 70 78 3b 2d 2d 62 75 69 5f 61 63 74 69 6f 6e 5f 62 61 72 5f 63 6f 6e 74 61 69 6e 65 72 5f 62 65 66 6f 72 65 5f 63 6f 6e 74 65 6e 74 3a 22 22 7d 2e 61 35 33 36 31 37 62 38 66 61 7b 2d 2d 62 75 69 5f 61 63 74 69 6f 6e 5f 62 61 72 5f 63 6f 6e 74 61 69 6e 65 72 5f 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 0a 20 20 20 20 20 20 2d 2d 62 75 69 5f 63 6f 6c Data Ascii: bui_action_bar_container_background:var( --bui_color_background_elevation_two );--bui_action_bar_container_border_block_start:0px;--bui_action_bar_container_before_content:""}.a53617b8fa{--bui_action_bar_container_background:var( --bui_col
2024-02-08 18:36:29 UTC	16384	IN	Data Raw: 5f 68 65 61 64 6c 69 6e 65 5f 32 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 29 7d 2e 65 64 64 30 64 64 32 65 38 64 7b 68 65 69 67 68 74 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 2a 33 32 29 3b 77 69 64 74 68 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 2a 33 32 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 68 65 61 64 6c 69 6e 65 5f 31 5f 66 6f 6e 74 2d 73 69 7a 65 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 68 65 61 64 6c 69 6e 65 5f 31 5f 66 6f 6e 74 2d 77 65 69 67 68 74 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 68 65 61 64 6c 69 6e 65 5f 31 5f 6c 69 6e 65 2d 68 65 Data Ascii: _headline_2_font-family)}.edd0dd2e8d{height:calc(var(--bui_spacing_1x)32);width:calc(var(--bui_spacing_1x)32);font-size:var(--bui_font_headline_1_font-size);font-weight:var(--bui_font_headline_1_font-weight);line-height:var(--bui_font_headline_1_line-he
2024-02-08 18:36:29 UTC	1514	IN	Data Raw: 32 66 61 65 3a 68 6f 76 65 72 2c 2e 66 61 31 65 32 61 32 66 61 65 3a 68 6f 76 65 72 3a 61 66 74 65 72 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 66 6f 72 65 67 72 6f 75 6e 64 5f 64 69 73 61 62 6c 65 64 29 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 63 75 72 73 6f 72 3a 64 65 66 61 75 6c 74 7d 2e 62 30 65 32 32 37 64 39 38 38 7b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 2e 64 38 30 36 32 31 31 65 36 39 7b 6d 61 72 67 69 6e 2d 62 6c 6f 63 6b 2d 73 74 61 72 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 7d 2e 62 32 39 30 64 37 32 63 39 61 7b 62 6f 72 64 65 72 2d 62 6c 6f 63 6b 2d 73 74 61 72 74 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 77 69 64 74 68 5f 31 30 30 29 20 73 6f 6c 69 64 20 76 Data Ascii: 2fae:hover,.fa1e2a2fae:hover:after{color:var(--bui_color_foreground_disabled);background:none;cursor:default}.b0e227d988{max-width:100%}.d806211e69{margin-block-start:var(--bui_spacing_1x)}.b290d72c9a{border-block-start:var(--bui_border_width_100) solid v
2024-02-08 18:36:29 UTC	16384	IN	Data Raw: 6e 7d 2e 62 36 36 61 32 38 65 35 37 35 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 22 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 69 6e 73 65 74 3a 30 3b 6f 70 61 63 69 74 79 3a 76 61 72 28 2d 2d 62 75 69 5f 73 6b 65 6c 65 74 6f 6e 5f 6c 6f 61 64 65 72 2d 2d 63 6f 6c 6f 72 5f 6f 70 61 63 69 74 79 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 73 6b 65 6c 65 74 6f 6e 5f 6c 6f 61 64 65 72 2d 2d 62 61 63 6b 67 72 6f 75 6e 64 5f 63 6f 6c 6f 72 29 7d 2e 62 36 36 61 32 38 65 35 37 35 3a 61 66 74 65 72 7b 63 6f 6e 74 65 6e 74 3a 22 22 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 77 69 64 74 68 3a 38 30 70 78 3b 69 6e 73 65 74 2d 62 6c 6f 63 6b 2d 73 74 61 Data Ascii: n}.b66a28e575:before{content:"";position:absolute;inset:0;opacity:var(--bui_skeleton_loader--color_opacity);background-color:var(--bui_skeleton_loader--background_color)}.b66a28e575:after{content:"";position:absolute;height:100%;width:80px;inset-block-sta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
738	192.168.2.5	50589	18.64.236.64	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:29 UTC	542	OUT	GET /psb/capla/static/css/4bac1f1e.6ef899ee.chunk.css HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:29 UTC	619	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 2247 Connection: close Date: Wed, 07 Feb 2024 21:04:30 GMT Last-Modified: Wed, 07 Feb 2024 13:32:13 GMT ETag: "ab47dae8d780ca3887e8fcd93da2b469" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: C3e8ZL8VLFDh79YUndDn8kD9AFmjxZNK Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 f48cffdc03f0808f9e716538a6340862.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: 1VXvsGFuX6HMcRKT-zRWJX2haFnGZX9ECF1p7p8xI0tSxJleSxh-8A== Age: 77520 Vary: Origin
2024-02-08 18:36:29 UTC	2247	IN	Data Raw: 2e 61 37 35 65 32 64 37 61 38 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 62 61 73 65 5f 61 6c 74 29 7d 2e 66 30 65 37 34 37 39 61 61 65 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 38 78 29 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 38 78 29 7d 2e 66 34 34 64 35 65 31 30 39 39 7b 6d 61 78 2d 77 69 64 74 68 3a 31 39 36 70 78 7d 2e 62 65 39 30 38 62 32 35 39 61 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 62 61 73 65 5f 61 6c 74 29 7d 2e 64 39 61 62 65 37 30 37 63 38 2e Data Ascii: .a75e2d7a8e{background-color:var(--bui_color_background_base_alt)}.f0e7479aae{padding-top:var(--bui_spacing_8x);padding-bottom:var(--bui_spacing_8x)}.f44d5e1099{max-width:196px}.be908b259a{background-color:var(--bui_color_background_base_alt)}.d9abe707c8.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
739	192.168.2.5	50592	35.190.10.96	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:29 UTC	657	OUT	POST /api/v2/collector HTTP/1.1 Host: collector-pxikkul2rm.px-cloud.net Connection: keep-alive Content-Length: 1950 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Origin: https://account.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:29 UTC	1950	OUT	Data Raw: 70 61 79 6c 6f 61 64 3d 61 55 6b 51 52 68 41 49 45 47 4a 71 41 77 49 4b 42 67 63 51 48 68 42 57 45 41 68 4a 45 47 4a 71 41 77 49 4b 41 51 49 51 43 41 51 47 42 42 34 51 59 6d 6f 44 41 77 4d 47 41 78 41 49 42 67 59 44 48 68 42 69 61 67 4d 43 42 51 49 48 45 41 67 51 5a 6b 74 43 56 33 64 41 51 46 31 41 43 42 4a 78 55 31 78 63 58 55 59 53 51 46 64 54 56 68 4a 43 51 46 31 43 56 30 42 47 57 31 64 42 45 6c 31 55 45 6c 78 48 58 6c 34 53 47 6b 42 58 55 31 5a 62 58 46 55 53 46 51 49 56 47 32 35 63 45 68 49 53 45 6c 4e 47 45 6e 4e 47 45 68 70 61 52 6b 5a 43 51 51 67 64 48 55 41 63 55 45 46 47 55 30 5a 62 55 52 78 52 58 56 38 64 58 6c 74 51 51 52 31 54 51 56 64 52 48 56 42 47 58 31 56 66 52 68 31 43 53 68 78 45 42 52 77 48 48 41 45 63 58 31 74 63 48 46 68 42 43 41 41 Data Ascii: payload=aUkQRhAIEGJqAwIKBgcQHhBWEAhJEGJqAwIKAQIQCAQGBB4QYmoDAwMGAxAIBgYDHhBiagMCBQIHEAgQZktCV3dAQF1ACBJxU1xcXUYSQFdTVhJCQF1CV0BGW1dBEl1UElxHXl4SGkBXU1ZbXFUSFQIVG25cEhISElNGEnNGEhpaRkZCQQgdHUAcUEFGU0ZbURxRXV8dXltQQR1TQVdRHVBGX1VfRh1CShxEBRwHHAEcX1tcHFhBCAA
2024-02-08 18:36:30 UTC	400	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:36:29 GMT Content-Type: application/json; charset=utf-8 Content-Length: 10 Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE Access-Control-Allow-Origin: https://account.booking.com Timing-Allow-Origin: * Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:30 UTC	10	IN	Data Raw: 7b 22 64 6f 22 3a 5b 5d 7d 0a Data Ascii: {"do":[]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
740	192.168.2.5	50304	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:30 UTC	615	OUT	GET /design-assets/assets/v3.99.1/illustrations-traveller/MagnifyingGlassUsp.png HTTP/1.1 Host: t-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:30 UTC	528	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 3358 Connection: close Last-Modified: Tue, 10 Oct 2023 12:25:25 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 18:36:31 GMT ETag: "5966a74d467ac8907792c738d59e8218" Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront Via: 1.1 145bb9cba9e12350510f02ee9ab6ca22.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: rMxXsFftFN2GM-jCB-7tZA0g04efzXEjAfCktoa-PcFFNr3C8P0kog== Vary: Origin
2024-02-08 18:36:30 UTC	3358	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 78 00 00 00 78 08 03 00 00 00 0e ba c6 e0 00 00 01 23 50 4c 54 45 4c 69 71 09 6b da f3 68 02 0b 73 e3 06 5d c5 0a 6d dc 07 61 ca 0b 73 e3 09 6e dd ff b6 00 09 6b d9 09 6e de 09 6f dd 07 66 d3 09 6e dd 0a 70 df 0a 72 e3 0a 72 e3 0a 71 e0 0a 6e dc fe b0 00 fd a5 00 09 6b d9 fe ae 00 ff ae 00 04 54 ba ff b7 00 ff b7 00 fe b3 00 01 47 a7 ff b7 00 ff b7 00 fc a8 01 f0 86 0a ff b7 00 f6 6a 00 08 5d c3 cf 6b 21 f9 88 00 79 6e 73 28 58 9b ff ff ff bc dc f5 0b 74 e4 fe fe ff b9 db f5 ff b7 00 09 71 e2 fc fd ff af d7 f7 e0 f0 fc f8 fc ff 09 6f de e7 f3 fd f3 fa fe ed f6 fe b4 d9 f6 a1 d2 f8 c0 de f5 d9 ec fb c9 e4 fa 00 41 9f 01 47 a7 04 53 b7 05 59 bf 02 4c af a9 d5 f9 09 6b d8 07 64 cf d1 e9 fb 98 ce f9 8c Data Ascii: PNGIHDRxx#PLTELiqkhs]masnknofnprrqnkTGj]k!yns(XtqoAGSYLkd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
741	192.168.2.5	50593	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:30 UTC	550	OUT	GET /flights/web/static/js/client.ae384b8e.js HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:30 UTC	578	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 1154916 Connection: close Date: Thu, 08 Feb 2024 15:05:46 GMT Last-Modified: Thu, 08 Feb 2024 14:27:12 GMT ETag: "69393d6b6a9ad309f4c96d0c1f6cfa5a" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 d6a35bbafad9c6ab102b2f66ffd65942.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: PCKLDBhA1Z1BBxBql0X7CixqJo5oZR5Lk5ZP8SaGD61wIjfSzYhAJA== Age: 12645 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:36:30 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 63 6c 69 65 6e 74 2e 61 65 33 38 34 62 38 65 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 76 61 72 20 63 6c 69 65 6e 74 3b 28 28 29 3d 3e 7b 76 61 72 20 65 3d 7b 36 32 32 34 33 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 74 68 69 73 26 26 74 68 69 73 2e 5f 5f 63 72 65 61 74 65 42 69 6e 64 69 6e 67 7c 7c 28 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 76 6f 69 64 20 30 3d 3d 3d 72 26 26 28 72 3d 6e 29 3b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 Data Ascii: /! For license information please see client.ae384b8e.js.LICENSE.txt /var client;(()=>{var e={62243:function(e,t,n){"use strict";var r=this&&this.__createBinding\|\|(Object.create?function(e,t,n,r){void 0===r&&(r=n);var o=Object.getOwnPropertyDescriptor(
2024-02-08 18:36:30 UTC	16384	IN	Data Raw: 36 41 31 36 20 31 36 20 30 20 30 20 30 20 30 20 32 34 76 39 36 68 39 36 61 31 36 20 31 36 20 30 20 30 20 30 20 31 36 2d 31 36 56 32 34 41 31 36 20 31 36 20 30 20 30 20 30 20 39 36 20 38 7a 4d 35 36 20 38 38 61 32 34 20 32 34 20 30 20 31 20 31 20 32 34 2d 32 34 20 32 34 20 32 34 20 30 20 30 20 31 2d 32 34 20 32 34 7a 22 7d 29 29 7d 7d 2c 37 33 37 35 32 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 2e 68 58 3d 76 6f 69 64 20 30 3b 76 61 72 20 72 3d 6e 28 36 32 32 34 33 29 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 68 58 22 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e 67 65 74 49 6d 61 67 65 41 73 73 65 74 55 72 6c 7d 7d Data Ascii: 6A16 16 0 0 0 0 24v96h96a16 16 0 0 0 16-16V24A16 16 0 0 0 96 8zM56 88a24 24 0 1 1 24-24 24 24 0 0 1-24 24z"}))}},73752:(e,t,n)=>{"use strict";t.hX=void 0;var r=n(62243);Object.defineProperty(t,"hX",{enumerable:!0,get:function(){return r.getImageAssetUrl}}
2024-02-08 18:36:30 UTC	11108	IN	Data Raw: 61 63 65 68 6f 6c 64 65 72 41 74 74 72 3d 76 6f 69 64 20 30 2c 74 2e 66 6f 63 75 73 50 6c 61 63 65 68 6f 6c 64 65 72 41 74 74 72 3d 22 64 61 74 61 2d 62 75 69 2d 74 72 61 70 2d 66 6f 63 75 73 2d 70 6c 61 63 65 68 6f 6c 64 65 72 22 3b 76 61 72 20 6e 3d 30 3b 74 2e 61 64 64 49 66 72 61 6d 65 46 6f 63 75 73 50 6c 61 63 65 68 6f 6c 64 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 72 29 7b 76 61 72 20 6f 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 7c 7c 22 62 75 69 2d 74 72 61 70 2d 66 6f 63 75 73 2d 69 66 72 61 6d 65 2d 22 2e 63 6f 6e 63 61 74 28 6e 29 3b 6e 2b 3d 31 3b 76 61 72 20 61 2c 69 3d 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 74 69 74 6c 65 22 29 7c 7c 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 61 72 69 61 2d 6c 61 62 65 6c Data Ascii: aceholderAttr=void 0,t.focusPlaceholderAttr="data-bui-trap-focus-placeholder";var n=0;t.addIframeFocusPlaceholder=function(e,r){var o=e.getAttribute("id")\|\|"bui-trap-focus-iframe-".concat(n);n+=1;var a,i=e.getAttribute("title")\|\|e.getAttribute("aria-label
2024-02-08 18:36:30 UTC	16384	IN	Data Raw: 31 39 30 34 32 29 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 67 65 74 4d 6f 6e 74 68 73 54 6f 53 68 6f 77 22 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 28 6f 29 2e 64 65 66 61 75 6c 74 7d 7d 29 3b 76 61 72 20 61 3d 6e 28 31 32 35 31 38 29 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 67 65 74 42 61 73 65 44 61 74 65 22 2c 7b 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 28 61 29 2e 64 65 66 61 75 6c 74 7d 7d 29 3b 76 61 72 20 69 3d 6e 28 31 32 30 30 33 29 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 63 68 61 6e 67 65 4d Data Ascii: 19042);Object.defineProperty(t,"getMonthsToShow",{enumerable:!0,get:function(){return r(o).default}});var a=n(12518);Object.defineProperty(t,"getBaseDate",{enumerable:!0,get:function(){return r(a).default}});var i=n(12003);Object.defineProperty(t,"changeM
2024-02-08 18:36:30 UTC	4177	IN	Data Raw: 29 2c 6e 3d 22 72 65 76 65 72 73 65 22 2c 65 2e 73 63 72 6f 6c 6c 4c 65 66 74 3e 30 3f 6e 3d 22 64 65 66 61 75 6c 74 22 3a 28 65 2e 73 63 72 6f 6c 6c 4c 65 66 74 3d 31 2c 65 2e 73 63 72 6f 6c 6c 4c 65 66 74 3c 31 26 26 28 6e 3d 22 6e 65 67 61 74 69 76 65 22 29 29 2c 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 65 29 2c 6e 7d 7d 2c 36 38 36 39 33 3a 28 65 2c 74 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 3b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 65 29 72 65 74 75 72 6e 20 65 3b 76 61 Data Ascii: ),n="reverse",e.scrollLeft>0?n="default":(e.scrollLeft=1,e.scrollLeft<1&&(n="negative")),document.body.removeChild(e),n}},68693:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=function(){var e;return function(){if(e)return e;va
2024-02-08 18:36:30 UTC	8949	IN	Data Raw: 39 32 32 30 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 74 68 69 73 26 26 74 68 69 73 2e 5f 5f 69 6d 70 6f 72 74 44 65 66 61 75 6c 74 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 26 26 65 2e 5f 5f 65 73 4d 6f 64 75 6c 65 3f 65 3a 7b 64 65 66 61 75 6c 74 3a 65 7d 7d 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 3b 76 61 72 20 6f 3d 72 28 6e 28 33 38 31 34 37 29 29 2c 61 3d 72 28 6e 28 31 36 32 34 34 29 29 3b 74 2e 64 65 66 61 75 6c 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 6f 69 64 20 30 3d 3d 3d 6e 26 26 28 6e 3d 7b 69 6e 73 74 61 6e 74 3a 21 31 7d 29 3b 76 Data Ascii: 9220:function(e,t,n){"use strict";var r=this&&this.__importDefault\|\|function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0});var o=r(n(38147)),a=r(n(16244));t.default=function(e,t,n){void 0===n&&(n={instant:!1});v
2024-02-08 18:36:31 UTC	16384	IN	Data Raw: 3d 3d 63 3f 76 6f 69 64 20 30 3a 63 5b 22 61 72 69 61 2d 6c 61 62 65 6c 22 5d 29 3b 72 65 74 75 72 6e 20 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 2c 6a 28 7b 7d 2c 63 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 73 2c 72 6f 6c 65 3a 22 70 72 6f 67 72 65 73 73 62 61 72 22 2c 22 61 72 69 61 2d 6c 69 76 65 22 3a 75 3f 22 70 6f 6c 69 74 65 22 3a 76 6f 69 64 20 30 2c 22 61 72 69 61 2d 6c 61 62 65 6c 22 3a 75 7d 29 2c 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 52 28 29 2e 69 6e 6e 65 72 7d 29 29 7d 3b 76 61 72 20 4c 3d 6e 28 32 30 37 34 36 29 2c 4d 3d 6e 2e 6e 28 4c 29 2c 7a 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 7a 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 Data Ascii: ==c?void 0:c["aria-label"]);return r.createElement("div",j({},c,{className:s,role:"progressbar","aria-live":u?"polite":void 0,"aria-label":u}),r.createElement("div",{className:R().inner}))};var L=n(20746),M=n.n(L),z=function(){return z=Object.assign\|\|func
2024-02-08 18:36:31 UTC	16384	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 55 65 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 3d 31 2c 72 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 74 3d 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 6f 29 26 26 28 65 5b 6f 5d 3d 74 5b 6f 5d 29 3b 72 65 74 75 72 6e 20 65 7d 2c 55 65 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 3b 63 6f 6e 73 74 20 48 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 76 61 72 69 61 6e 74 2c 6e 3d 65 2e 61 6c 74 65 72 6e 61 Data Ascii: unction(){return Ue=Object.assign\|\|function(e){for(var t,n=1,r=arguments.length;n<r;n++)for(var o in t=arguments[n])Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=t[o]);return e},Ue.apply(this,arguments)};const He=function(e){var t=e.variant,n=e.alterna
2024-02-08 18:36:31 UTC	16384	IN	Data Raw: 6c 69 76 65 22 3a 22 70 6f 6c 69 74 65 22 7d 2c 63 6c 61 73 73 4e 61 6d 65 3a 76 7d 2c 70 2c 22 20 22 2c 68 29 2c 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 74 61 62 6c 65 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 50 74 28 29 2e 64 61 74 65 73 2c 72 6f 6c 65 3a 22 67 72 69 64 22 7d 2c 21 66 26 26 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 56 74 2c 6e 75 6c 6c 29 2c 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 74 62 6f 64 79 22 2c 6e 75 6c 6c 2c 5f 2e 6d 61 70 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 47 74 2c 7b 66 69 72 73 74 44 61 74 65 49 53 4f 3a 69 2c 66 6f 63 75 73 65 64 44 61 74 65 49 53 4f 3a 6c 2c 6b 65 79 3a 74 2c 77 65 65 6b 3a 65 2c 6f 6e 44 61 79 4b 65 Data Ascii: live":"polite"},className:v},p," ",h),r.createElement("table",{className:Pt().dates,role:"grid"},!f&&r.createElement(Vt,null),r.createElement("tbody",null,_.map((function(e,t){return r.createElement(Gt,{firstDateISO:i,focusedDateISO:l,key:t,week:e,onDayKe
2024-02-08 18:36:31 UTC	13491	IN	Data Raw: 6e 28 29 2e 68 65 61 64 65 72 7d 2c 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 57 2c 7b 64 69 72 65 63 74 69 6f 6e 3a 22 72 6f 77 22 2c 61 6c 69 67 6e 49 74 65 6d 73 3a 22 65 6e 64 22 7d 2c 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 57 2e 49 74 65 6d 2c 7b 67 72 6f 77 3a 21 30 7d 2c 6e 29 2c 6f 26 26 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 57 2e 49 74 65 6d 2c 6e 75 6c 6c 2c 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 42 2e 41 6c 69 67 6e 65 72 2c 7b 61 6c 69 67 6e 6d 65 6e 74 3a 5b 22 62 6f 74 74 6f 6d 22 2c 22 65 6e 64 22 5d 7d 2c 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 42 2c 50 6e 28 7b 7d 2c 6f 2c 7b 76 61 72 69 61 6e 74 3a 22 74 65 72 74 69 61 72 79 22 7d 29 29 29 29 29 29 2c 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 Data Ascii: n().header},r.createElement(W,{direction:"row",alignItems:"end"},r.createElement(W.Item,{grow:!0},n),o&&r.createElement(W.Item,null,r.createElement(B.Aligner,{alignment:["bottom","end"]},r.createElement(B,Pn({},o,{variant:"tertiary"})))))),r.createElement

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
742	192.168.2.5	50600	18.64.236.64	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:30 UTC	530	OUT	GET /psb/capla/static/js/remoteEntry.4935f89c.client.js HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:30 UTC	634	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 28814 Connection: close Date: Thu, 08 Feb 2024 08:33:00 GMT Last-Modified: Sun, 04 Feb 2024 06:12:25 GMT ETag: "a687e666ee59c8527c21313adba1bf8f" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: vN7OnMe.ojdXDDTQ9pmibMWIDd5xf9ld Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 fb5ea1bd3c16ca58cbd34c1e50619c70.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: FEJ2iZTsWQDeJzTqzK6t2sqY0r0jKA8vA_7c4zOptiGU6mD-wpXWkQ== Age: 36211 Vary: Origin
2024-02-08 18:36:30 UTC	16384	IN	Data Raw: 76 61 72 20 62 57 65 62 53 68 65 6c 6c 43 6f 6d 70 6f 6e 65 6e 74 73 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 7b 22 34 65 64 62 62 63 38 61 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 76 61 72 20 63 3d 7b 22 2e 2f 41 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 46 6f 6f 74 65 72 22 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 65 28 22 38 31 64 61 35 66 33 32 22 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 28 22 39 32 39 62 62 36 61 31 22 29 7d 7d 29 29 7d 2c 22 2e 2f 41 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 48 65 61 64 65 72 22 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 65 28 Data Ascii: var bWebShellComponents;!function(){"use strict";var e={"4edbbc8a":function(e,n,t){var c={"./AccommodationFooter":function(){return t.e("81da5f32").then((function(){return function(){return t("929bb6a1")}}))},"./AccommodationHeader":function(){return t.e(
2024-02-08 18:36:30 UTC	12398	IN	Data Raw: 64 6f 63 75 6d 65 6e 74 3b 69 66 28 21 65 26 26 6e 26 26 28 6e 2e 63 75 72 72 65 6e 74 53 63 72 69 70 74 26 26 28 65 3d 6e 2e 63 75 72 72 65 6e 74 53 63 72 69 70 74 2e 73 72 63 29 2c 21 65 29 29 7b 76 61 72 20 63 3d 6e 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 3b 63 2e 6c 65 6e 67 74 68 26 26 28 65 3d 63 5b 63 2e 6c 65 6e 67 74 68 2d 31 5d 2e 73 72 63 29 7d 69 66 28 21 65 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 41 75 74 6f 6d 61 74 69 63 20 70 75 62 6c 69 63 50 61 74 68 20 69 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 20 69 6e 20 74 68 69 73 20 62 72 6f 77 73 65 72 22 29 3b 65 3d 65 2e 72 65 70 6c 61 63 65 28 2f 23 2e 2a 24 2f 2c 22 22 29 2e 72 65 70 6c 61 63 65 28 2f 5c 3f 2e 2a 24 2f 2c Data Ascii: document;if(!e&&n&&(n.currentScript&&(e=n.currentScript.src),!e)){var c=n.getElementsByTagName("script");c.length&&(e=c[c.length-1].src)}if(!e)throw new Error("Automatic publicPath is not supported in this browser");e=e.replace(/#.$/,"").replace(/\?.$/,
2024-02-08 18:36:30 UTC	32	IN	Data Raw: 6d 6f 74 65 45 6e 74 72 79 2e 34 39 33 35 66 38 39 63 2e 63 6c 69 65 6e 74 2e 6a 73 2e 6d 61 70 Data Ascii: moteEntry.4935f89c.client.js.map

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
743	192.168.2.5	50594	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:30 UTC	562	OUT	GET /flights/web/static/js/screens-Home.67ba2cfc.chunk.js HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:30 UTC	577	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 284453 Connection: close Date: Thu, 08 Feb 2024 15:05:46 GMT Last-Modified: Thu, 08 Feb 2024 14:27:12 GMT ETag: "890c09286de5b03b9edf0d8dc6027b30" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 711d3c800952edc1dd6cabc0c877aa5a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: 5jXwqFvHbbSmk2XVosP3Z8IqZ2G5Hc-OEGKfk1xgWYcCR0OOdy9WfQ== Age: 12645 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:36:30 UTC	16384	IN	Data Raw: 28 73 65 6c 66 2e 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 3d 73 65 6c 66 2e 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 38 39 30 34 39 5d 2c 7b 32 37 34 37 39 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 5a 3a 28 29 3d 3e 72 7d 29 3b 76 61 72 20 61 3d 6e 28 36 37 32 39 34 29 3b 63 6f 6e 73 74 20 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 76 67 22 2c 7b 78 6d 6c 6e 73 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 2c 76 69 65 77 42 6f 78 3a 22 30 20 30 20 38 30 20 33 32 22 7d 2c 61 2e 63 72 Data Ascii: (self.__LOADABLE_LOADED_CHUNKS__=self.__LOADABLE_LOADED_CHUNKS__\|\|[]).push([[89049],{27479:(e,t,n)=>{"use strict";n.d(t,{Z:()=>r});var a=n(67294);const r=function(){return a.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 80 32"},a.cr
2024-02-08 18:36:30 UTC	16384	IN	Data Raw: 20 31 20 30 20 2e 39 30 38 2d 31 2e 31 39 34 4c 38 2e 33 38 20 35 2e 38 31 36 61 2e 33 35 2e 33 35 20 30 20 30 20 31 20 2e 30 35 35 2d 2e 35 39 31 6c 31 2e 38 34 35 2d 2e 39 31 32 61 2e 33 35 31 2e 33 35 31 20 30 20 30 20 31 20 2e 33 31 35 20 30 6c 34 2e 34 35 36 20 32 2e 32 35 36 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 2e 36 37 38 2d 31 2e 33 33 38 7a 22 7d 29 29 7d 7d 2c 37 30 34 37 36 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 5a 3a 28 29 3d 3e 72 7d 29 3b 76 61 72 20 61 3d 6e 28 36 37 32 39 34 29 3b 63 6f 6e 73 74 20 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 76 67 22 2c 7b 78 6d 6c 6e 73 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 Data Ascii: 1 0 .908-1.194L8.38 5.816a.35.35 0 0 1 .055-.591l1.845-.912a.351.351 0 0 1 .315 0l4.456 2.256a.75.75 0 0 0 .678-1.338z"}))}},70476:(e,t,n)=>{"use strict";n.d(t,{Z:()=>r});var a=n(67294);const r=function(){return a.createElement("svg",{xmlns:"http://www.w
2024-02-08 18:36:31 UTC	12288	IN	Data Raw: 73 68 6f 72 74 5f 64 61 74 65 5f 77 69 74 68 5f 77 65 65 6b 64 61 79 5f 77 69 74 68 6f 75 74 5f 79 65 61 72 22 29 29 3b 76 61 72 20 61 65 3d 22 64 61 74 65 5f 77 69 74 68 5f 77 65 65 6b 64 61 79 22 3b 28 30 2c 76 2e 71 51 29 28 28 30 2c 76 2e 74 29 28 22 64 61 74 65 5f 66 6f 72 6d 61 74 22 2c 22 66 61 6b 65 49 6e 64 65 78 22 2c 22 64 61 74 65 5f 77 69 74 68 5f 77 65 65 6b 64 61 79 22 29 29 3b 76 61 72 20 72 65 3d 22 64 61 79 5f 73 68 6f 72 74 5f 6d 6f 6e 74 68 5f 74 69 6d 65 22 3b 28 30 2c 76 2e 71 51 29 28 28 30 2c 76 2e 74 29 28 22 64 61 74 65 5f 66 6f 72 6d 61 74 22 2c 22 66 61 6b 65 49 6e 64 65 78 22 2c 22 64 61 79 5f 73 68 6f 72 74 5f 6d 6f 6e 74 68 5f 74 69 6d 65 22 29 29 3b 76 61 72 20 69 65 3d 22 73 68 6f 72 74 5f 64 61 74 65 22 3b 28 30 2c 76 2e Data Ascii: short_date_with_weekday_without_year"));var ae="date_with_weekday";(0,v.qQ)((0,v.t)("date_format","fakeIndex","date_with_weekday"));var re="day_short_month_time";(0,v.qQ)((0,v.t)("date_format","fakeIndex","day_short_month_time"));var ie="short_date";(0,v.
2024-02-08 18:36:31 UTC	16384	IN	Data Raw: 62 6c 65 64 3a 53 2c 63 68 65 63 6b 65 64 3a 5a 7c 7c 53 2c 61 74 74 72 69 62 75 74 65 73 3a 7b 74 61 62 49 6e 64 65 78 3a 2d 31 2c 6f 6e 43 6c 69 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 73 74 6f 70 50 72 6f 70 61 67 61 74 69 6f 6e 28 29 7d 7d 2c 6f 6e 43 68 61 6e 67 65 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 74 2e 63 68 65 63 6b 65 64 3b 6b 28 6e 2c 65 29 7d 7d 29 29 3a 6e 75 6c 6c 29 7d 29 29 29 29 3a 6e 75 6c 6c 7d 3b 66 75 6e 63 74 69 6f 6e 20 68 28 65 29 7b 76 61 72 20 74 3d 65 2e 61 64 64 2c 6e 3d 65 2e 61 64 64 4d 75 6c 74 69 2c 61 3d 65 2e 65 72 72 6f 72 2c 69 3d 65 2e 69 31 38 6e 2c 6f 3d 65 2e 65 6e 61 62 6c 65 4d 75 6c 74 69 53 65 6c 65 63 74 2c 63 3d 65 2e 6c 6f 61 64 69 6e 67 2c 75 3d 65 2e 72 65 6d 6f 76 65 2c 64 Data Ascii: bled:S,checked:Z\|\|S,attributes:{tabIndex:-1,onClick:function(e){e.stopPropagation()}},onChange:function(t){var n=t.checked;k(n,e)}})):null)})))):null};function h(e){var t=e.add,n=e.addMulti,a=e.error,i=e.i18n,o=e.enableMultiSelect,c=e.loading,u=e.remove,d
2024-02-08 18:36:31 UTC	2988	IN	Data Raw: 6d 3a 31 2c 7a 77 3a 30 7d 3b 66 75 6e 63 74 69 6f 6e 20 6c 28 65 29 7b 76 61 72 20 74 3d 65 2e 73 65 67 6d 65 6e 74 49 6e 64 65 78 2c 6e 3d 28 30 2c 69 2e 75 73 65 43 6f 6e 74 65 78 74 29 28 6f 2e 6c 29 2c 6c 3d 6e 2e 69 31 38 6e 2c 63 3d 6e 2e 73 65 67 6d 65 6e 74 73 2c 75 3d 6e 2e 73 65 61 72 63 68 54 79 70 65 2c 64 3d 6e 2e 74 72 61 63 6b 56 32 2c 6d 3d 6e 2e 69 70 43 6f 75 6e 74 72 79 2c 68 3d 28 30 2c 61 2e 5a 29 28 6c 29 2c 67 3d 68 2e 67 65 74 57 65 65 6b 44 61 79 73 48 61 73 68 2c 5f 3d 68 2e 67 65 74 4d 6f 6e 74 68 48 61 73 68 2c 66 3d 63 5b 74 5d 2c 70 3d 66 2e 64 65 70 61 72 74 75 72 65 44 61 74 65 2c 76 3d 66 2e 72 65 74 75 72 6e 44 61 74 65 2c 62 3d 28 63 5b 74 2d 31 5d 7c 7c 7b 7d 29 2e 64 65 70 61 72 74 75 72 65 44 61 74 65 2c 79 3d 22 52 Data Ascii: m:1,zw:0};function l(e){var t=e.segmentIndex,n=(0,i.useContext)(o.l),l=n.i18n,c=n.segments,u=n.searchType,d=n.trackV2,m=n.ipCountry,h=(0,a.Z)(l),g=h.getWeekDaysHash,_=h.getMonthHash,f=c[t],p=f.departureDate,v=f.returnDate,b=(c[t-1]\|\|{}).departureDate,y="R
2024-02-08 18:36:31 UTC	16384	IN	Data Raw: 2c 75 2e 74 72 61 6e 73 28 28 30 2c 69 2e 74 29 28 22 66 6c 69 67 68 74 73 5f 73 65 61 72 63 68 5f 72 65 74 75 72 6e 5f 6c 61 62 65 6c 22 29 29 29 3b 72 65 74 75 72 6e 20 75 2e 74 72 61 6e 73 28 28 30 2c 69 2e 74 29 28 22 66 6c 69 67 68 74 73 5f 73 65 61 72 63 68 5f 64 61 74 65 5f 72 61 6e 67 65 22 2c 7b 76 61 72 69 61 62 6c 65 73 3a 7b 66 6c 69 67 68 74 5f 64 61 74 65 5f 31 3a 61 2c 66 6c 69 67 68 74 5f 64 61 74 65 5f 32 3a 72 7d 7d 29 29 7d 76 61 72 20 6f 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 28 6e 2e 67 65 74 54 69 6d 65 28 29 2d 74 2e 67 65 74 54 69 6d 65 28 29 29 2f 38 36 34 65 35 29 3b 72 65 74 75 72 6e 20 76 26 26 74 26 26 6e 3f 75 2e 74 72 61 6e 73 28 28 30 2c 69 2e 74 29 28 22 66 6c 69 67 68 74 73 5f 73 65 61 72 63 68 5f 64 61 74 65 73 5f 73 65 6c Data Ascii: ,u.trans((0,i.t)("flights_search_return_label")));return u.trans((0,i.t)("flights_search_date_range",{variables:{flight_date_1:a,flight_date_2:r}}))}var o=Math.floor((n.getTime()-t.getTime())/864e5);return v&&t&&n?u.trans((0,i.t)("flights_search_dates_sel
2024-02-08 18:36:31 UTC	16384	IN	Data Raw: 65 2c 64 3d 28 30 2c 49 2e 5a 29 28 7b 74 79 70 65 3a 74 2c 73 65 67 6d 65 6e 74 49 6e 64 65 78 3a 6e 7d 29 2c 6d 3d 64 2e 73 65 6c 65 63 74 65 64 4c 6f 63 61 74 69 6f 6e 73 54 65 78 74 2c 68 3d 64 2e 70 6c 61 63 65 68 6f 6c 64 65 72 54 65 78 74 2c 67 3d 64 2e 74 72 61 63 6b 56 32 2c 5f 3d 64 2e 65 72 72 6f 72 4d 65 73 73 61 67 65 2c 66 3d 28 30 2c 63 2e 5a 29 28 52 29 2c 70 3d 28 30 2c 61 2e 75 73 65 53 74 61 74 65 29 28 21 31 29 2c 76 3d 70 5b 30 5d 2c 62 3d 70 5b 31 5d 2c 79 3d 28 30 2c 61 2e 75 73 65 52 65 66 29 28 6e 75 6c 6c 29 2c 6b 3d 28 30 2c 61 2e 75 73 65 43 61 6c 6c 62 61 63 6b 29 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 62 28 21 31 29 7d 29 2c 5b 5d 29 2c 45 3d 28 30 2c 61 2e 75 73 65 43 61 6c 6c 62 61 63 6b 29 28 28 66 75 6e 63 74 69 6f 6e 28 Data Ascii: e,d=(0,I.Z)({type:t,segmentIndex:n}),m=d.selectedLocationsText,h=d.placeholderText,g=d.trackV2,_=d.errorMessage,f=(0,c.Z)(R),p=(0,a.useState)(!1),v=p[0],b=p[1],y=(0,a.useRef)(null),k=(0,a.useCallback)((function(){b(!1)}),[]),E=(0,a.useCallback)((function(
2024-02-08 18:36:31 UTC	16384	IN	Data Raw: 45 6c 65 6d 65 6e 74 28 73 2e 5a 2c 7b 69 63 6f 6e 3a 22 66 72 6f 6d 22 3d 3d 3d 74 3f 7a 2e 5a 3a 52 2e 5a 2c 65 72 72 6f 72 4d 65 73 73 61 67 65 3a 6c 2c 65 72 72 6f 72 56 61 72 69 61 6e 74 3a 22 69 6e 6c 69 6e 65 22 2c 74 61 62 49 6e 64 65 78 3a 30 2c 72 65 66 3a 6b 2c 22 61 72 69 61 2d 68 61 73 70 6f 70 75 70 22 3a 22 74 72 75 65 22 2c 22 64 61 74 61 2d 75 69 2d 6e 61 6d 65 22 3a 22 69 6e 70 75 74 5f 6c 6f 63 61 74 69 6f 6e 5f 22 2e 63 6f 6e 63 61 74 28 74 2c 22 5f 73 65 67 6d 65 6e 74 5f 22 29 2e 63 6f 6e 63 61 74 28 6e 29 2c 22 64 61 74 61 2d 75 69 2d 65 72 72 6f 72 22 3a 42 6f 6f 6c 65 61 6e 28 6c 29 2c 6f 6e 43 6c 69 63 6b 3a 54 2c 73 69 7a 65 3a 69 2c 65 72 72 6f 72 49 64 3a 4e 7d 2c 64 26 26 64 2e 6c 65 6e 67 74 68 3e 30 3f 61 2e 63 72 65 61 74 Data Ascii: Element(s.Z,{icon:"from"===t?z.Z:R.Z,errorMessage:l,errorVariant:"inline",tabIndex:0,ref:k,"aria-haspopup":"true","data-ui-name":"input_location_".concat(t,"_segment_").concat(n),"data-ui-error":Boolean(l),onClick:T,size:i,errorId:N},d&&d.length>0?a.creat
2024-02-08 18:36:31 UTC	16384	IN	Data Raw: 61 72 69 61 2d 6c 61 62 65 6c 6c 65 64 62 79 22 3a 5f 3f 67 3a 76 6f 69 64 20 30 2c 72 65 66 3a 74 2c 63 6c 61 73 73 4e 61 6d 65 3a 45 7d 2c 79 29 2c 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 6b 2e 69 6e 6e 65 72 7d 2c 76 3f 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 70 61 6e 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 6b 2e 70 72 65 66 69 78 7d 2c 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 63 2e 5a 2c 7b 72 74 6c 41 75 74 6f 46 6c 69 70 3a 21 30 2c 73 76 67 3a 76 2c 73 69 7a 65 3a 22 6d 65 64 69 75 6d 22 2c 63 6f 6c 6f 72 3a 22 6e 65 75 74 72 61 6c 5f 61 6c 74 22 7d 29 29 3a 6e 75 6c 6c 2c 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 70 61 6e 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 Data Ascii: aria-labelledby":_?g:void 0,ref:t,className:E},y),i.createElement("div",{className:k.inner},v?i.createElement("span",{className:k.prefix},i.createElement(c.Z,{rtlAutoFlip:!0,svg:v,size:"medium",color:"neutral_alt"})):null,i.createElement("span",{className
2024-02-08 18:36:31 UTC	16384	IN	Data Raw: 65 28 22 7b 7b 74 69 6d 65 7d 7d 22 2c 72 28 73 2c 74 29 29 7d 7d 7d 2c 32 34 32 36 32 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 5a 3a 28 29 3d 3e 69 7d 29 3b 76 61 72 20 61 3d 36 65 34 3b 66 75 6e 63 74 69 6f 6e 20 72 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 67 65 74 54 69 6d 65 28 29 25 61 7d 66 75 6e 63 74 69 6f 6e 20 69 28 65 29 7b 76 61 72 20 74 3d 6e 65 77 20 44 61 74 65 28 65 2e 67 65 74 54 69 6d 65 28 29 29 2c 6e 3d 4d 61 74 68 2e 63 65 69 6c 28 74 2e 67 65 74 54 69 6d 65 7a 6f 6e 65 4f 66 66 73 65 74 28 29 29 3b 74 2e 73 65 74 53 65 63 6f 6e 64 73 28 30 2c 30 29 3b 76 61 72 20 69 3d 6e 3e 30 3f 28 61 2b 72 28 74 29 29 25 61 3a 72 28 74 29 3b 72 65 74 75 72 6e 20 6e 2a 61 2b 69 7d 7d 2c 34 39 37 30 Data Ascii: e("{{time}}",r(s,t))}}},24262:(e,t,n)=>{"use strict";n.d(t,{Z:()=>i});var a=6e4;function r(e){return e.getTime()%a}function i(e){var t=new Date(e.getTime()),n=Math.ceil(t.getTimezoneOffset());t.setSeconds(0,0);var i=n>0?(a+r(t))%a:r(t);return n*a+i}},4970

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
744	192.168.2.5	50595	18.64.236.64	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:30 UTC	530	OUT	GET /psb/capla/static/js/remoteEntry.40329cb8.client.js HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:30 UTC	634	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 22132 Connection: close Last-Modified: Mon, 05 Feb 2024 13:55:08 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 0T2tnYIoJiSDDuAyKDoOuj8a4d6GNIAa Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 07 Feb 2024 19:17:38 GMT ETag: "38c1479da92f5cd233a5feed62e2d75e" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 fb5ea1bd3c16ca58cbd34c1e50619c70.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: urza4RpAbiBusMUaSozihf406mPnqzo_D2lqO7fd5rKSI2BcgeYdvA== Age: 83933 Vary: Origin
2024-02-08 18:36:30 UTC	16384	IN	Data Raw: 76 61 72 20 62 57 65 62 63 6f 72 65 50 72 6f 6d 6f 74 69 6f 6e 61 6c 43 6f 6d 70 6f 6e 65 6e 74 53 65 72 76 69 63 65 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 7b 65 31 38 36 66 63 36 39 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 76 61 72 20 72 3d 7b 22 2e 2f 47 65 6e 69 75 73 57 72 61 70 70 65 72 41 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 42 6f 6f 6b 50 72 6f 63 65 73 73 22 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 65 28 22 63 33 62 64 34 66 39 34 22 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 28 22 64 32 61 62 39 31 38 66 22 29 7d 7d 29 29 7d 2c 22 2e 2f 47 65 6e 69 75 73 57 72 61 70 70 Data Ascii: var bWebcorePromotionalComponentService;!function(){"use strict";var e={e186fc69:function(e,n,t){var r={"./GeniusWrapperAccommodationBookProcess":function(){return t.e("c3bd4f94").then((function(){return function(){return t("d2ab918f")}}))},"./GeniusWrapp
2024-02-08 18:36:30 UTC	5748	IN	Data Raw: 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 28 22 38 65 66 39 34 35 36 35 22 29 7d 7d 29 29 7d 29 29 7d 2c 22 34 31 63 36 63 36 36 65 22 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 64 28 22 64 65 66 61 75 6c 74 22 2c 22 40 62 6f 6f 6b 69 6e 67 63 6f 6d 2f 63 61 70 6c 61 2d 73 65 72 76 65 72 2f 66 6c 6f 67 22 2c 5b 2c 5b 34 2c 30 2c 30 2c 30 5d 2c 30 2c 5b 30 2c 30 2c 30 2c 30 5d 2c 32 5d 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 65 28 22 61 36 33 39 33 33 63 65 22 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 28 22 34 63 63 64 38 62 38 35 22 29 7d 7d 29 29 7d 29 29 7d 2c 64 31 65 35 Data Ascii: on(){return function(){return t("8ef94565")}}))}))},"41c6c66e":function(){return d("default","@bookingcom/capla-server/flog",[,[4,0,0,0],0,[0,0,0,0],2],(function(){return t.e("a63933ce").then((function(){return function(){return t("4ccd8b85")}}))}))},d1e5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
745	192.168.2.5	50601	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:30 UTC	648	OUT	GET /xdata/images/city/square210/682559.jpg?k=eba0a86971de163610eaab458cd7c2483f59ff8f350d2f63eceed77d21afbed3&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:30 UTC	542	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 6208 Connection: close Server: nginx Date: Mon, 29 Jan 2024 19:54:08 GMT Content-Language: 6208 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * ETag: "6f65813dfc922188ee5c5075e3c0b4fdeb5a7bd6" X-Cache: Hit from cloudfront Via: 1.1 85a5b0f6d760d71ec1e7840a933b5572.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: n2Y2G1kqmr4_6CHHKVwYGzzUIzL_DGnLDzIsGCLYE4zKZOcLLTmdfg== Age: 859342
2024-02-08 18:36:30 UTC	6208	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 00 d2 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
746	192.168.2.5	50598	18.64.236.64	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:30 UTC	530	OUT	GET /psb/capla/static/js/remoteEntry.e62c532d.client.js HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:30 UTC	634	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 17990 Connection: close Date: Wed, 07 Feb 2024 21:01:56 GMT Last-Modified: Mon, 18 Dec 2023 09:34:08 GMT ETag: "225ad398feb446bb2302ad0c3a390259" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: R0L6KaaSp8JvkeOR.evATZGbq5_PBDMt Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 5df6a6f843be2e6dd8ba492b043e12c4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: ocnsjOi1sZHHDew2yVsI2oAYeVSPYmC15mMKG3S7wV1LrunoO1wk2w== Age: 77675 Vary: Origin
2024-02-08 18:36:30 UTC	15750	IN	Data Raw: 76 61 72 20 62 46 6c 69 67 68 74 73 49 6e 64 65 78 43 6f 6d 70 6f 6e 65 6e 74 53 65 72 76 69 63 65 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 3d 7b 62 34 38 35 37 30 36 61 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 29 7b 76 61 72 20 72 3d 7b 22 2e 2f 49 6e 74 65 72 6c 69 6e 6b 69 6e 67 43 6f 6d 70 6f 6e 65 6e 74 22 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 2e 65 28 22 36 31 39 37 62 63 61 62 22 29 2e 74 68 65 6e 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 28 22 33 36 62 33 63 62 64 38 22 29 7d 7d 29 29 7d 7d 2c 6f 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 72 65 74 75 72 6e 20 74 2e 52 3d 6e 2c 6e 3d 74 2e 6f 28 Data Ascii: var bFlightsIndexComponentService;!function(){"use strict";var e={b485706a:function(e,n,t){var r={"./InterlinkingComponent":function(){return t.e("6197bcab").then((function(){return function(){return t("36b3cbd8")}}))}},o=function(e,n){return t.R=n,n=t.o(
2024-02-08 18:36:30 UTC	240	IN	Data Raw: 6f 6e 28 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 64 6f 63 75 6d 65 6e 74 29 7b 76 61 72 20 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 50 72 6f 6d 69 73 65 28 28 66 75 6e 63 74 69 6f 6e 28 6e 2c 72 29 7b 76 61 72 20 6f 3d 74 2e 6d 69 6e 69 43 73 73 46 28 65 29 2c 63 3d 74 2e 70 2b 6f 3b 69 66 28 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 66 6f 72 28 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 6c 69 6e 6b 22 29 2c 72 3d 30 3b 72 3c 74 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 7b 76 61 72 20 6f 3d 28 75 3d 74 5b 72 5d 29 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 68 72 Data Ascii: on(){if("undefined"!==typeof document){var e=function(e){return new Promise((function(n,r){var o=t.miniCssF(e),c=t.p+o;if(function(e,n){for(var t=document.getElementsByTagName("link"),r=0;r<t.length;r++){var o=(u=t[r]).getAttribute("data-hr
2024-02-08 18:36:30 UTC	2000	IN	Data Raw: 65 66 22 29 7c 7c 75 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 68 72 65 66 22 29 3b 69 66 28 22 73 74 79 6c 65 73 68 65 65 74 22 3d 3d 3d 75 2e 72 65 6c 26 26 28 6f 3d 3d 3d 65 7c 7c 6f 3d 3d 3d 6e 29 29 72 65 74 75 72 6e 20 75 7d 76 61 72 20 63 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 74 79 6c 65 22 29 3b 66 6f 72 28 72 3d 30 3b 72 3c 63 2e 6c 65 6e 67 74 68 3b 72 2b 2b 29 7b 76 61 72 20 75 3b 69 66 28 28 6f 3d 28 75 3d 63 5b 72 5d 29 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 68 72 65 66 22 29 29 3d 3d 3d 65 7c 7c 6f 3d 3d 3d 6e 29 72 65 74 75 72 6e 20 75 7d 7d 28 6f 2c 63 29 29 72 65 74 75 72 6e 20 6e 28 29 3b 21 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 74 2c 72 2c 6f 29 7b 76 Data Ascii: ef")\|\|u.getAttribute("href");if("stylesheet"===u.rel&&(o===e\|\|o===n))return u}var c=document.getElementsByTagName("style");for(r=0;r<c.length;r++){var u;if((o=(u=c[r]).getAttribute("data-href"))===e\|\|o===n)return u}}(o,c))return n();!function(e,n,t,r,o){v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
747	192.168.2.5	50603	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:30 UTC	648	OUT	GET /xdata/images/city/square210/688940.jpg?k=8c6ae0b4434360802cfc87335163787de421d3fcb7df1a4bdffbc5f930fa8f2d&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:30 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 5960 Connection: close Server: nginx Date: Sun, 21 Jan 2024 19:04:19 GMT ETag: "3f66ef17dca93d6d7b4071ddc2b0234b7489653f" Content-Language: 5960 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 b340a44dae03e8ff13e054502e49abe2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: KSxCcVLbrSy9NCl2pYlXT4jI-Yj_T0GYD9HehzwYtRq6hQr7vZX8bg== Age: 1553531
2024-02-08 18:36:30 UTC	5960	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 00 d2 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
748	192.168.2.5	50602	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:30 UTC	648	OUT	GET /xdata/images/city/square210/690620.jpg?k=5b801857b88469e1cc299707cda5a8ee86c757a159c04ff69fbc1fbb37a9fe4c&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:30 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Wed, 10 Jan 2024 14:35:01 GMT ETag: "bd4710f923ebebb6dc6662d77d7c03793152313b" Content-Language: 8808 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 d680d477a1d2c387663f2f93d2dabec6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: eP6cipi-P6Dx2PqmTaOP0LjNXG9mnvX3jF_TiXaZIiZtkQcZhWqS0Q== Age: 2520089
2024-02-08 18:36:30 UTC	8816	IN	Data Raw: 32 32 36 38 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 00 d2 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 2268JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:36:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
749	192.168.2.5	50604	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:30 UTC	648	OUT	GET /xdata/images/city/square210/688779.jpg?k=def43ae0127037a004ded67b24b8f978345b16a8d10edd0832dcabbed12f2fcd&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:30 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 5745 Connection: close Server: nginx Date: Sun, 21 Jan 2024 16:00:13 GMT ETag: "a0bbacee6852ca8dc84c1c65e81af973a170f3ff" Content-Language: 5745 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 b340a44dae03e8ff13e054502e49abe2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: xjFVetJ2eJYtHcb6jeAR3qJ56v8VlMvr92MJ0nGBV1SbpNtkXaU-hg== Age: 1564577
2024-02-08 18:36:30 UTC	5745	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 00 d2 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
750	192.168.2.5	50599	18.64.236.64	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:30 UTC	526	OUT	GET /psb/capla/static/js/6197bcab.619d148f.chunk.js HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:31 UTC	623	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 20768 Connection: close Date: Thu, 08 Feb 2024 18:36:32 GMT Last-Modified: Thu, 21 Dec 2023 09:43:41 GMT ETag: "b89ff6f5870e0ee50ca963284082208d" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: hyPQNodPfBpOT0Yg2blx8nmt5iblYgyw Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 5df6a6f843be2e6dd8ba492b043e12c4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: sNv6k9ukec2xLPbeqn993XCn_Z_2S3KPLcPUFxMNA-dA3Nk885aqbQ== Vary: Origin
2024-02-08 18:36:31 UTC	8393	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 36 31 39 37 62 63 61 62 2e 36 31 39 64 31 34 38 66 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 66 6c 69 67 68 74 73 2d 69 6e 64 65 78 2d 63 6f 6d 70 6f 6e 65 6e 74 2d 73 65 72 76 69 63 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 66 6c 69 67 68 74 73 2d 69 6e 64 65 78 2d 63 6f 6d 70 6f 6e 65 6e 74 2d 73 65 72 76 69 63 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 36 31 39 37 62 63 61 62 22 5d 2c 7b 65 66 30 61 65 66 39 39 3a 66 75 6e Data Ascii: /! For license information please see 6197bcab.619d148f.chunk.js.LICENSE.txt /(self["b-flights-index-component-service__LOADABLE_LOADED_CHUNKS__"]=self["b-flights-index-component-service__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["6197bcab"],{ef0aef99:fun
2024-02-08 18:36:31 UTC	12375	IN	Data Raw: 6e 64 69 6e 67 43 6f 6e 74 65 6e 74 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 6e 7c 7c 6e 75 6c 6c 3d 3d 3d 28 6e 3d 6e 2e 66 6c 69 67 68 74 73 49 6e 64 65 78 49 6e 74 65 72 6c 69 6e 6b 69 6e 67 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 6e 3f 76 6f 69 64 20 30 3a 6e 2e 74 69 74 6c 65 2c 73 75 62 74 69 74 6c 65 3a 6e 75 6c 6c 3d 3d 3d 28 72 3d 69 2e 64 61 74 61 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 72 7c 7c 6e 75 6c 6c 3d 3d 3d 28 72 3d 72 2e 6c 61 6e 64 69 6e 67 43 6f 6e 74 65 6e 74 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 72 7c 7c 6e 75 6c 6c 3d 3d 3d 28 72 3d 72 2e 66 6c 69 67 68 74 73 49 6e 64 65 78 49 6e 74 65 72 6c 69 6e 6b 69 6e 67 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 72 3f 76 6f 69 64 20 30 3a 72 2e 73 75 62 74 69 74 6c 65 2c 76 61 72 69 61 6e 74 3a 22 68 65 61 64 6c Data Ascii: ndingContent)\|\|void 0===n\|\|null===(n=n.flightsIndexInterlinking)\|\|void 0===n?void 0:n.title,subtitle:null===(r=i.data)\|\|void 0===r\|\|null===(r=r.landingContent)\|\|void 0===r\|\|null===(r=r.flightsIndexInterlinking)\|\|void 0===r?void 0:r.subtitle,variant:"headl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
751	192.168.2.5	50596	18.64.236.64	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:30 UTC	518	OUT	GET /psb/capla/static/js/client.5a83af42.js HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:31 UTC	625	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 1036167 Connection: close Date: Thu, 08 Feb 2024 18:36:32 GMT Last-Modified: Mon, 15 Jan 2024 01:52:42 GMT ETag: "1a04f4294923713e0783afdfdf1f0788" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: w3OW8BxqmMkfi32GLobOCfoWKWH6RW0o Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 3ba4c01e89cbea15846c7d4a61b1242c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: vYK-dupBTweQ6Gy96dvHAMz_eS4TD9izGwZcQT8BiiQDIqaktjBTow== Vary: Origin
2024-02-08 18:36:31 UTC	15759	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 63 6c 69 65 6e 74 2e 35 61 38 33 61 66 34 32 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 22 38 35 34 62 36 63 61 31 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 74 68 69 73 26 26 74 68 69 73 2e 5f 5f 63 72 65 61 74 65 42 69 6e 64 69 6e 67 7c 7c 28 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 76 6f 69 64 20 30 3d 3d 3d 72 26 26 28 72 3d 6e 29 3b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 Data Ascii: /! For license information please see client.5a83af42.js.LICENSE.txt /!function(){var e={"854b6ca1":function(e,t,n){"use strict";var r=this&&this.__createBinding\|\|(Object.create?function(e,t,n,r){void 0===r&&(r=n);var o=Object.getOwnPropertyDescriptor(
2024-02-08 18:36:31 UTC	18	IN	Data Raw: 26 6f 21 3d 3d 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 Data Ascii: &o!==document.body
2024-02-08 18:36:31 UTC	16384	IN	Data Raw: 3b 29 74 28 6f 29 2c 6f 3d 6f 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 3b 72 65 74 75 72 6e 7b 72 65 6c 65 61 73 65 3a 6e 7d 7d 7d 28 29 7d 2c 22 35 64 33 61 63 63 66 30 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 74 68 69 73 26 26 74 68 69 73 2e 5f 5f 73 70 72 65 61 64 41 72 72 61 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 69 66 28 6e 7c 7c 32 3d 3d 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 29 66 6f 72 28 76 61 72 20 72 2c 6f 3d 30 2c 61 3d 74 2e 6c 65 6e 67 74 68 3b 6f 3c 61 3b 6f 2b 2b 29 21 72 26 26 6f 20 69 6e 20 74 7c 7c 28 72 7c 7c 28 72 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 74 2c 30 2c 6f 29 29 2c 72 5b 6f 5d 3d Data Ascii: ;)t(o),o=o.parentElement;return{release:n}}}()},"5d3accf0":function(e,t,n){"use strict";var r=this&&this.__spreadArray\|\|function(e,t,n){if(n\|\|2===arguments.length)for(var r,o=0,a=t.length;o<a;o++)!r&&o in t\|\|(r\|\|(r=Array.prototype.slice.call(t,0,o)),r[o]=
2024-02-08 18:36:31 UTC	16384	IN	Data Raw: 5b 22 62 6f 74 74 6f 6d 2d 65 6e 64 22 2c 22 74 6f 70 2d 65 6e 64 22 5d 2e 69 6e 63 6c 75 64 65 73 28 65 29 26 26 28 63 2e 78 3d 66 2f 32 2d 74 2e 63 6c 69 65 6e 74 57 69 64 74 68 2f 32 29 29 2c 6c 26 26 65 26 26 28 5b 22 73 74 61 72 74 2d 74 6f 70 22 2c 22 65 6e 64 2d 74 6f 70 22 5d 2e 69 6e 63 6c 75 64 65 73 28 65 29 3f 63 2e 79 3d 2d 31 2a 28 66 2f 32 2d 74 2e 63 6c 69 65 6e 74 48 65 69 67 68 74 2f 32 29 3a 5b 22 65 6e 64 2d 62 6f 74 74 6f 6d 22 2c 22 73 74 61 72 74 2d 62 6f 74 74 6f 6d 22 5d 2e 69 6e 63 6c 75 64 65 73 28 65 29 26 26 28 63 2e 79 3d 66 2f 32 2d 74 2e 63 6c 69 65 6e 74 48 65 69 67 68 74 2f 32 29 29 2c 63 7d 7d 7d 2c 39 36 37 33 34 38 30 35 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e Data Ascii: ["bottom-end","top-end"].includes(e)&&(c.x=f/2-t.clientWidth/2)),l&&e&&(["start-top","end-top"].includes(e)?c.y=-1*(f/2-t.clientHeight/2):["end-bottom","start-bottom"].includes(e)&&(c.y=f/2-t.clientHeight/2)),c}}},96734805:function(e,t){"use strict";var n
2024-02-08 18:36:31 UTC	2048	IN	Data Raw: 28 29 7b 72 65 74 75 72 6e 20 6c 6f 7d 2c 46 6f 72 6d 43 6f 6e 74 72 6f 6c 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 45 6f 7d 2c 47 72 69 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4f 6f 7d 2c 47 72 69 64 43 6f 6c 75 6d 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 77 6f 7d 2c 48 69 64 64 65 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 4c 65 7d 2c 48 69 64 64 65 6e 56 69 73 75 61 6c 6c 79 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 54 6f 7d 2c 49 63 6f 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 68 7d 2c 49 6d 61 67 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 77 65 7d 2c 49 6e 70 75 74 43 68 65 63 6b 62 6f 78 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 Data Ascii: (){return lo},FormControl:function(){return Eo},Grid:function(){return Oo},GridColumn:function(){return wo},Hidden:function(){return Le},HiddenVisually:function(){return To},Icon:function(){return h},Image:function(){return we},InputCheckbox:function(){re
2024-02-08 18:36:31 UTC	16384	IN	Data Raw: 2c 6f 3d 6e 2e 6e 28 72 29 2c 61 3d 6e 28 22 32 38 35 36 63 37 61 62 22 29 2c 69 3d 6e 28 22 38 61 38 65 66 36 64 31 22 29 3b 76 61 72 20 75 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 76 67 22 2c 7b 78 6d 6c 6e 73 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 2c 76 69 65 77 42 6f 78 3a 22 30 20 30 20 32 34 20 32 34 22 7d 2c 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 31 39 2e 32 36 38 31 20 38 2e 39 31 32 38 38 43 31 39 2e 32 36 38 37 20 39 2e 30 33 32 32 36 20 31 39 2e 32 34 35 34 20 39 2e 31 35 30 35 34 20 31 39 2e 31 39 39 36 20 39 2e 32 36 30 37 39 43 31 39 2e 31 35 33 39 20 39 2e 33 37 31 30 35 20 31 39 Data Ascii: ,o=n.n(r),a=n("2856c7ab"),i=n("8a8ef6d1");var u=function(){return r.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},r.createElement("path",{d:"M19.2681 8.91288C19.2687 9.03226 19.2454 9.15054 19.1996 9.26079C19.1539 9.37105 19
2024-02-08 18:36:31 UTC	1514	IN	Data Raw: 3a 22 64 63 63 38 33 38 36 32 30 38 22 2c 22 72 6f 6f 74 2d 2d 67 61 70 2d 31 2d 2d 6d 22 3a 22 66 34 31 30 66 35 32 65 63 65 22 2c 22 72 6f 6f 74 2d 2d 67 61 70 2d 32 2d 2d 6d 22 3a 22 63 35 32 38 65 63 38 66 31 37 22 2c 22 72 6f 6f 74 2d 2d 67 61 70 2d 33 2d 2d 6d 22 3a 22 64 32 31 66 39 34 61 61 33 63 22 2c 22 72 6f 6f 74 2d 2d 67 61 70 2d 34 2d 2d 6d 22 3a 22 64 37 38 64 66 66 31 39 61 30 22 2c 22 72 6f 6f 74 2d 2d 67 61 70 2d 36 2d 2d 6d 22 3a 22 66 36 36 66 39 31 36 36 32 36 22 2c 22 72 6f 6f 74 2d 2d 67 61 70 2d 38 2d 2d 6d 22 3a 22 65 63 34 30 64 63 39 62 62 66 22 2c 22 72 6f 6f 74 2d 2d 67 61 70 2d 30 2d 2d 6c 22 3a 22 63 33 35 62 32 31 37 62 30 37 22 2c 22 72 6f 6f 74 2d 2d 67 61 70 2d 30 2e 35 2d 2d 6c 22 3a 22 65 30 66 39 38 39 61 64 66 38 22 Data Ascii: :"dcc8386208","root--gap-1--m":"f410f52ece","root--gap-2--m":"c528ec8f17","root--gap-3--m":"d21f94aa3c","root--gap-4--m":"d78dff19a0","root--gap-6--m":"f66f916626","root--gap-8--m":"ec40dc9bbf","root--gap-0--l":"c35b217b07","root--gap-0.5--l":"e0f989adf8"
2024-02-08 18:36:31 UTC	16384	IN	Data Raw: 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 3d 31 2c 72 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 74 3d 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 6f 29 26 26 28 65 5b 6f 5d 3d 74 5b 6f 5d 29 3b 72 65 74 75 72 6e 20 65 7d 2c 51 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 2c 57 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 73 70 6c 69 74 2c 6e 3d 65 2e 67 72 6f 77 2c 72 3d 65 2e 73 68 72 69 6e 6b 2c 61 3d 65 2e 61 6c 69 67 6e 53 65 6c 66 2c 75 3d 65 2e 63 68 69 6c 64 72 Data Ascii: ect.assign\|\|function(e){for(var t,n=1,r=arguments.length;n<r;n++)for(var o in t=arguments[n])Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=t[o]);return e},Q.apply(this,arguments)},W=function(e){var t=e.split,n=e.grow,r=e.shrink,a=e.alignSelf,u=e.childr
2024-02-08 18:36:31 UTC	16384	IN	Data Raw: 65 52 65 66 28 21 31 29 3b 6f 28 29 2e 75 73 65 45 66 66 65 63 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 45 2e 63 75 72 72 65 6e 74 3b 45 2e 63 75 72 72 65 6e 74 3d 21 30 2c 65 26 26 79 28 21 31 29 7d 29 2c 5b 74 2c 6e 5d 29 3b 76 61 72 20 5f 3d 28 30 2c 69 2e 63 6c 61 73 73 4e 61 6d 65 73 29 28 4e 65 2e 72 6f 6f 74 2c 73 2c 28 30 2c 69 2e 72 65 73 70 6f 6e 73 69 76 65 43 6c 61 73 73 4e 61 6d 65 73 29 28 4e 65 2c 22 72 6f 6f 74 2d 2d 73 69 7a 65 22 2c 6d 29 2c 66 26 26 4e 65 5b 22 72 6f 6f 74 2d 2d 63 6f 6c 6f 72 2d 22 2e 63 6f 6e 63 61 74 28 66 29 5d 2c 64 26 26 4e 65 5b 22 72 6f 6f 74 2d 2d 6f 75 74 6c 69 6e 65 2d 22 2e 63 6f 6e 63 61 74 28 64 29 5d 2c 64 26 26 6e 3f 4e 65 5b 22 72 6f 6f 74 2d 2d 62 6f 72 64 65 72 2d 74 68 69 6e 22 5d Data Ascii: eRef(!1);o().useEffect((function(){var e=E.current;E.current=!0,e&&y(!1)}),[t,n]);var _=(0,i.classNames)(Ne.root,s,(0,i.responsiveClassNames)(Ne,"root--size",m),f&&Ne["root--color-".concat(f)],d&&Ne["root--outline-".concat(d)],d&&n?Ne["root--border-thin"]
2024-02-08 18:36:31 UTC	16384	IN	Data Raw: 74 65 78 74 28 7b 7d 29 2c 6a 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 63 68 69 6c 64 72 65 6e 2c 6e 3d 4d 74 28 65 2c 5b 22 63 68 69 6c 64 72 65 6e 22 5d 29 2c 72 3d 6e 2e 73 74 61 72 74 44 61 74 65 2c 61 3d 6e 2e 65 6e 64 44 61 74 65 2c 69 3d 6f 28 29 2e 75 73 65 53 74 61 74 65 28 6e 75 6c 6c 29 2c 75 3d 69 5b 30 5d 2c 63 3d 69 5b 31 5d 3b 72 65 74 75 72 6e 20 6f 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 4c 74 2e 50 72 6f 76 69 64 65 72 2c 7b 76 61 6c 75 65 3a 46 74 28 46 74 28 7b 7d 2c 6e 29 2c 7b 68 6f 76 65 72 65 64 44 61 74 65 49 53 4f 3a 75 2c 73 65 74 48 6f 76 65 72 65 64 44 61 74 65 49 53 4f 3a 63 2c 73 74 61 72 74 44 61 74 65 49 53 4f 3a 72 26 26 28 30 2c 41 74 2e 63 61 73 74 44 61 74 65 54 6f 49 53 4f 29 28 72 Data Ascii: text({}),jt=function(e){var t=e.children,n=Mt(e,["children"]),r=n.startDate,a=n.endDate,i=o().useState(null),u=i[0],c=i[1];return o().createElement(Lt.Provider,{value:Ft(Ft({},n),{hoveredDateISO:u,setHoveredDateISO:c,startDateISO:r&&(0,At.castDateToISO)(r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
752	192.168.2.5	50605	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:30 UTC	605	OUT	GET /design-assets/assets/v3.99.1/illustrations-traveller/MoneyUsp.png HTTP/1.1 Host: t-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:31 UTC	528	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 4038 Connection: close Last-Modified: Tue, 10 Oct 2023 12:25:25 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 18:36:32 GMT ETag: "dca7c9b271c8b4799ce94491fa1b9ef2" Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront Via: 1.1 4a9f56098c7d51e12b8d2ac77b6f1bcc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: sr9H-H5Tt5Jkjkc2HwvbzmD0y50e3PdFhnZ5NVngX5D5njK6rfOCoA== Vary: Origin
2024-02-08 18:36:31 UTC	4038	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 78 00 00 00 78 08 03 00 00 00 0e ba c6 e0 00 00 01 71 50 4c 54 45 4c 69 71 fe b8 31 fb 92 00 ff e8 b0 ff b6 00 fe a8 03 ff e4 a2 ee cb 7c ff df 90 ff e1 95 fe bb 35 ff b0 00 fe ab 09 fe d0 6f ff b6 00 fc de 93 ff d8 82 fd 9f 00 bb dd f7 ff de 8f fa 8a 01 fe ab 00 92 c3 f2 fe dc 87 ff b4 00 fd c8 5c c2 e1 f9 ff de 8f 80 b9 f1 ff b2 13 fe af 04 ff b2 00 fb 95 00 ff df 91 ff b3 00 c8 e3 f7 fd c3 45 be df f9 0a 73 e4 8d c2 f5 fe b2 0b ca e4 f8 0f 75 e5 7d c4 fd ff b5 03 ff b5 01 fb 94 00 fc bc 2c fe de 8e e5 c1 83 cf e6 f7 be df f9 0b 73 e4 0a 73 e4 ff df 91 c0 e0 f9 fa aa 23 fc 9a 00 f2 c2 60 35 8c e9 93 cd fb af d8 fa a8 d5 fa 0b 74 e4 90 cb fb fe cf 5b f6 cf 70 ff c1 2f ff b6 00 ff b7 00 d0 e7 f8 ff Data Ascii: PNGIHDRxxqPLTELiq1\|5o\Esu},ss#`5t[p/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
753	192.168.2.5	50597	18.64.236.64	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:30 UTC	526	OUT	GET /psb/capla/static/js/a6808fc8.130754bc.chunk.js HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:30 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 383 Connection: close Date: Wed, 07 Feb 2024 21:01:56 GMT Last-Modified: Wed, 07 Feb 2024 13:30:16 GMT ETag: "75bcbe7945b1104286d727e632cdda8e" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: iaQjJAtJJFoLFhrDehS4SzLJKXRM6uvU Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 567dd5250230dcede6b80a58163202c0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: QAMasK9aDD0LzChX7ELXT2JNYLyz09DyabD41b0Xg6Scylf0OEGC_w== Age: 77675 Vary: Origin
2024-02-08 18:36:30 UTC	383	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 5b 22 62 2d 77 65 62 2d 73 68 65 6c 6c 2d 68 65 61 64 65 72 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 77 65 62 2d 73 68 65 6c 6c 2d 68 65 61 64 65 72 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 61 36 38 30 38 66 63 38 22 5d 2c 7b 66 65 39 30 35 66 37 62 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 5f 2c 66 29 7b 66 2e 72 28 5f 29 3b 76 61 72 20 73 3d 66 28 22 35 34 30 61 64 63 64 38 22 29 3b 28 30 2c 73 2e 73 65 72 76 65 29 28 28 28 29 3d 3e 66 2e 65 28 22 61 65 65 30 31 37 30 31 22 29 2e 74 68 65 6e 28 66 2e 62 69 6e 64 28 66 2c 22 36 34 Data Ascii: "use strict";(self["b-web-shell-header-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-web-shell-header-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["a6808fc8"],{fe905f7b:function(e,_,f){f.r(_);var s=f("540adcd8");(0,s.serve)((()=>f.e("aee01701").then(f.bind(f,"64

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
754	192.168.2.5	50606	35.190.10.96	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:30 UTC	373	OUT	GET /api/v2/collector HTTP/1.1 Host: collector-pxikkul2rm.px-cloud.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:31 UTC	284	IN	HTTP/1.1 405 Method Not Allowed Date: Thu, 08 Feb 2024 18:36:30 GMT Content-Type: application/json; charset=utf-8 Content-Length: 31 Allow: HEAD, POST, OPTIONS Timing-Allow-Origin: * Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:31 UTC	31	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 22 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 22 7d 0a Data Ascii: {"error":"Method Not Allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
755	192.168.2.5	50607	18.64.236.64	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:31 UTC	526	OUT	GET /psb/capla/static/js/aee01701.c6972f88.chunk.js HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:31 UTC	629	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 16853 Connection: close Last-Modified: Mon, 22 Jan 2024 05:13:56 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: vAG3vhK_13RwvW8Mem3Sz3vGYqHbN1wS Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 18:36:32 GMT ETag: "9a4778ec8fd99573d02323e7f38b0e53" Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront Via: 1.1 85a5b0f6d760d71ec1e7840a933b5572.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: y797D1aiXYiVklYk8SJjXp7tS0VvyLkuDwI198WqhHm1Uu3Cu6jQcg== Vary: Origin
2024-02-08 18:36:31 UTC	16384	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 5b 22 62 2d 77 65 62 2d 73 68 65 6c 6c 2d 68 65 61 64 65 72 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 77 65 62 2d 73 68 65 6c 6c 2d 68 65 61 64 65 72 2d 6d 66 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 61 65 65 30 31 37 30 31 22 5d 2c 7b 22 31 38 31 65 61 63 63 38 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 72 2c 74 29 7b 74 2e 64 28 72 2c 7b 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 7d 29 3b 76 61 72 20 73 3d 74 28 22 36 65 65 38 38 63 35 34 22 29 2c 6f 3d 74 28 22 64 63 36 64 32 38 66 66 22 29 2c 6e 3d 74 28 22 64 31 Data Ascii: "use strict";(self["b-web-shell-header-mfe__LOADABLE_LOADED_CHUNKS__"]=self["b-web-shell-header-mfe__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["aee01701"],{"181eacc8":function(e,r,t){t.d(r,{d:function(){return i}});var s=t("6ee88c54"),o=t("dc6d28ff"),n=t("d1
2024-02-08 18:36:31 UTC	469	IN	Data Raw: 72 65 74 75 72 6e 28 30 2c 68 2e 72 65 70 6f 72 74 57 61 72 6e 69 6e 67 29 28 60 4e 6f 20 63 6f 6e 6e 65 63 74 65 64 20 70 61 74 74 65 72 6e 20 74 6f 20 72 65 6e 64 65 72 20 66 6f 72 20 70 61 74 68 6e 61 6d 65 20 24 7b 72 7d 60 29 2c 6e 75 6c 6c 7d 2c 67 65 74 50 72 6f 70 73 3a 65 3d 3e 28 7b 70 61 74 68 6e 61 6d 65 3a 65 7d 29 7d 7d 2c 70 3d 65 3d 3e 7b 6c 65 74 7b 6c 6f 63 61 74 69 6f 6e 3a 72 7d 3d 65 3b 63 6f 6e 73 74 20 74 3d 6e 65 77 20 55 52 4c 28 72 2c 22 68 74 74 70 3a 2f 2f 63 61 70 6c 61 22 29 2e 70 61 74 68 6e 61 6d 65 2c 6e 3d 62 5b 74 5d 3f 3f 62 5b 22 2a 22 5d 2c 6c 3d 6e 2e 63 6f 6d 70 6f 6e 65 6e 74 2c 68 3d 6e 2e 67 65 74 50 72 6f 70 73 3f 6e 2e 67 65 74 50 72 6f 70 73 28 74 29 3f 3f 7b 7d 3a 7b 7d 3b 72 65 74 75 72 6e 20 6d 28 29 2e 63 Data Ascii: return(0,h.reportWarning)(`No connected pattern to render for pathname ${r}`),null},getProps:e=>({pathname:e})}},p=e=>{let{location:r}=e;const t=new URL(r,"http://capla").pathname,n=b[t]??b["*"],l=n.component,h=n.getProps?n.getProps(t)??{}:{};return m().c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
756	192.168.2.5	50608	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:31 UTC	607	OUT	GET /design-assets/assets/v3.99.1/illustrations-traveller/TicketsUsp.png HTTP/1.1 Host: t-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:31 UTC	499	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 3759 Connection: close Date: Thu, 08 Feb 2024 18:36:32 GMT Last-Modified: Tue, 10 Oct 2023 12:25:25 GMT ETag: "4f8be30173d60369e61612204c1a9013" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 31341771a4bfa40d7b1f61883ffb56c6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: YhunezLIwN7R0hJQU5e1_NRSv47Fl4a9OfWmmKOzZlbk-R7cVgBNvQ== Vary: Origin
2024-02-08 18:36:31 UTC	3759	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 78 00 00 00 78 08 03 00 00 00 0e ba c6 e0 00 00 00 f3 50 4c 54 45 4c 69 71 fa a3 56 ff e1 9a fc bc 6e eb e2 d2 fd cd 7c e8 f1 f8 eb f3 f8 ef ea da ea f2 f8 fe de 95 ff e2 9c fb de 9f f8 8e 43 f8 91 44 e3 ec f0 d9 ea f7 ff e1 9a f9 92 46 f8 8e 42 f9 93 41 db e9 f6 ff e3 9d f8 90 46 df ed f7 e9 f2 f8 db e8 f2 fc ba 18 fc b9 5b 72 ac e9 eb f3 f9 ea f2 f8 e6 f0 f8 e3 ef f8 ff e2 9d ff df 99 ff e3 9e e1 ee f8 dd ec f7 e8 f1 f8 f8 91 47 f8 92 48 db eb f7 d8 e9 f7 d4 e7 f6 eb f3 f7 fe d6 8f ff db 94 cd e3 f6 fe d1 89 ee f5 f8 92 c0 f0 f8 8e 41 f8 88 37 c1 db f4 f7 82 2c ab cf f2 a0 c9 f1 0b 73 e4 f6 7a 20 b4 d4 f3 6c a9 eb fe cc 69 f8 e3 b1 dc e9 ef fe c8 58 fe c5 45 05 70 e3 2e 87 e7 fd c0 2e fc bd 1d 47 Data Ascii: PNGIHDRxxPLTELiqVn\|CDFBAF[rGHA7,sz liXEp..G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
757	192.168.2.5	50609	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:31 UTC	415	OUT	GET /design-assets/assets/v3.99.1/illustrations-traveller/MagnifyingGlassUsp.png HTTP/1.1 Host: t-cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:31 UTC	529	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 3358 Connection: close Last-Modified: Tue, 10 Oct 2023 12:25:25 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 18:36:31 GMT ETag: "5966a74d467ac8907792c738d59e8218" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 086e2cd5d94fa729de58c51b5666e0e4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: XxYpMF9cfVuhsuONNDgjtAxgQXavia3XiDWICjq9xonGwKdOQImkgA== Age: 1 Vary: Origin
2024-02-08 18:36:31 UTC	3198	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 78 00 00 00 78 08 03 00 00 00 0e ba c6 e0 00 00 01 23 50 4c 54 45 4c 69 71 09 6b da f3 68 02 0b 73 e3 06 5d c5 0a 6d dc 07 61 ca 0b 73 e3 09 6e dd ff b6 00 09 6b d9 09 6e de 09 6f dd 07 66 d3 09 6e dd 0a 70 df 0a 72 e3 0a 72 e3 0a 71 e0 0a 6e dc fe b0 00 fd a5 00 09 6b d9 fe ae 00 ff ae 00 04 54 ba ff b7 00 ff b7 00 fe b3 00 01 47 a7 ff b7 00 ff b7 00 fc a8 01 f0 86 0a ff b7 00 f6 6a 00 08 5d c3 cf 6b 21 f9 88 00 79 6e 73 28 58 9b ff ff ff bc dc f5 0b 74 e4 fe fe ff b9 db f5 ff b7 00 09 71 e2 fc fd ff af d7 f7 e0 f0 fc f8 fc ff 09 6f de e7 f3 fd f3 fa fe ed f6 fe b4 d9 f6 a1 d2 f8 c0 de f5 d9 ec fb c9 e4 fa 00 41 9f 01 47 a7 04 53 b7 05 59 bf 02 4c af a9 d5 f9 09 6b d8 07 64 cf d1 e9 fb 98 ce f9 8c Data Ascii: PNGIHDRxx#PLTELiqkhs]masnknofnprrqnkTGj]k!yns(XtqoAGSYLkd
2024-02-08 18:36:31 UTC	160	IN	Data Raw: 32 a4 82 a9 c1 ef 56 1c e0 8f 33 47 ff 1d 01 de 20 8e 7e fd 72 95 dc 97 a4 82 69 0d 7f 5c 69 62 31 cf 36 36 fe 9e 00 bf 9b 67 f4 ff 49 80 5f 2d 2a f8 cd 2a b9 cc db 26 c0 fd 55 07 f8 d9 6c 30 ac 3c c0 1f a9 a3 fb 1b fd 57 ab 0c f0 73 e6 19 9d 85 1b 1b fd 8f 2b 0d f0 73 e6 7d e3 e8 55 07 f8 39 01 53 bd 5d 69 25 31 c4 d5 54 ab 9d c1 54 ef fb fd fe ab 67 ab ad e0 46 2f 9e bd 58 ad 9b 9f f4 a4 27 3d e9 49 4f fa db f5 1f 99 bc ef ab 88 0b c4 cf 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: 2V3G ~ri\ib166gI_-**&Ul0<Ws+s}U9S]i%1TTgF/X'=IOIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
758	192.168.2.5	50610	18.64.236.64	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:31 UTC	526	OUT	GET /psb/capla/static/js/4bac1f1e.ebb2755f.chunk.js HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:31 UTC	635	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 275544 Connection: close Date: Wed, 07 Feb 2024 21:04:31 GMT Last-Modified: Mon, 05 Feb 2024 15:23:38 GMT ETag: "19ac003ff6ad2a469a19cb86c18edbf4" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: dK7V0A0NwiEbQNHlayX.NwyIbb.bl_1B Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 787da2b9a155d00032c7d0d9a8c2a7dc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: 7DVX8sJcxiI6U0KIViDnaKFx4kK-GnXR_R7rVWECaLXcbHukJUwPUw== Age: 77521 Vary: Origin
2024-02-08 18:36:31 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 34 62 61 63 31 66 31 65 2e 65 62 62 32 37 35 35 66 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 77 65 62 2d 73 68 65 6c 6c 2d 63 6f 6d 70 6f 6e 65 6e 74 73 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 77 65 62 2d 73 68 65 6c 6c 2d 63 6f 6d 70 6f 6e 65 6e 74 73 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 34 62 61 63 31 66 31 65 22 5d 2c 7b 64 30 39 38 39 32 33 36 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 69 29 7b 22 75 73 65 20 73 74 72 69 Data Ascii: /! For license information please see 4bac1f1e.ebb2755f.chunk.js.LICENSE.txt /(self["b-web-shell-components__LOADABLE_LOADED_CHUNKS__"]=self["b-web-shell-components__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["4bac1f1e"],{d0989236:function(e,n,i){"use stri
2024-02-08 18:36:31 UTC	16384	IN	Data Raw: 65 22 3a 22 64 65 73 6b 74 6f 70 22 2c 63 75 72 72 65 6e 63 79 53 65 6c 65 63 74 69 6f 6e 3a 6b 2c 73 65 6c 65 63 74 65 64 43 75 72 72 65 6e 63 79 49 64 3a 70 2c 73 68 6f 75 6c 64 44 69 73 70 6c 61 79 53 65 6c 65 63 74 69 6f 6e 54 69 74 6c 65 3a 21 31 2c 6f 6e 4f 70 65 6e 3a 49 2c 6f 6e 43 6c 6f 73 65 3a 50 2c 61 74 74 72 69 62 75 74 65 73 3a 7b 22 64 61 74 61 2d 74 65 73 74 69 64 22 3a 77 3f 22 66 6f 6f 74 65 72 2d 63 75 72 72 65 6e 63 79 2d 70 69 63 6b 65 72 2d 6d 6f 62 69 6c 65 22 3a 22 66 6f 6f 74 65 72 2d 63 75 72 72 65 6e 63 79 2d 70 69 63 6b 65 72 2d 64 65 73 6b 74 6f 70 22 7d 2c 74 72 69 67 67 65 72 41 74 74 72 69 62 75 74 65 73 3a 7b 22 64 61 74 61 2d 74 65 73 74 69 64 22 3a 77 3f 22 66 6f 6f 74 65 72 2d 63 75 72 72 65 6e 63 79 2d 70 69 63 6b 65 Data Ascii: e":"desktop",currencySelection:k,selectedCurrencyId:p,shouldDisplaySelectionTitle:!1,onOpen:I,onClose:P,attributes:{"data-testid":w?"footer-currency-picker-mobile":"footer-currency-picker-desktop"},triggerAttributes:{"data-testid":w?"footer-currency-picke
2024-02-08 18:36:31 UTC	16384	IN	Data Raw: 2e 36 31 38 20 33 2e 39 39 68 32 2e 33 31 33 6c 31 2e 32 39 36 20 32 2e 34 36 20 31 2e 32 37 37 2d 32 2e 34 36 68 32 2e 32 37 39 6c 2d 32 2e 35 38 20 34 2e 34 38 35 76 33 2e 35 33 35 5a 22 7d 29 2c 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 70 61 74 68 22 2c 7b 66 69 6c 6c 3a 22 23 46 46 36 39 30 46 22 2c 64 3a 22 4d 35 31 2e 30 39 20 30 68 31 36 76 31 36 68 2d 31 36 56 30 5a 22 7d 29 2c 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 70 61 74 68 22 2c 7b 66 69 6c 6c 3a 22 23 66 66 66 22 2c 64 3a 22 6d 35 37 2e 36 34 20 31 30 2e 38 34 37 2d 2e 33 34 38 20 31 2e 31 36 33 48 35 35 2e 32 32 6c 32 2e 36 33 33 2d 38 2e 30 32 68 32 2e 34 37 33 6c 32 2e 36 31 33 20 38 2e 30 32 68 2d 32 2e 31 31 38 6c 2d 2e 33 34 38 2d 31 2e 31 35 2d 32 2e 38 33 34 2d Data Ascii: .618 3.99h2.313l1.296 2.46 1.277-2.46h2.279l-2.58 4.485v3.535Z"}),t.createElement("path",{fill:"#FF690F",d:"M51.09 0h16v16h-16V0Z"}),t.createElement("path",{fill:"#fff",d:"m57.64 10.847-.348 1.163H55.22l2.633-8.02h2.473l2.613 8.02h-2.118l-.348-1.15-2.834-
2024-02-08 18:36:31 UTC	13912	IN	Data Raw: 31 34 32 2e 33 31 33 2e 33 31 31 2e 33 31 33 68 31 2e 31 34 61 2e 33 32 34 2e 33 32 34 20 30 20 30 20 30 20 2e 33 31 2d 2e 33 31 33 76 2d 33 2e 33 39 32 63 30 2d 31 2e 35 39 2d 2e 35 33 35 2d 32 2e 39 39 35 2d 32 2e 36 30 35 2d 32 2e 39 39 35 5a 6d 2d 31 35 2e 35 31 33 20 35 2e 32 33 37 63 2d 2e 38 31 38 20 30 2d 31 2e 33 35 33 2d 2e 33 37 2d 31 2e 33 35 33 2d 2e 33 37 76 2d 32 2e 33 34 32 63 2e 31 34 31 2d 2e 33 37 2e 35 39 32 2d 2e 39 30 39 20 31 2e 34 33 38 2d 2e 39 30 39 20 31 2e 30 31 34 20 30 20 31 2e 35 33 35 2e 38 39 35 20 31 2e 35 33 35 20 31 2e 38 31 37 20 30 20 2e 39 32 33 2d 2e 35 35 20 31 2e 38 30 33 2d 31 2e 36 32 20 31 2e 38 30 33 5a 6d 2e 33 32 34 2d 35 2e 32 33 38 61 32 2e 38 20 32 2e 38 20 30 20 30 20 30 2d 32 2e 31 32 35 2e 39 37 37 76 Data Ascii: 142.313.311.313h1.14a.324.324 0 0 0 .31-.313v-3.392c0-1.59-.535-2.995-2.605-2.995Zm-15.513 5.237c-.818 0-1.353-.37-1.353-.37v-2.342c.141-.37.592-.909 1.438-.909 1.014 0 1.535.895 1.535 1.817 0 .923-.55 1.803-1.62 1.803Zm.324-5.238a2.8 2.8 0 0 0-2.125.977v
2024-02-08 18:36:31 UTC	16384	IN	Data Raw: 2c 22 64 61 74 61 2d 74 65 73 74 69 64 22 3a 22 77 65 62 2d 73 68 65 6c 6c 2d 66 6f 6f 74 65 72 2d 6d 66 65 22 7d 2c 6e 75 6c 6c 21 3d 3d 53 2e 64 73 61 56 61 6c 75 65 26 26 61 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 59 2c 7b 69 73 53 68 6f 77 4d 6f 64 61 6c 3a 53 2e 69 73 53 68 6f 77 44 53 41 2c 68 69 64 65 4d 6f 64 61 6c 3a 53 2e 68 69 64 65 44 53 41 2c 69 6e 69 74 56 61 6c 75 65 3a 53 2e 64 73 61 56 61 6c 75 65 7d 29 2c 61 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 79 2c 7b 76 61 72 69 61 6e 74 3a 22 66 75 6c 6c 22 2c 63 6f 70 79 72 69 67 68 74 54 65 78 74 3a 66 2c 6c 65 67 61 6c 54 65 78 74 3a 70 2c 63 75 72 72 65 6e 63 79 53 65 6c 65 63 74 69 6f 6e 3a 49 2c 6c 61 6e 67 75 61 67 65 53 65 6c 65 63 74 69 6f 6e 3a 45 2c 73 65 6c 65 63 Data Ascii: ,"data-testid":"web-shell-footer-mfe"},null!==S.dsaValue&&a().createElement(Y,{isShowModal:S.isShowDSA,hideModal:S.hideDSA,initValue:S.dsaValue}),a().createElement(y,{variant:"full",copyrightText:f,legalText:p,currencySelection:I,languageSelection:E,selec
2024-02-08 18:36:31 UTC	3986	IN	Data Raw: 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 75 72 6c 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 69 63 6f 6e 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 5d 7d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 6c 69 6e 6b 73 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 Data Ascii: ives:[]},{kind:"Field",name:{kind:"Name",value:"url"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"icon"},arguments:[],directives:[]}]}},{kind:"Field",name:{kind:"Name",value:"links"},arguments:[],directives:[],selectionSet:{kind:"Se
2024-02-08 18:36:31 UTC	12792	IN	Data Raw: 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 61 66 66 69 6c 69 61 74 65 53 65 74 74 69 6e 67 73 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 2c 73 65 6c 65 63 74 69 6f 6e 53 65 74 3a 7b 6b 69 6e 64 3a 22 53 65 6c 65 63 74 69 6f 6e 53 65 74 22 2c 73 65 6c 65 63 74 69 6f 6e 73 3a 5b 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 70 72 6f 64 75 63 74 54 79 70 65 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 69 73 55 73 65 72 4c 6f 67 69 6e 41 6c 6c 6f 77 65 64 22 Data Ascii: me:{kind:"Name",value:"affiliateSettings"},arguments:[],directives:[],selectionSet:{kind:"SelectionSet",selections:[{kind:"Field",name:{kind:"Name",value:"productType"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"isUserLoginAllowed"
2024-02-08 18:36:31 UTC	16384	IN	Data Raw: 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 6c 61 62 65 6c 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 73 75 62 4c 61 62 65 6c 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 6d 65 3a 7b 6b 69 6e 64 3a 22 4e 61 6d 65 22 2c 76 61 6c 75 65 3a 22 75 72 6c 22 7d 2c 61 72 67 75 6d 65 6e 74 73 3a 5b 5d 2c 64 69 72 65 63 74 69 76 65 73 3a 5b 5d 7d 2c 7b 6b 69 6e 64 3a 22 46 69 65 6c 64 22 2c 6e 61 Data Ascii: rectives:[]},{kind:"Field",name:{kind:"Name",value:"label"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"subLabel"},arguments:[],directives:[]},{kind:"Field",name:{kind:"Name",value:"url"},arguments:[],directives:[]},{kind:"Field",na
2024-02-08 18:36:31 UTC	9200	IN	Data Raw: 76 33 2e 37 35 6c 2e 37 35 2d 2e 37 35 68 2d 33 6c 2e 37 35 2e 37 35 76 2d 33 2e 37 35 68 31 2e 35 7a 22 7d 29 29 7d 2c 75 3d 69 28 22 34 33 62 65 64 64 38 34 22 29 2c 6d 3d 69 28 22 65 62 62 30 35 63 34 63 22 29 3b 66 75 6e 63 74 69 6f 6e 20 76 28 65 29 7b 73 77 69 74 63 68 28 65 29 7b 63 61 73 65 22 61 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 73 22 3a 72 65 74 75 72 6e 22 78 70 62 5f 61 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 22 3b 63 61 73 65 22 61 74 74 72 61 63 74 69 6f 6e 73 22 3a 72 65 74 75 72 6e 22 78 70 62 5f 61 74 74 72 61 63 74 69 6f 6e 73 22 3b 63 61 73 65 22 63 61 72 73 22 3a 72 65 74 75 72 6e 22 78 70 62 5f 72 65 6e 74 61 6c 63 61 72 73 22 3b 63 61 73 65 22 61 69 72 70 6f 72 74 5f 74 61 78 69 73 22 3a 72 65 74 75 72 6e 22 78 70 62 5f 72 69 64 65 77 Data Ascii: v3.75l.75-.75h-3l.75.75v-3.75h1.5z"}))},u=i("43bedd84"),m=i("ebb05c4c");function v(e){switch(e){case"accommodations":return"xpb_accommodation";case"attractions":return"xpb_attractions";case"cars":return"xpb_rentalcars";case"airport_taxis":return"xpb_ridew
2024-02-08 18:36:31 UTC	12792	IN	Data Raw: 6f 6e 73 74 20 6e 3d 4f 2e 65 78 65 63 28 65 29 3b 69 66 28 6e 26 26 34 3d 3d 3d 6e 2e 6c 65 6e 67 74 68 29 7b 63 6f 6e 73 74 20 65 3d 4e 75 6d 62 65 72 28 6e 5b 33 5d 29 2c 69 3d 4e 75 6d 62 65 72 28 6e 5b 31 5d 29 2c 74 3d 4e 75 6d 62 65 72 28 6e 5b 32 5d 29 3b 69 66 28 21 69 73 4e 61 4e 28 69 29 26 26 21 69 73 4e 61 4e 28 74 29 26 26 21 69 73 4e 61 4e 28 65 29 29 72 65 74 75 72 6e 20 6e 65 77 20 44 61 74 65 28 69 2c 74 2d 31 2c 65 2c 30 2c 30 2c 30 29 7d 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 2c 78 3d 28 29 3d 3e 7b 63 6f 6e 73 74 20 65 3d 6e 65 77 20 44 61 74 65 3b 72 65 74 75 72 6e 20 65 2e 73 65 74 48 6f 75 72 73 28 30 2c 30 2c 30 2c 30 29 2c 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 56 28 65 29 7b 6c 65 74 20 6e 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 Data Ascii: onst n=O.exec(e);if(n&&4===n.length){const e=Number(n[3]),i=Number(n[1]),t=Number(n[2]);if(!isNaN(i)&&!isNaN(t)&&!isNaN(e))return new Date(i,t-1,e,0,0,0)}return null},x=()=>{const e=new Date;return e.setHours(0,0,0,0),e};function V(e){let n=arguments.leng

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
759	192.168.2.5	50611	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:31 UTC	448	OUT	GET /xdata/images/city/square210/682559.jpg?k=eba0a86971de163610eaab458cd7c2483f59ff8f350d2f63eceed77d21afbed3&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:31 UTC	542	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 6208 Connection: close Server: nginx Date: Mon, 29 Jan 2024 19:54:08 GMT ETag: "6f65813dfc922188ee5c5075e3c0b4fdeb5a7bd6" Content-Language: 6208 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 a53ebc5c4d12bc9682b9c11ea18dccbe.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: _70IbytGo7DsLbUf7bN30BvRdw8fFyS5gk-2BtClMtrIejkPtpttAQ== Age: 859343
2024-02-08 18:36:31 UTC	6208	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 00 d2 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
760	192.168.2.5	50612	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:31 UTC	648	OUT	GET /xdata/images/city/square210/977408.jpg?k=125215335ffab346e954ff91ddbf6e4d2f15812d3e3a51b654ccd29705cce852&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:31 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sun, 28 Jan 2024 22:39:36 GMT ETag: "30d10436df80f84ae1e8257ce3a31595edd12dcc" Content-Language: 13871 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 8c7b20060d90bea31f16760f6840aa40.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: vGmwkErWmcXRU2cbicI_ovroLrpcPeiUSMZnQZY-Pe1gmTteHX2AMg== Age: 935815
2024-02-08 18:36:31 UTC	13879	IN	Data Raw: 33 36 32 66 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 00 d2 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 362fJFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:36:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
761	192.168.2.5	50614	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:31 UTC	648	OUT	GET /xdata/images/city/square210/977387.jpg?k=07aeb102ff72c498cfb8c4b92382aa6ada5fd4e84ad283aa8b387b072c9fd7d3&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:31 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Mon, 22 Jan 2024 22:05:09 GMT ETag: "6842881bdf780fcf108886267e6f0c67a3b48f1f" Content-Language: 13559 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 5df6a6f843be2e6dd8ba492b043e12c4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: D1BEkDiaT9J2HETHq4B6UDAdnxMLvYWVkt6mWEJGYw1LCIgErTYUKA== Age: 1456282
2024-02-08 18:36:31 UTC	13567	IN	Data Raw: 33 34 66 37 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 00 d2 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 34f7JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:36:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
762	192.168.2.5	50615	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:31 UTC	448	OUT	GET /xdata/images/city/square210/688940.jpg?k=8c6ae0b4434360802cfc87335163787de421d3fcb7df1a4bdffbc5f930fa8f2d&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:31 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 5960 Connection: close Server: nginx Date: Sun, 21 Jan 2024 19:04:19 GMT ETag: "3f66ef17dca93d6d7b4071ddc2b0234b7489653f" Content-Language: 5960 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 b0c7b942a33f0f4451718aee53f7840c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Z5fJPtPNqPDXSshg6ZjAMK78Q2bryuIDPrwxuE8MMfzFea1UXhEMjg== Age: 1553532
2024-02-08 18:36:31 UTC	5960	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 00 d2 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
763	192.168.2.5	50616	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:31 UTC	448	OUT	GET /xdata/images/city/square210/690620.jpg?k=5b801857b88469e1cc299707cda5a8ee86c757a159c04ff69fbc1fbb37a9fe4c&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:31 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Wed, 10 Jan 2024 14:35:01 GMT ETag: "bd4710f923ebebb6dc6662d77d7c03793152313b" Content-Language: 8808 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 76f3fedc86826a7b266250e33ee41082.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 2j_-OJ3BvGJlQY3ZNWEfOddcrKy5WZ6aOB6hC-9EHSnG21jGd-4whw== Age: 2520090
2024-02-08 18:36:31 UTC	8816	IN	Data Raw: 32 32 36 38 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 00 d2 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 2268JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:36:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
764	192.168.2.5	50617	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:31 UTC	448	OUT	GET /xdata/images/city/square210/688779.jpg?k=def43ae0127037a004ded67b24b8f978345b16a8d10edd0832dcabbed12f2fcd&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:31 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 5745 Connection: close Server: nginx Date: Sun, 21 Jan 2024 16:00:13 GMT ETag: "a0bbacee6852ca8dc84c1c65e81af973a170f3ff" Content-Language: 5745 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 e6c353101750d150139bda8d95719802.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: eojT886zTerWqnlY-3jWCb9F6V1UdI7czX5p0jwDPta6Y8UF-TkQdA== Age: 1564578
2024-02-08 18:36:31 UTC	5745	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 00 d2 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
765	192.168.2.5	50618	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:31 UTC	648	OUT	GET /xdata/images/city/square210/977415.jpg?k=fa67e6f0e70c09f18c4181bef46164f0406fbd367cad543314a3c748bfc7e411&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:31 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Tue, 06 Feb 2024 12:35:13 GMT ETag: "3f29f6d5efa98e9b0b1e32dc5cca3045dbce1ca2" Content-Language: 10198 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 b2005ca570500d06b9f0674e17212cee.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: DCwI8i2qhPouZSOS820vyX_Z5JgqtUz-82OxzYE6w6A1TWSUJDNP7Q== Age: 194478
2024-02-08 18:36:31 UTC	10206	IN	Data Raw: 32 37 64 36 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 00 d2 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 27d6JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:36:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
766	192.168.2.5	50619	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:31 UTC	648	OUT	GET /xdata/images/city/square210/977345.jpg?k=898a2e6c68a765bdc18cc57be5c78b3e1f5b825c4d3167e7a0860c4c988a1af1&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:31 UTC	542	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 6218 Connection: close Server: nginx Date: Tue, 06 Feb 2024 00:36:01 GMT ETag: "c4123ef9a3176c8df7b35723adb04f2c968b18eb" Content-Language: 6218 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 d15135b95e5ad7fd5c97f893917772de.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: lxxnHRw8qXWCdoRfGaiaF8P_Gicgyvzp2_luAN5zD3DhWDQ0BPgOhw== Age: 237630
2024-02-08 18:36:31 UTC	6218	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 00 d2 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
767	192.168.2.5	50620	18.64.236.64	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:31 UTC	648	OUT	GET /xdata/images/city/square100/977408.jpg?k=125215335ffab346e954ff91ddbf6e4d2f15812d3e3a51b654ccd29705cce852&o= HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:31 UTC	542	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 4271 Connection: close Server: nginx Date: Sun, 04 Feb 2024 21:13:32 GMT ETag: "5534d822f4d018c46247fc29e2c68767355a316e" Content-Language: 4271 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 71cf657de17d1d4de9dbcb4ff38d54c0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: vpwgDFHNtSwYBgrL1zYv6sUshqx-i-I4p6uF9-aygkDyUl5jusyenA== Age: 336179
2024-02-08 18:36:31 UTC	4271	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 64 00 64 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222dd"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
768	192.168.2.5	50621	18.64.236.64	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:31 UTC	648	OUT	GET /xdata/images/city/square100/977387.jpg?k=07aeb102ff72c498cfb8c4b92382aa6ada5fd4e84ad283aa8b387b072c9fd7d3&o= HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:31 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 3971 Connection: close Server: nginx Date: Fri, 26 Jan 2024 17:53:58 GMT ETag: "ffe47bb938cd555121e09d4c987d2b389b470457" Content-Language: 3971 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 5df6a6f843be2e6dd8ba492b043e12c4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: rO1ZzNDQ3tr0aBzfuZH6mtFZkbsV621pxYugVSM1hHprbLPBAZw4nw== Age: 1125753
2024-02-08 18:36:31 UTC	3971	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 64 00 64 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222dd"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
769	192.168.2.5	50622	18.64.236.64	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:31 UTC	648	OUT	GET /xdata/images/city/square100/977415.jpg?k=fa67e6f0e70c09f18c4181bef46164f0406fbd367cad543314a3c748bfc7e411&o= HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:31 UTC	542	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 3170 Connection: close Server: nginx Date: Tue, 30 Jan 2024 16:40:54 GMT ETag: "2e755c6758fe186a583471e02adaf64522665696" Content-Language: 3170 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 5976fe1222a45812dfd5003b003d8b56.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: MUp3Zk7iLdWznVCYd6UFojxxsF6JTFL9yg2FWUQffY94jWEDc6abPA== Age: 784537
2024-02-08 18:36:31 UTC	3170	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 64 00 64 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222dd"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
770	192.168.2.5	50623	18.64.236.64	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:31 UTC	648	OUT	GET /xdata/images/city/square100/977345.jpg?k=898a2e6c68a765bdc18cc57be5c78b3e1f5b825c4d3167e7a0860c4c988a1af1&o= HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:32 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 2224 Connection: close Server: nginx Date: Sat, 20 Jan 2024 16:58:47 GMT ETag: "03b52ca7dff6757dfce97903a2c1f7e8849cdf07" Content-Language: 2224 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 787da2b9a155d00032c7d0d9a8c2a7dc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: 1wOP7_zMOKcnVNPqFIp3Sh9RGry75nuEle9Xy0NTv_305cFGQ4yx-A== Age: 1647465
2024-02-08 18:36:32 UTC	2224	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 64 00 64 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222dd"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
771	192.168.2.5	50624	18.64.236.64	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:31 UTC	648	OUT	GET /xdata/images/city/square100/690408.jpg?k=f59731e733077b90bc716596e05cfd0f85a2582341cc25c17b26ee2a755d7b55&o= HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:32 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 3298 Connection: close Server: nginx Date: Mon, 22 Jan 2024 21:35:20 GMT ETag: "9511c8a2db9c6e79fc7139c58f571d2cd4f308df" Content-Language: 3298 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 b340a44dae03e8ff13e054502e49abe2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: FuO7-UNKCF6PJiCU6O47R-RnfGSw5wYLs8Kl6LUPF6dCy80mAcMrJQ== Age: 1458072
2024-02-08 18:36:32 UTC	3298	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 64 00 64 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222dd"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
772	192.168.2.5	50625	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:32 UTC	554	OUT	GET /flights/web/static/js/9806.15323e3e.chunk.js HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:32 UTC	599	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 10770 Connection: close Date: Wed, 07 Feb 2024 21:04:31 GMT Last-Modified: Wed, 07 Feb 2024 16:05:10 GMT ETag: "a197ce07cfb7a8cb87b370fe65362bfb" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 787da2b9a155d00032c7d0d9a8c2a7dc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: sLlAOS10OvQzfFdukeeP0BCyuOxnG60n4qCZaBow3ptUFEUw2hkqVw== Age: 77521 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:36:32 UTC	10770	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 3d 73 65 6c 66 2e 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 39 38 30 36 5d 2c 7b 34 39 35 32 36 3a 28 74 2c 65 2c 61 29 3d 3e 7b 66 75 6e 63 74 69 6f 6e 20 6e 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 61 3d 65 7c 7c 7b 7d 2c 6e 3d 61 2e 77 69 64 74 68 3f 53 74 72 69 6e 67 28 61 2e 77 69 64 74 68 29 3a 74 2e 64 65 66 61 75 6c 74 57 69 64 74 68 3b 72 65 74 75 72 6e 20 74 2e 66 6f 72 6d 61 74 73 5b 6e 5d 7c 7c 74 2e 66 6f 72 6d 61 74 73 5b 74 2e 64 65 66 61 75 6c 74 57 69 64 74 68 5d 7d 7d 61 2e 64 28 65 2c 7b 5a Data Ascii: "use strict";(self.__LOADABLE_LOADED_CHUNKS__=self.__LOADABLE_LOADED_CHUNKS__\|\|[]).push([[9806],{49526:(t,e,a)=>{function n(t){return function(e){var a=e\|\|{},n=a.width?String(a.width):t.defaultWidth;return t.formats[n]\|\|t.formats[t.defaultWidth]}}a.d(e,{Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
773	192.168.2.5	50627	18.64.236.64	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:32 UTC	648	OUT	GET /xdata/images/city/square100/976918.jpg?k=ba17581113d23e0a509fba3480bb6c08fef757afd93d9c56808a343bc2612e18&o= HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:32 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 4146 Connection: close Server: nginx Date: Wed, 10 Jan 2024 23:06:51 GMT ETag: "d56dec58fbb45404aa83b6eb98f12e5c81f74b99" Content-Language: 4146 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 85a5b0f6d760d71ec1e7840a933b5572.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: 3dXVGFI3oNEkS_e49dsxnbqgm_9pokT-OQgPLHMns08RXZ3_EphDBA== Age: 2489381
2024-02-08 18:36:32 UTC	4146	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 64 00 64 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222dd"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
774	192.168.2.5	50629	18.64.236.64	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:32 UTC	648	OUT	GET /xdata/images/city/square100/682559.jpg?k=eba0a86971de163610eaab458cd7c2483f59ff8f350d2f63eceed77d21afbed3&o= HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:32 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 2315 Connection: close Server: nginx Date: Mon, 22 Jan 2024 07:13:44 GMT ETag: "5bff16d33321fc839eec78ed3662449d54fac1a3" Content-Language: 2315 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 dfd828b2c103ff2899b6b2f2946f1e2e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: OgokzGkCKvqcDjsFgHt9lfM5hxsWkjFdSz5-PKYHfVeB3JPGXIZnDQ== Age: 1509768
2024-02-08 18:36:32 UTC	2315	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 64 00 64 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222dd"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
775	192.168.2.5	50628	18.64.236.64	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:32 UTC	648	OUT	GET /xdata/images/city/square100/689744.jpg?k=3c7c6d59d968c2bade9003d9ebf8a1346455ce92abe94ffaa29247839161f09e&o= HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:32 UTC	542	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 2617 Connection: close Server: nginx Date: Tue, 06 Feb 2024 12:35:38 GMT ETag: "e477fe470be3c71b86fe8a6db69c367395ef93a2" Content-Language: 2617 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 b340a44dae03e8ff13e054502e49abe2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: WSzXM0t9NdjMlw4iuUDqcSie8JH5YpExA6B1BPx_H6RQ50ygNxpGhg== Age: 194454
2024-02-08 18:36:32 UTC	2617	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 64 00 64 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222dd"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
776	192.168.2.5	50630	172.64.155.119	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:32 UTC	562	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:32 UTC	370	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:36:32 GMT Content-Type: application/json Content-Length: 68 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8525fa8ecf1912dd-ATL
2024-02-08 18:36:32 UTC	68	IN	Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 47 41 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 47 65 6f 72 67 69 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d Data Ascii: {"country":"US","state":"GA","stateName":"Georgia","continent":"NA"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
777	192.168.2.5	50631	18.64.236.64	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:32 UTC	648	OUT	GET /xdata/images/city/square100/976905.jpg?k=5a3ac9e6ec03eb39b872674694fc81d05643a1cc7df66b2e93d0de4bf21801d7&o= HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:32 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 2433 Connection: close Server: nginx Date: Tue, 16 Jan 2024 23:44:48 GMT ETag: "0aef82d62a869b634b57d966e67df199df994f35" Content-Language: 2433 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 d680d477a1d2c387663f2f93d2dabec6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: O3pNWeXH2pUk351gpIA8D8y-njuid1SfAoz0VAZyc3_YEepl4aty1A== Age: 1968704
2024-02-08 18:36:32 UTC	2433	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 64 00 64 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222dd"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
778	192.168.2.5	50632	3.162.125.32	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:32 UTC	582	OUT	OPTIONS /orca/chunk-metadata?chunk=95f0c6f5&mfe=b-web-shell-header-mfe&lang=en-us&namespace=cbMBXEQB HTTP/1.1 Host: accommodations.booking.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-booking-et-serialized-state Origin: https://www.booking.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:32 UTC	684	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:32 GMT x-frame-options: SAMEORIGIN x-content-type-options: nosniff access-control-allow-credentials: true access-control-allow-methods: HEAD,OPTIONS,GET,POST access-control-allow-headers: x-booking-et-serialized-state vary: Origin access-control-allow-origin: https://www.booking.com strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 14c14e18d9457c881708b4141ebcdd66.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P3 X-Amz-Cf-Id: tamV7VrcQycECNQKGio5HFQK4ZA8Weh2VRDZhlFBf4JuVxU0xBiYpA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
779	192.168.2.5	50633	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:32 UTC	405	OUT	GET /design-assets/assets/v3.99.1/illustrations-traveller/MoneyUsp.png HTTP/1.1 Host: t-cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:32 UTC	529	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 4038 Connection: close Last-Modified: Tue, 10 Oct 2023 12:25:25 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 18:36:32 GMT ETag: "dca7c9b271c8b4799ce94491fa1b9ef2" Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 09aa283795aaafe63cbd7c2cbac2c306.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 1L0jnNeqlZ-xwSsJtH3lZZ6lS3fQpcTdeM8IZpRd18oY7LJOuK4v_w== Age: 1 Vary: Origin
2024-02-08 18:36:32 UTC	4038	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 78 00 00 00 78 08 03 00 00 00 0e ba c6 e0 00 00 01 71 50 4c 54 45 4c 69 71 fe b8 31 fb 92 00 ff e8 b0 ff b6 00 fe a8 03 ff e4 a2 ee cb 7c ff df 90 ff e1 95 fe bb 35 ff b0 00 fe ab 09 fe d0 6f ff b6 00 fc de 93 ff d8 82 fd 9f 00 bb dd f7 ff de 8f fa 8a 01 fe ab 00 92 c3 f2 fe dc 87 ff b4 00 fd c8 5c c2 e1 f9 ff de 8f 80 b9 f1 ff b2 13 fe af 04 ff b2 00 fb 95 00 ff df 91 ff b3 00 c8 e3 f7 fd c3 45 be df f9 0a 73 e4 8d c2 f5 fe b2 0b ca e4 f8 0f 75 e5 7d c4 fd ff b5 03 ff b5 01 fb 94 00 fc bc 2c fe de 8e e5 c1 83 cf e6 f7 be df f9 0b 73 e4 0a 73 e4 ff df 91 c0 e0 f9 fa aa 23 fc 9a 00 f2 c2 60 35 8c e9 93 cd fb af d8 fa a8 d5 fa 0b 74 e4 90 cb fb fe cf 5b f6 cf 70 ff c1 2f ff b6 00 ff b7 00 d0 e7 f8 ff Data Ascii: PNGIHDRxxqPLTELiq1\|5o\Esu},ss#`5t[p/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
780	192.168.2.5	50634	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:32 UTC	448	OUT	GET /xdata/images/city/square210/977408.jpg?k=125215335ffab346e954ff91ddbf6e4d2f15812d3e3a51b654ccd29705cce852&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:32 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Sun, 28 Jan 2024 22:39:36 GMT ETag: "30d10436df80f84ae1e8257ce3a31595edd12dcc" Content-Language: 13871 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 f588325f7617672d954c4267c8bee1ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Wzqys4OPjgtr73dUrnfRJ1DFq-AC4oXVytJclhtes_GPFp0Z3bcRxA== Age: 935816
2024-02-08 18:36:32 UTC	13879	IN	Data Raw: 33 36 32 66 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 00 d2 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 362fJFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:36:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
781	192.168.2.5	50635	18.64.236.64	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:32 UTC	526	OUT	GET /psb/capla/static/js/95f0c6f5.61e0b6e0.chunk.js HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:32 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 572 Connection: close Date: Thu, 08 Feb 2024 13:40:48 GMT Last-Modified: Thu, 08 Feb 2024 10:29:33 GMT ETag: "5776fa326996fc5fab93fc69b26cbe02" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 5P1q1CfNOlxQrtyLQG9B3E0YFYSZCNqw Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 d7734ec5e5fca10fcc695a29ed943462.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: Z9V0_8y9dZqfZH7LOSxR4p0hx9w4rDcleyZ0GNoVMi5gGHlXIy_9IQ== Age: 17745 Vary: Origin
2024-02-08 18:36:32 UTC	572	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 5b 22 62 2d 66 6c 69 67 68 74 73 2d 69 6e 64 65 78 2d 63 6f 6d 70 6f 6e 65 6e 74 2d 73 65 72 76 69 63 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 66 6c 69 67 68 74 73 2d 69 6e 64 65 78 2d 63 6f 6d 70 6f 6e 65 6e 74 2d 73 65 72 76 69 63 65 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 39 35 66 30 63 36 66 35 22 2c 22 38 62 35 63 63 35 64 35 22 5d 2c 7b 22 37 35 31 61 33 38 37 35 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 6e 2e 72 28 74 29 3b 76 61 72 20 69 3d 6e 28 22 65 61 64 37 31 65 62 30 22 29 2c 6f 3d 6e 2e 6e 28 69 29 28 29 2e 63 72 65 61 Data Ascii: "use strict";(self["b-flights-index-component-service__LOADABLE_LOADED_CHUNKS__"]=self["b-flights-index-component-service__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["95f0c6f5","8b5cc5d5"],{"751a3875":function(e,t,n){n.r(t);var i=n("ead71eb0"),o=n.n(i)().crea

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
782	192.168.2.5	50637	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:32 UTC	4087	OUT	POST /js_errors HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 4573 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryjClg2vaOjIWInoiJ X-Booking-ET-Serialized-State: EggNsz4B_SY1UmxSoj7ncG8VtNhkBKW-u1pbeB5xtLqkgIgWCRoMOUVwixu8ULIMWgxkCUUTpwak sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAfk6BVJUjAAAA:WDfXg2ry+HvbnxTztLnepFvhf3dpX4SdQfM4GczRrcPw6MWAZH8MErn+af2Y9SvAts7ySjM/T9nCQWaxTWJ+ECSRYADCgGFp6g8nwqAAp4uZuesbnPNMB9VWMMTR/6OqpiFI1lm6c8HTX0et8uTZTDvEovUpe/ZJPj+EvnZwpL1hdq9NKhFzFZb6nk1kcyw+S5Gmb0WW/JMfQvkBUX6FX8nHd2pkcvntEKFlkhvMXyaXZ+ocI5s4XxhjbVLG6yziJfNgBxF+; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3W%2BNL4quFW42Tdgsr2lQmhkj%2Fk4mI%2BTrnhecMjFPG%2FDvcPMlrXQlThAlGgTjgpGFFCJGfzukHp6ArijaWBMwPVZP%2FesWLKFmsG86c0W8fSjSVGEzYHJFRgb5uOXqsIPNgXjkQJaikxJpyece9f8XeEAvu0lzqDd7nY%3D
2024-02-08 18:36:32 UTC	4573	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 6a 43 6c 67 32 76 61 4f 6a 49 57 49 6e 6f 69 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 65 72 72 6f 72 22 0d 0a 0d 0a 45 72 72 6f 72 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 6a 43 6c 67 32 76 61 4f 6a 49 57 49 6e 6f 69 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 6e 6f 22 0d 0a 0d 0a 30 0d 0a 2d 2d 2d 2d 2d 2d 57 65 62 4b 69 74 46 6f 72 6d 42 6f 75 6e 64 61 72 79 6a 43 6c 67 32 76 61 4f 6a 49 57 49 6e 6f 69 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d Data Ascii: ------WebKitFormBoundaryjClg2vaOjIWInoiJContent-Disposition: form-data; name="error"Error------WebKitFormBoundaryjClg2vaOjIWInoiJContent-Disposition: form-data; name="lno"0------WebKitFormBoundaryjClg2vaOjIWInoiJContent-Disposition: form
2024-02-08 18:36:33 UTC	684	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:33 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=4d2e82d80b50011d&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpDDfh8iaOvezEV9sdG7iHZymhx0IpBBfP x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 e268ddb03ed9480c5c602c27323a81ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: K3gAF5GZspksCgreg9BfXoSIXdmWrAI4TbLAbV2_BRCcxiUVgwMa0w==
2024-02-08 18:36:33 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
783	192.168.2.5	50636	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:32 UTC	4371	OUT	GET /js_tracking?ref_action=&ver=2&stype=1&lang=en-us&pid=feba38c8c78949209e6dc34689f0c290&ete=&etg=&etcg=&ets=YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|7&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-ET-Serialized-State: EggNsz4B_SY1UmxSoj7ncG8VtNhkBKW-u1pbeB5xtLqkgIgWCRoMOUVwixu8ULIMWgxkCUUTpwak X-Booking-Language-Code: en-us X-Booking-Client-Info: sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: feba38c8c78949209e6dc34689f0c290 X-Booking-Info: X-Booking-SiteType-Id: 1 X-Booking-Session-Id: e6cee70651ebbef06190dea052768836 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAfk6BVJUjAAAA:WDfXg2ry+HvbnxTztLnepFvhf3dpX4SdQfM4GczRrcPw6MWAZH8MErn+af2Y9SvAts7ySjM/T9nCQWaxTWJ+ECSRYADCgGFp6g8nwqAAp4uZuesbnPNMB9VWMMTR/6OqpiFI1lm6c8HTX0et8uTZTDvEovUpe/ZJPj+EvnZwpL1hdq9NKhFzFZb6nk1kcyw+S5Gmb0WW/JMfQvkBUX6FX8nHd2pkcvntEKFlkhvMXyaXZ+ocI5s4XxhjbVLG6yziJfNgBxF+; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3W%2BNL4quFW42Tdgsr2lQmhkj%2Fk4mI%2BTrnhecMjFPG%2FDvcPMlrXQlThAlGgTjgpGFFCJGfzukHp6ArijaWBMwPVZP%2FesWLKFmsG86c0W8fSjSVGEzYHJFRgb5uOXqsIPNgXjkQJaikxJpyece9f8XeEAvu0lzqDd7nY%3D
2024-02-08 18:36:33 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:32 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=8fe682d85157048a&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejLKoxt8vT2AKNLZ9FKTPPCZ9QHPp53O9ME x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 309e9e958e8d35f7e17ae8ac267b7dea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 6hn4evji_EXXwIJ1YqBFVJRMNdLuXeV4gN22crhsN6irG6oLbdd70Q==
2024-02-08 18:36:33 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
784	192.168.2.5	50640	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:33 UTC	580	OUT	GET /flights/web/static/css/screens-Search.f7732e67.chunk.css HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: style Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:33 UTC	574	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 45867 Connection: close Date: Thu, 08 Feb 2024 18:36:34 GMT Last-Modified: Thu, 08 Feb 2024 14:27:05 GMT ETag: "e8fe041d8c91154bb197a40dc785e5a4" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 2d92895b53b29a36f51f181a2ba9c2aa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: PIjhA1j7uV0dfMI82ASt6YxaRUl0SBVncft0k8AqEwsc3NhdsxGhUQ== Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:36:33 UTC	16384	IN	Data Raw: 2e 43 6f 6e 74 61 69 6e 65 72 2d 6d 6f 64 75 6c 65 5f 5f 63 6f 6e 74 61 69 6e 65 72 5f 5f 5f 51 62 49 32 33 7b 6d 69 6e 2d 77 69 64 74 68 3a 33 35 30 70 78 3b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 66 6c 65 78 3a 31 3b 6d 61 78 2d 77 69 64 74 68 3a 31 31 30 30 70 78 7d 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 33 35 30 70 78 29 7b 2e 43 6f 6e 74 61 69 6e 65 72 2d 6d 6f 64 75 6c 65 5f 5f 63 6f 6e 74 61 69 6e 65 72 5f 5f 5f 51 62 49 32 33 7b 6d 69 6e 2d 77 69 64 74 68 3a 61 75 74 6f 7d 7d 2e 43 6f 6e 74 61 69 6e 65 72 2d 6d 6f 64 75 6c 65 5f 5f 63 6f 6e 74 61 69 6e 65 72 5f 5f 5f 51 62 49 32 33 3e 64 69 76 7b 77 69 64 74 68 3a 31 30 30 25 7d 2e 75 Data Ascii: .Container-module__container___QbI23{min-width:350px;width:100%;display:flex;flex-direction:column;flex:1;max-width:1100px}@media (max-width:350px){.Container-module__container___QbI23{min-width:auto}}.Container-module__container___QbI23>div{width:100%}.u
2024-02-08 18:36:33 UTC	519	IN	Data Raw: 75 69 5f 73 70 61 63 69 6e 67 5f 68 61 6c 66 29 3b 6d 61 72 67 69 6e 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 68 61 6c 66 29 2a 2d 31 29 20 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 68 61 6c 66 29 2a 2d 31 29 7d 2e 46 61 72 65 43 61 72 64 50 72 69 63 65 2d 6d 6f 64 75 6c 65 5f 5f 74 6f 74 61 6c 50 72 69 63 65 4c 61 62 65 6c 5f 5f 5f 30 46 73 50 55 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 66 6f 72 65 67 72 6f 75 6e 64 5f 61 6c 74 29 7d 2e 46 61 72 65 43 61 72 64 50 72 69 63 65 2d 6d 6f 64 75 6c 65 5f 5f 6d 61 69 6e 50 72 69 63 65 5f 5f 5f 4f 55 78 6f 45 7b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 Data Ascii: ui_spacing_half);margin:calc(var(--bui_spacing_half)-1) calc(var(--bui_spacing_half)-1)}.FareCardPrice-module__totalPriceLabel___0FsPU{color:var(--bui_color_foreground_alt)}.FareCardPrice-module__mainPrice___OUxoE{white-space:nowrap;padding-top:var(--bu
2024-02-08 18:36:33 UTC	16384	IN	Data Raw: 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 7d 2e 43 68 65 63 6b 6f 75 74 46 61 72 65 49 6e 6e 65 72 2d 6d 6f 64 75 6c 65 5f 5f 66 65 61 74 75 72 65 49 63 6f 6e 5f 5f 5f 33 77 4c 48 36 7b 77 69 64 74 68 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 36 78 29 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 33 78 29 7d 5b 64 69 72 3d 72 74 6c 5d 20 2e 43 68 65 63 6b 6f 75 74 46 61 72 65 49 6e 6e 65 72 2d 6d 6f 64 75 6c 65 5f 5f 66 65 61 74 75 72 65 49 63 6f 6e 5f 5f 5f 33 77 4c 48 36 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 33 78 29 7d 2e 43 68 65 63 6b 6f 75 74 46 61 72 65 49 Data Ascii: ar(--bui_spacing_2x)}.CheckoutFareInner-module__featureIcon___3wLH6{width:var(--bui_spacing_6x);margin-right:var(--bui_spacing_3x)}[dir=rtl] .CheckoutFareInner-module__featureIcon___3wLH6{margin-right:unset;margin-left:var(--bui_spacing_3x)}.CheckoutFareI
2024-02-08 18:36:33 UTC	11802	IN	Data Raw: 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 33 78 29 3b 6d 61 78 2d 77 69 64 74 68 3a 33 31 30 70 78 7d 5b 64 61 74 61 2d 69 73 4d 6f 64 61 6c 3d 74 72 75 65 5d 20 2e 4c 69 73 74 41 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 43 61 72 64 2d 6d 6f 64 75 6c 65 5f 5f 69 6e 66 6f 5f 5f 5f 71 48 74 2d 53 7b 66 6c 65 78 3a 61 75 74 6f 7d 2e 4c 69 73 74 41 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 43 61 72 64 2d 6d 6f 64 75 6c 65 5f 5f 62 61 64 67 65 5f 5f 5f 71 59 55 5a 7a 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 7d 2e 4c 69 73 74 41 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 43 61 72 64 2d 6d 6f 64 75 6c 65 5f 5f 64 69 73 74 61 6e 63 65 5f 5f 5f 4a 31 70 71 62 7b 6d Data Ascii: padding-left:var(--bui_spacing_3x);max-width:310px}[data-isModal=true] .ListAccommodationCard-module__info___qHt-S{flex:auto}.ListAccommodationCard-module__badge___qYUZz{margin-bottom:var(--bui_spacing_2x)}.ListAccommodationCard-module__distance___J1pqb{m
2024-02-08 18:36:33 UTC	778	IN	Data Raw: 66 61 6d 69 6c 79 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 65 6d 70 68 61 73 69 7a 65 64 5f 32 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 29 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 66 6f 72 65 67 72 6f 75 6e 64 5f 61 6c 74 29 3b 6d 61 72 67 69 6e 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 2e 53 65 61 72 63 68 52 65 73 75 6c 74 73 2d 64 65 73 6b 74 6f 70 2d 6d 6f 64 75 6c 65 5f 5f 73 65 61 72 63 68 52 65 6d 6f 76 65 49 63 6f 6e 5f 5f 5f 52 77 62 39 78 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 2e 53 65 61 72 63 68 52 65 73 75 6c 74 73 2d 64 65 73 6b 74 6f 70 2d 6d 6f 64 75 6c 65 5f Data Ascii: family:var(--bui_font_emphasized_2_font-family);text-align:center;color:var(--bui_color_foreground_alt);margin:var(--bui_spacing_4x)}.SearchResults-desktop-module__searchRemoveIcon___Rwb9x{margin-bottom:var(--bui_spacing_4x)}.SearchResults-desktop-module_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
785	192.168.2.5	50641	18.64.236.114	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:33 UTC	564	OUT	GET /flights/web/static/js/screens-Search.f7031ba1.chunk.js HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:33 UTC	577	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 991736 Connection: close Date: Thu, 08 Feb 2024 15:05:48 GMT Last-Modified: Thu, 08 Feb 2024 14:27:12 GMT ETag: "5a95cd0457fbcc68bde1c995ef69d6df" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 349ae0102af9efb84ba18944b2446234.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL56-P1 X-Amz-Cf-Id: DvEpiK9glquNvZLLOCJVlZ-PtPkyhGrxK-3GO_wOH_4K88oEIRgnVw== Age: 12646 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:36:33 UTC	8949	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 73 63 72 65 65 6e 73 2d 53 65 61 72 63 68 2e 66 37 30 33 31 62 61 31 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 3d 73 65 6c 66 2e 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 32 38 33 34 33 5d 2c 7b 32 37 34 37 39 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 5a 3a 28 29 3d 3e 61 7d 29 3b 76 61 72 20 72 3d 6e 28 36 37 32 39 34 29 3b 63 6f 6e 73 74 20 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 Data Ascii: /! For license information please see screens-Search.f7031ba1.chunk.js.LICENSE.txt /(self.__LOADABLE_LOADED_CHUNKS__=self.__LOADABLE_LOADED_CHUNKS__\|\|[]).push([[28343],{27479:(e,t,n)=>{"use strict";n.d(t,{Z:()=>a});var r=n(67294);const a=function(){ret
2024-02-08 18:36:33 UTC	16384	IN	Data Raw: 34 20 2d 38 2e 37 37 20 56 20 34 20 43 20 31 35 2e 37 34 35 20 34 2e 34 31 32 20 31 35 2e 34 31 32 20 34 2e 37 34 35 20 31 35 20 34 2e 37 35 20 48 20 36 2e 35 20 43 20 36 2e 30 38 38 20 34 2e 37 35 35 20 35 2e 37 35 35 20 35 2e 30 38 38 20 35 2e 37 35 20 35 2e 35 20 56 20 31 35 20 61 20 30 2e 37 35 20 30 2e 37 35 20 30 20 30 20 31 20 2d 31 2e 35 20 30 20 56 20 35 2e 35 20 43 20 34 2e 32 35 20 34 2e 32 35 37 20 35 2e 32 35 37 20 33 2e 32 35 20 36 2e 35 20 33 2e 32 35 20 68 20 31 2e 37 35 20 76 20 2d 32 20 43 20 38 2e 32 35 20 30 2e 35 36 20 38 2e 38 31 20 30 20 39 2e 35 20 30 20 68 20 35 20 63 20 30 2e 36 39 20 30 20 31 2e 32 35 20 30 2e 35 36 20 31 2e 32 35 20 31 2e 32 35 20 7a 20 6d 20 2d 31 2e 35 20 32 20 56 20 31 2e 35 20 68 20 2d 34 2e 35 20 76 20 31 Data Ascii: 4 -8.77 V 4 C 15.745 4.412 15.412 4.745 15 4.75 H 6.5 C 6.088 4.755 5.755 5.088 5.75 5.5 V 15 a 0.75 0.75 0 0 1 -1.5 0 V 5.5 C 4.25 4.257 5.257 3.25 6.5 3.25 h 1.75 v -2 C 8.25 0.56 8.81 0 9.5 0 h 5 c 0.69 0 1.25 0.56 1.25 1.25 z m -1.5 2 V 1.5 h -4.5 v 1
2024-02-08 18:36:33 UTC	1514	IN	Data Raw: 20 31 2d 2e 34 33 37 2d 32 2e 36 33 38 20 32 2e 32 37 36 20 32 2e 32 37 36 20 30 20 30 20 31 20 33 2e 36 34 35 2d 2e 35 39 6c 2e 38 33 36 2e 38 33 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 31 2e 30 36 20 30 6c 2e 38 33 34 2d 2e 38 33 36 61 32 2e 32 37 36 20 32 2e 32 37 36 20 30 20 30 20 31 20 33 2e 32 31 39 20 33 2e 32 31 38 6c 2d 34 2e 30 34 32 20 34 2e 32 31 36 7a 6d 31 2e 30 38 33 20 31 2e 30 33 38 6c 34 2e 30 33 31 2d 34 2e 32 30 35 61 33 2e 37 37 20 33 2e 37 37 20 30 20 30 20 30 2d 2e 30 31 2d 35 2e 33 32 37 20 33 2e 37 37 36 20 33 2e 37 37 36 20 30 20 30 20 30 2d 35 2e 33 34 20 30 6c 2d 2e 38 33 35 2e 38 33 35 20 31 2e 30 35 39 2d 2e 30 30 32 2d 2e 38 33 35 2d 2e 38 33 61 33 2e 37 37 36 20 33 2e 37 37 36 20 30 20 30 20 30 2d 35 2e 33 33 38 20 35 2e Data Ascii: 1-.437-2.638 2.276 2.276 0 0 1 3.645-.59l.836.83a.75.75 0 0 0 1.06 0l.834-.836a2.276 2.276 0 0 1 3.219 3.218l-4.042 4.216zm1.083 1.038l4.031-4.205a3.77 3.77 0 0 0-.01-5.327 3.776 3.776 0 0 0-5.34 0l-.835.835 1.059-.002-.835-.83a3.776 3.776 0 0 0-5.338 5.
2024-02-08 18:36:33 UTC	16384	IN	Data Raw: 37 37 33 35 3a 28 65 2c 74 2c 6e 29 3d 3e 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 5a 3a 28 29 3d 3e 61 7d 29 3b 76 61 72 20 72 3d 6e 28 36 37 32 39 34 29 3b 63 6f 6e 73 74 20 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 76 67 22 2c 7b 78 6d 6c 6e 73 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 2c 76 69 65 77 42 6f 78 3a 22 30 20 30 20 32 34 20 32 34 22 7d 2c 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 32 30 2e 32 32 34 20 31 31 2e 33 33 39 41 38 2e 32 35 20 38 2e 32 35 20 30 20 30 20 31 20 34 2e 35 20 31 35 2e 34 34 61 2e 37 35 2e 37 35 20 30 20 30 20 30 2d 31 2e 33 36 34 2e 36 32 34 Data Ascii: 7735:(e,t,n)=>{"use strict";n.d(t,{Z:()=>a});var r=n(67294);const a=function(){return r.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},r.createElement("path",{d:"M20.224 11.339A8.25 8.25 0 0 1 4.5 15.44a.75.75 0 0 0-1.364.624
2024-02-08 18:36:33 UTC	10463	IN	Data Raw: 64 4f 66 4d 69 6e 75 74 65 3a 28 29 3d 3e 75 74 2c 65 6e 64 4f 66 4d 6f 6e 74 68 3a 28 29 3d 3e 46 65 2c 65 6e 64 4f 66 51 75 61 72 74 65 72 3a 28 29 3d 3e 64 74 2c 65 6e 64 4f 66 53 65 63 6f 6e 64 3a 28 29 3d 3e 66 74 2c 65 6e 64 4f 66 54 6f 64 61 79 3a 28 29 3d 3e 6d 74 2c 65 6e 64 4f 66 54 6f 6d 6f 72 72 6f 77 3a 28 29 3d 3e 68 74 2c 65 6e 64 4f 66 57 65 65 6b 3a 28 29 3d 3e 6c 74 2c 65 6e 64 4f 66 59 65 61 72 3a 28 29 3d 3e 74 74 2c 65 6e 64 4f 66 59 65 73 74 65 72 64 61 79 3a 28 29 3d 3e 70 74 2c 66 6f 72 6d 61 74 3a 28 29 3d 3e 75 6e 2c 66 6f 72 6d 61 74 44 69 73 74 61 6e 63 65 3a 28 29 3d 3e 5f 6e 2c 66 6f 72 6d 61 74 44 69 73 74 61 6e 63 65 53 74 72 69 63 74 3a 28 29 3d 3e 45 6e 2c 66 6f 72 6d 61 74 44 69 73 74 61 6e 63 65 54 6f 4e 6f 77 3a 28 29 Data Ascii: dOfMinute:()=>ut,endOfMonth:()=>Fe,endOfQuarter:()=>dt,endOfSecond:()=>ft,endOfToday:()=>mt,endOfTomorrow:()=>ht,endOfWeek:()=>lt,endOfYear:()=>tt,endOfYesterday:()=>pt,format:()=>un,formatDistance:()=>_n,formatDistanceStrict:()=>En,formatDistanceToNow:()
2024-02-08 18:36:33 UTC	8949	IN	Data Raw: 65 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 61 28 32 2c 61 72 67 75 6d 65 6e 74 73 29 2c 69 28 65 29 2e 67 65 74 54 69 6d 65 28 29 2d 69 28 74 29 2e 67 65 74 54 69 6d 65 28 29 7d 76 61 72 20 49 65 3d 7b 63 65 69 6c 3a 4d 61 74 68 2e 63 65 69 6c 2c 72 6f 75 6e 64 3a 4d 61 74 68 2e 72 6f 75 6e 64 2c 66 6c 6f 6f 72 3a 4d 61 74 68 2e 66 6c 6f 6f 72 2c 74 72 75 6e 63 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 3c 30 3f 4d 61 74 68 2e 63 65 69 6c 28 65 29 3a 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 7d 7d 2c 4d 65 3d 22 74 72 75 6e 63 22 3b 66 75 6e 63 74 69 6f 6e 20 44 65 28 65 29 7b 72 65 74 75 72 6e 20 65 3f 49 65 5b 65 5d 3a 49 65 5b 4d 65 5d 7d 66 75 6e 63 74 69 6f 6e 20 4f 65 28 65 2c 74 2c 6e 29 7b 61 28 32 2c 61 72 67 75 6d 65 6e 74 73 29 Data Ascii: e(e,t){return a(2,arguments),i(e).getTime()-i(t).getTime()}var Ie={ceil:Math.ceil,round:Math.round,floor:Math.floor,trunc:function(e){return e<0?Math.ceil(e):Math.floor(e)}},Me="trunc";function De(e){return e?Ie[e]:Ie[Me]}function Oe(e,t,n){a(2,arguments)
2024-02-08 18:36:33 UTC	16384	IN	Data Raw: 61 69 6e 73 44 61 74 65 29 26 26 76 6f 69 64 20 30 21 3d 3d 6f 3f 6f 3a 6e 75 6c 6c 3d 3d 3d 28 75 3d 66 2e 6c 6f 63 61 6c 65 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 75 7c 7c 6e 75 6c 6c 3d 3d 3d 28 64 3d 75 2e 6f 70 74 69 6f 6e 73 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 64 3f 76 6f 69 64 20 30 3a 64 2e 66 69 72 73 74 57 65 65 6b 43 6f 6e 74 61 69 6e 73 44 61 74 65 29 26 26 76 6f 69 64 20 30 21 3d 3d 6e 3f 6e 3a 31 29 2c 68 3d 43 74 28 65 2c 74 29 2c 70 3d 6e 65 77 20 44 61 74 65 28 30 29 3b 72 65 74 75 72 6e 20 70 2e 73 65 74 55 54 43 46 75 6c 6c 59 65 61 72 28 68 2c 30 2c 6d 29 2c 70 2e 73 65 74 55 54 43 48 6f 75 72 73 28 30 2c 30 2c 30 2c 30 29 2c 45 74 28 70 2c 74 29 7d 28 6e 2c 74 29 2e 67 65 74 54 69 6d 65 28 29 3b 72 65 74 75 72 6e 20 4d 61 74 68 2e 72 6f Data Ascii: ainsDate)&&void 0!==o?o:null===(u=f.locale)\|\|void 0===u\|\|null===(d=u.options)\|\|void 0===d?void 0:d.firstWeekContainsDate)&&void 0!==n?n:1),h=Ct(e,t),p=new Date(0);return p.setUTCFullYear(h,0,m),p.setUTCHours(0,0,0,0),Et(p,t)}(n,t).getTime();return Math.ro
2024-02-08 18:36:33 UTC	16384	IN	Data Raw: 75 6c 2f 69 2c 2f 5e 61 75 2f 69 2c 2f 5e 73 2f 69 2c 2f 5e 6f 2f 69 2c 2f 5e 6e 2f 69 2c 2f 5e 64 2f 69 5d 7d 2c 64 65 66 61 75 6c 74 50 61 72 73 65 57 69 64 74 68 3a 22 61 6e 79 22 7d 29 2c 64 61 79 3a 74 6e 28 7b 6d 61 74 63 68 50 61 74 74 65 72 6e 73 3a 7b 6e 61 72 72 6f 77 3a 2f 5e 5b 73 6d 74 77 66 5d 2f 69 2c 73 68 6f 72 74 3a 2f 5e 28 73 75 7c 6d 6f 7c 74 75 7c 77 65 7c 74 68 7c 66 72 7c 73 61 29 2f 69 2c 61 62 62 72 65 76 69 61 74 65 64 3a 2f 5e 28 73 75 6e 7c 6d 6f 6e 7c 74 75 65 7c 77 65 64 7c 74 68 75 7c 66 72 69 7c 73 61 74 29 2f 69 2c 77 69 64 65 3a 2f 5e 28 73 75 6e 64 61 79 7c 6d 6f 6e 64 61 79 7c 74 75 65 73 64 61 79 7c 77 65 64 6e 65 73 64 61 79 7c 74 68 75 72 73 64 61 79 7c 66 72 69 64 61 79 7c 73 61 74 75 72 64 61 79 29 2f 69 7d 2c 64 Data Ascii: ul/i,/^au/i,/^s/i,/^o/i,/^n/i,/^d/i]},defaultParseWidth:"any"}),day:tn({matchPatterns:{narrow:/^[smtwf]/i,short:/^(su\|mo\|tu\|we\|th\|fr\|sa)/i,abbreviated:/^(sun\|mon\|tue\|wed\|thu\|fri\|sat)/i,wide:/^(sunday\|monday\|tuesday\|wednesday\|thursday\|friday\|saturday)/i},d
2024-02-08 18:36:33 UTC	11977	IN	Data Raw: 75 6d 65 6e 74 73 29 3b 76 61 72 20 74 3d 69 28 65 2e 73 74 61 72 74 29 2c 6e 3d 69 28 65 2e 65 6e 64 29 3b 69 66 28 69 73 4e 61 4e 28 74 2e 67 65 74 54 69 6d 65 28 29 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 53 74 61 72 74 20 44 61 74 65 20 69 73 20 69 6e 76 61 6c 69 64 22 29 3b 69 66 28 69 73 4e 61 4e 28 6e 2e 67 65 74 54 69 6d 65 28 29 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 45 6e 64 20 44 61 74 65 20 69 73 20 69 6e 76 61 6c 69 64 22 29 3b 76 61 72 20 72 3d 7b 7d 3b 72 2e 79 65 61 72 73 3d 4d 61 74 68 2e 61 62 73 28 48 65 28 6e 2c 74 29 29 3b 76 61 72 20 6f 3d 57 28 6e 2c 74 29 2c 6c 3d 75 28 74 2c 7b 79 65 61 72 73 3a 6f 2a 72 2e 79 65 61 72 73 7d 29 3b 72 2e 6d 6f 6e 74 68 73 3d 4d 61 74 Data Ascii: uments);var t=i(e.start),n=i(e.end);if(isNaN(t.getTime()))throw new RangeError("Start Date is invalid");if(isNaN(n.getTime()))throw new RangeError("End Date is invalid");var r={};r.years=Math.abs(He(n,t));var o=W(n,t),l=u(t,{years:o*r.years});r.months=Mat
2024-02-08 18:36:33 UTC	16384	IN	Data Raw: 3a 72 65 74 75 72 6e 20 6e 61 28 6e 2e 6f 72 64 69 6e 61 6c 4e 75 6d 62 65 72 28 65 2c 7b 75 6e 69 74 3a 22 79 65 61 72 22 7d 29 2c 72 29 3b 64 65 66 61 75 6c 74 3a 72 65 74 75 72 6e 20 6e 61 28 69 61 28 74 2e 6c 65 6e 67 74 68 2c 65 29 2c 72 29 7d 7d 7d 2c 7b 6b 65 79 3a 22 76 61 6c 69 64 61 74 65 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 2e 69 73 54 77 6f 44 69 67 69 74 59 65 61 72 7c 7c 74 2e 79 65 61 72 3e 30 7d 7d 2c 7b 6b 65 79 3a 22 73 65 74 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 65 2e 67 65 74 55 54 43 46 75 6c 6c 59 65 61 72 28 29 3b 69 66 28 6e 2e 69 73 54 77 6f 44 69 67 69 74 59 65 61 72 29 7b 76 61 72 20 61 3d 63 61 28 6e 2e 79 65 61 72 2c 72 29 Data Ascii: :return na(n.ordinalNumber(e,{unit:"year"}),r);default:return na(ia(t.length,e),r)}}},{key:"validate",value:function(e,t){return t.isTwoDigitYear\|\|t.year>0}},{key:"set",value:function(e,t,n){var r=e.getUTCFullYear();if(n.isTwoDigitYear){var a=ca(n.year,r)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
786	192.168.2.5	50638	3.162.125.32	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:33 UTC	3352	OUT	GET /orca/chunk-metadata?chunk=95f0c6f5&mfe=b-web-shell-header-mfe&lang=en-us&namespace=cbMBXEQB HTTP/1.1 Host: accommodations.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json x-booking-et-serialized-state: EggNsz4B_SY1UmxSoj7ncG8VtNhkBKW-u1pbeB5xtLqkgIgWCRoMOUVwixu8ULIMWgxkCUUTpwak sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3W%2BNL4quFW42Tdgsr2lQmhkj%2Fk4mI%2BTrnhecMjFPG%2FDvcPMlrXQlThAlGgTjgpGFFCJGfzukHp6ArijaWBMwPVZP%2FesWLKFmsG86c0W8fSjSVGEzYHJFRgb5uOXqsIPNgXjkQJaikxJpyece9f8XeEAvu0lzqDd7nY%3D
2024-02-08 18:36:33 UTC	651	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 192 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:33 GMT x-frame-options: SAMEORIGIN x-content-type-options: nosniff access-control-allow-origin: https://www.booking.com vary: Origin, Accept-Encoding access-control-allow-credentials: true referrer-policy: no-referrer strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 e28efd1a65ea5d8d42e5dac75c735524.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P3 X-Amz-Cf-Id: BEsgARag7bAweepj9kuYR6_OScf6_WIi53Gmb1QAO2dmpKkdMHQeaw==
2024-02-08 18:36:33 UTC	192	IN	Data Raw: 7b 22 63 68 75 6e 6b 73 22 3a 5b 22 39 35 66 30 63 36 66 35 22 5d 2c 22 65 78 70 65 72 69 6d 65 6e 74 54 61 67 73 22 3a 7b 7d 2c 22 66 65 61 74 75 72 65 4e 61 6d 65 73 22 3a 7b 7d 2c 22 73 65 6f 45 78 70 65 72 69 6d 65 6e 74 54 61 67 73 22 3a 7b 7d 2c 22 63 6f 70 79 54 61 67 73 22 3a 7b 22 61 31 31 79 5f 61 72 69 61 5f 6c 61 62 65 6c 5f 63 61 72 6f 75 73 65 6c 5f 6e 65 78 74 5f 70 72 65 76 69 6f 75 73 22 3a 22 4e 65 78 74 22 2c 22 61 31 31 79 5f 61 72 69 61 5f 6c 61 62 65 6c 5f 63 61 72 6f 75 73 65 6c 5f 70 72 65 76 69 6f 75 73 22 3a 22 50 72 65 76 69 6f 75 73 22 7d 7d Data Ascii: {"chunks":["95f0c6f5"],"experimentTags":{},"featureNames":{},"seoExperimentTags":{},"copyTags":{"a11y_aria_label_carousel_next_previous":"Next","a11y_aria_label_carousel_previous":"Previous"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
787	192.168.2.5	50639	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:33 UTC	4037	OUT	GET /attractions/api/header?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&lang=en-us&aid=304142&product=flights HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A07+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAfk6BVJUjAAAA:WDfXg2ry+HvbnxTztLnepFvhf3dpX4SdQfM4GczRrcPw6MWAZH8MErn+af2Y9SvAts7ySjM/T9nCQWaxTWJ+ECSRYADCgGFp6g8nwqAAp4uZuesbnPNMB9VWMMTR/6OqpiFI1lm6c8HTX0et8uTZTDvEovUpe/ZJPj+EvnZwpL1hdq9NKhFzFZb6nk1kcyw+S5Gmb0WW/JMfQvkBUX6FX8nHd2pkcvntEKFlkhvMXyaXZ+ocI5s4XxhjbVLG6yziJfNgBxF+; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3W%2BNL4quFW42Tdgsr2lQmhkj%2Fk4mI%2BTrnhecMjFPG%2FDvcPMlrXQlThAlGgTjgpGFFCJGfzukHp6ArijaWBMwPVZP%2FesWLKFmsG86c0W8fSjSVGEzYHJFRgb5uOXqsIPNgXjkQJaikxJpyece9f8XeEAvu0lzqDd7nY%3D
2024-02-08 18:36:33 UTC	1485	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:33 GMT vary: Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCoRU%2FMYfybDNcYUtImwTKmofwPZ3tBFno2lg7lDqS0CmNf0xTT1xT1c3zXx6qKnJczWXmoFQWrJGif%2FdMUlZOJCt6Nk2US7TY70cx%2FmgqgVnPv9YUr2CguMGRLRSO%2F9x9cyiRrsMNHPS4dkDIgVu6rQcMTXDfpfcd4%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:33 GMT; Secure; HTTPOnly; SameSite=None x-content-options: nosniff x-frame-options: SAMEORIGIN strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: default-src 'self'; connect-src 'self' .booking.com: wss://.booking.com: cdn.cookielaw.org .google-analytics.com .onetrust.com; script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com; img-src * data:; style-src 'self' 'unsafe-inline' .booking.com .bstatic.com .googleapis.com; font-src 'self' .bstatic.com fonts.gstatic.com; frame-src 'self' *.booking.com; object-src 'none'; report-to default x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 7699e4f17e72e42cba0c247c650005d2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Q5Q_0Dt88tNPS-lfqxTisJ03X1u8vMzdnueUmUz83fDg0xgNYoimDA==
2024-02-08 18:36:33 UTC	14899	IN	Data Raw: 34 31 37 30 0d 0a 7b 22 68 65 61 64 65 72 22 3a 7b 22 63 75 72 72 65 6e 63 69 65 73 22 3a 7b 22 6c 69 73 74 22 3a 5b 22 68 6f 74 65 6c 5f 63 75 72 72 65 6e 63 79 22 2c 22 41 52 53 22 2c 22 41 55 44 22 2c 22 41 5a 4e 22 2c 22 42 48 44 22 2c 22 42 52 4c 22 2c 22 42 47 4e 22 2c 22 58 4f 46 22 2c 22 43 41 44 22 2c 22 43 4c 50 22 2c 22 43 4e 59 22 2c 22 43 4f 50 22 2c 22 43 5a 4b 22 2c 22 44 4b 4b 22 2c 22 45 47 50 22 2c 22 45 55 52 22 2c 22 46 4a 44 22 2c 22 47 45 4c 22 2c 22 48 4b 44 22 2c 22 48 55 46 22 2c 22 49 4e 52 22 2c 22 49 44 52 22 2c 22 4a 50 59 22 2c 22 4a 4f 44 22 2c 22 4b 5a 54 22 2c 22 4b 52 57 22 2c 22 4b 57 44 22 2c 22 4d 59 52 22 2c 22 4d 58 4e 22 2c 22 4d 44 4c 22 2c 22 4e 41 44 22 2c 22 49 4c 53 22 2c 22 54 57 44 22 2c 22 4e 5a 44 22 2c 22 Data Ascii: 4170{"header":{"currencies":{"list":["hotel_currency","ARS","AUD","AZN","BHD","BRL","BGN","XOF","CAD","CLP","CNY","COP","CZK","DKK","EGP","EUR","FJD","GEL","HKD","HUF","INR","IDR","JPY","JOD","KZT","KRW","KWD","MYR","MXN","MDL","NAD","ILS","TWD","NZD","
2024-02-08 18:36:33 UTC	1861	IN	Data Raw: 42 59 6a 47 64 76 58 6e 44 79 22 2c 22 69 63 6f 6e 5f 6b 65 79 22 3a 22 73 69 67 6e 5f 6f 75 74 22 2c 22 6c 61 62 65 6c 22 3a 22 53 69 67 6e 20 6f 75 74 22 2c 22 66 6f 72 6d 5f 61 63 74 69 6f 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 73 73 6f 2f 6c 6f 67 6f 75 74 22 7d 2c 22 73 69 67 6e 5f 69 6e 22 3a 7b 22 68 72 65 66 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 61 74 74 72 61 63 74 69 6f 6e 73 2f 6c 6f 67 69 6e 2e 68 74 6d 6c 3f 61 69 64 3d 33 30 34 31 34 32 26 6c 61 62 65 6c 3d 67 65 6e 31 37 33 6e 72 2d 31 46 43 41 45 6f 67 67 49 34 36 41 64 49 4d 31 67 45 61 49 38 43 69 41 45 42 6d 41 45 78 75 41 45 58 79 41 45 4d 32 41 45 42 36 41 45 42 2d 41 45 43 69 41 49 42 Data Ascii: BYjGdvXnDy","icon_key":"sign_out","label":"Sign out","form_action":"https://account.booking.com/sso/logout"},"sign_in":{"href":"https://www.booking.com/attractions/login.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIB
2024-02-08 18:36:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
788	192.168.2.5	50642	99.84.208.90	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:33 UTC	686	OUT	OPTIONS /track/internal-events HTTP/1.1 Host: flights.booking.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type,x-booking-affiliate-id,x-booking-flights-client-hints,x-booking-label,x-booking-parent-request-id,x-booking-request-tree-id,x-booking-trace-meta,x-requested-from Origin: https://www.booking.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:33 UTC	941	IN	HTTP/1.1 204 No Content Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:33 GMT x-request-id: fbd3ce90-c6b0-11ee-ae70-f93edd8aa25e access-control-allow-origin: https://www.booking.com vary: Origin, Access-Control-Request-Headers access-control-allow-credentials: true access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-headers: content-type,x-booking-affiliate-id,x-booking-flights-client-hints,x-booking-label,x-booking-parent-request-id,x-booking-request-tree-id,x-booking-trace-meta,x-requested-from referrer-policy: no-referrer x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 f0f1092b2ad1f0e573a4fcbefe4fb620.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD79-C1 X-Amz-Cf-Id: -LLpGNdKpCl4i4Cohw2lwGyxOoBw9LdFfUEJAJ4J2GpG2g85SgdNqw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
789	192.168.2.5	50645	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:33 UTC	448	OUT	GET /xdata/images/city/square210/977387.jpg?k=07aeb102ff72c498cfb8c4b92382aa6ada5fd4e84ad283aa8b387b072c9fd7d3&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:33 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Mon, 22 Jan 2024 22:05:09 GMT ETag: "6842881bdf780fcf108886267e6f0c67a3b48f1f" Content-Language: 13559 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 f588325f7617672d954c4267c8bee1ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 75sKStunvnChYSrB7Rw-BaTztJTPvK5s797tkwbVKO3NE1gVbnzUXQ== Age: 1456284
2024-02-08 18:36:33 UTC	13567	IN	Data Raw: 33 34 66 37 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 00 d2 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 34f7JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:36:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
790	192.168.2.5	50643	99.84.208.90	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:33 UTC	686	OUT	OPTIONS /track/internal-events HTTP/1.1 Host: flights.booking.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type,x-booking-affiliate-id,x-booking-flights-client-hints,x-booking-label,x-booking-parent-request-id,x-booking-request-tree-id,x-booking-trace-meta,x-requested-from Origin: https://www.booking.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:33 UTC	941	IN	HTTP/1.1 204 No Content Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:33 GMT x-request-id: fbd86270-c6b0-11ee-a589-ab3989907d23 access-control-allow-origin: https://www.booking.com vary: Origin, Access-Control-Request-Headers access-control-allow-credentials: true access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-headers: content-type,x-booking-affiliate-id,x-booking-flights-client-hints,x-booking-label,x-booking-parent-request-id,x-booking-request-tree-id,x-booking-trace-meta,x-requested-from referrer-policy: no-referrer x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 68bb623bd1a01bfb6607a40643084c92.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD79-C1 X-Amz-Cf-Id: UnAtOTVbnvcWg95F_PY5Pu80KlCSSRuFp486WiDLac6uNsEokwP1gg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
791	192.168.2.5	50647	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:33 UTC	448	OUT	GET /xdata/images/city/square210/977415.jpg?k=fa67e6f0e70c09f18c4181bef46164f0406fbd367cad543314a3c748bfc7e411&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:33 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Server: nginx Date: Tue, 06 Feb 2024 12:35:13 GMT ETag: "3f29f6d5efa98e9b0b1e32dc5cca3045dbce1ca2" Content-Language: 10198 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 7db19e3781edb64ef4f7023d2c25783e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: b33IQeLPXZEdzTWQTvKQhzW6apmqmBaMSw5l3URrSirAgwCEc2URQg== Age: 194480
2024-02-08 18:36:33 UTC	10206	IN	Data Raw: 32 37 64 36 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 00 d2 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 Data Ascii: 27d6JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q
2024-02-08 18:36:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
792	192.168.2.5	50646	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:33 UTC	407	OUT	GET /design-assets/assets/v3.99.1/illustrations-traveller/TicketsUsp.png HTTP/1.1 Host: t-cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:33 UTC	506	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 3759 Connection: close Date: Thu, 08 Feb 2024 18:36:32 GMT Last-Modified: Tue, 10 Oct 2023 12:25:25 GMT ETag: "4f8be30173d60369e61612204c1a9013" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 c625b1bdde545acdeb26c9f6ad3a8c6e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: jbyE8bNwWga8lZdFWeWpEoI6bTsfb4DC5Epb9uU9EZ1apcSnoFJeRg== Age: 2 Vary: Origin
2024-02-08 18:36:33 UTC	3759	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 78 00 00 00 78 08 03 00 00 00 0e ba c6 e0 00 00 00 f3 50 4c 54 45 4c 69 71 fa a3 56 ff e1 9a fc bc 6e eb e2 d2 fd cd 7c e8 f1 f8 eb f3 f8 ef ea da ea f2 f8 fe de 95 ff e2 9c fb de 9f f8 8e 43 f8 91 44 e3 ec f0 d9 ea f7 ff e1 9a f9 92 46 f8 8e 42 f9 93 41 db e9 f6 ff e3 9d f8 90 46 df ed f7 e9 f2 f8 db e8 f2 fc ba 18 fc b9 5b 72 ac e9 eb f3 f9 ea f2 f8 e6 f0 f8 e3 ef f8 ff e2 9d ff df 99 ff e3 9e e1 ee f8 dd ec f7 e8 f1 f8 f8 91 47 f8 92 48 db eb f7 d8 e9 f7 d4 e7 f6 eb f3 f7 fe d6 8f ff db 94 cd e3 f6 fe d1 89 ee f5 f8 92 c0 f0 f8 8e 41 f8 88 37 c1 db f4 f7 82 2c ab cf f2 a0 c9 f1 0b 73 e4 f6 7a 20 b4 d4 f3 6c a9 eb fe cc 69 f8 e3 b1 dc e9 ef fe c8 58 fe c5 45 05 70 e3 2e 87 e7 fd c0 2e fc bd 1d 47 Data Ascii: PNGIHDRxxPLTELiqVn\|CDFBAF[rGHA7,sz liXEp..G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
793	192.168.2.5	50648	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:33 UTC	448	OUT	GET /xdata/images/city/square210/977345.jpg?k=898a2e6c68a765bdc18cc57be5c78b3e1f5b825c4d3167e7a0860c4c988a1af1&o= HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:33 UTC	542	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 6218 Connection: close Server: nginx Date: Tue, 06 Feb 2024 00:36:01 GMT ETag: "c4123ef9a3176c8df7b35723adb04f2c968b18eb" Content-Language: 6218 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 7eeed291abf48890d3f36565208941a8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Zr22srw-C0pA4bPK2M1HZBc82RVBRp9ttTM9KhcgNgJwSWPN1DzYuw== Age: 237632
2024-02-08 18:36:33 UTC	6218	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 d2 00 d2 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
794	192.168.2.5	50649	104.18.32.137	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:33 UTC	380	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:33 UTC	249	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:36:33 GMT Content-Type: text/javascript Content-Length: 79 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8525fa96ac8e5080-ATL
2024-02-08 18:36:33 UTC	79	IN	Data Raw: 6a 73 6f 6e 46 65 65 64 28 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 47 41 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 47 65 6f 72 67 69 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d 29 3b Data Ascii: jsonFeed({"country":"US","state":"GA","stateName":"Georgia","continent":"NA"});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
795	192.168.2.5	50650	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:33 UTC	3888	OUT	GET /js_tracking?ref_action=&ver=2&stype=1&lang=en-us&pid=feba38c8c78949209e6dc34689f0c290&ete=&etg=&etcg=&ets=YTBUIHOdVMYCMTdXSbDbFCeVO\|1,YTBUIHOdVMYCMTdXSbDbFCeVO\|3,YTBUIHOdVMYCMTdXSbDbFCeVO\|7&etgwv= HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAfk6BVJUjAAAA:WDfXg2ry+HvbnxTztLnepFvhf3dpX4SdQfM4GczRrcPw6MWAZH8MErn+af2Y9SvAts7ySjM/T9nCQWaxTWJ+ECSRYADCgGFp6g8nwqAAp4uZuesbnPNMB9VWMMTR/6OqpiFI1lm6c8HTX0et8uTZTDvEovUpe/ZJPj+EvnZwpL1hdq9NKhFzFZb6nk1kcyw+S5Gmb0WW/JMfQvkBUX6FX8nHd2pkcvntEKFlkhvMXyaXZ+ocI5s4XxhjbVLG6yziJfNgBxF+; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3W%2BNL4quFW42Tdgsr2lQmhkj%2Fk4mI%2BTrnhecMjFPG%2FDvcPMlrXQlThAlGgTjgpGFFCJGfzukHp6ArijaWBMwPVZP%2FesWLKFmsG86c0W8fSjSVGEzYHJFRgb5uOXqsIPNgXjkQJaikxJpyece9f8XeEAvu0lzqDd7nY%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false
2024-02-08 18:36:33 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:33 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=920082d882100153&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejJTQjQJiF7FzN9D-5-LufMbudN460Wfbeg x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 a53ebc5c4d12bc9682b9c11ea18dccbe.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: B1mZBUUnHjQtfq6Ng6VhXPgEFLNKgbfWbTK5JXE5CJmzm0ML3yw6sQ==
2024-02-08 18:36:33 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
796	192.168.2.5	50651	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:33 UTC	717	OUT	POST /p HTTP/1.1 Host: tr6.snapchat.com Connection: keep-alive Content-Length: 890 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:33 UTC	890	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 64 37 33 36 31 61 34 2d 63 63 63 66 2d 34 30 62 39 2d 62 63 31 31 2d 36 36 61 32 35 38 35 32 32 35 33 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 37 63 33 30 66 39 34 64 2d 36 30 32 38 2d 34 32 63 61 2d 61 38 31 31 2d 36 30 65 66 34 31 38 33 66 61 39 33 22 2c 22 73 73 22 3a 22 31 35 65 30 61 36 32 31 2d 31 31 34 34 2d 34 38 35 64 2d 39 30 31 62 2d 30 39 62 62 36 33 38 64 32 39 33 36 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"fd7361a4-cccf-40b9-bc11-66a258522530","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"7c30f94d-6028-42ca-a811-60ef4183fa93","ss":"15e0a621-1144-485d-901b-09bb638d2936","bg":true,"s
2024-02-08 18:36:33 UTC	388	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:33 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: clear Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
797	192.168.2.5	50652	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:33 UTC	718	OUT	POST /p HTTP/1.1 Host: tr6.snapchat.com Connection: keep-alive Content-Length: 1094 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:33 UTC	1094	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 66 36 39 37 39 39 62 31 2d 62 32 62 32 2d 34 30 66 38 2d 38 65 36 66 2d 32 38 30 39 62 39 63 36 66 31 61 30 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 30 32 61 39 62 65 33 31 2d 32 33 66 33 2d 34 63 62 32 2d 39 65 30 35 2d 30 30 62 35 32 37 30 62 35 65 64 62 22 2c 22 73 73 22 3a 22 30 32 34 37 38 38 37 34 2d 61 32 37 37 2d 34 36 35 63 2d 62 39 65 37 2d 63 65 32 34 31 32 32 33 32 65 34 66 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"f69799b1-b2b2-40f8-8e6f-2809b9c6f1a0","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"02a9be31-23f3-4cb2-9e05-00b5270b5edb","ss":"02478874-a277-465c-b9e7-ce2412232e4f","bg":true,"s
2024-02-08 18:36:33 UTC	388	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:33 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: clear Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
798	192.168.2.5	50653	35.190.43.134	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:33 UTC	717	OUT	POST /p HTTP/1.1 Host: tr6.snapchat.com Connection: keep-alive Content-Length: 900 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sc_at=v2\|H4sIAAAAAAAAAAXBiQ0AIAgDwIlIKGJax/FhC4b37upiryeLXbCsmCbPshPwR1/EUDfoTHCk2j8qpvAUMgAAAA==
2024-02-08 18:36:33 UTC	900	OUT	Data Raw: 7b 22 63 74 78 22 3a 7b 22 62 74 22 3a 22 31 64 35 33 63 33 38 37 22 2c 22 63 31 22 3a 22 65 37 64 66 64 38 39 39 2d 36 61 32 32 2d 34 65 35 63 2d 38 61 39 61 2d 36 65 38 33 64 34 38 61 65 63 38 65 22 2c 22 6c 63 22 3a 22 65 32 63 65 64 30 36 34 2d 33 31 34 64 2d 34 63 62 63 2d 61 61 37 61 2d 35 62 31 66 38 64 36 61 61 34 39 34 22 2c 22 6c 73 22 3a 22 37 35 30 32 32 64 34 64 2d 61 65 35 30 2d 34 61 30 32 2d 38 61 62 31 2d 64 33 64 37 65 30 36 39 35 66 39 65 22 2c 22 72 22 3a 22 30 64 30 31 32 31 36 33 2d 39 30 39 32 2d 34 37 37 33 2d 61 64 30 34 2d 38 66 35 38 36 37 30 65 36 62 34 39 22 2c 22 73 73 22 3a 22 32 32 34 65 39 64 61 32 2d 33 65 62 65 2d 34 64 65 30 2d 39 34 62 61 2d 30 64 35 64 32 32 63 39 35 62 37 66 22 2c 22 62 67 22 3a 74 72 75 65 2c 22 73 Data Ascii: {"ctx":{"bt":"1d53c387","c1":"e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e","lc":"e2ced064-314d-4cbc-aa7a-5b1f8d6aa494","ls":"75022d4d-ae50-4a02-8ab1-d3d7e0695f9e","r":"0d012163-9092-4773-ad04-8f58670e6b49","ss":"224e9da2-3ebe-4de0-94ba-0d5d22c95b7f","bg":true,"s
2024-02-08 18:36:33 UTC	388	IN	HTTP/1.1 200 OK date: Thu, 08 Feb 2024 18:36:33 GMT strict-transport-security: max-age=31536000; includeSubDomains; preload strict-transport-security: max-age=31536000; includeSubDomains Content-Length: 0 x-envoy-upstream-service-time: 0 server: API Gateway alt-svc: clear Via: 1.1 google, 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
799	192.168.2.5	50656	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:33 UTC	448	OUT	GET /xdata/images/city/square100/977415.jpg?k=fa67e6f0e70c09f18c4181bef46164f0406fbd367cad543314a3c748bfc7e411&o= HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:33 UTC	542	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 3170 Connection: close Server: nginx Date: Tue, 30 Jan 2024 16:40:54 GMT ETag: "2e755c6758fe186a583471e02adaf64522665696" Content-Language: 3170 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 d125bf8405e840aa51a88ae3d8d91fb2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: JNDFUkp94nrbOBeWJlHuNQSBmBqbwVLB3_h4X6SsqD0UrFJH5yTeCQ== Age: 784539
2024-02-08 18:36:33 UTC	3170	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 64 00 64 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222dd"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
800	192.168.2.5	50655	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:33 UTC	448	OUT	GET /xdata/images/city/square100/977387.jpg?k=07aeb102ff72c498cfb8c4b92382aa6ada5fd4e84ad283aa8b387b072c9fd7d3&o= HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:33 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 3971 Connection: close Server: nginx Date: Fri, 26 Jan 2024 17:53:58 GMT ETag: "ffe47bb938cd555121e09d4c987d2b389b470457" Content-Language: 3971 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 7db19e3781edb64ef4f7023d2c25783e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 3Fp_F7GJIiBoxPvpoN0QLZ4E1rxvo5YG1sSAqeo2V4FclmqKPyJWaA== Age: 1125755
2024-02-08 18:36:33 UTC	3971	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 64 00 64 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222dd"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
801	192.168.2.5	50654	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:33 UTC	448	OUT	GET /xdata/images/city/square100/977408.jpg?k=125215335ffab346e954ff91ddbf6e4d2f15812d3e3a51b654ccd29705cce852&o= HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:33 UTC	542	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 4271 Connection: close Server: nginx Date: Sun, 04 Feb 2024 21:13:32 GMT ETag: "5534d822f4d018c46247fc29e2c68767355a316e" Content-Language: 4271 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 4a9f56098c7d51e12b8d2ac77b6f1bcc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: tQ30NcxGgq8CbHRYieqOZpW6PGndGRRzJekcJPZ6OcpT-St9pQd81Q== Age: 336181
2024-02-08 18:36:33 UTC	4271	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 64 00 64 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222dd"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
802	192.168.2.5	50657	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:33 UTC	448	OUT	GET /xdata/images/city/square100/977345.jpg?k=898a2e6c68a765bdc18cc57be5c78b3e1f5b825c4d3167e7a0860c4c988a1af1&o= HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:33 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 2224 Connection: close Server: nginx Date: Sat, 20 Jan 2024 16:58:47 GMT ETag: "03b52ca7dff6757dfce97903a2c1f7e8849cdf07" Content-Language: 2224 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 8415794d557292780ff382a8c5bd6058.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: CTQjvE-Ncl1qcJmaTq5bNoohLKwtKDyX-kSiQrXmSwYqCfJYTNCGFA== Age: 1647466
2024-02-08 18:36:33 UTC	2224	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 64 00 64 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222dd"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
803	192.168.2.5	50658	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:33 UTC	448	OUT	GET /xdata/images/city/square100/690408.jpg?k=f59731e733077b90bc716596e05cfd0f85a2582341cc25c17b26ee2a755d7b55&o= HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:33 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 3298 Connection: close Server: nginx Date: Mon, 22 Jan 2024 21:35:20 GMT ETag: "9511c8a2db9c6e79fc7139c58f571d2cd4f308df" Content-Language: 3298 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 f4c38e024a95b76a27c9f3dc9ff2eda6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: XDiZBZRBud5r2YMcWGB1rU3mlSFoRCK2B1D-fd1QLIheIOu26wszWw== Age: 1458073
2024-02-08 18:36:33 UTC	3298	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 64 00 64 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222dd"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
804	192.168.2.5	50659	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:33 UTC	448	OUT	GET /xdata/images/city/square100/976905.jpg?k=5a3ac9e6ec03eb39b872674694fc81d05643a1cc7df66b2e93d0de4bf21801d7&o= HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:33 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 2433 Connection: close Server: nginx Date: Tue, 16 Jan 2024 23:44:48 GMT ETag: "0aef82d62a869b634b57d966e67df199df994f35" Content-Language: 2433 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 e268ddb03ed9480c5c602c27323a81ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: DHLFOQKbN_saqInGidY7SD64_0Xyp-1YVw5eJi7jnPXLFHrmxh9vBA== Age: 1968705
2024-02-08 18:36:33 UTC	2433	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 64 00 64 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222dd"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
805	192.168.2.5	50661	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:33 UTC	3701	OUT	GET /js_errors HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAfk6BVJUjAAAA:WDfXg2ry+HvbnxTztLnepFvhf3dpX4SdQfM4GczRrcPw6MWAZH8MErn+af2Y9SvAts7ySjM/T9nCQWaxTWJ+ECSRYADCgGFp6g8nwqAAp4uZuesbnPNMB9VWMMTR/6OqpiFI1lm6c8HTX0et8uTZTDvEovUpe/ZJPj+EvnZwpL1hdq9NKhFzFZb6nk1kcyw+S5Gmb0WW/JMfQvkBUX6FX8nHd2pkcvntEKFlkhvMXyaXZ+ocI5s4XxhjbVLG6yziJfNgBxF+; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3W%2BNL4quFW42Tdgsr2lQmhkj%2Fk4mI%2BTrnhecMjFPG%2FDvcPMlrXQlThAlGgTjgpGFFCJGfzukHp6ArijaWBMwPVZP%2FesWLKFmsG86c0W8fSjSVGEzYHJFRgb5uOXqsIPNgXjkQJaikxJpyece9f8XeEAvu0lzqDd7nY%3D; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false
2024-02-08 18:36:34 UTC	677	IN	HTTP/1.1 400 Bad Request Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:33 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=10a482d8078f0016&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpYSYFwzrjdSjJSSZSECQ45RgUbLXvUe5q x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 309e9e958e8d35f7e17ae8ac267b7dea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: -xtTdPV4Frz2-mHPMlIkeYjrPZLI04x5JgSjNyaX43veahW0feouKQ==
2024-02-08 18:36:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
806	192.168.2.5	50660	99.84.208.90	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:33 UTC	689	OUT	OPTIONS /track/et HTTP/1.1 Host: flights.booking.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type,x-booking-affiliate-id,x-booking-flights-client-hints,x-booking-label,x-booking-parent-request-id,x-booking-request-tree-id,x-booking-trace-meta,x-requested-from,x-soylent-email Origin: https://www.booking.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:34 UTC	957	IN	HTTP/1.1 204 No Content Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:34 GMT x-request-id: fc05db10-c6b0-11ee-ae83-458d2da7eaae access-control-allow-origin: https://www.booking.com vary: Origin, Access-Control-Request-Headers access-control-allow-credentials: true access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-headers: content-type,x-booking-affiliate-id,x-booking-flights-client-hints,x-booking-label,x-booking-parent-request-id,x-booking-request-tree-id,x-booking-trace-meta,x-requested-from,x-soylent-email referrer-policy: no-referrer x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 426461ac6e9a3bd7fa011ad672ee0062.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD79-C1 X-Amz-Cf-Id: nSF_kqfnmvUTJMvgcoKRdpFw698JRhm1ONDk-x7ZZXQ-fFH4MQwbfA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
807	192.168.2.5	50662	3.162.125.41	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:33 UTC	3062	OUT	GET /orca/chunk-metadata?chunk=95f0c6f5&mfe=b-web-shell-header-mfe&lang=en-us&namespace=cbMBXEQB HTTP/1.1 Host: accommodations.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbbmD9q%2B5pe3W%2BNL4quFW42Tdgsr2lQmhkj%2Fk4mI%2BTrnhecMjFPG%2FDvcPMlrXQlThAlGgTjgpGFFCJGfzukHp6ArijaWBMwPVZP%2FesWLKFmsG86c0W8fSjSVGEzYHJFRgb5uOXqsIPNgXjkQJaikxJpyece9f8XeEAvu0lzqDd7nY%3D
2024-02-08 18:36:34 UTC	549	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 192 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:34 GMT x-frame-options: SAMEORIGIN x-content-type-options: nosniff referrer-policy: no-referrer vary: Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 ff2d6deff1b50282a21f4b199088c76e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD61-P3 X-Amz-Cf-Id: FPRq7bLw4fNr94WHHlR72WhMmsxhRBaPez6z3vpsA2NLyFaNv6GS2A==
2024-02-08 18:36:34 UTC	192	IN	Data Raw: 7b 22 63 68 75 6e 6b 73 22 3a 5b 22 39 35 66 30 63 36 66 35 22 5d 2c 22 65 78 70 65 72 69 6d 65 6e 74 54 61 67 73 22 3a 7b 7d 2c 22 66 65 61 74 75 72 65 4e 61 6d 65 73 22 3a 7b 7d 2c 22 73 65 6f 45 78 70 65 72 69 6d 65 6e 74 54 61 67 73 22 3a 7b 7d 2c 22 63 6f 70 79 54 61 67 73 22 3a 7b 22 61 31 31 79 5f 61 72 69 61 5f 6c 61 62 65 6c 5f 63 61 72 6f 75 73 65 6c 5f 6e 65 78 74 5f 70 72 65 76 69 6f 75 73 22 3a 22 4e 65 78 74 22 2c 22 61 31 31 79 5f 61 72 69 61 5f 6c 61 62 65 6c 5f 63 61 72 6f 75 73 65 6c 5f 70 72 65 76 69 6f 75 73 22 3a 22 50 72 65 76 69 6f 75 73 22 7d 7d Data Ascii: {"chunks":["95f0c6f5"],"experimentTags":{},"featureNames":{},"seoExperimentTags":{},"copyTags":{"a11y_aria_label_carousel_next_previous":"Next","a11y_aria_label_carousel_previous":"Previous"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
808	192.168.2.5	50663	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:33 UTC	3896	OUT	GET /attractions/api/header?label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&lang=en-us&aid=304142&product=flights HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAfk6BVJUjAAAA:WDfXg2ry+HvbnxTztLnepFvhf3dpX4SdQfM4GczRrcPw6MWAZH8MErn+af2Y9SvAts7ySjM/T9nCQWaxTWJ+ECSRYADCgGFp6g8nwqAAp4uZuesbnPNMB9VWMMTR/6OqpiFI1lm6c8HTX0et8uTZTDvEovUpe/ZJPj+EvnZwpL1hdq9NKhFzFZb6nk1kcyw+S5Gmb0WW/JMfQvkBUX6FX8nHd2pkcvntEKFlkhvMXyaXZ+ocI5s4XxhjbVLG6yziJfNgBxF+; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCoRU%2FMYfybDNcYUtImwTKmofwPZ3tBFno2lg7lDqS0CmNf0xTT1xT1c3zXx6qKnJczWXmoFQWrJGif%2FdMUlZOJCt6Nk2US7TY70cx%2FmgqgVnPv9YUr2CguMGRLRSO%2F9x9cyiRrsMNHPS4dkDIgVu6rQcMTXDfpfcd4%3D
2024-02-08 18:36:34 UTC	1499	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:34 GMT vary: Accept-Encoding set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBJoTYc%2FGcpLXBKXbYOyXI%2F8wXqW%2FpslxpYGBLRqkm5PB2Uc61PgHfoMxAsqHhj0KEfCaXiT2YCylAFh5%2FONX%2FvWgiYfjJrcEkFXmxKGrMJFRX%2Fmlnxb%2BnrdN6TJBl%2Fg%2FBX%2BNRLe4BDP1oP%2FjIfk11HgOTmin4aDlQI%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:34 GMT; Secure; HTTPOnly; SameSite=None x-content-options: nosniff x-frame-options: SAMEORIGIN strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: default-src 'self'; connect-src 'self' .booking.com: wss://.booking.com: cdn.cookielaw.org .google-analytics.com .onetrust.com; script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com; img-src * data:; style-src 'self' 'unsafe-inline' .booking.com .bstatic.com .googleapis.com; font-src 'self' .bstatic.com fonts.gstatic.com; frame-src 'self' *.booking.com; object-src 'none'; report-to default x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 f4c38e024a95b76a27c9f3dc9ff2eda6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: xzIv013mbsFo_RKw9TW6Y-ZHDlu5mZILfXwMH9sxrlM5ZFOTUIri-g==
2024-02-08 18:36:34 UTC	14885	IN	Data Raw: 34 31 37 30 0d 0a 7b 22 68 65 61 64 65 72 22 3a 7b 22 70 72 6f 64 75 63 74 73 22 3a 7b 22 73 65 6c 65 63 74 65 64 22 3a 22 66 6c 69 67 68 74 73 22 2c 22 6c 69 73 74 22 3a 5b 22 61 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 22 2c 22 66 6c 69 67 68 74 73 22 2c 22 70 61 63 6b 61 67 65 73 22 2c 22 63 61 72 73 22 2c 22 61 74 74 72 61 63 74 69 6f 6e 73 22 2c 22 61 69 72 70 6f 72 74 5f 74 61 78 69 73 22 5d 2c 22 61 6c 6c 22 3a 7b 22 66 6c 69 67 68 74 73 22 3a 7b 22 68 72 65 66 22 3a 22 68 74 74 70 73 3a 2f 2f 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 70 78 67 6f 3f 6c 61 6e 67 3d 65 6e 26 75 72 6c 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 62 6f 6f 6b 69 6e 67 2e 6b 61 79 61 6b 2e 63 6f 6d 25 32 46 69 6e 25 33 46 70 25 33 44 73 65 61 72 63 68 62 6f 78 5f 6c 69 6e 6b 25 32 Data Ascii: 4170{"header":{"products":{"selected":"flights","list":["accommodation","flights","packages","cars","attractions","airport_taxis"],"all":{"flights":{"href":"https://booking.com/pxgo?lang=en&url=https%3A%2F%2Fbooking.kayak.com%2Fin%3Fp%3Dsearchbox_link%2
2024-02-08 18:36:34 UTC	1875	IN	Data Raw: 4e 32 55 77 4c 54 63 78 59 7a 68 68 4d 6a 6b 77 5a 44 45 79 4e 74 67 43 42 65 41 43 41 51 22 2c 22 69 64 22 3a 22 73 65 74 74 69 6e 67 73 22 2c 22 6c 61 62 65 6c 22 3a 22 4d 61 6e 61 67 65 20 61 63 63 6f 75 6e 74 22 7d 2c 22 72 65 77 61 72 64 73 5f 77 61 6c 6c 65 74 22 3a 7b 22 69 64 22 3a 22 72 65 77 61 72 64 73 5f 77 61 6c 6c 65 74 22 2c 22 68 72 65 66 22 3a 22 68 74 74 70 73 3a 2f 2f 73 65 63 75 72 65 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 72 65 77 61 72 64 73 5f 61 6e 64 5f 77 61 6c 6c 65 74 2e 68 74 6d 6c 3f 61 69 64 3d 33 30 34 31 34 32 3b 6c 61 62 65 6c 3d 67 65 6e 31 37 33 6e 72 2d 31 46 43 41 45 6f 67 67 49 34 36 41 64 49 4d 31 67 45 61 49 38 43 69 41 45 42 6d 41 45 78 75 41 45 58 79 41 45 4d 32 41 45 42 36 41 45 42 2d 41 45 43 69 41 49 42 71 41 Data Ascii: N2UwLTcxYzhhMjkwZDEyNtgCBeACAQ","id":"settings","label":"Manage account"},"rewards_wallet":{"id":"rewards_wallet","href":"https://secure.booking.com/rewards_and_wallet.html?aid=304142;label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqA
2024-02-08 18:36:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
809	192.168.2.5	50664	99.84.208.90	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:34 UTC	3724	OUT	POST /track/internal-events HTTP/1.1 Host: flights.booking.com Connection: keep-alive Content-Length: 951 X-Booking-Flights-Client-Hints: price_change_v2 x-booking-trace-meta: caller_persona="b-flights-frontend"; root_caller_persona="app" sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-request-tree-id: 65c51f2bbf86b3c983f5b9d844888b15 sec-ch-ua-mobile: ?0 x-booking-parent-request-id: 6eb16677-e113-4790-902a-e8b887dc46a4 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ Content-Type: application/json X-Requested-From: clientFetch User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Affiliate-Id: 304142 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCoRU%2FMYfybDNcYUtImwTKmofwPZ3tBFno2lg7lDqS0CmNf0xTT1xT1c3zXx6qKnJczWXmoFQWrJGif%2FdMUlZOJCt6Nk2US7TY70cx%2FmgqgVnPv9YUr2CguMGRLRSO%2F9x9cyiRrsMNHPS4dkDIgVu6rQcMTXDfpfcd4%3D
2024-02-08 18:36:34 UTC	951	OUT	Data Raw: 7b 22 63 6f 6e 74 65 78 74 5f 6e 61 6d 65 22 3a 22 69 6e 64 65 78 22 2c 22 64 61 74 61 22 3a 7b 22 67 65 6e 65 72 69 63 22 3a 7b 22 65 70 6f 63 68 5f 6d 73 22 3a 31 37 30 37 34 31 37 33 39 32 31 33 37 2c 22 65 76 65 6e 74 5f 69 64 22 3a 22 35 32 31 32 65 66 64 64 2d 31 30 32 37 2d 34 33 38 38 2d 61 66 30 61 2d 61 64 36 65 66 62 64 36 32 64 36 62 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 64 65 76 69 63 65 5f 74 79 70 65 22 3a 22 75 6e 6b 6e 6f 77 6e 22 2c 22 6c 61 6e 67 75 61 67 65 22 3a 22 65 6e 22 2c 22 69 70 5f 63 6f 75 6e 74 72 79 22 3a 22 75 6e 6b 6e 6f 77 6e 22 2c 22 63 75 72 72 65 6e 63 79 22 3a 22 75 6e 6b 6e 6f 77 6e 22 2c 22 61 6e 61 6c 79 74 69 63 73 5f 73 65 73 73 69 6f 6e 5f 69 64 22 3a 22 75 6e 6b 6e 6f 77 6e 22 2c 22 72 65 71 75 65 73 74 Data Ascii: {"context_name":"index","data":{"generic":{"epoch_ms":1707417392137,"event_id":"5212efdd-1027-4388-af0a-ad6efbd62d6b"},"context":{"device_type":"unknown","language":"en","ip_country":"unknown","currency":"unknown","analytics_session_id":"unknown","request
2024-02-08 18:36:34 UTC	993	IN	HTTP/1.1 202 Accepted Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:34 GMT x-request-id: 65c51f2bbf86b3c983f5b9d844888b15 set-cookie: fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; Max-Age=86400; Domain=.booking.com; Path=/; Expires=Fri, 09 Feb 2024 18:36:34 GMT; HttpOnly; Secure set-cookie: fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; Path=/; Expires=Sun, 25 Feb 2024 19:17:03 GMT; HttpOnly; Secure access-control-allow-origin: https://www.booking.com vary: Origin access-control-allow-credentials: true x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 0173aeb09060ae0dd8c77e399d9e5634.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD79-C1 X-Amz-Cf-Id: bLfE1y3qAl1cc4apkgvhs9qortzZ3CT2Fm0AdeHXVoguMb4h7D8s_w==
2024-02-08 18:36:34 UTC	16	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 7d Data Ascii: {"success":true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
810	192.168.2.5	50665	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:34 UTC	448	OUT	GET /xdata/images/city/square100/976918.jpg?k=ba17581113d23e0a509fba3480bb6c08fef757afd93d9c56808a343bc2612e18&o= HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:34 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 4146 Connection: close Server: nginx Date: Wed, 10 Jan 2024 23:06:51 GMT ETag: "d56dec58fbb45404aa83b6eb98f12e5c81f74b99" Content-Language: 4146 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 ea0f86c249e022d5015ce79f54e723d0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: MW8EgOzieddrtEK1mwiv1GHg_B6dETh_gSVuLrM6q94xl-Su3qv_NA== Age: 2489383
2024-02-08 18:36:34 UTC	4146	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 64 00 64 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222dd"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
811	192.168.2.5	50667	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:34 UTC	448	OUT	GET /xdata/images/city/square100/682559.jpg?k=eba0a86971de163610eaab458cd7c2483f59ff8f350d2f63eceed77d21afbed3&o= HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:34 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 2315 Connection: close Server: nginx Date: Mon, 22 Jan 2024 07:13:44 GMT ETag: "5bff16d33321fc839eec78ed3662449d54fac1a3" Content-Language: 2315 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 f588325f7617672d954c4267c8bee1ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: BNCb9dLqWGQe9L7Wg2R-26NJoUYQhvg1OElZv3ijMdP4p8Sf06hVYQ== Age: 1509770
2024-02-08 18:36:34 UTC	2315	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 64 00 64 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222dd"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
812	192.168.2.5	50666	108.138.64.95	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:34 UTC	448	OUT	GET /xdata/images/city/square100/689744.jpg?k=3c7c6d59d968c2bade9003d9ebf8a1346455ce92abe94ffaa29247839161f09e&o= HTTP/1.1 Host: q-cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:34 UTC	542	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 2617 Connection: close Server: nginx Date: Tue, 06 Feb 2024 12:35:38 GMT ETag: "e477fe470be3c71b86fe8a6db69c367395ef93a2" Content-Language: 2617 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 8415794d557292780ff382a8c5bd6058.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: VfQdeeT5jxSGVRKVSp_s05U2zkefr1LUi060Jhsi-LXZtCa7s4Ro-g== Age: 194456
2024-02-08 18:36:34 UTC	2617	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 00 64 00 64 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222dd"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
813	192.168.2.5	50668	99.84.208.90	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:34 UTC	3725	OUT	POST /track/internal-events HTTP/1.1 Host: flights.booking.com Connection: keep-alive Content-Length: 1054 X-Booking-Flights-Client-Hints: price_change_v2 x-booking-trace-meta: caller_persona="b-flights-frontend"; root_caller_persona="app" sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-request-tree-id: 65c51f2bbf86b3c983f5b9d844888b15 sec-ch-ua-mobile: ?0 x-booking-parent-request-id: 6eb16677-e113-4790-902a-e8b887dc46a4 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ Content-Type: application/json X-Requested-From: clientFetch User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Affiliate-Id: 304142 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCoRU%2FMYfybDNcYUtImwTKmofwPZ3tBFno2lg7lDqS0CmNf0xTT1xT1c3zXx6qKnJczWXmoFQWrJGif%2FdMUlZOJCt6Nk2US7TY70cx%2FmgqgVnPv9YUr2CguMGRLRSO%2F9x9cyiRrsMNHPS4dkDIgVu6rQcMTXDfpfcd4%3D
2024-02-08 18:36:34 UTC	1054	OUT	Data Raw: 7b 22 63 6f 6e 74 65 78 74 5f 6e 61 6d 65 22 3a 22 69 6e 64 65 78 22 2c 22 64 61 74 61 22 3a 7b 22 67 65 6e 65 72 69 63 22 3a 7b 22 65 70 6f 63 68 5f 6d 73 22 3a 31 37 30 37 34 31 37 33 39 32 31 33 39 2c 22 65 76 65 6e 74 5f 69 64 22 3a 22 30 31 65 64 33 39 35 33 2d 37 64 35 66 2d 34 33 34 32 2d 38 65 64 62 2d 65 66 63 39 39 37 32 65 66 61 35 33 22 7d 2c 22 63 6f 6e 74 65 78 74 22 3a 7b 22 64 65 76 69 63 65 5f 74 79 70 65 22 3a 22 75 6e 6b 6e 6f 77 6e 22 2c 22 6c 61 6e 67 75 61 67 65 22 3a 22 65 6e 22 2c 22 69 70 5f 63 6f 75 6e 74 72 79 22 3a 22 75 6e 6b 6e 6f 77 6e 22 2c 22 63 75 72 72 65 6e 63 79 22 3a 22 75 6e 6b 6e 6f 77 6e 22 2c 22 61 6e 61 6c 79 74 69 63 73 5f 73 65 73 73 69 6f 6e 5f 69 64 22 3a 22 75 6e 6b 6e 6f 77 6e 22 2c 22 72 65 71 75 65 73 74 Data Ascii: {"context_name":"index","data":{"generic":{"epoch_ms":1707417392139,"event_id":"01ed3953-7d5f-4342-8edb-efc9972efa53"},"context":{"device_type":"unknown","language":"en","ip_country":"unknown","currency":"unknown","analytics_session_id":"unknown","request
2024-02-08 18:36:34 UTC	993	IN	HTTP/1.1 202 Accepted Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:34 GMT x-request-id: 65c51f2bbf86b3c983f5b9d844888b15 set-cookie: fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; Max-Age=86400; Domain=.booking.com; Path=/; Expires=Fri, 09 Feb 2024 18:36:34 GMT; HttpOnly; Secure set-cookie: fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; Path=/; Expires=Sun, 25 Feb 2024 19:17:03 GMT; HttpOnly; Secure access-control-allow-origin: https://www.booking.com vary: Origin access-control-allow-credentials: true x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 7f4d5d15a00b6ae82bb7aabc4560d3a6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD79-C1 X-Amz-Cf-Id: 1MEc2G7-4F8o_fiTWhDHW4ZmZ1ICsYGKWfwzx4UQoKHKjr1fhCwcWg==
2024-02-08 18:36:34 UTC	16	IN	Data Raw: 7b 22 73 75 63 63 65 73 73 22 3a 74 72 75 65 7d Data Ascii: {"success":true}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
814	192.168.2.5	50669	99.84.208.90	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:34 UTC	3731	OUT	POST /track/et HTTP/1.1 Host: flights.booking.com Connection: keep-alive Content-Length: 1299 X-Booking-Flights-Client-Hints: price_change_v2 x-booking-trace-meta: caller_persona="b-flights-frontend"; root_caller_persona="app" sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-request-tree-id: 65c51f2bbf86b3c983f5b9d844888b15 sec-ch-ua-mobile: ?0 x-booking-parent-request-id: 6eb16677-e113-4790-902a-e8b887dc46a4 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ Content-Type: application/json X-Requested-From: clientFetch User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Affiliate-Id: 304142 X-Soylent-Email: sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbwcLxQQ4VaCoRU%2FMYfybDNcYUtImwTKmofwPZ3tBFno2lg7lDqS0CmNf0xTT1xT1c3zXx6qKnJczWXmoFQWrJGif%2FdMUlZOJCt6Nk2US7TY70cx%2FmgqgVnPv9YUr2CguMGRLRSO%2F9x9cyiRrsMNHPS4dkDIgVu6rQcMTXDfpfcd4%3D
2024-02-08 18:36:34 UTC	1299	OUT	Data Raw: 7b 22 72 65 71 75 65 73 74 73 22 3a 5b 7b 22 74 79 70 65 22 3a 22 73 74 61 67 65 22 2c 22 6e 61 6d 65 22 3a 22 66 6c 69 67 68 74 73 5f 77 65 62 5f 66 65 65 64 62 61 63 6b 5f 62 6c 61 63 6b 6f 75 74 22 2c 22 76 61 6c 75 65 22 3a 31 7d 2c 7b 22 74 79 70 65 22 3a 22 73 74 61 67 65 22 2c 22 6e 61 6d 65 22 3a 22 66 6c 69 67 68 74 73 5f 77 65 62 5f 66 65 65 64 62 61 63 6b 5f 62 6c 61 63 6b 6f 75 74 22 2c 22 76 61 6c 75 65 22 3a 33 7d 2c 7b 22 74 79 70 65 22 3a 22 73 74 61 67 65 22 2c 22 6e 61 6d 65 22 3a 22 66 6c 69 67 68 74 73 5f 61 70 65 78 5f 77 65 62 5f 75 73 65 5f 72 65 64 75 78 22 2c 22 76 61 6c 75 65 22 3a 31 7d 2c 7b 22 74 79 70 65 22 3a 22 73 74 61 67 65 22 2c 22 6e 61 6d 65 22 3a 22 66 6c 69 67 68 74 73 5f 61 70 65 78 5f 77 65 62 5f 75 73 65 5f 72 65 Data Ascii: {"requests":[{"type":"stage","name":"flights_web_feedback_blackout","value":1},{"type":"stage","name":"flights_web_feedback_blackout","value":3},{"type":"stage","name":"flights_apex_web_use_redux","value":1},{"type":"stage","name":"flights_apex_web_use_re
2024-02-08 18:36:34 UTC	1016	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 4 Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:34 GMT x-request-id: 65c51f2bbf86b3c983f5b9d844888b15 set-cookie: fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; Max-Age=86400; Domain=.booking.com; Path=/; Expires=Fri, 09 Feb 2024 18:36:34 GMT; HttpOnly; Secure set-cookie: fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; Path=/; Expires=Sun, 25 Feb 2024 19:17:03 GMT; HttpOnly; Secure access-control-allow-origin: https://www.booking.com vary: Origin access-control-allow-credentials: true referrer-policy: no-referrer x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 f8558580f66929e19ed69bba2e85da74.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD79-C1 X-Amz-Cf-Id: AdKZCoVkwiSQT22oSqizdwoKssuDTJc8FaV5MxE57VJj8_0bqLmCGQ==
2024-02-08 18:36:34 UTC	4	IN	Data Raw: 74 72 75 65 Data Ascii: true

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
815	192.168.2.5	50671	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:34 UTC	1590	OUT	GET /td/rul/481216654?random=1707417393396&cv=11&fst=1707417393396&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45He4250v843635506za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Fflights%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3D5171fc655664ddf74ab763a094523fb7%26from%3Dbooking%26&hn=www.googleadservices.com&frm=0&tiba=Find%20cheap%20flights%20%26%20plane%20tickets%20%7C%20Booking.com&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:36:34 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:34 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:36:34 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-08 18:36:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
816	192.168.2.5	50673	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:34 UTC	1453	OUT	GET /pagead/1p-user-list/481216654/?random=1707417393396&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v843635506za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Fflights%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3D5171fc655664ddf74ab763a094523fb7%26from%3Dbooking%26&frm=0&tiba=Find%20cheap%20flights%20%26%20plane%20tickets%20%7C%20Booking.com&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_Q42k7LniCkJSmGP5qbVRNGdKG19C38wURmRQTCr_7yXYQedx&random=352684247&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:34 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:34 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:34 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
817	192.168.2.5	50674	99.84.208.90	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:34 UTC	3246	OUT	GET /manifest.json HTTP/1.1 Host: flights.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: manifest Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBJoTYc%2FGcpLXBKXbYOyXI%2F8wXqW%2FpslxpYGBLRqkm5PB2Uc61PgHfoMxAsqHhj0KEfCaXiT2YCylAFh5%2FONX%2FvWgiYfjJrcEkFXmxKGrMJFRX%2Fmlnxb%2BnrdN6TJBl%2Fg%2FBX%2BNRLe4BDP1oP%2FjIfk11HgOTmin4aDlQI%3D; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U
2024-02-08 18:36:35 UTC	698	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 753 Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:35 GMT vary: Accept-Encoding accept-ranges: bytes cache-control: public, max-age=604800 last-modified: Thu, 08 Feb 2024 14:22:44 GMT etag: W/"2f1-18d89197720" referrer-policy: no-referrer x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 0173aeb09060ae0dd8c77e399d9e5634.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD79-C1 X-Amz-Cf-Id: HmomvvSVPCJbay08_RNK82zE15VMVBbeMDMJhDZsHcbD7soWDR6AfA==
2024-02-08 18:36:35 UTC	753	IN	Data Raw: 7b 0a 20 20 22 6e 61 6d 65 22 3a 20 22 46 6c 69 67 68 74 73 20 2d 20 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 0a 20 20 22 73 68 6f 72 74 5f 6e 61 6d 65 22 3a 20 22 46 6c 69 67 68 74 73 22 2c 0a 20 20 22 74 68 65 6d 65 5f 63 6f 6c 6f 72 22 3a 20 22 23 32 31 39 36 66 33 22 2c 0a 20 20 22 62 61 63 6b 67 72 6f 75 6e 64 5f 63 6f 6c 6f 72 22 3a 20 22 23 32 31 39 36 66 33 22 2c 0a 20 20 22 64 69 73 70 6c 61 79 22 3a 20 22 73 74 61 6e 64 61 6c 6f 6e 65 22 2c 0a 20 20 22 53 63 6f 70 65 22 3a 20 22 2f 22 2c 0a 20 20 22 73 74 61 72 74 5f 75 72 6c 22 3a 20 22 2f 22 2c 0a 20 20 22 69 63 6f 6e 73 22 3a 20 5b 0a 20 20 20 20 7b 0a 20 20 20 20 20 20 22 73 72 63 22 3a 20 22 69 63 6f 6e 73 2f 66 61 76 69 63 6f 6e 2d 31 36 78 31 36 2e 70 6e 67 22 2c 0a 20 20 20 20 20 20 22 73 Data Ascii: { "name": "Flights - Booking.com", "short_name": "Flights", "theme_color": "#2196f3", "background_color": "#2196f3", "display": "standalone", "Scope": "/", "start_url": "/", "icons": [ { "src": "icons/favicon-16x16.png", "s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
818	192.168.2.5	50675	99.84.208.123	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:35 UTC	3070	OUT	GET /track/et HTTP/1.1 Host: flights.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBJoTYc%2FGcpLXBKXbYOyXI%2F8wXqW%2FpslxpYGBLRqkm5PB2Uc61PgHfoMxAsqHhj0KEfCaXiT2YCylAFh5%2FONX%2FvWgiYfjJrcEkFXmxKGrMJFRX%2Fmlnxb%2BnrdN6TJBl%2Fg%2FBX%2BNRLe4BDP1oP%2FjIfk11HgOTmin4aDlQI%3D; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U
2024-02-08 18:36:35 UTC	947	IN	HTTP/1.1 400 Bad Request Content-Type: application/json; charset=utf-8 Content-Length: 82 Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:35 GMT x-request-id: fcf28500-c6b0-11ee-9562-899adabad3cd set-cookie: fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; Max-Age=86400; Domain=.booking.com; Path=/; Expires=Fri, 09 Feb 2024 18:36:35 GMT; HttpOnly; Secure set-cookie: fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; Path=/; Expires=Sun, 25 Feb 2024 19:17:04 GMT; HttpOnly; Secure vary: Origin access-control-allow-credentials: true x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Error from cloudfront Via: 1.1 19ae496eb414e9373ed8ce49d0fdbba2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD79-C1 X-Amz-Cf-Id: sSN9L5p5jKy6aklRkAJ9mtcgQNMRHkSJbr8eywpZliV8GkNOH-Hq0A==
2024-02-08 18:36:35 UTC	82	IN	Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 22 3a 22 45 54 20 74 72 61 63 6b 69 6e 67 20 65 6e 64 70 6f 69 6e 74 3a 20 27 72 65 71 75 65 73 74 73 27 20 61 72 72 61 79 20 69 73 20 72 65 71 75 69 72 65 64 20 69 6e 20 72 65 71 75 65 73 74 20 62 6f 64 79 2e 22 7d Data Ascii: {"response":"ET tracking endpoint: 'requests' array is required in request body."}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
819	192.168.2.5	50676	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:35 UTC	1253	OUT	GET /pagead/1p-user-list/481216654/?random=1707417393396&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45He4250v843635506za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Fflights%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3D5171fc655664ddf74ab763a094523fb7%26from%3Dbooking%26&frm=0&tiba=Find%20cheap%20flights%20%26%20plane%20tickets%20%7C%20Booking.com&npa=0&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_Q42k7LniCkJSmGP5qbVRNGdKG19C38wURmRQTCr_7yXYQedx&random=352684247&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:35 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:35 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:35 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
820	192.168.2.5	50678	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:35 UTC	1616	OUT	GET /td/rul/1070314322?random=1707417394312&cv=11&fst=1707417394312&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4250v882970024za200&gcd=13l3l3l3l1&dma=0&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Fflights%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3D5171fc655664ddf74ab763a094523fb7%26from%3Dbooking%26&hn=www.googleadservices.com&frm=0&tiba=Find%20cheap%20flights%20%26%20plane%20tickets%20%7C%20Booking.com&npa=0&pscdl=noapi&auid=1592208705.1707417344&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:36:35 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:35 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:36:35 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-08 18:36:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
821	192.168.2.5	50682	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:35 UTC	1480	OUT	GET /pagead/1p-user-list/1070314322/?random=1707417394312&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45be4250v882970024za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Fflights%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3D5171fc655664ddf74ab763a094523fb7%26from%3Dbooking%26&frm=0&tiba=Find%20cheap%20flights%20%26%20plane%20tickets%20%7C%20Booking.com&npa=0&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_CzDUH1s5abS80C-w2A_9_GmSLYFEXbYQEE-WNN1CXmMrcQS5&random=2428839238&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:35 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:35 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:35 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
822	192.168.2.5	50681	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:35 UTC	682	OUT	POST /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive Content-Length: 2895 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://account.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:35 UTC	2895	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 5a 4f 4f 43 6e 79 73 45 41 41 41 41 3a 73 69 45 74 69 52 47 58 2f 52 30 2b 39 48 59 32 62 61 64 71 4b 34 73 55 74 69 38 56 78 57 49 4b 64 54 34 52 47 68 2f 73 6b 51 37 72 70 6d 52 35 6d 73 48 57 49 65 6a 38 43 46 6e 5a 4c 5a 6d 53 4f 6a 5a 70 64 4f 4e 42 48 49 7a 67 7a 2b 30 72 73 6e 77 6d 41 78 6f 4c 47 2f 66 64 35 70 4b 4e 39 50 4b 62 4e 59 78 4a 5a 72 36 6c 75 7a 33 73 35 2b 65 6c 51 38 79 44 6c 63 52 66 49 6a 62 2b 4c 39 54 79 49 30 61 7a 4b 43 73 47 76 4a 39 41 64 62 2f 68 4c 57 7a 2f 34 76 33 47 41 34 6c 76 45 43 6d 43 38 37 4d 4a 52 43 2f 2f 44 50 35 4e 57 6f 6b 67 76 6d Data Ascii: {"existing_token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAZOOCnysEAAAA:siEtiRGX/R0+9HY2badqK4sUti8VxWIKdT4RGh/skQ7rpmR5msHWIej8CFnZLZmSOjZpdONBHIzgz+0rsnwmAxoLG/fd5pKN9PKbNYxJZr6luz3s5+elQ8yDlcRfIjb+L9TyI0azKCsGvJ9Adb/hLWz/4v3GA4lvECmC87MJRC//DP5NWokgvm
2024-02-08 18:36:35 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1044 Connection: close Vary: Accept-Encoding Date: Thu, 08 Feb 2024 18:36:35 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65c51f33-3078c97b44a971d631807cde X-Cache: Miss from cloudfront Via: 1.1 3500e6db5ae43764ed5ca43fc6d56058.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: EgQ5tPsNchtDUL-3xx7a9QkEo33Z2dlqMed2sZTtZrSUWOwPRyWkWg==
2024-02-08 18:36:35 UTC	1044	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 59 6a 61 43 55 78 45 4d 41 41 41 41 3a 6b 4d 61 52 59 5a 66 76 65 4a 45 4f 49 36 56 33 4f 76 66 30 72 59 59 39 53 4e 57 7a 48 61 35 48 52 4c 58 51 45 35 79 72 4a 2b 70 62 2b 53 51 77 42 71 2b 5a 52 6d 67 75 70 75 4d 53 4b 71 71 6a 65 50 31 50 64 62 33 70 33 67 49 41 36 65 67 50 77 2b 37 57 48 34 36 43 4c 31 58 45 33 38 73 37 4f 49 2f 52 6b 63 39 46 35 56 78 47 67 39 53 41 72 2b 4a 58 4a 41 78 4c 53 58 70 31 34 32 54 57 68 4c 71 75 37 4d 58 6f 50 41 50 36 66 6b 62 34 51 52 69 34 70 6f 31 49 65 4c 68 58 30 62 6d 37 75 48 64 47 58 6a 45 41 57 77 56 45 52 63 2b 79 38 43 48 4a 76 58 39 51 30 4f 53 2b 6a 77 72 Data Ascii: {"token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAYjaCUxEMAAAA:kMaRYZfveJEOI6V3Ovf0rYY9SNWzHa5HRLXQE5yrJ+pb+SQwBq+ZRmgupuMSKqqjeP1Pdb3p3gIA6egPw+7WH46CL1XE38s7OI/Rkc9F5VxGg9SAr+JXJAxLSXp142TWhLqu7MXoPAP6fkb4QRi4po1IeLhX0bm7uHdGXjEAWwVERc+y8CHJvX9Q0OS+jwr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
823	192.168.2.5	50683	99.84.208.90	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:36 UTC	3272	OUT	GET /favicon.ico HTTP/1.1 Host: flights.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBJoTYc%2FGcpLXBKXbYOyXI%2F8wXqW%2FpslxpYGBLRqkm5PB2Uc61PgHfoMxAsqHhj0KEfCaXiT2YCylAFh5%2FONX%2FvWgiYfjJrcEkFXmxKGrMJFRX%2Fmlnxb%2BnrdN6TJBl%2Fg%2FBX%2BNRLe4BDP1oP%2FjIfk11HgOTmin4aDlQI%3D; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42
2024-02-08 18:36:36 UTC	680	IN	HTTP/1.1 200 OK Content-Type: image/x-icon Content-Length: 1582 Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:36 GMT vary: Accept-Encoding accept-ranges: bytes cache-control: public, max-age=604800 last-modified: Thu, 08 Feb 2024 14:22:44 GMT etag: W/"62e-18d89197720" referrer-policy: no-referrer x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 426461ac6e9a3bd7fa011ad672ee0062.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD79-C1 X-Amz-Cf-Id: CNIi7EflRu4ioLtsy38iLa4100lXTyldteBlv3aPO2-cMAH4n3EyXQ==
2024-02-08 18:36:36 UTC	1582	IN	Data Raw: 00 00 01 00 03 00 20 20 10 00 01 00 04 00 e8 02 00 00 36 00 00 00 18 18 10 00 01 00 04 00 e8 01 00 00 1e 03 00 00 10 10 10 00 01 00 04 00 28 01 00 00 06 05 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 00 02 00 00 12 0b 00 00 12 0b 00 00 10 00 00 00 10 00 00 00 80 35 00 00 92 4d 16 00 a1 6a 43 00 d8 9e 29 00 b3 86 67 00 ff fe fe 00 d1 b6 a2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 27 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6(( @5MjC)g'ww

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
824	192.168.2.5	50684	142.250.9.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:36 UTC	1280	OUT	GET /pagead/1p-user-list/1070314322/?random=1707417394312&cv=11&fst=1707415200000&bg=ffffff&guid=ON&async=1&gtm=45be4250v882970024za200&u_w=1280&u_h=1024&url=https%3A%2F%2Fwww.booking.com%2Fflights%2Findex.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3D5171fc655664ddf74ab763a094523fb7%26from%3Dbooking%26&frm=0&tiba=Find%20cheap%20flights%20%26%20plane%20tickets%20%7C%20Booking.com&npa=0&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQAvHhf_CzDUH1s5abS80C-w2A_9_GmSLYFEXbYQEE-WNN1CXmMrcQS5&random=2428839238&rmt_tld=0&ipr=y HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:36 UTC	602	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:36 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:36 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
825	192.168.2.5	50686	18.67.65.100	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:36 UTC	407	OUT	GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:36 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Thu, 08 Feb 2024 18:36:36 GMT X-Cache: Error from cloudfront Via: 1.1 066fc17b108820c747336d8f45e8ea54.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: k2sxRZaXgWOFuvha2vn0nWNxLy_MLg2i8CNEzBf_v8oPAHOjTkk65g==
2024-02-08 18:36:36 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
826	192.168.2.5	50685	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:36 UTC	682	OUT	POST /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive Content-Length: 2886 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://account.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:36 UTC	2886	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 5a 4f 4f 43 6e 79 73 45 41 41 41 41 3a 73 69 45 74 69 52 47 58 2f 52 30 2b 39 48 59 32 62 61 64 71 4b 34 73 55 74 69 38 56 78 57 49 4b 64 54 34 52 47 68 2f 73 6b 51 37 72 70 6d 52 35 6d 73 48 57 49 65 6a 38 43 46 6e 5a 4c 5a 6d 53 4f 6a 5a 70 64 4f 4e 42 48 49 7a 67 7a 2b 30 72 73 6e 77 6d 41 78 6f 4c 47 2f 66 64 35 70 4b 4e 39 50 4b 62 4e 59 78 4a 5a 72 36 6c 75 7a 33 73 35 2b 65 6c 51 38 79 44 6c 63 52 66 49 6a 62 2b 4c 39 54 79 49 30 61 7a 4b 43 73 47 76 4a 39 41 64 62 2f 68 4c 57 7a 2f 34 76 33 47 41 34 6c 76 45 43 6d 43 38 37 4d 4a 52 43 2f 2f 44 50 35 4e 57 6f 6b 67 76 6d Data Ascii: {"existing_token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAZOOCnysEAAAA:siEtiRGX/R0+9HY2badqK4sUti8VxWIKdT4RGh/skQ7rpmR5msHWIej8CFnZLZmSOjZpdONBHIzgz+0rsnwmAxoLG/fd5pKN9PKbNYxJZr6luz3s5+elQ8yDlcRfIjb+L9TyI0azKCsGvJ9Adb/hLWz/4v3GA4lvECmC87MJRC//DP5NWokgvm
2024-02-08 18:36:36 UTC	609	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 1044 Connection: close Vary: Accept-Encoding Date: Thu, 08 Feb 2024 18:36:36 GMT access-control-allow-origin: * access-control-max-age: 86400 access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65c51f34-4872ca3e18862add34a9cc43 X-Cache: Miss from cloudfront Via: 1.1 bfba2464a75a65b0c6568afe15f68b4c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: LYIr-7vpTh9cBBXgHOUEPC_XzfJe1cx9tsqwV6h3rgqH-z0Cr75OJg==
2024-02-08 18:36:36 UTC	1044	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 5a 36 61 43 79 4e 34 42 41 41 41 41 3a 44 6b 33 39 42 41 6f 70 42 54 4a 61 43 4f 30 39 45 68 4f 69 6d 6a 5a 63 7a 52 2f 74 36 68 33 6a 64 31 42 44 4a 42 6a 37 62 6f 63 64 67 6a 6a 70 35 2b 56 31 63 55 69 78 4c 4d 6c 37 46 47 4a 65 35 71 6e 67 30 55 75 37 6b 75 49 51 35 68 4a 53 30 6d 4a 79 52 79 64 2f 37 2b 6e 79 4e 6e 79 6c 6f 56 49 39 54 59 71 44 57 32 55 36 66 49 74 6a 71 63 32 53 35 76 58 42 61 72 2f 58 77 75 2f 33 69 59 47 71 68 43 41 76 46 51 36 54 47 46 4d 50 56 77 31 6c 47 47 50 57 5a 52 73 48 36 4f 51 59 73 79 30 62 64 53 55 67 51 7a 6f 35 6c 49 35 43 48 6e 62 51 54 76 47 49 36 41 4e 6a 76 59 52 Data Ascii: {"token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAZ6aCyN4BAAAA:Dk39BAopBTJaCO09EhOimjZczR/t6h3jd1BDJBj7bocdgjjp5+V1cUixLMl7FGJe5qng0Uu7kuIQ5hJS0mJyRyd/7+nyNnyloVI9TYqDW2U6fItjqc2S5vXBar/Xwu/3iYGqhCAvFQ6TGFMPVw1lGGPWZRsH6OQYsy0bdSUgQzo5lI5CHnbQTvGI6ANjvYR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
827	192.168.2.5	50687	18.67.65.100	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:36 UTC	407	OUT	GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:37 UTC	334	IN	HTTP/1.1 400 Bad Request Content-Type: application/json Content-Length: 48 Connection: close Date: Thu, 08 Feb 2024 18:36:37 GMT X-Cache: Error from cloudfront Via: 1.1 4a66fbee8ce857225d1bddf53b79420c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: fTcYRuQMda8ISrLG03A6V6PYE9Cg2StZVIBJDQGSOHgLZVA6b5ywXA==
2024-02-08 18:36:37 UTC	48	IN	Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 30 2c 22 6d 65 73 73 61 67 65 22 3a 22 48 54 54 50 20 6d 65 74 68 6f 64 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 22 7d Data Ascii: {"code":400,"message":"HTTP method not allowed"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
828	192.168.2.5	50688	99.84.208.123	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:36 UTC	3073	OUT	GET /favicon.ico HTTP/1.1 Host: flights.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBJoTYc%2FGcpLXBKXbYOyXI%2F8wXqW%2FpslxpYGBLRqkm5PB2Uc61PgHfoMxAsqHhj0KEfCaXiT2YCylAFh5%2FONX%2FvWgiYfjJrcEkFXmxKGrMJFRX%2Fmlnxb%2BnrdN6TJBl%2Fg%2FBX%2BNRLe4BDP1oP%2FjIfk11HgOTmin4aDlQI%3D; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42
2024-02-08 18:36:37 UTC	680	IN	HTTP/1.1 200 OK Content-Type: image/x-icon Content-Length: 1582 Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:37 GMT vary: Accept-Encoding accept-ranges: bytes cache-control: public, max-age=604800 last-modified: Thu, 08 Feb 2024 14:22:44 GMT etag: W/"62e-18d89197720" referrer-policy: no-referrer x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 03a399d73bdcccc9e7ad44d059b07ef4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD79-C1 X-Amz-Cf-Id: oibWRSfwo0kF31hNLYTA6ccVCwxLho7bw86lT6Why1TweJiADGkC_g==
2024-02-08 18:36:37 UTC	1582	IN	Data Raw: 00 00 01 00 03 00 20 20 10 00 01 00 04 00 e8 02 00 00 36 00 00 00 18 18 10 00 01 00 04 00 e8 01 00 00 1e 03 00 00 10 10 10 00 01 00 04 00 28 01 00 00 06 05 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 04 00 00 00 00 00 00 02 00 00 12 0b 00 00 12 0b 00 00 10 00 00 00 10 00 00 00 80 35 00 00 92 4d 16 00 a1 6a 43 00 d8 9e 29 00 b3 86 67 00 ff fe fe 00 d1 b6 a2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 27 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6(( @5MjC)g'ww

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
829	192.168.2.5	50689	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:38 UTC	4210	OUT	GET /packages.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; _gat=1; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAfk6BVJUjAAAA:WDfXg2ry+HvbnxTztLnepFvhf3dpX4SdQfM4GczRrcPw6MWAZH8MErn+af2Y9SvAts7ySjM/T9nCQWaxTWJ+ECSRYADCgGFp6g8nwqAAp4uZuesbnPNMB9VWMMTR/6OqpiFI1lm6c8HTX0et8uTZTDvEovUpe/ZJPj+EvnZwpL1hdq9NKhFzFZb6nk1kcyw+S5Gmb0WW/JMfQvkBUX6FX8nHd2pkcvntEKFlkhvMXyaXZ+ocI5s4XxhjbVLG6yziJfNgBxF+; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbiKbS0JOgDBJoTYc%2FGcpLXBKXbYOyXI%2F8wXqW%2FpslxpYGBLRqkm5PB2Uc61PgHfoMxAsqHhj0KEfCaXiT2YCylAFh5%2FONX%2FvWgiYfjJrcEkFXmxKGrMJFRX%2Fmlnxb%2BnrdN6TJBl%2Fg%2FBX%2BNRLe4BDP1oP%2FjIfk11HgOTmin4aDlQI%3D; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42
2024-02-08 18:36:39 UTC	1522	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Content-Length: 448749 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:39 GMT vary: User-Agent, Accept-Encoding nel: {"max_age":604800,"report_to":"default"} report-to: {"max_age":604800,"endpoints":[{"url":"https://nellie.booking.com/report"}],"group":"default"} set-cookie: _implmdnbl=2__1__0; path=/; expires=Sat, 09-Feb-2019 18:36:38 GMT; HttpOnly set-cookie: px_init=0; domain=booking.com; expires=Tue, 17-May-2078 13:13:16 GMT; SameSite=Strict; secure; HttpOnly set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbVA9iGwA%2BUSwQ2O%2FlHm0pqQylRO2dJ7x%2FYlVcVU5Hiw1maEZ7F5OJC7JbdIX2o2ehMp3Yo4XT4lkzfuwozqYc9CeWfmPGKOe3hqqu4HQULabtlMTEeCieJXNZjl6azPIa5VZ0lIM7ZhfVN1YLZMT32klhmcppfCGhIQ8euPDUOg0%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:39 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-type-options: nosniff x-recruiting: Like HTTP headers? Come write ours: https://careers.booking.com content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=d16682db432d0172&e=UmFuZG9tSVYkc2RlIyh9YTCoV0bP7vIXa1YpGH5dQeYJjE76I5KlSxQQA93m14yRdlNd1dwk38U x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 c1bfc7dbcf7f9782aa3be590b7ce3d6a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: YKujzwJ6N0BG-B--jk9R7mV2SbHbasHBTWqGHUXG0vDJ0x-vJlAQAA==
2024-02-08 18:36:39 UTC	16384	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 59 6f 75 20 6b 6e 6f 77 20 79 6f 75 20 63 6f 75 6c 64 20 62 65 20 67 65 74 74 69 6e 67 20 70 61 69 64 20 74 6f 20 70 6f 6b 65 20 61 72 6f 75 6e 64 20 69 6e 20 6f 75 72 20 63 6f 64 65 3f 0a 57 65 27 72 65 20 68 69 72 69 6e 67 20 64 65 73 69 67 6e 65 72 73 20 61 6e 64 20 64 65 76 65 6c 6f 70 65 72 73 20 74 6f 20 77 6f 72 6b 20 69 6e 20 41 6d 73 74 65 72 64 61 6d 3a 0a 68 74 74 70 73 3a 2f 2f 63 61 72 65 65 72 73 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 0a 2d 2d 3e 0a 3c 21 2d 2d 20 77 64 6f 74 2d 38 30 32 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 73 59 6b 55 6c 53 4e 48 4a 74 71 34 4b 6e 4d 22 3e 0a 64 6f 63 75 Data Ascii: <!DOCTYPE html>...You know you could be getting paid to poke around in our code?We're hiring designers and developers to work in Amsterdam:https://careers.booking.com/-->... wdot-802 --><script type="text/javascript" nonce="sYkUlSNHJtq4KnM">docu
2024-02-08 18:36:39 UTC	16384	IN	Data Raw: 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 68 74 6d 6c 22 20 68 72 65 66 6c 61 6e 67 3d 22 65 6c 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 70 61 63 6b 61 67 65 73 2e 65 6c 2e 68 74 6d 6c 22 20 74 69 74 6c 65 3d 22 ce 95 ce bb ce bb ce b7 ce bd ce b9 ce ba ce ac 22 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 74 65 78 74 2f 68 74 6d 6c 22 20 68 72 65 66 6c 61 6e 67 3d 22 72 75 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 70 61 63 6b 61 67 65 73 2e 72 75 2e 68 74 6d 6c 22 20 74 69 74 6c 65 3d 22 d0 a0 d1 83 d1 81 d1 81 d0 ba d0 b8 d0 b9 22 2f 3e 0a 3c 6c 69 6e 6b 20 Data Ascii: rel="alternate" type="text/html" hreflang="el" href="https://www.booking.com/packages.el.html" title=""/><link rel="alternate" type="text/html" hreflang="ru" href="https://www.booking.com/packages.ru.html" title=""/><link
2024-02-08 18:36:39 UTC	10463	IN	Data Raw: 2c 22 6f 6e 5f 64 61 79 5f 6d 6f 6e 74 68 22 3a 22 30 38 22 2c 22 73 68 6f 72 74 5f 6e 61 6d 65 5f 75 63 22 3a 22 41 75 67 75 73 74 22 2c 22 6e 61 6d 65 5f 64 65 66 5f 61 72 74 69 63 6c 65 5f 75 63 22 3a 22 54 68 65 20 41 75 67 75 73 74 22 2c 22 6e 61 6d 65 5f 75 63 22 3a 22 41 75 67 75 73 74 22 2c 22 6e 61 6d 65 22 3a 22 41 75 67 75 73 74 22 2c 22 73 68 6f 72 74 5f 6e 61 6d 65 22 3a 22 41 75 67 22 2c 22 6e 61 6d 65 5f 74 6f 22 3a 22 41 75 67 75 73 74 22 2c 22 69 6e 5f 6d 6f 6e 74 68 5f 6c 63 22 3a 22 69 6e 20 41 75 67 75 73 74 22 2c 22 6d 6f 6e 74 68 5f 32 22 3a 22 41 75 67 75 73 74 22 2c 22 6e 61 6d 65 5f 6f 6e 6c 79 22 3a 22 41 75 67 75 73 74 22 2c 22 6e 61 6d 65 5f 77 69 74 68 5f 79 65 61 72 5f 6f 6e 6c 79 22 3a 22 41 75 67 75 73 74 22 2c 22 6e 61 6d Data Ascii: ,"on_day_month":"08","short_name_uc":"August","name_def_article_uc":"The August","name_uc":"August","name":"August","short_name":"Aug","name_to":"August","in_month_lc":"in August","month_2":"August","name_only":"August","name_with_year_only":"August","nam
2024-02-08 18:36:39 UTC	16384	IN	Data Raw: 65 72 22 3a 20 27 53 75 6e 27 2c 0a 22 73 68 6f 72 74 65 73 74 22 3a 20 27 53 75 27 7d 2c 0a 7b 7d 5d 2c 0a 62 5f 67 72 6f 75 70 3a 20 5b 5d 2c 0a 62 5f 73 69 6d 70 6c 65 5f 77 65 65 6b 64 61 79 73 3a 20 5b 27 4d 6f 27 2c 27 54 75 27 2c 27 57 65 27 2c 27 54 68 27 2c 27 46 72 27 2c 27 53 61 27 2c 27 53 75 27 5d 2c 0a 62 5f 73 69 6d 70 6c 65 5f 77 65 65 6b 64 61 79 73 5f 66 6f 72 5f 6a 73 3a 20 5b 27 4d 6f 6e 27 2c 27 54 75 65 27 2c 27 57 65 64 27 2c 27 54 68 75 27 2c 27 46 72 69 27 2c 27 53 61 74 27 2c 27 53 75 6e 27 5d 2c 0a 62 5f 6c 6f 6e 67 5f 77 65 65 6b 64 61 79 73 3a 20 5b 27 4d 6f 6e 64 61 79 27 2c 27 54 75 65 73 64 61 79 27 2c 27 57 65 64 6e 65 73 64 61 79 27 2c 27 54 68 75 72 73 64 61 79 27 2c 27 46 72 69 64 61 79 27 2c 27 53 61 74 75 72 64 61 79 Data Ascii: er": 'Sun',"shortest": 'Su'},{}],b_group: [],b_simple_weekdays: ['Mo','Tu','We','Th','Fr','Sa','Su'],b_simple_weekdays_for_js: ['Mon','Tue','Wed','Thu','Fri','Sat','Sun'],b_long_weekdays: ['Monday','Tuesday','Wednesday','Thursday','Friday','Saturday
2024-02-08 18:36:39 UTC	16384	IN	Data Raw: 54 22 3a 31 2c 22 4e 4e 53 43 5a 57 58 46 47 64 56 61 63 44 64 4d 55 4e 50 59 53 62 53 43 5a 43 22 3a 31 2c 22 62 5a 57 4d 53 47 45 4e 49 62 66 64 65 44 63 59 48 59 55 41 5a 4e 5a 41 47 57 65 22 3a 31 2c 22 48 57 41 46 59 54 62 44 4f 4c 62 65 54 53 4c 64 61 52 4f 22 3a 31 2c 22 62 51 47 42 49 55 65 42 41 48 55 5a 65 57 4e 5a 4a 4b 62 49 59 55 4e 66 53 65 56 53 54 64 54 55 43 22 3a 31 2c 22 48 4d 62 43 44 57 4f 4f 4a 47 4f 47 65 4d 56 4f 58 54 22 3a 31 2c 22 48 57 4c 4d 59 43 42 59 61 62 64 53 4f 42 4e 53 4a 53 63 46 48 52 65 22 3a 31 2c 22 42 43 42 61 51 44 62 41 4d 55 56 62 43 65 66 41 66 64 52 65 22 3a 31 2c 22 54 66 4e 5a 65 46 4f 42 54 65 4b 53 49 62 45 44 62 45 62 65 41 62 41 55 4d 63 45 55 62 66 4b 65 22 3a 32 2c 22 4f 44 52 45 57 51 63 62 64 62 66 Data Ascii: T":1,"NNSCZWXFGdVacDdMUNPYSbSCZC":1,"bZWMSGENIbfdeDcYHYUAZNZAGWe":1,"HWAFYTbDOLbeTSLdaRO":1,"bQGBIUeBAHUZeWNZJKbIYUNfSeVSTdTUC":1,"HMbCDWOOJGOGeMVOXT":1,"HWLMYCBYabdSOBNSJScFHRe":1,"BCBaQDbAMUVbCefAfdRe":1,"TfNZeFOBTeKSIbEDbEbeAbAUMcEUbfKe":2,"ODREWQcbdbf
2024-02-08 18:36:39 UTC	16384	IN	Data Raw: 3a 31 2c 22 4f 4f 49 42 54 56 58 49 4e 4c 63 4d 4e 51 4b 41 45 4e 4a 48 65 22 3a 31 2c 22 4e 41 46 4c 65 4f 65 4a 59 54 42 65 44 55 66 57 5a 4a 45 62 4f 4d 46 63 55 4e 62 4c 57 5a 48 4f 61 4f 22 3a 31 2c 22 4f 41 5a 4f 58 48 48 48 58 46 5a 50 65 5a 65 4e 53 56 4d 50 59 57 62 48 52 54 48 54 22 3a 31 2c 22 59 54 42 54 52 59 50 55 54 48 4c 4c 45 49 62 4c 52 56 5a 4c 42 55 61 50 59 54 65 4d 4a 4b 44 4b 61 54 22 3a 31 2c 22 59 64 58 66 64 4b 4e 4b 4e 4b 5a 55 54 50 54 51 54 55 4d 4b 50 52 45 46 63 45 42 59 4a 4f 22 3a 31 2c 22 42 4b 41 54 59 46 52 55 52 55 52 59 56 63 54 51 51 44 41 55 52 41 66 50 4d 66 58 43 22 3a 31 2c 22 50 50 58 47 53 43 5a 46 52 55 52 55 52 4e 48 50 5a 41 57 65 22 3a 32 2c 22 48 4d 62 56 41 47 61 47 62 5a 45 65 65 54 59 53 43 5a 43 22 3a Data Ascii: :1,"OOIBTVXINLcMNQKAENJHe":1,"NAFLeOeJYTBeDUfWZJEbOMFcUNbLWZHOaO":1,"OAZOXHHHXFZPeZeNSVMPYWbHRTHT":1,"YTBTRYPUTHLLEIbLRVZLBUaPYTeMJKDKaT":1,"YdXfdKNKNKZUTPTQTUMKPREFcEBYJO":1,"BKATYFRURURYVcTQQDAURAfPMfXC":1,"PPXGSCZFRURURNHPZAWe":2,"HMbVAGaGbZEeeTYSCZC":
2024-02-08 18:36:39 UTC	16384	IN	Data Raw: 45 41 62 61 54 61 54 61 45 54 22 3a 31 2c 22 66 65 62 64 53 41 59 46 63 61 46 55 59 4b 47 5a 4a 41 52 47 4e 4b 43 46 4b 4f 66 43 53 52 42 4a 4f 4f 49 42 42 4f 22 3a 31 2c 22 5a 64 4c 4e 4b 5a 4a 41 45 63 62 46 44 61 50 54 4a 45 50 46 57 46 51 48 54 22 3a 31 2c 22 48 56 55 42 59 42 42 56 59 55 41 44 44 62 64 45 63 4c 63 44 4e 4f 4c 56 59 5a 45 54 22 3a 32 2c 22 41 64 65 4b 62 4f 54 64 66 64 52 4d 65 62 66 53 50 48 49 63 4e 4c 52 49 47 4c 54 22 3a 31 2c 22 62 64 50 42 51 52 53 49 4e 66 41 4f 4e 57 65 44 65 52 54 4c 63 66 66 57 65 22 3a 31 2c 22 65 57 48 4d 48 4f 57 44 44 58 42 59 48 4e 65 45 66 48 63 49 4a 44 65 51 63 4a 55 58 4f 22 3a 31 2c 22 62 5a 57 4f 64 41 53 55 54 62 44 62 65 41 50 43 62 41 65 54 53 4b 65 22 3a 31 2c 22 47 43 4c 61 59 43 4b 64 46 59 Data Ascii: EAbaTaTaET":1,"febdSAYFcaFUYKGZJARGNKCFKOfCSRBJOOIBBO":1,"ZdLNKZJAEcbFDaPTJEPFWFQHT":1,"HVUBYBBVYUADDbdEcLcDNOLVYZET":2,"AdeKbOTdfdRMebfSPHIcNLRIGLT":1,"bdPBQRSINfAONWeDeRTLcffWe":1,"eWHMHOWDDXBYHNeEfHcIJDeQcJUXO":1,"bZWOdASUTbDbeAPCbAeTSKe":1,"GCLaYCKdFY
2024-02-08 18:36:39 UTC	16384	IN	Data Raw: 55 66 62 66 4b 42 5a 54 53 4a 65 4f 58 62 62 46 46 62 4a 46 53 4d 5a 44 61 46 46 63 61 65 22 3a 31 2c 22 4e 41 46 51 56 55 4e 4f 64 4f 4b 42 42 49 55 4a 4c 4d 46 66 4f 59 45 51 43 42 56 53 63 61 65 22 3a 31 2c 22 42 50 48 41 66 61 53 64 4e 54 44 49 58 61 63 47 4b 5a 43 43 56 52 53 65 62 51 41 43 22 3a 31 2c 22 55 45 54 54 4a 63 62 54 59 55 53 43 53 58 49 65 49 50 4c 46 62 41 61 64 4a 52 65 22 3a 31 2c 22 54 65 43 4f 65 4a 42 49 55 4a 4c 4d 46 51 63 47 44 5a 48 58 4a 4e 56 42 55 4b 63 4b 65 22 3a 31 2c 22 59 64 58 66 43 44 57 4f 4f 57 4e 45 61 55 50 66 53 43 4d 65 4a 45 43 42 4c 65 45 4e 4b 65 22 3a 32 2c 22 61 57 51 4f 63 59 54 42 41 5a 57 45 48 47 49 66 55 59 51 5a 41 43 59 4f 22 3a 31 2c 22 48 57 41 46 4e 65 4f 59 44 65 66 66 42 4b 64 46 44 50 42 49 46 Data Ascii: UfbfKBZTSJeOXbbFFbJFSMZDaFFcae":1,"NAFQVUNOdOKBBIUJLMFfOYEQCBVScae":1,"BPHAfaSdNTDIXacGKZCCVRSebQAC":1,"UETTJcbTYUSCSXIeIPLFbAadJRe":1,"TeCOeJBIUJLMFQcGDZHXJNVBUKcKe":1,"YdXfCDWOOWNEaUPfSCMeJECBLeENKe":2,"aWQOcYTBAZWEHGIfUYQZACYO":1,"HWAFNeOYDeffBKdFDPBIF
2024-02-08 18:36:39 UTC	15005	IN	Data Raw: 31 2c 22 50 50 58 47 46 52 55 52 55 52 59 4e 59 55 4e 5a 54 65 5a 46 59 52 43 45 4e 46 65 61 59 4c 54 52 52 65 22 3a 31 2c 22 48 57 41 46 4e 52 59 57 4d 56 62 58 45 51 4a 61 56 57 4d 44 48 65 22 3a 31 2c 22 61 57 51 4f 63 54 45 57 63 66 42 51 44 50 42 46 4f 22 3a 31 2c 22 66 65 66 53 4b 65 45 46 49 4d 4e 4a 50 64 52 66 44 52 62 61 54 61 54 61 45 54 22 3a 31 2c 22 62 51 47 42 56 49 5a 64 52 4a 56 56 50 65 50 50 53 50 44 48 43 4f 4c 63 4f 22 3a 31 2c 22 49 5a 56 47 50 52 46 66 45 46 4b 59 4f 65 65 4f 5a 62 4e 46 62 4b 48 44 48 54 22 3a 31 2c 22 4f 4f 49 42 42 51 4d 41 4c 48 59 59 66 50 4e 52 59 5a 57 44 4f 43 59 4a 57 63 43 22 3a 31 2c 22 48 56 50 5a 45 4c 57 62 4d 56 5a 41 4c 4f 43 58 53 57 4f 47 64 57 59 52 4a 4a 4e 41 50 4c 52 52 4a 4c 54 22 3a 31 2c 22 Data Ascii: 1,"PPXGFRURURYNYUNZTeZFYRCENFeaYLTRRe":1,"HWAFNRYWMVbXEQJaVWMDHe":1,"aWQOcTEWcfBQDPBFO":1,"fefSKeEFIMNJPdRfDRbaTaTaET":1,"bQGBVIZdRJVVPePPSPDHCOLcO":1,"IZVGPRFfEFKYOeeOZbNFbKHDHT":1,"OOIBBQMALHYYfPNRYZWDOCYJWcC":1,"HVPZELWbMVZALOCXSWOGdWYRJJNAPLRRJLT":1,"
2024-02-08 18:36:39 UTC	16384	IN	Data Raw: 2d 63 6f 6e 74 61 69 6e 65 72 5f 5f 6d 61 69 6e 22 3e 53 6b 69 70 20 74 6f 20 6d 61 69 6e 20 63 6f 6e 74 65 6e 74 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 61 3e 0a 3c 2f 64 69 76 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 73 59 6b 55 6c 53 4e 48 4a 74 71 34 4b 6e 4d 22 3e 0a 77 69 6e 64 6f 77 2e 75 74 61 67 5f 64 61 74 61 20 3d 20 7b 0a 73 69 74 65 3a 20 27 62 6f 6f 6b 69 6e 67 73 32 27 2c 0a 73 74 79 70 65 69 64 3a 20 27 31 27 2c 0a 61 63 74 69 6f 6e 3a 20 27 70 61 63 6b 61 67 65 73 5f 63 69 74 79 27 2c 0a 63 72 74 3a 20 27 31 27 2c 0a 66 62 70 3a 20 27 31 27 2c 0a 65 78 70 31 3a 20 27 27 2c 0a 65 78 70 32 3a 20 27 30 27 2c 0a 62 65 6d 3a 20 27 27 2c 0a 62 69 70 3a 20 27 Data Ascii: -container__main">Skip to main content</div></div></a></div><script type="text/javascript" nonce="sYkUlSNHJtq4KnM">window.utag_data = {site: 'bookings2',stypeid: '1',action: 'packages_city',crt: '1',fbp: '1',exp1: '',exp2: '0',bem: '',bip: '

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
830	192.168.2.5	50695	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:39 UTC	624	OUT	GET /static/css/landing_pages_common_cloudfront_sd.iq_ltr/af1183ce024d54cd405252c30ee9c08c26b6d4f6.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:40 UTC	794	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 83810 Connection: close Server: nginx Date: Wed, 31 Jan 2024 03:52:18 GMT Last-Modified: Tue, 30 Jan 2024 07:07:17 GMT ETag: "65b8a025-14762" Expires: Fri, 01 Mar 2024 03:52:18 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 8415794d557292780ff382a8c5bd6058.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: K4PK4N-xZ10zki553TU2BXT_rtkxkf2tj41Po5b5SvF6VNzj8NNkpA== Age: 744262
2024-02-08 18:36:40 UTC	16384	IN	Data Raw: 2e 62 62 74 6f 6f 6c 2d 6e 6f 74 69 66 69 63 61 74 69 6f 6e 7b 63 6c 65 61 72 3a 62 6f 74 68 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 36 65 36 65 36 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 66 61 66 63 66 66 7d 2e 62 62 74 6f 6f 6c 2d 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2d 2d 74 6f 70 2d 6d 65 6e 75 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 77 68 69 74 65 29 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 65 62 66 33 66 66 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 31 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 29 3b Data Ascii: .bbtool-notification{clear:both;position:relative;background-color:#e6e6e6;border-bottom:1px solid #fafcff}.bbtool-notification--top-menu{background-color:var(--bui_color_white);border-bottom:1px solid #ebf3ff;-webkit-box-shadow:0 1px 2px rgba(0,0,0,0.1);
2024-02-08 18:36:40 UTC	16384	IN	Data Raw: 74 69 6f 6e 3a 72 69 67 68 74 7d 2e 74 6f 6f 6c 74 69 70 2d 72 69 67 68 74 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 31 70 78 7d 2e 74 6f 6f 6c 74 69 70 2d 72 69 67 68 74 20 2e 74 6f 6f 6c 74 69 70 2d 61 72 72 6f 77 7b 72 69 67 68 74 3a 61 75 74 6f 3b 6c 65 66 74 3a 30 3b 77 69 64 74 68 3a 31 32 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 6c 65 66 74 7d 2e 74 6f 6f 6c 74 69 70 2d 61 6c 69 67 6e 2d 72 69 67 68 74 20 2e 74 6f 6f 6c 74 69 70 2d 61 72 72 6f 77 7b 72 69 67 68 74 3a 33 35 70 78 3b 6c 65 66 74 3a 61 75 74 6f 3b 77 69 64 74 68 3a 32 30 70 78 7d 2e 74 6f 6f 6c 74 69 70 2d 61 6c 69 Data Ascii: tion:right}.tooltip-right{margin-right:0;padding-right:0;margin-left:5px;padding-left:11px}.tooltip-right .tooltip-arrow{right:auto;left:0;width:12px;background-position:left}.tooltip-align-right .tooltip-arrow{right:35px;left:auto;width:20px}.tooltip-ali
2024-02-08 18:36:40 UTC	16384	IN	Data Raw: 62 6f 78 2d 2d 70 61 69 6e 74 65 64 2e 2d 73 6d 61 6c 6c 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 36 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 36 70 78 7d 2e 73 62 2d 73 65 61 72 63 68 62 6f 78 2e 2d 73 6d 61 6c 6c 20 2e 73 62 2d 73 65 61 72 63 68 62 6f 78 5f 5f 6c 61 62 65 6c 2e 2d 6d 61 69 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 7d 2e 73 62 2d 73 65 61 72 63 68 62 6f 78 20 2e 62 2d 66 6f 72 6d 5f 5f 62 6f 6f 6b 65 72 2d 74 79 70 65 2d 2d 68 6f 74 65 6c 2c 2e 73 62 2d 73 65 61 72 63 68 62 6f 78 20 2e 62 2d 66 6f 72 6d 5f 5f 62 6f 6f 6b 65 72 2d 74 79 70 65 2d 2d 69 6e 64 65 78 2c 2e 73 62 2d 73 65 61 72 63 68 62 6f 78 20 2e 62 2d 66 6f 72 6d 5f 5f 62 6f 6f 6b 65 72 2d 74 79 70 65 2d 2d 70 72 6f 66 69 6c 65 2c 2e 73 62 2d 73 65 61 72 63 Data Ascii: box--painted.-small{padding-left:6px;padding-right:6px}.sb-searchbox.-small .sb-searchbox__label.-main{font-size:16px}.sb-searchbox .b-form__booker-type--hotel,.sb-searchbox .b-form__booker-type--index,.sb-searchbox .b-form__booker-type--profile,.sb-searc
2024-02-08 18:36:40 UTC	16384	IN	Data Raw: 6f 6c 64 65 72 2d 74 65 78 74 7b 68 65 69 67 68 74 3a 32 34 70 78 7d 2e 64 65 73 74 69 6e 61 74 69 6f 6e 2d 74 79 70 65 5f 5f 77 72 61 70 70 65 72 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 38 70 78 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 73 62 2d 61 75 74 6f 63 6f 6d 70 6c 65 74 65 5f 5f 62 61 64 67 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 38 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 38 70 78 7d 2e 73 62 2d 61 75 74 6f 63 6f 6d 70 6c 65 74 65 5f 5f 69 74 65 6d 2d 2d 74 61 62 62 65 64 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 38 30 70 78 21 69 6d 70 6f 72 74 61 6e 74 3b 62 61 63 6b 67 72 Data Ascii: older-text{height:24px}.destination-type__wrapper{display:inline-block;margin:0 0 0 8px;display:none}.sb-autocomplete__badge{font-size:12px;line-height:18px;font-weight:700;margin:0 0 0 8px}.sb-autocomplete__item--tabbed{padding-left:80px!important;backgr
2024-02-08 18:36:40 UTC	1514	IN	Data Raw: 65 7d 2e 61 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 20 2e 78 70 5f 5f 73 65 61 72 63 68 20 6c 61 62 65 6c 3a 6e 6f 74 28 2e 73 62 2d 64 65 73 74 69 6e 61 74 69 6f 6e 2d 6c 61 62 65 6c 2d 73 72 29 2c 2e 72 65 6e 74 61 6c 63 61 72 73 20 2e 78 70 5f 5f 73 65 61 72 63 68 20 6c 61 62 65 6c 3a 6e 6f 74 28 2e 73 62 2d 64 65 73 74 69 6e 61 74 69 6f 6e 2d 6c 61 62 65 6c 2d 73 72 29 2c 2e 66 6c 69 67 68 74 73 20 23 66 6c 69 67 68 74 73 5f 5f 66 72 6f 6d 20 6c 61 62 65 6c 3a 6e 6f 74 28 2e 73 62 2d 64 65 73 74 69 6e 61 74 69 6f 6e 2d 6c 61 62 65 6c 2d 73 72 29 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 30 70 78 21 69 6d 70 6f 72 74 61 6e 74 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 66 6c 69 67 68 74 73 20 2e 78 70 5f 5f 73 65 61 72 Data Ascii: e}.accommodation .xp__search label:not(.sb-destination-label-sr),.rentalcars .xp__search label:not(.sb-destination-label-sr),.flights #flights__from label:not(.sb-destination-label-sr){margin-left:50px!important;padding-left:0!important}.flights .xp__sear
2024-02-08 18:36:40 UTC	16384	IN	Data Raw: 2e 78 70 5f 5f 62 75 74 74 6f 6e 20 2e 73 62 2d 73 65 61 72 63 68 62 6f 78 5f 5f 62 75 74 74 6f 6e 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 74 61 5f 68 69 67 68 6c 69 67 68 74 65 64 29 7d 23 63 68 65 63 6b 69 6e 2c 23 63 68 65 63 6b 6f 75 74 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6c 65 66 74 3a 30 3b 7a 2d 69 6e 64 65 78 3a 2d 31 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 74 6f 70 3a 30 7d 2e 73 62 2d 73 65 61 72 63 68 62 6f 78 5f 5f 6c 61 62 65 6c 2e 2d 73 6d 61 6c 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 65 6d 70 68 61 73 69 7a 65 64 5f 32 5f 66 6f 6e 74 2d 73 69 7a 65 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 Data Ascii: .xp__button .sb-searchbox__button:hover{background:var(--bui_color_cta_highlighted)}#checkin,#checkout{position:absolute;left:0;z-index:-1;height:100%;top:0}.sb-searchbox__label.-small{font-size:var(--bui_font_emphasized_2_font-size);font-weight:var(--bui
2024-02-08 18:36:40 UTC	376	IN	Data Raw: 6d 73 2d 66 6c 65 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 2e 6c 70 2d 75 73 70 73 5f 5f 69 6e 6e 65 72 7b 77 69 64 74 68 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 31 30 30 70 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 Data Ascii: ms-flex-align:center;align-items:center}.lp-usps__inner{width:100%;max-width:1100px;display:-webkit-box;display:-webkit-flex;display:-ms-flexbox;display:flex;-webkit-box-pack:justify;-webkit-justify-content:space-between;-ms-flex-pack:justify;justify-cont

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
831	192.168.2.5	50696	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:39 UTC	630	OUT	GET /static/css/packages_city_landing_page_cloudfront_sd.iq_ltr/93424469ff1c9690f5bca8925db03679a0eb6072.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:40 UTC	780	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 4520 Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:40 GMT Last-Modified: Fri, 28 Jul 2023 11:29:02 GMT ETag: "64c3a67e-11a8" Expires: Sat, 09 Mar 2024 18:36:40 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 086e2cd5d94fa729de58c51b5666e0e4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: hVI39LRA6QfbSsmsUtl01P14NgiqSwytMoQsALmETYriq96yt82IsQ==
2024-02-08 18:36:40 UTC	4520	IN	Data Raw: 61 2e 62 75 69 2d 6c 69 6e 6b 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 62 75 69 2d 66 2d 66 6f 6e 74 2d 64 69 73 70 6c 61 79 5f 74 68 72 65 65 2c 2e 62 75 69 2d 66 2d 66 6f 6e 74 2d 64 69 73 70 6c 61 79 5f 74 77 6f 2c 2e 62 75 69 2d 66 2d 66 6f 6e 74 2d 64 69 73 70 6c 61 79 5f 6f 6e 65 2c 2e 62 75 69 2d 66 2d 66 6f 6e 74 2d 68 65 61 64 69 6e 67 2c 2e 62 75 69 2d 66 2d 66 6f 6e 74 2d 65 6d 70 68 61 73 69 7a 65 64 2c 2e 62 75 69 2d 66 2d 66 6f 6e 74 2d 66 65 61 74 75 72 65 64 2c 2e 62 75 69 2d 66 2d 66 6f 6e 74 2d 62 6f 64 79 2c 2e 62 75 69 2d 66 2d 66 6f 6e 74 2d 63 61 70 74 69 6f 6e 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 2e 6e 6f 62 67 2e 72 65 73 6f 72 74 5f 73 65 61 72 63 68 72 65 73 75 6c 74 73 20 23 62 6f 64 79 63 6f Data Ascii: a.bui-link{font-weight:400}.bui-f-font-display_three,.bui-f-font-display_two,.bui-f-font-display_one,.bui-f-font-heading,.bui-f-font-emphasized,.bui-f-font-featured,.bui-f-font-body,.bui-f-font-caption{margin:0;padding:0}.nobg.resort_searchresults #bodyco

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
832	192.168.2.5	50699	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:39 UTC	567	OUT	GET /psb/capla/static/css/client.d65aeb7e.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:40 UTC	610	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 209722 Connection: close Date: Thu, 08 Feb 2024 18:36:41 GMT Last-Modified: Wed, 18 Oct 2023 10:43:39 GMT ETag: "31d1ee8456bf79d48641456f821bb46b" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 3xoacJ5MH18WZvItwKhn32haenrYuCBP Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 fcb94596db202c75ac0e559b3183be72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: wZDVSFfjHpslFHHvUEroGlq9ZZvhtmgBsUfgpCjHM8qmad6u0sZx4A== Vary: Origin
2024-02-08 18:36:40 UTC	15774	IN	Data Raw: 2e 64 62 31 35 30 66 65 63 65 34 2c 2e 64 62 31 35 30 66 65 63 65 34 3e 2a 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 63 6c 65 61 72 3a 62 6f 74 68 7d 2e 62 32 33 32 61 33 35 30 32 62 7b 77 69 64 74 68 3a 63 61 6c 63 28 38 2e 33 33 33 33 33 25 20 2d 20 76 61 72 28 2d 2d 62 75 69 5f 73 74 61 63 6b 5f 67 61 70 29 29 7d 2e 62 31 65 39 66 38 61 36 31 64 7b 77 69 64 74 68 3a 63 61 6c 63 28 31 36 2e 36 36 36 36 37 25 20 2d 20 76 61 72 28 2d 2d 62 75 69 5f 73 74 61 63 6b 5f 67 61 70 29 29 7d 2e 63 34 34 63 33 37 35 31 35 65 7b 77 69 64 74 68 3a 63 61 6c 63 28 32 35 25 20 2d 20 76 61 72 28 2d 2d 62 75 69 5f 73 74 61 63 6b 5f 67 61 70 29 29 7d 2e 61 37 63 66 31 61 36 62 31 64 7b 77 69 64 74 68 3a 63 61 6c 63 28 33 33 2e 33 33 33 33 33 25 Data Ascii: .db150fece4,.db150fece4>*{box-sizing:border-box;clear:both}.b232a3502b{width:calc(8.33333% - var(--bui_stack_gap))}.b1e9f8a61d{width:calc(16.66667% - var(--bui_stack_gap))}.c44c37515e{width:calc(25% - var(--bui_stack_gap))}.a7cf1a6b1d{width:calc(33.33333%
2024-02-08 18:36:40 UTC	18	IN	Data Raw: 37 35 7b 2d 2d 62 75 69 5f 73 74 61 63 6b 5f 63 6f 6d Data Ascii: 75{--bui_stack_com
2024-02-08 18:36:40 UTC	16384	IN	Data Raw: 70 65 6e 73 61 74 69 6f 6e 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 33 78 29 7d 2e 66 63 63 62 37 35 63 64 37 61 7b 2d 2d 62 75 69 5f 73 74 61 63 6b 5f 63 6f 6d 70 65 6e 73 61 74 69 6f 6e 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 2e 65 32 33 64 39 31 61 37 66 32 7b 2d 2d 62 75 69 5f 73 74 61 63 6b 5f 63 6f 6d 70 65 6e 73 61 74 69 6f 6e 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 36 78 29 7d 2e 61 36 32 34 34 36 32 34 66 63 7b 2d 2d 62 75 69 5f 73 74 61 63 6b 5f 63 6f 6d 70 65 6e 73 61 74 69 6f 6e 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 38 78 29 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 32 38 30 70 78 29 7b 2e 61 32 62 62 30 33 39 30 63 30 7b 2d 2d 62 75 69 5f 73 Data Ascii: pensation:var(--bui_spacing_3x)}.fccb75cd7a{--bui_stack_compensation:var(--bui_spacing_4x)}.e23d91a7f2{--bui_stack_compensation:var(--bui_spacing_6x)}.a6244624fc{--bui_stack_compensation:var(--bui_spacing_8x)}}@media (min-width:1280px){.a2bb0390c0{--bui_s
2024-02-08 18:36:40 UTC	1024	IN	Data Raw: 3b 2d 2d 62 75 69 5f 61 6e 69 6d 61 74 69 6f 6e 5f 64 69 73 61 70 70 65 61 72 5f 74 69 6d 69 6e 67 5f 66 75 6e 63 74 69 6f 6e 3a 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 32 2c 30 2c 31 2c 30 2e 38 29 3b 2d 2d 62 75 69 5f 61 6e 69 6d 61 74 69 6f 6e 5f 70 61 67 65 5f 74 72 61 6e 73 69 74 69 6f 6e 5f 65 78 69 74 3a 30 2e 34 38 73 20 63 75 62 69 63 2d 62 65 7a 69 65 72 28 31 2c 30 2c 31 2c 31 29 3b 2d 2d 62 75 69 5f 61 6e 69 6d 61 74 69 6f 6e 5f 70 61 67 65 5f 74 72 61 6e 73 69 74 69 6f 6e 5f 65 78 69 74 5f 64 75 72 61 74 69 6f 6e 3a 30 2e 34 38 73 3b 2d 2d 62 75 69 5f 61 6e 69 6d 61 74 69 6f 6e 5f 70 61 67 65 5f 74 72 61 6e 73 69 74 69 6f 6e 5f 65 78 69 74 5f 74 69 6d 69 6e 67 5f 66 75 6e 63 74 69 6f 6e 3a 63 75 62 69 63 2d 62 65 7a 69 65 72 28 31 2c 30 Data Ascii: ;--bui_animation_disappear_timing_function:cubic-bezier(0.2,0,1,0.8);--bui_animation_page_transition_exit:0.48s cubic-bezier(1,0,1,1);--bui_animation_page_transition_exit_duration:0.48s;--bui_animation_page_transition_exit_timing_function:cubic-bezier(1,0
2024-02-08 18:36:40 UTC	16384	IN	Data Raw: 65 6d 46 6f 6e 74 2c 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 53 65 67 6f 65 20 55 49 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 5f 32 5f 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 5f 32 5f 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 5f 32 5f 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 36 70 78 3b 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 5f 32 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 53 65 67 6f 65 20 55 49 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 Data Ascii: emFont,-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;--bui_font_small_2_font-size:10px;--bui_font_small_2_font-weight:500;--bui_font_small_2_line-height:16px;--bui_font_small_2_font-family:BlinkMacSystemFont,-apple-system,Segoe UI,Roboto,Helvet
2024-02-08 18:36:40 UTC	1024	IN	Data Raw: 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 6f 72 64 65 72 5f 61 6c 74 29 7d 2e 62 30 66 39 36 38 36 61 32 66 20 2e 64 65 63 30 30 37 38 65 37 63 3a 61 66 74 65 72 7b 62 6f 72 64 65 72 2d 72 69 67 68 74 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 62 6f 72 64 65 72 29 3b 62 6f 72 64 65 72 2d 74 6f 70 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 62 6f 72 64 65 72 29 7d 2e 62 32 32 32 62 64 34 62 34 62 3a 61 66 74 65 72 2c 2e 62 32 32 32 62 64 34 62 34 62 3a 62 65 66 6f 72 65 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 63 75 72 72 65 6e 74 63 6f 6c 6f 72 7d 2e 62 32 32 32 62 64 34 62 34 62 20 2e 64 65 63 30 30 37 38 65 37 63 3a 62 65 66 6f 72 65 Data Ascii: r(--bui_color_border_alt)}.b0f9686a2f .dec0078e7c:after{border-right-color:var(--bui_color_destructive_border);border-top-color:var(--bui_color_destructive_border)}.b222bd4b4b:after,.b222bd4b4b:before{background:currentcolor}.b222bd4b4b .dec0078e7c:before
2024-02-08 18:36:40 UTC	16384	IN	Data Raw: 73 70 69 6e 6e 65 72 5f 69 6e 6e 65 72 5f 61 66 74 65 72 5f 62 6f 72 64 65 72 5f 77 69 64 74 68 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 68 61 6c 66 29 2a 33 29 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 35 37 36 70 78 29 7b 2e 66 65 35 66 37 39 64 38 38 32 7b 2d 2d 62 75 69 5f 73 70 69 6e 6e 65 72 5f 73 69 7a 65 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 3b 2d 2d 62 75 69 5f 73 70 69 6e 6e 65 72 5f 62 65 66 6f 72 65 5f 73 69 7a 65 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 68 61 6c 66 29 3b 2d 2d 62 75 69 5f 73 70 69 6e 6e 65 72 5f 69 6e 6e 65 72 5f 61 66 74 65 72 5f 62 6f 72 64 65 72 5f 77 69 64 74 68 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 68 61 6c 66 29 Data Ascii: spinner_inner_after_border_width:calc(var(--bui_spacing_half)*3)}@media (min-width:576px){.fe5f79d882{--bui_spinner_size:var(--bui_spacing_4x);--bui_spinner_before_size:var(--bui_spacing_half);--bui_spinner_inner_after_border_width:var(--bui_spacing_half)
2024-02-08 18:36:40 UTC	16384	IN	Data Raw: 74 74 6f 6e 5f 6c 61 72 67 65 5f 6d 61 72 67 69 6e 5f 69 6e 6c 69 6e 65 5f 73 74 61 72 74 2c 69 6e 69 74 69 61 6c 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 2a 31 32 29 3b 6d 69 6e 2d 77 69 64 74 68 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 2a 31 32 29 3b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 20 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 20 2b 20 76 61 72 28 2d 2d 62 75 69 5f 62 75 74 74 6f 6e 5f 69 6e 6c 69 6e 65 5f 70 61 64 64 69 6e 67 5f 65 78 74 72 61 2c 20 30 70 78 29 29 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 32 38 30 70 78 29 7b 2e Data Ascii: tton_large_margin_inline_start,initial);min-height:calc(var(--bui_spacing_1x)12);min-width:calc(var(--bui_spacing_1x)12);padding:var(--bui_spacing_2x) calc(var(--bui_spacing_4x) + var(--bui_button_inline_padding_extra, 0px))}}@media (min-width:1280px){.
2024-02-08 18:36:40 UTC	2048	IN	Data Raw: 7d 2e 66 63 63 30 31 39 36 38 35 35 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 72 61 64 69 75 73 5f 32 30 30 29 7d 2e 63 32 61 63 63 63 39 38 37 30 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 72 61 64 69 75 73 5f 33 30 30 29 7d 2e 64 66 39 37 39 63 65 32 61 32 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 61 6c 74 29 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 36 78 29 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 77 Data Ascii: }.fcc0196855{border-radius:var(--bui_border_radius_200)}.c2accc9870{border-radius:var(--bui_border_radius_300)}.df979ce2a2{background-color:var(--bui_color_background_alt);box-sizing:border-box;height:100%;padding:var(--bui_spacing_6x);position:absolute;w
2024-02-08 18:36:40 UTC	16384	IN	Data Raw: 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 72 61 6e 64 5f 70 72 69 6d 61 72 79 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 64 79 6e 61 6d 69 63 29 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 6f 6e 5f 62 72 61 6e 64 5f 70 72 69 6d 61 72 79 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 64 79 6e 61 6d 69 63 29 7d 2e 66 33 36 61 34 39 36 31 37 37 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 62 6f 72 64 65 72 29 7d 2e 63 33 66 61 33 38 38 37 65 64 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 62 6f 72 64 65 72 29 7d 2e 63 61 38 32 36 34 32 37 65 35 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a Data Ascii: lor:var(--bui_color_brand_primary_background_dynamic);color:var(--bui_color_on_brand_primary_background_dynamic)}.f36a496177{border-color:var(--bui_color_action_border)}.c3fa3887ed{border-color:var(--bui_color_destructive_border)}.ca826427e5{border-color:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
833	192.168.2.5	50697	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:39 UTC	575	OUT	GET /psb/capla/static/css/da34a25a.596e2bbe.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:40 UTC	608	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 5258 Connection: close Date: Thu, 08 Feb 2024 18:36:41 GMT Last-Modified: Mon, 23 Oct 2023 15:59:42 GMT ETag: "4a228916b32250d7386cc77d8886133c" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: jEkfbSZ_Bpex.wWGezM0w1up60AH4QxR Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 f4c38e024a95b76a27c9f3dc9ff2eda6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 1Xm0ATcUAEt1f3HoA3ECGVuS0llZr4K9NH-npwVacZseXSQibCMh6g== Vary: Origin
2024-02-08 18:36:40 UTC	5258	IN	Data Raw: 2e 63 39 36 64 38 31 34 34 36 31 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 63 65 6e 74 5f 62 61 63 6b 67 72 6f 75 6e 64 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 76 61 72 28 2d 2d 62 75 69 5f 62 6f 72 64 65 72 5f 72 61 64 69 75 73 5f 32 30 30 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 76 61 72 28 2d 2d 62 75 69 5f 73 68 61 64 6f 77 5f 31 30 30 29 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 7d 2e 63 39 36 64 38 31 34 34 36 31 3e 2a 7b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 7d 2e 63 39 36 64 38 31 34 34 36 31 3e 3a 6c 61 73 74 2d 63 68 69 6c 64 Data Ascii: .c96d814461{background-color:var(--bui_color_accent_background);border-radius:var(--bui_border_radius_200);box-shadow:var(--bui_shadow_100);display:flex;padding:var(--bui_spacing_1x)}.c96d814461>*{margin-right:var(--bui_spacing_1x)}.c96d814461>:last-child

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
834	192.168.2.5	50698	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:39 UTC	575	OUT	GET /psb/capla/static/css/0de3785e.401967bd.chunk.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:40 UTC	584	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 606 Connection: close Date: Thu, 08 Feb 2024 18:36:41 GMT Last-Modified: Wed, 18 Oct 2023 10:43:39 GMT ETag: "e7873a194c1c3d1e24807a3504b1558e" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: OpCvh_x0qc5moy.96NhI.Qe5zPZJfSJW Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 7eeed291abf48890d3f36565208941a8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: wm90OSc32_5ADirhvnkJ8k0ujcS8gnqHRzBGHrcPUhMz9AdP6DG2bQ== Vary: Origin
2024-02-08 18:36:40 UTC	606	IN	Data Raw: 2e 63 63 35 61 63 63 34 31 36 65 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 2e 62 37 39 39 62 61 38 33 34 35 7b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 73 68 72 69 6e 6b 3a 30 3b 68 65 69 67 68 74 3a 34 30 70 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 31 36 70 78 3b 77 69 64 74 68 3a 34 30 70 78 7d 2e 66 32 63 36 32 37 66 33 31 34 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b Data Ascii: .cc5acc416e{margin-bottom:var(--bui_spacing_4x);margin-top:var(--bui_spacing_4x)}.b799ba8345{align-items:center;border-radius:50%;display:flex;flex-shrink:0;height:40px;justify-content:center;margin-right:16px;width:40px}.f2c627f314{box-sizing:border-box;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
835	192.168.2.5	50701	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:40 UTC	652	OUT	GET /static/img/flags/new/48-squared/us/fa2b2a0e643c840152ba856a8bb081c7ded40efa.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:40 UTC	769	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 642 Connection: close Server: nginx Date: Wed, 17 Jan 2024 11:39:09 GMT Last-Modified: Mon, 07 Sep 2020 10:40:08 GMT ETag: "5f560e08-282" Expires: Fri, 16 Feb 2024 11:39:09 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 a01680a1fee7e35f1738191420d98822.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 1i0EljZowktLdNjHf5kN_yCxY2gVCmfjiW2MEkU4pyMoWptRHIIWvw== Age: 1925851
2024-02-08 18:36:40 UTC	642	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 08 03 00 00 00 60 dc 09 b5 00 00 00 75 50 4c 54 45 b4 1f 30 3c 39 70 b4 1f 30 97 27 40 ff ff ff b4 1f 30 3c 3a 70 d0 73 7d 54 53 82 ec c7 cb e3 ab b1 61 5f 8b 48 46 79 6d 6b 94 49 46 79 be 3b 49 91 90 ae c2 c2 d2 79 78 9c 85 84 a6 48 47 79 9d 9c b7 aa a9 c0 b6 b5 c9 c7 57 64 f3 f3 f6 db da e4 ce cd db 96 26 40 e7 e7 ed 6d 6b 93 9e 9d b7 ce ce db a1 47 5e b5 b5 c9 9e 9c b8 c0 a4 b4 b7 87 9a ae 6c 81 d6 1f 19 b1 00 00 00 04 74 52 4e 53 df bf bf bf 3b 25 6a 12 00 00 01 b8 49 44 41 54 48 c7 8c d4 61 93 94 30 0c 06 60 d4 f5 35 9a 14 4b 69 41 38 d9 dd bb 53 ff ff 4f b4 79 b9 b9 ce c0 ce 68 3e 3c d3 81 09 34 a4 a1 fb f0 1f f1 e9 63 8b 0e 30 83 87 50 6d eb 76 e5 e7 e7 16 1d fa 69 10 bc 89 69 Data Ascii: PNGIHDR00`uPLTE0<9p0'@0<:ps}TSa_HFymkIFy;IyxHGyWd&@mkG^ltRNS;%jIDATHa0`5KiA8SOyh><4c0Pmvii

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
836	192.168.2.5	50702	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:40 UTC	682	OUT	GET /xdata/images/city/square250/976919.webp?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:40 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Tue, 30 Jan 2024 01:35:16 GMT ETag: "bb2473dd82f02dd4000ed979bc6da66dace09676" Content-Language: 17122 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 4a91a321d4c2ab7334c6f285093956ae.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: vwhtJCx7coGHdvaHSz8kGXRc18aHX5-UWSC13E1lhb_RKWqemezunQ== Age: 838884
2024-02-08 18:36:40 UTC	15835	IN	Data Raw: 34 32 65 32 0d 0a 52 49 46 46 da 42 00 00 57 45 42 50 56 50 38 20 ce 42 00 00 30 c7 00 9d 01 2a fa 00 fa 00 3e 6d 2a 91 45 a6 23 a2 17 db 56 88 60 06 c4 a0 67 bd 41 f4 18 6c 67 a1 7f 33 ce a7 95 fc 4e 8e 3e 0a 19 5b ce c9 ef 7d 40 6e 44 e7 5d 72 5a f1 cf f3 5f 95 5e 6b f8 b1 f6 e7 ef 3f e5 ff eb ff 8e f7 09 c7 bf 5f ba 87 7c f3 f0 9f f0 bf c5 fb 61 fe 5b ff 27 f8 cf 17 fe 27 ff c1 fe 4b d8 17 f3 3f e8 1f ec 3f bc fa f6 fd b7 69 46 db fe b7 f6 b3 d8 47 dc bf b5 7f da ff 27 ea 9b f3 ff fa 7f d5 7a a5 f6 13 ff 47 b8 0f f4 cf ec df f5 bd 5b ff 79 e1 6b f7 bf f6 7f b2 5f 00 ff d2 7f bd 7f eb ff 33 fe 9f e1 c7 fb cf fe df ee 3f dd 7e ee fb bf fd 83 fd 6f ed 77 c0 e7 ec 3f a6 cf ff ff 79 9f b8 ff ff fd e8 49 73 43 7a 0a 95 79 ce cf 0f 43 f8 f1 61 53 e7 12 24 13 Data Ascii: 42e2RIFFBWEBPVP8 B0>mE#V`gAlg3N>[}@nD]rZ_^k?_\|a[''K??iFG'zG[yk_3?~ow?yIsCzyCaS$
2024-02-08 18:36:40 UTC	1295	IN	Data Raw: bd ee 7d 7d 9f 7e 7d 47 e0 76 3c d5 47 9b de ee 57 0a 03 ae 1d 81 77 5a 7b f6 49 e3 90 e8 93 65 42 38 8a 8a 11 97 4c 1a ab 9d d0 d8 84 e0 62 9f 44 19 b4 b9 fe 84 3d 81 5d f1 15 b1 88 70 52 b8 60 31 4d 00 23 f6 ca 21 ea 84 de e9 ea 9d b9 16 ec 75 28 c5 3f 27 6c d6 d7 e1 fa 26 04 cb ec cd 52 a5 f6 6b dc 9d 00 d6 44 d7 2c df 8b ce c8 bb 2c 9c 8b b8 88 67 df 0f 6f ca e4 83 bc e5 83 56 33 86 8a fa 64 3b c6 b9 dd 4e 43 2d c8 cb cb 57 dc 3b a1 b9 b5 b9 a1 00 47 75 4a 87 24 19 22 25 09 5c 81 80 6d b4 8a 82 0f 84 8a 33 54 a4 3b 01 cb 5d 97 e1 be 66 c3 0e ee 16 49 80 0d ab c8 c2 30 1a 40 c9 ee 8c 2a d4 8c c0 a4 42 72 43 9f 76 c0 ca ce af 14 b1 87 48 3f e1 e2 ee 10 23 e6 7e ea d2 af 00 be c5 42 9e a7 80 b3 94 47 82 ae 22 8e 5f 89 65 a0 ff 19 36 0b 2c d9 0d 29 9e cc Data Ascii: }}~}Gv<GWwZ{IeB8LbD=]pR`1M#!u(?'l&RkD,,goV3d;NC-W;GuJ$"%\m3T;]fI0@*BrCvH?#~BG"_e6,)
2024-02-08 18:36:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
837	192.168.2.5	50703	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:40 UTC	682	OUT	GET /xdata/images/city/square250/976708.webp?k=cb62481ca3494ac4e0b030345eedc77024732fb227f5642c773e5a11f534016c&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:40 UTC	537	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:40 GMT ETag: "7a92d4fc9cef018cd7367cd5643c0caa26b048a5" Content-Language: 13904 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Miss from cloudfront Via: 1.1 3f95374273631adbfd8e0d0a9f6d7b64.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Sx4XH_LBrGs1jCryC_fDgZ1-9THLd9aEVfF5X9VH1WqA8VHtWOhEnA==
2024-02-08 18:36:40 UTC	13912	IN	Data Raw: 33 36 35 30 0d 0a 52 49 46 46 48 36 00 00 57 45 42 50 56 50 38 20 3c 36 00 00 f0 ae 00 9d 01 2a fa 00 fa 00 3e 6d 30 92 46 a6 24 22 a1 ab 55 5c 50 c0 0d 89 65 6b 2b ff bc 03 71 a3 86 70 00 c7 6d 1e d7 8b 7f dd b7 97 07 37 e4 12 c3 5f c1 b0 9a 95 1a ac 45 a6 3a 8f fb 1f f0 7f bb 9f e3 7d b7 f2 2f f0 1f ce 79 8f f6 5f d2 9e d9 3f a2 fd 94 f1 b7 e3 3f fc 5e a0 be d7 ff 87 e9 63 f5 bd bf 3b c7 fa 8f fb de a2 3e f6 7d 8f ff 07 a1 cf d0 f9 a5 f5 ef d8 1b f5 a7 d1 ef f5 be 18 7f 6f ff 2b fb 3f f0 0d fd 1f fc 4f fe 2f f5 5e ca 3f 61 7a 66 fd 8b fd a7 ed 9f c1 17 4d cf dd 13 7c e6 a1 51 36 3a 08 04 ef d3 82 d7 13 33 45 87 94 2c ab e5 9e ff 3a 6e 40 cc f2 f0 9d 70 c2 ea 23 3b 4d 7f 94 27 cc e8 45 63 da 56 e8 dc 88 f2 5f aa 02 98 8d 79 91 fc 1f dd 21 84 ea d0 af 87 Data Ascii: 3650RIFFH6WEBPVP8 <6*>m0F$"U\Pek+qpm7_E:}/y_??^c;>}o+?O/^?azfM\|Q6:3E,:n@p#;M'EcV_y!
2024-02-08 18:36:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
838	192.168.2.5	50704	172.64.155.119	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:40 UTC	597	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:40 UTC	370	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:36:40 GMT Content-Type: application/json Content-Length: 68 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8525fac2fa3153cc-ATL
2024-02-08 18:36:40 UTC	68	IN	Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 47 41 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 47 65 6f 72 67 69 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d Data Ascii: {"country":"US","state":"GA","stateName":"Georgia","continent":"NA"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
839	192.168.2.5	50705	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:40 UTC	682	OUT	GET /xdata/images/city/square250/352166.webp?k=70257e02f84d33fc68f9da008ec0c40b54a86ce522305dfa807b0bc449ee690c&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:41 UTC	537	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:41 GMT ETag: "a351111d46999d06faae3832f723a2e93a4df5fc" Content-Language: 21134 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Miss from cloudfront Via: 1.1 5988b4ae4648c0fec3c60a3cca580092.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Iq2FFjkgW627Hiesuh_cQGb4-f4_BMQOIx-jSqdQSBBPd-lonl2dkA==
2024-02-08 18:36:41 UTC	16384	IN	Data Raw: 35 32 38 65 0d 0a 52 49 46 46 86 52 00 00 57 45 42 50 56 50 38 20 7a 52 00 00 f0 db 00 9d 01 2a fa 00 fa 00 3e 65 26 8f 45 a5 a3 22 1a 6c 67 00 58 06 44 b1 9f 8e d4 53 83 07 ad b1 4e 8e 79 47 e3 79 db f5 eb b3 b3 1b df 57 c9 79 90 10 c6 13 97 46 04 06 3f 5e ff 76 f0 17 f2 2f 9a 7f 37 fd c3 fc 97 fe 0f f0 1e d3 b8 37 ea 23 fd cf 40 bf 9c 7d f8 fe 5f f7 ef 3e bf f3 7f 9a f1 17 e2 1f fb 1f e6 bd 81 7d a9 ff 23 d0 fb e8 fb 23 b6 7f f3 5f b6 9e c1 7e f7 fe 03 be ef fe bf f0 de a3 fe ab fe 2f ff 4f b8 0f f4 7f ed 3f f8 bf c2 fb 09 fe cf c1 a3 ee bf f0 3d 80 ff a8 7f 88 ff e9 fe 9f dd 9b fb df ff 1f ef fd 0d fe bf fe b7 d8 67 f6 57 d3 63 ff ff bc 6f dd 0f ff fe f6 01 e2 33 15 9a b2 49 bf 0b 9c b7 be 55 fc 89 51 b3 a1 5c 6e c4 ff 31 ac 43 bc dc 81 4a a0 b9 c6 41 Data Ascii: 528eRIFFRWEBPVP8 zR*>e&E"lgXDSNyGyWyF?^v/77#@}_>}##_~/O?=gWco3IUQ\n1CJA
2024-02-08 18:36:41 UTC	4758	IN	Data Raw: 18 a5 90 1f ef 82 a7 79 23 0b f2 9a 0f bb cc 35 3d 49 ce c6 7f 78 ec 2e 21 74 e2 ba f1 21 d3 ab 59 81 69 dc 40 43 9f c6 ee 9c 47 49 21 5d f5 07 10 77 b5 0b 16 42 b1 aa 69 4d 57 7f 5d 1e 5c 6a 38 7c 2b b0 7b 67 ee 51 af 53 cd ed a9 e7 88 bc 86 ae c9 70 f9 54 07 94 5b 29 22 ea 8e cd 9c 74 e0 8b 34 2d 0b 46 ee 67 d0 70 a3 2b b0 4f d2 13 4e ad 62 37 b3 28 2e 06 1b 27 86 63 75 65 eb e0 e0 2a 5a 83 4c ec 26 80 57 55 c9 81 ff c7 00 f1 1f 74 72 39 48 3a ab b8 cd 88 08 96 08 24 45 84 e4 1f eb e4 e0 a7 1c 0d bf 4c f0 77 a4 9f 90 b4 a1 69 32 50 d0 de 62 ea d3 24 dc a5 d0 8d f4 34 db fe 0e 36 4b 20 cc f9 b9 aa 80 50 a3 c6 e8 4d b3 5d 5d cf 66 40 b5 ef 67 8d f1 e2 af 0e 53 b8 8e 6d 17 07 01 32 74 34 21 5c 35 49 8c 7b 09 1a 15 c7 7e 91 26 23 bd d3 ae f1 a1 cf e9 35 0a Data Ascii: y#5=Ix.!t!Yi@CGI!]wBiMW]\j8\|+{gQSpT[)"t4-Fgp+ONb7(.'cue*ZL&WUtr9H:$ELwi2Pb$46K PM]]f@gSm2t4!\5I{~&#5
2024-02-08 18:36:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
840	192.168.2.5	50706	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:40 UTC	417	OUT	GET /static/img/flags/new/48-squared/us/fa2b2a0e643c840152ba856a8bb081c7ded40efa.png HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:40 UTC	769	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 642 Connection: close Server: nginx Date: Wed, 17 Jan 2024 11:39:09 GMT Last-Modified: Mon, 07 Sep 2020 10:40:08 GMT ETag: "5f560e08-282" Expires: Fri, 16 Feb 2024 11:39:09 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 7699e4f17e72e42cba0c247c650005d2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: ZIJVZxbyYzON1uTNnTHCocW5aQW0c2EKMPoww1UcPBw2BEDrYaPNtw== Age: 1925851
2024-02-08 18:36:40 UTC	642	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 08 03 00 00 00 60 dc 09 b5 00 00 00 75 50 4c 54 45 b4 1f 30 3c 39 70 b4 1f 30 97 27 40 ff ff ff b4 1f 30 3c 3a 70 d0 73 7d 54 53 82 ec c7 cb e3 ab b1 61 5f 8b 48 46 79 6d 6b 94 49 46 79 be 3b 49 91 90 ae c2 c2 d2 79 78 9c 85 84 a6 48 47 79 9d 9c b7 aa a9 c0 b6 b5 c9 c7 57 64 f3 f3 f6 db da e4 ce cd db 96 26 40 e7 e7 ed 6d 6b 93 9e 9d b7 ce ce db a1 47 5e b5 b5 c9 9e 9c b8 c0 a4 b4 b7 87 9a ae 6c 81 d6 1f 19 b1 00 00 00 04 74 52 4e 53 df bf bf bf 3b 25 6a 12 00 00 01 b8 49 44 41 54 48 c7 8c d4 61 93 94 30 0c 06 60 d4 f5 35 9a 14 4b 69 41 38 d9 dd bb 53 ff ff 4f b4 79 b9 b9 ce c0 ce 68 3e 3c d3 81 09 34 a4 a1 fb f0 1f f1 e9 63 8b 0e 30 83 87 50 6d eb 76 e5 e7 e7 16 1d fa 69 10 bc 89 69 Data Ascii: PNGIHDR00`uPLTE0<9p0'@0<:ps}TSa_HFymkIFy;IyxHGyWd&@mkG^ltRNS;%jIDATHa0`5KiA8SOyh><4c0Pmvii

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
841	192.168.2.5	50707	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:40 UTC	682	OUT	GET /xdata/images/city/square250/976744.webp?k=d386664a0cfa562d8586fa2251c11c4f6d14e554281a47189dd8c3bb5c2b798a&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:41 UTC	537	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:41 GMT ETag: "d87dd83248541ad9faa8adbd4f5d2f999d29ccd5" Content-Language: 13702 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Miss from cloudfront Via: 1.1 3f95374273631adbfd8e0d0a9f6d7b64.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: ZLx3KEgJAjjvrsWskqzUuiXrBBPSR1ydq_FibwxOsh12KbjiTrDU2A==
2024-02-08 18:36:41 UTC	13710	IN	Data Raw: 33 35 38 36 0d 0a 52 49 46 46 7e 35 00 00 57 45 42 50 56 50 38 20 72 35 00 00 f0 9a 00 9d 01 2a fa 00 fa 00 3e 6d 2c 92 46 26 23 a2 97 3c 85 9c 60 06 c4 b2 b7 7d 0a 5a fa 5b b9 bf 7d bb 63 28 2f 11 57 0b 6f b8 f1 05 35 d6 9e 5b 92 27 ca f4 d5 6b 15 6b 1f c1 ff d2 78 13 e2 57 d8 ff bf ff 8e ff bb eb 11 88 3e ba f5 0b ed 7f f8 3f e0 3d a3 ff 01 ff 97 fc f7 89 ff 24 7f dd ff 19 ec 11 ed 8f d7 ff 59 df ae ec af da 7f d7 7e d3 fb 02 fb b5 f7 2f d8 df 1c ad 45 fb ff ec 03 fd 17 fb 37 9d bf e8 fc 26 7e d5 fe ef d8 17 fa 2f f7 3f fd df e9 3d dc 3f b7 ff f1 fe cb d1 0f ec 7f eb 3f 6d fe 07 3c b3 ff ff fb ac fd d1 ff e7 ef 45 fb 96 96 d2 dc bb cf eb 5f 86 39 ae 3c f3 cf 24 ec 22 6d 7f f4 7f f8 42 a6 bc f6 f8 48 df 41 af 8b 73 87 95 d7 07 58 27 5b 39 f8 76 74 2f 7d Data Ascii: 3586RIFF~5WEBPVP8 r5*>m,F&#<`}Z[}c(/Wo5['kkxW>?=$Y~/E7&~/?=??m<E_9<$"mBHAsX'[9vt/}
2024-02-08 18:36:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
842	192.168.2.5	50708	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:40 UTC	631	OUT	GET /static/js/landing_pages_common_cloudfront_sd/5d6270f9d99467ef1f2d14da9abb86c291f4bb0b.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:41 UTC	793	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 1175 Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:41 GMT Last-Modified: Tue, 04 Feb 2020 10:19:57 GMT ETag: "5e39454d-497" Expires: Sat, 09 Mar 2024 18:36:41 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 f588325f7617672d954c4267c8bee1ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 4E1lDhDu_i-lpbEwp5m38Xme-jNG5mDU24Xywzv5nX_o_gZ3pU2FxA==
2024-02-08 18:36:41 UTC	1175	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 69 29 7b 72 65 74 75 72 6e 20 69 7d 3b 66 75 6e 63 74 69 6f 6e 20 65 71 75 61 6c 69 7a 65 48 65 69 67 68 74 4f 66 49 74 65 6d 73 28 61 29 7b 5f 69 5f 28 22 35 63 32 3a 36 63 31 61 33 30 37 62 22 29 2c 61 28 22 73 65 63 74 69 6f 6e 22 29 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 69 2c 65 29 7b 5f 69 5f 28 22 35 63 32 3a 64 37 38 32 33 63 66 63 22 29 3b 76 61 72 20 74 3d 61 28 74 68 69 73 29 2e 66 69 6e 64 28 22 5b 64 61 74 61 2d 65 71 75 61 6c 2d 68 65 69 67 68 74 3d 74 72 75 65 5d 22 29 2c 63 3d 2d 31 3b 74 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 69 2c 65 29 7b 5f 69 5f 28 22 35 63 32 3a Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(i){return i};function equalizeHeightOfItems(a){_i_("5c2:6c1a307b"),a("section").each(function(i,e){_i_("5c2:d7823cfc");var t=a(this).find("[data-equal-height=true]"),c=-1;t.each(function(i,e){_i_("5c2:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
843	192.168.2.5	50710	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:40 UTC	447	OUT	GET /xdata/images/city/square250/976919.webp?k=b4d2dd3f87340b547a0e1aa9fc7e89b47ebe9539086c7f5f4e637e5e2137be7c&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:41 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Tue, 30 Jan 2024 01:35:16 GMT ETag: "bb2473dd82f02dd4000ed979bc6da66dace09676" Content-Language: 17122 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 b0c7b942a33f0f4451718aee53f7840c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: KkrJCsZfplExIg4M-ryPMZspjnXNaHsFbLtq6ZKEptC8XZTDQDWi_g== Age: 838885
2024-02-08 18:36:41 UTC	15835	IN	Data Raw: 34 32 65 32 0d 0a 52 49 46 46 da 42 00 00 57 45 42 50 56 50 38 20 ce 42 00 00 30 c7 00 9d 01 2a fa 00 fa 00 3e 6d 2a 91 45 a6 23 a2 17 db 56 88 60 06 c4 a0 67 bd 41 f4 18 6c 67 a1 7f 33 ce a7 95 fc 4e 8e 3e 0a 19 5b ce c9 ef 7d 40 6e 44 e7 5d 72 5a f1 cf f3 5f 95 5e 6b f8 b1 f6 e7 ef 3f e5 ff eb ff 8e f7 09 c7 bf 5f ba 87 7c f3 f0 9f f0 bf c5 fb 61 fe 5b ff 27 f8 cf 17 fe 27 ff c1 fe 4b d8 17 f3 3f e8 1f ec 3f bc fa f6 fd b7 69 46 db fe b7 f6 b3 d8 47 dc bf b5 7f da ff 27 ea 9b f3 ff fa 7f d5 7a a5 f6 13 ff 47 b8 0f f4 cf ec df f5 bd 5b ff 79 e1 6b f7 bf f6 7f b2 5f 00 ff d2 7f bd 7f eb ff 33 fe 9f e1 c7 fb cf fe df ee 3f dd 7e ee fb bf fd 83 fd 6f ed 77 c0 e7 ec 3f a6 cf ff ff 79 9f b8 ff ff fd e8 49 73 43 7a 0a 95 79 ce cf 0f 43 f8 f1 61 53 e7 12 24 13 Data Ascii: 42e2RIFFBWEBPVP8 B0>mE#V`gAlg3N>[}@nD]rZ_^k?_\|a[''K??iFG'zG[yk_3?~ow?yIsCzyCaS$
2024-02-08 18:36:41 UTC	1295	IN	Data Raw: bd ee 7d 7d 9f 7e 7d 47 e0 76 3c d5 47 9b de ee 57 0a 03 ae 1d 81 77 5a 7b f6 49 e3 90 e8 93 65 42 38 8a 8a 11 97 4c 1a ab 9d d0 d8 84 e0 62 9f 44 19 b4 b9 fe 84 3d 81 5d f1 15 b1 88 70 52 b8 60 31 4d 00 23 f6 ca 21 ea 84 de e9 ea 9d b9 16 ec 75 28 c5 3f 27 6c d6 d7 e1 fa 26 04 cb ec cd 52 a5 f6 6b dc 9d 00 d6 44 d7 2c df 8b ce c8 bb 2c 9c 8b b8 88 67 df 0f 6f ca e4 83 bc e5 83 56 33 86 8a fa 64 3b c6 b9 dd 4e 43 2d c8 cb cb 57 dc 3b a1 b9 b5 b9 a1 00 47 75 4a 87 24 19 22 25 09 5c 81 80 6d b4 8a 82 0f 84 8a 33 54 a4 3b 01 cb 5d 97 e1 be 66 c3 0e ee 16 49 80 0d ab c8 c2 30 1a 40 c9 ee 8c 2a d4 8c c0 a4 42 72 43 9f 76 c0 ca ce af 14 b1 87 48 3f e1 e2 ee 10 23 e6 7e ea d2 af 00 be c5 42 9e a7 80 b3 94 47 82 ae 22 8e 5f 89 65 a0 ff 19 36 0b 2c d9 0d 29 9e cc Data Ascii: }}~}Gv<GWwZ{IeB8LbD=]pR`1M#!u(?'l&RkD,,goV3d;NC-W;GuJ$"%\m3T;]fI0@*BrCvH?#~BG"_e6,)
2024-02-08 18:36:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
844	192.168.2.5	50709	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:40 UTC	637	OUT	GET /static/js/packages_city_landing_page_cloudfront_sd/172f7d6c1b0baff6a5977b7d9131abccccb65cf9.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:41 UTC	795	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 10122 Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:41 GMT Last-Modified: Mon, 10 Feb 2020 15:20:44 GMT ETag: "5e4174cc-278a" Expires: Sat, 09 Mar 2024 18:36:41 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 4a91a321d4c2ab7334c6f285093956ae.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: MumxQdpfXwYymdkCqdo0pCCUhwMgi-COp0ARcDI28SDcG69mZm5B1w==
2024-02-08 18:36:41 UTC	10122	IN	Data Raw: 76 61 72 20 5f 69 5f 3d 74 68 69 73 2e 5f 69 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 5f 72 5f 3d 74 68 69 73 2e 5f 72 5f 7c 7c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 7d 3b 42 2e 64 65 66 69 6e 65 28 22 73 65 61 72 63 68 2f 64 65 73 74 69 6e 61 74 69 6f 6e 2f 73 65 72 76 69 63 65 2d 61 75 74 6f 63 6f 6d 70 6c 65 74 65 22 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 69 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 5f 69 5f 28 22 66 37 34 3a 35 32 36 32 31 33 34 31 22 29 3b 76 61 72 20 61 3d 74 28 22 65 76 65 6e 74 2d 65 6d 69 74 74 65 72 22 29 2c 72 3d 74 28 22 73 65 72 76 65 72 2d 64 61 74 61 22 29 2c 6e 3d 22 65 6e 22 3b 66 75 6e 63 74 69 6f 6e 20 73 28 74 2c 61 2c 65 29 7b 69 66 28 5f 69 5f 28 22 66 37 34 3a 34 38 65 64 63 30 34 Data Ascii: var _i_=this._i_\|\|function(){},_r_=this._r_\|\|function(t){return t};B.define("search/destination/service-autocomplete",function(t,e,i){"use strict";_i_("f74:52621341");var a=t("event-emitter"),r=t("server-data"),n="en";function s(t,a,e){if(_i_("f74:48edc04

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
845	192.168.2.5	50711	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:41 UTC	682	OUT	GET /xdata/images/city/square250/976877.webp?k=2aab28217f0fb039e0f35ea2b2c3976141b5860b074f74220edf998115935cda&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:41 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Mon, 29 Jan 2024 10:27:14 GMT ETag: "f2a5ee553ff43f0ff8ae2fa36a53ff6bf91d0508" Content-Language: 18472 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 3f95374273631adbfd8e0d0a9f6d7b64.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: F6OiTDeyOHUntDzetUc4j005jtsQZSSZQYW-jiZ9qi3tAezpqzqnoA== Age: 893366
2024-02-08 18:36:41 UTC	15835	IN	Data Raw: 34 38 32 38 0d 0a 52 49 46 46 20 48 00 00 57 45 42 50 56 50 38 20 14 48 00 00 b0 d1 00 9d 01 2a fa 00 fa 00 3e 69 28 8f 45 a6 23 22 19 eb de 8c 60 06 84 a6 cc a5 a1 53 d5 f2 d2 0c 0e ae 6b b8 f2 c2 e4 5f 03 fe a9 95 8f 10 e3 cd 6c 1f fa 3e bd f9 6f 3f 5c be 1b fe e3 fa c9 fd bb fd 8c f7 64 ff 79 fb 79 d6 93 fe 03 d6 5f d6 73 fa 3f a9 f7 ec e7 a6 df ed df c4 a7 ed ad b4 2f 15 7f 0f f9 4b e6 6f 8c 6f 77 7e e7 fe 63 fe e7 f8 af 6c 1f a5 7c 21 74 6f 98 9f ce 7f 1a 7f 23 fc 6f b4 cf e0 bf ed 7f a8 f1 6f e2 37 fb be a1 1e cc ff 93 fd ff d6 77 e9 3f 6d 3b b4 36 6f f2 9f b4 1e c1 7e e2 fd bb fe df f9 3f 52 5f 9b ff db fe 97 d4 ef b0 de c0 5f ad bf f8 7d 5a ff 7b e1 41 f7 df f5 df b8 ff 00 9f d5 3f bd ff f2 ff 4b ee dd fd af ff 7f f7 5e 8b 7e a9 f6 1b fd 89 f4 d2 Data Ascii: 4828RIFF HWEBPVP8 H*>i(E#"`Sk_l>o?\dyy_s?/Koow~cl\|!to#oo7w?m;6o~?R__}Z{A?K^~
2024-02-08 18:36:41 UTC	2645	IN	Data Raw: ba 17 0b dc 69 98 1e 14 35 bc 9e b7 f5 be cc ee 63 a2 c1 12 b4 d2 3c 94 dc bf 0a 3f 3b 68 e3 a9 e2 71 6b 51 59 84 93 40 6b 6f 62 62 37 62 a7 f9 cc 62 92 c0 1c 48 cb 0d 21 40 60 fc 72 2f 97 47 80 16 48 b1 89 96 af 21 29 fd 07 54 48 e7 f9 71 10 65 a4 bb 6e 20 f2 94 64 49 63 55 8c 25 51 b8 90 30 ae 34 b1 8b ab cc 11 de b2 33 20 bc d8 aa ca 63 18 91 a1 8f 4c 20 9e 45 e3 98 71 fb be e5 08 32 18 d8 f2 4a 2a 10 bb 08 12 c9 82 bd b4 0b 98 d2 e1 61 9e 6a 61 40 82 bf 27 cf bc 87 4a dd c7 32 9d 6f 40 5c d5 38 62 20 da a2 c2 0b c6 9b 60 66 5e cb e3 2f 88 48 54 3f a0 eb 6a 04 32 98 26 55 c8 60 bf 4c d1 0a 3d 77 41 f7 cb 6e 96 ff de 6a 57 68 d4 43 b4 27 5a b2 fc fe ad 26 c6 11 8c 08 7b 27 7d 09 8b 41 53 34 09 16 79 f7 18 91 27 78 c2 5c ed 06 ef ce d1 c6 3b d6 f3 83 e0 Data Ascii: i5c<?;hqkQY@kobb7bbH!@`r/GH!)THqen dIcU%Q043 cL Eq2J*aja@'J2o@\8b `f^/HT?j2&U`L=wAnjWhC'Z&{'}AS4y'x\;
2024-02-08 18:36:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
846	192.168.2.5	50712	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:41 UTC	682	OUT	GET /xdata/images/city/square250/689573.webp?k=4aefe3aca3ad388dca94c5fc8123ddd89aff34d443ccaa192a8b4ec6981c5b90&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:41 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Mon, 05 Feb 2024 07:30:26 GMT ETag: "5523d4acdcaeef0dc949126a4b9ffc77845fc166" Content-Language: 10200 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 d125bf8405e840aa51a88ae3d8d91fb2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 4VJPYpg_ssoEJ6TtoaYbiVrVcA1Qsw7j9R2lvZcL1QiTM2qU-0RykA== Age: 299175
2024-02-08 18:36:41 UTC	10208	IN	Data Raw: 32 37 64 38 0d 0a 52 49 46 46 d0 27 00 00 57 45 42 50 56 50 38 20 c4 27 00 00 b0 8c 00 9d 01 2a fa 00 fa 00 3e 6d 32 94 47 a6 24 22 a1 a7 56 1b 08 c0 0d 89 4d da f6 6b 73 32 2d 9d af ec 56 c9 43 19 f2 dd 75 5e d6 7c a7 dd a7 ce 74 e8 c7 d3 b1 f3 37 f8 2e fa 7f ef 3f ed 7f 8d f7 85 fa 83 fe ef 58 7f f8 7e c7 ff b5 ff b3 f5 7f fb 55 eb 4b ff 1f d3 3b d2 ab aa 4f a2 83 fe ef b5 27 ee 9f b4 0f ee 86 0f c3 53 f5 5b f5 5f 9b 3f df bd be b2 2f f1 7f dd 79 95 f7 09 cf be d9 bf b2 ef 9f e4 2f fb 1e a1 de cc ff 75 e9 31 f6 5f f5 7b ea 76 af f4 df f5 bf cc fb 0b fb 85 f6 5f f9 3f df bd 82 fe cf ff 1f a3 ff 64 fd 80 7c c2 ff 95 e2 f3 e9 1e c0 9f d3 bf bc fe 3c 7c 44 7f 75 ff cf fd 97 a7 bf d9 ff d5 ff f1 ff 57 ed 13 e9 b1 e7 67 ed 5a 65 bb ac 12 4f 53 a5 6d 72 8d 32 Data Ascii: 27d8RIFF'WEBPVP8 '*>m2G$"VMks2-VCu^\|t7.?X~UK;O'S[_?/y/u1_{v_?d\|<\|DuWgZeOSmr2
2024-02-08 18:36:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
847	192.168.2.5	50713	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:41 UTC	682	OUT	GET /xdata/images/city/square250/689617.webp?k=edf88994b0c6b4c060300b942efdc1242289d1a695fcea13493e20596edc7daa&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:41 UTC	530	IN	HTTP/1.1 200 OK Content-Type: image/webp Content-Length: 5836 Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:41 GMT ETag: "5ed7894801b9c0c2d25e22433d0d1da1feefbad7" Content-Language: 5836 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Miss from cloudfront Via: 1.1 31341771a4bfa40d7b1f61883ffb56c6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: WUu09Xx1oWMaS4OvaiS_6pTXiHC9Yqggrq32pOa7EY5bFl0fedt8oA==
2024-02-08 18:36:41 UTC	5836	IN	Data Raw: 52 49 46 46 c4 16 00 00 57 45 42 50 56 50 38 20 b8 16 00 00 f0 7b 00 9d 01 2a fa 00 fa 00 3e 6d 32 95 48 a6 23 a2 a1 a3 30 ab 08 c0 0d 89 63 6e 2d e3 5a 1f db bf 25 20 be 8f 13 95 ee 94 86 f2 ad e2 7d 8e 25 0b 8d 57 f5 d3 d8 01 65 ec 9c e6 78 d9 f3 bd fd d2 7f e6 8d 30 3f 70 89 dd 07 b1 5f cf fd d0 b7 78 c3 df d8 77 6e ed df da 6f ee 5f c8 72 65 48 e5 3d 3d 24 a7 43 e1 1e 5c 5f 19 cf 23 f6 0b fe 77 fd db f6 03 de 47 fc df 3e 7f bb 7f b3 d2 2b 20 d6 19 e7 6e 9f 9f 23 b4 05 6a 99 4f fe b4 c6 1b ee ed 89 c3 a0 de ff eb de 76 44 fc 12 da ad ec ea 1c b8 f0 32 9c 07 4a 3f b6 df d4 b6 bb 3b 5e ac 8a 8c 02 a9 a8 a8 46 2d ff 76 17 af 32 58 99 e8 5f 38 93 82 88 e1 a2 82 9a 1a b6 b6 6d be b5 7e b1 40 81 af f0 18 26 6e f3 79 ab 40 ab 96 65 55 06 1a 54 c5 8f 09 4c 5d Data Ascii: RIFFWEBPVP8 {*>m2H#0cn-Z% }%Wex0?p_xwno_reH==$C\_#wG>+ n#jOvD2J?;^F-v2X_8m~@&ny@eUTL]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
848	192.168.2.5	50714	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:43 UTC	682	OUT	GET /xdata/images/city/square250/690267.webp?k=05055e2ec19868d57cf86ccb604589b988d64eacbb3e6a8645af8e8e1f8256e0&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:43 UTC	542	IN	HTTP/1.1 200 OK Content-Type: image/webp Content-Length: 5854 Connection: close Server: nginx Date: Mon, 29 Jan 2024 17:47:37 GMT ETag: "13fa017e6b4e4e52595854655e097edae8abddf0" Content-Language: 5854 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 6e0f9dce97fcb3c9b684592a289e4e72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: YYpi3d8ACr8BspzTnRmCJ4ynfmxhDiGnVl0iFoJj7iH75x3L7UxSDA== Age: 866946
2024-02-08 18:36:43 UTC	5854	IN	Data Raw: 52 49 46 46 d6 16 00 00 57 45 42 50 56 50 38 20 ca 16 00 00 50 94 00 9d 01 2a fa 00 fa 00 3e 6d 30 92 46 a6 24 22 21 aa 56 0c b8 c0 0d 89 63 6a c2 d2 d9 5f de bf fe ca d8 2a 5c 92 f0 60 f7 da 57 39 3b c9 b0 07 a3 1d 5e f2 8f c6 33 af ec c5 1d 7b f4 fd 6f 32 5f cb ff ff ca 77 af ee 60 de 4c fc c8 3d 3f ec 78 7d 77 74 7c be 75 b6 2f 6d ed d4 70 cf f7 5d de fb 69 76 cb 83 02 4b 7e 9b 16 c3 6f ff 70 f5 7a 16 e8 7a 6c 6d be 8a 13 92 35 6e 90 b3 c6 e2 62 73 9e f1 59 46 b7 02 24 1c 74 f0 f2 e0 d8 ca 9b 19 85 54 01 d7 4b 72 cd 83 3e 07 27 e2 84 3c b0 21 45 6b 7b d3 e4 c4 cf a3 43 d4 57 9e e9 85 3f 5e 42 6a 39 fd 34 fb 37 d0 c3 16 1b 1e 78 45 81 7a a0 74 89 f9 5a cc 14 3d 58 5e 70 59 69 b6 4f e2 38 01 19 8b b7 98 80 44 f9 b6 49 0c b3 a0 8b d1 c6 2b e1 76 4d 44 51 Data Ascii: RIFFWEBPVP8 P>m0F$"!Vcj_\`W9;^3{o2_w`L=?x}wt\|u/mp]ivK~opzzlm5nbsYF$tTKr>'<!Ek{CW?^Bj947xEztZ=X^pYiO8DI+vMDQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
849	192.168.2.5	50715	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:43 UTC	682	OUT	GET /xdata/images/city/square250/976823.webp?k=96ffc687725d79086ffd57914e2f32803127412daf40ecf1195d9038107917bb&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:43 UTC	537	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:43 GMT ETag: "c5c250c9b94b23a40f4f0eaee988472abfa79ba5" Content-Language: 14458 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Miss from cloudfront Via: 1.1 a1a074529ccb9ea97acd7d95c506f336.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: CZ2wOp3Ooca62BWdiroDoo44_uH6uUTO7RNj3tUvBTVX1PAkXqzavQ==
2024-02-08 18:36:43 UTC	14466	IN	Data Raw: 33 38 37 61 0d 0a 52 49 46 46 72 38 00 00 57 45 42 50 56 50 38 20 66 38 00 00 30 b5 00 9d 01 2a fa 00 fa 00 3e 6d 2c 91 46 26 23 a2 16 fb 56 90 60 06 c4 b1 96 a7 9f 20 2d 76 17 81 69 b4 e2 41 ba ef 7a 0f 2e 0e 51 f2 87 f5 dd b4 f7 5f f6 7d 8e bf ab d5 e8 34 9f 48 9f 5d fd f3 f7 6f d7 73 1b 7d 96 ea 29 f3 ef c2 df bc ff 19 ed 8f fa 3f fc 7e 10 fc 88 ff 77 d4 17 da 5f f0 fd 44 3e cb b4 1f 76 ff 6f ff 97 d4 23 de 6f b8 7f d8 ff 23 ea 55 f5 1f f8 7d 11 fb 33 ec 05 fd 27 fb 57 fd 3f 57 bf dd f8 76 fe 1b fd 3f b0 3f f4 3f ee 3f fc ff d1 fb 28 ff ed e7 23 f5 ef f5 bf fd 7f db fc 0f 7e c8 fa 69 ff ff f7 75 fb 97 ff ff de c3 f5 25 4e 9e ae 35 ed 4a f5 81 6c 01 61 09 b5 50 10 69 92 73 09 19 e5 8d 3a 51 0b 9f 59 01 f2 97 36 cb 9e 71 32 90 fc c1 54 05 0f 53 1d 2a c2 Data Ascii: 387aRIFFr8WEBPVP8 f80>m,F&#V` -viAz.Q_}4H]os})?~w_D>vo#o#U}3'W?Wv????(#~iu%N5JlaPis:QY6q2TS
2024-02-08 18:36:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
850	192.168.2.5	50690	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:43 UTC	4184	OUT	GET /logo?ver=1&sid=5171fc655664ddf74ab763a094523fb7&t=17074173981 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/packages.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAfk6BVJUjAAAA:WDfXg2ry+HvbnxTztLnepFvhf3dpX4SdQfM4GczRrcPw6MWAZH8MErn+af2Y9SvAts7ySjM/T9nCQWaxTWJ+ECSRYADCgGFp6g8nwqAAp4uZuesbnPNMB9VWMMTR/6OqpiFI1lm6c8HTX0et8uTZTDvEovUpe/ZJPj+EvnZwpL1hdq9NKhFzFZb6nk1kcyw+S5Gmb0WW/JMfQvkBUX6FX8nHd2pkcvntEKFlkhvMXyaXZ+ocI5s4XxhjbVLG6yziJfNgBxF+; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A32+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbVA9iGwA%2BUSwQ2O%2FlHm0pqQylRO2dJ7x%2FYlVcVU5Hiw1maEZ7F5OJC7JbdIX2o2ehMp3Yo4XT4lkzfuwozqYc9CeWfmPGKOe3hqqu4HQULabtlMTEeCieJXNZjl6azPIa5VZ0lIM7ZhfVN1YLZMT32klhmcppfCGhIQ8euPDUOg0%3D
2024-02-08 18:36:43 UTC	780	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:43 GMT vary: User-Agent, Accept-Encoding set-cookie: BJS=-; domain=booking.com; expires=Fri, 09-Feb-2024 18:36:43 GMT; Secure; HTTPOnly strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=ea7c82ddfdc9028b&e=UmFuZG9tSVYkc2RlIyh9YbpBYTW1tHKzK9X34Fda1b-S_o2zx5PyzTXEUdYgIip7 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 14e4300e15854895259e6944bb121ec8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: vUWDMD9POfHCgmIpUIikLkQsPKTng3_rbI1RHu_Ezpw6DD02gyKdtA==
2024-02-08 18:36:43 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
851	192.168.2.5	50716	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:43 UTC	662	OUT	GET /static/img/resorts/landing_pages/airplane_bg/82842ea42e7cb6a992e722675e0556c5f8f9b172.jpg HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:43 UTC	750	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 48905 Connection: close Server: nginx Date: Sat, 03 Feb 2024 22:48:13 GMT Last-Modified: Thu, 15 Aug 2019 10:35:46 GMT ETag: "5d553582-bf09" Expires: Mon, 04 Mar 2024 22:48:13 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 f588325f7617672d954c4267c8bee1ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: osdJJxnH2KF9viDh6HrH35vD5lyb7Cxzmp-yVdiZmlRuN7jp0_4MfA== Age: 416910
2024-02-08 18:36:43 UTC	15634	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 84 00 08 08 08 08 09 08 09 0a 0a 09 0d 0e 0c 0e 0d 13 11 10 10 11 13 1c 14 16 14 16 14 1c 2b 1b 1f 1b 1b 1f 1b 2b 26 2e 25 23 25 2e 26 44 35 2f 2f 35 44 4e 42 3e 42 4e 5f 55 55 5f 77 71 77 9c 9c d1 01 08 08 08 08 09 08 09 0a 0a 09 0d 0e 0c 0e 0d 13 11 10 10 11 13 1c 14 16 14 16 14 1c 2b 1b 1f 1b 1b 1f 1b 2b 26 2e 25 23 25 2e 26 44 35 2f 2f 35 44 4e 42 3e 42 4e 5f 55 55 5f 77 71 77 9c 9c d1 ff c2 00 11 08 03 c2 05 a0 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 03 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 ff da 00 08 01 01 00 00 00 00 f8 a7 54 da a3 7f 43 ab 87 0c 83 31 ac 72 98 6c d7 4b df 19 ad 16 69 db d4 b5 85 56 6a 1b bd de f4 53 ee c7 bb 6e 7e 9e 7c 31 Data Ascii: JFIF++&.%#%.&D5//5DNB>BN_UU_wqw++&.%#%.&D5//5DNB>BN_UU_wqw"TC1rlKiVjSn~\|1
2024-02-08 18:36:43 UTC	16384	IN	Data Raw: 7f c4 bd 7b cb fc b0 94 22 22 21 18 42 1e 3b c7 69 ac 3f da 7a a4 96 e6 8f 44 41 d8 ec 7a 23 44 50 a0 05 0a 14 36 14 05 2a 02 86 c2 85 0a 14 36 14 3d 20 6e 3a 8d 87 fe 03 ca f9 ef 23 e5 90 02 31 84 60 61 08 68 b4 3a 4d 27 f0 01 34 20 23 c7 f5 f8 38 25 60 69 e7 a7 e2 fa a7 45 2d 30 d3 7d 53 a3 9d 83 69 54 a8 d1 1b 9d c6 c2 80 14 28 50 d8 0a 14 36 14 36 1b 0a 14 36 14 3a 8d c7 fe 22 f5 ef 2f f2 b9 10 00 11 8c 63 08 c3 0d 2e 93 43 a2 fd c7 ab cb 30 56 22 b0 9d 83 a5 36 cd d1 aa fb bf 78 eb 0d e7 52 13 84 e0 76 34 68 d4 3c 84 2e 8a 40 50 d8 50 d8 1a 14 28 6c 28 50 a1 d8 76 62 86 e3 dc ff 00 ab e5 7c f7 90 f2 80 4e 71 8c 62 21 18 46 10 85 9b 1e 3f 41 fc 04 92 5b e5 c9 ca 6f 1b bc bf 63 ec 8d 59 d6 4a f4 89 dc ec 68 d2 21 11 90 9c 35 51 f2 90 f3 90 f9 04 3c fc Data Ascii: {""!B;i?zDAz#DP6*6= n:#1`ah:M'4 #8%`iE-0}SiT(P666:"/c.C0V"6xRv4h<.@PP(l(Pvb\|Nqb!F?A[ocYJh!5Q<
2024-02-08 18:36:44 UTC	16384	IN	Data Raw: 56 8f 29 95 a3 cd af c8 76 cd 15 65 ee a4 56 a8 f3 62 f9 99 4a dc 95 ca 75 39 c5 14 2a 47 38 91 86 71 6c 85 ad f6 96 7a 0a 9d 29 de 5d 32 c5 35 9a 3a c4 6b 9e 2f 09 49 a5 14 db e8 91 5a 76 9e d1 ec 47 d3 d5 94 e8 c1 42 9c 37 52 e8 86 31 8f ee 34 21 11 22 44 88 84 2d 45 c5 d8 42 22 44 44 44 2c 19 22 7a 15 3d 24 fd 23 f4 8f d2 3f 49 db 07 a1 d8 bf b9 57 f3 36 b8 f2 dd 91 b6 47 9d 19 1b 57 ec 27 f9 1b 57 ec 27 f9 1b 5f ec 2a 7e 96 6d 7f b0 a9 fa 59 b6 7e c2 a7 e9 66 db fb 0a bf a5 9b 6f ec 6a fe 96 6d bf b1 ab fa 59 b6 fe c6 af e9 66 d7 7b fd 8d 4f d2 cd ab f6 33 fd 2c da 57 f9 52 fd 2c af fb 37 fa 59 5b f6 6f f2 65 4f d9 bf c9 95 3f 66 c9 fe cd 8f f6 6c 7e 86 2f 43 23 e9 64 34 64 3b fe 45 3e ff 00 91 4f 52 1e a2 1e a2 1a 91 d4 8e a2 d7 07 a3 25 a3 c1 6a 2d Data Ascii: V)veVbJu9G8qlz)]25:k/IZvGB7R14!"D-EB"DDD,"z=$#?IW6GW'W'_~mY~fojmYf{O3,WR,7Y[oeO?fl~/C#d4d;E>OR%j-
2024-02-08 18:36:44 UTC	503	IN	Data Raw: 59 bc 9d fa 0b 27 d0 63 b8 ee 3b e4 c6 3e 9e c2 63 d3 9f 1e 26 0b 7f 0b e4 fb 98 af 9a 91 8b f3 18 9f 33 31 1a a3 75 18 b8 23 4e 62 c9 92 b9 b8 96 a5 91 2b 12 1e a2 49 72 23 f2 91 74 e5 42 0f ba a1 1d 3d ca be 6c 62 af 7c ae 88 dc 59 f2 ee 53 51 e4 fa ee f9 a1 68 35 a7 0d 1a 55 e4 fa 2c 7d df 61 11 10 ed 9a a8 ae 6e 5d 91 b1 b7 1a eb 32 a2 b8 ae 6f c3 ca 94 c9 0a e6 e6 c4 5a 75 2a b9 52 a4 75 74 20 ab ce a4 65 4d 0d c6 50 6d 8f d9 a7 dd 16 63 cb 9f 0b 1e 5b 0a 9d 86 d0 c9 2d 4e 74 6a a2 d1 8a 95 64 6b c9 0a d9 3d 07 92 cb 7e 05 d4 79 f3 cd 64 ea 31 5b 91 11 3d 32 42 15 84 2b 9b 95 1d b3 63 1d c7 71 dc 95 c6 6d ed 5f 42 2d 3a ba 11 4d ae e8 d8 8b ad 79 11 d1 57 25 93 b6 4e c3 15 c8 dc df 85 64 af 92 e2 5c 4f a1 61 df 89 dc 7a f3 15 88 d8 5c 0b d8 ae 37 71 Data Ascii: Y'c;>c&31u#Nb+Ir#tB=lb\|YSQh5U,}an]2oZu*Rut eMPmc[-Ntjdk=~yd1[=2B+cqm_B-:MyW%Nd\Oaz\7q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
852	192.168.2.5	50717	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:43 UTC	682	OUT	GET /xdata/images/city/square250/690179.webp?k=cb5eb236e7e9bf988a677e4fbdbf81ef955c828b5bfccac307c9f9786f31d48e&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:44 UTC	537	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:44 GMT ETag: "ad134843f38628f0e4d7db61f2683e4ce09f481c" Content-Language: 12702 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Miss from cloudfront Via: 1.1 d125bf8405e840aa51a88ae3d8d91fb2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: aTDj7fgNkMvRZAMvNo2SPJ0ZVNpSwBKp3IdElBcbL1Vj5__tS4Ea1Q==
2024-02-08 18:36:44 UTC	12710	IN	Data Raw: 33 31 39 65 0d 0a 52 49 46 46 96 31 00 00 57 45 42 50 56 50 38 20 8a 31 00 00 10 bc 00 9d 01 2a fa 00 fa 00 3e 6d 30 93 47 26 24 22 a1 a9 52 dc 38 c0 0d 89 41 12 04 c3 96 5b 03 ab db ea bf eb 79 ed f2 3f 8b 92 06 c3 23 b1 33 73 f7 6e 3e 6b ba 79 4f 79 f7 5d 7e 64 7e 2b f4 c7 fc cf 8b 2f dc b2 bf f1 5f e3 79 a1 f6 c3 f9 ff e2 bd a3 7f 61 fb 31 e4 ef ca cd 42 fd a1 fe eb d2 b3 ef ff 68 7c 5e b6 8f f7 5e 84 de ea 7d df cf 67 ea fc ed fb 4b ec 09 e5 d7 fd 1f 0f 4f c0 7f c5 fd b3 f8 05 fe 91 fe 07 f6 83 d9 47 eb df 4d 3f b0 ff b2 f6 20 e9 b4 7f 8e b0 82 3c 44 e1 6b 48 95 1e b0 7b 89 05 bf 92 e5 f7 97 83 47 3a d1 5f b3 f7 34 53 78 b3 1a c3 4d 0f 56 78 c9 ef 74 c7 73 4a 27 06 da 73 d9 c8 ab 5c 04 43 e9 dc d2 d3 f2 a0 20 43 cc f0 cc 74 fa 75 fe b7 03 41 9e f9 5f Data Ascii: 319eRIFF1WEBPVP8 1*>m0G&$"R8A[y?#3sn>kyOy]~d~+/_ya1Bh\|^^}gKOGM? <DkH{G:_4SxMVxtsJ's\C CtuA_
2024-02-08 18:36:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
853	192.168.2.5	50720	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:43 UTC	682	OUT	GET /xdata/images/city/square250/786960.webp?k=e313213321010a516ee56b6ee04e367f770af64eaae9e8e230cde42d2cbca75a&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:44 UTC	537	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:44 GMT ETag: "26068a16355384ba3585236d5faf790db7f1bed8" Content-Language: 15612 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Miss from cloudfront Via: 1.1 b0c7b942a33f0f4451718aee53f7840c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: WoWxoz9TLb26oBEDVYAACHnyuAApW1CPQw0kex1XBPFCLNxeghrJ-g==
2024-02-08 18:36:44 UTC	15620	IN	Data Raw: 33 63 66 63 0d 0a 52 49 46 46 f4 3c 00 00 57 45 42 50 56 50 38 20 e8 3c 00 00 70 ab 00 9d 01 2a fa 00 fa 00 3e 69 2a 90 45 a6 23 a2 19 0c 6e 0c 60 06 84 a3 3a 73 4c 5c 86 7c 34 10 09 aa bf e8 ea 2e 79 17 ba 68 e0 e1 19 d2 39 b5 fc 17 75 5f 60 18 49 7a 79 32 a2 fd ff fe b3 c0 bf 19 be df fd b3 fc d7 a5 de 18 fa d3 d4 23 ba bc e8 7e fd ff 77 fc 4f 8a 7f 15 75 0b f6 f7 9d 67 d4 f6 57 ee 3f eb bd 02 3d f5 fc 1f 99 07 d3 79 99 f6 7f d8 0b c8 ef f8 9e 14 1f 74 ff 63 fb 69 f0 09 fd 43 fc d7 ab 7f f8 be 49 3f 62 ff 73 ec 39 e5 91 ff ff dd f7 ee 7f ff ff ff ff 18 0b 08 41 e7 00 b8 af 8a 47 e8 ec 9d 03 95 ea 35 39 7c 09 cf ab 88 8b ec fc ae 32 1a a9 c8 b5 7e f1 28 34 22 78 2e d0 87 f1 7a 7b 8c 5f fe a3 b6 12 1a 6a 07 68 94 3c b0 a5 00 e7 9d 38 32 d1 cd a0 80 df ad Data Ascii: 3cfcRIFF<WEBPVP8 <p>iE#n`:sL\\|4.yh9u_`Izy2#~wOugW?=ytciCI?bs9AG59\|2~(4"x.z{_jh<82
2024-02-08 18:36:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
854	192.168.2.5	50719	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:43 UTC	682	OUT	GET /xdata/images/city/square250/977416.webp?k=ea06e0b572ff052f4fe4fcf35ac3616e8d1b7300f0402756c460a4e9c19e54ed&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:44 UTC	537	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:44 GMT ETag: "c4770f0dae2399153c9c92e5f14ca2a9c605f50a" Content-Language: 11060 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Miss from cloudfront Via: 1.1 7699e4f17e72e42cba0c247c650005d2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 84A_OxE3pomeE0oSD2r2A71_wvHpWGSMwTUeXyhSQs5zL6wakGY9tw==
2024-02-08 18:36:44 UTC	11068	IN	Data Raw: 32 62 33 34 0d 0a 52 49 46 46 2c 2b 00 00 57 45 42 50 56 50 38 20 20 2b 00 00 b0 9b 00 9d 01 2a fa 00 fa 00 3e 6d 30 94 46 a6 24 22 a1 a9 32 dc 80 c0 0d 89 65 6e e0 30 3c 1a d5 3e 53 ca 3f 5a 2b db 8f 3e 3f e2 77 9d 9f 9c fe fb e8 43 8b fe c9 f5 1a ef cf 3e 1f da f7 d7 fb 1f f2 7e 81 7e df f4 0b fc 3e d5 4b 7d e8 23 df 8f 37 5f ba f3 83 ed 0f b0 17 93 df f0 fc 39 be fd fe fb d8 3f fa 7f f6 cf 45 7d 2b 7e d5 ff 00 e3 c6 24 44 ef 4a b2 32 78 52 4e 60 c1 86 ae 2a 5d 73 e2 03 37 78 ee a1 35 72 7c 20 14 66 72 c4 f6 f7 e1 64 36 7b c5 1f dd e8 27 59 e9 fd e7 51 a2 00 ed fa ad 92 8b 02 e6 b3 ea 89 70 de 4a 21 83 80 cc 4a 8f 47 bb af 2a db 81 93 7d 5f 35 61 e4 af 25 d7 de b1 21 4f 9b 5f 72 9f 43 10 0b a4 b5 86 0e c0 2a 90 30 12 4e 96 fe 9d 82 ee b8 4b 8a b9 de 75 Data Ascii: 2b34RIFF,+WEBPVP8 +>m0F$"2en0<>S?Z+>?wC>~~>K}#7_9?E}+~$DJ2xRN`]s7x5r\| frd6{'YQpJ!JG}_5a%!O_rC0NKu
2024-02-08 18:36:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
855	192.168.2.5	50721	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:43 UTC	682	OUT	GET /xdata/images/city/square250/689152.webp?k=3e406cd8b3fabad15ed34e82484d43d44bb0a05899ba8252d2334f73dbbe3697&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:44 UTC	530	IN	HTTP/1.1 200 OK Content-Type: image/webp Content-Length: 7046 Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:44 GMT ETag: "4d0d11b4a2b332a2b876436b689450336d5d826b" Content-Language: 7046 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Miss from cloudfront Via: 1.1 7eeed291abf48890d3f36565208941a8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: i273gYnFtmCw_-QwNmMsClbQNImyWAe8w7Fjq5EdOio7Q0gFxe-WMw==
2024-02-08 18:36:44 UTC	7046	IN	Data Raw: 52 49 46 46 7e 1b 00 00 57 45 42 50 56 50 38 20 72 1b 00 00 70 93 00 9d 01 2a fa 00 fa 00 3e 6d 30 94 47 a6 23 a2 a1 a8 34 7b 18 c0 0d 89 63 6d 33 d2 fb 34 e0 0c e8 41 1a 49 20 3f 5c b1 a2 b6 3a 76 5c 7f 57 fd 2f 46 5f 2d f8 57 23 3c 32 3c 7b 39 bf 91 ee 9f eb c1 fd 4f ab fe ab 47 53 ff 48 dc 0f 17 f6 af b6 35 cd 6f f4 fd 45 31 4f 53 b7 99 57 e4 79 eb c7 b7 8b 3f e1 ff e8 74 46 ea 37 f6 a3 a3 d8 0a 05 e0 ba 30 a6 45 eb 5a d6 7b f4 67 c2 bc 52 79 91 d6 2f 0f 62 0c c6 3d fe 5f 01 70 34 29 db 01 d2 fd 1c cc 99 70 4c 9b 8e 5c b8 05 34 ae 4b e4 f2 fc 48 95 3e 7d 24 df f6 7e 7a b0 8d 6b 67 0b 1a 7d ec ba 69 c2 f3 67 a4 14 7a f3 86 08 33 50 34 6c 1b af 5c 47 39 57 57 be ff a4 c2 d7 68 e7 ac 49 3c 44 47 41 8b 02 64 bc cb 3a ce e2 1a c9 d4 96 89 59 e2 8c ef 36 60 Data Ascii: RIFF~WEBPVP8 rp*>m0G#4{cm34AI ?\:v\W/F_-W#<2<{9OGSH5oE1OSWy?tF70EZ{gRy/b=_p4)pL\4KH>}$~zkg}igz3P4l\G9WWhI<DGAd:Y6`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
856	192.168.2.5	50718	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:43 UTC	682	OUT	GET /xdata/images/city/square250/689838.webp?k=32ffc2bfac0d85557bd5ddfc1ca92c73aef20bc8b4b5f2ac8b77ad47b6b7d5c1&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:44 UTC	537	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:44 GMT ETag: "697f6d5e35a615c8c45e32eb4c6cac8a7ebd07a5" Content-Language: 11818 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Miss from cloudfront Via: 1.1 e268ddb03ed9480c5c602c27323a81ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: DcuU2ziAo6hU4GxL9S5l-vhoaMY4GZa7iND-EG9LV6sikWJx-cHf5Q==
2024-02-08 18:36:44 UTC	11826	IN	Data Raw: 32 65 32 61 0d 0a 52 49 46 46 22 2e 00 00 57 45 42 50 56 50 38 20 16 2e 00 00 50 bb 00 9d 01 2a fa 00 fa 00 3e 6d 2e 93 46 a6 23 a2 a1 aa f3 5d 48 c0 0d 89 65 00 cf da 80 de 3f 5a fd 80 15 fe ea 4d df 85 7f 7f e6 a5 f6 5c 81 f9 a1 6d f1 b9 30 79 59 fb df 05 fc c8 fd 8f f8 8f 6b bf cc 31 87 f2 1e 05 ff 62 ed 9f fd 2f ed 5f 8d 7f 25 f5 17 c3 af f6 bd ce 5a ef fb 8f 41 af 84 33 87 fc df 3c 3f 90 f4 1d e1 bf e3 c5 ea 3e 87 3d 60 3f d7 f3 93 fb 2f fc 8f 64 2f db a3 57 be cd e3 70 6f fb 33 c6 b4 b4 05 3d c0 75 a6 3e af 4a 68 66 d1 4a a1 fd e2 6c 5f 06 ec 69 d6 df 9b b5 8e 77 41 f6 22 96 12 f4 d4 8b 25 a3 aa 7b 7d 23 70 a9 86 ec 67 49 1b 5f 4c 9f 77 e9 b4 ec 09 ca b3 e6 44 92 c6 dd 17 cf 83 e4 d0 75 78 fa 4c 75 1a 35 ee b2 23 f0 49 88 8f 10 bb 6f c2 bc 77 5b 83 Data Ascii: 2e2aRIFF".WEBPVP8 .P*>m.F#]He?ZM\m0yYk1b/_%ZA3<?>=`?/d/Wpo3=u>JhfJl_iwA"%{}#pgI_LwDuxLu5#Iow[
2024-02-08 18:36:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
857	192.168.2.5	50723	64.233.176.157	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:44 UTC	955	OUT	POST /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-116109-18&cid=421694156.1707417338&jid=1759057297&gjid=1532392567&_gid=1662332493.1707417338&_u=SCCAgAIJAAAAAGgMI~&z=722720305 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain Accept: / Origin: https://www.booking.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:36:44 UTC	593	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://www.booking.com Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Thu, 08 Feb 2024 18:36:44 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:44 UTC	2	IN	Data Raw: 31 67 Data Ascii: 1g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
858	192.168.2.5	50727	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:44 UTC	682	OUT	GET /xdata/images/city/square250/977388.webp?k=4c9c54255e9d2e2d8084959527abea6b6b8a4b8a538a921f1df9e4bea2503ff6&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:44 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Sun, 04 Feb 2024 10:07:42 GMT ETag: "89058bf22a63370898638a51884183132b06e8ff" Content-Language: 16834 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 d125bf8405e840aa51a88ae3d8d91fb2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 27l8npaF6X56pL_Pn2xImu-bVJ6v1aCTZPtG2hPjEKLgHZbaRMcmgg== Age: 376142
2024-02-08 18:36:44 UTC	15835	IN	Data Raw: 33 65 37 30 0d 0a 52 49 46 46 ba 41 00 00 57 45 42 50 56 50 38 20 ae 41 00 00 b0 c7 00 9d 01 2a fa 00 fa 00 3e 6d 2c 91 46 26 23 a2 18 1a c6 30 60 06 c4 b1 b5 99 5e a8 a8 99 b6 af 1f b4 f2 fe e5 3f 2d c2 9d e9 4b 68 f4 3b c0 df 1c 5e fa fd e7 f7 73 fc 0f b6 26 2c fa df ff 7b d0 4f e7 ff 8a ff 9b fe 0f da c7 f2 fd ef fc 97 ff 7b fc af b0 47 b8 7c e8 be eb f2 67 bf f3 6e ff 47 ff 77 d4 47 e0 1f bc ff e0 f4 52 fa 6f 36 3e c6 7b 01 7e b2 fa 57 ff 3b c3 b7 f1 3f ed 3f 70 be 01 3f a7 ff 81 ff d9 fe 83 d8 ff ff 7f f7 9f 99 3e f3 bf 65 ff 63 ff cf fd bf c1 17 ec 77 a6 8f ff 3f 79 9f b8 1e d8 7f b2 60 fe 4d 77 a1 90 6d 66 c2 26 06 9a b0 27 9b 8e eb 63 99 54 96 cd f4 23 ff c6 ac 2a 7d a2 be 5b ca f7 af 80 9f 85 a0 d0 57 d8 fb 71 76 cf 8a 34 96 2d 3c fe dd fd 20 42 Data Ascii: 3e70RIFFAWEBPVP8 A>m,F&#0`^?-Kh;^s&,{O{G\|gnGwGRo6>{~W;??p?>ecw?y`Mwmf&'cT#}[Wqv4-< B
2024-02-08 18:36:44 UTC	157	IN	Data Raw: f0 d5 84 55 ed 21 fe de 09 6f 04 78 76 4a fb 99 3a 87 ab 30 f6 64 df 5d 19 26 8d 41 3a 06 08 2d c7 06 82 a6 39 a5 98 98 d5 61 1f fc b8 32 08 19 48 22 5d cc 1a df 59 e5 14 41 6b 8d b0 4a 25 ce 67 89 e2 39 11 49 59 26 d2 5a 5d 12 c0 19 de 77 b5 6b a4 8f ea ba 01 9f d2 93 f7 73 e0 fc ef 77 9a 20 8d 13 39 25 70 93 6f 92 98 66 08 be 94 cf 7b 34 c3 3d b4 95 ae d1 84 47 b1 41 5e 9a 42 fb d1 06 51 14 9e 0e 52 cd b8 b9 5a 5d fe 4b d2 bb 3c 47 ec fa 48 75 2b 4a d9 3c fc 0d 0a Data Ascii: U!oxvJ:0d]&A:-9a2H"]YAkJ%g9IY&Z]wksw 9%pof{4=GA^BQRZ]K<GHu+J<
2024-02-08 18:36:44 UTC	857	IN	Data Raw: 33 35 32 0d 0a 83 f8 ed b0 d1 fa 42 90 a8 b6 af ab a1 33 16 3f b7 47 57 50 d9 68 6b c1 8c 69 40 20 3a 89 ed c1 f7 2d 0b 67 5b 66 19 16 00 b0 97 37 38 39 ef f7 5e 27 2d c2 5e 3e 50 b7 cf ea 42 4b b9 0b b9 34 01 05 3f db 9d 6e fd 85 e8 84 01 96 d5 08 8a 5e 0f 49 39 c4 d6 be e1 bd de 35 d7 ee 4b cb 5b ff 19 34 dd bd 3e a3 6e 09 8a 6c 4b 12 32 8a 6c 74 f5 29 c9 ba 0d c9 16 d9 81 cc 18 e6 aa c3 0b 69 7f dc 04 66 72 f3 68 5b c0 e6 93 11 46 df 37 b8 b5 6d 11 16 b3 0b cb 3e e9 d2 f9 b5 f9 a9 f8 a5 ef 86 2a 9f 07 8c d1 cd d8 de a1 38 5e 02 46 20 5e f6 00 00 b6 ca 38 eb 85 7c 15 4e f9 61 83 1f 2d d4 dc 41 db 72 fb 78 4c 82 87 3c 0f 0c b3 87 33 a2 40 fe 32 f0 19 e2 ed b9 61 41 ff c8 80 e7 75 ee c2 c5 7a 10 4e 0f 82 32 00 06 5b 1a ec 2c d2 e8 4d 6a 72 fa 73 6c 78 d9 Data Ascii: 352B3?GWPhki@ :-g[f789^'-^>PBK4?n^I95K[4>nlK2lt)ifrh[F7m>*8^F ^8\|Na-ArxL<3@2aAuzN2[,Mjrslx
2024-02-08 18:36:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
859	192.168.2.5	50728	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:44 UTC	447	OUT	GET /xdata/images/city/square250/976708.webp?k=cb62481ca3494ac4e0b030345eedc77024732fb227f5642c773e5a11f534016c&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:44 UTC	544	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:40 GMT ETag: "7a92d4fc9cef018cd7367cd5643c0caa26b048a5" Content-Language: 13904 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 309e9e958e8d35f7e17ae8ac267b7dea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: kL7MVMW_3AgSNFsXpApZPrz2H7XuOJIn_1SVxworu8fvsBgi3FynKA== Age: 4
2024-02-08 18:36:44 UTC	13912	IN	Data Raw: 33 36 35 30 0d 0a 52 49 46 46 48 36 00 00 57 45 42 50 56 50 38 20 3c 36 00 00 f0 ae 00 9d 01 2a fa 00 fa 00 3e 6d 30 92 46 a6 24 22 a1 ab 55 5c 50 c0 0d 89 65 6b 2b ff bc 03 71 a3 86 70 00 c7 6d 1e d7 8b 7f dd b7 97 07 37 e4 12 c3 5f c1 b0 9a 95 1a ac 45 a6 3a 8f fb 1f f0 7f bb 9f e3 7d b7 f2 2f f0 1f ce 79 8f f6 5f d2 9e d9 3f a2 fd 94 f1 b7 e3 3f fc 5e a0 be d7 ff 87 e9 63 f5 bd bf 3b c7 fa 8f fb de a2 3e f6 7d 8f ff 07 a1 cf d0 f9 a5 f5 ef d8 1b f5 a7 d1 ef f5 be 18 7f 6f ff 2b fb 3f f0 0d fd 1f fc 4f fe 2f f5 5e ca 3f 61 7a 66 fd 8b fd a7 ed 9f c1 17 4d cf dd 13 7c e6 a1 51 36 3a 08 04 ef d3 82 d7 13 33 45 87 94 2c ab e5 9e ff 3a 6e 40 cc f2 f0 9d 70 c2 ea 23 3b 4d 7f 94 27 cc e8 45 63 da 56 e8 dc 88 f2 5f aa 02 98 8d 79 91 fc 1f dd 21 84 ea d0 af 87 Data Ascii: 3650RIFFH6WEBPVP8 <6*>m0F$"U\Pek+qpm7_E:}/y_??^c;>}o+?O/^?azfM\|Q6:3E,:n@p#;M'EcV_y!
2024-02-08 18:36:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
860	192.168.2.5	50729	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:44 UTC	447	OUT	GET /xdata/images/city/square250/689573.webp?k=4aefe3aca3ad388dca94c5fc8123ddd89aff34d443ccaa192a8b4ec6981c5b90&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:44 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Mon, 05 Feb 2024 07:30:26 GMT ETag: "5523d4acdcaeef0dc949126a4b9ffc77845fc166" Content-Language: 10200 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 ea0f86c249e022d5015ce79f54e723d0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: GWZxI_eqxxluAt2j_hSAXWRFq7SNLsSWWKxJWVBVGI-jVsqE94u3RA== Age: 299178
2024-02-08 18:36:44 UTC	9596	IN	Data Raw: 32 35 37 34 0d 0a 52 49 46 46 d0 27 00 00 57 45 42 50 56 50 38 20 c4 27 00 00 b0 8c 00 9d 01 2a fa 00 fa 00 3e 6d 32 94 47 a6 24 22 a1 a7 56 1b 08 c0 0d 89 4d da f6 6b 73 32 2d 9d af ec 56 c9 43 19 f2 dd 75 5e d6 7c a7 dd a7 ce 74 e8 c7 d3 b1 f3 37 f8 2e fa 7f ef 3f ed 7f 8d f7 85 fa 83 fe ef 58 7f f8 7e c7 ff b5 ff b3 f5 7f fb 55 eb 4b ff 1f d3 3b d2 ab aa 4f a2 83 fe ef b5 27 ee 9f b4 0f ee 86 0f c3 53 f5 5b f5 5f 9b 3f df bd be b2 2f f1 7f dd 79 95 f7 09 cf be d9 bf b2 ef 9f e4 2f fb 1e a1 de cc ff 75 e9 31 f6 5f f5 7b ea 76 af f4 df f5 bf cc fb 0b fb 85 f6 5f f9 3f df bd 82 fe cf ff 1f a3 ff 64 fd 80 7c c2 ff 95 e2 f3 e9 1e c0 9f d3 bf bc fe 3c 7c 44 7f 75 ff cf fd 97 a7 bf d9 ff d5 ff f1 ff 57 ed 13 e9 b1 e7 67 ed 5a 65 bb ac 12 4f 53 a5 6d 72 8d 32 Data Ascii: 2574RIFF'WEBPVP8 '*>m2G$"VMks2-VCu^\|t7.?X~UK;O'S[_?/y/u1_{v_?d\|<\|DuWgZeOSmr2
2024-02-08 18:36:44 UTC	619	IN	Data Raw: 32 36 34 0d 0a 84 71 8f 9c 59 ed 4e b2 19 d8 22 99 23 24 6f 7c 7a f2 e1 e9 61 32 43 4f 02 cf 67 82 12 d4 e0 f0 66 24 01 33 36 6c 97 c1 83 40 33 f6 78 1b ba 2c d5 17 f1 f1 f9 23 2c 09 c5 64 67 b9 c6 a1 9a 04 de 4c 22 36 3c 06 f5 70 bb b4 4e 34 0b 2e ee a3 79 ce ca 8b 4f 0d d7 b7 e0 68 54 bb 31 e0 ab f8 4c cb 66 23 a6 fc 38 e3 3f 9b d9 d1 6a 58 76 8b d8 2b 8f 93 81 0e 53 c5 65 c3 40 38 1a fb bc f1 22 1b 6f 36 b7 39 8d 2a c3 f5 0a 11 a5 91 0c 84 95 7b e3 f2 10 5c 10 e0 bb 6b 7c 1b 2a be bf 29 d2 2d 0c 78 bb be 1a ae f6 23 db e1 24 d5 be de fb cc 6d 3b b7 46 2f cd 3b 87 60 12 51 4e 0c 36 b5 52 30 6f b5 0d 99 26 14 d4 5a 1a bd c0 e1 a3 68 8e 51 8d b2 54 a0 3a 83 e4 03 f3 af 6f fd 8c ae 81 31 5e b1 76 36 77 00 60 cd ae f0 dd 71 ba 53 51 ee 2d 2b d8 8b 61 18 15 Data Ascii: 264qYN"#$o\|za2COgf$36l@3x,#,dgL"6<pN4.yOhT1Lf#8?jXv+Se@8"o69{\k\|)-x#$m;F/;`QN6R0o&ZhQT:o1^v6w`qSQ-+a
2024-02-08 18:36:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
861	192.168.2.5	50730	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:44 UTC	447	OUT	GET /xdata/images/city/square250/352166.webp?k=70257e02f84d33fc68f9da008ec0c40b54a86ce522305dfa807b0bc449ee690c&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:44 UTC	544	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:41 GMT ETag: "a351111d46999d06faae3832f723a2e93a4df5fc" Content-Language: 21134 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 c625b1bdde545acdeb26c9f6ad3a8c6e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 01KK2lVyJ9cKEPLJgtBEfQOHa_DYRil9rndAq16NzpSNIZoajJjfVA== Age: 3
2024-02-08 18:36:44 UTC	16384	IN	Data Raw: 35 32 38 65 0d 0a 52 49 46 46 86 52 00 00 57 45 42 50 56 50 38 20 7a 52 00 00 f0 db 00 9d 01 2a fa 00 fa 00 3e 65 26 8f 45 a5 a3 22 1a 6c 67 00 58 06 44 b1 9f 8e d4 53 83 07 ad b1 4e 8e 79 47 e3 79 db f5 eb b3 b3 1b df 57 c9 79 90 10 c6 13 97 46 04 06 3f 5e ff 76 f0 17 f2 2f 9a 7f 37 fd c3 fc 97 fe 0f f0 1e d3 b8 37 ea 23 fd cf 40 bf 9c 7d f8 fe 5f f7 ef 3e bf f3 7f 9a f1 17 e2 1f fb 1f e6 bd 81 7d a9 ff 23 d0 fb e8 fb 23 b6 7f f3 5f b6 9e c1 7e f7 fe 03 be ef fe bf f0 de a3 fe ab fe 2f ff 4f b8 0f f4 7f ed 3f f8 bf c2 fb 09 fe cf c1 a3 ee bf f0 3d 80 ff a8 7f 88 ff e9 fe 9f dd 9b fb df ff 1f ef fd 0d fe bf fe b7 d8 67 f6 57 d3 63 ff ff bc 6f dd 0f ff fe f6 01 e2 33 15 9a b2 49 bf 0b 9c b7 be 55 fc 89 51 b3 a1 5c 6e c4 ff 31 ac 43 bc dc 81 4a a0 b9 c6 41 Data Ascii: 528eRIFFRWEBPVP8 zR*>e&E"lgXDSNyGyWyF?^v/77#@}_>}##_~/O?=gWco3IUQ\n1CJA
2024-02-08 18:36:44 UTC	4758	IN	Data Raw: 18 a5 90 1f ef 82 a7 79 23 0b f2 9a 0f bb cc 35 3d 49 ce c6 7f 78 ec 2e 21 74 e2 ba f1 21 d3 ab 59 81 69 dc 40 43 9f c6 ee 9c 47 49 21 5d f5 07 10 77 b5 0b 16 42 b1 aa 69 4d 57 7f 5d 1e 5c 6a 38 7c 2b b0 7b 67 ee 51 af 53 cd ed a9 e7 88 bc 86 ae c9 70 f9 54 07 94 5b 29 22 ea 8e cd 9c 74 e0 8b 34 2d 0b 46 ee 67 d0 70 a3 2b b0 4f d2 13 4e ad 62 37 b3 28 2e 06 1b 27 86 63 75 65 eb e0 e0 2a 5a 83 4c ec 26 80 57 55 c9 81 ff c7 00 f1 1f 74 72 39 48 3a ab b8 cd 88 08 96 08 24 45 84 e4 1f eb e4 e0 a7 1c 0d bf 4c f0 77 a4 9f 90 b4 a1 69 32 50 d0 de 62 ea d3 24 dc a5 d0 8d f4 34 db fe 0e 36 4b 20 cc f9 b9 aa 80 50 a3 c6 e8 4d b3 5d 5d cf 66 40 b5 ef 67 8d f1 e2 af 0e 53 b8 8e 6d 17 07 01 32 74 34 21 5c 35 49 8c 7b 09 1a 15 c7 7e 91 26 23 bd d3 ae f1 a1 cf e9 35 0a Data Ascii: y#5=Ix.!t!Yi@CGI!]wBiMW]\j8\|+{gQSpT[)"t4-Fgp+ONb7(.'cue*ZL&WUtr9H:$ELwi2Pb$46K PM]]f@gSm2t4!\5I{~&#5
2024-02-08 18:36:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
862	192.168.2.5	50731	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:44 UTC	447	OUT	GET /xdata/images/city/square250/976877.webp?k=2aab28217f0fb039e0f35ea2b2c3976141b5860b074f74220edf998115935cda&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:44 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Mon, 29 Jan 2024 10:27:14 GMT ETag: "f2a5ee553ff43f0ff8ae2fa36a53ff6bf91d0508" Content-Language: 18472 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 086e2cd5d94fa729de58c51b5666e0e4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: OXHMFh-3vy75mNU-uC2AfVVxbFyMTchtEQIlb57HWuJBGCT6VvvEeQ== Age: 893369
2024-02-08 18:36:44 UTC	16384	IN	Data Raw: 34 38 32 38 0d 0a 52 49 46 46 20 48 00 00 57 45 42 50 56 50 38 20 14 48 00 00 b0 d1 00 9d 01 2a fa 00 fa 00 3e 69 28 8f 45 a6 23 22 19 eb de 8c 60 06 84 a6 cc a5 a1 53 d5 f2 d2 0c 0e ae 6b b8 f2 c2 e4 5f 03 fe a9 95 8f 10 e3 cd 6c 1f fa 3e bd f9 6f 3f 5c be 1b fe e3 fa c9 fd bb fd 8c f7 64 ff 79 fb 79 d6 93 fe 03 d6 5f d6 73 fa 3f a9 f7 ec e7 a6 df ed df c4 a7 ed ad b4 2f 15 7f 0f f9 4b e6 6f 8c 6f 77 7e e7 fe 63 fe e7 f8 af 6c 1f a5 7c 21 74 6f 98 9f ce 7f 1a 7f 23 fc 6f b4 cf e0 bf ed 7f a8 f1 6f e2 37 fb be a1 1e cc ff 93 fd ff d6 77 e9 3f 6d 3b b4 36 6f f2 9f b4 1e c1 7e e2 fd bb fe df f9 3f 52 5f 9b ff db fe 97 d4 ef b0 de c0 5f ad bf f8 7d 5a ff 7b e1 41 f7 df f5 df b8 ff 00 9f d5 3f bd ff f2 ff 4b ee dd fd af ff 7f f7 5e 8b 7e a9 f6 1b fd 89 f4 d2 Data Ascii: 4828RIFF HWEBPVP8 H*>i(E#"`Sk_l>o?\dyy_s?/Koow~cl\|!to#oo7w?m;6o~?R__}Z{A?K^~
2024-02-08 18:36:44 UTC	2096	IN	Data Raw: a7 14 13 43 5a b8 04 c5 09 00 0a 3f 87 3d f4 40 ab 3b c9 d3 e2 73 73 b8 89 48 f3 0d d9 16 7f 5f cf da 69 a0 c6 d3 6f c5 cb 8e cf a4 7c 73 b6 14 18 fa b9 30 4c bf f4 47 9e dc 0e 93 c7 fa ce f9 49 b1 03 d9 fb 3a c4 42 f3 e8 81 36 a1 21 a4 f0 a2 1c cb fd 30 29 16 8c 59 da 60 ec 76 82 8c 1c 19 40 46 2a 35 5c 2e 33 d4 5b ab 66 5a 42 61 09 b1 7a b8 07 98 cb b4 87 37 0c 4b 40 19 ed 01 9e 12 96 81 99 07 bf 4c 36 07 df c0 44 10 b7 63 43 fe ee 13 56 7e 3c 02 17 90 47 6e 22 6a 76 61 2b 72 30 33 33 84 71 0d c8 53 3f 4d 8f 43 3d 84 75 da f8 06 95 90 c4 dc 0f 72 74 2b 9b fb b0 12 45 c9 e2 61 eb aa 3c 83 39 73 55 13 7d a7 e7 82 8d 50 32 1e b0 4a 55 b4 39 f8 34 9d a7 d5 d2 b7 f0 3e 8e 13 a4 af b9 f3 74 3e cb e2 9d af 3c 96 d5 79 fd 18 1a b1 f0 7d 3d 4e 6f 7f ed 87 47 d9 Data Ascii: CZ?=@;ssH_io\|s0LGI:B6!0)Y`v@F*5\.3[fZBaz7K@L6DcCV~<Gn"jva+r033qS?MC=urt+Ea<9sU}P2JU94>t><y}=NoG
2024-02-08 18:36:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
863	192.168.2.5	50732	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:44 UTC	447	OUT	GET /xdata/images/city/square250/976744.webp?k=d386664a0cfa562d8586fa2251c11c4f6d14e554281a47189dd8c3bb5c2b798a&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:44 UTC	544	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:41 GMT ETag: "d87dd83248541ad9faa8adbd4f5d2f999d29ccd5" Content-Language: 13702 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 a53ebc5c4d12bc9682b9c11ea18dccbe.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: gFpBLjlZ0Dns7quebzfTpuByVVAicenOq_LiSh8XjYrDjR610_ZlvA== Age: 3
2024-02-08 18:36:44 UTC	13710	IN	Data Raw: 33 35 38 36 0d 0a 52 49 46 46 7e 35 00 00 57 45 42 50 56 50 38 20 72 35 00 00 f0 9a 00 9d 01 2a fa 00 fa 00 3e 6d 2c 92 46 26 23 a2 97 3c 85 9c 60 06 c4 b2 b7 7d 0a 5a fa 5b b9 bf 7d bb 63 28 2f 11 57 0b 6f b8 f1 05 35 d6 9e 5b 92 27 ca f4 d5 6b 15 6b 1f c1 ff d2 78 13 e2 57 d8 ff bf ff 8e ff bb eb 11 88 3e ba f5 0b ed 7f f8 3f e0 3d a3 ff 01 ff 97 fc f7 89 ff 24 7f dd ff 19 ec 11 ed 8f d7 ff 59 df ae ec af da 7f d7 7e d3 fb 02 fb b5 f7 2f d8 df 1c ad 45 fb ff ec 03 fd 17 fb 37 9d bf e8 fc 26 7e d5 fe ef d8 17 fa 2f f7 3f fd df e9 3d dc 3f b7 ff f1 fe cb d1 0f ec 7f eb 3f 6d fe 07 3c b3 ff ff fb ac fd d1 ff e7 ef 45 fb 96 96 d2 dc bb cf eb 5f 86 39 ae 3c f3 cf 24 ec 22 6d 7f f4 7f f8 42 a6 bc f6 f8 48 df 41 af 8b 73 87 95 d7 07 58 27 5b 39 f8 76 74 2f 7d Data Ascii: 3586RIFF~5WEBPVP8 r5*>m,F&#<`}Z[}c(/Wo5['kkxW>?=$Y~/E7&~/?=??m<E_9<$"mBHAsX'[9vt/}
2024-02-08 18:36:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
864	192.168.2.5	50733	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:44 UTC	447	OUT	GET /xdata/images/city/square250/689617.webp?k=edf88994b0c6b4c060300b942efdc1242289d1a695fcea13493e20596edc7daa&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:44 UTC	537	IN	HTTP/1.1 200 OK Content-Type: image/webp Content-Length: 5836 Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:41 GMT ETag: "5ed7894801b9c0c2d25e22433d0d1da1feefbad7" Content-Language: 5836 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 3f95374273631adbfd8e0d0a9f6d7b64.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: BQeTr_-NXXm3CBl8nVLendbGXLvXtv62tpyLzwAmrtOMCE9tIPnDUw== Age: 3
2024-02-08 18:36:44 UTC	5836	IN	Data Raw: 52 49 46 46 c4 16 00 00 57 45 42 50 56 50 38 20 b8 16 00 00 f0 7b 00 9d 01 2a fa 00 fa 00 3e 6d 32 95 48 a6 23 a2 a1 a3 30 ab 08 c0 0d 89 63 6e 2d e3 5a 1f db bf 25 20 be 8f 13 95 ee 94 86 f2 ad e2 7d 8e 25 0b 8d 57 f5 d3 d8 01 65 ec 9c e6 78 d9 f3 bd fd d2 7f e6 8d 30 3f 70 89 dd 07 b1 5f cf fd d0 b7 78 c3 df d8 77 6e ed df da 6f ee 5f c8 72 65 48 e5 3d 3d 24 a7 43 e1 1e 5c 5f 19 cf 23 f6 0b fe 77 fd db f6 03 de 47 fc df 3e 7f bb 7f b3 d2 2b 20 d6 19 e7 6e 9f 9f 23 b4 05 6a 99 4f fe b4 c6 1b ee ed 89 c3 a0 de ff eb de 76 44 fc 12 da ad ec ea 1c b8 f0 32 9c 07 4a 3f b6 df d4 b6 bb 3b 5e ac 8a 8c 02 a9 a8 a8 46 2d ff 76 17 af 32 58 99 e8 5f 38 93 82 88 e1 a2 82 9a 1a b6 b6 6d be b5 7e b1 40 81 af f0 18 26 6e f3 79 ab 40 ab 96 65 55 06 1a 54 c5 8f 09 4c 5d Data Ascii: RIFFWEBPVP8 {*>m2H#0cn-Z% }%Wex0?p_xwno_reH==$C\_#wG>+ n#jOvD2J?;^F-v2X_8m~@&ny@eUTL]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
865	192.168.2.5	50734	104.18.32.137	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:44 UTC	380	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:44 UTC	249	IN	HTTP/1.1 200 OK Date: Thu, 08 Feb 2024 18:36:44 GMT Content-Type: text/javascript Content-Length: 79 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8525fadac9236738-ATL
2024-02-08 18:36:44 UTC	79	IN	Data Raw: 6a 73 6f 6e 46 65 65 64 28 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 47 41 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 47 65 6f 72 67 69 61 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d 29 3b Data Ascii: jsonFeed({"country":"US","state":"GA","stateName":"Georgia","continent":"NA"});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
866	192.168.2.5	50735	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:44 UTC	4945	OUT	POST /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 1477 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-AID: 304142 X-Booking-Pageview-Id: d16682db432d0172 X-Booking-Info: 1908890,1914530,1908890\|1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7 sec-ch-ua-platform: "Windows" X-Booking-Language-Code: en-us X-Booking-CSRF: dlfFZQAAAAA=9FEpDaCj1qqLdemHHz3PAsjsumCEOKcSBegdNQuXcZ3_gZl_kN0VsNDXgRe0ATwcE5urQkwmo2KWpVgW5QJwbPGV9GbJwVQ4wghe1QBGjzQB60WEFosHhV4PwY1mc4hwAusHrxF2T8D0J5_AJQXRQn9kqNDUTvK0-rlnqU9QKWQ3r4-Kg3ajLU-6vixaGPa7ESiUEgsJgaiJczqx sec-ch-ua-mobile: ?0 X-Partner-Channel-Id: 3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Accept: application/json, text/javascript, /; q=0.01 X-Booking-SiteType-Id: 1 Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/packages.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAfk6BVJUjAAAA:WDfXg2ry+HvbnxTztLnepFvhf3dpX4SdQfM4GczRrcPw6MWAZH8MErn+af2Y9SvAts7ySjM/T9nCQWaxTWJ+ECSRYADCgGFp6g8nwqAAp4uZuesbnPNMB9VWMMTR/6OqpiFI1lm6c8HTX0et8uTZTDvEovUpe/ZJPj+EvnZwpL1hdq9NKhFzFZb6nk1kcyw+S5Gmb0WW/JMfQvkBUX6FX8nHd2pkcvntEKFlkhvMXyaXZ+ocI5s4XxhjbVLG6yziJfNgBxF+; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbVA9iGwA%2BUSwQ2O%2FlHm0pqQylRO2dJ7x%2FYlVcVU5Hiw1maEZ7F5OJC7JbdIX2o2ehMp3Yo4XT4lkzfuwozqYc9CeWfmPGKOe3hqqu4HQULabtlMTEeCieJXNZjl6azPIa5VZ0lIM7ZhfVN1YLZMT32klhmcppfCGhIQ8euPDUOg0%3D; header_signin_prompt=1; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false
2024-02-08 18:36:44 UTC	1477	OUT	Data Raw: 7b 22 65 76 65 6e 74 73 22 3a 5b 7b 22 61 63 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 61 70 70 74 72 61 63 6b 2e 6c 61 6e 64 69 6e 67 5f 70 61 67 65 5f 66 75 6e 6e 65 6c 22 2c 22 61 63 74 69 6f 6e 5f 76 65 72 73 69 6f 6e 22 3a 22 31 2e 30 2e 30 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 61 66 66 69 6c 69 61 74 65 5f 69 64 22 3a 22 33 30 34 31 34 32 22 2c 22 6c 61 62 65 6c 22 3a 22 67 65 6e 31 37 33 6e 72 2d 31 46 43 41 45 6f 67 67 49 34 36 41 64 49 4d 31 67 45 61 49 38 43 69 41 45 42 6d 41 45 78 75 41 45 58 79 41 45 4d 32 41 45 42 36 41 45 42 2d 41 45 43 69 41 49 42 71 41 49 44 75 41 4c 7a 76 5a 53 75 42 73 41 43 41 64 49 43 4a 44 49 31 4e 6a 4d 30 5a 44 64 6a 4c 54 64 6d 4d 7a 41 74 4e 44 51 79 4d 43 31 68 4e 32 55 77 4c 54 63 78 59 7a 68 68 4d 6a 6b 77 5a 44 Data Ascii: {"events":[{"action_name":"apptrack.landing_page_funnel","action_version":"1.0.0","content":{"affiliate_id":"304142","label":"gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZD
2024-02-08 18:36:44 UTC	1177	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Content-Length: 61 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:44 GMT vary: Accept-Encoding, User-Agent access-control-allow-credentials: true access-control-allow-origin: https://www.booking.com set-cookie: bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbVA9iGwA%2BUSxwIu42mh5GOPt%2BW7AjYQvdrYhpXt0yQFsQgSxwG2BeSZAS5JRsMvijVPUCEElqMR%2BgrpCsa0hesk9dK0dyhz4ueIXiJkQ7CCAR6GErty2h09ffyYfs3vBFMK3lSm5wxNxn%2Bv9npOMvhMSJBOD4Bbg9B4eWxmufPHI%3D; domain=.booking.com; path=/; expires=Tue, 06-Feb-2029 18:36:44 GMT; Secure; HTTPOnly; SameSite=None strict-transport-security: max-age=86400; includeSubDomains x-content-options: nosniff content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=a87e82deb98e0121&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqss5gIFbPEtOEHMMKnk2isBb-kHLbnPVNds x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 45893c5ff2aa24fa7dce9573a0274642.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: kwq1U0OuV9f2phe9IZzyVBP0abt7GAEwV9rv5SG2tSsw32wHemsB4Q==
2024-02-08 18:36:44 UTC	61	IN	Data Raw: 5b 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d 2c 7b 22 63 6f 6e 74 65 6e 74 22 3a 22 53 65 6e 74 22 2c 22 73 74 61 74 75 73 22 3a 31 7d 5d Data Ascii: [{"content":"Sent","status":1},{"content":"Sent","status":1}]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
867	192.168.2.5	50736	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:44 UTC	3771	OUT	GET /logo?ver=1&sid=5171fc655664ddf74ab763a094523fb7&t=17074173981 HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAfk6BVJUjAAAA:WDfXg2ry+HvbnxTztLnepFvhf3dpX4SdQfM4GczRrcPw6MWAZH8MErn+af2Y9SvAts7ySjM/T9nCQWaxTWJ+ECSRYADCgGFp6g8nwqAAp4uZuesbnPNMB9VWMMTR/6OqpiFI1lm6c8HTX0et8uTZTDvEovUpe/ZJPj+EvnZwpL1hdq9NKhFzFZb6nk1kcyw+S5Gmb0WW/JMfQvkBUX6FX8nHd2pkcvntEKFlkhvMXyaXZ+ocI5s4XxhjbVLG6yziJfNgBxF+; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbVA9iGwA%2BUSwQ2O%2FlHm0pqQylRO2dJ7x%2FYlVcVU5Hiw1maEZ7F5OJC7JbdIX2o2ehMp3Yo4XT4lkzfuwozqYc9CeWfmPGKOe3hqqu4HQULabtlMTEeCieJXNZjl6azPIa5VZ0lIM7ZhfVN1YLZMT32klhmcppfCGhIQ8euPDUOg0%3D; header_signin_prompt=1; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false
2024-02-08 18:36:44 UTC	780	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:44 GMT vary: Accept-Encoding, User-Agent set-cookie: BJS=-; domain=booking.com; expires=Fri, 09-Feb-2024 18:36:44 GMT; Secure; HTTPOnly strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=a2c782dedef1005b&e=UmFuZG9tSVYkc2RlIyh9YbpBYTW1tHKzBueHrgUFLskX3B-YxvFUxyKGCSyAZc44 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 ea0f86c249e022d5015ce79f54e723d0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 70bwe3DXy5nHgSvj7yvJBb7an2Ou2P6IcmYfvGY9DtDhtrKko9l0Zw==
2024-02-08 18:36:44 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
868	192.168.2.5	50738	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:44 UTC	1003	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-116109-18&cid=421694156.1707417338&jid=1759057297&_u=SCCAgAIJAAAAAGgMI~&z=391046350 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:44 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:44 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:44 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
869	192.168.2.5	50737	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:44 UTC	682	OUT	GET /xdata/images/city/square250/976861.webp?k=16d2ae8c0dfb3a2fa26b763677f321f1381be233e5dceaca916c520802b840ad&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:44 UTC	542	IN	HTTP/1.1 200 OK Content-Type: image/webp Content-Length: 6742 Connection: close Server: nginx Date: Mon, 05 Feb 2024 07:30:27 GMT ETag: "8d89ca4827a36b602f3819f29f6703c47110514d" Content-Language: 6742 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 f588325f7617672d954c4267c8bee1ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Ok-EP5acdJmw8O1QIJKkLFn0A2XwdSyGhhJNVShhmA__2Flhx56pbg== Age: 299177
2024-02-08 18:36:44 UTC	6742	IN	Data Raw: 52 49 46 46 4e 1a 00 00 57 45 42 50 56 50 38 20 42 1a 00 00 d0 86 00 9d 01 2a fa 00 fa 00 3e 6d 34 94 47 26 24 a2 a1 a9 74 7a 98 c0 0d 89 67 6e 28 bd d1 d9 ae 38 6d 8a 48 b6 da 15 99 9e de e5 b3 07 ca 8f b1 ef e8 c0 16 87 e6 6e 0b 5d fd 03 af ea fd 7f 53 e0 97 f6 be db df e4 77 fb f3 ae 61 fb 9e b5 ae 3b 09 e5 fd ca cb 89 e4 3f de f0 74 f5 4b 30 ad 74 20 55 31 4a 19 7f 20 13 31 c3 a1 35 5e cc 38 7a 0e 3e d2 e3 f0 33 87 6f 31 76 95 a7 4e 3d fc 9c a5 7b c8 16 d6 59 c0 7d 85 0b b4 45 5d 5b 23 1b fc 0b 18 4e 77 11 a5 3f 83 f4 5d ca ed ab 4d 3f e0 3e b2 b5 c9 f1 3c f9 af 7d 4e a2 5f 3c 28 8a 08 d4 20 70 e3 f1 9f 9f 29 0d 3e bb b5 ee 7a 9b be a1 6d 7e 1c e1 51 73 50 27 bd 1a c6 0e 1f a0 20 69 51 c8 a2 7d ac 57 41 e5 85 34 11 bd 6c 24 81 5c ae 76 f8 a1 12 db 62 Data Ascii: RIFFNWEBPVP8 B*>m4G&$tzgn(8mHn]Swa;?tK0t U1J 15^8z>3o1vN={Y}E][#Nw?]M?><}N_<( p)>zm~QsP' iQ}WA4l$\vb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
870	192.168.2.5	50741	108.177.122.154	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:44 UTC	705	OUT	GET /j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-116109-18&cid=421694156.1707417338&jid=1759057297&gjid=1532392567&_gid=1662332493.1707417338&_u=SCCAgAIJAAAAAGgMI~&z=722720305 HTTP/1.1 Host: stats.g.doubleclick.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:36:45 UTC	531	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=10886400; includeSubDomains; preload Date: Thu, 08 Feb 2024 18:36:44 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Last-Modified: Sun, 17 May 1998 03:00:00 GMT X-Content-Type-Options: nosniff Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 2 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:45 UTC	2	IN	Data Raw: 31 67 Data Ascii: 1g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
871	192.168.2.5	50739	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:44 UTC	682	OUT	GET /xdata/images/city/square250/689523.webp?k=70ca656d88199dc2b8a04b0bccc877d2c971f409cf9bd5e76c736432579c3467&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:45 UTC	536	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:45 GMT ETag: "15401b89d585ee45318147d3446ad2215eb2f8e4" Content-Language: 8854 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Miss from cloudfront Via: 1.1 f588325f7617672d954c4267c8bee1ea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 5Us1zNa_ocM-yOJqLXkbn2ib64nMKhYCt48y4VeUsEHquGxgJYp6uQ==
2024-02-08 18:36:45 UTC	8862	IN	Data Raw: 32 32 39 36 0d 0a 52 49 46 46 8e 22 00 00 57 45 42 50 56 50 38 20 82 22 00 00 b0 8e 00 9d 01 2a fa 00 fa 00 3e 6d 32 94 48 26 24 22 a1 a5 94 0c 18 c0 0d 89 65 6d b6 6e 0f 21 fe b3 37 8c 69 d1 0d cb eb bd 61 f6 02 6b 39 0f 32 8a f2 4c 30 b3 70 5a e5 b1 6f c3 fe f9 ed 8f 7f 3f 8d ff 03 cc af b9 39 d3 fe fb be ff 96 5a 8a 7b 83 cd 9a 17 1d 1b fb ff d8 8f 62 3f 76 bf 13 e7 3b f9 9e 7b 7d a9 e8 f7 fe ef 89 67 e0 bf d6 fe dc fc 03 fe 8f f4 6f d3 1b ed 1f ed cb 58 0c a1 37 36 34 1d 66 4b ae 72 e5 dc 49 54 7b 16 12 10 f6 68 f4 11 8f 31 5a a2 cf 05 9f 26 35 11 d9 aa 91 21 20 94 1e d7 82 ce f4 fe 7c 9d ea df 3f 92 d1 e0 8b 7d bc b7 73 8d e3 5b 70 dd 6b b0 0a 7f 32 3b 52 f1 7f 46 b2 f6 82 f3 14 10 0d 6f d3 56 9b 81 9e 98 77 6f b0 12 96 38 33 cc 76 5f 4b c0 e8 48 27 Data Ascii: 2296RIFF"WEBPVP8 "*>m2H&$"emn!7iak92L0pZo?9Z{b?v;{}goX764fKrIT{h1Z&5! \|?}s[pk2;RFoVwo83v_KH'
2024-02-08 18:36:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
872	192.168.2.5	50742	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:44 UTC	447	OUT	GET /xdata/images/city/square250/690267.webp?k=05055e2ec19868d57cf86ccb604589b988d64eacbb3e6a8645af8e8e1f8256e0&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:45 UTC	542	IN	HTTP/1.1 200 OK Content-Type: image/webp Content-Length: 5854 Connection: close Server: nginx Date: Mon, 29 Jan 2024 17:47:37 GMT ETag: "13fa017e6b4e4e52595854655e097edae8abddf0" Content-Language: 5854 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 6e0f9dce97fcb3c9b684592a289e4e72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: v-AZUMAT41_C6SEeMWsJ7m_5WubBjRJDYnuX-pFa2mVB4mzzP-UcWA== Age: 866948
2024-02-08 18:36:45 UTC	5854	IN	Data Raw: 52 49 46 46 d6 16 00 00 57 45 42 50 56 50 38 20 ca 16 00 00 50 94 00 9d 01 2a fa 00 fa 00 3e 6d 30 92 46 a6 24 22 21 aa 56 0c b8 c0 0d 89 63 6a c2 d2 d9 5f de bf fe ca d8 2a 5c 92 f0 60 f7 da 57 39 3b c9 b0 07 a3 1d 5e f2 8f c6 33 af ec c5 1d 7b f4 fd 6f 32 5f cb ff ff ca 77 af ee 60 de 4c fc c8 3d 3f ec 78 7d 77 74 7c be 75 b6 2f 6d ed d4 70 cf f7 5d de fb 69 76 cb 83 02 4b 7e 9b 16 c3 6f ff 70 f5 7a 16 e8 7a 6c 6d be 8a 13 92 35 6e 90 b3 c6 e2 62 73 9e f1 59 46 b7 02 24 1c 74 f0 f2 e0 d8 ca 9b 19 85 54 01 d7 4b 72 cd 83 3e 07 27 e2 84 3c b0 21 45 6b 7b d3 e4 c4 cf a3 43 d4 57 9e e9 85 3f 5e 42 6a 39 fd 34 fb 37 d0 c3 16 1b 1e 78 45 81 7a a0 74 89 f9 5a cc 14 3d 58 5e 70 59 69 b6 4f e2 38 01 19 8b b7 98 80 44 f9 b6 49 0c b3 a0 8b d1 c6 2b e1 76 4d 44 51 Data Ascii: RIFFWEBPVP8 P>m0F$"!Vcj_\`W9;^3{o2_w`L=?x}wt\|u/mp]ivK~opzzlm5nbsYF$tTKr>'<!Ek{CW?^Bj947xEztZ=X^pYiO8DI+vMDQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
873	192.168.2.5	50743	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:44 UTC	447	OUT	GET /xdata/images/city/square250/976823.webp?k=96ffc687725d79086ffd57914e2f32803127412daf40ecf1195d9038107917bb&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:45 UTC	544	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:43 GMT ETag: "c5c250c9b94b23a40f4f0eaee988472abfa79ba5" Content-Language: 14458 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 b0c7b942a33f0f4451718aee53f7840c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: MQpEsvHnvDFb68vS00ohAQifAbZhL0uen62HxDF93S50OcrKGj_7Gw== Age: 2
2024-02-08 18:36:45 UTC	8951	IN	Data Raw: 32 32 65 66 0d 0a 52 49 46 46 72 38 00 00 57 45 42 50 56 50 38 20 66 38 00 00 30 b5 00 9d 01 2a fa 00 fa 00 3e 6d 2c 91 46 26 23 a2 16 fb 56 90 60 06 c4 b1 96 a7 9f 20 2d 76 17 81 69 b4 e2 41 ba ef 7a 0f 2e 0e 51 f2 87 f5 dd b4 f7 5f f6 7d 8e bf ab d5 e8 34 9f 48 9f 5d fd f3 f7 6f d7 73 1b 7d 96 ea 29 f3 ef c2 df bc ff 19 ed 8f fa 3f fc 7e 10 fc 88 ff 77 d4 17 da 5f f0 fd 44 3e cb b4 1f 76 ff 6f ff 97 d4 23 de 6f b8 7f d8 ff 23 ea 55 f5 1f f8 7d 11 fb 33 ec 05 fd 27 fb 57 fd 3f 57 bf dd f8 76 fe 1b fd 3f b0 3f f4 3f ee 3f fc ff d1 fb 28 ff ed e7 23 f5 ef f5 bf fd 7f db fc 0f 7e c8 fa 69 ff ff f7 75 fb 97 ff ff de c3 f5 25 4e 9e ae 35 ed 4a f5 81 6c 01 61 09 b5 50 10 69 92 73 09 19 e5 8d 3a 51 0b 9f 59 01 f2 97 36 cb 9e 71 32 90 fc c1 54 05 0f 53 1d 2a c2 Data Ascii: 22efRIFFr8WEBPVP8 f80>m,F&#V` -viAz.Q_}4H]os})?~w_D>vo#o#U}3'W?Wv????(#~iu%N5JlaPis:QY6q2TS
2024-02-08 18:36:45 UTC	5523	IN	Data Raw: 31 35 38 62 0d 0a 58 8e 91 cc a5 da 6c dd 2c b9 df 88 39 49 75 b4 ac 30 78 1e e5 54 c6 bf 9e 3e 4b bb 7f a3 2d fc 73 a3 9e 91 38 e7 b7 05 4c 28 df 9f 00 eb 5d 44 07 8a 11 b2 94 37 d1 7d ed 47 02 1a b4 eb 65 a8 1f 97 2a 16 94 04 34 ea 39 1c 88 d9 65 b4 54 89 e4 cc 43 3b f3 00 84 27 a0 88 36 bf 11 86 da e2 e9 04 46 72 3b ea 90 41 68 92 5d 72 da 5c 4a 53 cc 27 60 1c e7 87 99 b6 3d 1b 3c 21 aa 60 45 23 b3 e8 86 78 e2 2e 9d 11 f6 2c c3 24 ff a3 17 6f 52 85 85 15 b1 4f 98 c7 ea e0 fa 05 e5 2b b3 4b ca 12 cc b3 f2 7c dd 11 43 5a 29 f3 08 12 0d 0c c0 c9 46 4f e7 6e 32 51 30 27 5c 98 0e 9c 6e f7 4f 69 66 60 76 71 b4 44 ee db e6 0a 7e ba f1 a5 0d d5 ab 5a c3 01 30 21 04 2e d4 e3 45 16 de 88 23 04 31 6c 25 2d ef cb 0e fb 2b ca e4 8e fb ed 26 c6 d5 83 03 07 2d 0b 46 Data Ascii: 158bXl,9Iu0xT>K-s8L(]D7}Ge*49eTC;'6Fr;Ah]r\JS'`=<!`E#x.,$oRO+K\|CZ)FOn2Q0'\nOif`vqD~Z0!.E#1l%-+&-F
2024-02-08 18:36:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
874	192.168.2.5	50745	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:44 UTC	682	OUT	GET /xdata/images/city/square250/689687.webp?k=654bc31e8dc1dabf9b94fb37ad00f6942dc9927f10cf0b7b6a9f43e10d49375e&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:45 UTC	536	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:45 GMT ETag: "1c99bdd626affcc33cc05cbc273a61624b05ab74" Content-Language: 9846 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Miss from cloudfront Via: 1.1 8415794d557292780ff382a8c5bd6058.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 2u1SbEgbgRziXVBoNIrAEn9DFTEvkmFHBM1decplz8Hmg7PvKHFnog==
2024-02-08 18:36:45 UTC	9854	IN	Data Raw: 32 36 37 36 0d 0a 52 49 46 46 6e 26 00 00 57 45 42 50 56 50 38 20 62 26 00 00 10 85 00 9d 01 2a fa 00 fa 00 3e 6d 30 95 47 26 24 23 21 a8 d2 4b a8 c0 0d 89 63 33 9d fe de ae f6 7a f3 55 1b 34 85 5b eb 2d 2b 62 19 37 67 d9 f9 7a 73 0f 8f e0 ef e6 fc c4 7d df 90 ce 12 fe 9d d4 aa 7f 2f 7c 1b f2 0b ed 9f dc bf 77 7e 37 3f 18 c7 7f 5a da 8e f7 37 9f 6f e8 ff 64 fc 67 fd bb f7 3f 40 ec 43 ff 5f fb 43 fe bb c2 b3 6e ff 43 e8 23 ef af e2 7c d5 fe 9f fe ef a4 1f 6a 3a 37 ff 7d e2 ad f8 bf f9 fe c2 ff a7 bd 18 ff f8 ff 77 ea 43 f6 af f5 de ad 9d 51 7f 74 bd 93 4f c3 d2 65 41 9c ca 83 39 95 06 73 0a eb c0 da 85 c1 b5 0b 83 62 8f 42 7a 76 de cd f6 ae 97 ab a1 71 37 6d 24 2d 5d 9b 0d 83 00 db c7 1c ce 0c 91 71 b9 88 e9 27 bf b5 2a 1b b1 aa e9 0f 34 a9 8f a8 bf b9 c0 Data Ascii: 2676RIFFn&WEBPVP8 b&>m0G&$#!Kc3zU4[-+b7gzs}/\|w~7?Z7odg?@C_CnC#\|j:7}wCQtOeA9sbBzvq7m$-]q'4
2024-02-08 18:36:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
875	192.168.2.5	50744	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:44 UTC	427	OUT	GET /static/img/resorts/landing_pages/airplane_bg/82842ea42e7cb6a992e722675e0556c5f8f9b172.jpg HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:45 UTC	750	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 48905 Connection: close Server: nginx Date: Sat, 03 Feb 2024 22:48:13 GMT Last-Modified: Thu, 15 Aug 2019 10:35:46 GMT ETag: "5d553582-bf09" Expires: Mon, 04 Mar 2024 22:48:13 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 76f3fedc86826a7b266250e33ee41082.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: dEggmHW75gDB9D-CbMqXHLzTZZEmxSmLR4MJo6lHGVkdC9_WDA3I8g== Age: 416912
2024-02-08 18:36:45 UTC	16384	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 84 00 08 08 08 08 09 08 09 0a 0a 09 0d 0e 0c 0e 0d 13 11 10 10 11 13 1c 14 16 14 16 14 1c 2b 1b 1f 1b 1b 1f 1b 2b 26 2e 25 23 25 2e 26 44 35 2f 2f 35 44 4e 42 3e 42 4e 5f 55 55 5f 77 71 77 9c 9c d1 01 08 08 08 08 09 08 09 0a 0a 09 0d 0e 0c 0e 0d 13 11 10 10 11 13 1c 14 16 14 16 14 1c 2b 1b 1f 1b 1b 1f 1b 2b 26 2e 25 23 25 2e 26 44 35 2f 2f 35 44 4e 42 3e 42 4e 5f 55 55 5f 77 71 77 9c 9c d1 ff c2 00 11 08 03 c2 05 a0 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 03 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 ff da 00 08 01 01 00 00 00 00 f8 a7 54 da a3 7f 43 ab 87 0c 83 31 ac 72 98 6c d7 4b df 19 ad 16 69 db d4 b5 85 56 6a 1b bd de f4 53 ee c7 bb 6e 7e 9e 7c 31 Data Ascii: JFIF++&.%#%.&D5//5DNB>BN_UU_wqw++&.%#%.&D5//5DNB>BN_UU_wqw"TC1rlKiVjSn~\|1
2024-02-08 18:36:45 UTC	16384	IN	Data Raw: b1 2c 81 04 1e cf 21 2c 81 c9 bc 84 f3 cb 31 35 85 bb 96 fc cd af 95 5b f9 a4 3e 6f 0f 9a c3 e5 76 bc f5 bd 5a 30 c1 71 8b 7c 5c 46 d7 1e 35 93 7b aa 6d b6 dd 36 db db 5b e4 3c af ca d4 68 54 ef c6 76 e7 00 2d c6 11 88 b2 21 08 e8 34 10 86 e9 7e 12 22 4c 8d c9 cf 33 26 db c8 cc df 96 b3 ef fd e8 ea 33 cb 2c b2 cb 33 33 70 dc 37 33 6a 50 98 31 c2 56 3e ac 6c c6 12 d3 47 47 c0 6c 8b 02 b0 a4 62 29 25 d1 d2 c5 08 e2 a9 89 67 c9 cb ca 2f 0b a2 e4 67 19 33 46 89 6d e5 96 42 59 e4 f2 05 e7 90 98 b9 c9 90 b8 2f 72 3c 6d ea 6d f9 bb 5f 2a 87 cc ed fc d6 1f 34 87 cb a1 f2 4b 5e 53 9f 33 7c 5e cc dc 17 79 45 c0 4d 25 bb a0 16 22 d8 b6 0e b7 c9 79 0f 9d 79 7f 3b 1a 14 65 2b 82 00 42 ad ca dc e3 11 6a d5 b1 6f 49 a1 b7 69 22 05 2f c4 d9 d9 ee db 35 c7 c2 74 dc 06 cf Data Ascii: ,!,15[>ovZ0q\|\F5{m6[<hTv-!4~"L3&3,33p73jP1V>lGGlb)%g/g3FmBY/r<mm_*4K^S3\|^yEM%"yy;e+BjoIi"/5t
2024-02-08 18:36:45 UTC	15202	IN	Data Raw: ea a8 7f 47 16 78 17 fa 2d b7 ff 00 cf 0f ff 00 43 c0 bf d2 6d df fe 58 7f fa 1e 01 37 75 b2 6d d0 cb 3b 54 85 af fa 4f 01 fd 86 df fa e9 ff 00 d8 f0 1f d9 6d ff 00 ae 9f fd 8f 01 fd 9e df fa a9 9e 01 e8 f1 0f ce 99 e0 1a 78 8f ff 00 d6 78 07 ff 00 c8 7e 54 cf ec fe be 21 fa 69 9f d9 ef 57 88 fe 9a 67 f6 73 d7 e2 3f a2 99 fd 9b f5 f8 97 e8 a4 7f 66 3f 69 e2 5f a2 91 fd 97 fd a7 89 7e 8a 47 f6 5b f6 9e 27 fa 29 1f d9 d9 d4 8f d8 ed 1b 6d 38 fc db f4 a1 2f ca d2 47 f6 7b 6c 83 70 fe d2 c2 2d 26 dc 6a 52 dc 97 f5 66 d3 b6 c2 a5 4f 0a ad 4b 6c 8c 2f 78 2f 62 aa 5a ee 48 db 36 3a ae 9d 5a 33 a5 35 ce 13 8b 8b fc 99 4e af 3f 62 5f d0 6b 81 a2 f8 b8 33 71 39 28 ef 65 cb 93 28 55 b5 39 4f 76 5a 48 a3 bc e2 e6 ae 54 6e 51 a4 e3 3a 4f a5 bd a8 b3 69 ad 25 08 6c f5 Data Ascii: Gx-CmX7um;TOmxx~T!iWgs?f?i_~G[')m8/G{lp-&jRfOKl/x/bZH6:Z35N?b_k3q9(e(U9OvZHTnQ:Oi%l
2024-02-08 18:36:45 UTC	935	IN	Data Raw: 4b bc a4 c5 18 a4 ab 45 7c 90 84 2f 18 c7 ec 99 88 fb 41 b3 1d f6 c2 7f b9 ea 1f 74 97 dd 98 9a cd 22 3a e2 37 f6 46 06 ae 4c f4 cb fe ba fd d9 83 1e d8 51 22 bb 2a 67 b9 09 a6 a5 1a a7 71 3a bc 27 4f f5 66 26 1c a9 38 b5 c2 85 ca 13 7f 66 2e 05 92 cb 71 df 36 31 8f dd b1 8c 63 18 c7 93 eb 60 62 46 bf 1b dd 1e 96 cd fd cf 4b 1e d0 5f ba 30 97 68 af d9 1b 66 84 21 5f 34 21 67 09 aa 4a 29 ad c8 ba bc 27 4d 99 8b 84 ff 00 ce 2d 6f c3 17 05 17 2e 6a fc 0f a6 fa 4f 81 64 ad 92 17 41 08 42 16 6a c2 b6 52 b0 c6 ba 72 84 ab 17 46 39 aa fc 4e a4 ae 3b e5 b0 c7 c1 be 4e c6 cc d8 63 18 c4 d5 1a aa 30 71 2b 45 f0 bd 8c 68 7e 1a 49 6c 4e 1c a5 16 9e eb 26 7e 1c 39 fd 93 e9 21 65 b1 b1 b1 b1 b0 84 2e 1d 8d 85 61 58 5c 68 59 2c 95 cd cd cd d1 b8 ae 2d 18 cd cd f8 3e 2e Data Ascii: KE\|/At":7FLQ"*gq:'Of&8f.q61c`bFK_0hf!_4!gJ)'M-o.jOdABjRrF9N;Nc0q+Eh~IlN&~9!e.aX\hY,->.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
876	192.168.2.5	50746	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:44 UTC	447	OUT	GET /xdata/images/city/square250/690179.webp?k=cb5eb236e7e9bf988a677e4fbdbf81ef955c828b5bfccac307c9f9786f31d48e&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:45 UTC	544	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:44 GMT ETag: "ad134843f38628f0e4d7db61f2683e4ce09f481c" Content-Language: 12702 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 d48a409d6a3222e2cc9a060d30206d3c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: qBLnEnT2jBFJamnn6dawMCIKSiKLlRz0d8ffY4TOlWaSjkOS0sKDcQ== Age: 1
2024-02-08 18:36:45 UTC	12710	IN	Data Raw: 33 31 39 65 0d 0a 52 49 46 46 96 31 00 00 57 45 42 50 56 50 38 20 8a 31 00 00 10 bc 00 9d 01 2a fa 00 fa 00 3e 6d 30 93 47 26 24 22 a1 a9 52 dc 38 c0 0d 89 41 12 04 c3 96 5b 03 ab db ea bf eb 79 ed f2 3f 8b 92 06 c3 23 b1 33 73 f7 6e 3e 6b ba 79 4f 79 f7 5d 7e 64 7e 2b f4 c7 fc cf 8b 2f dc b2 bf f1 5f e3 79 a1 f6 c3 f9 ff e2 bd a3 7f 61 fb 31 e4 ef ca cd 42 fd a1 fe eb d2 b3 ef ff 68 7c 5e b6 8f f7 5e 84 de ea 7d df cf 67 ea fc ed fb 4b ec 09 e5 d7 fd 1f 0f 4f c0 7f c5 fd b3 f8 05 fe 91 fe 07 f6 83 d9 47 eb df 4d 3f b0 ff b2 f6 20 e9 b4 7f 8e b0 82 3c 44 e1 6b 48 95 1e b0 7b 89 05 bf 92 e5 f7 97 83 47 3a d1 5f b3 f7 34 53 78 b3 1a c3 4d 0f 56 78 c9 ef 74 c7 73 4a 27 06 da 73 d9 c8 ab 5c 04 43 e9 dc d2 d3 f2 a0 20 43 cc f0 cc 74 fa 75 fe b7 03 41 9e f9 5f Data Ascii: 319eRIFF1WEBPVP8 1*>m0G&$"R8A[y?#3sn>kyOy]~d~+/_ya1Bh\|^^}gKOGM? <DkH{G:_4SxMVxtsJ's\C CtuA_
2024-02-08 18:36:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
877	192.168.2.5	50747	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:44 UTC	682	OUT	GET /xdata/images/city/square250/977381.webp?k=ab236c5e99ba40341684e2d3bfcd8256d36f5e63883350af9faa988cd4d49939&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:45 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Tue, 30 Jan 2024 10:20:37 GMT ETag: "87f2aacd9ce7c6bfd4d44dc40b2911eede50f090" Content-Language: 10578 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 76f3fedc86826a7b266250e33ee41082.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: TxPh-B_7_RHvhWz7U5esk_G-tKE4voab2yNJq5O-Co1Zc8ssmjeqTQ== Age: 807368
2024-02-08 18:36:45 UTC	10586	IN	Data Raw: 32 39 35 32 0d 0a 52 49 46 46 4a 29 00 00 57 45 42 50 56 50 38 20 3e 29 00 00 d0 a7 00 9d 01 2a fa 00 fa 00 3e 6d 30 92 47 a6 23 a2 21 aa 54 1b 58 c0 0d 89 67 6d ff 9f 37 a7 20 15 f7 58 0e 08 af 1e 49 c3 ab d3 ba 8f 55 54 73 13 15 9d 01 fc 4b dc ff f0 ff 35 ff 98 7f 95 e2 53 b0 bc cd fb 52 fc 5f f1 9e d2 7f af ef df e6 26 a1 7e cf ff 85 fd d3 d6 b3 f1 3b ad 37 af f9 1e 85 9e f9 7d ef cd c3 ec 3f f3 7a 85 f6 23 d8 1b f5 8b d3 cf f6 3e 33 9f 90 ff 61 ec 09 fd 47 fc 17 fe 6f f3 5e cd 3a 56 fa e7 f6 cb e0 7f a6 41 ad 7f 11 4d 26 bf 79 9c 7b a4 89 49 34 f5 06 40 ab 71 44 fb c5 c1 fc c7 da b8 8b 4d 63 2a 78 d4 4a 5e aa e7 77 6f 4a 86 74 06 2c 3a 57 6f 80 d5 03 16 51 f5 ce 8b 3c b1 ee 3b 54 62 51 2c fb 7c c5 4b 1f cf 1b d8 79 51 a3 ad 04 d5 05 be 17 11 b4 75 69 Data Ascii: 2952RIFFJ)WEBPVP8 >)>m0G#!TXgm7 XIUTsK5SR_&~;7}?z#>3aGo^:VAM&y{I4@qDMcxJ^woJt,:WoQ<;TbQ,\|KyQui
2024-02-08 18:36:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
878	192.168.2.5	50748	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:44 UTC	682	OUT	GET /xdata/images/city/square250/690242.webp?k=d237489ebaacd4fce01bee28f2947d5b8e4e062f62a47f1b3f771473dae96fb9&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:45 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Wed, 31 Jan 2024 18:47:41 GMT ETag: "c60438342739c0782f273d6c29e4ec8e6825df46" Content-Language: 10006 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 8415794d557292780ff382a8c5bd6058.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 4X20Fl-UU8bG9BN86xK1W_ZfC_C5ef57S5mgR1DOSrT5ZT3qvqX3bg== Age: 690544
2024-02-08 18:36:45 UTC	10014	IN	Data Raw: 32 37 31 36 0d 0a 52 49 46 46 0e 27 00 00 57 45 42 50 56 50 38 20 02 27 00 00 30 b2 00 9d 01 2a fa 00 fa 00 3e 6d 30 93 47 26 23 a2 a1 a8 71 bd 88 c0 0d 89 63 00 c3 e0 34 ec 37 a4 c9 2b e4 bf 1f e4 c1 8b 6f 98 62 1f 7e 0f 62 dc d6 fd 79 fa 61 b0 00 bc c5 97 73 58 f6 41 51 1f e8 78 0a f9 1f 03 fb 26 ff 91 df ff 01 dc 50 ee 58 18 5f d8 f5 c5 fa 22 81 5f f4 bc 88 7f 29 ff 5f 69 d7 ed db 90 05 21 6a 41 78 b5 8b 55 c2 4d d1 bd 6e 88 4e 30 f1 bf 82 1b 58 d1 0f e5 4a 7a be c8 2b 7d d8 a5 00 b6 2f 10 ea e5 4b 34 46 7e 63 5c 69 97 1e 55 82 16 5e da 5d 47 fd ce 59 9d f7 c7 c9 40 cf ff 60 ea 15 00 b6 4b e8 64 30 7e 0d 4f cc fc 71 79 78 ca c1 1e e4 e2 90 d4 00 b6 22 78 8a e6 4e 31 af 19 fb b9 44 95 32 7b 22 9d 27 4b 83 2c 0d e6 82 b8 32 2c 2f 0e 7c b0 da eb 40 02 a8 Data Ascii: 2716RIFF'WEBPVP8 '0*>m0G&#qc47+ob~byasXAQx&PX_"_)_i!jAxUMnN0XJz+}/K4F~c\iU^]GY@`Kd0~Oqyx"xN1D2{"'K,2,/\|@
2024-02-08 18:36:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
879	192.168.2.5	50749	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:44 UTC	581	OUT	GET /psb/capla/static/js/client.2cf42118.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:45 UTC	688	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 1006490 Connection: close Date: Thu, 08 Feb 2024 11:00:47 GMT Last-Modified: Thu, 19 Oct 2023 10:33:13 GMT ETag: "960030fdb11d5bd734786c251c3797e3" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: yTZbI.66am8lUZDmzj1WgPuCmGJ2YxRE Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 34411558fb3a23efdbbaaddb8a12b574.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: oYZQ-FHWBkqe7fpi7BIyvYcc1WoWb055lYNI6JA86PScjbZl4lIlNw== Age: 27359 Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:36:45 UTC	15696	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 63 6c 69 65 6e 74 2e 32 63 66 34 32 31 31 38 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 22 38 35 34 62 36 63 61 31 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 74 68 69 73 26 26 74 68 69 73 2e 5f 5f 63 72 65 61 74 65 42 69 6e 64 69 6e 67 7c 7c 28 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 76 6f 69 64 20 30 3d 3d 3d 72 26 26 28 72 3d 6e 29 3b 76 61 72 20 6f 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 Data Ascii: /! For license information please see client.2cf42118.js.LICENSE.txt /!function(){var e={"854b6ca1":function(e,t,n){"use strict";var r=this&&this.__createBinding\|\|(Object.create?function(e,t,n,r){void 0===r&&(r=n);var o=Object.getOwnPropertyDescriptor(
2024-02-08 18:36:45 UTC	16384	IN	Data Raw: 72 20 72 3d 6e 21 3d 3d 74 2c 6f 3d 31 3d 3d 3d 6e 2e 6e 6f 64 65 54 79 70 65 26 26 21 6e 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 61 72 69 61 2d 68 69 64 64 65 6e 22 29 3b 72 26 26 6f 26 26 28 6e 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 61 72 69 61 2d 68 69 64 64 65 6e 22 2c 22 74 72 75 65 22 29 2c 65 2e 70 75 73 68 28 6e 29 29 2c 6e 3d 6e 2e 6e 65 78 74 53 69 62 6c 69 6e 67 7d 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 65 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 22 61 72 69 61 2d 68 69 64 64 65 6e 22 29 7d 29 29 2c 65 3d 5b 5d 7d 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 72 29 7b 76 61 72 20 6f 3d 72 3b 66 6f 72 28 65 2e 6c 65 6e 67 74 68 26 26 6e 28 29 3b Data Ascii: r r=n!==t,o=1===n.nodeType&&!n.hasAttribute("aria-hidden");r&&o&&(n.setAttribute("aria-hidden","true"),e.push(n)),n=n.nextSibling}},n=function(){e.forEach((function(e){e.removeAttribute("aria-hidden")})),e=[]};return function(r){var o=r;for(e.length&&n();
2024-02-08 18:36:45 UTC	16384	IN	Data Raw: 61 33 32 65 35 36 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 74 2c 22 5f 5f 65 73 4d 6f 64 75 6c 65 22 2c 7b 76 61 6c 75 65 3a 21 30 7d 29 3b 74 2e 64 65 66 61 75 6c 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6e 3d 65 2e 6c 65 6e 67 74 68 2c 72 3d 30 3b 72 3c 6e 3b 72 2b 3d 31 29 7b 76 61 72 20 6f 3d 65 5b 72 5d 3b 69 66 28 74 28 6f 29 29 72 65 74 75 72 6e 20 6f 7d 7d 7d 2c 22 32 38 35 36 63 37 61 62 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 74 68 69 73 26 26 74 68 69 73 2e 5f 5f 69 6d 70 6f 72 74 44 65 66 61 75 6c 74 7c 7c 66 75 6e 63 74 69 6f 6e 28 Data Ascii: a32e56":function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0});t.default=function(e,t){for(var n=e.length,r=0;r<n;r+=1){var o=e[r];if(t(o))return o}}},"2856c7ab":function(e,t,n){"use strict";var r=this&&this.__importDefault\|\|function(
2024-02-08 18:36:45 UTC	16384	IN	Data Raw: 2c 22 69 74 65 6d 2d 2d 67 72 6f 77 22 3a 22 61 61 65 65 34 65 37 63 64 33 22 2c 22 69 74 65 6d 2d 2d 73 68 72 69 6e 6b 22 3a 22 65 37 61 35 37 61 62 62 31 65 22 2c 22 69 74 65 6d 2d 2d 61 6c 69 67 6e 2d 73 65 6c 66 2d 73 74 61 72 74 22 3a 22 66 66 37 37 35 39 38 61 34 63 22 2c 22 69 74 65 6d 2d 2d 61 6c 69 67 6e 2d 73 65 6c 66 2d 63 65 6e 74 65 72 22 3a 22 61 66 64 34 63 63 33 33 36 33 22 2c 22 69 74 65 6d 2d 2d 61 6c 69 67 6e 2d 73 65 6c 66 2d 65 6e 64 22 3a 22 62 34 62 39 39 35 37 36 64 66 22 2c 22 69 74 65 6d 2d 2d 73 70 6c 69 74 22 3a 22 61 33 39 38 39 63 31 39 33 38 22 7d 29 2c 75 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 75 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 Data Ascii: ,"item--grow":"aaee4e7cd3","item--shrink":"e7a57abb1e","item--align-self-start":"ff77598a4c","item--align-self-center":"afd4cc3363","item--align-self-end":"b4b99576df","item--split":"a3989c1938"}),u=function(){return u=Object.assign\|\|function(e){for(var t
2024-02-08 18:36:45 UTC	16384	IN	Data Raw: 74 3d 65 7d 29 2c 5b 65 5d 29 2c 74 2e 63 75 72 72 65 6e 74 7d 7d 2c 22 33 65 66 65 65 65 38 34 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 22 65 61 64 37 31 65 62 30 22 29 2c 6f 3d 6e 2e 6e 28 72 29 2c 61 3d 28 6e 28 22 33 37 66 62 64 31 33 62 22 29 2c 6e 28 22 37 35 31 61 33 38 37 35 22 29 29 3b 74 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 6f 28 29 2e 75 73 65 43 6f 6e 74 65 78 74 28 61 2e 5a 29 2c 74 3d 65 2e 72 74 6c 2c 6e 3d 65 2e 73 65 74 52 54 4c 3b 72 65 74 75 72 6e 20 6f 28 29 2e 75 73 65 4d 65 6d 6f 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 5b 74 2c 6e 5d 7d 29 2c 5b 74 2c 6e 5d 29 7d 7d 2c 63 36 61 37 37 66 39 39 3a 66 75 6e 63 74 69 6f 6e Data Ascii: t=e}),[e]),t.current}},"3efeee84":function(e,t,n){"use strict";var r=n("ead71eb0"),o=n.n(r),a=(n("37fbd13b"),n("751a3875"));t.Z=function(){var e=o().useContext(a.Z),t=e.rtl,n=e.setRTL;return o().useMemo((function(){return[t,n]}),[t,n])}},c6a77f99:function
2024-02-08 18:36:45 UTC	15024	IN	Data Raw: 6f 6e 74 61 69 6e 65 72 2d 2d 65 6c 65 76 61 74 65 64 2d 74 72 75 65 2d 2d 78 6c 22 3a 22 66 34 34 32 39 36 64 63 61 38 22 2c 22 63 6f 6e 74 61 69 6e 65 72 2d 2d 65 6c 65 76 61 74 65 64 2d 66 61 6c 73 65 2d 2d 78 6c 22 3a 22 61 65 30 65 66 34 64 63 31 30 22 7d 2c 56 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 56 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 3d 31 2c 72 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 74 3d 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 6f 29 26 26 28 65 5b 6f 5d 3d Data Ascii: ontainer--elevated-true--xl":"f44296dca8","container--elevated-false--xl":"ae0ef4dc10"},V=function(){return V=Object.assign\|\|function(e){for(var t,n=1,r=arguments.length;n<r;n++)for(var o in t=arguments[n])Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=
2024-02-08 18:36:45 UTC	16384	IN	Data Raw: 2c 53 65 3d 22 62 38 38 61 64 30 33 39 38 61 22 2c 4f 65 3d 5b 22 73 6d 61 6c 6c 22 2c 22 6d 65 64 69 75 6d 22 2c 22 6c 61 72 67 65 22 2c 22 78 6c 61 72 67 65 22 5d 2c 78 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 61 62 6f 76 65 2c 6e 3d 65 2e 62 65 6c 6f 77 2c 72 3d 65 2e 63 68 69 6c 64 72 65 6e 2c 69 3d 4f 65 2e 69 6e 64 65 78 4f 66 28 74 29 2c 75 3d 4f 65 2e 69 6e 64 65 78 4f 66 28 6e 29 2c 63 3d 2d 31 21 3d 3d 75 26 26 75 3e 30 2c 73 3d 2d 31 21 3d 3d 75 26 26 75 3e 31 7c 7c 2d 31 21 3d 3d 69 26 26 69 3c 31 2c 6c 3d 2d 31 21 3d 3d 75 26 26 75 3e 32 7c 7c 2d 31 21 3d 3d 69 26 26 69 3c 32 2c 66 3d 2d 31 21 3d 3d 69 26 26 69 3c 33 2c 64 3d 28 30 2c 61 2e 63 6c 61 73 73 4e 61 6d 65 73 29 28 63 3f 79 65 3a 67 65 2c 73 3f 45 65 3a 62 Data Ascii: ,Se="b88ad0398a",Oe=["small","medium","large","xlarge"],xe=function(e){var t=e.above,n=e.below,r=e.children,i=Oe.indexOf(t),u=Oe.indexOf(n),c=-1!==u&&u>0,s=-1!==u&&u>1\|\|-1!==i&&i<1,l=-1!==u&&u>2\|\|-1!==i&&i<2,f=-1!==i&&i<3,d=(0,a.classNames)(c?ye:ge,s?Ee:b
2024-02-08 18:36:45 UTC	16384	IN	Data Raw: 44 61 74 65 49 53 4f 3a 72 26 26 28 30 2c 45 74 2e 63 61 73 74 44 61 74 65 54 6f 49 53 4f 29 28 72 29 2c 65 6e 64 44 61 74 65 49 53 4f 3a 61 26 26 28 30 2c 45 74 2e 63 61 73 74 44 61 74 65 54 6f 49 53 4f 29 28 61 29 7c 7c 6e 75 6c 6c 7d 29 7d 2c 74 29 7d 2c 43 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 28 29 2e 75 73 65 43 6f 6e 74 65 78 74 28 54 74 29 7d 2c 49 74 3d 22 63 36 65 36 34 31 36 31 37 39 22 2c 52 74 3d 22 62 36 36 61 32 38 65 35 37 35 22 2c 44 74 3d 22 65 38 64 31 31 62 64 62 66 35 22 2c 41 74 3d 22 61 39 65 35 36 38 64 32 65 65 22 2c 50 74 3d 22 63 64 62 61 34 33 32 39 37 65 22 2c 46 74 3d 22 62 30 38 66 36 33 36 64 33 65 22 2c 4d 74 3d 22 61 66 62 36 33 32 37 39 66 62 22 2c 4c 74 3d 22 66 35 38 36 33 31 66 39 33 33 22 2c Data Ascii: DateISO:r&&(0,Et.castDateToISO)(r),endDateISO:a&&(0,Et.castDateToISO)(a)\|\|null})},t)},Ct=function(){return o().useContext(Tt)},It="c6e6416179",Rt="b66a28e575",Dt="e8d11bdbf5",At="a9e568d2ee",Pt="cdba43297e",Ft="b08f636d3e",Mt="afb63279fb",Lt="f58631f933",
2024-02-08 18:36:45 UTC	16384	IN	Data Raw: 3d 28 30 2c 6b 2e 64 65 62 6f 75 6e 63 65 29 28 65 2c 74 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 70 65 72 73 69 73 74 28 29 2c 6e 28 65 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 53 6e 28 65 2c 74 2c 6e 29 7b 76 6f 69 64 20 30 3d 3d 3d 6e 26 26 28 6e 3d 22 63 65 6e 74 65 72 22 29 3b 66 6f 72 28 76 61 72 20 72 3d 30 3b 72 3c 74 2e 6c 65 6e 67 74 68 3b 72 2b 3d 31 29 7b 76 61 72 20 6f 3d 74 5b 72 5d 2c 61 3d 28 30 2c 61 6e 2e 67 65 74 45 6c 65 6d 65 6e 74 53 63 72 6f 6c 6c 50 6f 73 69 74 69 6f 6e 29 28 6f 2e 65 6c 2c 65 29 2c 69 3d 22 63 65 6e 74 65 72 22 3d 3d 3d 6e 3f 6f 2e 65 6c 2e 63 6c 69 65 6e 74 57 69 64 74 68 2f 32 3a 30 3b 69 66 28 61 2b 61 6e 2e 53 43 52 4f 4c 4c 5f 54 48 52 45 53 48 4f 4c 44 2b 69 3e 3d Data Ascii: =(0,k.debounce)(e,t);return function(e){return e.persist(),n(e)}}function Sn(e,t,n){void 0===n&&(n="center");for(var r=0;r<t.length;r+=1){var o=t[r],a=(0,an.getElementScrollPosition)(o.el,e),i="center"===n?o.el.clientWidth/2:0;if(a+an.SCROLL_THRESHOLD+i>=
2024-02-08 18:36:45 UTC	13491	IN	Data Raw: 2c 69 3d 61 5b 30 5d 2c 75 3d 61 5b 31 5d 3b 72 65 74 75 72 6e 20 6f 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 68 72 2c 76 72 28 7b 7d 2c 65 2c 7b 61 63 74 69 76 65 3a 69 2c 6f 6e 49 74 65 6d 43 68 6f 6f 73 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 75 28 21 31 29 2c 74 26 26 74 28 65 2c 6e 29 7d 2c 6f 6e 4f 70 65 6e 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 75 28 21 30 29 2c 6e 26 26 6e 28 29 7d 2c 6f 6e 43 6c 6f 73 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 75 28 21 31 29 2c 72 26 26 72 28 29 7d 7d 29 29 7d 2c 67 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 67 72 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 3d 31 2c 72 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 Data Ascii: ,i=a[0],u=a[1];return o().createElement(hr,vr({},e,{active:i,onItemChoose:function(e,n){u(!1),t&&t(e,n)},onOpen:function(){u(!0),n&&n()},onClose:function(){u(!1),r&&r()}}))},gr=function(){return gr=Object.assign\|\|function(e){for(var t,n=1,r=arguments.leng

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
880	192.168.2.5	50750	99.84.208.90	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:45 UTC	685	OUT	OPTIONS /track/client-metrics HTTP/1.1 Host: flights.booking.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type,x-booking-affiliate-id,x-booking-flights-client-hints,x-booking-label,x-booking-parent-request-id,x-booking-request-tree-id,x-booking-trace-meta,x-requested-from Origin: https://www.booking.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:45 UTC	941	IN	HTTP/1.1 204 No Content Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:45 GMT x-request-id: 02c0e0d0-c6b1-11ee-8a61-ff6f3e7657b3 access-control-allow-origin: https://www.booking.com vary: Origin, Access-Control-Request-Headers access-control-allow-credentials: true access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-headers: content-type,x-booking-affiliate-id,x-booking-flights-client-hints,x-booking-label,x-booking-parent-request-id,x-booking-request-tree-id,x-booking-trace-meta,x-requested-from referrer-policy: no-referrer x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 a929b4bfaa0111e3feb7c4dbffdbd8d8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD79-C1 X-Amz-Cf-Id: Gow0j8wxTEukXuHj_Gkn5E3BFN6gEtYhh7WHkLIwiVmOOAmScCiegw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
881	192.168.2.5	50751	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:45 UTC	589	OUT	GET /psb/capla/static/js/f15792aa.a859b930.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:45 UTC	679	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 420 Connection: close Last-Modified: Wed, 18 Oct 2023 10:43:40 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: deXqTbfPzPmpXYLLJkepllXPQB7bZJcT Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 18:36:46 GMT ETag: "17de6e7ee1d946d00adef2dfde14b95b" Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront Via: 1.1 c625b1bdde545acdeb26c9f6ad3a8c6e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: D2zE6gniImD-pLyrVyd457ReMdM7Z9J5KphvZF99JA_6UyqKe_TUSw== Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:36:45 UTC	420	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 5b 22 62 2d 70 61 63 6b 61 67 65 73 2d 63 6f 72 65 2d 70 61 63 6b 61 67 65 73 2d 66 72 6f 6e 74 65 6e 64 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 70 61 63 6b 61 67 65 73 2d 63 6f 72 65 2d 70 61 63 6b 61 67 65 73 2d 66 72 6f 6e 74 65 6e 64 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 66 31 35 37 39 32 61 61 22 5d 2c 7b 66 65 39 30 35 66 37 62 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 61 2c 5f 29 7b 5f 2e 72 28 61 29 3b 76 61 72 20 6e 3d 5f 28 22 35 34 30 61 64 63 64 38 22 29 3b 28 30 2c 6e 2e 73 65 72 76 65 29 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 Data Ascii: "use strict";(self["b-packages-core-packages-frontend__LOADABLE_LOADED_CHUNKS__"]=self["b-packages-core-packages-frontend__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["f15792aa"],{fe905f7b:function(e,a,_){_.r(a);var n=_("540adcd8");(0,n.serve)((function(){retu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
882	192.168.2.5	50752	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:45 UTC	447	OUT	GET /xdata/images/city/square250/977388.webp?k=4c9c54255e9d2e2d8084959527abea6b6b8a4b8a538a921f1df9e4bea2503ff6&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:45 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Sun, 04 Feb 2024 10:07:42 GMT ETag: "89058bf22a63370898638a51884183132b06e8ff" Content-Language: 16834 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 c1bfc7dbcf7f9782aa3be590b7ce3d6a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: kHtDB9f2hIHlPW-Ooc9JAf0Dlw8HrpYRFUkThZufHYff5S-8j2CY0A== Age: 376143
2024-02-08 18:36:45 UTC	15835	IN	Data Raw: 34 31 63 32 0d 0a 52 49 46 46 ba 41 00 00 57 45 42 50 56 50 38 20 ae 41 00 00 b0 c7 00 9d 01 2a fa 00 fa 00 3e 6d 2c 91 46 26 23 a2 18 1a c6 30 60 06 c4 b1 b5 99 5e a8 a8 99 b6 af 1f b4 f2 fe e5 3f 2d c2 9d e9 4b 68 f4 3b c0 df 1c 5e fa fd e7 f7 73 fc 0f b6 26 2c fa df ff 7b d0 4f e7 ff 8a ff 9b fe 0f da c7 f2 fd ef fc 97 ff 7b fc af b0 47 b8 7c e8 be eb f2 67 bf f3 6e ff 47 ff 77 d4 47 e0 1f bc ff e0 f4 52 fa 6f 36 3e c6 7b 01 7e b2 fa 57 ff 3b c3 b7 f1 3f ed 3f 70 be 01 3f a7 ff 81 ff d9 fe 83 d8 ff ff 7f f7 9f 99 3e f3 bf 65 ff 63 ff cf fd bf c1 17 ec 77 a6 8f ff 3f 79 9f b8 1e d8 7f b2 60 fe 4d 77 a1 90 6d 66 c2 26 06 9a b0 27 9b 8e eb 63 99 54 96 cd f4 23 ff c6 ac 2a 7d a2 be 5b ca f7 af 80 9f 85 a0 d0 57 d8 fb 71 76 cf 8a 34 96 2d 3c fe dd fd 20 42 Data Ascii: 41c2RIFFAWEBPVP8 A>m,F&#0`^?-Kh;^s&,{O{G\|gnGwGRo6>{~W;??p?>ecw?y`Mwmf&'cT#}[Wqv4-< B
2024-02-08 18:36:45 UTC	1007	IN	Data Raw: f0 d5 84 55 ed 21 fe de 09 6f 04 78 76 4a fb 99 3a 87 ab 30 f6 64 df 5d 19 26 8d 41 3a 06 08 2d c7 06 82 a6 39 a5 98 98 d5 61 1f fc b8 32 08 19 48 22 5d cc 1a df 59 e5 14 41 6b 8d b0 4a 25 ce 67 89 e2 39 11 49 59 26 d2 5a 5d 12 c0 19 de 77 b5 6b a4 8f ea ba 01 9f d2 93 f7 73 e0 fc ef 77 9a 20 8d 13 39 25 70 93 6f 92 98 66 08 be 94 cf 7b 34 c3 3d b4 95 ae d1 84 47 b1 41 5e 9a 42 fb d1 06 51 14 9e 0e 52 cd b8 b9 5a 5d fe 4b d2 bb 3c 47 ec fa 48 75 2b 4a d9 3c fc 83 f8 ed b0 d1 fa 42 90 a8 b6 af ab a1 33 16 3f b7 47 57 50 d9 68 6b c1 8c 69 40 20 3a 89 ed c1 f7 2d 0b 67 5b 66 19 16 00 b0 97 37 38 39 ef f7 5e 27 2d c2 5e 3e 50 b7 cf ea 42 4b b9 0b b9 34 01 05 3f db 9d 6e fd 85 e8 84 01 96 d5 08 8a 5e 0f 49 39 c4 d6 be e1 bd de 35 d7 ee 4b cb 5b ff 19 34 dd bd Data Ascii: U!oxvJ:0d]&A:-9a2H"]YAkJ%g9IY&Z]wksw 9%pof{4=GA^BQRZ]K<GHu+J<B3?GWPhki@ :-g[f789^'-^>PBK4?n^I95K[4
2024-02-08 18:36:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
883	192.168.2.5	50753	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:45 UTC	447	OUT	GET /xdata/images/city/square250/977416.webp?k=ea06e0b572ff052f4fe4fcf35ac3616e8d1b7300f0402756c460a4e9c19e54ed&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:45 UTC	544	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:44 GMT ETag: "c4770f0dae2399153c9c92e5f14ca2a9c605f50a" Content-Language: 11060 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 3f95374273631adbfd8e0d0a9f6d7b64.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: mAwNMr0MNP8S0z3lWcKc5F5J1XgX2TzNfu9nw4S0O6KgQ0VTiQD-qA== Age: 1
2024-02-08 18:36:45 UTC	11068	IN	Data Raw: 32 62 33 34 0d 0a 52 49 46 46 2c 2b 00 00 57 45 42 50 56 50 38 20 20 2b 00 00 b0 9b 00 9d 01 2a fa 00 fa 00 3e 6d 30 94 46 a6 24 22 a1 a9 32 dc 80 c0 0d 89 65 6e e0 30 3c 1a d5 3e 53 ca 3f 5a 2b db 8f 3e 3f e2 77 9d 9f 9c fe fb e8 43 8b fe c9 f5 1a ef cf 3e 1f da f7 d7 fb 1f f2 7e 81 7e df f4 0b fc 3e d5 4b 7d e8 23 df 8f 37 5f ba f3 83 ed 0f b0 17 93 df f0 fc 39 be fd fe fb d8 3f fa 7f f6 cf 45 7d 2b 7e d5 ff 00 e3 c6 24 44 ef 4a b2 32 78 52 4e 60 c1 86 ae 2a 5d 73 e2 03 37 78 ee a1 35 72 7c 20 14 66 72 c4 f6 f7 e1 64 36 7b c5 1f dd e8 27 59 e9 fd e7 51 a2 00 ed fa ad 92 8b 02 e6 b3 ea 89 70 de 4a 21 83 80 cc 4a 8f 47 bb af 2a db 81 93 7d 5f 35 61 e4 af 25 d7 de b1 21 4f 9b 5f 72 9f 43 10 0b a4 b5 86 0e c0 2a 90 30 12 4e 96 fe 9d 82 ee b8 4b 8a b9 de 75 Data Ascii: 2b34RIFF,+WEBPVP8 +>m0F$"2en0<>S?Z+>?wC>~~>K}#7_9?E}+~$DJ2xRN`]s7x5r\| frd6{'YQpJ!JG}_5a%!O_rC0NKu
2024-02-08 18:36:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
884	192.168.2.5	50761	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:45 UTC	5254	OUT	GET /js_tracking?stype=1&lang=en-us&ver=2&aid=304142&sid=5171fc655664ddf74ab763a094523fb7&ref_action=packages_city&pid=d16682db432d0172&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|19&m=UmFuZG9tSVYkc2RlIyh9YdIXFZ7Nf82NAkuhhudQTioSutRpQn8uBcWgwMM-j5Sbuz9nv2vWLHLE4dV_SJngbBBk6UTeFiFgOcPnz7Gzoo2KA6TL2_i5J5f0Z_mULkN4439jWeHNCGdOf8Dnfr2mwd5U84qKx9veEXwn0ypiUZ29ohxd9ldgdVHyLvDvyEXRk_w3FXR-xkqyOsPLC6jUYYiSuqTleRS_1fViiRhT_YdQ6RNP48Cqy_dE7Kp_jNXyxS8D15Ld5uk HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-Language-Code: en-us X-Booking-Client-Info: X-Booking-CSRF: dlfFZQAAAAA=9FEpDaCj1qqLdemHHz3PAsjsumCEOKcSBegdNQuXcZ3_gZl_kN0VsNDXgRe0ATwcE5urQkwmo2KWpVgW5QJwbPGV9GbJwVQ4wghe1QBGjzQB60WEFosHhV4PwY1mc4hwAusHrxF2T8D0J5_AJQXRQn9kqNDUTvK0-rlnqU9QKWQ3r4-Kg3ajLU-6vixaGPa7ESiUEgsJgaiJczqx sec-ch-ua-mobile: ?0 X-Booking-AID: 304142 X-Partner-Channel-Id: 3 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Pageview-Id: d16682db432d0172 X-Booking-Info: 1908890,1914530,1908890\|1 X-Booking-SiteType-Id: 1 X-Requested-With: XMLHttpRequest X-Booking-Session-Id: 5171fc655664ddf74ab763a094523fb7 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/packages.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAfk6BVJUjAAAA:WDfXg2ry+HvbnxTztLnepFvhf3dpX4SdQfM4GczRrcPw6MWAZH8MErn+af2Y9SvAts7ySjM/T9nCQWaxTWJ+ECSRYADCgGFp6g8nwqAAp4uZuesbnPNMB9VWMMTR/6OqpiFI1lm6c8HTX0et8uTZTDvEovUpe/ZJPj+EvnZwpL1hdq9NKhFzFZb6nk1kcyw+S5Gmb0WW/JMfQvkBUX6FX8nHd2pkcvntEKFlkhvMXyaXZ+ocI5s4XxhjbVLG6yziJfNgBxF+; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; header_signin_prompt=1; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbVA9iGwA%2BUSxwIu42mh5GOPt%2BW7AjYQvdrYhpXt0yQFsQgSxwG2BeSZAS5JRsMvijVPUCEElqMR%2BgrpCsa0hesk9dK0dyhz4ueIXiJkQ7CCAR6GErty2h09ffyYfs3vBFMK3lSm5wxNxn%2Bv9npOMvhMSJBOD4Bbg9B4eWxmufPHI%3D
2024-02-08 18:36:45 UTC	719	IN	HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:45 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=dae482debb9102b9&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejI1YNB0pPaMiBYEc8hV9dFa4IJEegb9XtI x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 31341771a4bfa40d7b1f61883ffb56c6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: -oUh9xQJpJRP7W3CdEzClFxDqzzYwRhlupcAb09-WETg9Pm0Pa20sg==
2024-02-08 18:36:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
885	192.168.2.5	50762	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:45 UTC	589	OUT	GET /psb/capla/static/js/a4a24010.c06ec33d.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:46 UTC	674	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 2722 Connection: close Date: Thu, 08 Feb 2024 18:36:47 GMT Last-Modified: Tue, 21 Nov 2023 05:21:59 GMT ETag: "8a9d8fffd9fb9da1e8561180e6efea0c" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: T1F4.zs78Pnzicn37ROP88jb61oD47u2 Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 a53ebc5c4d12bc9682b9c11ea18dccbe.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 9Bdee2DwI8sLfAvh6Vs1jAO_XkHjx6O241zv7Vda_Ck1EVFZIVgncA== Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:36:46 UTC	2722	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 5b 22 62 2d 70 61 63 6b 61 67 65 73 2d 63 6f 72 65 2d 70 61 63 6b 61 67 65 73 2d 66 72 6f 6e 74 65 6e 64 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 70 61 63 6b 61 67 65 73 2d 63 6f 72 65 2d 70 61 63 6b 61 67 65 73 2d 66 72 6f 6e 74 65 6e 64 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 61 34 61 32 34 30 31 30 22 5d 2c 7b 22 31 38 31 65 61 63 63 38 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 72 29 7b 72 2e 64 28 6e 2c 7b 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 7d 7d 29 3b 76 61 72 20 74 3d 72 28 22 36 65 65 38 38 63 35 34 22 29 2c 6f Data Ascii: "use strict";(self["b-packages-core-packages-frontend__LOADABLE_LOADED_CHUNKS__"]=self["b-packages-core-packages-frontend__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["a4a24010"],{"181eacc8":function(e,n,r){r.d(n,{d:function(){return a}});var t=r("6ee88c54"),o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
886	192.168.2.5	50760	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:45 UTC	3725	OUT	GET /c360/v1/track HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAfk6BVJUjAAAA:WDfXg2ry+HvbnxTztLnepFvhf3dpX4SdQfM4GczRrcPw6MWAZH8MErn+af2Y9SvAts7ySjM/T9nCQWaxTWJ+ECSRYADCgGFp6g8nwqAAp4uZuesbnPNMB9VWMMTR/6OqpiFI1lm6c8HTX0et8uTZTDvEovUpe/ZJPj+EvnZwpL1hdq9NKhFzFZb6nk1kcyw+S5Gmb0WW/JMfQvkBUX6FX8nHd2pkcvntEKFlkhvMXyaXZ+ocI5s4XxhjbVLG6yziJfNgBxF+; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; header_signin_prompt=1; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbVA9iGwA%2BUSxwIu42mh5GOPt%2BW7AjYQvdrYhpXt0yQFsQgSxwG2BeSZAS5JRsMvijVPUCEElqMR%2BgrpCsa0hesk9dK0dyhz4ueIXiJkQ7CCAR6GErty2h09ffyYfs3vBFMK3lSm5wxNxn%2Bv9npOMvhMSJBOD4Bbg9B4eWxmufPHI%3D
2024-02-08 18:36:45 UTC	660	IN	HTTP/1.1 405 Method Not Allowed Transfer-Encoding: chunked Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:45 GMT strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=4f3b82de44fc0181&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqsvmTjWpyyOSoUPS0g9lYwgu3E9zdrT2SGI x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 5988b4ae4648c0fec3c60a3cca580092.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: YowO70nhoHO7d4XRhEQUXsa0P-uF1N4zfDA8tyACYQZBPWqmfaeHww==
2024-02-08 18:36:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
887	192.168.2.5	50759	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:45 UTC	447	OUT	GET /xdata/images/city/square250/689152.webp?k=3e406cd8b3fabad15ed34e82484d43d44bb0a05899ba8252d2334f73dbbe3697&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:45 UTC	537	IN	HTTP/1.1 200 OK Content-Type: image/webp Content-Length: 7046 Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:44 GMT ETag: "4d0d11b4a2b332a2b876436b689450336d5d826b" Content-Language: 7046 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 25d9b5959eaa82bb18ee3f35e6bf34b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Xjy-eKsLod3wbZbstXTr3F-Y-0yjdIa9fC-NK8F1tfPc4-hqlqI_Cg== Age: 1
2024-02-08 18:36:45 UTC	7046	IN	Data Raw: 52 49 46 46 7e 1b 00 00 57 45 42 50 56 50 38 20 72 1b 00 00 70 93 00 9d 01 2a fa 00 fa 00 3e 6d 30 94 47 a6 23 a2 a1 a8 34 7b 18 c0 0d 89 63 6d 33 d2 fb 34 e0 0c e8 41 1a 49 20 3f 5c b1 a2 b6 3a 76 5c 7f 57 fd 2f 46 5f 2d f8 57 23 3c 32 3c 7b 39 bf 91 ee 9f eb c1 fd 4f ab fe ab 47 53 ff 48 dc 0f 17 f6 af b6 35 cd 6f f4 fd 45 31 4f 53 b7 99 57 e4 79 eb c7 b7 8b 3f e1 ff e8 74 46 ea 37 f6 a3 a3 d8 0a 05 e0 ba 30 a6 45 eb 5a d6 7b f4 67 c2 bc 52 79 91 d6 2f 0f 62 0c c6 3d fe 5f 01 70 34 29 db 01 d2 fd 1c cc 99 70 4c 9b 8e 5c b8 05 34 ae 4b e4 f2 fc 48 95 3e 7d 24 df f6 7e 7a b0 8d 6b 67 0b 1a 7d ec ba 69 c2 f3 67 a4 14 7a f3 86 08 33 50 34 6c 1b af 5c 47 39 57 57 be ff a4 c2 d7 68 e7 ac 49 3c 44 47 41 8b 02 64 bc cb 3a ce e2 1a c9 d4 96 89 59 e2 8c ef 36 60 Data Ascii: RIFF~WEBPVP8 rp*>m0G#4{cm34AI ?\:v\W/F_-W#<2<{9OGSH5oE1OSWy?tF70EZ{gRy/b=_p4)pL\4KH>}$~zkg}igz3P4l\G9WWhI<DGAd:Y6`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
888	192.168.2.5	50754	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:45 UTC	447	OUT	GET /xdata/images/city/square250/689838.webp?k=32ffc2bfac0d85557bd5ddfc1ca92c73aef20bc8b4b5f2ac8b77ad47b6b7d5c1&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:45 UTC	544	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:44 GMT ETag: "697f6d5e35a615c8c45e32eb4c6cac8a7ebd07a5" Content-Language: 11818 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 3f95374273631adbfd8e0d0a9f6d7b64.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: utKV9qCHvvHSsXO1n-KFtj_h5tQmqCjPqeOe1an1Vx9hPaZGVuaZCQ== Age: 1
2024-02-08 18:36:45 UTC	11826	IN	Data Raw: 32 65 32 61 0d 0a 52 49 46 46 22 2e 00 00 57 45 42 50 56 50 38 20 16 2e 00 00 50 bb 00 9d 01 2a fa 00 fa 00 3e 6d 2e 93 46 a6 23 a2 a1 aa f3 5d 48 c0 0d 89 65 00 cf da 80 de 3f 5a fd 80 15 fe ea 4d df 85 7f 7f e6 a5 f6 5c 81 f9 a1 6d f1 b9 30 79 59 fb df 05 fc c8 fd 8f f8 8f 6b bf cc 31 87 f2 1e 05 ff 62 ed 9f fd 2f ed 5f 8d 7f 25 f5 17 c3 af f6 bd ce 5a ef fb 8f 41 af 84 33 87 fc df 3c 3f 90 f4 1d e1 bf e3 c5 ea 3e 87 3d 60 3f d7 f3 93 fb 2f fc 8f 64 2f db a3 57 be cd e3 70 6f fb 33 c6 b4 b4 05 3d c0 75 a6 3e af 4a 68 66 d1 4a a1 fd e2 6c 5f 06 ec 69 d6 df 9b b5 8e 77 41 f6 22 96 12 f4 d4 8b 25 a3 aa 7b 7d 23 70 a9 86 ec 67 49 1b 5f 4c 9f 77 e9 b4 ec 09 ca b3 e6 44 92 c6 dd 17 cf 83 e4 d0 75 78 fa 4c 75 1a 35 ee b2 23 f0 49 88 8f 10 bb 6f c2 bc 77 5b 83 Data Ascii: 2e2aRIFF".WEBPVP8 .P*>m.F#]He?ZM\m0yYk1b/_%ZA3<?>=`?/d/Wpo3=u>JhfJl_iwA"%{}#pgI_LwDuxLu5#Iow[
2024-02-08 18:36:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
889	192.168.2.5	50758	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:45 UTC	589	OUT	GET /psb/capla/static/js/da34a25a.be1d7e1b.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:46 UTC	675	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 41125 Connection: close Date: Thu, 08 Feb 2024 18:36:46 GMT Last-Modified: Wed, 18 Oct 2023 10:43:40 GMT ETag: "9a37e1026a86376b5f5a3992471355a6" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: hiq1.lQDa4pHzu6p2f2dfma6iVogJJzJ Accept-Ranges: bytes Server: AmazonS3 Vary: Accept-Encoding X-Cache: Miss from cloudfront Via: 1.1 086e2cd5d94fa729de58c51b5666e0e4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: t4HwI1bK0DJQcIv3s9OcqmTx55G-9PsOB8OVYZ2FKQDOcmaaSMHFog== Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:36:46 UTC	1443	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 64 61 33 34 61 32 35 61 2e 62 65 31 64 37 65 31 62 2e 63 68 75 6e 6b 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 5b 22 62 2d 70 61 63 6b 61 67 65 73 2d 63 6f 72 65 2d 70 61 63 6b 61 67 65 73 2d 66 72 6f 6e 74 65 6e 64 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 70 61 63 6b 61 67 65 73 2d 63 6f 72 65 2d 70 61 63 6b 61 67 65 73 2d 66 72 6f 6e 74 65 6e 64 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 64 61 33 34 61 32 35 61 22 5d 2c 7b 22 39 35 64 31 38 62 63 31 22 3a 66 Data Ascii: /! For license information please see da34a25a.be1d7e1b.chunk.js.LICENSE.txt /(self["b-packages-core-packages-frontend__LOADABLE_LOADED_CHUNKS__"]=self["b-packages-core-packages-frontend__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["da34a25a"],{"95d18bc1":f
2024-02-08 18:36:46 UTC	16384	IN	Data Raw: 2d 33 36 20 33 36 7a 22 7d 29 29 7d 3b 74 2e 5a 3d 69 7d 2c 22 34 62 36 39 30 35 65 35 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 7d 2c 22 34 65 31 36 30 31 33 31 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 72 28 74 29 2c 6e 2e 64 28 74 2c 7b 64 65 66 61 75 6c 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 74 7d 7d 29 3b 76 61 72 20 72 3d 6e 28 22 35 31 33 37 33 31 38 33 22 29 2c 61 3d 6e 28 22 65 61 64 37 31 65 62 30 22 29 2c 6f 3d 6e 2e 6e 28 61 29 2c 69 3d 6e 28 22 64 65 65 32 35 33 34 64 22 29 2c 75 3d 22 63 39 36 64 38 31 34 34 36 31 22 2c 63 3d 22 65 38 63 37 31 34 36 39 38 30 22 2c 6c 3d 22 61 66 36 35 39 36 35 31 Data Ascii: -36 36z"}))};t.Z=i},"4b6905e5":function(e){e.exports=function(){}},"4e160131":function(e,t,n){"use strict";n.r(t),n.d(t,{default:function(){return tt}});var r=n("51373183"),a=n("ead71eb0"),o=n.n(a),i=n("dee2534d"),u="c96d814461",c="e8c7146980",l="af659651
2024-02-08 18:36:46 UTC	16384	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 31 7d 29 29 7d 7d 2c 6f 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 2c 7b 73 74 79 6c 65 3a 7b 70 61 64 64 69 6e 67 54 6f 70 3a 35 30 7d 7d 2c 6f 28 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 69 2e 41 63 74 69 6f 6e 42 61 72 2c 7b 62 75 74 74 6f 6e 3a 7b 74 65 78 74 3a 68 2e 74 72 61 6e 73 28 28 30 2c 4d 2e 74 29 28 22 70 6b 67 73 5f 73 62 6f 78 5f 64 6f 6e 65 5f 63 74 61 22 29 29 2c 73 69 7a 65 3a 22 6c 61 72 67 65 22 2c 6f 6e 43 6c 69 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 70 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 21 31 7d 29 29 7d 7d 2c 74 6f 70 43 6f 6e 74 65 6e 74 3a 63 7d 29 29 29 29 3a 6f 28 29 2e 63 72 65 61 74 65 45 6c 65 6d Data Ascii: function(){return!1}))}},o().createElement("div",{style:{paddingTop:50}},o().createElement(i.ActionBar,{button:{text:h.trans((0,M.t)("pkgs_sbox_done_cta")),size:"large",onClick:function(){return p((function(){return!1}))}},topContent:c})))):o().createElem
2024-02-08 18:36:46 UTC	6914	IN	Data Raw: 75 72 6e 20 65 5b 74 5d 3d 6e 7d 7d 66 75 6e 63 74 69 6f 6e 20 66 28 65 2c 74 2c 6e 2c 72 29 7b 76 61 72 20 61 3d 74 26 26 74 2e 70 72 6f 74 6f 74 79 70 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 68 3f 74 3a 68 2c 6f 3d 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 61 2e 70 72 6f 74 6f 74 79 70 65 29 2c 75 3d 6e 65 77 20 53 28 72 7c 7c 5b 5d 29 3b 72 65 74 75 72 6e 20 69 28 6f 2c 22 5f 69 6e 76 6f 6b 65 22 2c 7b 76 61 6c 75 65 3a 41 28 65 2c 6e 2c 75 29 7d 29 2c 6f 7d 66 75 6e 63 74 69 6f 6e 20 6d 28 65 2c 74 2c 6e 29 7b 74 72 79 7b 72 65 74 75 72 6e 7b 74 79 70 65 3a 22 6e 6f 72 6d 61 6c 22 2c 61 72 67 3a 65 2e 63 61 6c 6c 28 74 2c 6e 29 7d 7d 63 61 74 63 68 28 49 29 7b 72 65 74 75 72 6e 7b 74 79 70 65 3a 22 74 68 72 6f 77 22 2c 61 72 67 3a 49 7d 7d 7d 74 2e 77 Data Ascii: urn e[t]=n}}function f(e,t,n,r){var a=t&&t.prototype instanceof h?t:h,o=Object.create(a.prototype),u=new S(r\|\|[]);return i(o,"_invoke",{value:A(e,n,u)}),o}function m(e,t,n){try{return{type:"normal",arg:e.call(t,n)}}catch(I){return{type:"throw",arg:I}}}t.w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
890	192.168.2.5	50755	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:45 UTC	447	OUT	GET /xdata/images/city/square250/786960.webp?k=e313213321010a516ee56b6ee04e367f770af64eaae9e8e230cde42d2cbca75a&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:45 UTC	544	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:44 GMT ETag: "26068a16355384ba3585236d5faf790db7f1bed8" Content-Language: 15612 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 45893c5ff2aa24fa7dce9573a0274642.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: qJAhfjMoDub2hJJWxiIE-5gk8gx1F163z7PyFsrNSmV6qAN0cwr1sw== Age: 1
2024-02-08 18:36:45 UTC	15620	IN	Data Raw: 33 63 66 63 0d 0a 52 49 46 46 f4 3c 00 00 57 45 42 50 56 50 38 20 e8 3c 00 00 70 ab 00 9d 01 2a fa 00 fa 00 3e 69 2a 90 45 a6 23 a2 19 0c 6e 0c 60 06 84 a3 3a 73 4c 5c 86 7c 34 10 09 aa bf e8 ea 2e 79 17 ba 68 e0 e1 19 d2 39 b5 fc 17 75 5f 60 18 49 7a 79 32 a2 fd ff fe b3 c0 bf 19 be df fd b3 fc d7 a5 de 18 fa d3 d4 23 ba bc e8 7e fd ff 77 fc 4f 8a 7f 15 75 0b f6 f7 9d 67 d4 f6 57 ee 3f eb bd 02 3d f5 fc 1f 99 07 d3 79 99 f6 7f d8 0b c8 ef f8 9e 14 1f 74 ff 63 fb 69 f0 09 fd 43 fc d7 ab 7f f8 be 49 3f 62 ff 73 ec 39 e5 91 ff ff dd f7 ee 7f ff ff ff ff 18 0b 08 41 e7 00 b8 af 8a 47 e8 ec 9d 03 95 ea 35 39 7c 09 cf ab 88 8b ec fc ae 32 1a a9 c8 b5 7e f1 28 34 22 78 2e d0 87 f1 7a 7b 8c 5f fe a3 b6 12 1a 6a 07 68 94 3c b0 a5 00 e7 9d 38 32 d1 cd a0 80 df ad Data Ascii: 3cfcRIFF<WEBPVP8 <p>iE#n`:sL\\|4.yh9u_`Izy2#~wOugW?=ytciCI?bs9AG59\|2~(4"x.z{_jh<82
2024-02-08 18:36:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
891	192.168.2.5	50757	108.138.64.16	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:45 UTC	589	OUT	GET /psb/capla/static/js/0de3785e.66d5d08f.chunk.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:46 UTC	680	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 4278 Connection: close Last-Modified: Wed, 18 Oct 2023 10:43:39 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: foo x-amz-version-id: 45Ii8Hx4NUkDikRj6iR_aMEhfnEec5Yx Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 08 Feb 2024 18:36:46 GMT ETag: "c907b4996b597288d653238dfa600eca" Vary: Accept-Encoding X-Cache: RefreshHit from cloudfront Via: 1.1 c625b1bdde545acdeb26c9f6ad3a8c6e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: Hgh7-Iotd9eWdmSTLsKsymS83zwpT05xC4yrtNSKTao-c5wGALuSeQ== Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-02-08 18:36:46 UTC	4278	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 5b 22 62 2d 70 61 63 6b 61 67 65 73 2d 63 6f 72 65 2d 70 61 63 6b 61 67 65 73 2d 66 72 6f 6e 74 65 6e 64 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 3d 73 65 6c 66 5b 22 62 2d 70 61 63 6b 61 67 65 73 2d 63 6f 72 65 2d 70 61 63 6b 61 67 65 73 2d 66 72 6f 6e 74 65 6e 64 5f 5f 4c 4f 41 44 41 42 4c 45 5f 4c 4f 41 44 45 44 5f 43 48 55 4e 4b 53 5f 5f 22 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 30 64 65 33 37 38 35 65 22 5d 2c 7b 22 38 63 38 61 66 32 63 35 22 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 61 2c 6e 29 7b 6e 2e 72 28 61 29 2c 6e 2e 64 28 61 2c 7b 64 65 66 61 75 6c 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 45 7d 7d 29 3b 76 61 72 20 74 3d 6e 28 Data Ascii: "use strict";(self["b-packages-core-packages-frontend__LOADABLE_LOADED_CHUNKS__"]=self["b-packages-core-packages-frontend__LOADABLE_LOADED_CHUNKS__"]\|\|[]).push([["0de3785e"],{"8c8af2c5":function(e,a,n){n.r(a),n.d(a,{default:function(){return E}});var t=n(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
892	192.168.2.5	50756	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:45 UTC	447	OUT	GET /xdata/images/city/square250/976861.webp?k=16d2ae8c0dfb3a2fa26b763677f321f1381be233e5dceaca916c520802b840ad&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:45 UTC	542	IN	HTTP/1.1 200 OK Content-Type: image/webp Content-Length: 6742 Connection: close Server: nginx Date: Mon, 05 Feb 2024 07:30:27 GMT ETag: "8d89ca4827a36b602f3819f29f6703c47110514d" Content-Language: 6742 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 5988b4ae4648c0fec3c60a3cca580092.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 1NU1zad77_33z40LauHo57A7r5a9MlQWonj8PUz_qvz5NTWhvpl1jQ== Age: 299178
2024-02-08 18:36:45 UTC	6742	IN	Data Raw: 52 49 46 46 4e 1a 00 00 57 45 42 50 56 50 38 20 42 1a 00 00 d0 86 00 9d 01 2a fa 00 fa 00 3e 6d 34 94 47 26 24 a2 a1 a9 74 7a 98 c0 0d 89 67 6e 28 bd d1 d9 ae 38 6d 8a 48 b6 da 15 99 9e de e5 b3 07 ca 8f b1 ef e8 c0 16 87 e6 6e 0b 5d fd 03 af ea fd 7f 53 e0 97 f6 be db df e4 77 fb f3 ae 61 fb 9e b5 ae 3b 09 e5 fd ca cb 89 e4 3f de f0 74 f5 4b 30 ad 74 20 55 31 4a 19 7f 20 13 31 c3 a1 35 5e cc 38 7a 0e 3e d2 e3 f0 33 87 6f 31 76 95 a7 4e 3d fc 9c a5 7b c8 16 d6 59 c0 7d 85 0b b4 45 5d 5b 23 1b fc 0b 18 4e 77 11 a5 3f 83 f4 5d ca ed ab 4d 3f e0 3e b2 b5 c9 f1 3c f9 af 7d 4e a2 5f 3c 28 8a 08 d4 20 70 e3 f1 9f 9f 29 0d 3e bb b5 ee 7a 9b be a1 6d 7e 1c e1 51 73 50 27 bd 1a c6 0e 1f a0 20 69 51 c8 a2 7d ac 57 41 e5 85 34 11 bd 6c 24 81 5c ae 76 f8 a1 12 db 62 Data Ascii: RIFFNWEBPVP8 B*>m4G&$tzgn(8mHn]Swa;?tK0t U1J 15^8z>3o1vN={Y}E][#Nw?]M?><}N_<( p)>zm~QsP' iQ}WA4l$\vb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
893	192.168.2.5	50763	74.125.136.99	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:45 UTC	768	OUT	GET /ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-116109-18&cid=421694156.1707417338&jid=1759057297&_u=SCCAgAIJAAAAAGgMI~&z=391046350 HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:45 UTC	539	IN	HTTP/1.1 200 OK P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:45 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:45 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
894	192.168.2.5	50765	18.67.65.25	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:45 UTC	650	OUT	POST /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive Content-Length: 92 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Booking-API-Version: 1 Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:45 UTC	92	OUT	Data Raw: 7b 22 70 69 64 22 3a 22 64 31 36 36 38 32 64 62 34 33 32 64 30 31 37 32 22 2c 22 72 65 66 41 63 74 69 6f 6e 22 3a 22 70 61 63 6b 61 67 65 73 5f 63 69 74 79 22 2c 22 73 69 74 65 54 79 70 65 22 3a 22 31 22 2c 22 63 6c 73 22 3a 31 39 2e 37 31 36 32 30 30 37 33 30 30 32 36 33 7d Data Ascii: {"pid":"d16682db432d0172","refAction":"packages_city","siteType":"1","cls":19.7162007300263}
2024-02-08 18:36:46 UTC	525	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:45 GMT vary: Origin, Accept-Encoding access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 470d4277236d0557f3e42c6bfe9dac78.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: Ocl1VwrfhAarOWTtZzakVvjwYB_gDToCfLaL1IRuuvsoCSUom68jhw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
895	192.168.2.5	50764	99.84.208.90	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:45 UTC	3812	OUT	POST /track/client-metrics HTTP/1.1 Host: flights.booking.com Connection: keep-alive Content-Length: 1268 X-Booking-Flights-Client-Hints: price_change_v2 x-booking-trace-meta: caller_persona="b-flights-frontend"; root_caller_persona="app" sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" x-booking-request-tree-id: 65c51f2bbf86b3c983f5b9d844888b15 sec-ch-ua-mobile: ?0 x-booking-parent-request-id: 6eb16677-e113-4790-902a-e8b887dc46a4 X-Booking-Label: gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ Content-Type: application/json X-Requested-From: clientFetch User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Booking-Affiliate-Id: 304142 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _gat=1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbVA9iGwA%2BUSxwIu42mh5GOPt%2BW7AjYQvdrYhpXt0yQFsQgSxwG2BeSZAS5JRsMvijVPUCEElqMR%2BgrpCsa0hesk9dK0dyhz4ueIXiJkQ7CCAR6GErty2h09ffyYfs3vBFMK3lSm5wxNxn%2Bv9npOMvhMSJBOD4Bbg9B4eWxmufPHI%3D
2024-02-08 18:36:45 UTC	1268	OUT	Data Raw: 7b 22 6d 65 74 72 69 63 73 22 3a 5b 7b 22 6e 61 6d 65 22 3a 22 73 63 72 65 65 6e 5f 6d 6f 75 6e 74 22 2c 22 72 6f 75 74 65 22 3a 22 68 6f 6d 65 22 2c 22 76 61 6c 75 65 22 3a 32 32 35 2e 35 7d 2c 7b 22 6e 61 6d 65 22 3a 22 46 43 50 22 2c 22 72 6f 75 74 65 22 3a 22 68 6f 6d 65 22 2c 22 76 61 6c 75 65 22 3a 35 33 37 34 7d 2c 7b 22 6e 61 6d 65 22 3a 22 70 61 67 65 76 69 65 77 22 2c 22 72 6f 75 74 65 22 3a 22 68 6f 6d 65 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 54 54 46 42 22 2c 22 72 6f 75 74 65 22 3a 22 68 6f 6d 65 22 2c 22 76 61 6c 75 65 22 3a 33 38 36 33 2e 38 30 30 30 30 30 30 30 30 30 34 36 36 7d 2c 7b 22 6e 61 6d 65 22 3a 22 66 69 72 73 74 5f 70 61 69 6e 74 22 2c 22 72 6f 75 74 65 22 3a 22 68 6f 6d 65 22 2c 22 76 61 6c 75 65 22 3a 35 33 37 34 7d 2c 7b 22 6e Data Ascii: {"metrics":[{"name":"screen_mount","route":"home","value":225.5},{"name":"FCP","route":"home","value":5374},{"name":"pageview","route":"home"},{"name":"TTFB","route":"home","value":3863.8000000000466},{"name":"first_paint","route":"home","value":5374},{"n
2024-02-08 18:36:46 UTC	1016	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 4 Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:46 GMT x-request-id: 65c51f2bbf86b3c983f5b9d844888b15 set-cookie: fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; Max-Age=86400; Domain=.booking.com; Path=/; Expires=Fri, 09 Feb 2024 18:36:46 GMT; HttpOnly; Secure set-cookie: fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; Path=/; Expires=Sun, 25 Feb 2024 19:17:14 GMT; HttpOnly; Secure access-control-allow-origin: https://www.booking.com vary: Origin access-control-allow-credentials: true referrer-policy: no-referrer x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Miss from cloudfront Via: 1.1 f8558580f66929e19ed69bba2e85da74.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD79-C1 X-Amz-Cf-Id: q5qAZPNvTj0XUb2prUDZBaJD96ld9h-xwve-PMbXlt4woAVFpL5OeA==
2024-02-08 18:36:46 UTC	4	IN	Data Raw: 74 72 75 65 Data Ascii: true

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
896	192.168.2.5	50766	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:45 UTC	447	OUT	GET /xdata/images/city/square250/690242.webp?k=d237489ebaacd4fce01bee28f2947d5b8e4e062f62a47f1b3f771473dae96fb9&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:46 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Wed, 31 Jan 2024 18:47:41 GMT ETag: "c60438342739c0782f273d6c29e4ec8e6825df46" Content-Language: 10006 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 14e4300e15854895259e6944bb121ec8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 65o45Mktzg2f_2DtDrRJGgBnJThu5yVxsvgeXaJxgZpR5osr3LgxaA== Age: 690545
2024-02-08 18:36:46 UTC	10014	IN	Data Raw: 32 37 31 36 0d 0a 52 49 46 46 0e 27 00 00 57 45 42 50 56 50 38 20 02 27 00 00 30 b2 00 9d 01 2a fa 00 fa 00 3e 6d 30 93 47 26 23 a2 a1 a8 71 bd 88 c0 0d 89 63 00 c3 e0 34 ec 37 a4 c9 2b e4 bf 1f e4 c1 8b 6f 98 62 1f 7e 0f 62 dc d6 fd 79 fa 61 b0 00 bc c5 97 73 58 f6 41 51 1f e8 78 0a f9 1f 03 fb 26 ff 91 df ff 01 dc 50 ee 58 18 5f d8 f5 c5 fa 22 81 5f f4 bc 88 7f 29 ff 5f 69 d7 ed db 90 05 21 6a 41 78 b5 8b 55 c2 4d d1 bd 6e 88 4e 30 f1 bf 82 1b 58 d1 0f e5 4a 7a be c8 2b 7d d8 a5 00 b6 2f 10 ea e5 4b 34 46 7e 63 5c 69 97 1e 55 82 16 5e da 5d 47 fd ce 59 9d f7 c7 c9 40 cf ff 60 ea 15 00 b6 4b e8 64 30 7e 0d 4f cc fc 71 79 78 ca c1 1e e4 e2 90 d4 00 b6 22 78 8a e6 4e 31 af 19 fb b9 44 95 32 7b 22 9d 27 4b 83 2c 0d e6 82 b8 32 2c 2f 0e 7c b0 da eb 40 02 a8 Data Ascii: 2716RIFF'WEBPVP8 '0*>m0G&#qc47+ob~byasXAQx&PX_"_)_i!jAxUMnN0XJz+}/K4F~c\iU^]GY@`Kd0~Oqyx"xN1D2{"'K,2,/\|@
2024-02-08 18:36:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
897	192.168.2.5	50767	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:45 UTC	447	OUT	GET /xdata/images/city/square250/977381.webp?k=ab236c5e99ba40341684e2d3bfcd8256d36f5e63883350af9faa988cd4d49939&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:46 UTC	549	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Tue, 30 Jan 2024 10:20:37 GMT ETag: "87f2aacd9ce7c6bfd4d44dc40b2911eede50f090" Content-Language: 10578 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 fcb94596db202c75ac0e559b3183be72.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: U-Jkl3cJamqXrWfn_KZ4sh9tNa2CmejHgewQD14mkUmSat1NERx6-g== Age: 807369
2024-02-08 18:36:46 UTC	9596	IN	Data Raw: 32 35 37 34 0d 0a 52 49 46 46 4a 29 00 00 57 45 42 50 56 50 38 20 3e 29 00 00 d0 a7 00 9d 01 2a fa 00 fa 00 3e 6d 30 92 47 a6 23 a2 21 aa 54 1b 58 c0 0d 89 67 6d ff 9f 37 a7 20 15 f7 58 0e 08 af 1e 49 c3 ab d3 ba 8f 55 54 73 13 15 9d 01 fc 4b dc ff f0 ff 35 ff 98 7f 95 e2 53 b0 bc cd fb 52 fc 5f f1 9e d2 7f af ef df e6 26 a1 7e cf ff 85 fd d3 d6 b3 f1 3b ad 37 af f9 1e 85 9e f9 7d ef cd c3 ec 3f f3 7a 85 f6 23 d8 1b f5 8b d3 cf f6 3e 33 9f 90 ff 61 ec 09 fd 47 fc 17 fe 6f f3 5e cd 3a 56 fa e7 f6 cb e0 7f a6 41 ad 7f 11 4d 26 bf 79 9c 7b a4 89 49 34 f5 06 40 ab 71 44 fb c5 c1 fc c7 da b8 8b 4d 63 2a 78 d4 4a 5e aa e7 77 6f 4a 86 74 06 2c 3a 57 6f 80 d5 03 16 51 f5 ce 8b 3c b1 ee 3b 54 62 51 2c fb 7c c5 4b 1f cf 1b d8 79 51 a3 ad 04 d5 05 be 17 11 b4 75 69 Data Ascii: 2574RIFFJ)WEBPVP8 >)>m0G#!TXgm7 XIUTsK5SR_&~;7}?z#>3aGo^:VAM&y{I4@qDMcxJ^woJt,:WoQ<;TbQ,\|KyQui
2024-02-08 18:36:46 UTC	997	IN	Data Raw: 33 64 65 0d 0a 67 21 31 46 b2 c3 8c 83 6a 91 03 bd 86 f4 84 77 91 b7 ad 3b 82 57 35 b1 5b 4f a8 9e 25 75 bc 20 14 2f e5 95 ad dc 53 57 c6 bb b4 fd 8d 88 36 c9 a3 26 71 80 48 84 93 18 ab bb e9 b0 21 8e 2c 86 83 f6 93 51 d2 d4 2b 7c 2a fc b2 67 c4 54 cf 52 8a 20 c6 ab 44 ea 64 ab 34 03 bd 5c 1b 8b e6 25 f5 35 dd a8 9f ca b7 03 7a 9b 42 fa 1e ba f4 48 d5 b3 e2 ef cd 03 cb 34 ce 56 7c 60 66 a7 db 23 7d c6 67 03 14 34 db 16 65 1e e7 d4 ee 35 9e 2e fa ac 38 27 83 59 b2 94 86 4f c6 2c 90 be 60 5a 60 14 2a 59 99 b1 7d 33 63 ae 34 ba ff 1f f3 fe 2d 22 d8 15 2b 84 7a 0a c6 7e 9d 22 a4 2c e9 55 6d 40 71 b8 3a 9f fe d9 e6 93 0b a7 ea 3b 1d 34 0c bf eb b0 cc 73 89 00 75 ab 23 49 18 4e 96 65 46 43 cc cf d9 d6 82 7f be 8a b3 bf 27 2d 69 15 26 04 3a c0 fb 6f f4 cf 45 e7 Data Ascii: 3deg!1Fjw;W5[O%u /SW6&qH!,Q+\|gTR Dd4\%5zBH4V\|`f#}g4e5.8'YO,`Z`Y}3c4-"+z~",Um@q:;4su#INeFC'-i&:oE
2024-02-08 18:36:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
898	192.168.2.5	50768	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:45 UTC	447	OUT	GET /xdata/images/city/square250/689523.webp?k=70ca656d88199dc2b8a04b0bccc877d2c971f409cf9bd5e76c736432579c3467&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:46 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:45 GMT ETag: "15401b89d585ee45318147d3446ad2215eb2f8e4" Content-Language: 8854 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 d48a409d6a3222e2cc9a060d30206d3c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: O5aHgY26V0prZ5EKlZd1M7jiMdOtfW-wcr9HJby30cWdj_Us7idCSw== Age: 1
2024-02-08 18:36:46 UTC	6398	IN	Data Raw: 31 38 66 36 0d 0a 52 49 46 46 8e 22 00 00 57 45 42 50 56 50 38 20 82 22 00 00 b0 8e 00 9d 01 2a fa 00 fa 00 3e 6d 32 94 48 26 24 22 a1 a5 94 0c 18 c0 0d 89 65 6d b6 6e 0f 21 fe b3 37 8c 69 d1 0d cb eb bd 61 f6 02 6b 39 0f 32 8a f2 4c 30 b3 70 5a e5 b1 6f c3 fe f9 ed 8f 7f 3f 8d ff 03 cc af b9 39 d3 fe fb be ff 96 5a 8a 7b 83 cd 9a 17 1d 1b fb ff d8 8f 62 3f 76 bf 13 e7 3b f9 9e 7b 7d a9 e8 f7 fe ef 89 67 e0 bf d6 fe dc fc 03 fe 8f f4 6f d3 1b ed 1f ed cb 58 0c a1 37 36 34 1d 66 4b ae 72 e5 dc 49 54 7b 16 12 10 f6 68 f4 11 8f 31 5a a2 cf 05 9f 26 35 11 d9 aa 91 21 20 94 1e d7 82 ce f4 fe 7c 9d ea df 3f 92 d1 e0 8b 7d bc b7 73 8d e3 5b 70 dd 6b b0 0a 7f 32 3b 52 f1 7f 46 b2 f6 82 f3 14 10 0d 6f d3 56 9b 81 9e 98 77 6f b0 12 96 38 33 cc 76 5f 4b c0 e8 48 27 Data Ascii: 18f6RIFF"WEBPVP8 "*>m2H&$"emn!7iak92L0pZo?9Z{b?v;{}goX764fKrIT{h1Z&5! \|?}s[pk2;RFoVwo83v_KH'
2024-02-08 18:36:46 UTC	2471	IN	Data Raw: 39 61 30 0d 0a bf aa 48 a6 84 32 5c 3d f6 6f 4b 41 76 a7 9e e7 67 7c cd 38 91 75 d4 60 4e 3b 90 42 46 5d b9 a6 55 d3 b7 f9 75 41 d1 d0 04 3a 2d 27 60 e9 ae 85 45 90 6e 39 24 83 d7 c2 db b0 76 af 8d d4 ba 09 2d 63 d0 54 dd 8e 5e be 90 78 a4 08 6e df 99 2b ea 3e b0 b7 e0 b5 eb b2 01 5f 7b 0d 00 37 0b d1 1a ef 00 13 7c 0b c8 d5 e5 d8 51 2c 79 7c 95 af 64 c7 b5 b5 a9 45 ad 2f c3 69 4c a3 74 20 a2 d7 2c 84 2d c6 2b e9 75 0a 4c 59 8e 81 31 29 38 ae df 52 95 4b ba f2 37 ab 78 0c 16 1a f6 ec 4d d0 a7 79 e6 c3 67 3a bd 7d 79 4f 28 8d fe 1e 9b be 3c df 99 50 56 7f ee 75 cb b2 fe 95 a2 71 e9 3c 89 46 21 c2 19 8c 39 fb f8 8a 34 7f 6a 13 58 62 fd b4 3a dc c6 d4 4d 67 d4 33 de cc 97 d1 3d f6 24 b9 8f 16 ac bd 11 3f 34 48 cc a7 76 17 c3 94 72 c4 50 0d 0c 2f 9b 45 2c 36 Data Ascii: 9a0H2\=oKAvg\|8u`N;BF]UuA:-'`En9$v-cT^xn+>_{7\|Q,y\|dE/iLt ,-+uLY1)8RK7xMyg:}yO(<PVuq<F!94jXb:Mg3=$?4HvrP/E,6
2024-02-08 18:36:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
899	192.168.2.5	50769	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:45 UTC	447	OUT	GET /xdata/images/city/square250/689687.webp?k=654bc31e8dc1dabf9b94fb37ad00f6942dc9927f10cf0b7b6a9f43e10d49375e&o= HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:46 UTC	543	IN	HTTP/1.1 200 OK Content-Type: image/webp Transfer-Encoding: chunked Connection: close Server: nginx Date: Thu, 08 Feb 2024 18:36:45 GMT ETag: "1c99bdd626affcc33cc05cbc273a61624b05ab74" Content-Language: 9846 Cache-Control: max-age=2592000 access-control-allow-origin: * x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 145bb9cba9e12350510f02ee9ab6ca22.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: xlw8i6kvmaBdrcSY1B8Z-9KJ-xra2z890OQhXDHbI5YE5MNmtfOJvQ== Age: 1
2024-02-08 18:36:46 UTC	9854	IN	Data Raw: 32 36 37 36 0d 0a 52 49 46 46 6e 26 00 00 57 45 42 50 56 50 38 20 62 26 00 00 10 85 00 9d 01 2a fa 00 fa 00 3e 6d 30 95 47 26 24 23 21 a8 d2 4b a8 c0 0d 89 63 33 9d fe de ae f6 7a f3 55 1b 34 85 5b eb 2d 2b 62 19 37 67 d9 f9 7a 73 0f 8f e0 ef e6 fc c4 7d df 90 ce 12 fe 9d d4 aa 7f 2f 7c 1b f2 0b ed 9f dc bf 77 7e 37 3f 18 c7 7f 5a da 8e f7 37 9f 6f e8 ff 64 fc 67 fd bb f7 3f 40 ec 43 ff 5f fb 43 fe bb c2 b3 6e ff 43 e8 23 ef af e2 7c d5 fe 9f fe ef a4 1f 6a 3a 37 ff 7d e2 ad f8 bf f9 fe c2 ff a7 bd 18 ff f8 ff 77 ea 43 f6 af f5 de ad 9d 51 7f 74 bd 93 4f c3 d2 65 41 9c ca 83 39 95 06 73 0a eb c0 da 85 c1 b5 0b 83 62 8f 42 7a 76 de cd f6 ae 97 ab a1 71 37 6d 24 2d 5d 9b 0d 83 00 db c7 1c ce 0c 91 71 b9 88 e9 27 bf b5 2a 1b b1 aa e9 0f 34 a9 8f a8 bf b9 c0 Data Ascii: 2676RIFFn&WEBPVP8 b&>m0G&$#!Kc3zU4[-+b7gzs}/\|w~7?Z7odg?@C_CnC#\|j:7}wCQtOeA9sbBzvq7m$-]q'4
2024-02-08 18:36:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
900	192.168.2.5	50770	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:46 UTC	4170	OUT	GET /js_tracking?stype=1&lang=en-us&ver=2&aid=304142&sid=5171fc655664ddf74ab763a094523fb7&ref_action=packages_city&pid=d16682db432d0172&ete=&etg=&etcg=&ets=&etgwv=js_web_vitals_cls_per_mille\|19&m=UmFuZG9tSVYkc2RlIyh9YdIXFZ7Nf82NAkuhhudQTioSutRpQn8uBcWgwMM-j5Sbuz9nv2vWLHLE4dV_SJngbBBk6UTeFiFgOcPnz7Gzoo2KA6TL2_i5J5f0Z_mULkN4439jWeHNCGdOf8Dnfr2mwd5U84qKx9veEXwn0ypiUZ29ohxd9ldgdVHyLvDvyEXRk_w3FXR-xkqyOsPLC6jUYYiSuqTleRS_1fViiRhT_YdQ6RNP48Cqy_dE7Kp_jNXyxS8D15Ld5uk HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAfk6BVJUjAAAA:WDfXg2ry+HvbnxTztLnepFvhf3dpX4SdQfM4GczRrcPw6MWAZH8MErn+af2Y9SvAts7ySjM/T9nCQWaxTWJ+ECSRYADCgGFp6g8nwqAAp4uZuesbnPNMB9VWMMTR/6OqpiFI1lm6c8HTX0et8uTZTDvEovUpe/ZJPj+EvnZwpL1hdq9NKhFzFZb6nk1kcyw+S5Gmb0WW/JMfQvkBUX6FX8nHd2pkcvntEKFlkhvMXyaXZ+ocI5s4XxhjbVLG6yziJfNgBxF+; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; header_signin_prompt=1; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbVA9iGwA%2BUSxwIu42mh5GOPt%2BW7AjYQvdrYhpXt0yQFsQgSxwG2BeSZAS5JRsMvijVPUCEElqMR%2BgrpCsa0hesk9dK0dyhz4ueIXiJkQ7CCAR6GErty2h09ffyYfs3vBFMK3lSm5wxNxn%2Bv9npOMvhMSJBOD4Bbg9B4eWxmufPHI%3D
2024-02-08 18:36:46 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:46 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=01a182df5dc204dd&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejLI5Mi5ZkNqTFsOgO4cbJStwIjeCtRkP30 x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 4a91a321d4c2ab7334c6f285093956ae.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 3OaqXMcZIrNst9oom5yHtYpGjK1eCcpHGSuTA2thRt7o2yOL3Sba0g==
2024-02-08 18:36:46 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
901	192.168.2.5	50771	99.84.208.123	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:46 UTC	3068	OUT	GET /track/client-metrics HTTP/1.1 Host: flights.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _gat=1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbVA9iGwA%2BUSxwIu42mh5GOPt%2BW7AjYQvdrYhpXt0yQFsQgSxwG2BeSZAS5JRsMvijVPUCEElqMR%2BgrpCsa0hesk9dK0dyhz4ueIXiJkQ7CCAR6GErty2h09ffyYfs3vBFMK3lSm5wxNxn%2Bv9npOMvhMSJBOD4Bbg9B4eWxmufPHI%3D
2024-02-08 18:36:46 UTC	1551	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Content-Length: 767 Connection: close server: envoy date: Thu, 08 Feb 2024 18:36:46 GMT vary: Accept-Encoding,Origin x-request-id: 0392afc0-c6b1-11ee-b5f7-c116a8c5fe13 set-cookie: fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; Max-Age=86400; Domain=.booking.com; Path=/; Expires=Fri, 09 Feb 2024 18:36:46 GMT; HttpOnly; Secure set-cookie: fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; Path=/; Expires=Sun, 25 Feb 2024 19:17:15 GMT; HttpOnly; Secure access-control-allow-credentials: true content-security-policy: base-uri 'none'; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=block&e=UmFuZG9tSVYkc2RlIyh9YYX-8qB8sBWzju5WmDl7IHU&pid=0392afc0c6b111eeb5f7c116a8c5fe13; script-src 'nonce-d1071a4aec29f37b8d9f' 'report-sample' 'self' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' https: content-security-policy-report-only: frame-ancestors 'none'; frame-src https://.booking.com https://.doubleclick.net; report-uri https://nellie.booking.com/csp-report-uri?type=report&e=UmFuZG9tSVYkc2RlIyh9YYX-8qB8sBWzju5WmDl7IHU&pid=0392afc0c6b111eeb5f7c116a8c5fe13 x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block strict-transport-security: max-age=86400; includeSubDomains X-Cache: Error from cloudfront Via: 1.1 5c302f38578fa41a607d734b38629fc2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD79-C1 X-Amz-Cf-Id: 9xVzd3CUiMqt0_OpnbTcYUgBHWjYzVqGELQppbZXSkIBY-EeluKteg==
2024-02-08 18:36:46 UTC	767	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 42 6f 6f 6b 69 6e 67 20 46 6c 69 67 68 74 73 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 62 61 63 6b 67 Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Booking Flights</title><style> body { backg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
902	192.168.2.5	50772	3.161.193.103	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:46 UTC	2985	OUT	GET /web-vitals/send-vitals HTTP/1.1 Host: web-vitals.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; lastSeen=1707417382595; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _gat=1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbVA9iGwA%2BUSxwIu42mh5GOPt%2BW7AjYQvdrYhpXt0yQFsQgSxwG2BeSZAS5JRsMvijVPUCEElqMR%2BgrpCsa0hesk9dK0dyhz4ueIXiJkQ7CCAR6GErty2h09ffyYfs3vBFMK3lSm5wxNxn%2Bv9npOMvhMSJBOD4Bbg9B4eWxmufPHI%3D
2024-02-08 18:36:46 UTC	513	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html;charset=iso-8859-1 Content-Length: 411 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:46 GMT cache-control: must-revalidate,no-cache,no-store strict-transport-security: max-age=86400; includeSubDomains x-xss-protection: 1; mode=block X-Cache: Error from cloudfront Via: 1.1 bc606b150a2a1ad01a254dcc3462c692.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P8 X-Amz-Cf-Id: 5ysra1UbNKchRpnG1RI3Rq7jAZGWMrGFQ4t550rLYT23vTDIjNTWkg==
2024-02-08 18:36:46 UTC	411	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 2f 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 32 3e 48 54 54 50 20 45 52 52 4f 52 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 32 3e 0a 3c 74 61 62 6c 65 3e 0a 3c 74 72 3e 3c 74 68 3e 55 52 49 3a 3c 2f 74 68 3e 3c 74 64 3e 2f 77 65 62 2d 76 69 74 61 6c 73 2f 73 65 6e 64 2d 76 69 74 61 6c 73 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/><title>Error 405 Method Not Allowed</title></head><body><h2>HTTP ERROR 405 Method Not Allowed</h2><table><tr><th>URI:</th><td>/web-vitals/send-vitals</td></tr><tr>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
903	192.168.2.5	50774	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:46 UTC	1015	OUT	GET /recaptcha/api.js?render=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&onload=onLoadRecaptchaV3Callback&_=1707417401851 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AJmcDEluwtSp57QJSmQQzbcGIOozbHSebG52sNz1noRw0W0Uj5MlmO6jPWiPivfFDy1ady_Qtnfk7_9aHN-OBpc; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:46 UTC	528	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Thu, 08 Feb 2024 18:36:46 GMT Date: Thu, 08 Feb 2024 18:36:46 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:36:46 UTC	724	IN	Data Raw: 35 32 63 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 52c/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2024-02-08 18:36:46 UTC	607	IN	Data Raw: 69 4f 69 4a 6f 64 48 52 77 63 7a 6f 76 4c 32 64 76 62 32 64 73 5a 53 35 6a 62 32 30 36 4e 44 51 7a 49 69 77 69 5a 6d 56 68 64 48 56 79 5a 53 49 36 49 6b 52 70 63 32 46 69 62 47 56 55 61 47 6c 79 5a 46 42 68 63 6e 52 35 55 33 52 76 63 6d 46 6e 5a 56 42 68 63 6e 52 70 64 47 6c 76 62 6d 6c 75 5a 79 49 73 49 6d 56 34 63 47 6c 79 65 53 49 36 4d 54 63 79 4e 54 51 77 4e 7a 6b 35 4f 53 77 69 61 58 4e 54 64 57 4a 6b 62 32 31 68 61 57 34 69 4f 6e 52 79 64 57 55 73 49 6d 6c 7a 56 47 68 70 63 6d 52 51 59 58 4a 30 65 53 49 36 64 48 4a 31 5a 58 30 3d 27 3b 64 2e 68 65 61 64 2e 70 72 65 70 65 6e 64 28 6d 29 3b 70 6f 2e 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 78 35 57 Data Ascii: iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/x5W
2024-02-08 18:36:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
904	192.168.2.5	50773	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:46 UTC	4598	OUT	POST /js_tracking?stype=1&lang=en-us&ver=2&aid=304142&sid=5171fc655664ddf74ab763a094523fb7&ref_action=packages_city&pid=d16682db432d0172&m=UmFuZG9tSVYkc2RlIyh9YdIXFZ7Nf82NAkuhhudQTioSutRpQn8uBcWgwMM-j5Sbuz9nv2vWLHLE4dV_SJngbBBk6UTeFiFgOcPnz7Gzoo2KA6TL2_i5J5f0Z_mULkN4439jWeHNCGdOf8Dnfr2mwd5U84qKx9veEXwn0ypiUZ29ohxd9ldgdVHyLvDvyEXRk_w3FXR-xkqyOsPLC6jUYYiSuqTleRS_1fViiRhT_YdQ6RNP48Cqy_dE7Kp_jNXyxS8D15Ld5uk&etgwv=js_onload_resource_transfer_size%7C400&_=1707417405590 HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/packages.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417370.35.0.0; _ga_A12345=GS1.1.1707417345.1.1.1707417370.0.0.0; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAfk6BVJUjAAAA:WDfXg2ry+HvbnxTztLnepFvhf3dpX4SdQfM4GczRrcPw6MWAZH8MErn+af2Y9SvAts7ySjM/T9nCQWaxTWJ+ECSRYADCgGFp6g8nwqAAp4uZuesbnPNMB9VWMMTR/6OqpiFI1lm6c8HTX0et8uTZTDvEovUpe/ZJPj+EvnZwpL1hdq9NKhFzFZb6nk1kcyw+S5Gmb0WW/JMfQvkBUX6FX8nHd2pkcvntEKFlkhvMXyaXZ+ocI5s4XxhjbVLG6yziJfNgBxF+; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _ga=GA1.2.421694156.1707417338; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; header_signin_prompt=1; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbVA9iGwA%2BUSxwIu42mh5GOPt%2BW7AjYQvdrYhpXt0yQFsQgSxwG2BeSZAS5JRsMvijVPUCEElqMR%2BgrpCsa0hesk9dK0dyhz4ueIXiJkQ7CCAR6GErty2h09ffyYfs3vBFMK3lSm5wxNxn%2Bv9npOMvhMSJBOD4Bbg9B4eWxmufPHI%3D; lastSeen=0
2024-02-08 18:36:46 UTC	695	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:46 GMT vary: Accept-Encoding, User-Agent strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=8c1382df26780341&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejLn9osU0OeJSILZJhSanUeTAiEsNvPsItA x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 f4c38e024a95b76a27c9f3dc9ff2eda6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: -YhyR_HCc3x8fsBwB5Xm4GZQG4gnHaDDOb-t0mhhITAzTsY0r_cnrw==
2024-02-08 18:36:46 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
905	192.168.2.5	50775	74.125.138.147	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:46 UTC	1040	OUT	POST /pagead/landing?gcs=G1--&gcd=13l3l3l3l5&rnd=651343451.1707417406&url=https%3A%2F%2Fwww.booking.com%2Fpackages.html&dma=0&npa=0&gtm=45He4250n815Q664QZv79615461za200&auid=1592208705.1707417344 HTTP/1.1 Host: www.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:46 UTC	842	IN	HTTP/1.1 302 Found P3P: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:46 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Content-Security-Policy: script-src 'none'; object-src 'none' Location: https://googleads.g.doubleclick.net/pagead/landing?gcs=G1--&gcd=13l3l3l3l5&rnd=651343451.1707417406&url=https%3A%2F%2Fwww.booking.com%2Fpackages.html&dma=0&npa=0&gtm=45He4250n815Q664QZv79615461za200&auid=1592208705.1707417344 X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-08 18:36:46 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
906	192.168.2.5	50780	216.239.38.21	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:46 UTC	4091	OUT	GET /g/collect?v=2&tid=G-A12345&gtm=45je4250z879615461za200&_p=1707417405583&gcs=G1--&gcd=13l3l3l3l5&npa=0&dma=0&cid=421694156.1707417338&ul=en-us&sr=1280x1024&ur=US-FL&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pscdl=noapi&sst.uc=US&sst.rnd=651343451.1707417406&sst.gcd=13l3l3l3l5&sst.tft=1707417405583&_s=1&sid=1707417345&sct=1&seg=1&dl=https%3A%2F%2Fwww.booking.com%2Fpackages.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&dt=All-inclusive%20Resorts%20and%20Flight%20%26%20Hotel%20packages%20%E2%80%93%20Booking.com&en=page_view&ep.is_aid_mcc_level_tracked=&ep.cd_action=packages_city&ep.n_b=&ep.hashed_email=&ep.partner_channel_id=3&tfd=8620&richsstsse HTTP/1.1 Host: gtm-mktg.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42; _gat=1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbVA9iGwA%2BUSxwIu42mh5GOPt%2BW7AjYQvdrYhpXt0yQFsQgSxwG2BeSZAS5JRsMvijVPUCEElqMR%2BgrpCsa0hesk9dK0dyhz4ueIXiJkQ7CCAR6GErty2h09ffyYfs3vBFMK3lSm5wxNxn%2Bv9npOMvhMSJBOD4Bbg9B4eWxmufPHI%3D; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417405.60.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417405.0.0.0
2024-02-08 18:36:47 UTC	566	IN	HTTP/1.1 200 OK Content-Type: text/plain Vary: Accept-Encoding set-cookie: FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; Max-Age=63072000; Domain=booking.com; Path=/; Secure; HttpOnly cache-control: no-cache x-content-type-options: nosniff access-control-allow-origin: https://www.booking.com access-control-allow-credentials: true X-Cloud-Trace-Context: bd5f8158123ed63bade780c7e762d0aa Date: Thu, 08 Feb 2024 18:36:47 GMT Server: Google Frontend Content-Length: 65 Expires: Thu, 08 Feb 2024 18:36:47 GMT Connection: close
2024-02-08 18:36:47 UTC	65	IN	Data Raw: 65 76 65 6e 74 3a 20 6d 65 73 73 61 67 65 0a 64 61 74 61 3a 20 7b 22 72 65 73 70 6f 6e 73 65 22 3a 7b 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 62 6f 64 79 22 3a 22 22 7d 7d 0a 0a Data Ascii: event: messagedata: {"response":{"status_code":200,"body":""}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
907	192.168.2.5	50777	216.239.34.181	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:46 UTC	2107	OUT	POST /g/collect?v=2&tid=G-FPD6YLJCJ7&gtm=45je4250v888381215z879615461za200&_p=1707417405583&_gaz=1&gcs=G1--&gcd=13l3l3l3l5&npa=0&dma=0&cid=421694156.1707417338&ul=en-us&sr=1280x1024&ir=1&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pae=1&pscdl=noapi&_eu=EA&_s=1&cu=EUR&dl=https%3A%2F%2Fwww.booking.com%2Fpackages.html&sid=1707417345&sct=1&seg=1&dt=All-inclusive%20Resorts%20and%20Flight%20%26%20Hotel%20packages%20%E2%80%93%20Booking.com&en=page_view&ep.cd_date_in=&ep.cd_date_out=&ep.cd_action=packages_city&ep.cd_adults=&ep.cd_children=&ep.cd_rooms=&ep.cd_nights=&ep.cd_page_url=https%3A%2F%2Fwww.booking.com%2Fpackages.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&ep.cd_ai=&ep.cd_book_window=&ep.cd_city_name=&ep.cd_country_name=&ep.cd_dest_cc=&ep.cd_dest_name=&ep.cd_dest_ufi=&ep.cd_full_referrer=&ep.cd_glev=&ep.cd_language=&ep.cd_logged_in=&ep.cd_tsmp=&ep.cd_user_location=&_et=7&up.up_ga_client_id=421694156.1707417338&up.up_is_subscribed_to_newsletter=&tfd=8575 HTTP/1.1 Host: analytics.google.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:47 UTC	449	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: https://www.booking.com Date: Thu, 08 Feb 2024 18:36:46 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Access-Control-Allow-Credentials: true Content-Type: text/plain Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
908	192.168.2.5	50779	142.251.15.156	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:46 UTC	1033	OUT	GET /td/ga/rul?tid=G-FPD6YLJCJ7&gacid=421694156.1707417338&gtm=45je4250v888381215z879615461za200&dma=0&gcs=G1--&gcd=13l3l3l3l5&npa=0&pscdl=noapi&aip=1&fledge=1&z=977750421 HTTP/1.1 Host: td.doubleclick.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: IDE=AHWqTUkENv7ENDMZ3ZrAkgASalpfCW8qgRXZa2T4y2upiK0NJpHe6N6I3vwDjLHm; ar_debug=1
2024-02-08 18:36:47 UTC	646	IN	HTTP/1.1 200 OK P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Date: Thu, 08 Feb 2024 18:36:47 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:36:47 UTC	18	IN	Data Raw: 64 0d 0a 3c 68 74 6d 6c 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: d<html></html>
2024-02-08 18:36:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
909	192.168.2.5	50781	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:46 UTC	4755	OUT	GET /js_errors?pid=d16682db432d0172&url=https%3A%2F%2Fwww.booking.com%2Fpackages.html&m=UmFuZG9tSVYkc2RlIyh9YdIXFZ7Nf82NAkuhhudQTioSutRpQn8uBcWgwMM-j5Sbuz9nv2vWLHLE4dV_SJngbBBk6UTeFiFgOcPnz7Gzoo2KA6TL2_i5J5f0Z_mULkN4439jWeHNCGdOf8Dnfr2mwd5U84qKx9veEXwn0ypiUZ29ohxd9ldgdVHyLvDvyEXRk_w3FXR-xkqyOsPLC6jUYYiSuqTleRS_1fViiRhT_YdQ6RNP48Cqy_dE7Kp_jNXyxS8D15Ld5uk&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=packages_city&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2Fpackages.html&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSObZWJFfVDSMePCFYZWFXO&cors=1 HTTP/1.1 Host: www.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/x-www-form-urlencoded Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/packages.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAfk6BVJUjAAAA:WDfXg2ry+HvbnxTztLnepFvhf3dpX4SdQfM4GczRrcPw6MWAZH8MErn+af2Y9SvAts7ySjM/T9nCQWaxTWJ+ECSRYADCgGFp6g8nwqAAp4uZuesbnPNMB9VWMMTR/6OqpiFI1lm6c8HTX0et8uTZTDvEovUpe/ZJPj+EvnZwpL1hdq9NKhFzFZb6nk1kcyw+S5Gmb0WW/JMfQvkBUX6FX8nHd2pkcvntEKFlkhvMXyaXZ+ocI5s4XxhjbVLG6yziJfNgBxF+; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; header_signin_prompt=1; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbVA9iGwA%2BUSxwIu42mh5GOPt%2BW7AjYQvdrYhpXt0yQFsQgSxwG2BeSZAS5JRsMvijVPUCEElqMR%2BgrpCsa0hesk9dK0dyhz4ueIXiJkQ7CCAR6GErty2h09ffyYfs3vBFMK3lSm5wxNxn%2Bv9npOMvhMSJBOD4Bbg9B4eWxmufPHI%3D; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417405.60.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417405.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42
2024-02-08 18:36:47 UTC	684	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:47 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=42cc82df621d0041&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQpT0JgeL3P3ILENkuYhvOmdn2rUJSIToAV x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 d125bf8405e840aa51a88ae3d8d91fb2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: vSOOuzKZ6twE5-u6gKV2-4EYjn4kck9ZYQTY4goGwJWldIEYF6uFwA==
2024-02-08 18:36:47 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
910	192.168.2.5	50778	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:46 UTC	636	OUT	GET /d8c14d4960ca/a18a4859af9c/challenge.js HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 If-Modified-Since: Thu, 8 Feb 2024 18:35:46 +0000
2024-02-08 18:36:47 UTC	519	IN	HTTP/1.1 304 Not Modified Content-Type: text/javascript Connection: close Vary: Accept-Encoding Date: Thu, 08 Feb 2024 18:36:47 GMT cache-control: private, max-age=86400 last-modified: Thu, 8 Feb 2024 18:35:46 +0000 pragma: no-cache expires: 0 x-amzn-waf-challenge-id: Root=1-65c51f3f-72ce8ae830d74c121bfed3f5 X-Cache: Miss from cloudfront Via: 1.1 e418fd5667de46c635f0321ea814c2e0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-P1 X-Amz-Cf-Id: jUqsiF-3Eg_cl0XU-pvXuJuCblgS5m970gjOKqMrY8N_mHKclY4PmA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
911	192.168.2.5	50789	64.233.177.99	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:47 UTC	1238	OUT	GET /recaptcha/api2/anchor?ar=1&k=6LfzopcUAAAAAPh4ue2iRjzP6XdxDVpwJigtlmeD&co=aHR0cHM6Ly93d3cuYm9va2luZy5jb206NDQz&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&cb=c94raoawdzt3 HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: _GRECAPTCHA=09AJmcDEluwtSp57QJSmQQzbcGIOozbHSebG52sNz1noRw0W0Uj5MlmO6jPWiPivfFDy1ady_Qtnfk7_9aHN-OBpc; NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-08 18:36:47 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 08 Feb 2024 18:36:47 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-aWoVYeJ3MfELfQYmBqCasw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-08 18:36:47 UTC	361	IN	Data Raw: 35 37 35 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b Data Ascii: 5758<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face {
2024-02-08 18:36:47 UTC	1252	IN	Data Raw: 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 Data Ascii: o/v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//f
2024-02-08 18:36:47 UTC	1252	IN	Data Raw: 39 2c 20 55 2b 32 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 Data Ascii: 9, U+20AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329,
2024-02-08 18:36:47 UTC	1252	IN	Data Raw: 30 2d 30 34 39 31 2c 20 55 2b 30 34 42 30 2d 30 34 42 31 2c 20 55 2b 32 31 31 36 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a Data Ascii: 0-0491, U+04B0-04B1, U+2116;}/* greek-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}
2024-02-08 18:36:47 UTC	1252	IN	Data Raw: 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c Data Ascii: */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA,
2024-02-08 18:36:47 UTC	1252	IN	Data Raw: 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 42 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 33 37 30 2d 30 33 37 37 2c 20 55 2b 30 33 37 41 2d 30 33 37 46 2c 20 55 2b 30 33 38 34 2d 30 33 38 41 2c 20 55 2b 30 33 38 43 2c 20 55 2b 30 33 38 45 2d 30 33 41 31 2c 20 55 2b 30 33 41 33 2d 30 33 46 46 3b 0a 7d 0a 2f 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b Data Ascii: l(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2) format('woff2'); unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}/* vietnamese */@font-face { font-family: 'Roboto'; font-style: normal;
2024-02-08 18:36:47 UTC	1252	IN	Data Raw: 20 55 2b 46 45 46 46 2c 20 55 2b 46 46 46 44 3b 0a 7d 0a 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 78 35 57 57 6f 45 35 37 46 76 30 64 36 41 54 4b 73 4c 44 49 41 4b 6e 74 2f 73 74 79 6c 65 73 5f 5f 6c 74 72 2e 63 73 73 22 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 61 57 6f 56 59 65 4a 33 4d 66 45 4c 66 51 59 6d 42 71 43 61 73 77 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 Data Ascii: U+FEFF, U+FFFD;}</style><link rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/styles__ltr.css"><script nonce="aWoVYeJ3MfELfQYmBqCasw" type="text/javascript">window['__recaptcha_api'] = 'http
2024-02-08 18:36:47 UTC	1252	IN	Data Raw: 55 41 5f 38 4d 32 73 4f 78 70 59 4f 42 4f 77 4d 79 4d 4b 64 4b 6b 50 76 69 39 59 33 46 65 42 46 4d 6a 30 4c 71 6a 6a 6b 44 6a 39 4e 45 76 6f 67 4b 2d 66 36 66 4d 32 41 7a 67 30 6c 37 70 6c 6d 6c 74 43 32 75 30 5a 45 44 68 4b 39 54 78 54 73 4c 4c 5f 68 39 76 4e 39 75 78 31 2d 62 56 6f 51 52 73 5f 62 50 63 66 64 61 35 35 52 30 67 6e 4f 6c 5f 64 4b 35 58 30 2d 4f 46 75 30 58 62 32 72 61 75 66 69 4d 39 4e 56 46 6e 56 78 54 49 50 55 4c 4f 5a 50 58 5a 72 77 61 78 51 72 70 30 77 32 57 32 61 4b 71 63 52 6c 32 32 65 48 70 69 4d 4b 49 2d 54 78 6c 65 67 6b 52 55 56 4f 49 61 4f 31 32 4d 68 4d 51 66 55 53 49 56 48 5f 36 6a 36 35 68 4a 4e 64 4f 79 49 6f 6a 52 6c 4c 66 66 67 51 31 71 54 58 53 44 2d 76 58 69 5a 48 38 6c 2d 46 72 78 52 77 52 72 43 37 38 6d 4f 31 6b 7a 2d Data Ascii: UA_8M2sOxpYOBOwMyMKdKkPvi9Y3FeBFMj0LqjjkDj9NEvogK-f6fM2Azg0l7plmltC2u0ZEDhK9TxTsLL_h9vN9ux1-bVoQRs_bPcfda55R0gnOl_dK5X0-OFu0Xb2raufiM9NVFnVxTIPULOZPXZrwaxQrp0w2W2aKqcRl22eHpiMKI-TxlegkRUVOIaO12MhMQfUSIVH_6j65hJNdOyIojRlLffgQ1qTXSD-vXiZH8l-FrxRwRrC78mO1kz-
2024-02-08 18:36:47 UTC	1252	IN	Data Raw: 72 6b 53 7a 74 69 77 50 35 48 45 36 5f 34 76 75 6f 56 65 74 52 6f 45 39 37 2d 48 62 76 72 4a 37 4e 73 61 6d 37 52 55 59 66 5f 4b 63 4a 34 41 22 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6e 6f 6e 63 65 3d 22 61 57 6f 56 59 65 4a 33 4d 66 45 4c 66 51 59 6d 42 71 43 61 73 77 22 3e 0a 20 20 20 20 20 20 72 65 63 61 70 74 63 68 61 2e 61 6e 63 68 6f 72 2e 4d 61 69 6e 2e 69 6e 69 74 28 22 5b 5c 78 32 32 61 69 6e 70 75 74 5c 78 32 32 2c 5b 5c 78 32 32 62 67 64 61 74 61 5c 78 32 32 2c 5c 78 32 32 4c 79 39 33 64 33 63 75 5a 32 39 76 5a 32 78 6c 4c 6d 4e 76 62 53 39 71 63 79 39 69 5a 79 39 4c 61 31 64 47 5a 56 4e 56 55 6d 56 72 57 45 64 35 59 32 52 77 63 6c 5a 44 4c 56 56 5a 4e 6b 56 45 4c 56 70 47 4e 57 78 73 Data Ascii: rkSztiwP5HE6_4vuoVetRoE97-HbvrJ7Nsam7RUYf_KcJ4A"><script type="text/javascript" nonce="aWoVYeJ3MfELfQYmBqCasw"> recaptcha.anchor.Main.init("[\x22ainput\x22,[\x22bgdata\x22,\x22Ly93d3cuZ29vZ2xlLmNvbS9qcy9iZy9La1dGZVNVUmVrWEd5Y2RwclZDLVVZNkVELVpGNWxs
2024-02-08 18:36:47 UTC	1252	IN	Data Raw: 45 61 57 56 31 51 58 42 73 51 56 46 30 65 57 70 35 4e 46 5a 32 53 57 68 58 59 58 42 75 54 6d 5a 36 53 6b 35 35 4c 7a 4a 77 57 57 74 47 59 56 59 35 56 48 56 6e 53 57 6b 31 62 47 6b 7a 56 47 30 31 55 58 56 4e 56 6e 4e 57 51 6d 74 33 4b 79 74 30 4d 32 39 31 4d 6e 6b 31 57 55 46 61 5a 7a 51 30 53 6b 56 45 5a 45 39 4e 53 43 39 71 54 6c 68 47 65 47 74 61 5a 6d 64 42 59 31 52 44 54 58 42 50 57 56 46 4f 64 47 4d 30 62 47 5a 71 56 47 6c 43 4e 32 35 7a 54 7a 46 51 53 55 74 51 4f 57 35 42 56 45 35 74 4e 6d 68 57 64 44 52 4d 52 47 6c 31 56 58 42 78 61 6e 52 49 53 6b 5a 46 5a 45 59 79 54 6d 35 42 65 44 4a 56 59 58 70 48 4e 6c 51 35 56 6e 70 6d 5a 6d 4e 4c 5a 6c 6c 45 4c 30 45 35 4e 32 52 59 5a 31 46 31 55 46 4e 49 4d 55 31 4f 51 55 6c 69 63 6b 78 46 65 6c 55 34 57 58 Data Ascii: EaWV1QXBsQVF0eWp5NFZ2SWhXYXBuTmZ6Sk55LzJwWWtGYVY5VHVnSWk1bGkzVG01UXVNVnNWQmt3Kyt0M291Mnk1WUFaZzQ0SkVEZE9NSC9qTlhGeGtaZmdBY1RDTXBPWVFOdGM0bGZqVGlCN25zTzFQSUtQOW5BVE5tNmhWdDRMRGl1VXBxanRISkZFZEYyTm5BeDJVYXpHNlQ5VnpmZmNLZllEL0E5N2RYZ1F1UFNIMU1OQUlickxFelU4WX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
912	192.168.2.5	50791	216.239.32.21	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:47 UTC	3888	OUT	GET /g/collect?v=2&tid=G-A12345&gtm=45je4250z879615461za200&_p=1707417405583&gcs=G1--&gcd=13l3l3l3l5&npa=0&dma=0&cid=421694156.1707417338&ul=en-us&sr=1280x1024&ur=US-FL&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&are=1&pscdl=noapi&sst.uc=US&sst.rnd=651343451.1707417406&sst.gcd=13l3l3l3l5&sst.tft=1707417405583&_s=1&sid=1707417345&sct=1&seg=1&dl=https%3A%2F%2Fwww.booking.com%2Fpackages.html%3Faid%3D304142%26label%3Dgen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ%26sid%3Ddb6e5bbb32eac0e80cfcae9b22f5390d&dt=All-inclusive%20Resorts%20and%20Flight%20%26%20Hotel%20packages%20%E2%80%93%20Booking.com&en=page_view&ep.is_aid_mcc_level_tracked=&ep.cd_action=packages_city&ep.n_b=&ep.hashed_email=&ep.partner_channel_id=3&tfd=8620&richsstsse HTTP/1.1 Host: gtm-mktg.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; _gat=1; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbVA9iGwA%2BUSxwIu42mh5GOPt%2BW7AjYQvdrYhpXt0yQFsQgSxwG2BeSZAS5JRsMvijVPUCEElqMR%2BgrpCsa0hesk9dK0dyhz4ueIXiJkQ7CCAR6GErty2h09ffyYfs3vBFMK3lSm5wxNxn%2Bv9npOMvhMSJBOD4Bbg9B4eWxmufPHI%3D; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417405.60.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417405.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42
2024-02-08 18:36:47 UTC	472	IN	HTTP/1.1 200 OK Content-Type: text/plain Vary: Accept-Encoding set-cookie: FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; Max-Age=63072000; Domain=booking.com; Path=/; Secure; HttpOnly cache-control: no-cache x-content-type-options: nosniff X-Cloud-Trace-Context: 0db38bd8a29726c6e00ab4da4ecddc42 Date: Thu, 08 Feb 2024 18:36:47 GMT Server: Google Frontend Content-Length: 65 Expires: Thu, 08 Feb 2024 18:36:47 GMT Connection: close
2024-02-08 18:36:47 UTC	65	IN	Data Raw: 65 76 65 6e 74 3a 20 6d 65 73 73 61 67 65 0a 64 61 74 61 3a 20 7b 22 72 65 73 70 6f 6e 73 65 22 3a 7b 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 62 6f 64 79 22 3a 22 22 7d 7d 0a 0a Data Ascii: event: messagedata: {"response":{"status_code":200,"body":""}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
913	192.168.2.5	50792	108.138.64.79	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:47 UTC	4325	OUT	GET /js_errors?pid=d16682db432d0172&url=https%3A%2F%2Fwww.booking.com%2Fpackages.html&m=UmFuZG9tSVYkc2RlIyh9YdIXFZ7Nf82NAkuhhudQTioSutRpQn8uBcWgwMM-j5Sbuz9nv2vWLHLE4dV_SJngbBBk6UTeFiFgOcPnz7Gzoo2KA6TL2_i5J5f0Z_mULkN4439jWeHNCGdOf8Dnfr2mwd5U84qKx9veEXwn0ypiUZ29ohxd9ldgdVHyLvDvyEXRk_w3FXR-xkqyOsPLC6jUYYiSuqTleRS_1fViiRhT_YdQ6RNP48Cqy_dE7Kp_jNXyxS8D15Ld5uk&aid=304142&lang=en-us&errc=1&errp=0&stid=304142&ch=d&ref_action=packages_city&stype=1&error=Script%20error.&be_running=1&be_message=Script%20error.&be_file=https%3A%2F%2Fwww.booking.com%2Fpackages.html&be_line=0&be_column=0&gtt=dLYAeZFVJfNTBBFYKSObZWJFfVDSMePCFYZWFXO&cors=1 HTTP/1.1 Host: www.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAfk6BVJUjAAAA:WDfXg2ry+HvbnxTztLnepFvhf3dpX4SdQfM4GczRrcPw6MWAZH8MErn+af2Y9SvAts7ySjM/T9nCQWaxTWJ+ECSRYADCgGFp6g8nwqAAp4uZuesbnPNMB9VWMMTR/6OqpiFI1lm6c8HTX0et8uTZTDvEovUpe/ZJPj+EvnZwpL1hdq9NKhFzFZb6nk1kcyw+S5Gmb0WW/JMfQvkBUX6FX8nHd2pkcvntEKFlkhvMXyaXZ+ocI5s4XxhjbVLG6yziJfNgBxF+; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; header_signin_prompt=1; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbVA9iGwA%2BUSxwIu42mh5GOPt%2BW7AjYQvdrYhpXt0yQFsQgSxwG2BeSZAS5JRsMvijVPUCEElqMR%2BgrpCsa0hesk9dK0dyhz4ueIXiJkQ7CCAR6GErty2h09ffyYfs3vBFMK3lSm5wxNxn%2Bv9npOMvhMSJBOD4Bbg9B4eWxmufPHI%3D; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417405.60.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417405.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42
2024-02-08 18:36:47 UTC	684	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 35 Connection: close server: nginx date: Thu, 08 Feb 2024 18:36:47 GMT vary: User-Agent, Accept-Encoding strict-transport-security: max-age=86400; includeSubDomains content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=7ee382dfea940043&e=UmFuZG9tSVYkc2RlIyh9YV1DLEiaMVQp3M560sE-UHH-LlTqCz7E9w_uN1Dp_kaP x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 3f95374273631adbfd8e0d0a9f6d7b64.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD12-P1 X-Amz-Cf-Id: 135rXmAtmgcG84OQR5YKUPy--Q4K9R0sCSbPr5xqTclFio9700cJTg==
2024-02-08 18:36:47 UTC	35	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b Data Ascii: GIF89a,;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
914	192.168.2.5	50793	108.138.64.87	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:47 UTC	4439	OUT	POST /navigation_times HTTP/1.1 Host: www.booking.com Connection: keep-alive Content-Length: 511 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/x-www-form-urlencoded X-Booking-CSRF: dlfFZQAAAAA=9FEpDaCj1qqLdemHHz3PAsjsumCEOKcSBegdNQuXcZ3_gZl_kN0VsNDXgRe0ATwcE5urQkwmo2KWpVgW5QJwbPGV9GbJwVQ4wghe1QBGjzQB60WEFosHhV4PwY1mc4hwAusHrxF2T8D0J5_AJQXRQn9kqNDUTvK0-rlnqU9QKWQ3r4-Kg3ajLU-6vixaGPa7ESiUEgsJgaiJczqx sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/packages.html?aid=304142&label=gen173nr-1FCAEoggI46AdIM1gEaI8CiAEBmAExuAEXyAEM2AEB6AEB-AECiAIBqAIDuALzvZSuBsACAdICJDI1NjM0ZDdjLTdmMzAtNDQyMC1hN2UwLTcxYzhhMjkwZDEyNtgCBeACAQ&sid=db6e5bbb32eac0e80cfcae9b22f5390d Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: px_init=0; bkng_sso_auth=CAIQsOnuTRpmbDHQTHQTGEqt0+6R1FjkXvHmBPFIlIT4934inZyackyWgC2/lAfUqRKSvBLVkEEbGAZX81UQ/tsJyvbJuw1p5vSV07dz/BK/PSr5WWgzYs5BEHlxLkPWXSnTFKWjNDjvCp64TxiH; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D4d9815ba-cd79-4f1d-9d5d-b1749569affa%26consentedAt%3D2024-02-08T18%3A35%3A31.547Z%26expiresAt%3D2024-08-06T18%3A35%3A31.547Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DGA%26regulation%3Dnone%26legacyRegulation%3Dnone; cors_js=1; _gid=GA1.2.1662332493.1707417338; BJS=-; bkng_sso_ses=e30; bkng_sso_session=e30; bkng_prue=1; _gcl_au=1.1.1592208705.1707417344; __gads=ID=0b43cf03ff4edaa9:T=1707417344:RT=1707417344:S=ALNI_MZ38ifUHCzv5_R9qPx_DSQxNX3mhw; __gpi=UID=00000a0c30c5c51f:T=1707417344:RT=1707417344:S=ALNI_MYTKU_KuOAu7csE-eRH6CpzPFUFZg; __eoi=ID=848d5fda89230a58:T=1707417344:RT=1707417344:S=AA-AfjblD-3JhdNa7xxiyNI1n_4V; _scid=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; FPID=FPID2.2.yZy4eHYAaPFiUWPLuiRAcCB9HB6jMpmj1yRXjI9Wbv8%3D.1707417338; FPLC=FxuSZ3WbRSHrxJt2GVU3vbLLQpZ8DbdrPJJPFNFs1R9q8h5PnnKST1A7vNogLOVO9cMuYhJctF8Da8CveNDrGwwP%2BwlNKpyuHHiteMrzsmXWA7GkBXwuCO0D1kn6aw%3D%3D; _pin_unauth=dWlkPVpXWTJOVE5qTldVdE5ETmlPQzAwTVdKbExUaGtZall0TW1Rd01EYzNNRFF4TXpsaA; _scid_r=e7dfd899-6a22-4e5c-8a9a-6e83d48aec8e; bkng_last_login_attempt_timestamp=2024-02-08%2019%3A36%3A16; aws-waf-token=cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAfk6BVJUjAAAA:WDfXg2ry+HvbnxTztLnepFvhf3dpX4SdQfM4GczRrcPw6MWAZH8MErn+af2Y9SvAts7ySjM/T9nCQWaxTWJ+ECSRYADCgGFp6g8nwqAAp4uZuesbnPNMB9VWMMTR/6OqpiFI1lm6c8HTX0et8uTZTDvEovUpe/ZJPj+EvnZwpL1hdq9NKhFzFZb6nk1kcyw+S5Gmb0WW/JMfQvkBUX6FX8nHd2pkcvntEKFlkhvMXyaXZ+ocI5s4XxhjbVLG6yziJfNgBxF+; pxcts=f650099f-c6b0-11ee-a9bf-0d5288ee06a5; _pxvid=f64fed37-c6b0-11ee-a9bf-8df738caae8b; _px3=7254a60d7a8e8b16b29c92475dbee8ef920cbc0ad27ed5824826edc0229dfd35:Kmg+Rf4jXfB9bvIrmMyNjQK6OEdjNt4esMV6Ps+cTmiDDAH0Rue5Uc2klAixW/HRTo3vqQXTdWe6oKK9t5D8Jw==:1000:Jzwqgq4KLsXvItu5JVTIDy5ejjrqsjiOVzq7o81gMPxebhpuDkxfnMNYGY8BOeBchzpUOJsUGl1///jy1LwXGX0CER8ustZb7oAVh4vSGhHy23kQo66h/GCy9Vug/oTkZxugDhX/dSTq/ly2Oz3sfD824bbjcU47jZ365fypgMm2ik9Mr2zaf0hKJItarcY5LwvRzL4vz/Fndi+nUrYj8EihSVTUQw7jx8Hx0jhv0ok=; _pxde=a70c817501f9aa869fab3fae4ab4c106c13413dbac1cf8f9cc069d44d912a887:eyJ0aW1lc3RhbXAiOjE3MDc0MTczODU4ODIsImZfa2IiOjAsImlwY19pZCI6W119; fasc=a3ba37ba-c2ec-43f9-95fe-d3f2b7d68674; pc_payer_id=99382e2a-b920-4915-b9cd-401e55f43794; fsc=s%3Afb1d95bfa9c9b2076a36dd7c3232981d.mV5R6l%2FzDla9Cm2dMbpsBgzmirNVtns9fCeSlnDy64U; header_signin_prompt=1; _gat=1; OptanonConsent=implicitConsentCountry=nonGDPR&implicitConsentDate=1707417338482&isGpcEnabled=0&datestamp=Thu+Feb+08+2024+19%3A36%3A43+GMT%2B0100+(Central+European+Standard+Time)&version=202310.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=28e00d48-764e-47fc-9a7e-d849857f307c&interactionCount=0&landingPath=NotLandingPage&groups=C0001%3A1%2CC0002%3A1%2CC0004%3A1&AwaitingReconsent=false; bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbVA9iGwA%2BUSxwIu42mh5GOPt%2BW7AjYQvdrYhpXt0yQFsQgSxwG2BeSZAS5JRsMvijVPUCEElqMR%2BgrpCsa0hesk9dK0dyhz4ueIXiJkQ7CCAR6GErty2h09ffyYfs3vBFMK3lSm5wxNxn%2Bv9npOMvhMSJBOD4Bbg9B4eWxmufPHI%3D; lastSeen=0; _ga_FPD6YLJCJ7=GS1.1.1707417345.1.1.1707417405.60.0.0; _ga=GA1.1.421694156.1707417338; _ga_A12345=GS1.1.1707417345.1.1.1707417405.0.0.0; _uetsid=df191de0c6b011eea7b7e756cffae9eb; _uetvid=df1947f0c6b011eeb9850f920174ad42
2024-02-08 18:36:47 UTC	511	OUT	Data Raw: 72 65 66 5f 61 63 74 69 6f 6e 3d 70 61 63 6b 61 67 65 73 5f 63 69 74 79 26 70 69 64 3d 64 31 36 36 38 32 64 62 34 33 32 64 30 31 37 32 26 73 74 79 70 65 3d 31 26 6c 61 6e 67 3d 65 6e 26 66 69 72 73 74 3d 30 26 63 68 3d 64 26 62 6f 3d 33 26 61 69 64 3d 33 30 34 31 34 32 26 63 73 73 5f 6c 6f 61 64 3d 31 26 63 64 6e 3d 63 66 26 64 63 3d 31 26 6e 74 73 3d 30 25 32 43 30 25 32 43 31 37 30 37 34 31 37 33 39 37 32 38 30 25 32 43 30 25 32 43 30 25 32 43 30 25 32 43 30 25 32 43 31 37 30 37 34 31 37 33 39 37 32 38 34 25 32 43 31 37 30 37 34 31 37 33 39 37 33 32 31 25 32 43 31 37 30 37 34 31 37 33 39 37 33 32 31 25 32 43 31 37 30 37 34 31 37 33 39 37 33 32 31 25 32 43 31 37 30 37 34 31 37 33 39 37 36 33 38 25 32 43 31 37 30 37 34 31 37 33 39 37 33 32 33 25 32 43 31 Data Ascii: ref_action=packages_city&pid=d16682db432d0172&stype=1&lang=en&first=0&ch=d&bo=3&aid=304142&css_load=1&cdn=cf&dc=1&nts=0%2C0%2C1707417397280%2C0%2C0%2C0%2C0%2C1707417397284%2C1707417397321%2C1707417397321%2C1707417397321%2C1707417397638%2C1707417397323%2C1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
915	192.168.2.5	50794	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-08 18:36:47 UTC	674	OUT	POST /d8c14d4960ca/a18a4859af9c/telemetry HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive Content-Length: 1817 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://www.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-08 18:36:47 UTC	1817	OUT	Data Raw: 7b 22 65 78 69 73 74 69 6e 67 5f 74 6f 6b 65 6e 22 3a 22 63 64 35 63 34 35 63 33 2d 38 38 35 32 2d 34 34 61 32 2d 39 38 66 30 2d 35 36 34 31 66 32 35 66 34 65 39 39 3a 45 67 6f 41 66 6b 36 42 56 4a 55 6a 41 41 41 41 3a 57 44 66 58 67 32 72 79 2b 48 76 62 6e 78 54 7a 74 4c 6e 65 70 46 76 68 66 33 64 70 58 34 53 64 51 66 4d 34 47 63 7a 52 72 63 50 77 36 4d 57 41 5a 48 38 4d 45 72 6e 2b 61 66 32 59 39 53 76 41 74 73 37 79 53 6a 4d 2f 54 39 6e 43 51 57 61 78 54 57 4a 2b 45 43 53 52 59 41 44 43 67 47 46 70 36 67 38 6e 77 71 41 41 70 34 75 5a 75 65 73 62 6e 50 4e 4d 42 39 56 57 4d 4d 54 52 2f 36 4f 71 70 69 46 49 31 6c 6d 36 63 38 48 54 58 30 65 74 38 75 54 5a 54 44 76 45 6f 76 55 70 65 2f 5a 4a 50 6a 2b 45 76 6e 5a 77 70 4c 31 68 64 71 39 4e 4b 68 46 7a 46 5a Data Ascii: {"existing_token":"cd5c45c3-8852-44a2-98f0-5641f25f4e99:EgoAfk6BVJUjAAAA:WDfXg2ry+HvbnxTztLnepFvhf3dpX4SdQfM4GczRrcPw6MWAZH8MErn+af2Y9SvAts7ySjM/T9nCQWaxTWJ+ECSRYADCgGFp6g8nwqAAp4uZuesbnPNMB9VWMMTR/6OqpiFI1lm6c8HTX0et8uTZTDvEovUpe/ZJPj+EvnZwpL1hdq9NKhFzFZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
916	192.168.2.5	50795	64.233.177.99	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
917	192.168.2.5	50796	18.67.65.7	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
918	192.168.2.5	50797	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
919	192.168.2.5	50798	74.125.136.99	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
920	192.168.2.5	50799	18.67.65.7	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
921	192.168.2.5	50800	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
922	192.168.2.5	50801	18.67.65.7	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
923	192.168.2.5	50802	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
924	192.168.2.5	50803	18.67.65.7	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
925	192.168.2.5	50804	18.67.65.55	443	5524	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
926	192.168.2.5	50805	18.67.65.7	443

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
927	192.168.2.5	50806	18.67.65.55	443

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
928	192.168.2.5	50807	108.138.64.87	443

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
929	192.168.2.5	50808	18.67.65.7	443

Timestamp	Bytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
930	192.168.2.5	50809	108.138.64.79	443

Timestamp	Bytes transferred	Direction	Data

Target ID:	0
Start time:	19:35:20
Start date:	08/02/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	19:35:25
Start date:	08/02/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1980,i,14640437719870964142,12986360728299235327,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	19:35:27
Start date:	08/02/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "https://booking.search-13125.com/6513881796
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://booking.search-13125.com/6513881796

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 316

Chrome Cache Entry: 317

Chrome Cache Entry: 318

Chrome Cache Entry: 319

Chrome Cache Entry: 320

Chrome Cache Entry: 321

Chrome Cache Entry: 322

Chrome Cache Entry: 323

Chrome Cache Entry: 324

Chrome Cache Entry: 325

Chrome Cache Entry: 326

Chrome Cache Entry: 327

Chrome Cache Entry: 328

Chrome Cache Entry: 329

Chrome Cache Entry: 330

Chrome Cache Entry: 331

Chrome Cache Entry: 332

Chrome Cache Entry: 333

Chrome Cache Entry: 334

Chrome Cache Entry: 335

Chrome Cache Entry: 336

Windows Analysis Report
https://booking.search-13125.com/6513881796