24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 4f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T492,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample a38e30fc95d2… — Score 88/100 — Hybrid Analysis","description":"Malicious verdict for sample a38e30fc95d2…. Malware family: Trojan.Generic. Threat score 88/100. 11/27 AV engines flagged this file. 2 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3"],"about":{"@type":"SoftwareApplication","name":"fps boost fix.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3","additionalType":"Malicious sample"},"threatScore":88,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":11,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4f6,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin")26:T40b,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin")27:T5f4,Found reference to "forHKDF" (Indicator: "HKDF"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found reference to "*hmac.HMAC" (Indicator: "HMAC"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") file/memory contains long string with (Indicator: "HMAC"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Sum" (Indicator: "HMAC"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Write" (Indicator: "HMAC"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).BlockSize" (Indicator: "HMAC"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Reset" (Indicator: "HMAC"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found reference to "runtime.useAeshash" (Indicator: "Aes"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found reference to "crypto/internal/fips140deps/cpu.ARM64HasSHA512" (Indicator: "SHA512"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found reference to "crypto/internal/fips140deps/cpu.S390XHasSHA512" (Indicator: "SHA512"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin")28:T9be,"status= pluginpath= : unknown pc called from runtime: pid=#failfipscastGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeHMAC-SHA2-256GetProcAddressVirtualProtectfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol error" (Indicator: "CertOpenStore"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found api reference "text file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #invalid syntax1907348632812595367431640625asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found api reference "text file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #invalid syntax1907348632812595367431640625asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found api reference "lex509negativeserialbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.Floatreflect.Value.IsNilafter array element14901161193847656257450580596923828125strongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad runtime" (Indicator: "CryptReleaseContext"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found api reference "(JSON):Dinyemxeoqjqchebqgxpinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling 37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goreflect.Value.IsZeroGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives" (Indicator: "CertOpenSystemStoreW"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found api reference "(JSON):Dinyemxeoqjqchebqgxpinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling 37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goreflect.Value.IsZeroGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives" (Indicator: "CryptAcquireContextW"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found api reference "function at pc=simulated CAST failureunexpected method stepRtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultexit hook invoked exitsha3: Write after ReadT+02:00.000 sea-passagedevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWunexpected map key type23283064365386962890625index out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the c" (Indicator: "CertGetCertificateChain"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found api reference "connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWjson: unsupported type: invalid argument to Intn116415321826934814453125582076609134674072265625tracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup setdouble traceGCSweepStartbad use of trace.seqlockinvalid pattern syntax: T+00:30.000 pilot-stationT+01:00.000 cha" (Indicator: "CertFreeCertificateChain"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStarttesting simulated failureGODEBUG: can not enable "GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWhash of unhashable type: T+04:00.000 full-sea-speedT+53:00.000 coast-approach P%-3d %-8d %-7d %-8d %sinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHa" (Indicator: "CertFreeCertificateContext"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin"), Found api reference "ndleencountered a cycle via %sinvalid argument to Int63ninvalid argument to Int31n1455191522836685180664062572759576141834259033203125all goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory using unaddressable valueunknown ABI parameter kindRtlNtStatusToDosErrorNoTebT+00:00.000 departure-berthchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStoreafter object key:value pair363797880709171295166015625PageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses size" (Indicator: "CertEnumCertificatesInStore"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for reflect.Value.UnsafePointer is not assignable to type abi.NewName: tag too long: httpservecontentkeepheaders %-4s %-22s %-10s %-10s %sfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContext!#" (Indicator: "CertCreateCertificateContext"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin"), Found api reference "an't happen11368683772161602973937988281255684341886080801486968994140625slice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type crypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyin literal false (expecting 'a')in literal false (expecting 'l')in literal false (expecting 's')in literal false (expecting 'e')284217094304" (Indicator: "CertAddCertificateContextToStore"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin"), Found api reference "an't happen11368683772161602973937988281255684341886080801486968994140625slice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type crypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyin literal false (expecting 'a')in literal false (expecting 'l')in literal false (expecting 's')in literal false (expecting 'e')284217094304" (Indicator: "CertVerifyCertificateChainPolicy"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin"), Found api reference ".level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbyname3814697265625wakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at: not pointer != sweepgen MB globals work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=#failfipscastGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeHMAC-SHA2-256GetProcAddressVirtualProtectfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol erro" (Indicator: "CertOpenStore"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found api reference "(JSON):Dinyemxeoqjqchebqgxpinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling 37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goreflect.Value.IsZeroGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitive" (Indicator: "CertOpenSystemStoreW"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found api reference "(JSON):Dinyemxeoqjqchebqgxpinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling 37252902984619140625floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goreflect.Value.IsZeroGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitive" (Indicator: "CryptAcquireContextW"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found api reference "function at pc=simulated CAST failureunexpected method stepRtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultexit hook invoked exitsha3: Write after ReadT+02:00.000 sea-passagedevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWunexpected map key type23283064365386962890625index out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the" (Indicator: "CertGetCertificateChain"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found api reference "connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWjson: unsupported type: invalid argument to Intn116415321826934814453125582076609134674072265625tracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup setdouble traceGCSweepStartbad use of trace.seqlockinvalid pattern syntax: T+00:30.000 pilot-stationT+01:00.000 ch" (Indicator: "CertFreeCertificateChain"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStarttesting simulated failureGODEBUG: can not enable "GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWhash of unhashable type: T+04:00.000 full-sea-speedT+53:00.000 coast-approach P%-3d %-8d %-7d %-8d %sinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByH" (Indicator: "CertFreeCertificateContext"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin"), Found api reference "ndleencountered a cycle via %sinvalid argument to Int63ninvalid argument to Int31n1455191522836685180664062572759576141834259033203125all goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory using unaddressable valueunknown ABI parameter kindRtlNtStatusToDosErrorNoTebT+00:00.000 departure-berthchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStoreafter object key:value pair363797880709171295166015625PageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses siz" (Indicator: "CertEnumCertificatesInStore"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for reflect.Value.UnsafePointer is not assignable to type abi.NewName: tag too long: httpservecontentkeepheaders %-4s %-22s %-10s %-10s %sfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContext!" (Indicator: "CertCreateCertificateContext"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin"), Found api reference "an't happen11368683772161602973937988281255684341886080801486968994140625slice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type crypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyin literal false (expecting 'a')in literal false (expecting 'l')in literal false (expecting 's')in literal false (expecting 'e')28421709430" (Indicator: "CertAddCertificateContextToStore"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin"), Found api reference "an't happen11368683772161602973937988281255684341886080801486968994140625slice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type crypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyin literal false (expecting 'a')in literal false (expecting 'l')in literal false (expecting 's')in literal false (expecting 'e')28421709430" (Indicator: "CertVerifyCertificateChainPolicy"; File: "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin")2b:T1609,Observed string: "crypto/rand" (Indicator: "crypto/rand") in Source: a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin Observed string: "crypto/internal/impl" (Indicator: "crypto/internal/impl") in Source: a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin Observed string: "crypto/internal/fips140/aes" (Indicator: "crypto/internal/fips140/aes") in Source: a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin Observed string: "crypto/internal/fips140/drbg" (Indicator: "crypto/internal/fips140/drbg") in Source: a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin Observed string: "crypto/internal/fips140/sha3" (Indicator: "crypto/internal/fips140/sha3") in Source: a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin Observed string: "crypto/internal/fips140/hmac" (Indicator: "crypto/internal/fips140/hmac") in Source: a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin Observed string: "crypto/internal/fips140/sha256" (Indicator: "crypto/internal/fips140/sha256") in Source: a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin Observed string: "crypto/internal/fips140/sha512" (Indicator: "crypto/internal/fips140/sha512") in Source: a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin Observed string: "Goal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc= until pc=active < 0unknown pcruntime: ggoroutine (durable)complex128t.Kind == IsValidSidLogonUserWLockFileExReOpenFileNetUserAddNetUserDelNtOpenFileWSASocketWexecerrdothttp2debugrsa1024mincrypto/rsacrypto/tlsx509rsacrtCounterKDF" (Indicator: "Goal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc= until pc=active < 0unknown pcruntime: ggoroutine (durable)complex128t.Kind == IsValidSidLogonUserWLockFileExReOpenFileNetUserAddNetUserDelNtOpenFileWSASocketWexecerrdothttp2debugrsa1024mincrypto/rsacrypto/tlsx509rsacrtCounterKDF") in Source: a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin, Observed string: "reflect: reflect.Value.UnsafePointer on an invalid notinheap pointercrypto/hmac: hash generation function does not produce unique valuesruntime.Pinner: found leaking pinned pointer; forgot to call Unpin()?" (Indicator: "reflect: reflect.Value.UnsafePointer on an invalid notinheap pointercrypto/hmac: hash generation function does not produce unique valuesruntime.Pinner: found leaking pinned pointer; forgot to call Unpin()?") in Source: a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin, Observed string: "crypto/rand.fatal" (Indicator: "crypto/rand.fatal") in Source: a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin, Observed string: "crypto/internal/sysrand.fatal" (Indicator: "crypto/internal/sysrand.fatal") in Source: a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin, Observed string: "crypto/internal/fips140deps/cpu.init" (Indicator: "crypto/internal/fips140deps/cpu.init") in Source: a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin, Observed string: "crypto/internal/impl.Register" (Indicator: "crypto/internal/impl.Register") in Source: a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin, Observed string: "type:.eq.crypto/internal/impl.implementation" (Indicator: "type:.eq.crypto/internal/impl.implementation") in Source: a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin, Observed string: "type:.eq.crypto/internal/fips140/sha256.Digest" (Indicator: "type:.eq.crypto/internal/fips140/sha256.Digest") in Source: a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin, Observed string: "type:.eq.crypto/internal/fips140/sha3.Digest" (Indicator: "type:.eq.crypto/internal/fips140/sha3.Digest") in Source: a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin, Observed string: "crypto/internal/sysrand.warnBlocked" (Indicator: "crypto/internal/sysrand.warnBlocked") in Source: a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin, Observed string: "crypto/internal/sysrand.Read" (Indicator: "crypto/internal/sysrand.Read") in Source: a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin, Observed string: "crypto/internal/sysrand.read" (Indicator: "crypto/internal/sysrand.read") in Source: a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin, Observed string: "crypto/internal/sysrand.Read.deferwrap1" (Indicator: "crypto/internal/sysrand.Read.deferwrap1") in Source: a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin, Observed string: "crypto/internal/entropy.Depleted" (Indicator: "crypto/internal/entropy.Depleted") in Source: a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin, Observed string: "crypto/internal/fips140only.init" (Indicator: "crypto/internal/fips140only.init") in Source: a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin, Observed string: "crypto/internal/boring/sig.StandardCrypto" (Indicator: "crypto/internal/boring/sig.StandardCrypto") in Source: a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin, Observed string: "crypto/rand.init.0" (Indicator: "crypto/rand.init.0") in Source: a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin2c:T42b,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains possible references to Golang crypto modules Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to decrypt/decode data Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: YARA signature match - ChaCha20 encryption algorithm Matched sigs: YARA signature match - AES encryption2d:Tef5,Found XOR loop in file "sample.bin" at offset 95058; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1510303; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1514351; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1555729; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1558703; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1562918; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1630769; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2396928; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2423231; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2769451; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2913980; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 28883; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 67209; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1569668; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2835541; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 191670; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 229481; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 229841; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 230241; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 232403; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 254993; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 275120; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 418757; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 419453; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 420094; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 430473; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1121880; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1142808; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1316432; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1348512; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1348624; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1348768; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1356676; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1473633; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1515326; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1645118; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1664414; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1970750; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2187950; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2379086; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2395694; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2407911; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2421473; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2608820; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2909080; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2939284; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3032000; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3162929; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3212316; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3241481; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3268746; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3291206; code bytes = 80302e:T9f2," HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:50:57 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Set-Cookie: stel_ssid=59687ae555972c250f_14486428535135335737; expires=Tue 07 Jul 2026 15:50:57 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: steamcommunity.com" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Date: Mon 06 Jul 2026 15:50:58 GMT Content-Length: 5839 Connection: keep-alive Set-Cookie: sessionid=0516d3b258ae4702a3fa823f; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; path=/; secure; HttpOnly; SameSite=None with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "GET /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:51:02 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3660 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Date: Mon 06 Jul 2026 15:51:02 GMT Content-Length: 5839 Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "GET /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:51:06 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 5839 Date: Mon 06 Jul 2026 15:51:07 GMT Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "GET /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:51:11 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3660 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 5838 Date: Mon 06 Jul 2026 15:51:11 GMT Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "GET /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:51:16 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3660 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Date: Mon 06 Jul 2026 15:51:16 GMT Content-Length: 5839 Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "GET /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:51:21 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3660 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 7103 Date: Mon 06 Jul 2026 15:51:21 GMT Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "GET /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:51:30 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 5839 Date: Mon 06 Jul 2026 15:51:30 GMT Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "GET /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:51:35 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 5839 Date: Mon 06 Jul 2026 15:51:36 GMT Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "GET /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:51:41 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 5838 Date: Mon 06 Jul 2026 15:51:41 GMT Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "GET /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:51:46 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 5839 Date: Mon 06 Jul 2026 15:51:46 GMT Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "GET /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:51:50 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3660 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 7104 Date: Mon 06 Jul 2026 15:51:51 GMT Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "GET /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:51:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" Response ==> HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 5838 Date: Mon 06 Jul 2026 15:51:57 GMT Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "GET /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:52:01 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3660 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C.......34:T8fb," "------5f9ecec30044c7af9359Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------5f9ecec30044c7af9359Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------5f9ecec30044c7af9359Content-Disposition: form-data; name="format"json------5f9ecec30044c7af9359--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:50:57 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----8d13540cff82e3a1ed67 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload::==> "------8d13540cff82e3a1ed67Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------8d13540cff82e3a1ed67Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------8d13540cff82e3a1ed67Content-Disposition: form-data; name="format"json------8d13540cff82e3a1ed67--" HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 5839 Date: Mon 06 Jul 2026 15:50:58 GMT Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----1db980a207146a0c68ce Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload::==> "------1db980a207146a0c68ceContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------1db980a207146a0c68ceContent-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------1db980a207146a0c68ceContent-Disposition: form-data; name="format"json------1db980a207146a0c68ce--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:51:02 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----9c86a38aebbeefa0cb69 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload::==> "------9c86a38aebbeefa0cb69Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------9c86a38aebbeefa0cb69Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------9c86a38aebbeefa0cb69Content-Disposition: form-data; name="format"json------9c86a38aebbeefa0cb69--" HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 5839 Date: Mon 06 Jul 2026 15:51:03 GMT Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----e3e91b1dbb2c22fee7a9 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload::==> "------e3e91b1dbb2c22fee7a9Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------e3e91b1dbb2c22fee7a9Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------e3e91b1dbb2c22fee7a9Content-Disposition: form-data; name="format"json------e3e91b1dbb2c22fee7a9--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:51:07 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----c03164e998de050a2c9c Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload::==> "------c03164e998de050a2c9cContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------c03164e998de050a2c9cContent-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------c03164e998de050a2c9cContent-Disposition: form-data; name="format"json------c03164e998de050a2c9c--" HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 5839 Date: Mon 06 Jul 2026 15:51:07 GMT Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----19b1895d027e06259d51 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload::==> "------19b1895d027e06259d51Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------19b1895d027e06259d51Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------19b1895d027e06259d51Content-Disposition: form-data; name="format"json------19b1895d027e06259d51--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:51:11 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----d4d9e1a2a609e8ae705b Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload::==> "------d4d9e1a2a609e8ae705bContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------d4d9e1a2a609e8ae705bContent-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------d4d9e1a2a609e8ae705bContent-Disposition: form-data; name="format"json------d4d9e1a2a609e8ae705b--" HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 5838 Date: Mon 06 Jul 2026 15:51:11 GMT Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----18b358eceb40739ad336 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload::==> "------18b358eceb40739ad336Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------18b358eceb40739ad336Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------18b358eceb40739ad336Content-Disposition: form-data; name="format"json------18b358eceb40739ad336--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:51:16 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----f10e0ff6754a87b73644 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload::==> "------f10e0ff6754a87b73644Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------f10e0ff6754a87b73644Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------f10e0ff6754a87b73644Content-Disposition: form-data; name="format"json------f10e0ff6754a87b73644--" HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 5839 Date: Mon 06 Jul 2026 15:51:16 GMT Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----a8de1fdd365ae206517a Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload::==> "------a8de1fdd365ae206517aContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------a8de1fdd365ae206517aContent-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------a8de1fdd365ae206517aContent-Disposition: form-data; name="format"json------a8de1fdd365ae206517a--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:51:21 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3660 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----bf6e340a0272f9be7041 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload::==> "------bf6e340a0272f9be7041Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------bf6e340a0272f9be7041Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------bf6e340a0272f9be7041Content-Disposition: form-data; name="format"json------bf6e340a0272f9be7041--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:51:30 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----d3f195d05d9c8bf15ba3 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload::==> "------d3f195d05d9c8bf15ba3Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------d3f195d05d9c8bf15ba3Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------d3f195d05d9c8bf15ba3Content-Disposition: form-data; name="format"json------d3f195d05d9c8bf15ba3--" HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 5839 Date: Mon 06 Jul 2026 15:51:30 GMT Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----a6336d37e9d90c24da60 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload::==> "------a6336d37e9d90c24da60Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------a6336d37e9d90c24da60Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------a6336d37e9d90c24da60Content-Disposition: form-data; name="format"json------a6336d37e9d90c24da60--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:51:35 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----726db8847d229f743f1a Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload::==> "------726db8847d229f743f1aContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------726db8847d229f743f1aContent-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------726db8847d229f743f1aContent-Disposition: form-data; name="format"json------726db8847d229f743f1a--" HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 5839 Date: Mon 06 Jul 2026 15:51:36 GMT Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----950f8bd901fae46c7065 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload::==> "------950f8bd901fae46c7065Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------950f8bd901fae46c7065Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------950f8bd901fae46c7065Content-Disposition: form-data; name="format"json------950f8bd901fae46c7065--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:51:41 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----456b34164628afafd001 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload::==> "------456b34164628afafd001Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------456b34164628afafd001Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------456b34164628afafd001Content-Disposition: form-data; name="format"json------456b34164628afafd001--" HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 5838 Date: Mon 06 Jul 2026 15:51:41 GMT Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----21fc2a70b01738762c02 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload::==> "------21fc2a70b01738762c02Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------21fc2a70b01738762c02Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------21fc2a70b01738762c02Content-Disposition: form-data; name="format"json------21fc2a70b01738762c02--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:51:46 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----1d3dc4c295654ef7d7d1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload::==> "------1d3dc4c295654ef7d7d1Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------1d3dc4c295654ef7d7d1Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------1d3dc4c295654ef7d7d1Content-Disposition: form-data; name="format"json------1d3dc4c295654ef7d7d1--" HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 5839 Date: Mon 06 Jul 2026 15:51:46 GMT Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----d52229f23a4860493037 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload::==> "------d52229f23a4860493037Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------d52229f23a4860493037Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------d52229f23a4860493037Content-Disposition: form-data; name="format"json------d52229f23a4860493037--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:51:50 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----fef583dfe20553e180e9 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload::==> "------fef583dfe20553e180e9Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------fef583dfe20553e180e9Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------fef583dfe20553e180e9Content-Disposition: form-data; name="format"json------fef583dfe20553e180e9--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:51:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3660 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----80f28dfb52b341a1a5fb Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload::==> "------80f28dfb52b341a1a5fbContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------80f28dfb52b341a1a5fbContent-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------80f28dfb52b341a1a5fbContent-Disposition: form-data; name="format"json------80f28dfb52b341a1a5fb--" HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 5838 Date: Mon 06 Jul 2026 15:51:57 GMT Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----0c5ee4584d364d4b4ce0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload::==> "------0c5ee4584d364d4b4ce0Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------0c5ee4584d364d4b4ce0Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------0c5ee4584d364d4b4ce0Content-Disposition: form-data; name="format"json------0c5ee4584d364d4b4ce0--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:52:01 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----0b41e0530cbc492efd3b Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload::==> "------0b41e0530cbc492efd3bContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------0b41e0530cbc492efd3bContent-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------0b41e0530cbc492efd3bContent-Disposition: form-data; name="format"json------0b41e0530cbc492efd3b--" HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.youtube-nocookie.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; Expires: Mon 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Content-Encoding: gzip Vary: Accept-Encoding Content-Length: 5838 Date: Mon 06 Jul 2026 15:52:01 GMT Connection: keep-alive with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C20636C6173733D2220726573706F6E73697665204465736B746F70554922206C616E673D22656E2220203E....... "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----d692965c2079092df9c5 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload::==> "------d692965c2079092df9c5Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------d692965c2079092df9c5Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------d692965c2079092df9c5Content-Disposition: form-data; name="format"json------d692965c2079092df9c5--" HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Mon 06 Jul 2026 15:52:06 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3661 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C.......4a:Td0c," "------5f9ecec30044c7af9359Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------5f9ecec30044c7af9359Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------5f9ecec30044c7af9359Content-Disposition: form-data; name="format"json------5f9ecec30044c7af9359--" "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----8d13540cff82e3a1ed67 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload:==> "------8d13540cff82e3a1ed67Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------8d13540cff82e3a1ed67Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------8d13540cff82e3a1ed67Content-Disposition: form-data; name="format"json------8d13540cff82e3a1ed67--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----1db980a207146a0c68ce Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------1db980a207146a0c68ceContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------1db980a207146a0c68ceContent-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------1db980a207146a0c68ceContent-Disposition: form-data; name="format"json------1db980a207146a0c68ce--" "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----9c86a38aebbeefa0cb69 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload:==> "------9c86a38aebbeefa0cb69Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------9c86a38aebbeefa0cb69Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------9c86a38aebbeefa0cb69Content-Disposition: form-data; name="format"json------9c86a38aebbeefa0cb69--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----e3e91b1dbb2c22fee7a9 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------e3e91b1dbb2c22fee7a9Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------e3e91b1dbb2c22fee7a9Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------e3e91b1dbb2c22fee7a9Content-Disposition: form-data; name="format"json------e3e91b1dbb2c22fee7a9--" "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----c03164e998de050a2c9c Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload:==> "------c03164e998de050a2c9cContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------c03164e998de050a2c9cContent-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------c03164e998de050a2c9cContent-Disposition: form-data; name="format"json------c03164e998de050a2c9c--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----19b1895d027e06259d51 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------19b1895d027e06259d51Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------19b1895d027e06259d51Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------19b1895d027e06259d51Content-Disposition: form-data; name="format"json------19b1895d027e06259d51--" "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----d4d9e1a2a609e8ae705b Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload:==> "------d4d9e1a2a609e8ae705bContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------d4d9e1a2a609e8ae705bContent-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------d4d9e1a2a609e8ae705bContent-Disposition: form-data; name="format"json------d4d9e1a2a609e8ae705b--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----18b358eceb40739ad336 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------18b358eceb40739ad336Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------18b358eceb40739ad336Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------18b358eceb40739ad336Content-Disposition: form-data; name="format"json------18b358eceb40739ad336--" "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----f10e0ff6754a87b73644 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload:==> "------f10e0ff6754a87b73644Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------f10e0ff6754a87b73644Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------f10e0ff6754a87b73644Content-Disposition: form-data; name="format"json------f10e0ff6754a87b73644--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----a8de1fdd365ae206517a Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------a8de1fdd365ae206517aContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------a8de1fdd365ae206517aContent-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------a8de1fdd365ae206517aContent-Disposition: form-data; name="format"json------a8de1fdd365ae206517a--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----bf6e340a0272f9be7041 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------bf6e340a0272f9be7041Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------bf6e340a0272f9be7041Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------bf6e340a0272f9be7041Content-Disposition: form-data; name="format"json------bf6e340a0272f9be7041--" "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----d3f195d05d9c8bf15ba3 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload:==> "------d3f195d05d9c8bf15ba3Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------d3f195d05d9c8bf15ba3Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------d3f195d05d9c8bf15ba3Content-Disposition: form-data; name="format"json------d3f195d05d9c8bf15ba3--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----a6336d37e9d90c24da60 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------a6336d37e9d90c24da60Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------a6336d37e9d90c24da60Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------a6336d37e9d90c24da60Content-Disposition: form-data; name="format"json------a6336d37e9d90c24da60--" "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----726db8847d229f743f1a Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload:==> "------726db8847d229f743f1aContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------726db8847d229f743f1aContent-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------726db8847d229f743f1aContent-Disposition: form-data; name="format"json------726db8847d229f743f1a--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----950f8bd901fae46c7065 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------950f8bd901fae46c7065Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------950f8bd901fae46c7065Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------950f8bd901fae46c7065Content-Disposition: form-data; name="format"json------950f8bd901fae46c7065--" "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----456b34164628afafd001 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload:==> "------456b34164628afafd001Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------456b34164628afafd001Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------456b34164628afafd001Content-Disposition: form-data; name="format"json------456b34164628afafd001--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----21fc2a70b01738762c02 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------21fc2a70b01738762c02Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------21fc2a70b01738762c02Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------21fc2a70b01738762c02Content-Disposition: form-data; name="format"json------21fc2a70b01738762c02--" "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----1d3dc4c295654ef7d7d1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload:==> "------1d3dc4c295654ef7d7d1Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------1d3dc4c295654ef7d7d1Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------1d3dc4c295654ef7d7d1Content-Disposition: form-data; name="format"json------1d3dc4c295654ef7d7d1--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----d52229f23a4860493037 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------d52229f23a4860493037Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------d52229f23a4860493037Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------d52229f23a4860493037Content-Disposition: form-data; name="format"json------d52229f23a4860493037--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----fef583dfe20553e180e9 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------fef583dfe20553e180e9Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------fef583dfe20553e180e9Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------fef583dfe20553e180e9Content-Disposition: form-data; name="format"json------fef583dfe20553e180e9--" "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----80f28dfb52b341a1a5fb Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload:==> "------80f28dfb52b341a1a5fbContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------80f28dfb52b341a1a5fbContent-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------80f28dfb52b341a1a5fbContent-Disposition: form-data; name="format"json------80f28dfb52b341a1a5fb--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----0c5ee4584d364d4b4ce0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------0c5ee4584d364d4b4ce0Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------0c5ee4584d364d4b4ce0Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------0c5ee4584d364d4b4ce0Content-Disposition: form-data; name="format"json------0c5ee4584d364d4b4ce0--" "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----0b41e0530cbc492efd3b Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload:==> "------0b41e0530cbc492efd3bContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------0b41e0530cbc492efd3bContent-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------0b41e0530cbc492efd3bContent-Disposition: form-data; name="format"json------0b41e0530cbc492efd3b--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----d692965c2079092df9c5 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------d692965c2079092df9c5Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------d692965c2079092df9c5Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------d692965c2079092df9c5Content-Disposition: form-data; name="format"json------d692965c2079092df9c5--" "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----87451a777922474180b6 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload:==> "------87451a777922474180b6Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------87451a777922474180b6Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------87451a777922474180b6Content-Disposition: form-data; name="format"json------87451a777922474180b6--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----a3c880a9c1e8bfb9ee05 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------a3c880a9c1e8bfb9ee05Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------a3c880a9c1e8bfb9ee05Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------a3c880a9c1e8bfb9ee05Content-Disposition: form-data; name="format"json------a3c880a9c1e8bfb9ee05--" "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----4e4c547359e7785ba9b3 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload:==> "------4e4c547359e7785ba9b3Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------4e4c547359e7785ba9b3Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------4e4c547359e7785ba9b3Content-Disposition: form-data; name="format"json------4e4c547359e7785ba9b3--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----807481a60327403e456a Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------807481a60327403e456aContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------807481a60327403e456aContent-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------807481a60327403e456aContent-Disposition: form-data; name="format"json------807481a60327403e456a--" "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----434ab9b060851cd4476e Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload:==> "------434ab9b060851cd4476eContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------434ab9b060851cd4476eContent-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------434ab9b060851cd4476eContent-Disposition: form-data; name="format"json------434ab9b060851cd4476e--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----35e911a6b457e87f6ece Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------35e911a6b457e87f6eceContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------35e911a6b457e87f6eceContent-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------35e911a6b457e87f6eceContent-Disposition: form-data; name="format"json------35e911a6b457e87f6ece--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----ce595063759c6f6b4013 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------ce595063759c6f6b4013Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------ce595063759c6f6b4013Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------ce595063759c6f6b4013Content-Disposition: form-data; name="format"json------ce595063759c6f6b4013--" "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----65363ff9b9c3fc840e76 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload:==> "------65363ff9b9c3fc840e76Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------65363ff9b9c3fc840e76Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------65363ff9b9c3fc840e76Content-Disposition: form-data; name="format"json------65363ff9b9c3fc840e76--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----8a0a5c1989a0ebd134f6 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------8a0a5c1989a0ebd134f6Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------8a0a5c1989a0ebd134f6Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------8a0a5c1989a0ebd134f6Content-Disposition: form-data; name="format"json------8a0a5c1989a0ebd134f6--" "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----aeb4422d950f22924b84 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload:==> "------aeb4422d950f22924b84Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------aeb4422d950f22924b84Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------aeb4422d950f22924b84Content-Disposition: form-data; name="format"json------aeb4422d950f22924b84--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----2a88c0b2ae9c6662f338 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------2a88c0b2ae9c6662f338Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------2a88c0b2ae9c6662f338Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------2a88c0b2ae9c6662f338Content-Disposition: form-data; name="format"json------2a88c0b2ae9c6662f338--" "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----ebec8c5a3ecda9f77a92 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload:==> "------ebec8c5a3ecda9f77a92Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------ebec8c5a3ecda9f77a92Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------ebec8c5a3ecda9f77a92Content-Disposition: form-data; name="format"json------ebec8c5a3ecda9f77a92--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----1cac0aed477959f91920 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------1cac0aed477959f91920Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------1cac0aed477959f91920Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------1cac0aed477959f91920Content-Disposition: form-data; name="format"json------1cac0aed477959f91920--" "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----e43f7a7b5c23eebd1211 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload:==> "------e43f7a7b5c23eebd1211Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------e43f7a7b5c23eebd1211Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------e43f7a7b5c23eebd1211Content-Disposition: form-data; name="format"json------e43f7a7b5c23eebd1211--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----8072051ba8f69baaa658 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------8072051ba8f69baaa658Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------8072051ba8f69baaa658Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------8072051ba8f69baaa658Content-Disposition: form-data; name="format"json------8072051ba8f69baaa658--" "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----b653dcceb879cf3f8a7d Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload:==> "------b653dcceb879cf3f8a7dContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------b653dcceb879cf3f8a7dContent-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------b653dcceb879cf3f8a7dContent-Disposition: form-data; name="format"json------b653dcceb879cf3f8a7d--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----05f32dc6b023f882eb85 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------05f32dc6b023f882eb85Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------05f32dc6b023f882eb85Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------05f32dc6b023f882eb85Content-Disposition: form-data; name="format"json------05f32dc6b023f882eb85--" "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----bf37f462eaa4bf0accc5 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload:==> "------bf37f462eaa4bf0accc5Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------bf37f462eaa4bf0accc5Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------bf37f462eaa4bf0accc5Content-Disposition: form-data; name="format"json------bf37f462eaa4bf0accc5--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----82137a9fc7ef64ed059d Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------82137a9fc7ef64ed059dContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------82137a9fc7ef64ed059dContent-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------82137a9fc7ef64ed059dContent-Disposition: form-data; name="format"json------82137a9fc7ef64ed059d--" "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----ee1b2ec9c7b667812a9d Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload:==> "------ee1b2ec9c7b667812a9dContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------ee1b2ec9c7b667812a9dContent-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------ee1b2ec9c7b667812a9dContent-Disposition: form-data; name="format"json------ee1b2ec9c7b667812a9d--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----738311437479ada21f42 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------738311437479ada21f42Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------738311437479ada21f42Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------738311437479ada21f42Content-Disposition: form-data; name="format"json------738311437479ada21f42--" "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----8116b5d7c01af6c8c44a Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload:==> "------8116b5d7c01af6c8c44aContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------8116b5d7c01af6c8c44aContent-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------8116b5d7c01af6c8c44aContent-Disposition: form-data; name="format"json------8116b5d7c01af6c8c44a--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----0f2313bb17d75d773d58 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------0f2313bb17d75d773d58Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------0f2313bb17d75d773d58Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------0f2313bb17d75d773d58Content-Disposition: form-data; name="format"json------0f2313bb17d75d773d58--" "POST /profiles/76561198684471717 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----ff6614bd170ed94dc500 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: steamcommunity.com Cookie: steamCountry=US%7Cdd89e304c87f19ea401ddd7cfd7158f5; sessionid=0516d3b258ae4702a3fa823f" with payload:==> "------ff6614bd170ed94dc500Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------ff6614bd170ed94dc500Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------ff6614bd170ed94dc500Content-Disposition: form-data; name="format"json------ff6614bd170ed94dc500--" "POST /t0mdr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----a5dd5ddeaec820a2de90 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0 Content-Length: 345 Host: telegram.me Cookie: stel_ssid=59687ae555972c250f_14486428535135335737" with payload:==> "------a5dd5ddeaec820a2de90Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-AC4391B------a5dd5ddeaec820a2de90Content-Disposition: form-data; name="build_id"62da7dcd35f91ae5bab7b1fb35ce2248------a5dd5ddeaec820a2de90Content-Disposition: form-data; name="format"json------a5dd5ddeaec820a2de90--"1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":88,"unified_at_epoch_ms":1790996825278,"unified_at":"2026-10-03T03:07:05.278Z","metadata":{"hashes":{"sha256":"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3","sha1":"390c2fd4ff2ffa07cab321eecf9623ec0625b00f","md5":"c0f539f5c7b3b42359d1c56d864bfe7d","sha512":"720bed38f50867157d2a349df83cf4039efe8ca28b9b1b3300af2da58356f6345071105589424116b952ce90af4660ae2efb6f3da0846a91c2beffc330c2ad4e","ssdeep":"49152:ltuPDBYu5mzKznz0SCohH7j6wkw04SVWqZE+j:lCFISb9j2DWqPj","ssdeep_chunks":["49152:ltuPDBY","49152:tuPDBYu","49152:uPDBYu5","49152:PDBYu5m","49152:DBYu5mz","49152:BYu5mzK","49152:Yu5mzKz","49152:u5mzKzn","49152:5mzKznz","49152:mzKznz0","49152:zKznz0S","49152:Kznz0SC","49152:znz0SCo","49152:nz0SCoh","49152:z0SCohH","49152:0SCohH7","49152:SCohH7j","49152:CohH7j6","49152:ohH7j6w","49152:hH7j6wk","49152:H7j6wkw","49152:7j6wkw0","49152:j6wkw04","49152:6wkw04S","49152:wkw04SV","49152:kw04SVW","49152:w04SVWq","49152:04SVWqZ","49152:4SVWqZE","49152:SVWqZE+","49152:VWqZE+j","98304:ltuPDBY","98304:tuPDBYu","98304:uPDBYu5","98304:PDBYu5m","98304:DBYu5mz","98304:BYu5mzK","98304:Yu5mzKz","98304:u5mzKzn","98304:5mzKznz","98304:mzKznz0","98304:zKznz0S","98304:Kznz0SC","98304:znz0SCo","98304:nz0SCoh","98304:z0SCohH","98304:0SCohH7","98304:SCohH7j","98304:CohH7j6","98304:ohH7j6w","98304:hH7j6wk","98304:H7j6wkw","98304:7j6wkw0","98304:j6wkw04","98304:6wkw04S","98304:wkw04SV","98304:kw04SVW","98304:w04SVWq","98304:04SVWqZ","98304:4SVWqZE","98304:SVWqZE+","98304:VWqZE+j","49152:lCFISb9","49152:CFISb9j","49152:FISb9j2","49152:ISb9j2D","49152:Sb9j2DW","49152:b9j2DWq","49152:9j2DWqP","49152:j2DWqPj"],"imphash":"d42595b695fc008ef2c56aabd8efd68e"},"file_info":{"file_name":"fps boost fix.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":3398000,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1782141652000,"last_seen":1783353028000,"last_multi_scan":1783353028000}},"detections":{"summary":{"verdict":"malicious","score":88,"tags":["commodity","vidarstealer","credentialharvesting","criminal","informationstealer","downloader","evasive"]},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":71},"sandbox_signatures":{"informative_count":150,"suspicious_count":16,"malicious_count":2,"total":168},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Evo-gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/Win64.Gobin","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.80605723","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.80605723 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of WinGo/Kryptik.TZ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Kryptik.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/W64.Obfuscated.h!crit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 006e1d061 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABTrojan.HAFT-6947","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.GenPsw.JUS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample contains the RDTSCP instruction"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Command and Control","technique":"Non-Standard Encoding","attack_id":"T1132.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/002","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a web server"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains possible references to Golang crypto modules"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"tactic":"Impact","technique":"Account Access Removal","attack_id":"T1531","attack_id_wiki":"https://attack.mitre.org/techniques/T1531","identifiers":[{"type":"informative","value":"Contains ability to delete a user account from a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")\n Found reference to API \"lINTERMEDIATESPECIAL-DOCKVirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")\n file/memory contains long string with (Indicator: \"VirtualFree\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")\n file/memory contains long string with (Indicator: \"VirtualAlloc\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"OpenThreadToken\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"file/memory contains long string with (Indicator: \"RegSetValue\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"file/memory contains long string with (Indicator: \"OpenService\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$27","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$28","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$29","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"crypto/internal/fips140/aes.decryptBlock\" (Indicator: \".decrypt\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")\n Found reference to API \"crypto/internal/fips140/aes.decryptBlockGeneric\" (Indicator: \".decrypt\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")\n Found reference to API \"crypto/internal/fips140/aes.decryptBlockAsm\" (Indicator: \".decrypt\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")\n Found reference to API \"crypto/internal/fips140/aes.decryptBlockAsm.abi0\" (Indicator: \".decrypt\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00006336-00000C2B-984532798\")\n Found reference to API \"BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"00000000-00006336-00000C2B-984532882\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00006336-00000C2B-984532906\")\n Found reference to API \"BCryptEncrypt\" (Indicator: \"BCryptEncrypt\"; Source: \"00000000-00006336-00000C2B-984532929\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00006336-00000C2B-984532957\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00006336-00000C2B-984532986\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"file/memory contains long string with (Indicator: \"CertCloseStore\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")\n file/memory contains long string with (Indicator: \"CryptReleaseContext\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")\n file/memory contains long string with (Indicator: \"CertOpenSystemStore\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")\n file/memory contains long string with (Indicator: \"CryptAcquireContext\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")\n file/memory contains long string with (Indicator: \"CertFreeCertificateContext\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")\n file/memory contains long string with (Indicator: \"CertEnumCertificatesInStore\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains possible references to Golang crypto modules","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"details too long to display","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2c","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2d","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006336-00000C2B-984393054\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006336-00000C2B-984393054\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")\n Found string \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")\n Found string \"syscall.procGetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006336-00000C2B-984205244\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"file/memory contains long string(File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\"\n Found system information discovery API: \"GetSystemInfo\" in file \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\"\n Found system information discovery API: \"GetEnvironmentStrings (in long string)\" in file \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\"\n Found system information discovery API: \"ExpandEnvironmentStrings (in long string)\" in file \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\"\n Found system information discovery API: \"RtlNtStatusToDosError (in long string)\" in file \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\"\n Found system information discovery API: \"internal/syscall/windows.procRtlNtStatusToDosErrorNoTeb\" in file \"a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3.bin\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a4bcec3e2692c9fe50711da"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Sets the 'ThreadHideFromDebugger' thread data structure","description":"\"