Edit tour

Windows Analysis Report
https://login-gemini-auth.webflow.io/

Overview

General Information

Sample URL:	https://login-gemini-auth.webflow.io/
Analysis ID:	1642790
Infos:

Detection

Score:	56
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Antivirus / Scanner detection for submitted sample

Creates files inside the system directory

Deletes files inside the Windows folder

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5116 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 1944 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2288,i,14955263884636232288,2717798674688248820,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2320 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7144 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://login-gemini-auth.webflow.io/" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Joe Sandbox Signatures

• AV Detection
• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://login-gemini-auth.webflow.io/

Avira URL Cloud: detection malicious, Label: phishing

Phishing

AI detected phishing page

Source: https://login-gemini-auth.webflow.io/

Joe Sandbox AI: Score: 9 Reasons: The brand 'Gemini' is a known cryptocurrency exchange platform., The legitimate domain for Gemini is 'gemini.com'., The URL 'login-gemini-auth.webflow.io' does not match the legitimate domain., The use of 'webflow.io' suggests a site built on a web design platform, which is not typical for a secure login page of a known brand like Gemini., The presence of 'login-gemini-auth' in the subdomain is suspicious and indicative of phishing attempts to mimic legitimate login pages., The URL structure includes hyphens and additional words, which are common tactics in phishing URLs. DOM: 0.0.pages.csv

Source: unknown	HTTPS traffic detected: 216.58.212.164:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.151.8:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.151.8:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.161.117:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.222.232.47:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.161.117:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.160.117:443 -> 192.168.2.4:49740 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.16.195
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.16.195
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.16.195
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.16.195
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.16.195
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.16.195
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.16.195
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: login-gemini-auth.webflow.ioConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/jquery-3.5.1.min.dc5e7f18c8.js?site=66da0a989f21be186b9a614e HTTP/1.1Host: d3e54v103j8qbb.cloudfront.netConnection: keep-aliveOrigin: https://login-gemini-auth.webflow.iosec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login-gemini-auth.webflow.io/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /66da0a989f21be186b9a614e/css/login-gemini-auth.webflow.d7148d6a6.css HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://login-gemini-auth.webflow.io/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /66da0a989f21be186b9a614e/66da0ca2f73a0182b200f996_66da0862104bc6499ba9eed6_66da06e8d54be283d98bad70_66d8c2bcf78e8198ec0c43c0_gemini%25252520png.png HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://login-gemini-auth.webflow.io/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /66da0a989f21be186b9a614e/js/webflow.7e939bc70.js HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://login-gemini-auth.webflow.io/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/favicon.ico HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://login-gemini-auth.webflow.io/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/favicon.ico HTTP/1.1Host: cdn.prod.website-files.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: login-gemini-auth.webflow.io
Source: global traffic	DNS traffic detected: DNS query: cdn.prod.website-files.com
Source: global traffic	DNS traffic detected: DNS query: d3e54v103j8qbb.cloudfront.net

Source: chromecache_60.4.dr	String found in binary or memory: http://underscorejs.org
Source: chromecache_58.4.dr	String found in binary or memory: https://cdn.prod.website-files.com/66da0a989f21be186b9a614e/66da0ca2f73a0182b200f996_66da0862104bc64
Source: chromecache_58.4.dr	String found in binary or memory: https://cdn.prod.website-files.com/66da0a989f21be186b9a614e/css/login-gemini-auth.webflow.d7148d6a6.
Source: chromecache_58.4.dr	String found in binary or memory: https://cdn.prod.website-files.com/66da0a989f21be186b9a614e/js/webflow.7e939bc70.js
Source: chromecache_58.4.dr	String found in binary or memory: https://cdn.prod.website-files.com/img/favicon.ico
Source: chromecache_58.4.dr	String found in binary or memory: https://cdn.prod.website-files.com/img/webclip.png
Source: chromecache_58.4.dr	String found in binary or memory: https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=66da0a989f21be186b9a614
Source: chromecache_60.4.dr	String found in binary or memory: https://github.com/bkwld/tram
Source: chromecache_58.4.dr	String found in binary or memory: https://webflow.com

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 216.58.212.164:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.151.8:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.64.151.8:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.161.117:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.222.232.47:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.161.117:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.160.117:443 -> 192.168.2.4:49740 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir5116_925397463

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir5116_925397463

Jump to behavior

Source: classification engine

Classification label: mal56.phis.win@21/13@10/6

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2288,i,14955263884636232288,2717798674688248820,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2320 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://login-gemini-auth.webflow.io/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2288,i,14955263884636232288,2717798674688248820,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2320 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://login-gemini-auth.webflow.io/	100%	Avira URL Cloud	phishing

Source	Detection	Scanner	Label	Link
https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=66da0a989f21be186b9a614e	0%	Avira URL Cloud	safe
https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=66da0a989f21be186b9a614	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
d3e54v103j8qbb.cloudfront.net	52.222.232.47	true	false	high
cdn.prod.website-files.com	104.18.161.117	true	false	high
login-gemini-auth.webflow.io	172.64.151.8	true	true	unknown
www.google.com	216.58.212.164	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdn.prod.website-files.com/66da0a989f21be186b9a614e/66da0ca2f73a0182b200f996_66da0862104bc6499ba9eed6_66da06e8d54be283d98bad70_66d8c2bcf78e8198ec0c43c0_gemini%25252520png.png	false		high
https://cdn.prod.website-files.com/img/favicon.ico	false		high
https://cdn.prod.website-files.com/66da0a989f21be186b9a614e/css/login-gemini-auth.webflow.d7148d6a6.css	false		high
https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=66da0a989f21be186b9a614e	false	Avira URL Cloud: safe	unknown
https://cdn.prod.website-files.com/66da0a989f21be186b9a614e/js/webflow.7e939bc70.js	false		high
https://login-gemini-auth.webflow.io/	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://cdn.prod.website-files.com/66da0a989f21be186b9a614e/css/login-gemini-auth.webflow.d7148d6a6.	chromecache_58.4.dr	false		high
http://underscorejs.org	chromecache_60.4.dr	false		high
https://cdn.prod.website-files.com/img/webclip.png	chromecache_58.4.dr	false		high
https://cdn.prod.website-files.com/66da0a989f21be186b9a614e/66da0ca2f73a0182b200f996_66da0862104bc64	chromecache_58.4.dr	false		high
https://github.com/bkwld/tram	chromecache_60.4.dr	false		high
https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=66da0a989f21be186b9a614	chromecache_58.4.dr	false	Avira URL Cloud: safe	unknown
https://webflow.com	chromecache_58.4.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
216.58.212.164	www.google.com	United States	15169	GOOGLEUS	false
104.18.160.117	unknown	United States	13335	CLOUDFLARENETUS	false
104.18.161.117	cdn.prod.website-files.com	United States	13335	CLOUDFLARENETUS	false
172.64.151.8	login-gemini-auth.webflow.io	United States	13335	CLOUDFLARENETUS	true
52.222.232.47	d3e54v103j8qbb.cloudfront.net	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1642790
Start date and time:	2025-03-19 11:16:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://login-gemini-auth.webflow.io/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.phis.win@21/13@10/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.238, 142.250.185.163, 142.250.110.84, 142.250.186.174, 216.58.206.78, 199.232.214.172, 172.217.18.14, 142.250.184.238, 142.250.185.110, 172.217.23.110, 142.250.184.195, 142.250.185.142, 142.250.186.142, 23.60.203.209, 20.12.23.50
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, accounts.google.com, redirector.gvt1.com, slscr.update.microsoft.com, update.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://login-gemini-auth.webflow.io/

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	downloaded
Size (bytes):	81369
Entropy (8bit):	5.291887605773591
Encrypted:	false
SSDEEP:	1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0Q/:AYh8eip3huuf6Iidl2
MD5:	37A252F53522A0993CE5A0C1A0A79DE1
SHA1:	BA57881A444FA0A98D477CE65C3B1B41845520AF
SHA-256:	EE8C8EE6BBB69AE67388DEECFC7C43DEF7380B84A41C3036890A84B6BFEC27EC
SHA-512:	A4808423220C3B964B7ECD1C60A9052BAF56CE51C8158CF5933ECEBB75C70123A69F50C6A16FFAB2DF60A333901148708DD1D67252C1610A244CF190E09448BD
Malicious:	false
Reputation:	low
URL:	https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=66da0a989f21be186b9a614e
Preview:	/! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"o

Chrome Cache Entry: 55

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	3.4582181256178264
Encrypted:	false
SSDEEP:	96:jQ2eQFXKn5O0NkoqpWyRuaoiQ5733LimpFim+xuUbw:jzFan5O0qbMy4d3bBWnuU
MD5:	1F894F487D068A2CED95D5CD4F88598C
SHA1:	743A2C39F538650D53664D19AB5079CFC9BA55D2
SHA-256:	4239819D399860EB27D8A73417F9BD108D45D11676F68B5EDAAE328EC197D55E
SHA-512:	A9BD551FA9F297083351B37DDE9CE6080D14433D26215561875C5A3E8C6EA8ABBE8F5F3204793A7EF9690A4563A2BC640E6A32CFF15F9A9BB42CD322CE1F2717
Malicious:	false
Reputation:	low
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......$..................92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92

Chrome Cache Entry: 56

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1600 x 751, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	73278
Entropy (8bit):	7.977165576283103
Encrypted:	false
SSDEEP:	1536:bhwVDXzJpgG9pcFyffEPXZ8PDeHyB2m2h2QYeSnASWNce/nv6gE1Sm5:b+lXMupc6fEPpauXhWASW2pDD
MD5:	20B610D822378F3688797E345F9DDB79
SHA1:	3D893B8D32D82BA5E3240314CFB14590286CB11B
SHA-256:	FD5BB889C17935C611959EC70679A9E4B6771775CA2602BB24A4B7FB9E8A36F8
SHA-512:	F7DD275092F7EDBB281389061591CE4C93CF03139CBE5747BDA1D2A8325822F110BD5D705ED5E623B13F15D4D26E4FA243768047107CE54D71EE93805749000A
Malicious:	false
Reputation:	low
URL:	https://cdn.prod.website-files.com/66da0a989f21be186b9a614e/66da0ca2f73a0182b200f996_66da0862104bc6499ba9eed6_66da06e8d54be283d98bad70_66d8c2bcf78e8198ec0c43c0_gemini%25252520png.png
Preview:	.PNG........IHDR...@.................gAMA......a.....sRGB.........PLTE...%......!".....................134......(+......SST:<=DEF...LMN...yz{...`ab.........hjkrst...YZ[.>!e%.&tA.J2-..I......]9.......I.p...,..O....!].."y..Y...-w.A... .IDATx...w.:....$j$*>.px.O.........-..;.......e..a..A..A..A..A..A..A..A..A..A..A..A..A..A..A..A..A..A..A..t...d.......$...K..c...^.......A..E...\0.&....R.._D..... ~..Q}.8".%.c._.s^..Y(Jr..'0w.U;.9.D..ea.........GGX.W.djS..5.0U.i7.E.!..g.a...Z...$7._.....6..l7..d_...8...y.....QW.x......../Q+.T'.4s..i..A......g.`u6H{..'...O....=-.s..b:..&..X...... .Q'v^<_...L....R.._A.1.@..HH...p{'..,1....\|..^.L..6...&.Gh._...A...D.<.y.9...1.U.sw4.8.@.=)..0.....s.Da/,.Q .>.".;x..y"......B.X.EOb...P.i....8...qk6l.....W.Eg.....v.....9 ..\|x..,Y.K.B.!..iz...Su>.5.6&....E....Q c.......-......5$.n4G.V Rr...........z.F....<......`.o..,.5..........6s..8.....[.P..#..u..w!.[p[.^'....2=.E../.T...s.L.<7."..\.....f@..N.Z #.w....F...df.}...

Chrome Cache Entry: 57

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (2587)
Category:	downloaded
Size (bytes):	36186
Entropy (8bit):	5.2278053090439744
Encrypted:	false
SSDEEP:	768:AyNf7A1RE/TEqyFVF54mkxWaIi1aUuF9Zl0F6FhF8FPqkowKji/JVx+:Aye1RELEqyP0XcPyjowKjR
MD5:	D7148D6A6DF8E313C3C1B781402C6174
SHA1:	C06E65FC85CB1A5E63CDCA4D9DB9CA0E8557AEA5
SHA-256:	5B1F365C3A8F3FB598D26E14A3410261BD3AD6DC9CC83EB8BE5C9974D5B7A575
SHA-512:	391CF7D986C713901396E5A083D3442FA391863B3A4529FF9D7EC8ABCF12C55DFC106546C43B9B87384DF54A6AF05C6DE173CC82900577797D488CDF0344EA5D
Malicious:	false
Reputation:	low
URL:	https://cdn.prod.website-files.com/66da0a989f21be186b9a614e/css/login-gemini-auth.webflow.d7148d6a6.css
Preview:	html {. -webkit-text-size-adjust: 100%;. -ms-text-size-adjust: 100%;. font-family: sans-serif;.}..body {. margin: 0;.}..article, aside, details, figcaption, figure, footer, header, hgroup, main, menu, nav, section, summary {. display: block;.}..audio, canvas, progress, video {. vertical-align: baseline;. display: inline-block;.}..audio:not([controls]) {. height: 0;. display: none;.}..[hidden], template {. display: none;.}..a {. background-color: #0000;.}..a:active, a:hover {. outline: 0;.}..abbr[title] {. border-bottom: 1px dotted;.}..b, strong {. font-weight: bold;.}..dfn {. font-style: italic;.}..h1 {. margin: .67em 0;. font-size: 2em;.}..mark {. color: #000;. background: #ff0;.}..small {. font-size: 80%;.}..sub, sup {. vertical-align: baseline;. font-size: 75%;. line-height: 0;. position: relative;.}..sup {. top: -.5em;.}..sub {. bottom: -.25em;.}..img {. border: 0;.}..svg:not(:root) {. overflow: hidden;.}..hr {. box-sizing: content-box;. height: 0;.}..

Chrome Cache Entry: 58

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (4623), with no line terminators
Category:	downloaded
Size (bytes):	4639
Entropy (8bit):	5.131538378728613
Encrypted:	false
SSDEEP:	96:0y7wUjbHLTZbMUzyMtP7ZyFDO5g8JbsrkYWESwSWsI1si:0bUvH3JXyOPYE5gefY3pSWt1si
MD5:	96EA257A28A51C3A05359C7015E07797
SHA1:	C701450252076B7DE1835377EF4ADECBCD558ABC
SHA-256:	EA0F2A60500AEF279B5CA6AE0C845ED1D4EA54BE24F23AE6273595B58FA30E1E
SHA-512:	16A389C20E56776275ADF279BC593FD8BB463FEEE318C96C10692EA5937A00791BED96F398E8356804100DFB74EBD182CBE93D734A6677A14B72647B42003A15
Malicious:	false
Reputation:	low
URL:	https://login-gemini-auth.webflow.io/
Preview:	<!DOCTYPE html> This site was created in Webflow. https://webflow.com --> Last Published: Thu Sep 05 2024 19:56:46 GMT+0000 (Coordinated Universal Time) --><html data-wf-domain="login-gemini-auth.webflow.io" data-wf-page="66da0a989f21be186b9a6161" data-wf-site="66da0a989f21be186b9a614e" data-wf-status="1"><head><meta charset="utf-8"/><title>.emini Logi.* - Sign-in</title><meta content="Gemini is a popular cryptocurrency exchange platform that helps you to buy Bitcoin, Ether, and alternative cryptocurrencies simply and securely. On this ..." name="description"/><meta content="width=device-width, initial-scale=1" name="viewport"/><meta content="Webflow" name="generator"/><link href="https://cdn.prod.website-files.com/66da0a989f21be186b9a614e/css/login-gemini-auth.webflow.d7148d6a6.css" rel="stylesheet" type="text/css"/><script type="text/javascript">!function(o,c){var n=c.documentElement,t=" w-mod-";n.className+=t+"js",("ontouchstart"in o\|\|o.DocumentTouch&&c instanceof Documen

Chrome Cache Entry: 59

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	15086
Entropy (8bit):	3.4582181256178264
Encrypted:	false
SSDEEP:	96:jQ2eQFXKn5O0NkoqpWyRuaoiQ5733LimpFim+xuUbw:jzFan5O0qbMy4d3bBWnuU
MD5:	1F894F487D068A2CED95D5CD4F88598C
SHA1:	743A2C39F538650D53664D19AB5079CFC9BA55D2
SHA-256:	4239819D399860EB27D8A73417F9BD108D45D11676F68B5EDAAE328EC197D55E
SHA-512:	A9BD551FA9F297083351B37DDE9CE6080D14433D26215561875C5A3E8C6EA8ABBE8F5F3204793A7EF9690A4563A2BC640E6A32CFF15F9A9BB42CD322CE1F2717
Malicious:	false
Reputation:	low
URL:	https://cdn.prod.website-files.com/img/favicon.ico
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......$..................92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92+.92

Chrome Cache Entry: 60

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21513)
Category:	downloaded
Size (bytes):	37349
Entropy (8bit):	5.44100455597547
Encrypted:	false
SSDEEP:	768:G5p9WeNujJ4zgTyxOv5GAUdxc4vyqLgxwEWpA8pziQfsJeG:G5p9WeNul4zC5jMXyqpM
MD5:	7E939BC705E46316013FC26650185A6E
SHA1:	31BDB7FBA1081F47B36A73226B173C55DD715F6F
SHA-256:	FCF8B8299787278F2B1362B64E8F79DED08975B41BE2841DEDCD8DEC2F5580F8
SHA-512:	D834DD21BEA8C59F2D31FFB82D6751263DE13BCD4801165D70599423CBDF25D3E8C91CBDFE7BB898A4B1702CDC73F6B5F03A97A0C71408245EDBF93DCDE2F4A9
Malicious:	false
Reputation:	low
URL:	https://cdn.prod.website-files.com/66da0a989f21be186b9a614e/js/webflow.7e939bc70.js
Preview:	./!. Webflow: Front-end site library. * @license MIT. * Inline scripts may access the api using an async handler:. * var Webflow = Webflow \|\| [];. * Webflow.push(readyFunction);. /..(()=>{var lt=(e,y)=>()=>(y\|\|e((y={exports:{}}).exports,y),y.exports);var Pt=lt(()=>{"use strict";window.tram=function(e){function y(t,n){var i=new J.Bare;return i.init(t,n)}function l(t){return t.replace(/[A-Z]/g,function(n){return"-"+n.toLowerCase()})}function T(t){var n=parseInt(t.slice(1),16),i=n>>16&255,r=n>>8&255,s=255&n;return[i,r,s]}function C(t,n,i){return"#"+(1<<24\|t<<16\|n<<8\|i).toString(16).slice(1)}function g(){}function L(t,n){B("Type warning: Expected: ["+t+"] Got: ["+typeof n+"] "+n)}function _(t,n,i){B("Units do not match ["+t+"]: "+n+", "+i)}function I(t,n,i){if(n!==void 0&&(i=n),t===void 0)return i;var r=i;return we.test(t)\|\|!Xt.test(t)?r=parseInt(t,10):Xt.test(t)&&(r=1e3parseFloat(t)),0>r&&(r=0),r===r?r:i}function B(t){et.debug&&window&&window.console.warn(t)}function U(t){for(var

Total Packets: 187
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2025 11:17:37.303999901 CET	49680	443	192.168.2.4	204.79.197.222
Mar 19, 2025 11:17:37.429058075 CET	49671	443	192.168.2.4	204.79.197.203
Mar 19, 2025 11:17:38.633563042 CET	49671	443	192.168.2.4	204.79.197.203
Mar 19, 2025 11:17:41.038284063 CET	49671	443	192.168.2.4	204.79.197.203
Mar 19, 2025 11:17:45.623019934 CET	49678	443	192.168.2.4	20.189.173.27
Mar 19, 2025 11:17:45.928821087 CET	49678	443	192.168.2.4	20.189.173.27
Mar 19, 2025 11:17:45.928883076 CET	49671	443	192.168.2.4	204.79.197.203
Mar 19, 2025 11:17:46.709611893 CET	49678	443	192.168.2.4	20.189.173.27
Mar 19, 2025 11:17:46.912833929 CET	49680	443	192.168.2.4	204.79.197.222
Mar 19, 2025 11:17:47.913116932 CET	49678	443	192.168.2.4	20.189.173.27
Mar 19, 2025 11:17:50.319407940 CET	49678	443	192.168.2.4	20.189.173.27
Mar 19, 2025 11:17:50.454806089 CET	49727	443	192.168.2.4	216.58.212.164
Mar 19, 2025 11:17:50.454863071 CET	443	49727	216.58.212.164	192.168.2.4
Mar 19, 2025 11:17:50.454929113 CET	49727	443	192.168.2.4	216.58.212.164
Mar 19, 2025 11:17:50.455090046 CET	49727	443	192.168.2.4	216.58.212.164
Mar 19, 2025 11:17:50.455100060 CET	443	49727	216.58.212.164	192.168.2.4
Mar 19, 2025 11:17:50.490164042 CET	443	49727	216.58.212.164	192.168.2.4
Mar 19, 2025 11:17:50.490251064 CET	49727	443	192.168.2.4	216.58.212.164
Mar 19, 2025 11:17:50.496460915 CET	49727	443	192.168.2.4	216.58.212.164
Mar 19, 2025 11:17:50.496731043 CET	443	49727	216.58.212.164	192.168.2.4
Mar 19, 2025 11:17:50.538048029 CET	49727	443	192.168.2.4	216.58.212.164
Mar 19, 2025 11:17:51.964416027 CET	49728	443	192.168.2.4	172.64.151.8
Mar 19, 2025 11:17:51.964457035 CET	443	49728	172.64.151.8	192.168.2.4
Mar 19, 2025 11:17:51.964685917 CET	49729	443	192.168.2.4	172.64.151.8
Mar 19, 2025 11:17:51.964731932 CET	443	49729	172.64.151.8	192.168.2.4
Mar 19, 2025 11:17:51.964791059 CET	49729	443	192.168.2.4	172.64.151.8
Mar 19, 2025 11:17:51.965018988 CET	49728	443	192.168.2.4	172.64.151.8
Mar 19, 2025 11:17:51.965181112 CET	49729	443	192.168.2.4	172.64.151.8
Mar 19, 2025 11:17:51.965198040 CET	443	49729	172.64.151.8	192.168.2.4
Mar 19, 2025 11:17:51.965291977 CET	49728	443	192.168.2.4	172.64.151.8
Mar 19, 2025 11:17:51.965305090 CET	443	49728	172.64.151.8	192.168.2.4
Mar 19, 2025 11:17:51.996428013 CET	443	49728	172.64.151.8	192.168.2.4
Mar 19, 2025 11:17:51.996494055 CET	49728	443	192.168.2.4	172.64.151.8
Mar 19, 2025 11:17:51.997716904 CET	49728	443	192.168.2.4	172.64.151.8
Mar 19, 2025 11:17:51.997998953 CET	443	49728	172.64.151.8	192.168.2.4
Mar 19, 2025 11:17:51.998425961 CET	49728	443	192.168.2.4	172.64.151.8
Mar 19, 2025 11:17:52.003421068 CET	443	49729	172.64.151.8	192.168.2.4
Mar 19, 2025 11:17:52.003483057 CET	49729	443	192.168.2.4	172.64.151.8
Mar 19, 2025 11:17:52.004513025 CET	49729	443	192.168.2.4	172.64.151.8
Mar 19, 2025 11:17:52.004801989 CET	443	49729	172.64.151.8	192.168.2.4
Mar 19, 2025 11:17:52.040326118 CET	443	49728	172.64.151.8	192.168.2.4
Mar 19, 2025 11:17:52.057579041 CET	49729	443	192.168.2.4	172.64.151.8
Mar 19, 2025 11:17:52.079096079 CET	443	49728	172.64.151.8	192.168.2.4
Mar 19, 2025 11:17:52.079138041 CET	443	49728	172.64.151.8	192.168.2.4
Mar 19, 2025 11:17:52.079191923 CET	49728	443	192.168.2.4	172.64.151.8
Mar 19, 2025 11:17:52.079231977 CET	443	49728	172.64.151.8	192.168.2.4
Mar 19, 2025 11:17:52.079283953 CET	49728	443	192.168.2.4	172.64.151.8
Mar 19, 2025 11:17:52.079288960 CET	443	49728	172.64.151.8	192.168.2.4
Mar 19, 2025 11:17:52.079303980 CET	443	49728	172.64.151.8	192.168.2.4
Mar 19, 2025 11:17:52.079329967 CET	49728	443	192.168.2.4	172.64.151.8
Mar 19, 2025 11:17:52.079366922 CET	49728	443	192.168.2.4	172.64.151.8
Mar 19, 2025 11:17:52.081496954 CET	49728	443	192.168.2.4	172.64.151.8
Mar 19, 2025 11:17:52.081517935 CET	443	49728	172.64.151.8	192.168.2.4
Mar 19, 2025 11:17:52.152081013 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.152107000 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.152209997 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.152398109 CET	49731	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.152441025 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.152519941 CET	49731	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.152693987 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.152708054 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.152976990 CET	49732	443	192.168.2.4	52.222.232.47
Mar 19, 2025 11:17:52.153017998 CET	443	49732	52.222.232.47	192.168.2.4
Mar 19, 2025 11:17:52.153084040 CET	49732	443	192.168.2.4	52.222.232.47
Mar 19, 2025 11:17:52.153124094 CET	49731	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.153136015 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.153198957 CET	49732	443	192.168.2.4	52.222.232.47
Mar 19, 2025 11:17:52.153217077 CET	443	49732	52.222.232.47	192.168.2.4
Mar 19, 2025 11:17:52.184022903 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.184092045 CET	49731	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.184593916 CET	443	49732	52.222.232.47	192.168.2.4
Mar 19, 2025 11:17:52.184654951 CET	49732	443	192.168.2.4	52.222.232.47
Mar 19, 2025 11:17:52.185408115 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.185475111 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.186512947 CET	49732	443	192.168.2.4	52.222.232.47
Mar 19, 2025 11:17:52.186801910 CET	443	49732	52.222.232.47	192.168.2.4
Mar 19, 2025 11:17:52.187805891 CET	49731	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.188076973 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.188855886 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.189120054 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.189409018 CET	49732	443	192.168.2.4	52.222.232.47
Mar 19, 2025 11:17:52.189652920 CET	49731	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.189769983 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.199290037 CET	443	49732	52.222.232.47	192.168.2.4
Mar 19, 2025 11:17:52.199311018 CET	443	49732	52.222.232.47	192.168.2.4
Mar 19, 2025 11:17:52.199326038 CET	443	49732	52.222.232.47	192.168.2.4
Mar 19, 2025 11:17:52.199358940 CET	49732	443	192.168.2.4	52.222.232.47
Mar 19, 2025 11:17:52.199378967 CET	443	49732	52.222.232.47	192.168.2.4
Mar 19, 2025 11:17:52.199395895 CET	49732	443	192.168.2.4	52.222.232.47
Mar 19, 2025 11:17:52.199419022 CET	49732	443	192.168.2.4	52.222.232.47
Mar 19, 2025 11:17:52.203394890 CET	443	49732	52.222.232.47	192.168.2.4
Mar 19, 2025 11:17:52.203417063 CET	443	49732	52.222.232.47	192.168.2.4
Mar 19, 2025 11:17:52.203495026 CET	49732	443	192.168.2.4	52.222.232.47
Mar 19, 2025 11:17:52.203516006 CET	443	49732	52.222.232.47	192.168.2.4
Mar 19, 2025 11:17:52.203564882 CET	49732	443	192.168.2.4	52.222.232.47
Mar 19, 2025 11:17:52.206171036 CET	443	49732	52.222.232.47	192.168.2.4
Mar 19, 2025 11:17:52.206188917 CET	443	49732	52.222.232.47	192.168.2.4
Mar 19, 2025 11:17:52.206238031 CET	49732	443	192.168.2.4	52.222.232.47
Mar 19, 2025 11:17:52.206247091 CET	443	49732	52.222.232.47	192.168.2.4
Mar 19, 2025 11:17:52.206284046 CET	49732	443	192.168.2.4	52.222.232.47
Mar 19, 2025 11:17:52.208093882 CET	443	49732	52.222.232.47	192.168.2.4
Mar 19, 2025 11:17:52.208117008 CET	443	49732	52.222.232.47	192.168.2.4
Mar 19, 2025 11:17:52.208161116 CET	49732	443	192.168.2.4	52.222.232.47
Mar 19, 2025 11:17:52.208172083 CET	443	49732	52.222.232.47	192.168.2.4
Mar 19, 2025 11:17:52.208200932 CET	49732	443	192.168.2.4	52.222.232.47
Mar 19, 2025 11:17:52.208218098 CET	49732	443	192.168.2.4	52.222.232.47
Mar 19, 2025 11:17:52.209460974 CET	443	49732	52.222.232.47	192.168.2.4
Mar 19, 2025 11:17:52.209486008 CET	443	49732	52.222.232.47	192.168.2.4
Mar 19, 2025 11:17:52.209542990 CET	49732	443	192.168.2.4	52.222.232.47
Mar 19, 2025 11:17:52.209552050 CET	443	49732	52.222.232.47	192.168.2.4
Mar 19, 2025 11:17:52.209568977 CET	443	49732	52.222.232.47	192.168.2.4
Mar 19, 2025 11:17:52.209609032 CET	49732	443	192.168.2.4	52.222.232.47
Mar 19, 2025 11:17:52.210033894 CET	49732	443	192.168.2.4	52.222.232.47
Mar 19, 2025 11:17:52.210047960 CET	443	49732	52.222.232.47	192.168.2.4
Mar 19, 2025 11:17:52.220340967 CET	49733	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.220402956 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.220633984 CET	49733	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.221127033 CET	49733	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.221143961 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.232316971 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.232332945 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.245529890 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.245779991 CET	49733	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.245914936 CET	49733	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.245927095 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.250277042 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.250348091 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.250386000 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.250422955 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.250432968 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.250463009 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.250477076 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.250507116 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.250545025 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.250581980 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.250585079 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.250595093 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.250648022 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.250958920 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.251008987 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.251046896 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.251058102 CET	49731	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.251080036 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.251118898 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.251126051 CET	49731	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.251132011 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.251173019 CET	49731	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.251333952 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.251470089 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.251485109 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.251518965 CET	49731	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.251524925 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.251552105 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.251559019 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.254764080 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.254798889 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.254831076 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.254851103 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.254862070 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.254882097 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.255311012 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.255351067 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.255384922 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.255400896 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.255408049 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.255429029 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.255435944 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.255459070 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.255480051 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.255485058 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.255489111 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.255522013 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.255542994 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.255544901 CET	49731	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.255556107 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.255590916 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.255615950 CET	49731	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.255640030 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.255731106 CET	49731	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.255738020 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.256026983 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.256055117 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.256062984 CET	49731	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.256078959 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.256105900 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.256124020 CET	49731	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.256130934 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.256166935 CET	49731	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.256233931 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.256339073 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.256373882 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.256381035 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.256387949 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.256817102 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.256822109 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.257026911 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.257076979 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.257105112 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.257132053 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.257155895 CET	49731	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.257160902 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.257164001 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.257174969 CET	49731	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.257188082 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.257205963 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.257214069 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.257246017 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.257253885 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.257261038 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.257358074 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.257894039 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.257915974 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.257972956 CET	49731	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.257980108 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.258024931 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.258028984 CET	49731	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.258065939 CET	49731	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.258299112 CET	49731	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.258311987 CET	443	49731	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.259398937 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.259650946 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.259685993 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.259704113 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.259711027 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.259752035 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.259759903 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.259798050 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.259874105 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.259880066 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.260436058 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.260473967 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.260493994 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.260500908 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.260512114 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.260545969 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.260554075 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.260572910 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.261383057 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.261420965 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.261435986 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.261445045 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.261456966 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.261459112 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.261509895 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.261517048 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.261564016 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.262448072 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.262506008 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.262511969 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.262523890 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.262573004 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.262665033 CET	49730	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.262682915 CET	443	49730	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.316361904 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.316417933 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.316451073 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.316473961 CET	49733	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.316483021 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.316503048 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.316540003 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.316545010 CET	49733	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.316551924 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.316576958 CET	49733	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.316595078 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.316626072 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.316644907 CET	49733	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.316649914 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.316696882 CET	49733	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.317650080 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.321108103 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.321142912 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.321182966 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.321197987 CET	49733	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.321213007 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.321223021 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.321244955 CET	49733	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.321274996 CET	49733	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.321494102 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.321549892 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.321578979 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.321595907 CET	49733	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.321611881 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.321640968 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.321669102 CET	49733	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.321676016 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.321795940 CET	49733	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.322411060 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.322462082 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.322489977 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.322515011 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.322530985 CET	49733	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.322556019 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.322571039 CET	49733	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.323334932 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.323390007 CET	49733	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.323399067 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.323424101 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.323468924 CET	49733	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.330730915 CET	49733	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.330768108 CET	443	49733	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.386392117 CET	49739	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.386454105 CET	443	49739	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.386631966 CET	49739	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.386800051 CET	49739	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.386810064 CET	443	49739	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.414833069 CET	443	49739	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.415057898 CET	49739	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.415178061 CET	49739	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.415193081 CET	443	49739	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.485733032 CET	443	49739	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.485774994 CET	443	49739	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.485805988 CET	443	49739	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.485831976 CET	443	49739	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.485862017 CET	443	49739	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.485862017 CET	49739	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.485889912 CET	443	49739	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.485908985 CET	49739	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.485929966 CET	443	49739	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.485933065 CET	49739	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.485941887 CET	443	49739	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.485977888 CET	49739	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.485986948 CET	443	49739	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.487315893 CET	443	49739	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.487365007 CET	49739	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.487375021 CET	443	49739	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.491801023 CET	443	49739	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.491856098 CET	49739	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.491866112 CET	443	49739	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.491883993 CET	443	49739	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.491939068 CET	49739	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.493004084 CET	49739	443	192.168.2.4	104.18.161.117
Mar 19, 2025 11:17:52.493022919 CET	443	49739	104.18.161.117	192.168.2.4
Mar 19, 2025 11:17:52.509248018 CET	49740	443	192.168.2.4	104.18.160.117
Mar 19, 2025 11:17:52.509294987 CET	443	49740	104.18.160.117	192.168.2.4
Mar 19, 2025 11:17:52.509350061 CET	49740	443	192.168.2.4	104.18.160.117
Mar 19, 2025 11:17:52.509738922 CET	49740	443	192.168.2.4	104.18.160.117
Mar 19, 2025 11:17:52.509749889 CET	443	49740	104.18.160.117	192.168.2.4
Mar 19, 2025 11:17:52.538528919 CET	443	49740	104.18.160.117	192.168.2.4
Mar 19, 2025 11:17:52.538595915 CET	49740	443	192.168.2.4	104.18.160.117
Mar 19, 2025 11:17:52.540551901 CET	49740	443	192.168.2.4	104.18.160.117
Mar 19, 2025 11:17:52.540779114 CET	443	49740	104.18.160.117	192.168.2.4
Mar 19, 2025 11:17:52.541090965 CET	49740	443	192.168.2.4	104.18.160.117
Mar 19, 2025 11:17:52.584323883 CET	443	49740	104.18.160.117	192.168.2.4
Mar 19, 2025 11:17:52.605428934 CET	443	49740	104.18.160.117	192.168.2.4
Mar 19, 2025 11:17:52.605479956 CET	443	49740	104.18.160.117	192.168.2.4
Mar 19, 2025 11:17:52.605525017 CET	49740	443	192.168.2.4	104.18.160.117
Mar 19, 2025 11:17:52.605537891 CET	443	49740	104.18.160.117	192.168.2.4
Mar 19, 2025 11:17:52.605540991 CET	443	49740	104.18.160.117	192.168.2.4
Mar 19, 2025 11:17:52.605587006 CET	49740	443	192.168.2.4	104.18.160.117
Mar 19, 2025 11:17:52.605597019 CET	443	49740	104.18.160.117	192.168.2.4
Mar 19, 2025 11:17:52.605638981 CET	443	49740	104.18.160.117	192.168.2.4
Mar 19, 2025 11:17:52.605680943 CET	443	49740	104.18.160.117	192.168.2.4
Mar 19, 2025 11:17:52.605731964 CET	49740	443	192.168.2.4	104.18.160.117
Mar 19, 2025 11:17:52.605739117 CET	443	49740	104.18.160.117	192.168.2.4
Mar 19, 2025 11:17:52.606025934 CET	443	49740	104.18.160.117	192.168.2.4
Mar 19, 2025 11:17:52.606056929 CET	49740	443	192.168.2.4	104.18.160.117
Mar 19, 2025 11:17:52.606062889 CET	443	49740	104.18.160.117	192.168.2.4
Mar 19, 2025 11:17:52.606111050 CET	49740	443	192.168.2.4	104.18.160.117
Mar 19, 2025 11:17:52.606772900 CET	443	49740	104.18.160.117	192.168.2.4
Mar 19, 2025 11:17:52.610151052 CET	443	49740	104.18.160.117	192.168.2.4
Mar 19, 2025 11:17:52.610204935 CET	443	49740	104.18.160.117	192.168.2.4
Mar 19, 2025 11:17:52.610264063 CET	49740	443	192.168.2.4	104.18.160.117
Mar 19, 2025 11:17:52.616610050 CET	49740	443	192.168.2.4	104.18.160.117
Mar 19, 2025 11:17:52.616640091 CET	443	49740	104.18.160.117	192.168.2.4
Mar 19, 2025 11:17:55.131866932 CET	49678	443	192.168.2.4	20.189.173.27
Mar 19, 2025 11:17:55.546143055 CET	49671	443	192.168.2.4	204.79.197.203
Mar 19, 2025 11:17:59.702995062 CET	49743	80	192.168.2.4	172.217.16.195
Mar 19, 2025 11:17:59.707683086 CET	80	49743	172.217.16.195	192.168.2.4
Mar 19, 2025 11:17:59.707766056 CET	49743	80	192.168.2.4	172.217.16.195
Mar 19, 2025 11:17:59.707878113 CET	49743	80	192.168.2.4	172.217.16.195
Mar 19, 2025 11:17:59.712490082 CET	80	49743	172.217.16.195	192.168.2.4
Mar 19, 2025 11:17:59.722645044 CET	80	49743	172.217.16.195	192.168.2.4
Mar 19, 2025 11:17:59.728163958 CET	49743	80	192.168.2.4	172.217.16.195
Mar 19, 2025 11:17:59.736243010 CET	80	49743	172.217.16.195	192.168.2.4
Mar 19, 2025 11:17:59.779162884 CET	49743	80	192.168.2.4	172.217.16.195
Mar 19, 2025 11:18:00.505383015 CET	443	49727	216.58.212.164	192.168.2.4
Mar 19, 2025 11:18:00.505450964 CET	443	49727	216.58.212.164	192.168.2.4
Mar 19, 2025 11:18:00.505556107 CET	49727	443	192.168.2.4	216.58.212.164
Mar 19, 2025 11:18:00.569236994 CET	49727	443	192.168.2.4	216.58.212.164
Mar 19, 2025 11:18:00.569269896 CET	443	49727	216.58.212.164	192.168.2.4
Mar 19, 2025 11:18:04.757097006 CET	49678	443	192.168.2.4	20.189.173.27
Mar 19, 2025 11:18:06.986206055 CET	443	49729	172.64.151.8	192.168.2.4
Mar 19, 2025 11:18:06.986283064 CET	443	49729	172.64.151.8	192.168.2.4
Mar 19, 2025 11:18:06.986350060 CET	49729	443	192.168.2.4	172.64.151.8
Mar 19, 2025 11:18:08.562812090 CET	49729	443	192.168.2.4	172.64.151.8
Mar 19, 2025 11:18:08.562851906 CET	443	49729	172.64.151.8	192.168.2.4
Mar 19, 2025 11:18:50.510189056 CET	49751	443	192.168.2.4	216.58.212.164
Mar 19, 2025 11:18:50.510236025 CET	443	49751	216.58.212.164	192.168.2.4
Mar 19, 2025 11:18:50.510292053 CET	49751	443	192.168.2.4	216.58.212.164
Mar 19, 2025 11:18:50.510725975 CET	49751	443	192.168.2.4	216.58.212.164
Mar 19, 2025 11:18:50.510735989 CET	443	49751	216.58.212.164	192.168.2.4
Mar 19, 2025 11:18:50.540723085 CET	443	49751	216.58.212.164	192.168.2.4
Mar 19, 2025 11:18:50.541126013 CET	49751	443	192.168.2.4	216.58.212.164
Mar 19, 2025 11:18:50.588315010 CET	443	49751	216.58.212.164	192.168.2.4
Mar 19, 2025 11:19:00.559710979 CET	443	49751	216.58.212.164	192.168.2.4
Mar 19, 2025 11:19:00.559798956 CET	443	49751	216.58.212.164	192.168.2.4
Mar 19, 2025 11:19:00.562350035 CET	49751	443	192.168.2.4	216.58.212.164
Mar 19, 2025 11:19:00.574414015 CET	49751	443	192.168.2.4	216.58.212.164
Mar 19, 2025 11:19:00.574435949 CET	443	49751	216.58.212.164	192.168.2.4
Mar 19, 2025 11:19:00.835618019 CET	49743	80	192.168.2.4	172.217.16.195
Mar 19, 2025 11:19:00.840502024 CET	80	49743	172.217.16.195	192.168.2.4
Mar 19, 2025 11:19:00.840558052 CET	49743	80	192.168.2.4	172.217.16.195

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2025 11:17:46.538469076 CET	53	59735	1.1.1.1	192.168.2.4
Mar 19, 2025 11:17:46.543066025 CET	53	65197	1.1.1.1	192.168.2.4
Mar 19, 2025 11:17:46.748524904 CET	53	52876	1.1.1.1	192.168.2.4
Mar 19, 2025 11:17:50.445517063 CET	52708	53	192.168.2.4	1.1.1.1
Mar 19, 2025 11:17:50.445832014 CET	56213	53	192.168.2.4	1.1.1.1
Mar 19, 2025 11:17:50.452383041 CET	53	52708	1.1.1.1	192.168.2.4
Mar 19, 2025 11:17:50.453859091 CET	53	56213	1.1.1.1	192.168.2.4
Mar 19, 2025 11:17:51.947433949 CET	53042	53	192.168.2.4	1.1.1.1
Mar 19, 2025 11:17:51.948276043 CET	60657	53	192.168.2.4	1.1.1.1
Mar 19, 2025 11:17:51.958513021 CET	53	53042	1.1.1.1	192.168.2.4
Mar 19, 2025 11:17:51.960803986 CET	53	60657	1.1.1.1	192.168.2.4
Mar 19, 2025 11:17:52.142784119 CET	59664	53	192.168.2.4	1.1.1.1
Mar 19, 2025 11:17:52.143517017 CET	55316	53	192.168.2.4	1.1.1.1
Mar 19, 2025 11:17:52.144620895 CET	58904	53	192.168.2.4	1.1.1.1
Mar 19, 2025 11:17:52.144881964 CET	61414	53	192.168.2.4	1.1.1.1
Mar 19, 2025 11:17:52.151132107 CET	53	59664	1.1.1.1	192.168.2.4
Mar 19, 2025 11:17:52.151452065 CET	53	61414	1.1.1.1	192.168.2.4
Mar 19, 2025 11:17:52.151546001 CET	53	55316	1.1.1.1	192.168.2.4
Mar 19, 2025 11:17:52.152041912 CET	53	58904	1.1.1.1	192.168.2.4
Mar 19, 2025 11:17:52.498728037 CET	54191	53	192.168.2.4	1.1.1.1
Mar 19, 2025 11:17:52.499435902 CET	49959	53	192.168.2.4	1.1.1.1
Mar 19, 2025 11:17:52.507415056 CET	53	49959	1.1.1.1	192.168.2.4
Mar 19, 2025 11:17:52.508393049 CET	53	54191	1.1.1.1	192.168.2.4
Mar 19, 2025 11:18:03.742537022 CET	53	56042	1.1.1.1	192.168.2.4
Mar 19, 2025 11:18:22.682120085 CET	53	60114	1.1.1.1	192.168.2.4
Mar 19, 2025 11:18:45.562427998 CET	53	54577	1.1.1.1	192.168.2.4
Mar 19, 2025 11:18:46.018435955 CET	53	57195	1.1.1.1	192.168.2.4
Mar 19, 2025 11:18:46.356796980 CET	138	138	192.168.2.4	192.168.2.255
Mar 19, 2025 11:18:48.391525984 CET	53	49910	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 19, 2025 11:17:50.445517063 CET	192.168.2.4	1.1.1.1	0x6bf	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 19, 2025 11:17:50.445832014 CET	192.168.2.4	1.1.1.1	0x2c45	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 19, 2025 11:17:51.947433949 CET	192.168.2.4	1.1.1.1	0xc108	Standard query (0)	login-gemini-auth.webflow.io	A (IP address)	IN (0x0001)	false
Mar 19, 2025 11:17:51.948276043 CET	192.168.2.4	1.1.1.1	0x39c5	Standard query (0)	login-gemini-auth.webflow.io	65	IN (0x0001)	false
Mar 19, 2025 11:17:52.142784119 CET	192.168.2.4	1.1.1.1	0x4ea9	Standard query (0)	cdn.prod.website-files.com	A (IP address)	IN (0x0001)	false
Mar 19, 2025 11:17:52.143517017 CET	192.168.2.4	1.1.1.1	0x9ba6	Standard query (0)	cdn.prod.website-files.com	65	IN (0x0001)	false
Mar 19, 2025 11:17:52.144620895 CET	192.168.2.4	1.1.1.1	0xd803	Standard query (0)	d3e54v103j8qbb.cloudfront.net	A (IP address)	IN (0x0001)	false
Mar 19, 2025 11:17:52.144881964 CET	192.168.2.4	1.1.1.1	0x2c4c	Standard query (0)	d3e54v103j8qbb.cloudfront.net	65	IN (0x0001)	false
Mar 19, 2025 11:17:52.498728037 CET	192.168.2.4	1.1.1.1	0xd286	Standard query (0)	cdn.prod.website-files.com	A (IP address)	IN (0x0001)	false
Mar 19, 2025 11:17:52.499435902 CET	192.168.2.4	1.1.1.1	0x3ecd	Standard query (0)	cdn.prod.website-files.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 19, 2025 11:17:50.452383041 CET	1.1.1.1	192.168.2.4	0x6bf	No error (0)	www.google.com	216.58.212.164	A (IP address)	IN (0x0001)	false
Mar 19, 2025 11:17:50.453859091 CET	1.1.1.1	192.168.2.4	0x2c45	No error (0)	www.google.com		65	IN (0x0001)	false
Mar 19, 2025 11:17:51.958513021 CET	1.1.1.1	192.168.2.4	0xc108	No error (0)	login-gemini-auth.webflow.io	172.64.151.8	A (IP address)	IN (0x0001)	false
Mar 19, 2025 11:17:51.958513021 CET	1.1.1.1	192.168.2.4	0xc108	No error (0)	login-gemini-auth.webflow.io	104.18.36.248	A (IP address)	IN (0x0001)	false
Mar 19, 2025 11:17:51.960803986 CET	1.1.1.1	192.168.2.4	0x39c5	No error (0)	login-gemini-auth.webflow.io		65	IN (0x0001)	false
Mar 19, 2025 11:17:52.151132107 CET	1.1.1.1	192.168.2.4	0x4ea9	No error (0)	cdn.prod.website-files.com	104.18.161.117	A (IP address)	IN (0x0001)	false
Mar 19, 2025 11:17:52.151132107 CET	1.1.1.1	192.168.2.4	0x4ea9	No error (0)	cdn.prod.website-files.com	104.18.160.117	A (IP address)	IN (0x0001)	false
Mar 19, 2025 11:17:52.151546001 CET	1.1.1.1	192.168.2.4	0x9ba6	No error (0)	cdn.prod.website-files.com		65	IN (0x0001)	false
Mar 19, 2025 11:17:52.152041912 CET	1.1.1.1	192.168.2.4	0xd803	No error (0)	d3e54v103j8qbb.cloudfront.net	52.222.232.47	A (IP address)	IN (0x0001)	false
Mar 19, 2025 11:17:52.152041912 CET	1.1.1.1	192.168.2.4	0xd803	No error (0)	d3e54v103j8qbb.cloudfront.net	52.222.232.144	A (IP address)	IN (0x0001)	false
Mar 19, 2025 11:17:52.152041912 CET	1.1.1.1	192.168.2.4	0xd803	No error (0)	d3e54v103j8qbb.cloudfront.net	52.222.232.39	A (IP address)	IN (0x0001)	false
Mar 19, 2025 11:17:52.152041912 CET	1.1.1.1	192.168.2.4	0xd803	No error (0)	d3e54v103j8qbb.cloudfront.net	52.222.232.99	A (IP address)	IN (0x0001)	false
Mar 19, 2025 11:17:52.507415056 CET	1.1.1.1	192.168.2.4	0x3ecd	No error (0)	cdn.prod.website-files.com		65	IN (0x0001)	false
Mar 19, 2025 11:17:52.508393049 CET	1.1.1.1	192.168.2.4	0xd286	No error (0)	cdn.prod.website-files.com	104.18.160.117	A (IP address)	IN (0x0001)	false
Mar 19, 2025 11:17:52.508393049 CET	1.1.1.1	192.168.2.4	0xd286	No error (0)	cdn.prod.website-files.com	104.18.161.117	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

d3e54v103j8qbb.cloudfront.net

cdn.prod.website-files.com

c.pki.goog

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.4	49743	172.217.16.195	80

Timestamp	Bytes transferred	Direction	Data
Mar 19, 2025 11:17:59.707878113 CET	202	OUT	GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 19, 2025 11:17:59.722645044 CET	222	IN	HTTP/1.1 304 Not Modified Date: Wed, 19 Mar 2025 10:05:49 GMT Expires: Wed, 19 Mar 2025 10:55:49 GMT Age: 730 Last-Modified: Tue, 07 Jan 2025 07:28:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding
Mar 19, 2025 11:17:59.728163958 CET	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 19, 2025 11:17:59.736243010 CET	223	IN	HTTP/1.1 304 Not Modified Date: Wed, 19 Mar 2025 09:40:11 GMT Expires: Wed, 19 Mar 2025 10:30:11 GMT Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding Age: 2268

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49728	172.64.151.8	443	1944	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 10:17:51 UTC	678	OUT	GET / HTTP/1.1 Host: login-gemini-auth.webflow.io Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 10:17:52 UTC	813	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 10:17:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Ray: 922c38f44cfbd389-FRA CF-Cache-Status: HIT Age: 139907 Last-Modified: Tue, 11 Mar 2025 15:34:08 GMT content-security-policy: frame-ancestors 'self' https://.webflow.com http://.webflow.com http://*.webflow.io http://webflow.com https://webflow.com surrogate-control: max-age=2147483647 surrogate-key: login-gemini-auth.webflow.io 66da0a989f21be186b9a614e pageId:66da0a989f21be186b9a6161 x-lambda-id: 9550827a-e4ca-46b5-bf39-d00beb4529c4 vary: Accept-Encoding Set-Cookie: _cfuvid=tYRfP3aI9OuTbGVPuqk_ZbZBaaCeZ3dCPQqdIHiT9uM-1742379472076-0.0.1.1-604800000; path=/; domain=.webflow.io; HttpOnly; Secure; SameSite=None Server: cloudflare alt-svc: h3=":443"; ma=86400
2025-03-19 10:17:52 UTC	556	IN	Data Raw: 31 32 31 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 77 61 73 20 63 72 65 61 74 65 64 20 69 6e 20 57 65 62 66 6c 6f 77 2e 20 68 74 74 70 73 3a 2f 2f 77 65 62 66 6c 6f 77 2e 63 6f 6d 20 2d 2d 3e 3c 21 2d 2d 20 4c 61 73 74 20 50 75 62 6c 69 73 68 65 64 3a 20 54 68 75 20 53 65 70 20 30 35 20 32 30 32 34 20 31 39 3a 35 36 3a 34 36 20 47 4d 54 2b 30 30 30 30 20 28 43 6f 6f 72 64 69 6e 61 74 65 64 20 55 6e 69 76 65 72 73 61 6c 20 54 69 6d 65 29 20 2d 2d 3e 3c 68 74 6d 6c 20 64 61 74 61 2d 77 66 2d 64 6f 6d 61 69 6e 3d 22 6c 6f 67 69 6e 2d 67 65 6d 69 6e 69 2d 61 75 74 68 2e 77 65 62 66 6c 6f 77 2e 69 6f 22 20 64 61 74 61 2d 77 66 2d 70 61 67 65 3d 22 36 36 64 61 30 61 39 38 39 66 32 31 62 65 31 38 36 62 39 Data Ascii: 121f<!DOCTYPE html>... This site was created in Webflow. https://webflow.com -->... Last Published: Thu Sep 05 2024 19:56:46 GMT+0000 (Coordinated Universal Time) --><html data-wf-domain="login-gemini-auth.webflow.io" data-wf-page="66da0a989f21be186b9
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 69 73 20 2e 2e 2e 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 2f 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 2f 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 57 65 62 66 6c 6f 77 22 20 6e 61 6d 65 3d 22 67 65 6e 65 72 61 74 6f 72 22 2f 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 70 72 6f 64 2e 77 65 62 73 69 74 65 2d 66 69 6c 65 73 2e 63 6f 6d 2f 36 36 64 61 30 61 39 38 39 66 32 31 62 65 31 38 36 62 39 61 36 31 34 65 2f 63 73 73 2f 6c 6f 67 69 6e 2d 67 65 6d 69 6e 69 2d 61 75 74 68 2e 77 65 62 66 6c 6f 77 2e 64 37 31 34 38 64 36 61 36 2e 63 73 73 22 Data Ascii: is ..." name="description"/><meta content="width=device-width, initial-scale=1" name="viewport"/><meta content="Webflow" name="generator"/><link href="https://cdn.prod.website-files.com/66da0a989f21be186b9a614e/css/login-gemini-auth.webflow.d7148d6a6.css"
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 6e 63 69 65 73 20 73 69 6d 70 6c 79 20 61 6e 64 20 73 65 63 75 72 65 6c 79 2e 20 4f 6e 20 74 68 69 73 20 70 6c 61 74 66 6f 72 6d 2c 20 74 68 65 72 65 20 61 72 65 20 6d 61 6e 79 20 63 72 79 70 74 6f 63 75 72 72 65 6e 63 69 65 73 20 6f 6e 20 74 68 65 20 6d 61 72 6b 65 74 20 6c 69 6b 65 20 42 69 74 63 6f 69 6e 2c 20 45 74 68 65 72 2c 20 43 61 72 64 61 6e 6f 2c 20 44 6f 67 65 63 6f 69 6e 2c 20 58 52 50 2c 20 50 6f 6c 6b 61 64 6f 74 2c 20 61 6e 64 20 74 68 65 6e 20 6f 6e 2e 20 79 6f 75 26 23 78 32 37 3b 6c 6c 20 62 75 79 20 61 20 42 69 74 63 6f 69 6e 20 69 66 20 79 6f 75 26 23 78 32 37 3b 76 65 20 67 6f 74 20 72 65 67 69 73 74 65 72 65 64 20 66 6f 72 20 61 20 47 65 6d 69 6e 69 20 6c 6f 67 69 6e 20 61 63 63 6f 75 6e 74 20 61 6e 64 20 73 75 66 66 69 63 69 65 6e Data Ascii: ncies simply and securely. On this platform, there are many cryptocurrencies on the market like Bitcoin, Ether, Cardano, Dogecoin, XRP, Polkadot, and then on. you'll buy a Bitcoin if you've got registered for a Gemini login account and sufficien
2025-03-19 10:17:52 UTC	1353	IN	Data Raw: 6e 20 64 65 74 61 69 6c 73 20 66 6f 72 20 79 6f 75 72 20 47 65 6d 69 6e 69 20 61 63 63 6f 75 6e 74 3c 62 72 2f 3e 43 6c 69 63 6b 20 6f 6e 20 74 68 65 20 e2 80 9c 4c 6f 67 69 6e e2 80 9d 20 62 75 74 74 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 79 6f 75 72 20 47 65 6d 69 6e 69 20 61 63 63 6f 75 6e 74 3c 62 72 2f 3e 77 68 65 6e 20 61 63 63 65 73 73 69 6e 67 20 74 68 65 20 61 63 63 6f 75 6e 74 2c 20 73 65 65 6b 20 66 6f 72 20 74 68 65 20 e2 80 9c 42 75 79 e2 80 9d 20 63 68 6f 69 63 65 20 61 6e 64 20 63 6c 69 63 6b 20 6f 6e 20 74 68 65 72 65 6f 6e 4e 6f 77 2c 20 73 65 6c 65 63 74 20 42 69 74 63 6f 69 6e 20 66 72 6f 6d 20 74 68 65 20 64 72 6f 70 2d 64 6f 77 6e 20 6c 69 73 74 20 6f 66 20 63 72 79 70 74 6f 63 75 72 72 65 6e 63 69 65 73 3c 62 72 2f 3e 54 68 65 6e 2c Data Ascii: n details for your Gemini account<br/>Click on the Login button to access your Gemini account<br/>when accessing the account, seek for the Buy choice and click on thereonNow, select Bitcoin from the drop-down list of cryptocurrencies<br/>Then,
2025-03-19 10:17:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	52.222.232.47	443	1944	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 10:17:52 UTC	654	OUT	GET /js/jquery-3.5.1.min.dc5e7f18c8.js?site=66da0a989f21be186b9a614e HTTP/1.1 Host: d3e54v103j8qbb.cloudfront.net Connection: keep-alive Origin: https://login-gemini-auth.webflow.io sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://login-gemini-auth.webflow.io/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 10:17:52 UTC	551	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 89476 Connection: close Last-Modified: Mon, 20 Jul 2020 17:53:02 GMT Accept-Ranges: bytes Server: AmazonS3 Date: Wed, 19 Mar 2025 00:14:30 GMT Cache-Control: max-age=84600, must-revalidate Etag: "dc5e7f18c8d36ac1d3d4753a87c98d0a" Via: 1.1 88f858f045c3909fad9cebbada511aee.cloudfront.net (CloudFront) Age: 36204 Access-Control-Allow-Origin: * X-Cache: Hit from cloudfront X-Amz-Cf-Pop: FRA56-P4 X-Amz-Cf-Id: cPgZUl3CNud12xpXsqgjRw1E4t2HzA9uZ3uqBjuql0h4qH159dz2WQ==
2025-03-19 10:17:52 UTC	15833	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 35 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 Data Ascii: /! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery
2025-03-19 10:17:52 UTC	16384	IN	Data Raw: 6e 74 4e 6f 64 65 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 2c 61 2c 73 2c 75 2c 6c 3d 79 21 3d 3d 6d 3f 22 6e 65 78 74 53 69 62 6c 69 6e 67 22 3a 22 70 72 65 76 69 6f 75 73 53 69 62 6c 69 6e 67 22 2c 63 3d 65 2e 70 61 72 65 6e 74 4e 6f 64 65 2c 66 3d 78 26 26 65 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2c 70 3d 21 6e 26 26 21 78 2c 64 3d 21 31 3b 69 66 28 63 29 7b 69 66 28 79 29 7b 77 68 69 6c 65 28 6c 29 7b 61 3d 65 3b 77 68 69 6c 65 28 61 3d 61 5b 6c 5d 29 69 66 28 78 3f 61 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 72 65 74 75 72 6e 21 31 3b 75 3d 6c 3d 22 6f 6e 6c 79 22 3d 3d 3d 68 26 26 21 75 26 26 Data Ascii: ntNode}:function(e,t,n){var r,i,o,a,s,u,l=y!==m?"nextSibling":"previousSibling",c=e.parentNode,f=x&&e.nodeName.toLowerCase(),p=!n&&!x,d=!1;if(c){if(y){while(l){a=e;while(a=a[l])if(x?a.nodeName.toLowerCase()===f:1===a.nodeType)return!1;u=l="only"===h&&!u&&
2025-03-19 10:17:52 UTC	16384	IN	Data Raw: 6c 3f 43 2e 73 65 74 54 69 6d 65 6f 75 74 28 53 2e 72 65 61 64 79 29 3a 28 45 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 42 29 2c 43 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 6c 6f 61 64 22 2c 42 29 29 3b 76 61 72 20 24 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 2c 69 2c 6f 2c 61 29 7b 76 61 72 20 73 3d 30 2c 75 3d 65 2e 6c 65 6e 67 74 68 2c 6c 3d 6e 75 6c 6c 3d 3d 6e 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 3d 77 28 6e 29 29 66 6f 72 28 73 20 69 6e 20 69 3d 21 30 2c 6e 29 24 28 65 2c 74 2c 73 2c 6e 5b 73 5d 2c 21 30 2c 6f 2c 61 29 3b 65 6c 73 65 20 69 66 28 76 6f 69 64 20 30 21 3d 3d 72 26 26 28 69 3d 21 30 2c 6d 28 72 29 7c 7c 28 61 3d 21 30 29 2c 6c 26 26 28 61 Data Ascii: l?C.setTimeout(S.ready):(E.addEventListener("DOMContentLoaded",B),C.addEventListener("load",B));var $=function(e,t,n,r,i,o,a){var s=0,u=e.length,l=null==n;if("object"===w(n))for(s in i=!0,n)$(e,t,s,n[s],!0,o,a);else if(void 0!==r&&(i=!0,m(r)\|\|(a=!0),l&&(a
2025-03-19 10:17:52 UTC	16384	IN	Data Raw: 69 62 75 74 65 28 22 6e 6f 6e 63 65 22 29 7d 2c 6c 29 3a 62 28 75 2e 74 65 78 74 43 6f 6e 74 65 6e 74 2e 72 65 70 6c 61 63 65 28 6a 65 2c 22 22 29 2c 75 2c 6c 29 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 52 65 28 65 2c 74 2c 6e 29 7b 66 6f 72 28 76 61 72 20 72 2c 69 3d 74 3f 53 2e 66 69 6c 74 65 72 28 74 2c 65 29 3a 65 2c 6f 3d 30 3b 6e 75 6c 6c 21 3d 28 72 3d 69 5b 6f 5d 29 3b 6f 2b 2b 29 6e 7c 7c 31 21 3d 3d 72 2e 6e 6f 64 65 54 79 70 65 7c 7c 53 2e 63 6c 65 61 6e 44 61 74 61 28 76 65 28 72 29 29 2c 72 2e 70 61 72 65 6e 74 4e 6f 64 65 26 26 28 6e 26 26 69 65 28 72 29 26 26 79 65 28 76 65 28 72 2c 22 73 63 72 69 70 74 22 29 29 2c 72 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 72 29 29 3b 72 65 74 75 72 6e 20 Data Ascii: ibute("nonce")},l):b(u.textContent.replace(je,""),u,l))}return n}function Re(e,t,n){for(var r,i=t?S.filter(t,e):e,o=0;null!=(r=i[o]);o++)n\|\|1!==r.nodeType\|\|S.cleanData(ve(r)),r.parentNode&&(n&&ie(r)&&ye(ve(r,"script")),r.parentNode.removeChild(r));return
2025-03-19 10:17:52 UTC	16384	IN	Data Raw: 70 65 65 64 73 5b 72 5d 7c 7c 72 2c 65 3d 65 7c 7c 22 66 78 22 2c 74 68 69 73 2e 71 75 65 75 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 43 2e 73 65 74 54 69 6d 65 6f 75 74 28 65 2c 72 29 3b 74 2e 73 74 6f 70 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 43 2e 63 6c 65 61 72 54 69 6d 65 6f 75 74 28 6e 29 7d 7d 29 7d 2c 72 74 3d 45 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6e 70 75 74 22 29 2c 69 74 3d 45 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 65 6c 65 63 74 22 29 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 45 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 6f 70 74 69 6f 6e 22 29 29 2c 72 74 2e 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 2c 79 2e 63 68 65 63 6b 4f 6e 3d 22 22 21 3d 3d 72 74 2e 76 61 6c 75 65 2c 79 2e 6f Data Ascii: peeds[r]\|\|r,e=e\|\|"fx",this.queue(e,function(e,t){var n=C.setTimeout(e,r);t.stop=function(){C.clearTimeout(n)}})},rt=E.createElement("input"),it=E.createElement("select").appendChild(E.createElement("option")),rt.type="checkbox",y.checkOn=""!==rt.value,y.o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49731	104.18.161.117	443	1944	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 10:17:52 UTC	661	OUT	GET /66da0a989f21be186b9a614e/css/login-gemini-auth.webflow.d7148d6a6.css HTTP/1.1 Host: cdn.prod.website-files.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Sec-Fetch-Storage-Access: active Referer: https://login-gemini-auth.webflow.io/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 10:17:52 UTC	632	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 10:17:52 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: close x-amz-id-2: uHkW/EAMEq1Y7JAOJaA3CUeEVW1Dac6z+55wTZ1hK7diypZO5bugfbRCgkN5Nw1o8YQoxc1LWd8= x-amz-request-id: AXV1GDDJFWJFCAQ9 Last-Modified: Thu, 05 Sep 2024 19:56:47 GMT ETag: W/"5025752116ac708a8db72decbc1015b7" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=31536000, immutable x-amz-version-id: 4Bj4t8eIepA_U6bs2l358UN3jpbeMEY8 CF-Cache-Status: HIT Age: 135720 Access-Control-Allow-Origin: * Server: cloudflare CF-RAY: 922c38f57947dcb6-FRA alt-svc: h3=":443"; ma=86400
2025-03-19 10:17:52 UTC	737	IN	Data Raw: 37 64 33 38 0d 0a 68 74 6d 6c 20 7b 0a 20 20 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 20 31 30 30 25 3b 0a 20 20 2d 6d 73 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 20 31 30 30 25 3b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 62 6f 64 79 20 7b 0a 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 7d 0a 0a 61 72 74 69 63 6c 65 2c 20 61 73 69 64 65 2c 20 64 65 74 61 69 6c 73 2c 20 66 69 67 63 61 70 74 69 6f 6e 2c 20 66 69 67 75 72 65 2c 20 66 6f 6f 74 65 72 2c 20 68 65 61 64 65 72 2c 20 68 67 72 6f 75 70 2c 20 6d 61 69 6e 2c 20 6d 65 6e 75 2c 20 6e 61 76 2c 20 73 65 63 74 69 6f 6e 2c 20 73 75 6d 6d 61 72 79 20 7b 0a 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 7d 0a Data Ascii: 7d38html { -webkit-text-size-adjust: 100%; -ms-text-size-adjust: 100%; font-family: sans-serif;}body { margin: 0;}article, aside, details, figcaption, figure, footer, header, hgroup, main, menu, nav, section, summary { display: block;}
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 20 38 30 25 3b 0a 7d 0a 0a 73 75 62 2c 20 73 75 70 20 7b 0a 20 20 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 62 61 73 65 6c 69 6e 65 3b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 37 35 25 3b 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 30 3b 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 7d 0a 0a 73 75 70 20 7b 0a 20 20 74 6f 70 3a 20 2d 2e 35 65 6d 3b 0a 7d 0a 0a 73 75 62 20 7b 0a 20 20 62 6f 74 74 6f 6d 3a 20 2d 2e 32 35 65 6d 3b 0a 7d 0a 0a 69 6d 67 20 7b 0a 20 20 62 6f 72 64 65 72 3a 20 30 3b 0a 7d 0a 0a 73 76 67 3a 6e 6f 74 28 3a 72 6f 6f 74 29 20 7b 0a 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 7d 0a 0a 68 72 20 7b 0a 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 0a 20 20 Data Ascii: 80%;}sub, sup { vertical-align: baseline; font-size: 75%; line-height: 0; position: relative;}sup { top: -.5em;}sub { bottom: -.25em;}img { border: 0;}svg:not(:root) { overflow: hidden;}hr { box-sizing: content-box;
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 65 72 2d 73 70 61 63 69 6e 67 3a 20 30 3b 0a 7d 0a 0a 74 64 2c 20 74 68 20 7b 0a 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 7d 0a 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 77 65 62 66 6c 6f 77 2d 69 63 6f 6e 73 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 22 64 61 74 61 3a 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 66 6f 6e 74 2d 74 74 66 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3b 62 61 73 65 36 34 2c 41 41 45 41 41 41 41 4c 41 49 41 41 41 77 41 77 54 31 4d 76 4d 67 38 53 42 69 55 41 41 41 43 38 41 41 41 41 59 47 4e 74 59 58 44 70 50 2b 61 34 41 41 41 42 48 41 41 41 41 46 78 6e 59 58 4e 77 41 41 41 41 45 41 41 41 41 58 67 41 41 41 41 49 5a 32 78 35 5a 6d 68 53 32 58 45 41 41 41 47 41 41 41 41 44 48 47 68 6c 59 57 51 Data Ascii: er-spacing: 0;}td, th { padding: 0;}@font-face { font-family: webflow-icons; src: url("data:application/x-font-ttf;charset=utf-8;base64,AAEAAAALAIAAAwAwT1MvMg8SBiUAAAC8AAAAYGNtYXDpP+a4AAABHAAAAFxnYXNwAAAAEAAAAXgAAAAIZ2x5ZmhS2XEAAAGAAAADHGhlYWQ
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 69 45 67 62 30 74 4b 56 56 56 4b 53 32 38 67 49 53 45 67 62 30 74 4b 56 56 56 4b 53 32 38 67 49 51 41 42 41 41 41 42 77 41 49 41 41 38 41 41 45 67 41 41 45 7a 51 33 50 67 45 33 4e 6a 4d 78 46 53 49 48 44 67 45 48 42 68 55 78 49 77 41 6f 4b 49 74 65 58 57 70 56 53 6b 74 76 49 43 46 6d 41 63 42 71 58 56 36 4c 4b 43 68 6d 49 53 42 76 53 30 70 56 41 41 41 41 41 67 41 41 2f 38 41 46 74 67 50 41 41 44 49 41 4f 67 41 41 41 52 59 58 48 67 45 58 46 68 55 55 42 77 34 42 42 77 59 48 49 78 55 68 49 69 63 75 41 53 63 6d 4e 54 51 33 50 67 45 33 4e 6a 4d 78 4f 41 45 78 4e 44 63 2b 41 54 63 32 4d 7a 49 58 48 67 45 58 46 68 63 56 41 54 4d 4a 41 54 4d 56 4d 7a 55 45 6a 44 38 33 4e 6c 41 58 46 78 59 58 54 6a 55 31 50 51 4c 38 6b 7a 30 31 4e 6b 38 58 46 78 63 58 54 7a 59 31 Data Ascii: iEgb0tKVVVKS28gISEgb0tKVVVKS28gIQABAAABwAIAA8AAEgAAEzQ3PgE3NjMxFSIHDgEHBhUxIwAoKIteXWpVSktvICFmAcBqXV6LKChmISBvS0pVAAAAAgAA/8AFtgPAADIAOgAAARYXHgEXFhUUBw4BBwYHIxUhIicuAScmNTQ3PgE3NjMxOAExNDc+ATc2MzIXHgEXFhcVATMJATMVMzUEjD83NlAXFxYXTjU1PQL8kz01Nk8XFxcXTzY1
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 2d 22 5d 2c 20 5b 63 6c 61 73 73 2a 3d 22 20 77 2d 69 63 6f 6e 2d 22 5d 20 7b 0a 20 20 73 70 65 61 6b 3a 20 6e 6f 6e 65 3b 0a 20 20 66 6f 6e 74 2d 76 61 72 69 61 6e 74 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 20 6e 6f 6e 65 3b 0a 20 20 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 20 61 6e 74 69 61 6c 69 61 73 65 64 3b 0a 20 20 2d 6d 6f 7a 2d 6f 73 78 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 20 67 72 61 79 73 63 61 6c 65 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 3b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 77 65 62 66 6c 6f 77 2d 69 63 Data Ascii: -"], [class*=" w-icon-"] { speak: none; font-variant: normal; text-transform: none; -webkit-font-smoothing: antialiased; -moz-osx-font-smoothing: grayscale; font-style: normal; font-weight: normal; line-height: 1; font-family: webflow-ic
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 65 72 2d 72 61 64 69 75 73 3a 20 30 3b 0a 20 20 70 61 64 64 69 6e 67 3a 20 39 70 78 20 31 35 70 78 3b 0a 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 7d 0a 0a 69 6e 70 75 74 2e 77 2d 62 75 74 74 6f 6e 20 7b 0a 20 20 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 20 62 75 74 74 6f 6e 3b 0a 7d 0a 0a 68 74 6d 6c 5b 64 61 74 61 2d 77 2d 64 79 6e 70 61 67 65 5d 20 5b 64 61 74 61 2d 77 2d 63 6c 6f 61 6b 5d 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 7d 0a 0a 2e 77 2d 63 6f 64 65 2d 62 6c 6f 63 6b 20 7b 0a 20 20 6d 61 72 67 69 6e 3a 20 75 6e 73 65 74 3b 0a 7d 0a 0a 70 72 65 2e 77 2d 63 6f 64 65 2d 62 6c Data Ascii: er-radius: 0; padding: 9px 15px; text-decoration: none; display: inline-block;}input.w-button { -webkit-appearance: button;}html[data-w-dynpage] [data-w-cloak] { color: #0000 !important;}.w-code-block { margin: unset;}pre.w-code-bl
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 69 74 65 2d 73 70 61 63 65 3a 20 6e 6f 77 72 61 70 3b 0a 20 20 63 75 72 73 6f 72 3a 20 70 6f 69 6e 74 65 72 3b 0a 20 20 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 30 20 30 20 31 70 78 20 23 30 30 30 30 30 30 31 61 2c 20 30 20 31 70 78 20 33 70 78 20 23 30 30 30 30 30 30 31 61 3b 0a 20 20 76 69 73 69 62 69 6c 69 74 79 3a 20 76 69 73 69 62 6c 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 7a 2d 69 6e 64 65 78 3a 20 32 31 34 37 34 38 33 36 34 37 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 63 6f 6c 6f 72 3a 20 23 61 61 61 64 62 30 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 6f 70 61 63 69 74 79 3a 20 31 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 20 20 Data Ascii: ite-space: nowrap; cursor: pointer; box-shadow: 0 0 0 1px #0000001a, 0 1px 3px #0000001a; visibility: visible !important; z-index: 2147483647 !important; color: #aaadb0 !important; opacity: 1 !important; background-color: #fff !important;
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 6c 65 66 74 3a 20 35 70 78 20 73 6f 6c 69 64 20 23 65 32 65 32 65 32 3b 0a 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 31 30 70 78 3b 0a 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 20 32 30 70 78 3b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 32 32 70 78 3b 0a 7d 0a 0a 66 69 67 75 72 65 20 7b 0a 20 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 31 30 70 78 3b 0a 7d 0a 0a 66 69 67 63 61 70 74 69 6f 6e 20 7b 0a 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 35 70 78 3b 0a 7d 0a 0a 75 6c 2c 20 6f 6c 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 30 3b 0a 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 31 30 70 78 3b 0a 20 20 70 61 64 64 69 Data Ascii: left: 5px solid #e2e2e2; margin: 0 0 10px; padding: 10px 20px; font-size: 18px; line-height: 22px;}figure { margin: 0 0 10px;}figcaption { text-align: center; margin-top: 5px;}ul, ol { margin-top: 0; margin-bottom: 10px; paddi
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 2e 34 32 38 35 37 3b 0a 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 7d 0a 0a 2e 77 2d 69 6e 70 75 74 3a 3a 70 6c 61 63 65 68 6f 6c 64 65 72 2c 20 2e 77 2d 73 65 6c 65 63 74 3a 3a 70 6c 61 63 65 68 6f 6c 64 65 72 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 39 39 39 3b 0a 7d 0a 0a 2e 77 2d 69 6e 70 75 74 3a 66 6f 63 75 73 2c 20 2e 77 2d 73 65 6c 65 63 74 3a 66 6f 63 75 73 20 7b 0a 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 33 38 39 38 65 63 3b 0a 20 20 6f 75 74 6c 69 6e 65 3a 20 30 3b 0a 7d 0a 0a 2e 77 2d 69 6e 70 75 74 5b 64 69 73 61 62 6c 65 64 5d 2c 20 2e 77 2d 73 65 6c 65 63 74 5b 64 69 73 61 62 6c 65 64 5d 2c 20 2e 77 2d 69 6e 70 75 74 5b 72 65 61 64 6f 6e 6c 79 5d 2c 20 2e 77 2d 73 65 6c 65 63 74 5b 72 65 61 64 6f 6e 6c 79 5d 2c 20 66 69 Data Ascii: .42857; display: block;}.w-input::placeholder, .w-select::placeholder { color: #999;}.w-input:focus, .w-select:focus { border-color: #3898ec; outline: 0;}.w-input[disabled], .w-select[disabled], .w-input[readonly], .w-select[readonly], fi
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 6f 61 64 2d 75 70 6c 6f 61 64 69 6e 67 2c 20 2e 77 2d 66 69 6c 65 2d 75 70 6c 6f 61 64 2d 73 75 63 63 65 73 73 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 7d 0a 0a 2e 77 2d 66 69 6c 65 2d 75 70 6c 6f 61 64 2d 65 72 72 6f 72 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 31 30 70 78 3b 0a 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 7d 0a 0a 2e 77 2d 66 69 6c 65 2d 75 70 6c 6f 61 64 2d 64 65 66 61 75 6c 74 2e 77 2d 68 69 64 64 65 6e 2c 20 2e 77 2d 66 69 6c 65 2d 75 70 6c 6f 61 64 2d 75 70 6c 6f 61 64 69 6e 67 2e 77 2d 68 69 64 64 65 6e 2c 20 2e 77 2d 66 69 6c 65 2d 75 70 6c 6f 61 64 2d 65 72 72 6f 72 2e 77 2d 68 69 64 64 65 6e 2c 20 2e 77 2d 66 69 6c 65 2d 75 Data Ascii: oad-uploading, .w-file-upload-success { color: #333; display: inline-block;}.w-file-upload-error { margin-top: 10px; display: block;}.w-file-upload-default.w-hidden, .w-file-upload-uploading.w-hidden, .w-file-upload-error.w-hidden, .w-file-u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49730	104.18.161.117	443	1944	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 10:17:52 UTC	786	OUT	GET /66da0a989f21be186b9a614e/66da0ca2f73a0182b200f996_66da0862104bc6499ba9eed6_66da06e8d54be283d98bad70_66d8c2bcf78e8198ec0c43c0_gemini%25252520png.png HTTP/1.1 Host: cdn.prod.website-files.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://login-gemini-auth.webflow.io/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 10:17:52 UTC	642	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 10:17:52 GMT Content-Type: image/png Content-Length: 84813 Connection: close x-amz-id-2: VNDFCzSgUNxEFAd3TWGetJzJnm3+K8WrB6cgSM4BeUp5jx8IdilugiGnhjbhDjkB508bJiU5bSU= x-amz-request-id: 2W5C4QNE6VYFW895 Last-Modified: Thu, 05 Sep 2024 19:55:15 GMT ETag: "f08c98f4d991596011698308b7582477" x-amz-server-side-encryption: AES256 Cache-Control: max-age=84600, must-revalidate x-amz-version-id: py.bBFNqK8XNINmg1ZeOT1nC1NZgMdeb CF-Cache-Status: HIT Age: 36514 Accept-Ranges: bytes Access-Control-Allow-Origin: * Server: cloudflare CF-RAY: 922c38f57c78d2a0-FRA alt-svc: h3=":443"; ma=86400
2025-03-19 10:17:52 UTC	727	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 06 40 00 00 02 ef 08 03 00 00 00 0a d7 f9 bd 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 a2 50 4c 54 45 00 02 03 25 dd f9 f0 f0 f0 1e 21 22 0f 11 12 08 09 0a 19 1a 1c 14 16 18 f5 f5 f5 ff ff ff c9 ca ca 31 33 34 e8 e9 e8 f9 f9 f7 28 2a 2b df df df fb fc fc 53 53 54 3a 3c 3d 44 45 46 d4 d6 d5 4c 4d 4e c2 c2 c2 79 7a 7b b7 b7 b7 60 61 62 a9 aa aa 9c 9c 9d 8f 8f 90 68 6a 6b 72 73 74 84 84 84 59 5a 5b 11 3e 21 65 25 1f 26 74 41 8a 4a 32 2d 10 0f 49 1e 18 cb f2 fb bc 5d 39 a3 d5 b3 fd f3 d0 07 1f 49 e2 b1 70 98 d1 f1 2c 82 b4 4f a6 d4 f6 d9 a4 21 5d 8e eb 95 22 79 be 8f 59 d4 f8 0c 2d 77 dd b4 41 a7 00 00 20 00 49 44 41 54 78 da ec 9c 0b 77 a2 3a 10 80 01 Data Ascii: PNGIHDR@gAMAasRGBPLTE%!"134(*+SST:<=DEFLMNyz{`abhjkrstYZ[>!e%&tAJ2-I]9Ip,O!]"yY-wA IDATxw:
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: ce 51 20 1d 3e d1 af 22 d0 3b 78 d2 02 79 22 81 10 c4 a3 09 88 fc 42 7f 58 ac 45 4f 62 11 b5 d1 50 b9 69 e6 17 cc e2 38 8b d1 1d 71 6b 36 6c b7 07 0b d7 05 57 0c 45 67 d2 ee f7 fb ed 76 bb a1 05 c2 ab e7 39 20 e7 e0 7c 78 16 08 2c 59 f3 4b 06 42 02 21 88 07 69 7a ec f5 d3 53 75 3e 89 35 a7 36 26 ea 01 1f e0 45 aa d7 ea ed 51 20 63 ce 02 fd d6 1e ac 0c 2d 90 c1 e5 12 9f 82 35 24 ce 6e 34 47 fc 56 20 52 72 b7 ff bd 19 88 dd 1e f4 07 af 07 7a ed 46 df fe ca a2 9c 3c fa d4 fe 9f fa c8 60 f7 6f 9f 19 2c d7 35 d6 fd 8d a2 92 d9 e6 d5 aa e9 a6 d6 36 73 06 7f 38 c8 ff c7 9d a5 c6 5b c3 50 fe eb 23 fd e3 75 d2 e6 77 21 9f 5b 70 5b fd 5e 27 7f d4 cd dd 32 3d 88 45 d4 c5 2f d3 54 f8 ec ee 73 f2 ac 4c 95 3c 37 92 22 af 12 5c a7 c5 fd ee e9 66 40 81 b0 4e fb 5a 20 23 Data Ascii: Q >";xy"BXEObPi8qk6lWEgv9 \|x,YKB!izSu>56&EQ c-5$n4GV RrzF<`o,56s8[P#uw![p[^'2=E/TsL<7"\f@NZ #
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 0e 61 35 8b f8 18 32 33 b0 16 d4 1b ab fe 82 d6 d8 60 12 84 de 9c bf 3f ff 38 0a 64 bf b5 b3 7d 37 3b e0 4c 0a b6 15 ec 44 0f 61 55 02 d9 e1 10 16 08 a4 64 d8 92 e9 b0 fa 40 89 3f 8e f3 24 b6 a5 bf 55 30 b4 de df a9 cd 45 d4 9b c9 34 81 7d 36 c3 b4 0f b5 2f 97 8d 2c b6 ab 43 d2 c7 8d 8e 29 59 8a 67 0f 4f 95 92 11 36 c1 e9 34 8d 3d 9c 9c 6b 8e a6 3f b8 6f 06 2a e7 98 51 89 75 a1 af 35 10 c8 01 0e 09 af 06 2d 90 fd 0e ae 93 df fc f2 ed 14 88 3c 28 69 59 1d 4c 45 20 a7 10 9b 82 a7 25 43 23 74 e0 ad 68 e1 10 96 64 ae 07 fd 16 25 d3 2e 7c 42 40 77 46 60 bf 62 0f a7 0c 73 e1 dd bd 40 f0 1b 5b 04 51 c7 08 56 03 67 cf 4f 93 e8 ca 34 d5 39 0a 77 78 70 8c 57 cb 4a 20 b7 93 e8 20 10 a3 dd 41 3b 0c 6f 05 82 03 5f 0b ce 7d 1f 05 e2 7c 47 06 e2 84 98 1a a5 78 f7 ea c8 Data Ascii: a523`?8d}7;LDaUd@?$U0E4}6/,C)YgO64=k?o*Qu5-<(iYLE %C#thd%.\|B@wF`bs@[QVgO49wxpWJ A;o_}\|Gx
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 6b bc 5a 85 c5 32 5e 38 06 9b fd 94 87 e3 be d8 c8 5d b7 0e 07 35 df 8c 44 f9 2a 1d bb 66 62 5c 29 65 97 61 f5 df e9 81 f4 ac 37 0a 81 88 51 78 36 81 5c 2f 66 b6 a6 19 a7 76 29 ad aa 99 95 52 0b 95 f6 4d b3 2f 5c f7 d3 7b b1 9c 9a 25 a2 8f ab da dc 5d 78 aa da 4b 88 3e 7d a9 c7 d5 dc 7d 5c 78 52 57 eb 9b a9 be a8 63 06 86 e2 83 9e d1 58 cd b5 40 c2 99 71 45 98 f6 83 9f 36 3a 6b 41 1b 8d 0e f5 62 7b d4 93 0f ba a9 6e e6 d2 b5 3c 74 2e f4 15 7d 9d 4d b3 f2 b7 18 3e f9 48 25 b7 d2 15 99 4e fe 42 bf 6f ea 3f cc ef c4 32 5c ff 5c cc 84 ae f2 6e 1b 36 01 91 b3 0a e7 ed c5 3f a6 f8 bc b9 78 4a 4d bd 3e d3 e7 d9 39 93 dd af ce 61 7b 2b 6d 74 99 34 74 bb 5c 4b 5d 97 95 bb ac d9 49 90 95 cd a9 28 f2 bd b4 8b a0 a7 52 67 cc d1 b7 aa 36 33 8b 79 55 d5 c5 d1 a5 7f b4 Data Ascii: kZ2^8]5D*fb\)ea7Qx6\/fv)RM/\{%]xK>}}\xRWcX@qE6:kAb{n<t.}M>H%NBo?2\\n6?xJM>9a{+mt4t\K]I(Rg63yU
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: f7 c9 b7 da fd bb 24 c8 37 92 b0 7d e7 9b 3d 06 f9 2a f1 fe ab 94 ef d2 5b 0d ab 66 f0 65 92 95 bf cb 91 79 59 0a a4 11 3e 8f c2 c6 6a 2f 8d 58 00 81 c0 39 05 22 e3 71 cf 12 a8 dd 39 45 48 9e ea fa a9 6f 5f 8f 07 35 cf 8f f3 76 92 4c c2 70 58 9c af 8f 2a d5 ed 25 49 d2 ee 05 2f 14 a2 82 51 71 52 56 09 cc 8a a0 71 a6 ca 1a 32 1d de e8 18 93 c9 30 dd 8b 40 06 bd 5d f4 cf df d7 8b a5 8c 8b 6b 8f bb 4a aa ee 48 bf 37 df 3f 22 51 1b 14 49 ed 9a 74 65 e6 e0 4d 5f 16 97 f2 bd fe 48 5f a9 35 0c fd e7 0e 50 41 de 32 19 18 0d e2 4a 0e 8a 0b 8e 07 e6 8c 70 30 31 49 1c d4 fc 17 fa 88 07 26 4a 1d 67 50 26 be bc 7e 51 6c e5 59 db b2 ea 55 fa 10 59 71 da 50 07 6d df 92 99 08 d3 bc 63 52 92 15 69 36 e5 90 77 ca 55 58 e3 6a 81 48 bf 66 73 93 74 f4 fb 7c 14 02 08 04 ce 28 Data Ascii: $7}=[feyY>j/X9"q9EHo_5vLpX%I/QqRVq20@]kJH7?"QIteM_H_5PA2Jp01I&JgP&~QlYUYqPmcRi6wUXjHfst\|(
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 70 a3 ef a6 bd 30 bc 34 1f 95 95 fa a1 ca 1c 27 d1 75 36 f9 e1 56 20 c7 58 8e 24 88 ac 32 50 04 3a 13 5d c8 ce f5 fa e7 67 18 d5 08 24 44 c1 9e 4f 62 b1 31 40 d8 3e 59 81 f4 ca 59 6b 27 be 9f 3f 49 70 e7 c6 33 cf 03 91 cc d8 cf de 13 7d e3 28 19 a8 b6 63 af 24 0b f9 f6 da 87 27 15 c8 38 db c5 c6 bf 06 48 3f a7 d0 13 e8 6e b3 a7 c7 fd 9f 70 d4 40 d9 cd b3 96 01 7c dc 1c 92 9e 9b 00 52 cd c9 e8 24 50 4e 10 0b ac 05 83 cb 05 62 8f 1f 88 32 34 bf c3 10 48 d4 99 b9 e9 4e 05 92 67 2a b2 7f 34 e3 41 8b 52 26 a2 52 27 b0 02 75 e4 39 c1 0f 72 ee af ce c6 00 61 fb 60 05 72 44 1f a5 9d 38 66 de 81 ca c9 a0 e0 b1 da c3 9a bd e9 6e da 64 82 6c a7 4e ac 02 e5 88 e4 18 75 a7 e0 c1 31 83 27 15 c8 65 f5 ce ad 01 32 6f e8 00 6e 20 61 06 1e 28 7d 30 fa 73 73 40 7b c7 cd 3b Data Ascii: p04'u6V X$2P:]g$DOb1@>YYk'?Ip3}(c$'8H?np@\|R$PNb24HNg*4AR&R'u9ra`rD8fndlNu1'e2on a(}0ss@{;
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: e5 80 45 13 6d 83 dd e1 58 ab aa 91 73 5c fb 34 8f b0 59 67 f8 7d 01 20 b3 e4 a0 73 bc 1b 55 c6 52 b4 2a 74 b4 e3 10 08 1b 03 84 ed 1d 00 89 81 7a 2b f5 95 0f 65 77 b4 7a 80 7f 4b 81 28 9f 1d 6d 67 8e 54 60 0b 8e 68 88 93 11 11 78 4e 77 2a fa 41 2e d4 8b ea d4 8f 4b dd ce e9 95 a7 b0 a8 1f c8 b6 1d 31 25 12 bf 8f 74 c9 96 87 0a 84 d2 23 f3 66 da b5 12 49 ba 88 6d cf 57 87 f3 00 fb 95 34 f8 1b 05 a2 7e 1a 5d 84 ec 7c a2 8b d0 ef cb 69 d6 d5 c1 bb bb 1c 6c 6c 0c 10 b6 1f 00 48 d2 eb e6 ae fb db 51 77 dd 7e 81 02 c9 cc 9e ad 74 0f bf a7 9e b0 4d 51 34 fd 96 14 89 2c 7a 72 6f 3a af cc 03 01 54 1c 5e 30 54 e3 14 f6 91 a3 23 a1 53 81 c4 d4 6b 36 18 d2 58 40 41 2d d8 a9 f5 a2 99 29 b2 5e 92 bf 51 20 34 d4 79 e8 3b 21 b5 0e 16 d7 ef ca 22 bd 20 5b 37 dc 91 90 8d Data Ascii: EmXs\4Yg} sURtz+ewzK(mgT`hxNwA.K1%t#fImW4~]\|illHQw~tMQ4,zro:T^0T#Sk6X@A-)^Q 4y;!" [7
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 90 48 9f 7d 9c 97 2d e6 c3 ae a0 cd 4c 24 12 01 84 44 fa 94 ff e1 97 ff f7 8e 84 24 12 01 84 44 fa 1b 1d 90 de 6c e2 6a 29 88 45 22 11 40 48 ff ac 33 01 5a 9f 03 88 79 91 48 38 c2 ef 58 f0 7f 01 4d 2d 72 b9 48 04 10 12 c9 a8 a8 93 a4 16 3f fe 97 00 f2 e7 9b a2 f3 42 ae 36 a9 eb ec 0f cf 9b e8 2f aa a2 ff 32 24 02 08 89 a4 35 e6 a5 50 fa b9 7c f8 0b 43 58 d0 96 a9 f8 29 d3 3f 9c c0 87 39 55 5f d4 4c 69 1f 12 01 84 44 d2 6a be d2 51 91 fb ba 94 bd fb f3 d6 94 f5 af e9 a7 cb 2e 7a da 3b 01 84 44 00 21 91 34 0a be 04 90 98 d5 72 1b ef f4 82 42 90 97 01 e4 4e 00 21 11 40 48 a4 ef 7b 20 71 0c 45 3f f4 d9 0b f6 60 11 40 48 04 10 12 e9 57 7b 20 ba 1b ca 2b 4c 29 01 84 44 00 21 91 7e b7 07 f2 32 11 40 48 04 10 12 e9 a3 8f f9 4c f6 3c 74 1e f6 d5 3f f5 11 2e fb 03 Data Ascii: H}-L$D$Dlj)E"@H3ZyH8XM-rH?B6/2$5P\|CX)?9U_LiDjQ.z;D!4rBN!@H{ qE?`@HW{ +L)D!~2@HL<t?.
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: d6 ec 5f 0a c6 98 75 0a 26 9f 6f 00 12 dd a7 f2 34 32 8c da 0f 66 7b 6e 75 42 46 b8 89 f2 70 ce 18 ab ee 6e 18 46 c8 d8 ea ab 2e ba 88 a1 b7 33 cb ca 90 0c 71 12 6d fa ee 3e 01 c8 79 4c ea 25 5a 73 36 80 66 f6 6c f2 fb 38 5b 58 81 75 46 84 7b 22 a7 ae 71 9b ac bf 42 2c ac 55 91 05 f2 30 ad 98 53 07 e2 eb ea 0f 07 20 79 9f 24 f7 8d 17 92 24 cd 9a 57 e7 c2 41 9b 3d b7 ec 05 e7 89 fa 2d 40 ca 3e a9 bb 35 0b c2 b9 53 07 32 e9 2a 96 ac c4 3b d1 4b bc fe b2 7a 4c 12 01 84 f4 b7 8a 17 68 94 3b 55 a7 c0 d0 5c a5 95 0b 90 34 d1 c6 cc 1a dc 49 9b 69 30 59 f5 50 46 a4 2c 40 82 56 97 dd 2d eb d3 bb fc f0 ae 12 dd e6 98 bb 58 65 06 b0 09 ed 36 41 7c 0c 90 99 4b 5b 0a dd ea 2f a1 c7 11 e0 7b 43 cc b9 9b ef e6 47 74 4d 05 52 af 65 bc 30 bf ce a6 9e a3 4a 8d 83 04 8f 95 Data Ascii: _u&o42f{nuBFpnF.3qm>yL%Zs6fl8[XuF{"qB,U0S y$$WA=-@>5S2*;KzLh;U\4Ii0YPF,@V-Xe6A\|K[/{CGtMRe0J
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: ee 24 d1 51 fa c6 20 6e e7 4b ba e9 fb 15 bd 55 89 fe 89 1c 48 74 79 98 74 fc bc 07 22 4b 26 e5 12 23 ea a6 48 22 80 90 7e 90 70 b7 d2 ec bb 6f f7 36 cd aa 0e 01 82 dd b3 c2 01 cc 46 aa 6b b6 f1 40 bc b5 90 fc 7f ec 9d 0b 73 aa 48 13 86 2d 14 04 64 60 62 70 20 03 ea 29 cb c4 94 c6 a8 5f 6d fe ff 5f fb 66 80 b9 00 72 12 73 b6 d6 4d ed fb d4 56 ce 86 cb 5c a8 54 bf f4 0c dd 6d 6a 72 f4 3d 90 48 7d 40 6c 7a d6 5f 61 45 df f3 40 1a 5f 63 92 36 ae d1 a4 ac 64 69 65 a7 96 6a a1 82 27 69 e0 87 45 f6 b4 18 5b 15 9b fe 6c 0f a4 f1 ec 66 49 bf 53 ff 76 0f a4 2a 9d ee b0 62 f5 f4 68 86 b8 86 07 02 20 20 e0 9e e8 54 58 0b 63 b3 d9 3a cb c4 7f f9 90 80 28 bb b9 24 ac b5 08 a5 05 c4 d4 84 52 69 01 eb fc 88 ed cf 78 1b f7 65 14 eb 12 50 3a 92 db b6 9c 37 08 88 af 16 8e Data Ascii: $Q nKUHtyt"K&#H"~po6Fk@sH-d`bp )_m_frsMV\Tmjr=H}@lz_aE@_c6diej'iE[lfISv*bh TXc:($RixeP:7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49733	104.18.161.117	443	1944	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 10:17:52 UTC	627	OUT	GET /66da0a989f21be186b9a614e/js/webflow.7e939bc70.js HTTP/1.1 Host: cdn.prod.website-files.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Referer: https://login-gemini-auth.webflow.io/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 10:17:52 UTC	639	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 10:17:52 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: close x-amz-id-2: zDnISOiZSgLS1fRG7poDPIJ5NjzF0AF/rVNc1CBqzfx1DZy6qCJ3wABaypXatHIEpYuMHEV+dqA= x-amz-request-id: 07F7HY8HRE1GBWY8 Last-Modified: Thu, 05 Sep 2024 19:56:47 GMT ETag: W/"f9dd65064b62ccff2d97c44d8b6fb974" x-amz-server-side-encryption: AES256 Cache-Control: public, max-age=31536000, immutable x-amz-version-id: e_YrURkLt8doSA7rDKiAHiF.9jEZYMNM CF-Cache-Status: HIT Age: 135720 Access-Control-Allow-Origin: * Server: cloudflare CF-RAY: 922c38f5dd38240f-FRA alt-svc: h3=":443"; ma=86400
2025-03-19 10:17:52 UTC	730	IN	Data Raw: 37 64 33 31 0d 0a 0a 2f 2a 21 0a 20 2a 20 57 65 62 66 6c 6f 77 3a 20 46 72 6f 6e 74 2d 65 6e 64 20 73 69 74 65 20 6c 69 62 72 61 72 79 0a 20 2a 20 40 6c 69 63 65 6e 73 65 20 4d 49 54 0a 20 2a 20 49 6e 6c 69 6e 65 20 73 63 72 69 70 74 73 20 6d 61 79 20 61 63 63 65 73 73 20 74 68 65 20 61 70 69 20 75 73 69 6e 67 20 61 6e 20 61 73 79 6e 63 20 68 61 6e 64 6c 65 72 3a 0a 20 2a 20 20 20 76 61 72 20 57 65 62 66 6c 6f 77 20 3d 20 57 65 62 66 6c 6f 77 20 7c 7c 20 5b 5d 3b 0a 20 2a 20 20 20 57 65 62 66 6c 6f 77 2e 70 75 73 68 28 72 65 61 64 79 46 75 6e 63 74 69 6f 6e 29 3b 0a 20 2a 2f 0a 0a 28 28 29 3d 3e 7b 76 61 72 20 6c 74 3d 28 65 2c 79 29 3d 3e 28 29 3d 3e 28 79 7c 7c 65 28 28 79 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 7d 29 2e 65 78 70 6f 72 74 73 2c 79 29 2c 79 Data Ascii: 7d31/! Webflow: Front-end site library * @license MIT * Inline scripts may access the api using an async handler: * var Webflow = Webflow \|\| []; * Webflow.push(readyFunction); */(()=>{var lt=(e,y)=>()=>(y\|\|e((y={exports:{}}).exports,y),y
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 6f 74 20 6d 61 74 63 68 20 5b 22 2b 74 2b 22 5d 3a 20 22 2b 6e 2b 22 2c 20 22 2b 69 29 7d 66 75 6e 63 74 69 6f 6e 20 49 28 74 2c 6e 2c 69 29 7b 69 66 28 6e 21 3d 3d 76 6f 69 64 20 30 26 26 28 69 3d 6e 29 2c 74 3d 3d 3d 76 6f 69 64 20 30 29 72 65 74 75 72 6e 20 69 3b 76 61 72 20 72 3d 69 3b 72 65 74 75 72 6e 20 77 65 2e 74 65 73 74 28 74 29 7c 7c 21 58 74 2e 74 65 73 74 28 74 29 3f 72 3d 70 61 72 73 65 49 6e 74 28 74 2c 31 30 29 3a 58 74 2e 74 65 73 74 28 74 29 26 26 28 72 3d 31 65 33 2a 70 61 72 73 65 46 6c 6f 61 74 28 74 29 29 2c 30 3e 72 26 26 28 72 3d 30 29 2c 72 3d 3d 3d 72 3f 72 3a 69 7d 66 75 6e 63 74 69 6f 6e 20 42 28 74 29 7b 65 74 2e 64 65 62 75 67 26 26 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 74 29 7d Data Ascii: ot match ["+t+"]: "+n+", "+i)}function I(t,n,i){if(n!==void 0&&(i=n),t===void 0)return i;var r=i;return we.test(t)\|\|!Xt.test(t)?r=parseInt(t,10):Xt.test(t)&&(r=1e3*parseFloat(t)),0>r&&(r=0),r===r?r:i}function B(t){et.debug&&window&&window.console.warn(t)}
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 2b 6e 7d 5d 2c 22 65 61 73 65 2d 69 6e 2d 71 75 61 64 22 3a 5b 22 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 35 35 30 2c 20 30 2e 30 38 35 2c 20 30 2e 36 38 30 2c 20 30 2e 35 33 30 29 22 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 69 2c 72 29 7b 72 65 74 75 72 6e 20 69 2a 28 74 2f 3d 72 29 2a 74 2b 6e 7d 5d 2c 22 65 61 73 65 2d 6f 75 74 2d 71 75 61 64 22 3a 5b 22 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 32 35 30 2c 20 30 2e 34 36 30 2c 20 30 2e 34 35 30 2c 20 30 2e 39 34 30 29 22 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 69 2c 72 29 7b 72 65 74 75 72 6e 2d 69 2a 28 74 2f 3d 72 29 2a 28 74 2d 32 29 2b 6e 7d 5d 2c 22 65 61 73 65 2d 69 6e 2d 6f 75 74 2d 71 75 61 64 22 3a 5b 22 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 34 35 35 2c 20 30 2e 30 33 30 2c Data Ascii: +n}],"ease-in-quad":["cubic-bezier(0.550, 0.085, 0.680, 0.530)",function(t,n,i,r){return i(t/=r)t+n}],"ease-out-quad":["cubic-bezier(0.250, 0.460, 0.450, 0.940)",function(t,n,i,r){return-i(t/=r)(t-2)+n}],"ease-in-out-quad":["cubic-bezier(0.455, 0.030,
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 73 65 2d 69 6e 2d 73 69 6e 65 22 3a 5b 22 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 34 37 30 2c 20 30 2c 20 30 2e 37 34 35 2c 20 30 2e 37 31 35 29 22 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 69 2c 72 29 7b 72 65 74 75 72 6e 2d 69 2a 4d 61 74 68 2e 63 6f 73 28 74 2f 72 2a 28 4d 61 74 68 2e 50 49 2f 32 29 29 2b 69 2b 6e 7d 5d 2c 22 65 61 73 65 2d 6f 75 74 2d 73 69 6e 65 22 3a 5b 22 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 33 39 30 2c 20 30 2e 35 37 35 2c 20 30 2e 35 36 35 2c 20 31 29 22 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 69 2c 72 29 7b 72 65 74 75 72 6e 20 69 2a 4d 61 74 68 2e 73 69 6e 28 74 2f 72 2a 28 4d 61 74 68 2e 50 49 2f 32 29 29 2b 6e 7d 5d 2c 22 65 61 73 65 2d 69 6e 2d 6f 75 74 2d 73 69 6e 65 22 3a 5b 22 63 75 62 69 63 2d 62 65 7a 69 Data Ascii: se-in-sine":["cubic-bezier(0.470, 0, 0.745, 0.715)",function(t,n,i,r){return-iMath.cos(t/r(Math.PI/2))+i+n}],"ease-out-sine":["cubic-bezier(0.390, 0.575, 0.565, 1)",function(t,n,i,r){return iMath.sin(t/r(Math.PI/2))+n}],"ease-in-out-sine":["cubic-bezi
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 26 26 28 73 3d 31 2e 37 30 31 35 38 29 2c 69 2a 28 28 74 3d 74 2f 72 2d 31 29 2a 74 2a 28 28 73 2b 31 29 2a 74 2b 73 29 2b 31 29 2b 6e 7d 5d 2c 22 65 61 73 65 2d 69 6e 2d 6f 75 74 2d 62 61 63 6b 22 3a 5b 22 63 75 62 69 63 2d 62 65 7a 69 65 72 28 30 2e 36 38 30 2c 20 2d 30 2e 35 35 30 2c 20 30 2e 32 36 35 2c 20 31 2e 35 35 30 29 22 2c 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 69 2c 72 2c 73 29 7b 72 65 74 75 72 6e 20 73 3d 3d 3d 76 6f 69 64 20 30 26 26 28 73 3d 31 2e 37 30 31 35 38 29 2c 28 74 2f 3d 72 2f 32 29 3c 31 3f 69 2f 32 2a 74 2a 74 2a 28 28 28 73 2a 3d 31 2e 35 32 35 29 2b 31 29 2a 74 2d 73 29 2b 6e 3a 69 2f 32 2a 28 28 74 2d 3d 32 29 2a 74 2a 28 28 28 73 2a 3d 31 2e 35 32 35 29 2b 31 29 2a 74 2b 73 29 2b 32 29 2b 6e 7d 5d 7d 2c 57 3d 7b 22 65 61 73 Data Ascii: &&(s=1.70158),i((t=t/r-1)t((s+1)t+s)+1)+n}],"ease-in-out-back":["cubic-bezier(0.680, -0.550, 0.265, 1.550)",function(t,n,i,r,s){return s===void 0&&(s=1.70158),(t/=r/2)<1?i/2tt(((s=1.525)+1)t-s)+n:i/2((t-=2)t(((s=1.525)+1)t+s)+2)+n}]},W={"eas
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 72 61 6d 65 7c 7c 48 2e 6d 73 52 65 71 75 65 73 74 41 6e 69 6d 61 74 69 6f 6e 46 72 61 6d 65 3b 72 65 74 75 72 6e 20 74 26 26 68 2e 62 69 6e 64 3f 74 2e 62 69 6e 64 28 48 29 3a 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 48 2e 73 65 74 54 69 6d 65 6f 75 74 28 6e 2c 31 36 29 7d 7d 28 29 2c 63 74 3d 79 2e 6e 6f 77 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 3d 48 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2c 6e 3d 74 26 26 28 74 2e 6e 6f 77 7c 7c 74 2e 77 65 62 6b 69 74 4e 6f 77 7c 7c 74 2e 6d 73 4e 6f 77 7c 7c 74 2e 6d 6f 7a 4e 6f 77 29 3b 72 65 74 75 72 6e 20 6e 26 26 68 2e 62 69 6e 64 3f 6e 2e 62 69 6e 64 28 74 29 3a 44 61 74 65 2e 6e 6f 77 7c 7c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 2b 6e 65 77 20 44 61 74 65 7d 7d 28 29 2c 70 74 3d 50 28 66 75 6e Data Ascii: rame\|\|H.msRequestAnimationFrame;return t&&h.bind?t.bind(H):function(n){H.setTimeout(n,16)}}(),ct=y.now=function(){var t=H.performance,n=t&&(t.now\|\|t.webkitNow\|\|t.msNow\|\|t.mozNow);return n&&h.bind?n.bind(t):Date.now\|\|function(){return+new Date}}(),pt=P(fun
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 70 74 69 6f 6e 73 3a 77 7d 29 3a 28 74 68 69 73 2e 74 69 6d 65 72 3d 6e 65 77 20 71 74 28 7b 64 75 72 61 74 69 6f 6e 3a 77 2c 63 6f 6e 74 65 78 74 3a 74 68 69 73 2c 63 6f 6d 70 6c 65 74 65 3a 6f 7d 29 2c 74 68 69 73 2e 61 63 74 69 76 65 3d 21 30 29 7d 66 75 6e 63 74 69 6f 6e 20 73 28 77 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 61 63 74 69 76 65 3f 28 74 68 69 73 2e 71 75 65 75 65 2e 70 75 73 68 28 7b 6f 70 74 69 6f 6e 73 3a 77 2c 61 72 67 73 3a 61 72 67 75 6d 65 6e 74 73 7d 29 2c 76 6f 69 64 28 74 68 69 73 2e 74 69 6d 65 72 2e 63 6f 6d 70 6c 65 74 65 3d 6f 29 29 3a 42 28 22 4e 6f 20 61 63 74 69 76 65 20 74 72 61 6e 73 69 74 69 6f 6e 20 74 69 6d 65 72 2e 20 55 73 65 20 73 74 61 72 74 28 29 20 6f 72 20 77 61 69 74 28 29 20 62 65 66 6f 72 65 20 74 68 65 6e Data Ascii: ptions:w}):(this.timer=new qt({duration:w,context:this,complete:o}),this.active=!0)}function s(w){return this.active?(this.queue.push({options:w,args:arguments}),void(this.timer.complete=o)):B("No active transition timer. Use start() or wait() before then
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 26 59 2e 63 61 6c 6c 28 74 68 69 73 2c 6e 74 29 7d 66 75 6e 63 74 69 6f 6e 20 6a 28 77 29 7b 77 2e 73 74 6f 70 28 29 7d 66 75 6e 63 74 69 6f 6e 20 41 74 28 77 2c 4f 29 7b 77 2e 73 65 74 28 4f 29 7d 66 75 6e 63 74 69 6f 6e 20 67 65 28 77 29 7b 74 68 69 73 2e 24 65 6c 2e 63 73 73 28 77 29 7d 66 75 6e 63 74 69 6f 6e 20 6f 74 28 77 2c 4f 29 7b 74 5b 77 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 63 68 69 6c 64 72 65 6e 3f 79 65 2e 63 61 6c 6c 28 74 68 69 73 2c 4f 2c 61 72 67 75 6d 65 6e 74 73 29 3a 28 74 68 69 73 2e 65 6c 26 26 4f 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 2c 74 68 69 73 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 79 65 28 77 2c 4f 29 7b 76 61 72 20 59 2c 4e 3d 74 68 69 73 2e 63 68 69 6c 64 72 65 Data Ascii: &Y.call(this,nt)}function j(w){w.stop()}function At(w,O){w.set(O)}function ge(w){this.$el.css(w)}function ot(w,O){t[w]=function(){return this.children?ye.call(this,O,arguments):(this.el&&O.apply(this,arguments),this)}}function ye(w,O){var Y,N=this.childre
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 74 3d 66 75 6e 63 74 69 6f 6e 28 6f 2c 70 2c 78 2c 4b 29 7b 74 68 69 73 2e 24 65 6c 3d 6f 2c 74 68 69 73 2e 65 6c 3d 6f 5b 30 5d 3b 76 61 72 20 63 3d 70 5b 30 5d 3b 78 5b 32 5d 26 26 28 63 3d 78 5b 32 5d 29 2c 48 74 5b 63 5d 26 26 28 63 3d 48 74 5b 63 5d 29 2c 74 68 69 73 2e 6e 61 6d 65 3d 63 2c 74 68 69 73 2e 74 79 70 65 3d 78 5b 31 5d 2c 74 68 69 73 2e 64 75 72 61 74 69 6f 6e 3d 49 28 70 5b 31 5d 2c 74 68 69 73 2e 64 75 72 61 74 69 6f 6e 2c 73 2e 64 75 72 61 74 69 6f 6e 29 2c 74 68 69 73 2e 65 61 73 65 3d 69 28 70 5b 32 5d 2c 74 68 69 73 2e 65 61 73 65 2c 73 2e 65 61 73 65 29 2c 74 68 69 73 2e 64 65 6c 61 79 3d 49 28 70 5b 33 5d 2c 74 68 69 73 2e 64 65 6c 61 79 2c 73 2e 64 65 6c 61 79 29 2c 74 68 69 73 2e 73 70 61 6e 3d 74 68 69 73 2e 64 75 72 61 74 69 Data Ascii: t=function(o,p,x,K){this.$el=o,this.el=o[0];var c=p[0];x[2]&&(c=x[2]),Ht[c]&&(c=Ht[c]),this.name=c,this.type=x[1],this.duration=I(p[1],this.duration,s.duration),this.ease=i(p[2],this.ease,s.ease),this.delay=I(p[3],this.delay,s.delay),this.span=this.durati
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 74 53 74 79 6c 65 29 26 26 28 74 68 69 73 2e 61 63 74 69 76 65 3d 21 31 2c 74 68 69 73 2e 6e 65 78 74 53 74 79 6c 65 3d 6e 75 6c 6c 2c 62 74 28 74 68 69 73 2e 65 6c 2c 74 68 69 73 2e 6e 61 6d 65 2c 74 68 69 73 2e 67 65 74 28 29 29 29 3b 76 61 72 20 6f 3d 74 68 69 73 2e 74 77 65 65 6e 3b 6f 26 26 6f 2e 63 6f 6e 74 65 78 74 26 26 6f 2e 64 65 73 74 72 6f 79 28 29 7d 2c 74 2e 63 6f 6e 76 65 72 74 3d 66 75 6e 63 74 69 6f 6e 28 6f 2c 70 29 7b 69 66 28 6f 3d 3d 22 61 75 74 6f 22 26 26 74 68 69 73 2e 61 75 74 6f 29 72 65 74 75 72 6e 20 6f 3b 76 61 72 20 78 2c 4b 3d 74 79 70 65 6f 66 20 6f 3d 3d 22 6e 75 6d 62 65 72 22 2c 63 3d 74 79 70 65 6f 66 20 6f 3d 3d 22 73 74 72 69 6e 67 22 3b 73 77 69 74 63 68 28 70 29 7b 63 61 73 65 20 66 3a 69 66 28 4b 29 72 65 74 75 72 Data Ascii: tStyle)&&(this.active=!1,this.nextStyle=null,bt(this.el,this.name,this.get()));var o=this.tween;o&&o.context&&o.destroy()},t.convert=function(o,p){if(o=="auto"&&this.auto)return o;var x,K=typeof o=="number",c=typeof o=="string";switch(p){case f:if(K)retur

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49739	104.18.161.117	443	1944	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 10:17:52 UTC	654	OUT	GET /img/favicon.ico HTTP/1.1 Host: cdn.prod.website-files.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://login-gemini-auth.webflow.io/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 10:17:52 UTC	645	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 10:17:52 GMT Content-Type: image/x-icon Content-Length: 15086 Connection: close x-amz-id-2: QRs3q+dhKhAMTlvzYZ9HsOXkYLhQn66tiVr3vbhVW/V2FbAxceQ9QjMXwPqcyzjtLgD1BjyzKEE= x-amz-request-id: BSTN61CAHM9SMTMC Last-Modified: Thu, 05 Oct 2023 23:38:20 GMT ETag: "1f894f487d068a2ced95d5cd4f88598c" x-amz-server-side-encryption: AES256 Cache-Control: max-age=84600, must-revalidate x-amz-version-id: C5TuT6ObkzP1GjuEGkIHJatwDHqj5J6N CF-Cache-Status: HIT Age: 19173 Accept-Ranges: bytes Access-Control-Allow-Origin: * Server: cloudflare CF-RAY: 922c38f6ef6630d2-FRA alt-svc: h3=":443"; ma=86400
2025-03-19 10:17:52 UTC	724	IN	Data Raw: 00 00 01 00 03 00 30 30 00 00 01 00 20 00 a8 25 00 00 36 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 de 25 00 00 10 10 00 00 01 00 20 00 68 04 00 00 86 36 00 00 28 00 00 00 30 00 00 00 60 00 00 00 01 00 20 00 00 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 39 32 2b 88 39 32 2b f3 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 Data Ascii: 00 %6 % h6(0` $92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+9
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 Data Ascii: +92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+9
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 Data Ascii: 92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: f8 f8 f8 ff f8 f8 f8 ff f8 f8 f8 ff f7 f7 f7 ff 8e 8a 86 ff 37 30 29 ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 38 30 29 ff 50 49 43 ff e0 e0 df ff f8 f9 f9 ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f9 f9 f9 ff f9 f9 f9 ff e2 e1 e0 ff 9a 96 93 ff 4b 44 3e ff 44 3d 36 ff c9 c7 c5 ff f9 fa fa ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f9 f9 f9 ff d6 d5 d4 ff 4f 49 42 ff 38 31 29 ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b Data Ascii: 70)92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+80)PICKD>D=6OIB81)92+92+92+92+92+92+92+92+92+
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: f9 f9 ff de dd dc ff 56 50 4a ff 37 30 29 ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 38 31 2a ff 4b 45 3f ff c0 be bc ff d3 d2 d1 ff d2 d1 d0 ff d2 d1 d0 ff d1 cf ce ff d9 d8 d6 ff f5 f4 f4 ff f8 f8 f8 ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f8 f8 f8 ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f8 f8 f8 ff 9c 99 96 ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff Data Ascii: VPJ70)92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+81*KE?92+92+92+92+92+92+92+92+92+92+92+92+92+
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 3c 36 2f ff 53 4d 47 ff 57 51 4b ff 56 50 4b ff 56 50 4b ff 56 50 4b ff 57 51 4b ff 50 4a 44 ff 3b 34 2d ff 38 31 2a ff 41 3a 33 ff 56 50 4a ff 56 51 4b ff 56 50 4b ff 57 51 4b ff 54 4e 48 ff 3f 38 31 ff 39 32 2a ff 3a 33 2d ff 50 4a 44 ff 57 51 4b ff 56 50 4b ff 56 50 4b ff 56 50 4b ff 56 50 4b ff 57 51 4b ff 4f 49 43 ff 3a 33 2c ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 Data Ascii: +92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+<6/SMGWQKVPKVPKVPKWQKPJD;4-81A:3VPJVQKVPKWQKTNH?8192:3-PJDWQKVPKVPKVPKVPKWQKOIC:3,92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+9
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 Data Ascii: 92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b f3 39 32 2b 89 39 32 2b f4 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b Data Ascii: 92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff Data Ascii: 2+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 2b ff 39 32 2b ff 3c 35 2e ff 54 4e 48 ff 76 72 6d ff b2 b0 ad ff eb ea ea ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f8 f8 f8 ff f3 f3 f3 ff f6 f6 f6 ff f7 f7 f7 ff f7 f7 f7 ff f8 f8 f8 ff ef ef ef ff 72 6d 68 ff 36 2f 28 ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 3f 39 32 ff 68 63 5d ff 6e 69 64 ff 74 6f 6b ff b1 ae ab ff f5 f5 f5 ff f7 f8 f8 ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f8 f8 f8 ff f7 f7 f7 ff f7 f7 f7 ff fa fa fa ff c0 be bc ff 41 3b 34 ff 38 31 2a ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 Data Ascii: +92+<5.TNHvrmrmh6/(92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+?92hc]nidtokA;481*92+92+92+92+92+92+92+92+92+92+92+92+9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49740	104.18.160.117	443	1944	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 10:17:52 UTC	405	OUT	GET /img/favicon.ico HTTP/1.1 Host: cdn.prod.website-files.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-19 10:17:52 UTC	645	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 10:17:52 GMT Content-Type: image/x-icon Content-Length: 15086 Connection: close x-amz-id-2: QRs3q+dhKhAMTlvzYZ9HsOXkYLhQn66tiVr3vbhVW/V2FbAxceQ9QjMXwPqcyzjtLgD1BjyzKEE= x-amz-request-id: BSTN61CAHM9SMTMC Last-Modified: Thu, 05 Oct 2023 23:38:20 GMT ETag: "1f894f487d068a2ced95d5cd4f88598c" x-amz-server-side-encryption: AES256 Cache-Control: max-age=84600, must-revalidate x-amz-version-id: C5TuT6ObkzP1GjuEGkIHJatwDHqj5J6N CF-Cache-Status: HIT Age: 19173 Accept-Ranges: bytes Access-Control-Allow-Origin: * Server: cloudflare CF-RAY: 922c38f7be70d34c-FRA alt-svc: h3=":443"; ma=86400
2025-03-19 10:17:52 UTC	724	IN	Data Raw: 00 00 01 00 03 00 30 30 00 00 01 00 20 00 a8 25 00 00 36 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 de 25 00 00 10 10 00 00 01 00 20 00 68 04 00 00 86 36 00 00 28 00 00 00 30 00 00 00 60 00 00 00 01 00 20 00 00 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 39 32 2b 88 39 32 2b f3 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 Data Ascii: 00 %6 % h6(0` $92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+9
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 Data Ascii: +92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+9
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 Data Ascii: 92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: f8 f8 f8 ff f8 f8 f8 ff f8 f8 f8 ff f7 f7 f7 ff 8e 8a 86 ff 37 30 29 ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 38 30 29 ff 50 49 43 ff e0 e0 df ff f8 f9 f9 ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f9 f9 f9 ff f9 f9 f9 ff e2 e1 e0 ff 9a 96 93 ff 4b 44 3e ff 44 3d 36 ff c9 c7 c5 ff f9 fa fa ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f9 f9 f9 ff d6 d5 d4 ff 4f 49 42 ff 38 31 29 ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b Data Ascii: 70)92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+80)PICKD>D=6OIB81)92+92+92+92+92+92+92+92+92+
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: f9 f9 ff de dd dc ff 56 50 4a ff 37 30 29 ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 38 31 2a ff 4b 45 3f ff c0 be bc ff d3 d2 d1 ff d2 d1 d0 ff d2 d1 d0 ff d1 cf ce ff d9 d8 d6 ff f5 f4 f4 ff f8 f8 f8 ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f8 f8 f8 ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f8 f8 f8 ff 9c 99 96 ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff Data Ascii: VPJ70)92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+81*KE?92+92+92+92+92+92+92+92+92+92+92+92+92+
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 3c 36 2f ff 53 4d 47 ff 57 51 4b ff 56 50 4b ff 56 50 4b ff 56 50 4b ff 57 51 4b ff 50 4a 44 ff 3b 34 2d ff 38 31 2a ff 41 3a 33 ff 56 50 4a ff 56 51 4b ff 56 50 4b ff 57 51 4b ff 54 4e 48 ff 3f 38 31 ff 39 32 2a ff 3a 33 2d ff 50 4a 44 ff 57 51 4b ff 56 50 4b ff 56 50 4b ff 56 50 4b ff 56 50 4b ff 57 51 4b ff 4f 49 43 ff 3a 33 2c ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 Data Ascii: +92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+<6/SMGWQKVPKVPKVPKWQKPJD;4-81A:3VPJVQKVPKWQKTNH?8192:3-PJDWQKVPKVPKVPKVPKWQKOIC:3,92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+9
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 Data Ascii: 92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b f3 39 32 2b 89 39 32 2b f4 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b Data Ascii: 92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff Data Ascii: 2+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+
2025-03-19 10:17:52 UTC	1369	IN	Data Raw: 2b ff 39 32 2b ff 3c 35 2e ff 54 4e 48 ff 76 72 6d ff b2 b0 ad ff eb ea ea ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f8 f8 f8 ff f3 f3 f3 ff f6 f6 f6 ff f7 f7 f7 ff f7 f7 f7 ff f8 f8 f8 ff ef ef ef ff 72 6d 68 ff 36 2f 28 ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 3f 39 32 ff 68 63 5d ff 6e 69 64 ff 74 6f 6b ff b1 ae ab ff f5 f5 f5 ff f7 f8 f8 ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f7 f7 f7 ff f8 f8 f8 ff f7 f7 f7 ff f7 f7 f7 ff fa fa fa ff c0 be bc ff 41 3b 34 ff 38 31 2a ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 32 2b ff 39 Data Ascii: +92+<5.TNHvrmrmh6/(92+92+92+92+92+92+92+92+92+92+92+92+92+92+92+?92hc]nidtokA;481*92+92+92+92+92+92+92+92+92+92+92+92+9

Statistics

CPU Usage

• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Memory Usage

• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Click to jump to process

Target ID:	1
Start time:	06:17:41
Start date:	19/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	06:17:45
Start date:	19/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2288,i,14955263884636232288,2717798674688248820,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2320 /prefetch:3
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	06:17:51
Start date:	19/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://login-gemini-auth.webflow.io/"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://login-gemini-auth.webflow.io/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 5116, Parent PID: 4480

General

File Activities

File Opened

File Created

File Deleted

Windows Analysis Report
https://login-gemini-auth.webflow.io/