Edit tour

Windows Analysis Report
message__0XSkcQEiS5ehXOfhSk9JKw_geopod_ismtpd_30_.eml

Overview

General Information

Sample name:	message__0XSkcQEiS5ehXOfhSk9JKw_geopod_ismtpd_30_.eml
Analysis ID:	1641941
MD5:	11e0e238d10996702dcef9893e69bfba
SHA1:	2be67d6f4f21992b9dcc642154d174596a2f87b1
SHA256:	66101f19ed9097e71c47e841316729e51b48442dd77dbc9e75a2e38e48fdd60b
Infos:

Detection

HTMLPhisher, Invisible JS, Tycoon2FA

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Yara detected AntiDebug via timestamp check

Yara detected HtmlPhish10

Yara detected Invisible JS

Yara detected Obfuscation Via HangulCharacter

Yara detected Tycoon 2FA PaaS

AI detected suspicious Javascript

AI detected suspicious URL

AI detected suspicious elements in Email content

AI detected suspicious elements in Email header

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

Invalid T&C link found

Queries the volume information (name, serial number etc) of a device

Sigma detected: Office Autorun Keys Modification

Sigma detected: Outlook Security Settings Updated - Registry

Sigma detected: Suspicious Office Outbound Connections

Suricata IDS alerts with low severity for network traffic

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Classification

Process Tree

System is w10x64_ra

OUTLOOK.EXE (PID: 2468 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\message__0XSkcQEiS5ehXOfhSk9JKw_geopod_ismtpd_30_.eml" MD5: 91A5292942864110ED734005B7E005C0)

ai.exe (PID: 2460 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "A7DF7246-10A0-4098-9443-EDC4BD1936C6" "66FD239E-9DE5-46C9-9CD3-55A0C6CBD113" "2468" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)

chrome.exe (PID: 4604 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\RNAYJ7P1\9114950926.svg MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 3284 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1972,i,10470063623338701964,3264311356742323731,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_92	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
dropped/chromecache_92	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security

HTML

Source	Rule	Description	Author
1.7..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.1.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.1.d.script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
1.2.d.script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
1.2.d.script.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
1.0.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.0.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
1.0.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
2.12..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.12..script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
1.10.d.script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.13..script.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.13..script.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
1.1.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
1.1.pages.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
1.1.pages.csv	JoeSecurity_InvisibleJS	Yara detected Invisible JS	Joe Security
2.17.d.script.csv	JoeSecurity_Tycoon2FA	Yara detected Tycoon 2FA PaaS	Joe Security
2.19..script.csv	JoeSecurity_HangulCharacter	Yara detected Obfuscation Via HangulCharacter	Joe Security
2.3.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.3.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
2.3.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
2.4.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.4.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
2.4.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
2.5.pages.csv	JoeSecurity_Tycoon2FA_1	Yara detected Tycoon 2FA PaaS	Joe Security
2.5.pages.csv	JoeSecurity_AntiDebugBrowser	Yara detected AntiDebug via timestamp check	Joe Security
2.5.pages.csv	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security
Click to see the 22 entries

Sigma Signatures

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 2468, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

Sigma detected: Outlook Security Settings Updated - Registry

Source: Registry Key set

Author: frack113: Data: Details: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\RNAYJ7P1\, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 2468, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Security\OutlookSecureTempFolder

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.18, DestinationIsIpv6: false, DestinationPort: 49709, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, Initiated: true, ProcessId: 2468, Protocol: tcp, SourceIp: 52.123.131.14, SourceIsIpv6: false, SourcePort: 443

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXW

Joe Sandbox AI: Score: 9 Reasons: The brand 'Quilter' is associated with Quilter Cheviot, a known investment management company., The legitimate domain for Quilter Cheviot is 'quiltercheviot.com'., The provided URL 'quiltercheviot.uuvght.ru' does not match the legitimate domain., The domain extension '.ru' is unusual for a UK-based investment company like Quilter Cheviot., The presence of a password input field on a suspicious domain increases the risk of phishing. DOM: 2.4.pages.csv

Yara detected HtmlPhish10

Source: Yara match	File source: 2.3.pages.csv, type: HTML
Source: Yara match	File source: 2.4.pages.csv, type: HTML
Source: Yara match	File source: 2.5.pages.csv, type: HTML

Yara detected Invisible JS

Source: Yara match	File source: 1.2.d.script.csv, type: HTML
Source: Yara match	File source: 1.0.pages.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML

Yara detected Obfuscation Via HangulCharacter

Source: Yara match	File source: 1.2.d.script.csv, type: HTML
Source: Yara match	File source: 1.0.pages.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 2.19..script.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_92, type: DROPPED

Yara detected Tycoon 2FA PaaS

Source: Yara match	File source: 2.17.d.script.csv, type: HTML
Source: Yara match	File source: 1.7..script.csv, type: HTML
Source: Yara match	File source: 1.1.d.script.csv, type: HTML
Source: Yara match	File source: 1.0.pages.csv, type: HTML
Source: Yara match	File source: 2.12..script.csv, type: HTML
Source: Yara match	File source: 1.10.d.script.csv, type: HTML
Source: Yara match	File source: 2.13..script.csv, type: HTML
Source: Yara match	File source: 1.1.pages.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML
Source: Yara match	File source: 2.4.pages.csv, type: HTML
Source: Yara match	File source: 2.5.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 1.3..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://quiltercheviot.uuvght.ru/nTJ777/... The script contains obfuscated code and URLs, uses dynamic code execution with eval, and interacts with a suspicious domain (pq.uuvght.ru). These high-risk indicators suggest potentially malicious behavior.
Source: 1.2.d.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: anonymous function... The script uses dynamic code execution via eval, which is a high-risk indicator. It also contains obfuscated code, another high-risk indicator. These behaviors suggest potential malicious intent, especially given the lack of transparency and the use of obfuscation.
Source: 0.0..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://y13tzxbjz1.moydow.de/DzC0pn01Csl0xBhEB8ZuB... The script constructs a URL using a potentially extracted subdomain from an email or a random string, then redirects to a suspicious domain (uuvght.ru). This behavior is indicative of phishing or malicious redirection, as it manipulates the URL and redirects without user consent. The use of a suspicious domain and the redirection logic contribute to a high-risk score.
Source: 1.9..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://quiltercheviot.uuvght.ru/nTJ777/... The script uses dynamic code execution via the Function constructor with base64-decoded content, which is a high-risk indicator. It also manipulates the window location to redirect to 'about:blank' and potentially 'https://google.com', suggesting suspicious behavior. The use of obfuscated code and potential data exfiltration or redirection to untrusted domains further increases the risk.

AI detected suspicious URL

Source: https://quiltercheviot.uuvght.ru

Joe Sandbox AI: The URL 'https://quiltercheviot.uuvght.ru' appears to be targeting the brand 'Quilter Cheviot', a known investment management firm. The domain 'uuvght.ru' does not have any clear association with Quilter Cheviot, and the use of a '.ru' domain extension could be misleading, as it is not the typical domain extension used by the legitimate brand. The subdomain 'quiltercheviot' directly uses the brand name, which increases the likelihood of user confusion. There are no obvious character substitutions, but the structural use of the brand name in the subdomain suggests a potential typosquatting attempt. The similarity score is high due to the direct use of the brand name, and the spoofed score is also high due to the misleading domain extension and potential for user confusion.

AI detected suspicious elements in Email content

Source: Email

Joe Sandbox AI: Detected potential phishing email: Sender domain 'servis.ai' does not match the claimed sender organization 'quiltercheviot.com'. SVG attachment is a high-risk file type commonly used in phishing attacks. Generic printer notification format but using suspicious domain and mismatched sender info

AI detected suspicious elements in Email header

Source: Email

Joe Sandbox AI: Detected suspicious elements in Email header: Proofpoint spam details indicate a high phish score of 100, suggesting phishing intent.. Received header shows an unknown sender IP [100.64.100.6], which is suspicious.. Proofpoint classifier explicitly labels the email as 'phish'.. Priority score of 1501 in Proofpoint headers indicates high risk.. No authentication results provided, increasing suspicion.

Source: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXW

HTTP Parser: Number of links: 0

Source: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXW

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://quiltercheviot.uuvght.ru/nTJ777/#Krichard.thorn%40quiltercheviot.com

HTTP Parser: Base64 decoded: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Graphic Card Web Template</title> <style> body { font-family: 'Montserrat', sa...

Source: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXW

HTTP Parser: Title: Enter Protected Profile Access does not match URL

Source: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXW	HTTP Parser: Invalid link: Terms of use
Source: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXW	HTTP Parser: Invalid link: Privacy & cookies
Source: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXW	HTTP Parser: Invalid link: Terms of use
Source: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXW	HTTP Parser: Invalid link: Privacy & cookies
Source: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXW	HTTP Parser: Invalid link: Terms of use
Source: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXW	HTTP Parser: Invalid link: Privacy & cookies

Source: https://quiltercheviot.uuvght.ru/nTJ777/	HTTP Parser: function jqeshhapyd(){mldwokqpiy = atob("pcfet0nuwvbfigh0bww+cjxodg1sigxhbmc9imvuij4kpghlywq+ciagica8bwv0ysbjagfyc2v0psjvveytoci+ciagica8bwv0ysbuyw1lpsj2awv3cg9ydcigy29udgvudd0id2lkdgg9zgv2awnllxdpzhrolcbpbml0awfslxnjywxlpteumci+ciagica8dgl0bgu+qukgvukgvgvtcgxhdgu8l3rpdgxlpgogicagphn0ewxlpgogicagicagigjvzhkgewogicagicagicagicbmb250lwzhbwlsetogj1nlz29lifvjjywgvgfob21hlcbhzw5ldmesifzlcmrhbmesihnhbnmtc2vyawy7ciagicagicagicagigjhy2tncm91bmqty29sb3i6icmxytfhmwe7ciagicagicagicagignvbg9yoiajztblmguwowogicagicagicagicbtyxjnaw46ida7ciagicagicagicagihbhzgrpbmc6ida7ciagicagicagicagigxpbmutagvpz2h0oiaxljy7ciagicagicagfqogicagicagighlywrlcib7ciagicagicagicagigjhy2tncm91bmqty29sb3i6icmwzdq3yte7ciagicagicagicagihbhzgrpbmc6idiwchg7ciagicagicagicagihrlehqtywxpz246ignlbnrlcjskicagicagicagicagym9yzgvylwjvdhrvbtogmnb4ihnvbglkicm2ngi1zjy7ciagicagicagfqogicagicagighlywrlcibomsb7ciagicagicagicagig1hcmdpbjogmdskicagicagicagicagzm9udc1zaxploiazmnb4owogicagicagicagicbjb2xvcjogi2zmzmzmzjskicagicagicb9ciagicagicagbmf2ihskicagicagicagi...
Source: anonymous function	HTTP Parser: var otherweburl = "";var websitenames = ["godaddy", "okta"];var bes = ["apple.com","netflix.com"];var pes = ["https:\/\/t.me\/","https:\/\/t.com\/","t.me\/","https:\/\/t.me.com\/","t.me.com\/","t.me@","https:\/\/t.me@","https:\/\/t.me","https:\/\/t.com","t.me","https:\/\/t.me.com","t.me.com","t.me\/@","https:\/\/t.me\/@","https:\/\/t.me@\/","t.me@\/","https:\/\/www.telegram.me\/","https:\/\/www.telegram.me"];var capnum = 1;var appnum = 1;var pvn = 0;var view = "";var pagelinkval = "x6avo";var emailcheck = "richard.thorn@quiltercheviot.com";var webname = "rtrim(/web9/, '/')";var urlo = "/xhssg433q0vlfxw282t0j4tzvt2ieeywr92lvd7p2bpmjtla0peiebuzk";var gdf = "/ghdqwdfam7lugmdptisbtuvuhs8drb9m344njmtijab116";var odf = "/ghlxxpzqvplzj9q6lp9y3e0fyzccmejen5dmcd648";var twa = 0;var currentreq = null;var requestsent = false;var pagedata = "";var redirecturl = "";var useragent = navigator.useragent;var browsername;var userip;var usercountry;var errorcodeexecuted = false;...

Source: Email

Classification: Credential Stealer

Source: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXW

HTTP Parser: <input type="password" .../> found

Source: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXW	HTTP Parser: No favicon
Source: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXW	HTTP Parser: No favicon
Source: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXW	HTTP Parser: No favicon

Source: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXW	HTTP Parser: No <meta name="author".. found
Source: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXW	HTTP Parser: No <meta name="author".. found
Source: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXW	HTTP Parser: No <meta name="author".. found

Source: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXW	HTTP Parser: No <meta name="copyright".. found
Source: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXW	HTTP Parser: No <meta name="copyright".. found
Source: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXW	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 104.21.13.170:443 -> 192.168.2.18:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.194.137:443 -> 192.168.2.18:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.18:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.18:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.3.189:443 -> 192.168.2.18:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.6.189:443 -> 192.168.2.18:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.228:443 -> 192.168.2.18:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.18:49931 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.18:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.18:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.18:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.187.14:443 -> 192.168.2.18:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.187.14:443 -> 192.168.2.18:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.18:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.187.14:443 -> 192.168.2.18:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.187.14:443 -> 192.168.2.18:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.1.100:443 -> 192.168.2.18:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.70.233:443 -> 192.168.2.18:50048 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.18:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.18:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.101.182.112:443 -> 192.168.2.18:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.101.182.112:443 -> 192.168.2.18:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.101.182.112:443 -> 192.168.2.18:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.101.182.112:443 -> 192.168.2.18:50054 version: TLS 1.2

Source: Network traffic

Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.18:49709 -> 52.123.131.14:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.131
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.185.131
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /DzC0pn01Csl0xBhEB8ZuBtzVkjUWPyAfYsoLARTnALcLCFnUCNW3DjobhQoJgtJFVwG9u3yxgKVJMxgGbRx2il5WBIbQaIcwT3MQa1jsOGLaAtedE1h9IThKR1LyVBhvwGIHHPsd60cpE2A5rtuhv6I2WjwtnliaqoT9XvtUNVLGJLs5tZQLcBfyptubL9vuVj1dixwg/dOGmOwe0jJcVHNyok9MfrN8x9KudV9hVKZoxRp1y2BOwFcLtHoWhYg7sREANrsfv3A5AfpiuKKaytzguSjLIsQ5RSezJDRkc6zjndnbLTWsxuI8keuUDUfnjzGiSaqgraw5zZ8KKB2TN4ykt2uTP8cCO2lsCahG3cVrtiyW29K12PSaLO0lWjUIFTWblxnTfKoo78ZNc/richard.thorn@quiltercheviot.com HTTP/1.1Host: y13tzxbjz1.moydow.deConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /nTJ777/ HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://y13tzxbjz1.moydow.de/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.6.0.min.js HTTP/1.1Host: code.jquery.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://quiltercheviot.uuvght.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://quiltercheviot.uuvght.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://quiltercheviot.uuvght.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/g/f3b948d8acb8/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://quiltercheviot.uuvght.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://quiltercheviot.uuvght.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.png HTTP/1.1Host: developers.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=Ev.6e0aaynRUW36WCCSZGHBefEEcfHtcDODN2DdMIEA-1742311364-1.0.1.1-7kfjjN0PAsffeadubXqsJwpQppYQgTQdDasUfZsEYMvQkb0u2rtd0Y4uIJJGaHUtGpeb4vzl3gan2ZtBbl.YjjTaf4YWVCTOpkYxtMK8HJ4
Source: global traffic	HTTP traffic detected: GET /tarboz@u106ot9 HTTP/1.1Host: v36ix.szsnqp.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Origin: https://quiltercheviot.uuvght.ruSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://quiltercheviot.uuvght.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tarboz@u106ot9 HTTP/1.1Host: v36ix.szsnqp.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /nTJ777/ HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://quiltercheviot.uuvght.ru/nTJ777/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InFnbDZlbU4rWVdzbEg1N1FwbDd2ZVE9PSIsInZhbHVlIjoiN0QzUE0zMjY5Y0xDajYwS1d1OXhyR1doZ3p2Njc5VU1ZSjFQQm9IWjI1Yy91NTFpVzRkbldCOFRNb1ZvUVI5U1NnRUNhUHZIdGpKR2dHL2doWWROTDFkYXBkR0xZd24xK29TT2k0YmVYWXNiOFVkMGlSYjU3Vm5RRXNmd1NCN0EiLCJtYWMiOiJhNDQ0MzcwMmRjZTkxOTA3NGY5MjVhY2I3YmUzZDAxNGUyOTQxMTUxZTlhNTQzNDZmYjk3NTA5OTBkZDlkMjQyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjdraXFyMzhLN3U4WWwwZW5ETTNCZXc9PSIsInZhbHVlIjoiL0MyaXd0dStFb3VCQWt5d1dRUWNqbXNKT1luRlEvRFRxcXBGZlBUTWM4WENta1ZhRmhPbmQzZGcxVkk4Q0Rnc3dOOHMybGJGeitpNTNwLzJEelJEajF4MDFHWCt2c25tSUk2b082aTlob21HaHpqa2FsSWxDU1RQbWZQdk1YdkwiLCJtYWMiOiIzOWM2MGJkMjI1ZDRiZWE5MGMyMmZlZGVkOGEwNjQ4NTYxMjRlYjU0ODNmZjMxNzk2ZWNhMGJhNmNjMGMwMzNkIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /tdl2unv9gDV7gebvSTx8fq6Qo8kD8UATTsu HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6InFnbDZlbU4rWVdzbEg1N1FwbDd2ZVE9PSIsInZhbHVlIjoiN0QzUE0zMjY5Y0xDajYwS1d1OXhyR1doZ3p2Njc5VU1ZSjFQQm9IWjI1Yy91NTFpVzRkbldCOFRNb1ZvUVI5U1NnRUNhUHZIdGpKR2dHL2doWWROTDFkYXBkR0xZd24xK29TT2k0YmVYWXNiOFVkMGlSYjU3Vm5RRXNmd1NCN0EiLCJtYWMiOiJhNDQ0MzcwMmRjZTkxOTA3NGY5MjVhY2I3YmUzZDAxNGUyOTQxMTUxZTlhNTQzNDZmYjk3NTA5OTBkZDlkMjQyIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjdraXFyMzhLN3U4WWwwZW5ETTNCZXc9PSIsInZhbHVlIjoiL0MyaXd0dStFb3VCQWt5d1dRUWNqbXNKT1luRlEvRFRxcXBGZlBUTWM4WENta1ZhRmhPbmQzZGcxVkk4Q0Rnc3dOOHMybGJGeitpNTNwLzJEelJEajF4MDFHWCt2c25tSUk2b082aTlob21HaHpqa2FsSWxDU1RQbWZQdk1YdkwiLCJtYWMiOiIzOWM2MGJkMjI1ZDRiZWE5MGMyMmZlZGVkOGEwNjQ4NTYxMjRlYjU0ODNmZjMxNzk2ZWNhMGJhNmNjMGMwMzNkIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://quiltercheviot.uuvght.ru/nTJ777/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IkN3OFJvK0ZVYUZQb1ZEWW02OHcraGc9PSIsInZhbHVlIjoiS3gwODN1SFhSZ3o3Y3RrK0YrMWk1WDAzUFdveFhqbW0xb1pQckt2cDZJQld3cHFlaXBiTnBYTlZIbmw1cFgzclltVUZIc0g5eFdZaDA4WjRwSnp6YWswN3pTMU56ODZHNmtTc2xqMFNNcVptTW1zZnR2dElGWE1NbklmM2lxSEkiLCJtYWMiOiI2OGY5YjJmYzRkZmM3NzI5ZWQ3YjY2MTY4MGFhZmNlNDhiM2M3MDc4NTdmZGMxNzNkM2NmM2NkNzI5MjVlZWZhIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlltVWVDMG1lSm5tcW90eUN2aUxRVEE9PSIsInZhbHVlIjoicTkrL20yWnJOT3E5ZllNcWdEMWY5dXJpUkl2UlZRM0RPcU5vOGpwekxOK1J4OEcyQ20vM0xwQkJhOHZQc0Z1Ym5QK3JuYWcrSEJjREtpUW9Penl2TjdLOXh3bkIyRDIrbEtZWmdwaG5YTnBDSks3U1FYTGFMZVoySkw1NGV3VmsiLCJtYWMiOiIzODExMWQ4MTYzYWYyMThhZGQ1ODRiZjI2N2NiZjY1YzQ2ZTNhZGM4Mjk2YmYxNGE1NDI3YzQzZmE4OGFhNjlhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /rq6hFLBxsRd99C5DxuUMgquYKDtkJqNXasAmjDrY34q9gy HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Inl0bWlhakhvRU91NjEzOUdpS1BiUUE9PSIsInZhbHVlIjoiZ3J1MEhma3BsdGJPR1l6eXk4clVndmNob015MjRsSERWQ1pvUEtGN05ZNUpnaUlqOEJ6MnR3WXF3K0FpN1N5blhsUEZIZlh3Q1p5ZHBoemJKNUlkN2lJYkkwQmw5SFBjeDhqL0xIUDdNdlI5N1VRVUhGcjI3ajY4a1RjazRXQW0iLCJtYWMiOiJmMmQzYWU4YmFjYTUxMGJlOWRhZmYxZGUzNTM0NzNmZTc5MTI0YzVhYjZiZjdmMzIxNDg1NDc3MDdjYjUyYTc0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkVtalBQUGNiclhHdmJyQW9abnJnTGc9PSIsInZhbHVlIjoidElKSW9JNGpXZ1d1VVdYT1pFSnVsZEZIQXM1eFdkQWdML0M2VDhZcC83UHdyc1FuWDNZOHgzcG1TbHhPa200d09KMURGVU5XRlVSa2J3eWE0alNNdWdTMytoNkZPNCt6YVZKMGlOKzh2d0RVbUZHTE5NL0F2eGxKTzF3WURsMFciLCJtYWMiOiI5Y2QxODk4MTE5ZDg4ZDI3MzdkMjk3OWQwYWQ2ZmI5MThmYzU1ZjU2ODdjOTE4MWNjNjU2N2MzMTJhZGUwYjU3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXW HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://quiltercheviot.uuvght.ru/nTJ777/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Inl0bWlhakhvRU91NjEzOUdpS1BiUUE9PSIsInZhbHVlIjoiZ3J1MEhma3BsdGJPR1l6eXk4clVndmNob015MjRsSERWQ1pvUEtGN05ZNUpnaUlqOEJ6MnR3WXF3K0FpN1N5blhsUEZIZlh3Q1p5ZHBoemJKNUlkN2lJYkkwQmw5SFBjeDhqL0xIUDdNdlI5N1VRVUhGcjI3ajY4a1RjazRXQW0iLCJtYWMiOiJmMmQzYWU4YmFjYTUxMGJlOWRhZmYxZGUzNTM0NzNmZTc5MTI0YzVhYjZiZjdmMzIxNDg1NDc3MDdjYjUyYTc0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkVtalBQUGNiclhHdmJyQW9abnJnTGc9PSIsInZhbHVlIjoidElKSW9JNGpXZ1d1VVdYT1pFSnVsZEZIQXM1eFdkQWdML0M2VDhZcC83UHdyc1FuWDNZOHgzcG1TbHhPa200d09KMURGVU5XRlVSa2J3eWE0alNNdWdTMytoNkZPNCt6YVZKMGlOKzh2d0RVbUZHTE5NL0F2eGxKTzF3WURsMFciLCJtYWMiOiI5Y2QxODk4MTE5ZDg4ZDI3MzdkMjk3OWQwYWQ2ZmI5MThmYzU1ZjU2ODdjOTE4MWNjNjU2N2MzMTJhZGUwYjU3IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /56ybfCjabGpJyUZ8916 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXWAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjRaQVhzTEFKNVk1TEJCYXQ2UUdTVkE9PSIsInZhbHVlIjoiQTFCbDNLM2ZvOGd5dXNWSWxXTjZENVN3ckV4L0R4cVRrYVpFYk1VODd5RHhJU01UVFBPZkxtd2lFYXVlRU5vTDZ0REZpemNPL21qMEdndVc5c09UK0xIRHpPY25WbjNUM2hOU1lNZ1liaVp1cVdVcVZWZzNwRndzaEQ3cFUveUIiLCJtYWMiOiIzYTI2ZTJmZmU2ZTNhYTI0MjQ2Y2YzMGQzNDVhMmQzZDU0Mzg0ZjlmYzFlMTVmN2RiYWU0NjkwMWM2NzZiMjU3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkNTMTBOaDB3alpaMllPVGl4dXNYVmc9PSIsInZhbHVlIjoiZ3JlZnF0dWtaeHN2RTJVVDJqTjY0TU12ditIeWdDNzF6TzNYMThrREFBcEJ2SUhkVy9TWW5IZXVIczNqeFIvcS9mME5XTUZTT3EvRU54Z2IrWCtzaFZsVnExRXpFelhRNVRwVk16clRFRUZiMzFKQklGVTdlWGgxcEU1RmltOG8iLCJtYWMiOiI4MDYzOTUxNzNiZjQwNTE2MzBlYTNkOWEyOTk0MjAxZTQ5NzViY2Y2ODQ3MDFjZjNmNmE4ZjFlYzY3OTVhZGM4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /xyrN6azxUjCRpqSzcd26 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXWAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjRaQVhzTEFKNVk1TEJCYXQ2UUdTVkE9PSIsInZhbHVlIjoiQTFCbDNLM2ZvOGd5dXNWSWxXTjZENVN3ckV4L0R4cVRrYVpFYk1VODd5RHhJU01UVFBPZkxtd2lFYXVlRU5vTDZ0REZpemNPL21qMEdndVc5c09UK0xIRHpPY25WbjNUM2hOU1lNZ1liaVp1cVdVcVZWZzNwRndzaEQ3cFUveUIiLCJtYWMiOiIzYTI2ZTJmZmU2ZTNhYTI0MjQ2Y2YzMGQzNDVhMmQzZDU0Mzg0ZjlmYzFlMTVmN2RiYWU0NjkwMWM2NzZiMjU3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkNTMTBOaDB3alpaMllPVGl4dXNYVmc9PSIsInZhbHVlIjoiZ3JlZnF0dWtaeHN2RTJVVDJqTjY0TU12ditIeWdDNzF6TzNYMThrREFBcEJ2SUhkVy9TWW5IZXVIczNqeFIvcS9mME5XTUZTT3EvRU54Z2IrWCtzaFZsVnExRXpFelhRNVRwVk16clRFRUZiMzFKQklGVTdlWGgxcEU1RmltOG8iLCJtYWMiOiI4MDYzOTUxNzNiZjQwNTE2MzBlYTNkOWEyOTk0MjAxZTQ5NzViY2Y2ODQ3MDFjZjNmNmE4ZjFlYzY3OTVhZGM4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-bold.woff2 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-aliveOrigin: https://quiltercheviot.uuvght.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXWAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjRaQVhzTEFKNVk1TEJCYXQ2UUdTVkE9PSIsInZhbHVlIjoiQTFCbDNLM2ZvOGd5dXNWSWxXTjZENVN3ckV4L0R4cVRrYVpFYk1VODd5RHhJU01UVFBPZkxtd2lFYXVlRU5vTDZ0REZpemNPL21qMEdndVc5c09UK0xIRHpPY25WbjNUM2hOU1lNZ1liaVp1cVdVcVZWZzNwRndzaEQ3cFUveUIiLCJtYWMiOiIzYTI2ZTJmZmU2ZTNhYTI0MjQ2Y2YzMGQzNDVhMmQzZDU0Mzg0ZjlmYzFlMTVmN2RiYWU0NjkwMWM2NzZiMjU3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkNTMTBOaDB3alpaMllPVGl4dXNYVmc9PSIsInZhbHVlIjoiZ3JlZnF0dWtaeHN2RTJVVDJqTjY0TU12ditIeWdDNzF6TzNYMThrREFBcEJ2SUhkVy9TWW5IZXVIczNqeFIvcS9mME5XTUZTT3EvRU54Z2IrWCtzaFZsVnExRXpFelhRNVRwVk16clRFRUZiMzFKQklGVTdlWGgxcEU1RmltOG8iLCJtYWMiOiI4MDYzOTUxNzNiZjQwNTE2MzBlYTNkOWEyOTk0MjAxZTQ5NzViY2Y2ODQ3MDFjZjNmNmE4ZjFlYzY3OTVhZGM4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-bold.woff HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-aliveOrigin: https://quiltercheviot.uuvght.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXWAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjRaQVhzTEFKNVk1TEJCYXQ2UUdTVkE9PSIsInZhbHVlIjoiQTFCbDNLM2ZvOGd5dXNWSWxXTjZENVN3ckV4L0R4cVRrYVpFYk1VODd5RHhJU01UVFBPZkxtd2lFYXVlRU5vTDZ0REZpemNPL21qMEdndVc5c09UK0xIRHpPY25WbjNUM2hOU1lNZ1liaVp1cVdVcVZWZzNwRndzaEQ3cFUveUIiLCJtYWMiOiIzYTI2ZTJmZmU2ZTNhYTI0MjQ2Y2YzMGQzNDVhMmQzZDU0Mzg0ZjlmYzFlMTVmN2RiYWU0NjkwMWM2NzZiMjU3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkNTMTBOaDB3alpaMllPVGl4dXNYVmc9PSIsInZhbHVlIjoiZ3JlZnF0dWtaeHN2RTJVVDJqTjY0TU12ditIeWdDNzF6TzNYMThrREFBcEJ2SUhkVy9TWW5IZXVIczNqeFIvcS9mME5XTUZTT3EvRU54Z2IrWCtzaFZsVnExRXpFelhRNVRwVk16clRFRUZiMzFKQklGVTdlWGgxcEU1RmltOG8iLCJtYWMiOiI4MDYzOTUxNzNiZjQwNTE2MzBlYTNkOWEyOTk0MjAxZTQ5NzViY2Y2ODQ3MDFjZjNmNmE4ZjFlYzY3OTVhZGM4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-regular.woff2 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-aliveOrigin: https://quiltercheviot.uuvght.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXWAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjRaQVhzTEFKNVk1TEJCYXQ2UUdTVkE9PSIsInZhbHVlIjoiQTFCbDNLM2ZvOGd5dXNWSWxXTjZENVN3ckV4L0R4cVRrYVpFYk1VODd5RHhJU01UVFBPZkxtd2lFYXVlRU5vTDZ0REZpemNPL21qMEdndVc5c09UK0xIRHpPY25WbjNUM2hOU1lNZ1liaVp1cVdVcVZWZzNwRndzaEQ3cFUveUIiLCJtYWMiOiIzYTI2ZTJmZmU2ZTNhYTI0MjQ2Y2YzMGQzNDVhMmQzZDU0Mzg0ZjlmYzFlMTVmN2RiYWU0NjkwMWM2NzZiMjU3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkNTMTBOaDB3alpaMllPVGl4dXNYVmc9PSIsInZhbHVlIjoiZ3JlZnF0dWtaeHN2RTJVVDJqTjY0TU12ditIeWdDNzF6TzNYMThrREFBcEJ2SUhkVy9TWW5IZXVIczNqeFIvcS9mME5XTUZTT3EvRU54Z2IrWCtzaFZsVnExRXpFelhRNVRwVk16clRFRUZiMzFKQklGVTdlWGgxcEU1RmltOG8iLCJtYWMiOiI4MDYzOTUxNzNiZjQwNTE2MzBlYTNkOWEyOTk0MjAxZTQ5NzViY2Y2ODQ3MDFjZjNmNmE4ZjFlYzY3OTVhZGM4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-regular.woff HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-aliveOrigin: https://quiltercheviot.uuvght.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXWAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjRaQVhzTEFKNVk1TEJCYXQ2UUdTVkE9PSIsInZhbHVlIjoiQTFCbDNLM2ZvOGd5dXNWSWxXTjZENVN3ckV4L0R4cVRrYVpFYk1VODd5RHhJU01UVFBPZkxtd2lFYXVlRU5vTDZ0REZpemNPL21qMEdndVc5c09UK0xIRHpPY25WbjNUM2hOU1lNZ1liaVp1cVdVcVZWZzNwRndzaEQ3cFUveUIiLCJtYWMiOiIzYTI2ZTJmZmU2ZTNhYTI0MjQ2Y2YzMGQzNDVhMmQzZDU0Mzg0ZjlmYzFlMTVmN2RiYWU0NjkwMWM2NzZiMjU3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkNTMTBOaDB3alpaMllPVGl4dXNYVmc9PSIsInZhbHVlIjoiZ3JlZnF0dWtaeHN2RTJVVDJqTjY0TU12ditIeWdDNzF6TzNYMThrREFBcEJ2SUhkVy9TWW5IZXVIczNqeFIvcS9mME5XTUZTT3EvRU54Z2IrWCtzaFZsVnExRXpFelhRNVRwVk16clRFRUZiMzFKQklGVTdlWGgxcEU1RmltOG8iLCJtYWMiOiI4MDYzOTUxNzNiZjQwNTE2MzBlYTNkOWEyOTk0MjAxZTQ5NzViY2Y2ODQ3MDFjZjNmNmE4ZjFlYzY3OTVhZGM4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /fent/randexp.js/releases/download/v0.4.3/randexp.min.js HTTP/1.1Host: github.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://quiltercheviot.uuvght.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/sdk/okta-signin-widget/7.18.0/css/okta-sign-in.min.css HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://quiltercheviot.uuvght.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/loginpage/css/loginpage-theme.e0d37a504604ef874bad26435d62011f.css HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://quiltercheviot.uuvght.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/2925284/11f3acf8-4ccb-11e6-8ce4-c179c0a212de?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250318%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250318T152121Z&X-Amz-Expires=300&X-Amz-Signature=740f45a720998c47938f1f35aa27b630e9cecf67a7bc9d7db99a8bfda1749aba&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drandexp.min.js&response-content-type=application%2Foctet-stream HTTP/1.1Host: objects.githubusercontent.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://quiltercheviot.uuvght.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /GDSherpa-vf.woff2 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-aliveOrigin: https://quiltercheviot.uuvght.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXWAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjRaQVhzTEFKNVk1TEJCYXQ2UUdTVkE9PSIsInZhbHVlIjoiQTFCbDNLM2ZvOGd5dXNWSWxXTjZENVN3ckV4L0R4cVRrYVpFYk1VODd5RHhJU01UVFBPZkxtd2lFYXVlRU5vTDZ0REZpemNPL21qMEdndVc5c09UK0xIRHpPY25WbjNUM2hOU1lNZ1liaVp1cVdVcVZWZzNwRndzaEQ3cFUveUIiLCJtYWMiOiIzYTI2ZTJmZmU2ZTNhYTI0MjQ2Y2YzMGQzNDVhMmQzZDU0Mzg0ZjlmYzFlMTVmN2RiYWU0NjkwMWM2NzZiMjU3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkNTMTBOaDB3alpaMllPVGl4dXNYVmc9PSIsInZhbHVlIjoiZ3JlZnF0dWtaeHN2RTJVVDJqTjY0TU12ditIeWdDNzF6TzNYMThrREFBcEJ2SUhkVy9TWW5IZXVIczNqeFIvcS9mME5XTUZTT3EvRU54Z2IrWCtzaFZsVnExRXpFelhRNVRwVk16clRFRUZiMzFKQklGVTdlWGgxcEU1RmltOG8iLCJtYWMiOiI4MDYzOTUxNzNiZjQwNTE2MzBlYTNkOWEyOTk0MjAxZTQ5NzViY2Y2ODQ3MDFjZjNmNmE4ZjFlYzY3OTVhZGM4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /GDSherpa-vf2.woff2 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-aliveOrigin: https://quiltercheviot.uuvght.rusec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXWAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjRaQVhzTEFKNVk1TEJCYXQ2UUdTVkE9PSIsInZhbHVlIjoiQTFCbDNLM2ZvOGd5dXNWSWxXTjZENVN3ckV4L0R4cVRrYVpFYk1VODd5RHhJU01UVFBPZkxtd2lFYXVlRU5vTDZ0REZpemNPL21qMEdndVc5c09UK0xIRHpPY25WbjNUM2hOU1lNZ1liaVp1cVdVcVZWZzNwRndzaEQ3cFUveUIiLCJtYWMiOiIzYTI2ZTJmZmU2ZTNhYTI0MjQ2Y2YzMGQzNDVhMmQzZDU0Mzg0ZjlmYzFlMTVmN2RiYWU0NjkwMWM2NzZiMjU3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkNTMTBOaDB3alpaMllPVGl4dXNYVmc9PSIsInZhbHVlIjoiZ3JlZnF0dWtaeHN2RTJVVDJqTjY0TU12ditIeWdDNzF6TzNYMThrREFBcEJ2SUhkVy9TWW5IZXVIczNqeFIvcS9mME5XTUZTT3EvRU54Z2IrWCtzaFZsVnExRXpFelhRNVRwVk16clRFRUZiMzFKQklGVTdlWGgxcEU1RmltOG8iLCJtYWMiOiI4MDYzOTUxNzNiZjQwNTE2MzBlYTNkOWEyOTk0MjAxZTQ5NzViY2Y2ODQ3MDFjZjNmNmE4ZjFlYzY3OTVhZGM4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /34ffrvM4h24NzkkyD6SwzVMu9WijuexAcp9VzMOlBVr67107 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXWAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjRaQVhzTEFKNVk1TEJCYXQ2UUdTVkE9PSIsInZhbHVlIjoiQTFCbDNLM2ZvOGd5dXNWSWxXTjZENVN3ckV4L0R4cVRrYVpFYk1VODd5RHhJU01UVFBPZkxtd2lFYXVlRU5vTDZ0REZpemNPL21qMEdndVc5c09UK0xIRHpPY25WbjNUM2hOU1lNZ1liaVp1cVdVcVZWZzNwRndzaEQ3cFUveUIiLCJtYWMiOiIzYTI2ZTJmZmU2ZTNhYTI0MjQ2Y2YzMGQzNDVhMmQzZDU0Mzg0ZjlmYzFlMTVmN2RiYWU0NjkwMWM2NzZiMjU3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkNTMTBOaDB3alpaMllPVGl4dXNYVmc9PSIsInZhbHVlIjoiZ3JlZnF0dWtaeHN2RTJVVDJqTjY0TU12ditIeWdDNzF6TzNYMThrREFBcEJ2SUhkVy9TWW5IZXVIczNqeFIvcS9mME5XTUZTT3EvRU54Z2IrWCtzaFZsVnExRXpFelhRNVRwVk16clRFRUZiMzFKQklGVTdlWGgxcEU1RmltOG8iLCJtYWMiOiI4MDYzOTUxNzNiZjQwNTE2MzBlYTNkOWEyOTk0MjAxZTQ5NzViY2Y2ODQ3MDFjZjNmNmE4ZjFlYzY3OTVhZGM4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /kljLcPWShXHXVYYUU12tSUDv56HXYBL0GF0xXh47yqPLMdA7Eah01QPwx220 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXWAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjRaQVhzTEFKNVk1TEJCYXQ2UUdTVkE9PSIsInZhbHVlIjoiQTFCbDNLM2ZvOGd5dXNWSWxXTjZENVN3ckV4L0R4cVRrYVpFYk1VODd5RHhJU01UVFBPZkxtd2lFYXVlRU5vTDZ0REZpemNPL21qMEdndVc5c09UK0xIRHpPY25WbjNUM2hOU1lNZ1liaVp1cVdVcVZWZzNwRndzaEQ3cFUveUIiLCJtYWMiOiIzYTI2ZTJmZmU2ZTNhYTI0MjQ2Y2YzMGQzNDVhMmQzZDU0Mzg0ZjlmYzFlMTVmN2RiYWU0NjkwMWM2NzZiMjU3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkNTMTBOaDB3alpaMllPVGl4dXNYVmc9PSIsInZhbHVlIjoiZ3JlZnF0dWtaeHN2RTJVVDJqTjY0TU12ditIeWdDNzF6TzNYMThrREFBcEJ2SUhkVy9TWW5IZXVIczNqeFIvcS9mME5XTUZTT3EvRU54Z2IrWCtzaFZsVnExRXpFelhRNVRwVk16clRFRUZiMzFKQklGVTdlWGgxcEU1RmltOG8iLCJtYWMiOiI4MDYzOTUxNzNiZjQwNTE2MzBlYTNkOWEyOTk0MjAxZTQ5NzViY2Y2ODQ3MDFjZjNmNmE4ZjFlYzY3OTVhZGM4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /klet11CCZk79YbQutqnTSKM1JZecexnomL2CqqrpyZHGyJ74c2fkogJFPjUKjFZ1HDbo2ab224 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXWAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjRaQVhzTEFKNVk1TEJCYXQ2UUdTVkE9PSIsInZhbHVlIjoiQTFCbDNLM2ZvOGd5dXNWSWxXTjZENVN3ckV4L0R4cVRrYVpFYk1VODd5RHhJU01UVFBPZkxtd2lFYXVlRU5vTDZ0REZpemNPL21qMEdndVc5c09UK0xIRHpPY25WbjNUM2hOU1lNZ1liaVp1cVdVcVZWZzNwRndzaEQ3cFUveUIiLCJtYWMiOiIzYTI2ZTJmZmU2ZTNhYTI0MjQ2Y2YzMGQzNDVhMmQzZDU0Mzg0ZjlmYzFlMTVmN2RiYWU0NjkwMWM2NzZiMjU3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkNTMTBOaDB3alpaMllPVGl4dXNYVmc9PSIsInZhbHVlIjoiZ3JlZnF0dWtaeHN2RTJVVDJqTjY0TU12ditIeWdDNzF6TzNYMThrREFBcEJ2SUhkVy9TWW5IZXVIczNqeFIvcS9mME5XTUZTT3EvRU54Z2IrWCtzaFZsVnExRXpFelhRNVRwVk16clRFRUZiMzFKQklGVTdlWGgxcEU1RmltOG8iLCJtYWMiOiI4MDYzOTUxNzNiZjQwNTE2MzBlYTNkOWEyOTk0MjAxZTQ5NzViY2Y2ODQ3MDFjZjNmNmE4ZjFlYzY3OTVhZGM4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /klet11CCZk79YbQutqnTSKM1JZecexnomL2CqqrpyZHGyJ74c2fkogJFPjUKjFZ1HDbo2ab224 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjRaQVhzTEFKNVk1TEJCYXQ2UUdTVkE9PSIsInZhbHVlIjoiQTFCbDNLM2ZvOGd5dXNWSWxXTjZENVN3ckV4L0R4cVRrYVpFYk1VODd5RHhJU01UVFBPZkxtd2lFYXVlRU5vTDZ0REZpemNPL21qMEdndVc5c09UK0xIRHpPY25WbjNUM2hOU1lNZ1liaVp1cVdVcVZWZzNwRndzaEQ3cFUveUIiLCJtYWMiOiIzYTI2ZTJmZmU2ZTNhYTI0MjQ2Y2YzMGQzNDVhMmQzZDU0Mzg0ZjlmYzFlMTVmN2RiYWU0NjkwMWM2NzZiMjU3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkNTMTBOaDB3alpaMllPVGl4dXNYVmc9PSIsInZhbHVlIjoiZ3JlZnF0dWtaeHN2RTJVVDJqTjY0TU12ditIeWdDNzF6TzNYMThrREFBcEJ2SUhkVy9TWW5IZXVIczNqeFIvcS9mME5XTUZTT3EvRU54Z2IrWCtzaFZsVnExRXpFelhRNVRwVk16clRFRUZiMzFKQklGVTdlWGgxcEU1RmltOG8iLCJtYWMiOiI4MDYzOTUxNzNiZjQwNTE2MzBlYTNkOWEyOTk0MjAxZTQ5NzViY2Y2ODQ3MDFjZjNmNmE4ZjFlYzY3OTVhZGM4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /kljLcPWShXHXVYYUU12tSUDv56HXYBL0GF0xXh47yqPLMdA7Eah01QPwx220 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjRaQVhzTEFKNVk1TEJCYXQ2UUdTVkE9PSIsInZhbHVlIjoiQTFCbDNLM2ZvOGd5dXNWSWxXTjZENVN3ckV4L0R4cVRrYVpFYk1VODd5RHhJU01UVFBPZkxtd2lFYXVlRU5vTDZ0REZpemNPL21qMEdndVc5c09UK0xIRHpPY25WbjNUM2hOU1lNZ1liaVp1cVdVcVZWZzNwRndzaEQ3cFUveUIiLCJtYWMiOiIzYTI2ZTJmZmU2ZTNhYTI0MjQ2Y2YzMGQzNDVhMmQzZDU0Mzg0ZjlmYzFlMTVmN2RiYWU0NjkwMWM2NzZiMjU3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkNTMTBOaDB3alpaMllPVGl4dXNYVmc9PSIsInZhbHVlIjoiZ3JlZnF0dWtaeHN2RTJVVDJqTjY0TU12ditIeWdDNzF6TzNYMThrREFBcEJ2SUhkVy9TWW5IZXVIczNqeFIvcS9mME5XTUZTT3EvRU54Z2IrWCtzaFZsVnExRXpFelhRNVRwVk16clRFRUZiMzFKQklGVTdlWGgxcEU1RmltOG8iLCJtYWMiOiI4MDYzOTUxNzNiZjQwNTE2MzBlYTNkOWEyOTk0MjAxZTQ5NzViY2Y2ODQ3MDFjZjNmNmE4ZjFlYzY3OTVhZGM4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /wxEAvfh79xY931O7OkQQ5DeTPrst9wZU0uuvZgKtV34130 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXWAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjRaQVhzTEFKNVk1TEJCYXQ2UUdTVkE9PSIsInZhbHVlIjoiQTFCbDNLM2ZvOGd5dXNWSWxXTjZENVN3ckV4L0R4cVRrYVpFYk1VODd5RHhJU01UVFBPZkxtd2lFYXVlRU5vTDZ0REZpemNPL21qMEdndVc5c09UK0xIRHpPY25WbjNUM2hOU1lNZ1liaVp1cVdVcVZWZzNwRndzaEQ3cFUveUIiLCJtYWMiOiIzYTI2ZTJmZmU2ZTNhYTI0MjQ2Y2YzMGQzNDVhMmQzZDU0Mzg0ZjlmYzFlMTVmN2RiYWU0NjkwMWM2NzZiMjU3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkNTMTBOaDB3alpaMllPVGl4dXNYVmc9PSIsInZhbHVlIjoiZ3JlZnF0dWtaeHN2RTJVVDJqTjY0TU12ditIeWdDNzF6TzNYMThrREFBcEJ2SUhkVy9TWW5IZXVIczNqeFIvcS9mME5XTUZTT3EvRU54Z2IrWCtzaFZsVnExRXpFelhRNVRwVk16clRFRUZiMzFKQklGVTdlWGgxcEU1RmltOG8iLCJtYWMiOiI4MDYzOTUxNzNiZjQwNTE2MzBlYTNkOWEyOTk0MjAxZTQ5NzViY2Y2ODQ3MDFjZjNmNmE4ZjFlYzY3OTVhZGM4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /qrP6RmVW07q5q2IzmAMefCmNGikm8kh7E6AP45140 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXWAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IjRaQVhzTEFKNVk1TEJCYXQ2UUdTVkE9PSIsInZhbHVlIjoiQTFCbDNLM2ZvOGd5dXNWSWxXTjZENVN3ckV4L0R4cVRrYVpFYk1VODd5RHhJU01UVFBPZkxtd2lFYXVlRU5vTDZ0REZpemNPL21qMEdndVc5c09UK0xIRHpPY25WbjNUM2hOU1lNZ1liaVp1cVdVcVZWZzNwRndzaEQ3cFUveUIiLCJtYWMiOiIzYTI2ZTJmZmU2ZTNhYTI0MjQ2Y2YzMGQzNDVhMmQzZDU0Mzg0ZjlmYzFlMTVmN2RiYWU0NjkwMWM2NzZiMjU3IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IkNTMTBOaDB3alpaMllPVGl4dXNYVmc9PSIsInZhbHVlIjoiZ3JlZnF0dWtaeHN2RTJVVDJqTjY0TU12ditIeWdDNzF6TzNYMThrREFBcEJ2SUhkVy9TWW5IZXVIczNqeFIvcS9mME5XTUZTT3EvRU54Z2IrWCtzaFZsVnExRXpFelhRNVRwVk16clRFRUZiMzFKQklGVTdlWGgxcEU1RmltOG8iLCJtYWMiOiI4MDYzOTUxNzNiZjQwNTE2MzBlYTNkOWEyOTk0MjAxZTQ5NzViY2Y2ODQ3MDFjZjNmNmE4ZjFlYzY3OTVhZGM4IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /efxsGgZ9g96NYVuIvRwEYQSx0A8SVy5blklUrKSSj9iyc6co8Jt78146 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXWAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IklEcEpUVWNFMXBkYjJHTWlCS3I0SkE9PSIsInZhbHVlIjoiRU5TWmM4SmZCQWszMmw4QVZaKzNLN3d3eU56K29ramVmeFNFRWhPeUpYMGFPTHowYUVRbjdPbllvUVVVV3dKV0U1VTE3ZE1TOFRkUmpjdVcxV05VNWFXODdyWWdyeEhmNlRUOWk1TFc3U3Q1VkRqTEx1YmNLMjRMOHQwQXo1TWIiLCJtYWMiOiJmYmY5ZDcwMzU5MzEwN2M3Zjg3ODZmNjY3ZGJlNDI4M2JhZGM2OWJkYzU5ZDY3MDRlZWYyNmQxZjM4OTIwODAxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InZVbXloM1A5Q2JZSWFPd0FJWDBGVWc9PSIsInZhbHVlIjoiZk5xODExV05VQVgwQnp0dHFVd0JmTHVQQTdtajBTaEQ5U3hIb0k1M3lnblE2ekxreFdXb3hYU2JRZndCWFZ5VWRzZ3JFdjlOWHhVQnhVZ0Z1Nkl4dFBHdWNBdlBkSEVNOEJYWXRDNVhaU1A3NFZ2bGcrZVc4dXBSSHlmdzcxWnYiLCJtYWMiOiJmOTVjYmMyZTNlNjQyZTFmMWM2ZDMxMTA5ZWFmZDk5Nzk5ZjVlZDMzYzEyMDNjYWYxYTdhNWExZjA3OWE2Y2FhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ij4ju2f5snoNTxMCJrxIedZBHZMU2Iz4yXZa0cdKQl2fDm9jTZe4c7rlVqysESBB56169 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXWAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IklEcEpUVWNFMXBkYjJHTWlCS3I0SkE9PSIsInZhbHVlIjoiRU5TWmM4SmZCQWszMmw4QVZaKzNLN3d3eU56K29ramVmeFNFRWhPeUpYMGFPTHowYUVRbjdPbllvUVVVV3dKV0U1VTE3ZE1TOFRkUmpjdVcxV05VNWFXODdyWWdyeEhmNlRUOWk1TFc3U3Q1VkRqTEx1YmNLMjRMOHQwQXo1TWIiLCJtYWMiOiJmYmY5ZDcwMzU5MzEwN2M3Zjg3ODZmNjY3ZGJlNDI4M2JhZGM2OWJkYzU5ZDY3MDRlZWYyNmQxZjM4OTIwODAxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InZVbXloM1A5Q2JZSWFPd0FJWDBGVWc9PSIsInZhbHVlIjoiZk5xODExV05VQVgwQnp0dHFVd0JmTHVQQTdtajBTaEQ5U3hIb0k1M3lnblE2ekxreFdXb3hYU2JRZndCWFZ5VWRzZ3JFdjlOWHhVQnhVZ0Z1Nkl4dFBHdWNBdlBkSEVNOEJYWXRDNVhaU1A3NFZ2bGcrZVc4dXBSSHlmdzcxWnYiLCJtYWMiOiJmOTVjYmMyZTNlNjQyZTFmMWM2ZDMxMTA5ZWFmZDk5Nzk5ZjVlZDMzYzEyMDNjYWYxYTdhNWExZjA3OWE2Y2FhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /xhSSG433q0vLfXw282T0j4tZVT2ieEywR92lVD7p2BPMjtlA0PeiEbuzk HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IklEcEpUVWNFMXBkYjJHTWlCS3I0SkE9PSIsInZhbHVlIjoiRU5TWmM4SmZCQWszMmw4QVZaKzNLN3d3eU56K29ramVmeFNFRWhPeUpYMGFPTHowYUVRbjdPbllvUVVVV3dKV0U1VTE3ZE1TOFRkUmpjdVcxV05VNWFXODdyWWdyeEhmNlRUOWk1TFc3U3Q1VkRqTEx1YmNLMjRMOHQwQXo1TWIiLCJtYWMiOiJmYmY5ZDcwMzU5MzEwN2M3Zjg3ODZmNjY3ZGJlNDI4M2JhZGM2OWJkYzU5ZDY3MDRlZWYyNmQxZjM4OTIwODAxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InZVbXloM1A5Q2JZSWFPd0FJWDBGVWc9PSIsInZhbHVlIjoiZk5xODExV05VQVgwQnp0dHFVd0JmTHVQQTdtajBTaEQ5U3hIb0k1M3lnblE2ekxreFdXb3hYU2JRZndCWFZ5VWRzZ3JFdjlOWHhVQnhVZ0Z1Nkl4dFBHdWNBdlBkSEVNOEJYWXRDNVhaU1A3NFZ2bGcrZVc4dXBSSHlmdzcxWnYiLCJtYWMiOiJmOTVjYmMyZTNlNjQyZTFmMWM2ZDMxMTA5ZWFmZDk5Nzk5ZjVlZDMzYzEyMDNjYWYxYTdhNWExZjA3OWE2Y2FhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /wxw1sZOySil8NEjvIYFtxD8u66tYQYXgQQAmnPjgqr0tgkbNH5Tke3Rab171 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXWAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IklEcEpUVWNFMXBkYjJHTWlCS3I0SkE9PSIsInZhbHVlIjoiRU5TWmM4SmZCQWszMmw4QVZaKzNLN3d3eU56K29ramVmeFNFRWhPeUpYMGFPTHowYUVRbjdPbllvUVVVV3dKV0U1VTE3ZE1TOFRkUmpjdVcxV05VNWFXODdyWWdyeEhmNlRUOWk1TFc3U3Q1VkRqTEx1YmNLMjRMOHQwQXo1TWIiLCJtYWMiOiJmYmY5ZDcwMzU5MzEwN2M3Zjg3ODZmNjY3ZGJlNDI4M2JhZGM2OWJkYzU5ZDY3MDRlZWYyNmQxZjM4OTIwODAxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InZVbXloM1A5Q2JZSWFPd0FJWDBGVWc9PSIsInZhbHVlIjoiZk5xODExV05VQVgwQnp0dHFVd0JmTHVQQTdtajBTaEQ5U3hIb0k1M3lnblE2ekxreFdXb3hYU2JRZndCWFZ5VWRzZ3JFdjlOWHhVQnhVZ0Z1Nkl4dFBHdWNBdlBkSEVNOEJYWXRDNVhaU1A3NFZ2bGcrZVc4dXBSSHlmdzcxWnYiLCJtYWMiOiJmOTVjYmMyZTNlNjQyZTFmMWM2ZDMxMTA5ZWFmZDk5Nzk5ZjVlZDMzYzEyMDNjYWYxYTdhNWExZjA3OWE2Y2FhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /wxEAvfh79xY931O7OkQQ5DeTPrst9wZU0uuvZgKtV34130 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IklEcEpUVWNFMXBkYjJHTWlCS3I0SkE9PSIsInZhbHVlIjoiRU5TWmM4SmZCQWszMmw4QVZaKzNLN3d3eU56K29ramVmeFNFRWhPeUpYMGFPTHowYUVRbjdPbllvUVVVV3dKV0U1VTE3ZE1TOFRkUmpjdVcxV05VNWFXODdyWWdyeEhmNlRUOWk1TFc3U3Q1VkRqTEx1YmNLMjRMOHQwQXo1TWIiLCJtYWMiOiJmYmY5ZDcwMzU5MzEwN2M3Zjg3ODZmNjY3ZGJlNDI4M2JhZGM2OWJkYzU5ZDY3MDRlZWYyNmQxZjM4OTIwODAxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InZVbXloM1A5Q2JZSWFPd0FJWDBGVWc9PSIsInZhbHVlIjoiZk5xODExV05VQVgwQnp0dHFVd0JmTHVQQTdtajBTaEQ5U3hIb0k1M3lnblE2ekxreFdXb3hYU2JRZndCWFZ5VWRzZ3JFdjlOWHhVQnhVZ0Z1Nkl4dFBHdWNBdlBkSEVNOEJYWXRDNVhaU1A3NFZ2bGcrZVc4dXBSSHlmdzcxWnYiLCJtYWMiOiJmOTVjYmMyZTNlNjQyZTFmMWM2ZDMxMTA5ZWFmZDk5Nzk5ZjVlZDMzYzEyMDNjYWYxYTdhNWExZjA3OWE2Y2FhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ij4ju2f5snoNTxMCJrxIedZBHZMU2Iz4yXZa0cdKQl2fDm9jTZe4c7rlVqysESBB56169 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IklEcEpUVWNFMXBkYjJHTWlCS3I0SkE9PSIsInZhbHVlIjoiRU5TWmM4SmZCQWszMmw4QVZaKzNLN3d3eU56K29ramVmeFNFRWhPeUpYMGFPTHowYUVRbjdPbllvUVVVV3dKV0U1VTE3ZE1TOFRkUmpjdVcxV05VNWFXODdyWWdyeEhmNlRUOWk1TFc3U3Q1VkRqTEx1YmNLMjRMOHQwQXo1TWIiLCJtYWMiOiJmYmY5ZDcwMzU5MzEwN2M3Zjg3ODZmNjY3ZGJlNDI4M2JhZGM2OWJkYzU5ZDY3MDRlZWYyNmQxZjM4OTIwODAxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InZVbXloM1A5Q2JZSWFPd0FJWDBGVWc9PSIsInZhbHVlIjoiZk5xODExV05VQVgwQnp0dHFVd0JmTHVQQTdtajBTaEQ5U3hIb0k1M3lnblE2ekxreFdXb3hYU2JRZndCWFZ5VWRzZ3JFdjlOWHhVQnhVZ0Z1Nkl4dFBHdWNBdlBkSEVNOEJYWXRDNVhaU1A3NFZ2bGcrZVc4dXBSSHlmdzcxWnYiLCJtYWMiOiJmOTVjYmMyZTNlNjQyZTFmMWM2ZDMxMTA5ZWFmZDk5Nzk5ZjVlZDMzYzEyMDNjYWYxYTdhNWExZjA3OWE2Y2FhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /rshshJxZMD4moUnXROrGzvb6fdlKwG3xxgQnZl0THijFV3HtosSsaMM0Gw6eHHMCef192 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXWAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IklEcEpUVWNFMXBkYjJHTWlCS3I0SkE9PSIsInZhbHVlIjoiRU5TWmM4SmZCQWszMmw4QVZaKzNLN3d3eU56K29ramVmeFNFRWhPeUpYMGFPTHowYUVRbjdPbllvUVVVV3dKV0U1VTE3ZE1TOFRkUmpjdVcxV05VNWFXODdyWWdyeEhmNlRUOWk1TFc3U3Q1VkRqTEx1YmNLMjRMOHQwQXo1TWIiLCJtYWMiOiJmYmY5ZDcwMzU5MzEwN2M3Zjg3ODZmNjY3ZGJlNDI4M2JhZGM2OWJkYzU5ZDY3MDRlZWYyNmQxZjM4OTIwODAxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InZVbXloM1A5Q2JZSWFPd0FJWDBGVWc9PSIsInZhbHVlIjoiZk5xODExV05VQVgwQnp0dHFVd0JmTHVQQTdtajBTaEQ5U3hIb0k1M3lnblE2ekxreFdXb3hYU2JRZndCWFZ5VWRzZ3JFdjlOWHhVQnhVZ0Z1Nkl4dFBHdWNBdlBkSEVNOEJYWXRDNVhaU1A3NFZ2bGcrZVc4dXBSSHlmdzcxWnYiLCJtYWMiOiJmOTVjYmMyZTNlNjQyZTFmMWM2ZDMxMTA5ZWFmZDk5Nzk5ZjVlZDMzYzEyMDNjYWYxYTdhNWExZjA3OWE2Y2FhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /qrP6RmVW07q5q2IzmAMefCmNGikm8kh7E6AP45140 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IklEcEpUVWNFMXBkYjJHTWlCS3I0SkE9PSIsInZhbHVlIjoiRU5TWmM4SmZCQWszMmw4QVZaKzNLN3d3eU56K29ramVmeFNFRWhPeUpYMGFPTHowYUVRbjdPbllvUVVVV3dKV0U1VTE3ZE1TOFRkUmpjdVcxV05VNWFXODdyWWdyeEhmNlRUOWk1TFc3U3Q1VkRqTEx1YmNLMjRMOHQwQXo1TWIiLCJtYWMiOiJmYmY5ZDcwMzU5MzEwN2M3Zjg3ODZmNjY3ZGJlNDI4M2JhZGM2OWJkYzU5ZDY3MDRlZWYyNmQxZjM4OTIwODAxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InZVbXloM1A5Q2JZSWFPd0FJWDBGVWc9PSIsInZhbHVlIjoiZk5xODExV05VQVgwQnp0dHFVd0JmTHVQQTdtajBTaEQ5U3hIb0k1M3lnblE2ekxreFdXb3hYU2JRZndCWFZ5VWRzZ3JFdjlOWHhVQnhVZ0Z1Nkl4dFBHdWNBdlBkSEVNOEJYWXRDNVhaU1A3NFZ2bGcrZVc4dXBSSHlmdzcxWnYiLCJtYWMiOiJmOTVjYmMyZTNlNjQyZTFmMWM2ZDMxMTA5ZWFmZDk5Nzk5ZjVlZDMzYzEyMDNjYWYxYTdhNWExZjA3OWE2Y2FhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ghiYmnsgxfRBtGaEoscjiskLiru2jTJXevHbPWHxkFklSwGnOZswRieoV0kMZoDk6v12210 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXWAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IklEcEpUVWNFMXBkYjJHTWlCS3I0SkE9PSIsInZhbHVlIjoiRU5TWmM4SmZCQWszMmw4QVZaKzNLN3d3eU56K29ramVmeFNFRWhPeUpYMGFPTHowYUVRbjdPbllvUVVVV3dKV0U1VTE3ZE1TOFRkUmpjdVcxV05VNWFXODdyWWdyeEhmNlRUOWk1TFc3U3Q1VkRqTEx1YmNLMjRMOHQwQXo1TWIiLCJtYWMiOiJmYmY5ZDcwMzU5MzEwN2M3Zjg3ODZmNjY3ZGJlNDI4M2JhZGM2OWJkYzU5ZDY3MDRlZWYyNmQxZjM4OTIwODAxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InZVbXloM1A5Q2JZSWFPd0FJWDBGVWc9PSIsInZhbHVlIjoiZk5xODExV05VQVgwQnp0dHFVd0JmTHVQQTdtajBTaEQ5U3hIb0k1M3lnblE2ekxreFdXb3hYU2JRZndCWFZ5VWRzZ3JFdjlOWHhVQnhVZ0Z1Nkl4dFBHdWNBdlBkSEVNOEJYWXRDNVhaU1A3NFZ2bGcrZVc4dXBSSHlmdzcxWnYiLCJtYWMiOiJmOTVjYmMyZTNlNjQyZTFmMWM2ZDMxMTA5ZWFmZDk5Nzk5ZjVlZDMzYzEyMDNjYWYxYTdhNWExZjA3OWE2Y2FhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /qrNROqivBHGeLbBOhClY7GZWtq7YPg4tOUKDNS8VcsMyYNAuvDqOSMcRbEguUbLoPuu0pdeAHcd240 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXWAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IklEcEpUVWNFMXBkYjJHTWlCS3I0SkE9PSIsInZhbHVlIjoiRU5TWmM4SmZCQWszMmw4QVZaKzNLN3d3eU56K29ramVmeFNFRWhPeUpYMGFPTHowYUVRbjdPbllvUVVVV3dKV0U1VTE3ZE1TOFRkUmpjdVcxV05VNWFXODdyWWdyeEhmNlRUOWk1TFc3U3Q1VkRqTEx1YmNLMjRMOHQwQXo1TWIiLCJtYWMiOiJmYmY5ZDcwMzU5MzEwN2M3Zjg3ODZmNjY3ZGJlNDI4M2JhZGM2OWJkYzU5ZDY3MDRlZWYyNmQxZjM4OTIwODAxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InZVbXloM1A5Q2JZSWFPd0FJWDBGVWc9PSIsInZhbHVlIjoiZk5xODExV05VQVgwQnp0dHFVd0JmTHVQQTdtajBTaEQ5U3hIb0k1M3lnblE2ekxreFdXb3hYU2JRZndCWFZ5VWRzZ3JFdjlOWHhVQnhVZ0Z1Nkl4dFBHdWNBdlBkSEVNOEJYWXRDNVhaU1A3NFZ2bGcrZVc4dXBSSHlmdzcxWnYiLCJtYWMiOiJmOTVjYmMyZTNlNjQyZTFmMWM2ZDMxMTA5ZWFmZDk5Nzk5ZjVlZDMzYzEyMDNjYWYxYTdhNWExZjA3OWE2Y2FhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /efxsGgZ9g96NYVuIvRwEYQSx0A8SVy5blklUrKSSj9iyc6co8Jt78146 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IklEcEpUVWNFMXBkYjJHTWlCS3I0SkE9PSIsInZhbHVlIjoiRU5TWmM4SmZCQWszMmw4QVZaKzNLN3d3eU56K29ramVmeFNFRWhPeUpYMGFPTHowYUVRbjdPbllvUVVVV3dKV0U1VTE3ZE1TOFRkUmpjdVcxV05VNWFXODdyWWdyeEhmNlRUOWk1TFc3U3Q1VkRqTEx1YmNLMjRMOHQwQXo1TWIiLCJtYWMiOiJmYmY5ZDcwMzU5MzEwN2M3Zjg3ODZmNjY3ZGJlNDI4M2JhZGM2OWJkYzU5ZDY3MDRlZWYyNmQxZjM4OTIwODAxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InZVbXloM1A5Q2JZSWFPd0FJWDBGVWc9PSIsInZhbHVlIjoiZk5xODExV05VQVgwQnp0dHFVd0JmTHVQQTdtajBTaEQ5U3hIb0k1M3lnblE2ekxreFdXb3hYU2JRZndCWFZ5VWRzZ3JFdjlOWHhVQnhVZ0Z1Nkl4dFBHdWNBdlBkSEVNOEJYWXRDNVhaU1A3NFZ2bGcrZVc4dXBSSHlmdzcxWnYiLCJtYWMiOiJmOTVjYmMyZTNlNjQyZTFmMWM2ZDMxMTA5ZWFmZDk5Nzk5ZjVlZDMzYzEyMDNjYWYxYTdhNWExZjA3OWE2Y2FhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://quiltercheviot.uuvght.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wxw1sZOySil8NEjvIYFtxD8u66tYQYXgQQAmnPjgqr0tgkbNH5Tke3Rab171 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IklEcEpUVWNFMXBkYjJHTWlCS3I0SkE9PSIsInZhbHVlIjoiRU5TWmM4SmZCQWszMmw4QVZaKzNLN3d3eU56K29ramVmeFNFRWhPeUpYMGFPTHowYUVRbjdPbllvUVVVV3dKV0U1VTE3ZE1TOFRkUmpjdVcxV05VNWFXODdyWWdyeEhmNlRUOWk1TFc3U3Q1VkRqTEx1YmNLMjRMOHQwQXo1TWIiLCJtYWMiOiJmYmY5ZDcwMzU5MzEwN2M3Zjg3ODZmNjY3ZGJlNDI4M2JhZGM2OWJkYzU5ZDY3MDRlZWYyNmQxZjM4OTIwODAxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InZVbXloM1A5Q2JZSWFPd0FJWDBGVWc9PSIsInZhbHVlIjoiZk5xODExV05VQVgwQnp0dHFVd0JmTHVQQTdtajBTaEQ5U3hIb0k1M3lnblE2ekxreFdXb3hYU2JRZndCWFZ5VWRzZ3JFdjlOWHhVQnhVZ0Z1Nkl4dFBHdWNBdlBkSEVNOEJYWXRDNVhaU1A3NFZ2bGcrZVc4dXBSSHlmdzcxWnYiLCJtYWMiOiJmOTVjYmMyZTNlNjQyZTFmMWM2ZDMxMTA5ZWFmZDk5Nzk5ZjVlZDMzYzEyMDNjYWYxYTdhNWExZjA3OWE2Y2FhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /st1Db2ykjfYABIo1c7bMik440A2uivFvcyDDUDxbbHMMLX5lpn867VGTAn6EJhdvlX8cZHuBdooVGYagJwegh260 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://quiltercheviot.uuvght.ru/PCYXCWFOKIFLAIXDZJOUSUHSDR8097hms554imnm7gwq1z7?ZTSQFCBSVOBQMVHQXHEYQFLKLAFDXWAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IklEcEpUVWNFMXBkYjJHTWlCS3I0SkE9PSIsInZhbHVlIjoiRU5TWmM4SmZCQWszMmw4QVZaKzNLN3d3eU56K29ramVmeFNFRWhPeUpYMGFPTHowYUVRbjdPbllvUVVVV3dKV0U1VTE3ZE1TOFRkUmpjdVcxV05VNWFXODdyWWdyeEhmNlRUOWk1TFc3U3Q1VkRqTEx1YmNLMjRMOHQwQXo1TWIiLCJtYWMiOiJmYmY5ZDcwMzU5MzEwN2M3Zjg3ODZmNjY3ZGJlNDI4M2JhZGM2OWJkYzU5ZDY3MDRlZWYyNmQxZjM4OTIwODAxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InZVbXloM1A5Q2JZSWFPd0FJWDBGVWc9PSIsInZhbHVlIjoiZk5xODExV05VQVgwQnp0dHFVd0JmTHVQQTdtajBTaEQ5U3hIb0k1M3lnblE2ekxreFdXb3hYU2JRZndCWFZ5VWRzZ3JFdjlOWHhVQnhVZ0Z1Nkl4dFBHdWNBdlBkSEVNOEJYWXRDNVhaU1A3NFZ2bGcrZVc4dXBSSHlmdzcxWnYiLCJtYWMiOiJmOTVjYmMyZTNlNjQyZTFmMWM2ZDMxMTA5ZWFmZDk5Nzk5ZjVlZDMzYzEyMDNjYWYxYTdhNWExZjA3OWE2Y2FhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /fs/bcg/4/gfsh9pi7jcWKJKMAs1t7 HTTP/1.1Host: ok4static.oktacdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rshshJxZMD4moUnXROrGzvb6fdlKwG3xxgQnZl0THijFV3HtosSsaMM0Gw6eHHMCef192 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IklEcEpUVWNFMXBkYjJHTWlCS3I0SkE9PSIsInZhbHVlIjoiRU5TWmM4SmZCQWszMmw4QVZaKzNLN3d3eU56K29ramVmeFNFRWhPeUpYMGFPTHowYUVRbjdPbllvUVVVV3dKV0U1VTE3ZE1TOFRkUmpjdVcxV05VNWFXODdyWWdyeEhmNlRUOWk1TFc3U3Q1VkRqTEx1YmNLMjRMOHQwQXo1TWIiLCJtYWMiOiJmYmY5ZDcwMzU5MzEwN2M3Zjg3ODZmNjY3ZGJlNDI4M2JhZGM2OWJkYzU5ZDY3MDRlZWYyNmQxZjM4OTIwODAxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InZVbXloM1A5Q2JZSWFPd0FJWDBGVWc9PSIsInZhbHVlIjoiZk5xODExV05VQVgwQnp0dHFVd0JmTHVQQTdtajBTaEQ5U3hIb0k1M3lnblE2ekxreFdXb3hYU2JRZndCWFZ5VWRzZ3JFdjlOWHhVQnhVZ0Z1Nkl4dFBHdWNBdlBkSEVNOEJYWXRDNVhaU1A3NFZ2bGcrZVc4dXBSSHlmdzcxWnYiLCJtYWMiOiJmOTVjYmMyZTNlNjQyZTFmMWM2ZDMxMTA5ZWFmZDk5Nzk5ZjVlZDMzYzEyMDNjYWYxYTdhNWExZjA3OWE2Y2FhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /qrNROqivBHGeLbBOhClY7GZWtq7YPg4tOUKDNS8VcsMyYNAuvDqOSMcRbEguUbLoPuu0pdeAHcd240 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IklEcEpUVWNFMXBkYjJHTWlCS3I0SkE9PSIsInZhbHVlIjoiRU5TWmM4SmZCQWszMmw4QVZaKzNLN3d3eU56K29ramVmeFNFRWhPeUpYMGFPTHowYUVRbjdPbllvUVVVV3dKV0U1VTE3ZE1TOFRkUmpjdVcxV05VNWFXODdyWWdyeEhmNlRUOWk1TFc3U3Q1VkRqTEx1YmNLMjRMOHQwQXo1TWIiLCJtYWMiOiJmYmY5ZDcwMzU5MzEwN2M3Zjg3ODZmNjY3ZGJlNDI4M2JhZGM2OWJkYzU5ZDY3MDRlZWYyNmQxZjM4OTIwODAxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InZVbXloM1A5Q2JZSWFPd0FJWDBGVWc9PSIsInZhbHVlIjoiZk5xODExV05VQVgwQnp0dHFVd0JmTHVQQTdtajBTaEQ5U3hIb0k1M3lnblE2ekxreFdXb3hYU2JRZndCWFZ5VWRzZ3JFdjlOWHhVQnhVZ0Z1Nkl4dFBHdWNBdlBkSEVNOEJYWXRDNVhaU1A3NFZ2bGcrZVc4dXBSSHlmdzcxWnYiLCJtYWMiOiJmOTVjYmMyZTNlNjQyZTFmMWM2ZDMxMTA5ZWFmZDk5Nzk5ZjVlZDMzYzEyMDNjYWYxYTdhNWExZjA3OWE2Y2FhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ghiYmnsgxfRBtGaEoscjiskLiru2jTJXevHbPWHxkFklSwGnOZswRieoV0kMZoDk6v12210 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IklEcEpUVWNFMXBkYjJHTWlCS3I0SkE9PSIsInZhbHVlIjoiRU5TWmM4SmZCQWszMmw4QVZaKzNLN3d3eU56K29ramVmeFNFRWhPeUpYMGFPTHowYUVRbjdPbllvUVVVV3dKV0U1VTE3ZE1TOFRkUmpjdVcxV05VNWFXODdyWWdyeEhmNlRUOWk1TFc3U3Q1VkRqTEx1YmNLMjRMOHQwQXo1TWIiLCJtYWMiOiJmYmY5ZDcwMzU5MzEwN2M3Zjg3ODZmNjY3ZGJlNDI4M2JhZGM2OWJkYzU5ZDY3MDRlZWYyNmQxZjM4OTIwODAxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InZVbXloM1A5Q2JZSWFPd0FJWDBGVWc9PSIsInZhbHVlIjoiZk5xODExV05VQVgwQnp0dHFVd0JmTHVQQTdtajBTaEQ5U3hIb0k1M3lnblE2ekxreFdXb3hYU2JRZndCWFZ5VWRzZ3JFdjlOWHhVQnhVZ0Z1Nkl4dFBHdWNBdlBkSEVNOEJYWXRDNVhaU1A3NFZ2bGcrZVc4dXBSSHlmdzcxWnYiLCJtYWMiOiJmOTVjYmMyZTNlNjQyZTFmMWM2ZDMxMTA5ZWFmZDk5Nzk5ZjVlZDMzYzEyMDNjYWYxYTdhNWExZjA3OWE2Y2FhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /st1Db2ykjfYABIo1c7bMik440A2uivFvcyDDUDxbbHMMLX5lpn867VGTAn6EJhdvlX8cZHuBdooVGYagJwegh260 HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IklEcEpUVWNFMXBkYjJHTWlCS3I0SkE9PSIsInZhbHVlIjoiRU5TWmM4SmZCQWszMmw4QVZaKzNLN3d3eU56K29ramVmeFNFRWhPeUpYMGFPTHowYUVRbjdPbllvUVVVV3dKV0U1VTE3ZE1TOFRkUmpjdVcxV05VNWFXODdyWWdyeEhmNlRUOWk1TFc3U3Q1VkRqTEx1YmNLMjRMOHQwQXo1TWIiLCJtYWMiOiJmYmY5ZDcwMzU5MzEwN2M3Zjg3ODZmNjY3ZGJlNDI4M2JhZGM2OWJkYzU5ZDY3MDRlZWYyNmQxZjM4OTIwODAxIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6InZVbXloM1A5Q2JZSWFPd0FJWDBGVWc9PSIsInZhbHVlIjoiZk5xODExV05VQVgwQnp0dHFVd0JmTHVQQTdtajBTaEQ5U3hIb0k1M3lnblE2ekxreFdXb3hYU2JRZndCWFZ5VWRzZ3JFdjlOWHhVQnhVZ0Z1Nkl4dFBHdWNBdlBkSEVNOEJYWXRDNVhaU1A3NFZ2bGcrZVc4dXBSSHlmdzcxWnYiLCJtYWMiOiJmOTVjYmMyZTNlNjQyZTFmMWM2ZDMxMTA5ZWFmZDk5Nzk5ZjVlZDMzYzEyMDNjYWYxYTdhNWExZjA3OWE2Y2FhIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /v1/ip/geo.json HTTP/1.1Host: get.geojs.ioConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/json, text/javascript, /; q=0.01sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Origin: https://quiltercheviot.uuvght.ruSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://quiltercheviot.uuvght.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v1/ip/geo.json HTTP/1.1Host: get.geojs.ioConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /EOYjycEWqYUAcxcvGlGTovlvIGfUMCJNEJFKBSPXRJBLBPDZUIFSCIPEEVRBVJVSrsX08fBse3YeORZdUCL12OblSuv31 HTTP/1.1Host: fkbmp45xuukobliimngz8fszwpth2x9p8sp66fi21zoxkwiyhlosfjl.erisxw.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c1c6b6c8-rch2ljmfhhrlo6pwildmnbetzhhtpmipoxqhg8ezr8m/logintenantbranding/0/illustration?ts=636723567836061241 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://quiltercheviot.uuvght.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c1c6b6c8-rch2ljmfhhrlo6pwildmnbetzhhtpmipoxqhg8ezr8m/logintenantbranding/0/bannerlogo?ts=636723630488940825 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://quiltercheviot.uuvght.ru/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c1c6b6c8-rch2ljmfhhrlo6pwildmnbetzhhtpmipoxqhg8ezr8m/logintenantbranding/0/bannerlogo?ts=636723630488940825 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c1c6b6c8-rch2ljmfhhrlo6pwildmnbetzhhtpmipoxqhg8ezr8m/logintenantbranding/0/illustration?ts=636723567836061241 HTTP/1.1Host: aadcdn.msauthimages.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /xhSSG433q0vLfXw282T0j4tZVT2ieEywR92lVD7p2BPMjtlA0PeiEbuzk HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6IndiaWNwOGNJQXduVzJua3FCU3dMUEE9PSIsInZhbHVlIjoiVUxqcE1vKzhKUlp5VjZwUndObVdmaG80QlAxNys5YU1SK3o5RjBSci9UWVNYQjZtSnFZUndhWkwrVnlSZnY2UjFYSW9kV3kxK2lsZXhvbDB3aS9HNkc2T2RrM2t3YmxsMUtwNUhwZENpRW9nemNIOHdRQVJxVUxBcWxsQnc2SXgiLCJtYWMiOiIxZTQ0MTMxZDhjNjEyNDk4YWU0NWVjMmJjODg2OGI1MGQ3ZmNlNTE3ZGQzYmRjNjcwYjJjZTI4ZjUyOTIwNDNjIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlpjL3FnTjErZXpqeDM1MkdaZmxKUFE9PSIsInZhbHVlIjoiU3ZlTjEyeDNGT1VSTzhZT3V1M0xObVhUY2p1SnFiVUxWVFRQRWdEMG9ZZWVYMjBXNFF2R0lYU29MaXJacVI2SXJ5WWMxdjc4YmhXb3UxQ2NwMFdRQUFtb2Y4WG1JckYvK1B1N3pIdDU3UVdYTDZ5aG8wU0NLU05uQTVIaUF0NUIiLCJtYWMiOiIzNzRmODcxZDQ0ZTk2ZjI5NGIyZDc0NDcwYTkxYTU3ODJjZTQwY2MxNzgwMzE0YzIwNzdiOGI1ZjNkZmNiOWQ5IiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /EOYjycEWqYUAcxcvGlGTovlvIGfUMCJNEJFKBSPXRJBLBPDZUIFSCIPEEVRBVJVS12TNTVFKSUWpd78P86Oqr50 HTTP/1.1Host: fkbmp45xuukobliimngz8fszwpth2x9p8sp66fi21zoxkwiyhlosfjl.erisxw.esConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: y13tzxbjz1.moydow.de
Source: global traffic	DNS traffic detected: DNS query: quiltercheviot.uuvght.ru
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: developers.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: v36ix.szsnqp.ru
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: ok4static.oktacdn.com
Source: global traffic	DNS traffic detected: DNS query: objects.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: get.geojs.io
Source: global traffic	DNS traffic detected: DNS query: fkbmp45xuukobliimngz8fszwpth2x9p8sp66fi21zoxkwiyhlosfjl.erisxw.es
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msauthimages.net

Source: unknown

HTTP traffic detected: POST /tdl2unv9gDV7gebvSTx8fq6Qo8kD8UATTsu HTTP/1.1Host: quiltercheviot.uuvght.ruConnection: keep-aliveContent-Length: 803sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryqpbvcM1qWwZBoiiisec-ch-ua-mobile: ?0Accept: */*Origin: https://quiltercheviot.uuvght.ruSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://quiltercheviot.uuvght.ru/nTJ777/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ikh3Smxkc1c4bms5K2E2WUhORk43dkE9PSIsInZhbHVlIjoiaFJoUTJtMDRVRGdhakhqVHErdmNIN1hHYWhnbVk0ZFRNVk1lQ0VYd1RNR1dPUnJCS3JmMFU0U05YUW14ZXdXWkxRMHpmNW5EY2cxNEFMN040citsbWl3TmlGTGRhSzY4czB4YkZ1bzdzVWRvNzB1VmZwcUxBTFJVdG1ZcE1oYngiLCJtYWMiOiIwYWFkYjQxMGY2ZDRjNmI3ZDcwODM2ODFlNjdmZDUzNDhkYTZlMzcxMWRkOWRlNDc1ODgzZjRkZmM3MjUxZmJkIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6Ikp4ZkNVaHVRK0N6azJ2Y0NUeExsVHc9PSIsInZhbHVlIjoiVHNDeVhxRy9RZWVKYjJCc3g2eDAvMmZYSlZFczFxVDVlTE9KNTJMR1lKOTFXQU54SVlCdEhSQkY5Q1JwV1ZVVklEeTR1RG1HNVdVL0J4WllMUE9kb0diMk83WGlhMy9JVGJVdFkyMmNlK2wwQlpxR1hoSTZ5TzFUVndtMTJvakMiLCJtYWMiOiJiYmJhYTkxYzQxYzA1N2NjMWMyMzkxNGI0YjBkZDJhNjg0YzQ2Y2ZjZTM1MDU2NTYwMjcyYmUwMWQxOGJhMzRhIiwidGFnIjoiIn0%3D

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Mar 2025 15:23:01 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CexwVhN7kytl%2F8Lrz971rRJ%2FZ7ZfA82GiC%2BxZXVaCdplsZGQX0yKXPZZYRQgRuvEf2u%2BEjBoGPHwy2LHO9CbeMY65Q%2F6KS3KpiV681Ya6VWIpHhr0jcs0B5Yw6EyEur2xLZ3"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=1411&min_rtt=1245&rtt_var=585&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2055&delivery_rate=2326104&cwnd=251&unsent_bytes=0&cid=a58f606907647cd6&ts=89&x=0"Server: cloudflareCF-RAY: 9225ba91ebf70e82-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1683&min_rtt=1659&rtt_var=639&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2819&recv_bytes=1718&delivery_rate=1760096&cwnd=78&unsent_bytes=0&cid=cfb988684cbffcf1&ts=446&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Mar 2025 15:23:02 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v%2BWkONUnpii3au2ep9Mrbj0vxgu%2BuGtqyUyHqjoopJj2pFihMAa2smlp4EUCauRmCw0GU0Y31wUqntliyBwsidL4yOMwkjvfr%2BIyUwtcNSjDoPj2DdJBWXNcg93JSIKkTE2J"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Vary: Accept-Encodingserver-timing: cfL4;desc="?proto=TCP&rtt=50190&min_rtt=46487&rtt_var=20078&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2821&recv_bytes=2252&delivery_rate=62296&cwnd=53&unsent_bytes=0&cid=d1b187769d545367&ts=132&x=0"Cache-Control: max-age=14400CF-Cache-Status: MISSServer: cloudflareCF-RAY: 9225ba996bb17cb2-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1825&min_rtt=1825&rtt_var=912&sent=6&recv=7&lost=0&retrans=1&sent_bytes=4178&recv_bytes=1913&delivery_rate=153055&cwnd=223&unsent_bytes=0&cid=69e0c11621bb2dff&ts=680&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Mar 2025 15:23:02 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LLZaysRDPVHeRSDxgZ8wIxA2PNk1%2ByBTOmK0qFG5aAlC8u4uSqIwxjgy4kFJO5wWEWQnJ7gWRPQ5zCqMEglI0bXS4MJD1W6twrkXRHDj1YN9CWVEgysJT391ie%2B7PPBqZruO"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=42817&min_rtt=42313&rtt_var=16227&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2822&recv_bytes=2067&delivery_rate=68442&cwnd=140&unsent_bytes=0&cid=66f24c502b105d59&ts=125&x=0"Server: cloudflareCF-RAY: 9225ba9cb9f57ca6-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1941&min_rtt=1934&rtt_var=739&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2820&recv_bytes=1729&delivery_rate=1467336&cwnd=199&unsent_bytes=0&cid=9831c6121f1426a1&ts=589&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Mar 2025 15:23:07 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xDqO7jFuiBSJ80cICgx06DUdVRBt7%2FjeaSITpQKbm%2F%2BAt%2FtXXOds3BqSQvEGNTE71IODbyS26Q7Ti4gjR%2FX%2BV%2B%2B0fLhvld5x9lhtMwD4E0mc6nKG7aKJMdo9OGS1lb4ZUAwt"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=56869&min_rtt=56821&rtt_var=21404&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2078&delivery_rate=50624&cwnd=231&unsent_bytes=0&cid=b4f04b193a5d21ef&ts=179&x=0"Server: cloudflareCF-RAY: 9225bab9d83742a3-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1925&min_rtt=1697&rtt_var=1093&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2820&recv_bytes=1740&delivery_rate=828368&cwnd=142&unsent_bytes=0&cid=67f544b935a07a0a&ts=873&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 18 Mar 2025 15:23:18 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e2W%2FbnRmzWhyPBhi6fWhGJ5TkborrqLFdJ5tzTO4%2Bvgko7x2pmfCBe%2B7XV5ZoGSuuzR%2FQs4RUBk7efLiPJNwE0AsFYPrvjP58qXFSmiTx38hCiCfNkN3lZ5Rk6IDHIZyLQFw"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}server-timing: cfL4;desc="?proto=TCP&rtt=51459&min_rtt=50665&rtt_var=19567&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=2078&delivery_rate=57159&cwnd=251&unsent_bytes=0&cid=2745c505358d41ff&ts=226&x=0"Server: cloudflareCF-RAY: 9225bafe7c0c7039-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2436&min_rtt=2426&rtt_var=930&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2820&recv_bytes=1740&delivery_rate=1163810&cwnd=144&unsent_bytes=0&cid=91c3f56a3bc300aa&ts=744&x=0"

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988

Source: unknown	HTTPS traffic detected: 104.21.13.170:443 -> 192.168.2.18:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.194.137:443 -> 192.168.2.18:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.17.24.14:443 -> 192.168.2.18:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.18:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.3.189:443 -> 192.168.2.18:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.6.189:443 -> 192.168.2.18:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.228:443 -> 192.168.2.18:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.18:49931 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.18:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.18:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.18:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.187.14:443 -> 192.168.2.18:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.187.14:443 -> 192.168.2.18:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.18:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.18:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.187.14:443 -> 192.168.2.18:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.33.187.14:443 -> 192.168.2.18:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.1.100:443 -> 192.168.2.18:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.70.233:443 -> 192.168.2.18:50048 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.18:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.18:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.101.182.112:443 -> 192.168.2.18:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.101.182.112:443 -> 192.168.2.18:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.101.182.112:443 -> 192.168.2.18:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.101.182.112:443 -> 192.168.2.18:50054 version: TLS 1.2

Source: classification engine

Classification label: mal100.phis.evad.winEML@25/36@46/110