We obtained oRAT samples that register these routes:   GET /agent/info GET /agent/ping POST /agent/upload GET /agent/download GET /agent/screenshot GET /agent/zip GET /agent/unzip GET /agent/kill-self GET /agent/portscan GET /agent/proxy GET /agent/ssh GET /agent/net  PuppetDownloaders (C++ downloaders)